xmrig | b1d9248f4a3605d972808675e3e08b526656f82ca1b9beb6718d65ff3aac9940

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
Size

2.2MB
MD5

0f95b38fa957dfc7484d8cf542f413e8
SHA1

7f5e84674836e0f167a7913edce52b84e5572c74
SHA256

b1d9248f4a3605d972808675e3e08b526656f82ca1b9beb6718d65ff3aac9940
SHA512

a415094bd89cea4f0e7ca7b82960d8918fd3a8835ac1ca92946a3b3879eed281b84456fc6c5abd721454d6bff10c79dd41f29f31ac269686495901e89237a489
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr3:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-51-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2220-63-0x00000000030E0000-0x00000000034D2000-memory.dmp	xmrig
behavioral1/memory/2220-72-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2988-76-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2688-104-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2500-71-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2396-69-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2652-67-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2616-65-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2872-59-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2220-1579-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2508-3453-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2532-4561-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2640-4562-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2872-5168-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2616-5285-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2500-5296-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2688-5301-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2640-5300-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2508-5412-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2472	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2508	aiiZHUN.exe
2532	YhVZfBF.exe
2640	mGIQdoY.exe
2872	JkossAn.exe
2616	LFqNLZg.exe
2652	kVDSLlA.exe
2396	FcJLvwz.exe
2500	efcNTYR.exe
2988	jJbXVOJ.exe
2556	TlfskAh.exe
2688	TcydusW.exe
1244	mpOUKkI.exe
1604	mffhrYI.exe
2288	cTVZEFo.exe
2096	qyWboXz.exe
1552	vNiGFCw.exe
2468	jxzOVhi.exe
2036	wNXYrDk.exe
2832	BiqGjPY.exe
2136	ZBklOgN.exe
624	Nhaqecf.exe
1232	GizanSX.exe
1688	HIPivvf.exe
2168	nUaSDyA.exe
2196	HKAQaJm.exe
1724	nRiaGSs.exe
684	slGRyQT.exe
788	SbfCBqo.exe
2924	hbpmPTO.exe
2976	OHerXUE.exe
824	UeXtgDn.exe
1596	XYbJKaq.exe
912	hFKmkVg.exe
1680	SafpFIQ.exe
1684	yUlLROr.exe
2084	VkhtSKH.exe
856	GKCIFnT.exe
2744	qDKjSQp.exe
2176	hSbFNhF.exe
1652	MpHDzMn.exe
2204	fnYKHMd.exe
3068	IPwAGqP.exe
1736	gIKEgvW.exe
292	vJoXxvu.exe
1468	GDCWdzg.exe
1628	CDXZlgy.exe
2892	WyAZwlh.exe
2300	AXuOjIA.exe
1528	HdyLwdY.exe
2664	VtstjDH.exe
2404	JuJULgg.exe
2920	cezGLrF.exe
2432	VCYjkEp.exe
2440	GZAOGcn.exe
1564	JTajaVg.exe
860	yaqtKSB.exe
1772	dqQcQNg.exe
2576	vGGzjUO.exe
1404	TldhIUN.exe
2808	UAoPQtl.exe
1416	aenwOtg.exe
2040	WBrycjU.exe
2060	cRSVtsa.exe
2324	lfvskxP.exe

Loads dropped DLL 64 IoCs

pid	Process
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-2-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x000c00000001315b-7.dat	upx
behavioral1/memory/2508-8-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/files/0x003900000001340c-12.dat	upx
behavioral1/files/0x0008000000013a30-26.dat	upx
behavioral1/files/0x0009000000013a72-34.dat	upx
behavioral1/files/0x0008000000013ab9-38.dat	upx
behavioral1/files/0x0006000000014662-48.dat	upx
behavioral1/files/0x0007000000014588-46.dat	upx
behavioral1/files/0x000900000001416a-43.dat	upx
behavioral1/files/0x001800000000558a-30.dat	upx
behavioral1/memory/2640-51-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2988-76-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0006000000014702-81.dat	upx
behavioral1/files/0x00060000000155f6-136.dat	upx
behavioral1/files/0x0006000000014ba7-141.dat	upx
behavioral1/files/0x000600000001502c-123.dat	upx
behavioral1/files/0x0006000000015ba8-165.dat	upx
behavioral1/files/0x0006000000015c4c-167.dat	upx
behavioral1/files/0x0006000000015c85-186.dat	upx
behavioral1/files/0x0006000000015c6f-182.dat	upx
behavioral1/files/0x0006000000015c5a-174.dat	upx
behavioral1/files/0x0006000000015c93-191.dat	upx
behavioral1/files/0x000600000001564d-161.dat	upx
behavioral1/files/0x0006000000015645-152.dat	upx
behavioral1/files/0x000600000001540d-150.dat	upx
behavioral1/files/0x00060000000153c7-148.dat	upx
behavioral1/files/0x0006000000014eb9-146.dat	upx
behavioral1/files/0x00060000000153d9-130.dat	upx
behavioral1/files/0x00390000000136ec-156.dat	upx
behavioral1/files/0x0006000000014dae-116.dat	upx
behavioral1/files/0x0006000000014b10-109.dat	upx
behavioral1/files/0x0006000000014b36-108.dat	upx
behavioral1/files/0x000600000001480e-100.dat	upx
behavioral1/memory/2556-95-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x00060000000149e1-94.dat	upx
behavioral1/memory/2688-104-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x00060000000146f8-79.dat	upx
behavioral1/memory/2500-71-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2396-69-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2652-67-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/memory/2616-65-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2872-59-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2532-20-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2220-1579-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2508-3453-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2532-4561-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2640-4562-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2872-5168-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2616-5285-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2500-5296-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2688-5301-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2640-5300-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2508-5412-0x000000013F640000-0x000000013FA32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bnvGAYu.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\CMhGhAU.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\pCaPNBq.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\SNOeBfg.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\IBqALtT.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\YrNzzNy.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\GpTyWnJ.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\IMxqhDI.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\JrqGDGi.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\jUrbosF.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\yVzstoe.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\WkrVjLx.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\gQxRlnY.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\bejBTRo.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\AfHINEP.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\ChNjZUN.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\nEOCNBb.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\eRORCYa.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\YPhJCbw.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\rqDKxfe.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\HIPivvf.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\JwALGkf.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\wveskRY.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LsLtuJk.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\yKrUhek.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\AmfiisK.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\Uxbjnhy.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\xvVVUUp.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\QlOBbyH.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\XHUzetu.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\soEMdel.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LKayFYp.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\QWBpKRx.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LoOwyof.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\vgeBZfw.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\wbSwmPn.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\JVSDVtM.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LLtWVkA.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\pvEtzop.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\oKXIBjM.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\tlJQEdH.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\EEtVfRu.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\mRCpYle.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\jcHXXVQ.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LZWsIhr.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\xjXZBGl.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\sKYzvaT.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\zTCjPAc.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\aTLRAlJ.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\cHycccE.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\jGxzsXl.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\pRCbAel.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\xmspHra.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\YoZCRCh.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\DScLtgG.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\UeXtgDn.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\zovRFnE.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\YChgJMH.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\LTrJeQo.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\GbiAwWd.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\AltjqVd.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\AMjAQda.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\IvxyMLg.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
File created	C:\Windows\System\dRzdcTo.exe	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2472	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
Token: SeDebugPrivilege	2472	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2472	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2472	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2472	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2508	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2508	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2508	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2532	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2532	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2532	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2640	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2640	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2640	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2872	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2872	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2872	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2616	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2616	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2616	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2652	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2652	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2652	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2396	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2396	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2396	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2500	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2500	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2500	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2988	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2988	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2988	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2556	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2556	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2556	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2688	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	40
PID 2220 wrote to memory of 2688	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	40
PID 2220 wrote to memory of 2688	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	40
PID 2220 wrote to memory of 1604	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	41
PID 2220 wrote to memory of 1604	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	41
PID 2220 wrote to memory of 1604	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	41
PID 2220 wrote to memory of 1244	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	42
PID 2220 wrote to memory of 1244	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	42
PID 2220 wrote to memory of 1244	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2096	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2096	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2096	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2288	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	44
PID 2220 wrote to memory of 2288	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	44
PID 2220 wrote to memory of 2288	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	44
PID 2220 wrote to memory of 2136	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	45
PID 2220 wrote to memory of 2136	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	45
PID 2220 wrote to memory of 2136	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	45
PID 2220 wrote to memory of 1552	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	46
PID 2220 wrote to memory of 1552	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	46
PID 2220 wrote to memory of 1552	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	46
PID 2220 wrote to memory of 624	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	47
PID 2220 wrote to memory of 624	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	47
PID 2220 wrote to memory of 624	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	47
PID 2220 wrote to memory of 2468	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	48
PID 2220 wrote to memory of 2468	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	48
PID 2220 wrote to memory of 2468	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1232	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	49
PID 2220 wrote to memory of 1232	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	49
PID 2220 wrote to memory of 1232	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	49
PID 2220 wrote to memory of 2036	2220	0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f95b38fa957dfc7484d8cf542f413e8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System\aiiZHUN.exe
  C:\Windows\System\aiiZHUN.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\YhVZfBF.exe
  C:\Windows\System\YhVZfBF.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\mGIQdoY.exe
  C:\Windows\System\mGIQdoY.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\JkossAn.exe
  C:\Windows\System\JkossAn.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\LFqNLZg.exe
  C:\Windows\System\LFqNLZg.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\kVDSLlA.exe
  C:\Windows\System\kVDSLlA.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\FcJLvwz.exe
  C:\Windows\System\FcJLvwz.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\efcNTYR.exe
  C:\Windows\System\efcNTYR.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\jJbXVOJ.exe
  C:\Windows\System\jJbXVOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\TlfskAh.exe
  C:\Windows\System\TlfskAh.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\TcydusW.exe
  C:\Windows\System\TcydusW.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\mffhrYI.exe
  C:\Windows\System\mffhrYI.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\mpOUKkI.exe
  C:\Windows\System\mpOUKkI.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\qyWboXz.exe
  C:\Windows\System\qyWboXz.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\cTVZEFo.exe
  C:\Windows\System\cTVZEFo.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\ZBklOgN.exe
  C:\Windows\System\ZBklOgN.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\vNiGFCw.exe
  C:\Windows\System\vNiGFCw.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\Nhaqecf.exe
  C:\Windows\System\Nhaqecf.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\jxzOVhi.exe
  C:\Windows\System\jxzOVhi.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\GizanSX.exe
  C:\Windows\System\GizanSX.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\wNXYrDk.exe
  C:\Windows\System\wNXYrDk.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\HIPivvf.exe
  C:\Windows\System\HIPivvf.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\BiqGjPY.exe
  C:\Windows\System\BiqGjPY.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\nUaSDyA.exe
  C:\Windows\System\nUaSDyA.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\HKAQaJm.exe
  C:\Windows\System\HKAQaJm.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\nRiaGSs.exe
  C:\Windows\System\nRiaGSs.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\slGRyQT.exe
  C:\Windows\System\slGRyQT.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\hbpmPTO.exe
  C:\Windows\System\hbpmPTO.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\SbfCBqo.exe
  C:\Windows\System\SbfCBqo.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\OHerXUE.exe
  C:\Windows\System\OHerXUE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\UeXtgDn.exe
  C:\Windows\System\UeXtgDn.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\XYbJKaq.exe
  C:\Windows\System\XYbJKaq.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\hFKmkVg.exe
  C:\Windows\System\hFKmkVg.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\SafpFIQ.exe
  C:\Windows\System\SafpFIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\yUlLROr.exe
  C:\Windows\System\yUlLROr.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\GKCIFnT.exe
  C:\Windows\System\GKCIFnT.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\VkhtSKH.exe
  C:\Windows\System\VkhtSKH.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\MpHDzMn.exe
  C:\Windows\System\MpHDzMn.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\qDKjSQp.exe
  C:\Windows\System\qDKjSQp.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\fnYKHMd.exe
  C:\Windows\System\fnYKHMd.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\hSbFNhF.exe
  C:\Windows\System\hSbFNhF.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\gIKEgvW.exe
  C:\Windows\System\gIKEgvW.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\IPwAGqP.exe
  C:\Windows\System\IPwAGqP.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\vJoXxvu.exe
  C:\Windows\System\vJoXxvu.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\GDCWdzg.exe
  C:\Windows\System\GDCWdzg.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\CDXZlgy.exe
  C:\Windows\System\CDXZlgy.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\WyAZwlh.exe
  C:\Windows\System\WyAZwlh.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\AXuOjIA.exe
  C:\Windows\System\AXuOjIA.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\HdyLwdY.exe
  C:\Windows\System\HdyLwdY.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\VtstjDH.exe
  C:\Windows\System\VtstjDH.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JuJULgg.exe
  C:\Windows\System\JuJULgg.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\cezGLrF.exe
  C:\Windows\System\cezGLrF.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\VCYjkEp.exe
  C:\Windows\System\VCYjkEp.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\GZAOGcn.exe
  C:\Windows\System\GZAOGcn.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\JTajaVg.exe
  C:\Windows\System\JTajaVg.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\yaqtKSB.exe
  C:\Windows\System\yaqtKSB.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\dqQcQNg.exe
  C:\Windows\System\dqQcQNg.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\vGGzjUO.exe
  C:\Windows\System\vGGzjUO.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\TldhIUN.exe
  C:\Windows\System\TldhIUN.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\WBrycjU.exe
  C:\Windows\System\WBrycjU.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\UAoPQtl.exe
  C:\Windows\System\UAoPQtl.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\cRSVtsa.exe
  C:\Windows\System\cRSVtsa.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\aenwOtg.exe
  C:\Windows\System\aenwOtg.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\lfvskxP.exe
  C:\Windows\System\lfvskxP.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\ZwXGpDx.exe
  C:\Windows\System\ZwXGpDx.exe
  2⤵
  PID:2416
- C:\Windows\System\pdTgvgS.exe
  C:\Windows\System\pdTgvgS.exe
  2⤵
  PID:1840
- C:\Windows\System\CgkMLlq.exe
  C:\Windows\System\CgkMLlq.exe
  2⤵
  PID:2904
- C:\Windows\System\sXaUfLJ.exe
  C:\Windows\System\sXaUfLJ.exe
  2⤵
  PID:1216
- C:\Windows\System\HVobVzL.exe
  C:\Windows\System\HVobVzL.exe
  2⤵
  PID:2740
- C:\Windows\System\whhTspB.exe
  C:\Windows\System\whhTspB.exe
  2⤵
  PID:2588
- C:\Windows\System\XRRTpYb.exe
  C:\Windows\System\XRRTpYb.exe
  2⤵
  PID:1936
- C:\Windows\System\OLYOBOH.exe
  C:\Windows\System\OLYOBOH.exe
  2⤵
  PID:300
- C:\Windows\System\svMJXvd.exe
  C:\Windows\System\svMJXvd.exe
  2⤵
  PID:2492
- C:\Windows\System\ASZXGlL.exe
  C:\Windows\System\ASZXGlL.exe
  2⤵
  PID:1432
- C:\Windows\System\kDAwDHm.exe
  C:\Windows\System\kDAwDHm.exe
  2⤵
  PID:2208
- C:\Windows\System\IdTwLnw.exe
  C:\Windows\System\IdTwLnw.exe
  2⤵
  PID:2864
- C:\Windows\System\zctbaGn.exe
  C:\Windows\System\zctbaGn.exe
  2⤵
  PID:1676
- C:\Windows\System\uNzzrIf.exe
  C:\Windows\System\uNzzrIf.exe
  2⤵
  PID:572
- C:\Windows\System\qOrjjAl.exe
  C:\Windows\System\qOrjjAl.exe
  2⤵
  PID:1956
- C:\Windows\System\AzbHOeS.exe
  C:\Windows\System\AzbHOeS.exe
  2⤵
  PID:1932
- C:\Windows\System\QfVJBcX.exe
  C:\Windows\System\QfVJBcX.exe
  2⤵
  PID:2348
- C:\Windows\System\wMKxUor.exe
  C:\Windows\System\wMKxUor.exe
  2⤵
  PID:1536
- C:\Windows\System\ekQrgKm.exe
  C:\Windows\System\ekQrgKm.exe
  2⤵
  PID:2456
- C:\Windows\System\EDOEWhi.exe
  C:\Windows\System\EDOEWhi.exe
  2⤵
  PID:2340
- C:\Windows\System\orfUHdt.exe
  C:\Windows\System\orfUHdt.exe
  2⤵
  PID:2544
- C:\Windows\System\MQQUuir.exe
  C:\Windows\System\MQQUuir.exe
  2⤵
  PID:2372
- C:\Windows\System\mchYHKQ.exe
  C:\Windows\System\mchYHKQ.exe
  2⤵
  PID:2428
- C:\Windows\System\BKInDNV.exe
  C:\Windows\System\BKInDNV.exe
  2⤵
  PID:1540
- C:\Windows\System\qBFzqym.exe
  C:\Windows\System\qBFzqym.exe
  2⤵
  PID:1856
- C:\Windows\System\ejUNXey.exe
  C:\Windows\System\ejUNXey.exe
  2⤵
  PID:404
- C:\Windows\System\TQkErKo.exe
  C:\Windows\System\TQkErKo.exe
  2⤵
  PID:1996
- C:\Windows\System\xTADmuG.exe
  C:\Windows\System\xTADmuG.exe
  2⤵
  PID:2848
- C:\Windows\System\kepgjWH.exe
  C:\Windows\System\kepgjWH.exe
  2⤵
  PID:2696
- C:\Windows\System\dfSKWtE.exe
  C:\Windows\System\dfSKWtE.exe
  2⤵
  PID:2312
- C:\Windows\System\rhTURhr.exe
  C:\Windows\System\rhTURhr.exe
  2⤵
  PID:996
- C:\Windows\System\XYcRbUC.exe
  C:\Windows\System\XYcRbUC.exe
  2⤵
  PID:832
- C:\Windows\System\hWGbKQA.exe
  C:\Windows\System\hWGbKQA.exe
  2⤵
  PID:2400
- C:\Windows\System\tKQFjsC.exe
  C:\Windows\System\tKQFjsC.exe
  2⤵
  PID:2528
- C:\Windows\System\byZYaBr.exe
  C:\Windows\System\byZYaBr.exe
  2⤵
  PID:1748
- C:\Windows\System\ircjmVd.exe
  C:\Windows\System\ircjmVd.exe
  2⤵
  PID:884
- C:\Windows\System\lCRJJXY.exe
  C:\Windows\System\lCRJJXY.exe
  2⤵
  PID:848
- C:\Windows\System\JYYAxxo.exe
  C:\Windows\System\JYYAxxo.exe
  2⤵
  PID:2980
- C:\Windows\System\jRfNHZm.exe
  C:\Windows\System\jRfNHZm.exe
  2⤵
  PID:1904
- C:\Windows\System\ZfYfPWs.exe
  C:\Windows\System\ZfYfPWs.exe
  2⤵
  PID:2628
- C:\Windows\System\pNMtKQr.exe
  C:\Windows\System\pNMtKQr.exe
  2⤵
  PID:2272
- C:\Windows\System\AgiFakS.exe
  C:\Windows\System\AgiFakS.exe
  2⤵
  PID:2016
- C:\Windows\System\occlYUb.exe
  C:\Windows\System\occlYUb.exe
  2⤵
  PID:2548
- C:\Windows\System\nEZsNwL.exe
  C:\Windows\System\nEZsNwL.exe
  2⤵
  PID:2732
- C:\Windows\System\MnpOYix.exe
  C:\Windows\System\MnpOYix.exe
  2⤵
  PID:3020
- C:\Windows\System\ontXgGk.exe
  C:\Windows\System\ontXgGk.exe
  2⤵
  PID:2812
- C:\Windows\System\sAFnxUK.exe
  C:\Windows\System\sAFnxUK.exe
  2⤵
  PID:1504
- C:\Windows\System\nTbzzoQ.exe
  C:\Windows\System\nTbzzoQ.exe
  2⤵
  PID:2580
- C:\Windows\System\UzUpwwy.exe
  C:\Windows\System\UzUpwwy.exe
  2⤵
  PID:2996
- C:\Windows\System\RsMEAgg.exe
  C:\Windows\System\RsMEAgg.exe
  2⤵
  PID:2932
- C:\Windows\System\phqisix.exe
  C:\Windows\System\phqisix.exe
  2⤵
  PID:284
- C:\Windows\System\qyVcvLv.exe
  C:\Windows\System\qyVcvLv.exe
  2⤵
  PID:1136
- C:\Windows\System\ZGqBQdF.exe
  C:\Windows\System\ZGqBQdF.exe
  2⤵
  PID:1924
- C:\Windows\System\LNPkykj.exe
  C:\Windows\System\LNPkykj.exe
  2⤵
  PID:984
- C:\Windows\System\wymLSXO.exe
  C:\Windows\System\wymLSXO.exe
  2⤵
  PID:980
- C:\Windows\System\BpdKdVL.exe
  C:\Windows\System\BpdKdVL.exe
  2⤵
  PID:2896
- C:\Windows\System\KrBVIDe.exe
  C:\Windows\System\KrBVIDe.exe
  2⤵
  PID:952
- C:\Windows\System\ptKUUvz.exe
  C:\Windows\System\ptKUUvz.exe
  2⤵
  PID:1304
- C:\Windows\System\uixTxNV.exe
  C:\Windows\System\uixTxNV.exe
  2⤵
  PID:2380
- C:\Windows\System\JFAdiwC.exe
  C:\Windows\System\JFAdiwC.exe
  2⤵
  PID:1444
- C:\Windows\System\rjWOiGJ.exe
  C:\Windows\System\rjWOiGJ.exe
  2⤵
  PID:2736
- C:\Windows\System\lfzBaHD.exe
  C:\Windows\System\lfzBaHD.exe
  2⤵
  PID:2132
- C:\Windows\System\poqrUPt.exe
  C:\Windows\System\poqrUPt.exe
  2⤵
  PID:1548
- C:\Windows\System\wyCfRSi.exe
  C:\Windows\System\wyCfRSi.exe
  2⤵
  PID:2388
- C:\Windows\System\dwiHJvQ.exe
  C:\Windows\System\dwiHJvQ.exe
  2⤵
  PID:1288
- C:\Windows\System\llQUUZl.exe
  C:\Windows\System\llQUUZl.exe
  2⤵
  PID:2356
- C:\Windows\System\wSUhSBS.exe
  C:\Windows\System\wSUhSBS.exe
  2⤵
  PID:2596
- C:\Windows\System\AXrOBqz.exe
  C:\Windows\System\AXrOBqz.exe
  2⤵
  PID:2128
- C:\Windows\System\KVaREKH.exe
  C:\Windows\System\KVaREKH.exe
  2⤵
  PID:2792
- C:\Windows\System\xOFgEuh.exe
  C:\Windows\System\xOFgEuh.exe
  2⤵
  PID:1456
- C:\Windows\System\SEOOJsS.exe
  C:\Windows\System\SEOOJsS.exe
  2⤵
  PID:1988
- C:\Windows\System\durxERu.exe
  C:\Windows\System\durxERu.exe
  2⤵
  PID:2876
- C:\Windows\System\OnLFiMl.exe
  C:\Windows\System\OnLFiMl.exe
  2⤵
  PID:1656
- C:\Windows\System\rIWaMwe.exe
  C:\Windows\System\rIWaMwe.exe
  2⤵
  PID:2284
- C:\Windows\System\XylYGtA.exe
  C:\Windows\System\XylYGtA.exe
  2⤵
  PID:1672
- C:\Windows\System\uRECeGv.exe
  C:\Windows\System\uRECeGv.exe
  2⤵
  PID:2620
- C:\Windows\System\qsnfcjs.exe
  C:\Windows\System\qsnfcjs.exe
  2⤵
  PID:2140
- C:\Windows\System\fyeDGcL.exe
  C:\Windows\System\fyeDGcL.exe
  2⤵
  PID:2960
- C:\Windows\System\hvqhBTT.exe
  C:\Windows\System\hvqhBTT.exe
  2⤵
  PID:2120
- C:\Windows\System\auKCeNS.exe
  C:\Windows\System\auKCeNS.exe
  2⤵
  PID:1268
- C:\Windows\System\VoyKfPB.exe
  C:\Windows\System\VoyKfPB.exe
  2⤵
  PID:1280
- C:\Windows\System\pvKQzKa.exe
  C:\Windows\System\pvKQzKa.exe
  2⤵
  PID:2844
- C:\Windows\System\YnwBjVU.exe
  C:\Windows\System\YnwBjVU.exe
  2⤵
  PID:2316
- C:\Windows\System\babarJA.exe
  C:\Windows\System\babarJA.exe
  2⤵
  PID:756
- C:\Windows\System\oRnNDVg.exe
  C:\Windows\System\oRnNDVg.exe
  2⤵
  PID:2052
- C:\Windows\System\dveasdD.exe
  C:\Windows\System\dveasdD.exe
  2⤵
  PID:1452
- C:\Windows\System\fwqmueS.exe
  C:\Windows\System\fwqmueS.exe
  2⤵
  PID:1972
- C:\Windows\System\RJCwQyQ.exe
  C:\Windows\System\RJCwQyQ.exe
  2⤵
  PID:2148
- C:\Windows\System\WnbKVai.exe
  C:\Windows\System\WnbKVai.exe
  2⤵
  PID:2012
- C:\Windows\System\IcNYRoa.exe
  C:\Windows\System\IcNYRoa.exe
  2⤵
  PID:1992
- C:\Windows\System\tLhJhOa.exe
  C:\Windows\System\tLhJhOa.exe
  2⤵
  PID:3084
- C:\Windows\System\uAxPjuJ.exe
  C:\Windows\System\uAxPjuJ.exe
  2⤵
  PID:3100
- C:\Windows\System\klLAvIL.exe
  C:\Windows\System\klLAvIL.exe
  2⤵
  PID:3120
- C:\Windows\System\EZknfBE.exe
  C:\Windows\System\EZknfBE.exe
  2⤵
  PID:3136
- C:\Windows\System\nbxywrw.exe
  C:\Windows\System\nbxywrw.exe
  2⤵
  PID:3152
- C:\Windows\System\lwNaUzD.exe
  C:\Windows\System\lwNaUzD.exe
  2⤵
  PID:3168
- C:\Windows\System\GFnPAwv.exe
  C:\Windows\System\GFnPAwv.exe
  2⤵
  PID:3184
- C:\Windows\System\qqBGjyC.exe
  C:\Windows\System\qqBGjyC.exe
  2⤵
  PID:3200
- C:\Windows\System\GAhVPNX.exe
  C:\Windows\System\GAhVPNX.exe
  2⤵
  PID:3216
- C:\Windows\System\izjNJIm.exe
  C:\Windows\System\izjNJIm.exe
  2⤵
  PID:3240
- C:\Windows\System\ntJGQBX.exe
  C:\Windows\System\ntJGQBX.exe
  2⤵
  PID:3256
- C:\Windows\System\xNbcWFo.exe
  C:\Windows\System\xNbcWFo.exe
  2⤵
  PID:3272
- C:\Windows\System\VBmejnT.exe
  C:\Windows\System\VBmejnT.exe
  2⤵
  PID:3288
- C:\Windows\System\smauEyE.exe
  C:\Windows\System\smauEyE.exe
  2⤵
  PID:3304
- C:\Windows\System\IyMvZHl.exe
  C:\Windows\System\IyMvZHl.exe
  2⤵
  PID:3324
- C:\Windows\System\rzNHxGd.exe
  C:\Windows\System\rzNHxGd.exe
  2⤵
  PID:3340
- C:\Windows\System\SRvkTNn.exe
  C:\Windows\System\SRvkTNn.exe
  2⤵
  PID:3356
- C:\Windows\System\wRsMzOs.exe
  C:\Windows\System\wRsMzOs.exe
  2⤵
  PID:3372
- C:\Windows\System\AzQHMEK.exe
  C:\Windows\System\AzQHMEK.exe
  2⤵
  PID:3388
- C:\Windows\System\TFYwRRN.exe
  C:\Windows\System\TFYwRRN.exe
  2⤵
  PID:3404
- C:\Windows\System\TwLhcXb.exe
  C:\Windows\System\TwLhcXb.exe
  2⤵
  PID:3424
- C:\Windows\System\YHoNnvO.exe
  C:\Windows\System\YHoNnvO.exe
  2⤵
  PID:3440
- C:\Windows\System\VSYmgOE.exe
  C:\Windows\System\VSYmgOE.exe
  2⤵
  PID:3456
- C:\Windows\System\kHIoFDb.exe
  C:\Windows\System\kHIoFDb.exe
  2⤵
  PID:3472
- C:\Windows\System\sxbVNSn.exe
  C:\Windows\System\sxbVNSn.exe
  2⤵
  PID:3488
- C:\Windows\System\KYMxqrN.exe
  C:\Windows\System\KYMxqrN.exe
  2⤵
  PID:3504
- C:\Windows\System\sTHcQkW.exe
  C:\Windows\System\sTHcQkW.exe
  2⤵
  PID:3520
- C:\Windows\System\FWwVoPG.exe
  C:\Windows\System\FWwVoPG.exe
  2⤵
  PID:3536
- C:\Windows\System\fMENENq.exe
  C:\Windows\System\fMENENq.exe
  2⤵
  PID:3556
- C:\Windows\System\GzOYIzv.exe
  C:\Windows\System\GzOYIzv.exe
  2⤵
  PID:3572
- C:\Windows\System\kRQdRbb.exe
  C:\Windows\System\kRQdRbb.exe
  2⤵
  PID:3588
- C:\Windows\System\TkJKysK.exe
  C:\Windows\System\TkJKysK.exe
  2⤵
  PID:3604
- C:\Windows\System\nrAuroe.exe
  C:\Windows\System\nrAuroe.exe
  2⤵
  PID:3620
- C:\Windows\System\IYxDaeC.exe
  C:\Windows\System\IYxDaeC.exe
  2⤵
  PID:3636
- C:\Windows\System\ZiTCPFy.exe
  C:\Windows\System\ZiTCPFy.exe
  2⤵
  PID:3652
- C:\Windows\System\GmCcLtx.exe
  C:\Windows\System\GmCcLtx.exe
  2⤵
  PID:3668
- C:\Windows\System\tFLlppZ.exe
  C:\Windows\System\tFLlppZ.exe
  2⤵
  PID:3688
- C:\Windows\System\iANXPZC.exe
  C:\Windows\System\iANXPZC.exe
  2⤵
  PID:3704
- C:\Windows\System\iGafgTU.exe
  C:\Windows\System\iGafgTU.exe
  2⤵
  PID:3724
- C:\Windows\System\PKRFCQF.exe
  C:\Windows\System\PKRFCQF.exe
  2⤵
  PID:3740
- C:\Windows\System\BYfoSuY.exe
  C:\Windows\System\BYfoSuY.exe
  2⤵
  PID:3756
- C:\Windows\System\YupQhxs.exe
  C:\Windows\System\YupQhxs.exe
  2⤵
  PID:3772
- C:\Windows\System\EpMRgUR.exe
  C:\Windows\System\EpMRgUR.exe
  2⤵
  PID:3788
- C:\Windows\System\eTikqSt.exe
  C:\Windows\System\eTikqSt.exe
  2⤵
  PID:3804
- C:\Windows\System\aJOBIUd.exe
  C:\Windows\System\aJOBIUd.exe
  2⤵
  PID:3824
- C:\Windows\System\uSyQrqL.exe
  C:\Windows\System\uSyQrqL.exe
  2⤵
  PID:3840
- C:\Windows\System\QRfJxxk.exe
  C:\Windows\System\QRfJxxk.exe
  2⤵
  PID:3856
- C:\Windows\System\phHbAaD.exe
  C:\Windows\System\phHbAaD.exe
  2⤵
  PID:3872
- C:\Windows\System\hhWtlYA.exe
  C:\Windows\System\hhWtlYA.exe
  2⤵
  PID:3888
- C:\Windows\System\NXcgjmC.exe
  C:\Windows\System\NXcgjmC.exe
  2⤵
  PID:3904
- C:\Windows\System\vsKRSOL.exe
  C:\Windows\System\vsKRSOL.exe
  2⤵
  PID:3920
- C:\Windows\System\lhSmbFL.exe
  C:\Windows\System\lhSmbFL.exe
  2⤵
  PID:3940
- C:\Windows\System\AOvKeyr.exe
  C:\Windows\System\AOvKeyr.exe
  2⤵
  PID:3956
- C:\Windows\System\vggqqOq.exe
  C:\Windows\System\vggqqOq.exe
  2⤵
  PID:3972
- C:\Windows\System\PyVfvqH.exe
  C:\Windows\System\PyVfvqH.exe
  2⤵
  PID:3988
- C:\Windows\System\pfGhDLe.exe
  C:\Windows\System\pfGhDLe.exe
  2⤵
  PID:4004
- C:\Windows\System\cClNfOf.exe
  C:\Windows\System\cClNfOf.exe
  2⤵
  PID:4020
- C:\Windows\System\mfBiTxy.exe
  C:\Windows\System\mfBiTxy.exe
  2⤵
  PID:4036
- C:\Windows\System\qnXnojM.exe
  C:\Windows\System\qnXnojM.exe
  2⤵
  PID:4056
- C:\Windows\System\QgueExS.exe
  C:\Windows\System\QgueExS.exe
  2⤵
  PID:4072
- C:\Windows\System\hLtGHyt.exe
  C:\Windows\System\hLtGHyt.exe
  2⤵
  PID:4088
- C:\Windows\System\EkALlhM.exe
  C:\Windows\System\EkALlhM.exe
  2⤵
  PID:1544
- C:\Windows\System\OnOQOUd.exe
  C:\Windows\System\OnOQOUd.exe
  2⤵
  PID:2116
- C:\Windows\System\VGOtUgn.exe
  C:\Windows\System\VGOtUgn.exe
  2⤵
  PID:2360
- C:\Windows\System\GeyGDYK.exe
  C:\Windows\System\GeyGDYK.exe
  2⤵
  PID:2244
- C:\Windows\System\bowTrxX.exe
  C:\Windows\System\bowTrxX.exe
  2⤵
  PID:2636
- C:\Windows\System\MQEFDAB.exe
  C:\Windows\System\MQEFDAB.exe
  2⤵
  PID:3116
- C:\Windows\System\LKUAmeP.exe
  C:\Windows\System\LKUAmeP.exe
  2⤵
  PID:1212
- C:\Windows\System\XuFQeBj.exe
  C:\Windows\System\XuFQeBj.exe
  2⤵
  PID:4112
- C:\Windows\System\exdJmSL.exe
  C:\Windows\System\exdJmSL.exe
  2⤵
  PID:4128
- C:\Windows\System\fTmCkQe.exe
  C:\Windows\System\fTmCkQe.exe
  2⤵
  PID:4144
- C:\Windows\System\BjGvaan.exe
  C:\Windows\System\BjGvaan.exe
  2⤵
  PID:4160
- C:\Windows\System\gDskFca.exe
  C:\Windows\System\gDskFca.exe
  2⤵
  PID:4180
- C:\Windows\System\GQUfmPT.exe
  C:\Windows\System\GQUfmPT.exe
  2⤵
  PID:4196
- C:\Windows\System\EfQZEiY.exe
  C:\Windows\System\EfQZEiY.exe
  2⤵
  PID:4212
- C:\Windows\System\zIfbqBo.exe
  C:\Windows\System\zIfbqBo.exe
  2⤵
  PID:4228
- C:\Windows\System\jfymdNb.exe
  C:\Windows\System\jfymdNb.exe
  2⤵
  PID:4244
- C:\Windows\System\fKFiixi.exe
  C:\Windows\System\fKFiixi.exe
  2⤵
  PID:4260
- C:\Windows\System\FdVBPuO.exe
  C:\Windows\System\FdVBPuO.exe
  2⤵
  PID:4276
- C:\Windows\System\QjwiZHw.exe
  C:\Windows\System\QjwiZHw.exe
  2⤵
  PID:4292
- C:\Windows\System\vCyQWne.exe
  C:\Windows\System\vCyQWne.exe
  2⤵
  PID:4476
- C:\Windows\System\SMELTnU.exe
  C:\Windows\System\SMELTnU.exe
  2⤵
  PID:4496
- C:\Windows\System\nDWFYUm.exe
  C:\Windows\System\nDWFYUm.exe
  2⤵
  PID:4512
- C:\Windows\System\LxGxuwH.exe
  C:\Windows\System\LxGxuwH.exe
  2⤵
  PID:4528
- C:\Windows\System\TWjtyyo.exe
  C:\Windows\System\TWjtyyo.exe
  2⤵
  PID:4544
- C:\Windows\System\vQgoMIq.exe
  C:\Windows\System\vQgoMIq.exe
  2⤵
  PID:4560
- C:\Windows\System\HoxqWJm.exe
  C:\Windows\System\HoxqWJm.exe
  2⤵
  PID:4576
- C:\Windows\System\SuzGTpk.exe
  C:\Windows\System\SuzGTpk.exe
  2⤵
  PID:4592
- C:\Windows\System\qwvFPkf.exe
  C:\Windows\System\qwvFPkf.exe
  2⤵
  PID:4608
- C:\Windows\System\FwKJLrb.exe
  C:\Windows\System\FwKJLrb.exe
  2⤵
  PID:4624
- C:\Windows\System\xTxdxNt.exe
  C:\Windows\System\xTxdxNt.exe
  2⤵
  PID:4644
- C:\Windows\System\gGCNaXZ.exe
  C:\Windows\System\gGCNaXZ.exe
  2⤵
  PID:4660
- C:\Windows\System\szwThLf.exe
  C:\Windows\System\szwThLf.exe
  2⤵
  PID:4676
- C:\Windows\System\XaQkoMk.exe
  C:\Windows\System\XaQkoMk.exe
  2⤵
  PID:4692
- C:\Windows\System\XCVNuiM.exe
  C:\Windows\System\XCVNuiM.exe
  2⤵
  PID:4708
- C:\Windows\System\zwPihXa.exe
  C:\Windows\System\zwPihXa.exe
  2⤵
  PID:4724
- C:\Windows\System\ukHGlqt.exe
  C:\Windows\System\ukHGlqt.exe
  2⤵
  PID:4744
- C:\Windows\System\zQhvGoP.exe
  C:\Windows\System\zQhvGoP.exe
  2⤵
  PID:5016
- C:\Windows\System\disESCZ.exe
  C:\Windows\System\disESCZ.exe
  2⤵
  PID:5032
- C:\Windows\System\wgHXVYm.exe
  C:\Windows\System\wgHXVYm.exe
  2⤵
  PID:5048
- C:\Windows\System\OvNqEjA.exe
  C:\Windows\System\OvNqEjA.exe
  2⤵
  PID:5064
- C:\Windows\System\umbodCo.exe
  C:\Windows\System\umbodCo.exe
  2⤵
  PID:5080
- C:\Windows\System\gmYqxzO.exe
  C:\Windows\System\gmYqxzO.exe
  2⤵
  PID:5096
- C:\Windows\System\QKdwkpb.exe
  C:\Windows\System\QKdwkpb.exe
  2⤵
  PID:5112
- C:\Windows\System\wfqjmSn.exe
  C:\Windows\System\wfqjmSn.exe
  2⤵
  PID:3248
- C:\Windows\System\lysNIjA.exe
  C:\Windows\System\lysNIjA.exe
  2⤵
  PID:3380
- C:\Windows\System\MGZOobI.exe
  C:\Windows\System\MGZOobI.exe
  2⤵
  PID:3448
- C:\Windows\System\otVLvHN.exe
  C:\Windows\System\otVLvHN.exe
  2⤵
  PID:3516
- C:\Windows\System\DsDqCwD.exe
  C:\Windows\System\DsDqCwD.exe
  2⤵
  PID:3580
- C:\Windows\System\mWYVPSd.exe
  C:\Windows\System\mWYVPSd.exe
  2⤵
  PID:2724
- C:\Windows\System\bCVRqCf.exe
  C:\Windows\System\bCVRqCf.exe
  2⤵
  PID:1608
- C:\Windows\System\aTLRAlJ.exe
  C:\Windows\System\aTLRAlJ.exe
  2⤵
  PID:2264
- C:\Windows\System\VovskWV.exe
  C:\Windows\System\VovskWV.exe
  2⤵
  PID:2804
- C:\Windows\System\drdgbqo.exe
  C:\Windows\System\drdgbqo.exe
  2⤵
  PID:3052
- C:\Windows\System\nlIAMyL.exe
  C:\Windows\System\nlIAMyL.exe
  2⤵
  PID:3132
- C:\Windows\System\LmIAGKx.exe
  C:\Windows\System\LmIAGKx.exe
  2⤵
  PID:3196
- C:\Windows\System\cEKqdqA.exe
  C:\Windows\System\cEKqdqA.exe
  2⤵
  PID:3268
- C:\Windows\System\iGKQAyB.exe
  C:\Windows\System\iGKQAyB.exe
  2⤵
  PID:3336
- C:\Windows\System\CjpLCFJ.exe
  C:\Windows\System\CjpLCFJ.exe
  2⤵
  PID:3400
- C:\Windows\System\syxjHaz.exe
  C:\Windows\System\syxjHaz.exe
  2⤵
  PID:3468
- C:\Windows\System\jOtWDFr.exe
  C:\Windows\System\jOtWDFr.exe
  2⤵
  PID:3568
- C:\Windows\System\jCZKutU.exe
  C:\Windows\System\jCZKutU.exe
  2⤵
  PID:3628
- C:\Windows\System\LKayFYp.exe
  C:\Windows\System\LKayFYp.exe
  2⤵
  PID:3664
- C:\Windows\System\bSfeOIM.exe
  C:\Windows\System\bSfeOIM.exe
  2⤵
  PID:3764
- C:\Windows\System\vQJpLef.exe
  C:\Windows\System\vQJpLef.exe
  2⤵
  PID:3832
- C:\Windows\System\KGZrXam.exe
  C:\Windows\System\KGZrXam.exe
  2⤵
  PID:3928
- C:\Windows\System\zITVuRg.exe
  C:\Windows\System\zITVuRg.exe
  2⤵
  PID:3648
- C:\Windows\System\sjacbeq.exe
  C:\Windows\System\sjacbeq.exe
  2⤵
  PID:3752
- C:\Windows\System\tdndFEM.exe
  C:\Windows\System\tdndFEM.exe
  2⤵
  PID:3816
- C:\Windows\System\VJglShp.exe
  C:\Windows\System\VJglShp.exe
  2⤵
  PID:4136
- C:\Windows\System\xLxfozl.exe
  C:\Windows\System\xLxfozl.exe
  2⤵
  PID:4272
- C:\Windows\System\oBdkkHW.exe
  C:\Windows\System\oBdkkHW.exe
  2⤵
  PID:4316
- C:\Windows\System\AcKsLzb.exe
  C:\Windows\System\AcKsLzb.exe
  2⤵
  PID:3352
- C:\Windows\System\uFBRgyD.exe
  C:\Windows\System\uFBRgyD.exe
  2⤵
  PID:4332
- C:\Windows\System\xOTRzQR.exe
  C:\Windows\System\xOTRzQR.exe
  2⤵
  PID:4348
- C:\Windows\System\UDSXDgW.exe
  C:\Windows\System\UDSXDgW.exe
  2⤵
  PID:4364
- C:\Windows\System\FpvkYBG.exe
  C:\Windows\System\FpvkYBG.exe
  2⤵
  PID:4380
- C:\Windows\System\cQabSSH.exe
  C:\Windows\System\cQabSSH.exe
  2⤵
  PID:4404
- C:\Windows\System\HVroBlu.exe
  C:\Windows\System\HVroBlu.exe
  2⤵
  PID:3716
- C:\Windows\System\dNliEqY.exe
  C:\Windows\System\dNliEqY.exe
  2⤵
  PID:4424
- C:\Windows\System\eggFSTT.exe
  C:\Windows\System\eggFSTT.exe
  2⤵
  PID:4436
- C:\Windows\System\AizPUul.exe
  C:\Windows\System\AizPUul.exe
  2⤵
  PID:4452
- C:\Windows\System\KnTxPVz.exe
  C:\Windows\System\KnTxPVz.exe
  2⤵
  PID:4084
- C:\Windows\System\oqOLhWS.exe
  C:\Windows\System\oqOLhWS.exe
  2⤵
  PID:4472
- C:\Windows\System\frZxeMG.exe
  C:\Windows\System\frZxeMG.exe
  2⤵
  PID:4568
- C:\Windows\System\sJGZXtt.exe
  C:\Windows\System\sJGZXtt.exe
  2⤵
  PID:3964
- C:\Windows\System\UAssJWz.exe
  C:\Windows\System\UAssJWz.exe
  2⤵
  PID:4028
- C:\Windows\System\njgoAzv.exe
  C:\Windows\System\njgoAzv.exe
  2⤵
  PID:1560
- C:\Windows\System\zCpAmdo.exe
  C:\Windows\System\zCpAmdo.exe
  2⤵
  PID:896
- C:\Windows\System\OIkrCaP.exe
  C:\Windows\System\OIkrCaP.exe
  2⤵
  PID:2992
- C:\Windows\System\GwQRiUM.exe
  C:\Windows\System\GwQRiUM.exe
  2⤵
  PID:4188
- C:\Windows\System\GuegKpW.exe
  C:\Windows\System\GuegKpW.exe
  2⤵
  PID:4224
- C:\Windows\System\ykjyyZY.exe
  C:\Windows\System\ykjyyZY.exe
  2⤵
  PID:4288
- C:\Windows\System\yWooTXI.exe
  C:\Windows\System\yWooTXI.exe
  2⤵
  PID:4620
- C:\Windows\System\hPOWbQJ.exe
  C:\Windows\System\hPOWbQJ.exe
  2⤵
  PID:4636
- C:\Windows\System\DMrMWGA.exe
  C:\Windows\System\DMrMWGA.exe
  2⤵
  PID:4700
- C:\Windows\System\INhssNH.exe
  C:\Windows\System\INhssNH.exe
  2⤵
  PID:4392
- C:\Windows\System\qNFgwua.exe
  C:\Windows\System\qNFgwua.exe
  2⤵
  PID:4440
- C:\Windows\System\GdPTdpV.exe
  C:\Windows\System\GdPTdpV.exe
  2⤵
  PID:4484
- C:\Windows\System\tsSrVEX.exe
  C:\Windows\System\tsSrVEX.exe
  2⤵
  PID:4796
- C:\Windows\System\hWyjEJN.exe
  C:\Windows\System\hWyjEJN.exe
  2⤵
  PID:4780
- C:\Windows\System\PLaDvGP.exe
  C:\Windows\System\PLaDvGP.exe
  2⤵
  PID:4764
- C:\Windows\System\wBdeFmF.exe
  C:\Windows\System\wBdeFmF.exe
  2⤵
  PID:4752
- C:\Windows\System\DYVwTTf.exe
  C:\Windows\System\DYVwTTf.exe
  2⤵
  PID:4588
- C:\Windows\System\fkFqqRz.exe
  C:\Windows\System\fkFqqRz.exe
  2⤵
  PID:4524
- C:\Windows\System\BtRmkto.exe
  C:\Windows\System\BtRmkto.exe
  2⤵
  PID:4856
- C:\Windows\System\WZLUqnF.exe
  C:\Windows\System\WZLUqnF.exe
  2⤵
  PID:4840
- C:\Windows\System\kXpTbsn.exe
  C:\Windows\System\kXpTbsn.exe
  2⤵
  PID:4836
- C:\Windows\System\qhFcfUg.exe
  C:\Windows\System\qhFcfUg.exe
  2⤵
  PID:4864
- C:\Windows\System\Lltldvg.exe
  C:\Windows\System\Lltldvg.exe
  2⤵
  PID:4880
- C:\Windows\System\OeOHllZ.exe
  C:\Windows\System\OeOHllZ.exe
  2⤵
  PID:4896
- C:\Windows\System\CdVNyDw.exe
  C:\Windows\System\CdVNyDw.exe
  2⤵
  PID:4912
- C:\Windows\System\UNNLmUh.exe
  C:\Windows\System\UNNLmUh.exe
  2⤵
  PID:4932
- C:\Windows\System\JpWOcMB.exe
  C:\Windows\System\JpWOcMB.exe
  2⤵
  PID:4956
- C:\Windows\System\mIkrmwd.exe
  C:\Windows\System\mIkrmwd.exe
  2⤵
  PID:4992
- C:\Windows\System\lpcscLy.exe
  C:\Windows\System\lpcscLy.exe
  2⤵
  PID:2308
- C:\Windows\System\oczzoGA.exe
  C:\Windows\System\oczzoGA.exe
  2⤵
  PID:5040
- C:\Windows\System\WujEyaq.exe
  C:\Windows\System\WujEyaq.exe
  2⤵
  PID:5056
- C:\Windows\System\SNhXDVd.exe
  C:\Windows\System\SNhXDVd.exe
  2⤵
  PID:5108
- C:\Windows\System\ldjZcnA.exe
  C:\Windows\System\ldjZcnA.exe
  2⤵
  PID:3484
- C:\Windows\System\wLnoGFs.exe
  C:\Windows\System\wLnoGFs.exe
  2⤵
  PID:3848
- C:\Windows\System\fJoeSQZ.exe
  C:\Windows\System\fJoeSQZ.exe
  2⤵
  PID:760
- C:\Windows\System\ROHGsES.exe
  C:\Windows\System\ROHGsES.exe
  2⤵
  PID:3916
- C:\Windows\System\eeAeQCC.exe
  C:\Windows\System\eeAeQCC.exe
  2⤵
  PID:4048
- C:\Windows\System\xecTwrq.exe
  C:\Windows\System\xecTwrq.exe
  2⤵
  PID:3176
- C:\Windows\System\TkPlLBh.exe
  C:\Windows\System\TkPlLBh.exe
  2⤵
  PID:2984
- C:\Windows\System\KAoWHid.exe
  C:\Windows\System\KAoWHid.exe
  2⤵
  PID:4240
- C:\Windows\System\uXaNgIz.exe
  C:\Windows\System\uXaNgIz.exe
  2⤵
  PID:4208
- C:\Windows\System\HbrwamJ.exe
  C:\Windows\System\HbrwamJ.exe
  2⤵
  PID:3284
- C:\Windows\System\GVqwKGV.exe
  C:\Windows\System\GVqwKGV.exe
  2⤵
  PID:4340
- C:\Windows\System\goWlIeT.exe
  C:\Windows\System\goWlIeT.exe
  2⤵
  PID:4444
- C:\Windows\System\eBiDvOa.exe
  C:\Windows\System\eBiDvOa.exe
  2⤵
  PID:4600
- C:\Windows\System\XxHwRjL.exe
  C:\Windows\System\XxHwRjL.exe
  2⤵
  PID:4360
- C:\Windows\System\bdWqrFH.exe
  C:\Windows\System\bdWqrFH.exe
  2⤵
  PID:4540
- C:\Windows\System\iiRORna.exe
  C:\Windows\System\iiRORna.exe
  2⤵
  PID:4412
- C:\Windows\System\pqsvpAU.exe
  C:\Windows\System\pqsvpAU.exe
  2⤵
  PID:4432
- C:\Windows\System\OoZUqKG.exe
  C:\Windows\System\OoZUqKG.exe
  2⤵
  PID:4632
- C:\Windows\System\caZlDcm.exe
  C:\Windows\System\caZlDcm.exe
  2⤵
  PID:4584
- C:\Windows\System\zDBLdcz.exe
  C:\Windows\System\zDBLdcz.exe
  2⤵
  PID:4672
- C:\Windows\System\dwqjsoK.exe
  C:\Windows\System\dwqjsoK.exe
  2⤵
  PID:2540
- C:\Windows\System\EMpJXkM.exe
  C:\Windows\System\EMpJXkM.exe
  2⤵
  PID:4884
- C:\Windows\System\iqmfVZP.exe
  C:\Windows\System\iqmfVZP.exe
  2⤵
  PID:4920
- C:\Windows\System\hwqQmll.exe
  C:\Windows\System\hwqQmll.exe
  2⤵
  PID:4344
- C:\Windows\System\gRcLZbb.exe
  C:\Windows\System\gRcLZbb.exe
  2⤵
  PID:5008
- C:\Windows\System\hOnsZmP.exe
  C:\Windows\System\hOnsZmP.exe
  2⤵
  PID:1796
- C:\Windows\System\chdGbBO.exe
  C:\Windows\System\chdGbBO.exe
  2⤵
  PID:5104
- C:\Windows\System\sWrByhb.exe
  C:\Windows\System\sWrByhb.exe
  2⤵
  PID:3300
- C:\Windows\System\zmwMyiV.exe
  C:\Windows\System\zmwMyiV.exe
  2⤵
  PID:3596
- C:\Windows\System\VlTDPjX.exe
  C:\Windows\System\VlTDPjX.exe
  2⤵
  PID:3416
- C:\Windows\System\OthSBHw.exe
  C:\Windows\System\OthSBHw.exe
  2⤵
  PID:1240
- C:\Windows\System\AYRZDlm.exe
  C:\Windows\System\AYRZDlm.exe
  2⤵
  PID:3128
- C:\Windows\System\oEATmWg.exe
  C:\Windows\System\oEATmWg.exe
  2⤵
  PID:3528
- C:\Windows\System\fFUvhVU.exe
  C:\Windows\System\fFUvhVU.exe
  2⤵
  PID:3732
- C:\Windows\System\nFntQHW.exe
  C:\Windows\System\nFntQHW.exe
  2⤵
  PID:3796
- C:\Windows\System\uelwNzN.exe
  C:\Windows\System\uelwNzN.exe
  2⤵
  PID:3712
- C:\Windows\System\kBRLpLG.exe
  C:\Windows\System\kBRLpLG.exe
  2⤵
  PID:3812
- C:\Windows\System\pPGhhXf.exe
  C:\Windows\System\pPGhhXf.exe
  2⤵
  PID:3984
- C:\Windows\System\zbFfZrR.exe
  C:\Windows\System\zbFfZrR.exe
  2⤵
  PID:4080
- C:\Windows\System\IgSRmiL.exe
  C:\Windows\System\IgSRmiL.exe
  2⤵
  PID:4044
- C:\Windows\System\rgobsSm.exe
  C:\Windows\System\rgobsSm.exe
  2⤵
  PID:4104
- C:\Windows\System\uhYASLO.exe
  C:\Windows\System\uhYASLO.exe
  2⤵
  PID:2828
- C:\Windows\System\rgFhJqf.exe
  C:\Windows\System\rgFhJqf.exe
  2⤵
  PID:4308
- C:\Windows\System\KOqJXkN.exe
  C:\Windows\System\KOqJXkN.exe
  2⤵
  PID:4320
- C:\Windows\System\qUEsJwT.exe
  C:\Windows\System\qUEsJwT.exe
  2⤵
  PID:4064
- C:\Windows\System\OvsNciT.exe
  C:\Windows\System\OvsNciT.exe
  2⤵
  PID:4156
- C:\Windows\System\Awdikfj.exe
  C:\Windows\System\Awdikfj.exe
  2⤵
  PID:4220
- C:\Windows\System\OIReVns.exe
  C:\Windows\System\OIReVns.exe
  2⤵
  PID:4376
- C:\Windows\System\SCQwDWj.exe
  C:\Windows\System\SCQwDWj.exe
  2⤵
  PID:3820
- C:\Windows\System\FfnOPki.exe
  C:\Windows\System\FfnOPki.exe
  2⤵
  PID:4732
- C:\Windows\System\zMuWfbN.exe
  C:\Windows\System\zMuWfbN.exe
  2⤵
  PID:4736
- C:\Windows\System\MdQpUDX.exe
  C:\Windows\System\MdQpUDX.exe
  2⤵
  PID:4740
- C:\Windows\System\uDkEKxI.exe
  C:\Windows\System\uDkEKxI.exe
  2⤵
  PID:4808
- C:\Windows\System\zsnBRoa.exe
  C:\Windows\System\zsnBRoa.exe
  2⤵
  PID:4668
- C:\Windows\System\JCoQJKk.exe
  C:\Windows\System\JCoQJKk.exe
  2⤵
  PID:4892
- C:\Windows\System\XXCuHZP.exe
  C:\Windows\System\XXCuHZP.exe
  2⤵
  PID:5044
- C:\Windows\System\BwYaVsA.exe
  C:\Windows\System\BwYaVsA.exe
  2⤵
  PID:3436
- C:\Windows\System\RVhTwUC.exe
  C:\Windows\System\RVhTwUC.exe
  2⤵
  PID:2464
- C:\Windows\System\OBMpRoz.exe
  C:\Windows\System\OBMpRoz.exe
  2⤵
  PID:3208
- C:\Windows\System\GoxIQtY.exe
  C:\Windows\System\GoxIQtY.exe
  2⤵
  PID:2184
- C:\Windows\System\vDbsFvX.exe
  C:\Windows\System\vDbsFvX.exe
  2⤵
  PID:4312
- C:\Windows\System\eDzgRoI.exe
  C:\Windows\System\eDzgRoI.exe
  2⤵
  PID:4124
- C:\Windows\System\TKUrPuM.exe
  C:\Windows\System\TKUrPuM.exe
  2⤵
  PID:4492
- C:\Windows\System\DRXcvSN.exe
  C:\Windows\System\DRXcvSN.exe
  2⤵
  PID:4928
- C:\Windows\System\hTwFBMG.exe
  C:\Windows\System\hTwFBMG.exe
  2⤵
  PID:3532
- C:\Windows\System\xIpLbhU.exe
  C:\Windows\System\xIpLbhU.exe
  2⤵
  PID:3720
- C:\Windows\System\jcJSYYv.exe
  C:\Windows\System\jcJSYYv.exe
  2⤵
  PID:4876
- C:\Windows\System\tnGAJnr.exe
  C:\Windows\System\tnGAJnr.exe
  2⤵
  PID:3912
- C:\Windows\System\ldyKxRT.exe
  C:\Windows\System\ldyKxRT.exe
  2⤵
  PID:4788
- C:\Windows\System\dNTiuSO.exe
  C:\Windows\System\dNTiuSO.exe
  2⤵
  PID:3368
- C:\Windows\System\lDmrPRS.exe
  C:\Windows\System\lDmrPRS.exe
  2⤵
  PID:3748
- C:\Windows\System\AXvfCDa.exe
  C:\Windows\System\AXvfCDa.exe
  2⤵
  PID:4016
- C:\Windows\System\KmanXcR.exe
  C:\Windows\System\KmanXcR.exe
  2⤵
  PID:4192
- C:\Windows\System\TULGsHb.exe
  C:\Windows\System\TULGsHb.exe
  2⤵
  PID:2412
- C:\Windows\System\NoLmuTP.exe
  C:\Windows\System\NoLmuTP.exe
  2⤵
  PID:3192
- C:\Windows\System\XuvARot.exe
  C:\Windows\System\XuvARot.exe
  2⤵
  PID:4924
- C:\Windows\System\SDaPrph.exe
  C:\Windows\System\SDaPrph.exe
  2⤵
  PID:1920
- C:\Windows\System\zovRFnE.exe
  C:\Windows\System\zovRFnE.exe
  2⤵
  PID:4812
- C:\Windows\System\DrqHTdN.exe
  C:\Windows\System\DrqHTdN.exe
  2⤵
  PID:4684
- C:\Windows\System\ZuVazuB.exe
  C:\Windows\System\ZuVazuB.exe
  2⤵
  PID:5092
- C:\Windows\System\mFNBtBe.exe
  C:\Windows\System\mFNBtBe.exe
  2⤵
  PID:3112
- C:\Windows\System\sWmrQAU.exe
  C:\Windows\System\sWmrQAU.exe
  2⤵
  PID:4824
- C:\Windows\System\BXoXXpm.exe
  C:\Windows\System\BXoXXpm.exe
  2⤵
  PID:2672
- C:\Windows\System\aLhLdcF.exe
  C:\Windows\System\aLhLdcF.exe
  2⤵
  PID:2668
- C:\Windows\System\EhhAuTJ.exe
  C:\Windows\System\EhhAuTJ.exe
  2⤵
  PID:5076
- C:\Windows\System\qrjgPhT.exe
  C:\Windows\System\qrjgPhT.exe
  2⤵
  PID:4488
- C:\Windows\System\sqkJGEP.exe
  C:\Windows\System\sqkJGEP.exe
  2⤵
  PID:4552
- C:\Windows\System\GHwSkpP.exe
  C:\Windows\System\GHwSkpP.exe
  2⤵
  PID:4356
- C:\Windows\System\HiFItQS.exe
  C:\Windows\System\HiFItQS.exe
  2⤵
  PID:1668
- C:\Windows\System\JCAxLYy.exe
  C:\Windows\System\JCAxLYy.exe
  2⤵
  PID:5136
- C:\Windows\System\XlSZCex.exe
  C:\Windows\System\XlSZCex.exe
  2⤵
  PID:5152
- C:\Windows\System\GABcMoX.exe
  C:\Windows\System\GABcMoX.exe
  2⤵
  PID:5168
- C:\Windows\System\UuKTjBh.exe
  C:\Windows\System\UuKTjBh.exe
  2⤵
  PID:5184
- C:\Windows\System\uepSssX.exe
  C:\Windows\System\uepSssX.exe
  2⤵
  PID:5200
- C:\Windows\System\OKSKtJE.exe
  C:\Windows\System\OKSKtJE.exe
  2⤵
  PID:5216
- C:\Windows\System\PRaqlIK.exe
  C:\Windows\System\PRaqlIK.exe
  2⤵
  PID:5232
- C:\Windows\System\OOqhqxU.exe
  C:\Windows\System\OOqhqxU.exe
  2⤵
  PID:5248
- C:\Windows\System\FtpkLBQ.exe
  C:\Windows\System\FtpkLBQ.exe
  2⤵
  PID:5264
- C:\Windows\System\GiSPzCD.exe
  C:\Windows\System\GiSPzCD.exe
  2⤵
  PID:5280
- C:\Windows\System\mWTlPfB.exe
  C:\Windows\System\mWTlPfB.exe
  2⤵
  PID:5296
- C:\Windows\System\pdnEVjE.exe
  C:\Windows\System\pdnEVjE.exe
  2⤵
  PID:5312
- C:\Windows\System\PXZcJQk.exe
  C:\Windows\System\PXZcJQk.exe
  2⤵
  PID:5328
- C:\Windows\System\tpzsOfO.exe
  C:\Windows\System\tpzsOfO.exe
  2⤵
  PID:5344
- C:\Windows\System\FJuthtj.exe
  C:\Windows\System\FJuthtj.exe
  2⤵
  PID:5360
- C:\Windows\System\EqEIpCg.exe
  C:\Windows\System\EqEIpCg.exe
  2⤵
  PID:5376
- C:\Windows\System\UfYgjhe.exe
  C:\Windows\System\UfYgjhe.exe
  2⤵
  PID:5392
- C:\Windows\System\HTuMHZp.exe
  C:\Windows\System\HTuMHZp.exe
  2⤵
  PID:5408
- C:\Windows\System\yZDVvMd.exe
  C:\Windows\System\yZDVvMd.exe
  2⤵
  PID:5428
- C:\Windows\System\uEFXhpY.exe
  C:\Windows\System\uEFXhpY.exe
  2⤵
  PID:5532
- C:\Windows\System\FdFFcev.exe
  C:\Windows\System\FdFFcev.exe
  2⤵
  PID:5580
- C:\Windows\System\iHCAbue.exe
  C:\Windows\System\iHCAbue.exe
  2⤵
  PID:5596
- C:\Windows\System\SIpzZnz.exe
  C:\Windows\System\SIpzZnz.exe
  2⤵
  PID:5612
- C:\Windows\System\WuuYOJP.exe
  C:\Windows\System\WuuYOJP.exe
  2⤵
  PID:5628
- C:\Windows\System\DsCouDF.exe
  C:\Windows\System\DsCouDF.exe
  2⤵
  PID:5644
- C:\Windows\System\nTfiHSE.exe
  C:\Windows\System\nTfiHSE.exe
  2⤵
  PID:5660
- C:\Windows\System\AsDCinA.exe
  C:\Windows\System\AsDCinA.exe
  2⤵
  PID:5676
- C:\Windows\System\bcECGRT.exe
  C:\Windows\System\bcECGRT.exe
  2⤵
  PID:5692
- C:\Windows\System\evdMjWS.exe
  C:\Windows\System\evdMjWS.exe
  2⤵
  PID:5708
- C:\Windows\System\sxJaENQ.exe
  C:\Windows\System\sxJaENQ.exe
  2⤵
  PID:5724
- C:\Windows\System\HgfDpvD.exe
  C:\Windows\System\HgfDpvD.exe
  2⤵
  PID:5740
- C:\Windows\System\FoHaiNO.exe
  C:\Windows\System\FoHaiNO.exe
  2⤵
  PID:5772
- C:\Windows\System\IarmeZn.exe
  C:\Windows\System\IarmeZn.exe
  2⤵
  PID:5788
- C:\Windows\System\KidVTqX.exe
  C:\Windows\System\KidVTqX.exe
  2⤵
  PID:5804
- C:\Windows\System\fLIxZrt.exe
  C:\Windows\System\fLIxZrt.exe
  2⤵
  PID:5820
- C:\Windows\System\LFXJzRr.exe
  C:\Windows\System\LFXJzRr.exe
  2⤵
  PID:5836
- C:\Windows\System\afnNvca.exe
  C:\Windows\System\afnNvca.exe
  2⤵
  PID:5852
- C:\Windows\System\oBxlPaZ.exe
  C:\Windows\System\oBxlPaZ.exe
  2⤵
  PID:5868
- C:\Windows\System\jiPqMVm.exe
  C:\Windows\System\jiPqMVm.exe
  2⤵
  PID:5884
- C:\Windows\System\NCXNlBk.exe
  C:\Windows\System\NCXNlBk.exe
  2⤵
  PID:5900
- C:\Windows\System\rQFgekz.exe
  C:\Windows\System\rQFgekz.exe
  2⤵
  PID:5916
- C:\Windows\System\SjuLTWe.exe
  C:\Windows\System\SjuLTWe.exe
  2⤵
  PID:5932
- C:\Windows\System\NKbxgmg.exe
  C:\Windows\System\NKbxgmg.exe
  2⤵
  PID:5948
- C:\Windows\System\glAHAyZ.exe
  C:\Windows\System\glAHAyZ.exe
  2⤵
  PID:5964
- C:\Windows\System\gxCLIcP.exe
  C:\Windows\System\gxCLIcP.exe
  2⤵
  PID:5980
- C:\Windows\System\bBrsdta.exe
  C:\Windows\System\bBrsdta.exe
  2⤵
  PID:5996
- C:\Windows\System\wWhupNY.exe
  C:\Windows\System\wWhupNY.exe
  2⤵
  PID:6012
- C:\Windows\System\PPEgqkK.exe
  C:\Windows\System\PPEgqkK.exe
  2⤵
  PID:6028
- C:\Windows\System\HzMOQzw.exe
  C:\Windows\System\HzMOQzw.exe
  2⤵
  PID:6044
- C:\Windows\System\qrvpqTd.exe
  C:\Windows\System\qrvpqTd.exe
  2⤵
  PID:6060
- C:\Windows\System\FqhCpxO.exe
  C:\Windows\System\FqhCpxO.exe
  2⤵
  PID:6076
- C:\Windows\System\GZlZght.exe
  C:\Windows\System\GZlZght.exe
  2⤵
  PID:6092
- C:\Windows\System\yYfzhSO.exe
  C:\Windows\System\yYfzhSO.exe
  2⤵
  PID:6108
- C:\Windows\System\mPfrBBi.exe
  C:\Windows\System\mPfrBBi.exe
  2⤵
  PID:6124
- C:\Windows\System\OGxniCG.exe
  C:\Windows\System\OGxniCG.exe
  2⤵
  PID:6140
- C:\Windows\System\cSnKvqo.exe
  C:\Windows\System\cSnKvqo.exe
  2⤵
  PID:3180
- C:\Windows\System\nWAdNbn.exe
  C:\Windows\System\nWAdNbn.exe
  2⤵
  PID:4284
- C:\Windows\System\IkrOrvw.exe
  C:\Windows\System\IkrOrvw.exe
  2⤵
  PID:5240
- C:\Windows\System\eojXXwy.exe
  C:\Windows\System\eojXXwy.exe
  2⤵
  PID:2280
- C:\Windows\System\jtESUPI.exe
  C:\Windows\System\jtESUPI.exe
  2⤵
  PID:1324
- C:\Windows\System\CiNjnwQ.exe
  C:\Windows\System\CiNjnwQ.exe
  2⤵
  PID:904
- C:\Windows\System\jArjyAy.exe
  C:\Windows\System\jArjyAy.exe
  2⤵
  PID:5276
- C:\Windows\System\JuuBWyS.exe
  C:\Windows\System\JuuBWyS.exe
  2⤵
  PID:5336
- C:\Windows\System\DavMzdY.exe
  C:\Windows\System\DavMzdY.exe
  2⤵
  PID:5368
- C:\Windows\System\mhbCsGF.exe
  C:\Windows\System\mhbCsGF.exe
  2⤵
  PID:5292
- C:\Windows\System\oGDVyZx.exe
  C:\Windows\System\oGDVyZx.exe
  2⤵
  PID:5400
- C:\Windows\System\BvlGQgT.exe
  C:\Windows\System\BvlGQgT.exe
  2⤵
  PID:5352
- C:\Windows\System\IabHtyc.exe
  C:\Windows\System\IabHtyc.exe
  2⤵
  PID:5424
- C:\Windows\System\CMiKmrA.exe
  C:\Windows\System\CMiKmrA.exe
  2⤵
  PID:5456
- C:\Windows\System\OKtKwvn.exe
  C:\Windows\System\OKtKwvn.exe
  2⤵
  PID:5524
- C:\Windows\System\ENPJYwE.exe
  C:\Windows\System\ENPJYwE.exe
  2⤵
  PID:5556
- C:\Windows\System\QrWGZwL.exe
  C:\Windows\System\QrWGZwL.exe
  2⤵
  PID:5604
- C:\Windows\System\LoclnAT.exe
  C:\Windows\System\LoclnAT.exe
  2⤵
  PID:5672
- C:\Windows\System\sbluGLh.exe
  C:\Windows\System\sbluGLh.exe
  2⤵
  PID:5656
- C:\Windows\System\zofmfGu.exe
  C:\Windows\System\zofmfGu.exe
  2⤵
  PID:5844
- C:\Windows\System\ZRxCFFT.exe
  C:\Windows\System\ZRxCFFT.exe
  2⤵
  PID:5832
- C:\Windows\System\fzDxyWy.exe
  C:\Windows\System\fzDxyWy.exe
  2⤵
  PID:5756
- C:\Windows\System\vqGxmou.exe
  C:\Windows\System\vqGxmou.exe
  2⤵
  PID:5956
- C:\Windows\System\ZGCKknB.exe
  C:\Windows\System\ZGCKknB.exe
  2⤵
  PID:5988
- C:\Windows\System\lexNdSd.exe
  C:\Windows\System\lexNdSd.exe
  2⤵
  PID:6084
- C:\Windows\System\bjOCGQc.exe
  C:\Windows\System\bjOCGQc.exe
  2⤵
  PID:6040
- C:\Windows\System\WOqohdN.exe
  C:\Windows\System\WOqohdN.exe
  2⤵
  PID:6120
- C:\Windows\System\cOSlisJ.exe
  C:\Windows\System\cOSlisJ.exe
  2⤵
  PID:5944
- C:\Windows\System\tYKLfpn.exe
  C:\Windows\System\tYKLfpn.exe
  2⤵
  PID:6132
- C:\Windows\System\YurpVYg.exe
  C:\Windows\System\YurpVYg.exe
  2⤵
  PID:5148
- C:\Windows\System\MQUOpId.exe
  C:\Windows\System\MQUOpId.exe
  2⤵
  PID:5128
- C:\Windows\System\pDVgiAJ.exe
  C:\Windows\System\pDVgiAJ.exe
  2⤵
  PID:5224
- C:\Windows\System\ykFbrFO.exe
  C:\Windows\System\ykFbrFO.exe
  2⤵
  PID:3552
- C:\Windows\System\eTzigyj.exe
  C:\Windows\System\eTzigyj.exe
  2⤵
  PID:5208
- C:\Windows\System\CaAcAwx.exe
  C:\Windows\System\CaAcAwx.exe
  2⤵
  PID:5468
- C:\Windows\System\opXNewa.exe
  C:\Windows\System\opXNewa.exe
  2⤵
  PID:5592
- C:\Windows\System\vhHxrao.exe
  C:\Windows\System\vhHxrao.exe
  2⤵
  PID:5420
- C:\Windows\System\YqjQdWQ.exe
  C:\Windows\System\YqjQdWQ.exe
  2⤵
  PID:6024
- C:\Windows\System\vCDYBdD.exe
  C:\Windows\System\vCDYBdD.exe
  2⤵
  PID:5912
- C:\Windows\System\SRGMQwl.exe
  C:\Windows\System\SRGMQwl.exe
  2⤵
  PID:5624
- C:\Windows\System\dDNtFWk.exe
  C:\Windows\System\dDNtFWk.exe
  2⤵
  PID:6056
- C:\Windows\System\TuPEKJU.exe
  C:\Windows\System\TuPEKJU.exe
  2⤵
  PID:5384
- C:\Windows\System\QemiRaU.exe
  C:\Windows\System\QemiRaU.exe
  2⤵
  PID:5448
- C:\Windows\System\wEUAhYX.exe
  C:\Windows\System\wEUAhYX.exe
  2⤵
  PID:5640
- C:\Windows\System\OXWLCtk.exe
  C:\Windows\System\OXWLCtk.exe
  2⤵
  PID:5704
- C:\Windows\System\NDWkdWG.exe
  C:\Windows\System\NDWkdWG.exe
  2⤵
  PID:5760
- C:\Windows\System\aRhOtOW.exe
  C:\Windows\System\aRhOtOW.exe
  2⤵
  PID:5764
- C:\Windows\System\avoFtfg.exe
  C:\Windows\System\avoFtfg.exe
  2⤵
  PID:4108
- C:\Windows\System\FoPPTKa.exe
  C:\Windows\System\FoPPTKa.exe
  2⤵
  PID:5004
- C:\Windows\System\tKWULcS.exe
  C:\Windows\System\tKWULcS.exe
  2⤵
  PID:5212
- C:\Windows\System\gurtXuH.exe
  C:\Windows\System\gurtXuH.exe
  2⤵
  PID:5924
- C:\Windows\System\yfyBxmo.exe
  C:\Windows\System\yfyBxmo.exe
  2⤵
  PID:5864
- C:\Windows\System\txatiBJ.exe
  C:\Windows\System\txatiBJ.exe
  2⤵
  PID:5768
- C:\Windows\System\JBRIPEK.exe
  C:\Windows\System\JBRIPEK.exe
  2⤵
  PID:5256
- C:\Windows\System\NYhEmya.exe
  C:\Windows\System\NYhEmya.exe
  2⤵
  PID:5260
- C:\Windows\System\cJTdZmw.exe
  C:\Windows\System\cJTdZmw.exe
  2⤵
  PID:5716
- C:\Windows\System\YesYnsb.exe
  C:\Windows\System\YesYnsb.exe
  2⤵
  PID:5288
- C:\Windows\System\EojGmws.exe
  C:\Windows\System\EojGmws.exe
  2⤵
  PID:5472
- C:\Windows\System\ObmJaIa.exe
  C:\Windows\System\ObmJaIa.exe
  2⤵
  PID:5544
- C:\Windows\System\FVcfjPQ.exe
  C:\Windows\System\FVcfjPQ.exe
  2⤵
  PID:5684
- C:\Windows\System\nzYTNcq.exe
  C:\Windows\System\nzYTNcq.exe
  2⤵
  PID:5652
- C:\Windows\System\TkyuTfe.exe
  C:\Windows\System\TkyuTfe.exe
  2⤵
  PID:5828
- C:\Windows\System\blSBidn.exe
  C:\Windows\System\blSBidn.exe
  2⤵
  PID:5960
- C:\Windows\System\zVkOhRg.exe
  C:\Windows\System\zVkOhRg.exe
  2⤵
  PID:5784
- C:\Windows\System\blLeXIC.exe
  C:\Windows\System\blLeXIC.exe
  2⤵
  PID:5164
- C:\Windows\System\GEoeECx.exe
  C:\Windows\System\GEoeECx.exe
  2⤵
  PID:5720
- C:\Windows\System\TVNPUQX.exe
  C:\Windows\System\TVNPUQX.exe
  2⤵
  PID:5548
- C:\Windows\System\GMiyBxn.exe
  C:\Windows\System\GMiyBxn.exe
  2⤵
  PID:5796
- C:\Windows\System\TarmDeG.exe
  C:\Windows\System\TarmDeG.exe
  2⤵
  PID:3548
- C:\Windows\System\thqXoFP.exe
  C:\Windows\System\thqXoFP.exe
  2⤵
  PID:5636
- C:\Windows\System\rEcQxPl.exe
  C:\Windows\System\rEcQxPl.exe
  2⤵
  PID:6160
- C:\Windows\System\rRYUJRq.exe
  C:\Windows\System\rRYUJRq.exe
  2⤵
  PID:6176
- C:\Windows\System\DncHsSq.exe
  C:\Windows\System\DncHsSq.exe
  2⤵
  PID:6196
- C:\Windows\System\fWvKPZw.exe
  C:\Windows\System\fWvKPZw.exe
  2⤵
  PID:6212
- C:\Windows\System\sKYzvaT.exe
  C:\Windows\System\sKYzvaT.exe
  2⤵
  PID:6240
- C:\Windows\System\stWnnMG.exe
  C:\Windows\System\stWnnMG.exe
  2⤵
  PID:6260
- C:\Windows\System\eGwQYWI.exe
  C:\Windows\System\eGwQYWI.exe
  2⤵
  PID:6276
- C:\Windows\System\EKjDMBy.exe
  C:\Windows\System\EKjDMBy.exe
  2⤵
  PID:6296
- C:\Windows\System\iHJcWqJ.exe
  C:\Windows\System\iHJcWqJ.exe
  2⤵
  PID:6312
- C:\Windows\System\AiTMbeL.exe
  C:\Windows\System\AiTMbeL.exe
  2⤵
  PID:6328
- C:\Windows\System\PSTiSHz.exe
  C:\Windows\System\PSTiSHz.exe
  2⤵
  PID:6344
- C:\Windows\System\pNQBiki.exe
  C:\Windows\System\pNQBiki.exe
  2⤵
  PID:6372
- C:\Windows\System\RwPrmKF.exe
  C:\Windows\System\RwPrmKF.exe
  2⤵
  PID:6388
- C:\Windows\System\kAlGCuq.exe
  C:\Windows\System\kAlGCuq.exe
  2⤵
  PID:6412
- C:\Windows\System\QRfAalA.exe
  C:\Windows\System\QRfAalA.exe
  2⤵
  PID:6428
- C:\Windows\System\OLiDLPi.exe
  C:\Windows\System\OLiDLPi.exe
  2⤵
  PID:6444
- C:\Windows\System\mBgEggu.exe
  C:\Windows\System\mBgEggu.exe
  2⤵
  PID:6460
- C:\Windows\System\sXywwfc.exe
  C:\Windows\System\sXywwfc.exe
  2⤵
  PID:6476
- C:\Windows\System\CEDIsOK.exe
  C:\Windows\System\CEDIsOK.exe
  2⤵
  PID:6492
- C:\Windows\System\KFGswjX.exe
  C:\Windows\System\KFGswjX.exe
  2⤵
  PID:6508
- C:\Windows\System\nFldEwO.exe
  C:\Windows\System\nFldEwO.exe
  2⤵
  PID:6524
- C:\Windows\System\FGTsATg.exe
  C:\Windows\System\FGTsATg.exe
  2⤵
  PID:6540
- C:\Windows\System\SUTpFbX.exe
  C:\Windows\System\SUTpFbX.exe
  2⤵
  PID:6560
- C:\Windows\System\JwALGkf.exe
  C:\Windows\System\JwALGkf.exe
  2⤵
  PID:6576
- C:\Windows\System\vjneZCb.exe
  C:\Windows\System\vjneZCb.exe
  2⤵
  PID:6592
- C:\Windows\System\zHUPvAg.exe
  C:\Windows\System\zHUPvAg.exe
  2⤵
  PID:6608
- C:\Windows\System\HMhcTYS.exe
  C:\Windows\System\HMhcTYS.exe
  2⤵
  PID:6624
- C:\Windows\System\aBGGUYI.exe
  C:\Windows\System\aBGGUYI.exe
  2⤵
  PID:6640
- C:\Windows\System\XBEXNHP.exe
  C:\Windows\System\XBEXNHP.exe
  2⤵
  PID:6656
- C:\Windows\System\wvtgAES.exe
  C:\Windows\System\wvtgAES.exe
  2⤵
  PID:6672
- C:\Windows\System\RehlsiS.exe
  C:\Windows\System\RehlsiS.exe
  2⤵
  PID:6688
- C:\Windows\System\oBkxFxP.exe
  C:\Windows\System\oBkxFxP.exe
  2⤵
  PID:6704
- C:\Windows\System\juiQtQy.exe
  C:\Windows\System\juiQtQy.exe
  2⤵
  PID:6720
- C:\Windows\System\vKuyDeh.exe
  C:\Windows\System\vKuyDeh.exe
  2⤵
  PID:6736
- C:\Windows\System\icEwfDi.exe
  C:\Windows\System\icEwfDi.exe
  2⤵
  PID:6752
- C:\Windows\System\uUAiMix.exe
  C:\Windows\System\uUAiMix.exe
  2⤵
  PID:6768
- C:\Windows\System\lSCIsUe.exe
  C:\Windows\System\lSCIsUe.exe
  2⤵
  PID:6784
- C:\Windows\System\iLWrXuk.exe
  C:\Windows\System\iLWrXuk.exe
  2⤵
  PID:6800
- C:\Windows\System\wZtfVsn.exe
  C:\Windows\System\wZtfVsn.exe
  2⤵
  PID:6816
- C:\Windows\System\LONMTDH.exe
  C:\Windows\System\LONMTDH.exe
  2⤵
  PID:6832
- C:\Windows\System\BcaKmuW.exe
  C:\Windows\System\BcaKmuW.exe
  2⤵
  PID:6848
- C:\Windows\System\vHUSCiR.exe
  C:\Windows\System\vHUSCiR.exe
  2⤵
  PID:6864
- C:\Windows\System\TERdHMX.exe
  C:\Windows\System\TERdHMX.exe
  2⤵
  PID:6880
- C:\Windows\System\YpVsHEB.exe
  C:\Windows\System\YpVsHEB.exe
  2⤵
  PID:6896
- C:\Windows\System\kZLgfca.exe
  C:\Windows\System\kZLgfca.exe
  2⤵
  PID:6912
- C:\Windows\System\UfrAWJw.exe
  C:\Windows\System\UfrAWJw.exe
  2⤵
  PID:6928
- C:\Windows\System\RRYUeTr.exe
  C:\Windows\System\RRYUeTr.exe
  2⤵
  PID:6944
- C:\Windows\System\BtfCjWL.exe
  C:\Windows\System\BtfCjWL.exe
  2⤵
  PID:6960
- C:\Windows\System\kWxbCbO.exe
  C:\Windows\System\kWxbCbO.exe
  2⤵
  PID:6976
- C:\Windows\System\BAgumpi.exe
  C:\Windows\System\BAgumpi.exe
  2⤵
  PID:6992
- C:\Windows\System\HYWnzgo.exe
  C:\Windows\System\HYWnzgo.exe
  2⤵
  PID:7008
- C:\Windows\System\ePHCvpp.exe
  C:\Windows\System\ePHCvpp.exe
  2⤵
  PID:7024
- C:\Windows\System\RWmXLUg.exe
  C:\Windows\System\RWmXLUg.exe
  2⤵
  PID:7040
- C:\Windows\System\dNWQQlB.exe
  C:\Windows\System\dNWQQlB.exe
  2⤵
  PID:7056
- C:\Windows\System\gmPrgpt.exe
  C:\Windows\System\gmPrgpt.exe
  2⤵
  PID:7072
- C:\Windows\System\EocvYWs.exe
  C:\Windows\System\EocvYWs.exe
  2⤵
  PID:7088
- C:\Windows\System\wqbfWmz.exe
  C:\Windows\System\wqbfWmz.exe
  2⤵
  PID:7104
- C:\Windows\System\llDJROk.exe
  C:\Windows\System\llDJROk.exe
  2⤵
  PID:7120
- C:\Windows\System\GWgpLdH.exe
  C:\Windows\System\GWgpLdH.exe
  2⤵
  PID:7140
- C:\Windows\System\aVxCaFK.exe
  C:\Windows\System\aVxCaFK.exe
  2⤵
  PID:7156
- C:\Windows\System\vmfgiDo.exe
  C:\Windows\System\vmfgiDo.exe
  2⤵
  PID:6168
- C:\Windows\System\HKblpus.exe
  C:\Windows\System\HKblpus.exe
  2⤵
  PID:5812
- C:\Windows\System\XzxyyTV.exe
  C:\Windows\System\XzxyyTV.exe
  2⤵
  PID:6248
- C:\Windows\System\LYXNyBv.exe
  C:\Windows\System\LYXNyBv.exe
  2⤵
  PID:6292
- C:\Windows\System\DWCIybs.exe
  C:\Windows\System\DWCIybs.exe
  2⤵
  PID:6352
- C:\Windows\System\PIxRxqN.exe
  C:\Windows\System\PIxRxqN.exe
  2⤵
  PID:6360
- C:\Windows\System\pXRVfrw.exe
  C:\Windows\System\pXRVfrw.exe
  2⤵
  PID:6368
- C:\Windows\System\tBRhVAi.exe
  C:\Windows\System\tBRhVAi.exe
  2⤵
  PID:5308
- C:\Windows\System\KCsChdC.exe
  C:\Windows\System\KCsChdC.exe
  2⤵
  PID:6156
- C:\Windows\System\NlBQVwV.exe
  C:\Windows\System\NlBQVwV.exe
  2⤵
  PID:6304
- C:\Windows\System\jXcakvh.exe
  C:\Windows\System\jXcakvh.exe
  2⤵
  PID:6268
- C:\Windows\System\dQgyDUi.exe
  C:\Windows\System\dQgyDUi.exe
  2⤵
  PID:6380
- C:\Windows\System\snHquwg.exe
  C:\Windows\System\snHquwg.exe
  2⤵
  PID:6404
- C:\Windows\System\TvnRPKx.exe
  C:\Windows\System\TvnRPKx.exe
  2⤵
  PID:6484
- C:\Windows\System\HXmdqnS.exe
  C:\Windows\System\HXmdqnS.exe
  2⤵
  PID:6436
- C:\Windows\System\YoqADYA.exe
  C:\Windows\System\YoqADYA.exe
  2⤵
  PID:6472
- C:\Windows\System\ZFFsLka.exe
  C:\Windows\System\ZFFsLka.exe
  2⤵
  PID:6536
- C:\Windows\System\OXotwht.exe
  C:\Windows\System\OXotwht.exe
  2⤵
  PID:6604
- C:\Windows\System\RRsQkTC.exe
  C:\Windows\System\RRsQkTC.exe
  2⤵
  PID:6584
- C:\Windows\System\foUmBCk.exe
  C:\Windows\System\foUmBCk.exe
  2⤵
  PID:6648
- C:\Windows\System\FZWDVJF.exe
  C:\Windows\System\FZWDVJF.exe
  2⤵
  PID:6700
- C:\Windows\System\pctfVtg.exe
  C:\Windows\System\pctfVtg.exe
  2⤵
  PID:6764
- C:\Windows\System\dtrDhuH.exe
  C:\Windows\System\dtrDhuH.exe
  2⤵
  PID:6828
- C:\Windows\System\mSXsVFZ.exe
  C:\Windows\System\mSXsVFZ.exe
  2⤵
  PID:6860
- C:\Windows\System\fREjUVp.exe
  C:\Windows\System\fREjUVp.exe
  2⤵
  PID:6892
- C:\Windows\System\UXZOUzj.exe
  C:\Windows\System\UXZOUzj.exe
  2⤵
  PID:6952
- C:\Windows\System\xYLrDaN.exe
  C:\Windows\System\xYLrDaN.exe
  2⤵
  PID:6988
- C:\Windows\System\wGcutyY.exe
  C:\Windows\System\wGcutyY.exe
  2⤵
  PID:7048
- C:\Windows\System\OdVpwgp.exe
  C:\Windows\System\OdVpwgp.exe
  2⤵
  PID:6840
- C:\Windows\System\HzHcamk.exe
  C:\Windows\System\HzHcamk.exe
  2⤵
  PID:6872
- C:\Windows\System\ZLbRWUR.exe
  C:\Windows\System\ZLbRWUR.exe
  2⤵
  PID:7000
- C:\Windows\System\mYGWMDa.exe
  C:\Windows\System\mYGWMDa.exe
  2⤵
  PID:7052
- C:\Windows\System\XIoGLND.exe
  C:\Windows\System\XIoGLND.exe
  2⤵
  PID:7004
- C:\Windows\System\ZAFpmJf.exe
  C:\Windows\System\ZAFpmJf.exe
  2⤵
  PID:7084
- C:\Windows\System\GDbSOoS.exe
  C:\Windows\System\GDbSOoS.exe
  2⤵
  PID:7152
- C:\Windows\System\vQRjVZI.exe
  C:\Windows\System\vQRjVZI.exe
  2⤵
  PID:7136
- C:\Windows\System\gvgMgAM.exe
  C:\Windows\System\gvgMgAM.exe
  2⤵
  PID:6252
- C:\Windows\System\vzJWHiK.exe
  C:\Windows\System\vzJWHiK.exe
  2⤵
  PID:6324
- C:\Windows\System\LvwtUFM.exe
  C:\Windows\System\LvwtUFM.exe
  2⤵
  PID:6184
- C:\Windows\System\GkOqyLt.exe
  C:\Windows\System\GkOqyLt.exe
  2⤵
  PID:5972
- C:\Windows\System\tnmHwZj.exe
  C:\Windows\System\tnmHwZj.exe
  2⤵
  PID:6336
- C:\Windows\System\gMGxMQt.exe
  C:\Windows\System\gMGxMQt.exe
  2⤵
  PID:6340
- C:\Windows\System\QLXQpkn.exe
  C:\Windows\System\QLXQpkn.exe
  2⤵
  PID:6424
- C:\Windows\System\nyTlfhi.exe
  C:\Windows\System\nyTlfhi.exe
  2⤵
  PID:6440
- C:\Windows\System\xRVdmbG.exe
  C:\Windows\System\xRVdmbG.exe
  2⤵
  PID:6456
- C:\Windows\System\rEITdYL.exe
  C:\Windows\System\rEITdYL.exe
  2⤵
  PID:6732
- C:\Windows\System\ouRabxs.exe
  C:\Windows\System\ouRabxs.exe
  2⤵
  PID:6716
- C:\Windows\System\XPiWygv.exe
  C:\Windows\System\XPiWygv.exe
  2⤵
  PID:6792
- C:\Windows\System\LgXctxK.exe
  C:\Windows\System\LgXctxK.exe
  2⤵
  PID:6924
- C:\Windows\System\esJzNZv.exe
  C:\Windows\System\esJzNZv.exe
  2⤵
  PID:6712
- C:\Windows\System\XlxZSim.exe
  C:\Windows\System\XlxZSim.exe
  2⤵
  PID:6936
- C:\Windows\System\oSQpDCR.exe
  C:\Windows\System\oSQpDCR.exe
  2⤵
  PID:7068
- C:\Windows\System\gKfJojp.exe
  C:\Windows\System\gKfJojp.exe
  2⤵
  PID:7100
- C:\Windows\System\mzdATuK.exe
  C:\Windows\System\mzdATuK.exe
  2⤵
  PID:7116
- C:\Windows\System\lHxtVVl.exe
  C:\Windows\System\lHxtVVl.exe
  2⤵
  PID:6208
- C:\Windows\System\oplYDpd.exe
  C:\Windows\System\oplYDpd.exe
  2⤵
  PID:6364
- C:\Windows\System\KBZBVqE.exe
  C:\Windows\System\KBZBVqE.exe
  2⤵
  PID:6504
- C:\Windows\System\WYpQXDB.exe
  C:\Windows\System\WYpQXDB.exe
  2⤵
  PID:6728
- C:\Windows\System\PgRUjsS.exe
  C:\Windows\System\PgRUjsS.exe
  2⤵
  PID:6516
- C:\Windows\System\uQTwfnr.exe
  C:\Windows\System\uQTwfnr.exe
  2⤵
  PID:6780
- C:\Windows\System\iYFkYeT.exe
  C:\Windows\System\iYFkYeT.exe
  2⤵
  PID:6808
- C:\Windows\System\bhWehpx.exe
  C:\Windows\System\bhWehpx.exe
  2⤵
  PID:6968
- C:\Windows\System\SWboVHb.exe
  C:\Windows\System\SWboVHb.exe
  2⤵
  PID:6876
- C:\Windows\System\TXkWiwr.exe
  C:\Windows\System\TXkWiwr.exe
  2⤵
  PID:6616
- C:\Windows\System\HHVSkMz.exe
  C:\Windows\System\HHVSkMz.exe
  2⤵
  PID:6052
- C:\Windows\System\YitWPqA.exe
  C:\Windows\System\YitWPqA.exe
  2⤵
  PID:6680
- C:\Windows\System\xFzsSqq.exe
  C:\Windows\System\xFzsSqq.exe
  2⤵
  PID:7180
- C:\Windows\System\UPQEwqN.exe
  C:\Windows\System\UPQEwqN.exe
  2⤵
  PID:7196
- C:\Windows\System\knSPyfi.exe
  C:\Windows\System\knSPyfi.exe
  2⤵
  PID:7212
- C:\Windows\System\ineXtCI.exe
  C:\Windows\System\ineXtCI.exe
  2⤵
  PID:7228
- C:\Windows\System\mVlaxlW.exe
  C:\Windows\System\mVlaxlW.exe
  2⤵
  PID:7244
- C:\Windows\System\bOoTGLc.exe
  C:\Windows\System\bOoTGLc.exe
  2⤵
  PID:7260
- C:\Windows\System\nfgRrPP.exe
  C:\Windows\System\nfgRrPP.exe
  2⤵
  PID:7276
- C:\Windows\System\xjhvdgz.exe
  C:\Windows\System\xjhvdgz.exe
  2⤵
  PID:7292
- C:\Windows\System\ffEVIiM.exe
  C:\Windows\System\ffEVIiM.exe
  2⤵
  PID:7308
- C:\Windows\System\keAVbqg.exe
  C:\Windows\System\keAVbqg.exe
  2⤵
  PID:7324
- C:\Windows\System\hJTbZrJ.exe
  C:\Windows\System\hJTbZrJ.exe
  2⤵
  PID:7340
- C:\Windows\System\kUWjgBH.exe
  C:\Windows\System\kUWjgBH.exe
  2⤵
  PID:7356
- C:\Windows\System\vauPtHs.exe
  C:\Windows\System\vauPtHs.exe
  2⤵
  PID:7372
- C:\Windows\System\oldCvUK.exe
  C:\Windows\System\oldCvUK.exe
  2⤵
  PID:7388
- C:\Windows\System\fGDjQDV.exe
  C:\Windows\System\fGDjQDV.exe
  2⤵
  PID:7404
- C:\Windows\System\xztTIVl.exe
  C:\Windows\System\xztTIVl.exe
  2⤵
  PID:7420
- C:\Windows\System\pxdxHEv.exe
  C:\Windows\System\pxdxHEv.exe
  2⤵
  PID:7436
- C:\Windows\System\jAByYfP.exe
  C:\Windows\System\jAByYfP.exe
  2⤵
  PID:7452
- C:\Windows\System\VUfFZOJ.exe
  C:\Windows\System\VUfFZOJ.exe
  2⤵
  PID:7468
- C:\Windows\System\ZNcrnla.exe
  C:\Windows\System\ZNcrnla.exe
  2⤵
  PID:7484
- C:\Windows\System\wzZxIjr.exe
  C:\Windows\System\wzZxIjr.exe
  2⤵
  PID:7500
- C:\Windows\System\PwucQcv.exe
  C:\Windows\System\PwucQcv.exe
  2⤵
  PID:7516
- C:\Windows\System\qcjqkkB.exe
  C:\Windows\System\qcjqkkB.exe
  2⤵
  PID:7532
- C:\Windows\System\bXRYnDR.exe
  C:\Windows\System\bXRYnDR.exe
  2⤵
  PID:7548
- C:\Windows\System\AZXWOgo.exe
  C:\Windows\System\AZXWOgo.exe
  2⤵
  PID:7564
- C:\Windows\System\uwQFXuO.exe
  C:\Windows\System\uwQFXuO.exe
  2⤵
  PID:7580
- C:\Windows\System\GsEgmLv.exe
  C:\Windows\System\GsEgmLv.exe
  2⤵
  PID:7596
- C:\Windows\System\ebhhAaG.exe
  C:\Windows\System\ebhhAaG.exe
  2⤵
  PID:7612
- C:\Windows\System\zXHNXDf.exe
  C:\Windows\System\zXHNXDf.exe
  2⤵
  PID:7628
- C:\Windows\System\HaENlfH.exe
  C:\Windows\System\HaENlfH.exe
  2⤵
  PID:7644
- C:\Windows\System\mrbzNRQ.exe
  C:\Windows\System\mrbzNRQ.exe
  2⤵
  PID:7660
- C:\Windows\System\XAGaKen.exe
  C:\Windows\System\XAGaKen.exe
  2⤵
  PID:7676
- C:\Windows\System\xwFlQoo.exe
  C:\Windows\System\xwFlQoo.exe
  2⤵
  PID:7692
- C:\Windows\System\lwtbVAT.exe
  C:\Windows\System\lwtbVAT.exe
  2⤵
  PID:7708
- C:\Windows\System\hSCvNci.exe
  C:\Windows\System\hSCvNci.exe
  2⤵
  PID:7724
- C:\Windows\System\pIzyIxc.exe
  C:\Windows\System\pIzyIxc.exe
  2⤵
  PID:7740
- C:\Windows\System\KUHyHyJ.exe
  C:\Windows\System\KUHyHyJ.exe
  2⤵
  PID:7756
- C:\Windows\System\jyHmpEI.exe
  C:\Windows\System\jyHmpEI.exe
  2⤵
  PID:7772
- C:\Windows\System\PrmoMHJ.exe
  C:\Windows\System\PrmoMHJ.exe
  2⤵
  PID:7788
- C:\Windows\System\szHaPid.exe
  C:\Windows\System\szHaPid.exe
  2⤵
  PID:7804
- C:\Windows\System\HONtBSF.exe
  C:\Windows\System\HONtBSF.exe
  2⤵
  PID:7820
- C:\Windows\System\GntvzWb.exe
  C:\Windows\System\GntvzWb.exe
  2⤵
  PID:7836
- C:\Windows\System\ZgRvsjK.exe
  C:\Windows\System\ZgRvsjK.exe
  2⤵
  PID:7852
- C:\Windows\System\VhjpEHO.exe
  C:\Windows\System\VhjpEHO.exe
  2⤵
  PID:7868
- C:\Windows\System\TiadRXg.exe
  C:\Windows\System\TiadRXg.exe
  2⤵
  PID:7884
- C:\Windows\System\vfQwDkd.exe
  C:\Windows\System\vfQwDkd.exe
  2⤵
  PID:7900
- C:\Windows\System\IXiNmXg.exe
  C:\Windows\System\IXiNmXg.exe
  2⤵
  PID:7916
- C:\Windows\System\lAgVmxy.exe
  C:\Windows\System\lAgVmxy.exe
  2⤵
  PID:7932
- C:\Windows\System\FOZmmMH.exe
  C:\Windows\System\FOZmmMH.exe
  2⤵
  PID:7948
- C:\Windows\System\BmWucIR.exe
  C:\Windows\System\BmWucIR.exe
  2⤵
  PID:7964
- C:\Windows\System\BgGDVEo.exe
  C:\Windows\System\BgGDVEo.exe
  2⤵
  PID:7980
- C:\Windows\System\ZeJShJn.exe
  C:\Windows\System\ZeJShJn.exe
  2⤵
  PID:7996
- C:\Windows\System\ANdDWtZ.exe
  C:\Windows\System\ANdDWtZ.exe
  2⤵
  PID:8012
- C:\Windows\System\DkVlyeY.exe
  C:\Windows\System\DkVlyeY.exe
  2⤵
  PID:8028
- C:\Windows\System\ShnRouJ.exe
  C:\Windows\System\ShnRouJ.exe
  2⤵
  PID:8044
- C:\Windows\System\DgBSBFK.exe
  C:\Windows\System\DgBSBFK.exe
  2⤵
  PID:8060
- C:\Windows\System\wPjqypQ.exe
  C:\Windows\System\wPjqypQ.exe
  2⤵
  PID:8076
- C:\Windows\System\cMpWqGM.exe
  C:\Windows\System\cMpWqGM.exe
  2⤵
  PID:8092
- C:\Windows\System\sxhltTH.exe
  C:\Windows\System\sxhltTH.exe
  2⤵
  PID:8112
- C:\Windows\System\PxMQLyY.exe
  C:\Windows\System\PxMQLyY.exe
  2⤵
  PID:8128
- C:\Windows\System\rsYClZs.exe
  C:\Windows\System\rsYClZs.exe
  2⤵
  PID:8144
- C:\Windows\System\Ykhgprw.exe
  C:\Windows\System\Ykhgprw.exe
  2⤵
  PID:8160
- C:\Windows\System\FQiKzfP.exe
  C:\Windows\System\FQiKzfP.exe
  2⤵
  PID:8176
- C:\Windows\System\ecNuVXM.exe
  C:\Windows\System\ecNuVXM.exe
  2⤵
  PID:6284
- C:\Windows\System\yuVjXPk.exe
  C:\Windows\System\yuVjXPk.exe
  2⤵
  PID:7192
- C:\Windows\System\POQsPOY.exe
  C:\Windows\System\POQsPOY.exe
  2⤵
  PID:6984
- C:\Windows\System\GqYShvc.exe
  C:\Windows\System\GqYShvc.exe
  2⤵
  PID:6308
- C:\Windows\System\wyuXmgK.exe
  C:\Windows\System\wyuXmgK.exe
  2⤵
  PID:7204
- C:\Windows\System\FeeuKKT.exe
  C:\Windows\System\FeeuKKT.exe
  2⤵
  PID:7252
- C:\Windows\System\adNMFCS.exe
  C:\Windows\System\adNMFCS.exe
  2⤵
  PID:7332
- C:\Windows\System\zgIOdyO.exe
  C:\Windows\System\zgIOdyO.exe
  2⤵
  PID:7336
- C:\Windows\System\bnvGAYu.exe
  C:\Windows\System\bnvGAYu.exe
  2⤵
  PID:7320
- C:\Windows\System\lMsFYAh.exe
  C:\Windows\System\lMsFYAh.exe
  2⤵
  PID:7380
- C:\Windows\System\mgIuPCP.exe
  C:\Windows\System\mgIuPCP.exe
  2⤵
  PID:7444
- C:\Windows\System\MxQXjdf.exe
  C:\Windows\System\MxQXjdf.exe
  2⤵
  PID:7400
- C:\Windows\System\wJJWhqw.exe
  C:\Windows\System\wJJWhqw.exe
  2⤵
  PID:7428
- C:\Windows\System\UXgxmKK.exe
  C:\Windows\System\UXgxmKK.exe
  2⤵
  PID:7492
- C:\Windows\System\BAiXKhg.exe
  C:\Windows\System\BAiXKhg.exe
  2⤵
  PID:7544
- C:\Windows\System\ToMDatq.exe
  C:\Windows\System\ToMDatq.exe
  2⤵
  PID:7572
- C:\Windows\System\IqzgbZP.exe
  C:\Windows\System\IqzgbZP.exe
  2⤵
  PID:7636
- C:\Windows\System\PelAVOY.exe
  C:\Windows\System\PelAVOY.exe
  2⤵
  PID:7672
- C:\Windows\System\aAGjfLo.exe
  C:\Windows\System\aAGjfLo.exe
  2⤵
  PID:7624
- C:\Windows\System\SiByTfT.exe
  C:\Windows\System\SiByTfT.exe
  2⤵
  PID:7700
- C:\Windows\System\XzitxHC.exe
  C:\Windows\System\XzitxHC.exe
  2⤵
  PID:7736
- C:\Windows\System\DYxmfXf.exe
  C:\Windows\System\DYxmfXf.exe
  2⤵
  PID:7764
- C:\Windows\System\AVvbqfQ.exe
  C:\Windows\System\AVvbqfQ.exe
  2⤵
  PID:7784
- C:\Windows\System\nEOCNBb.exe
  C:\Windows\System\nEOCNBb.exe
  2⤵
  PID:7812
- C:\Windows\System\qkWcInP.exe
  C:\Windows\System\qkWcInP.exe
  2⤵
  PID:7848
- C:\Windows\System\pajvStu.exe
  C:\Windows\System\pajvStu.exe
  2⤵
  PID:7880
- C:\Windows\System\XvoSnwK.exe
  C:\Windows\System\XvoSnwK.exe
  2⤵
  PID:7908
- C:\Windows\System\HmEuiex.exe
  C:\Windows\System\HmEuiex.exe
  2⤵
  PID:7940
- C:\Windows\System\HDvPoIS.exe
  C:\Windows\System\HDvPoIS.exe
  2⤵
  PID:7988
- C:\Windows\System\umAdjTl.exe
  C:\Windows\System\umAdjTl.exe
  2⤵
  PID:8084
- C:\Windows\System\BVkvmqr.exe
  C:\Windows\System\BVkvmqr.exe
  2⤵
  PID:8020
- C:\Windows\System\THeSoAX.exe
  C:\Windows\System\THeSoAX.exe
  2⤵
  PID:8036
- C:\Windows\System\mJZOofn.exe
  C:\Windows\System\mJZOofn.exe
  2⤵
  PID:7128
- C:\Windows\System\zaGkveT.exe
  C:\Windows\System\zaGkveT.exe
  2⤵
  PID:8152
- C:\Windows\System\dTtfXxf.exe
  C:\Windows\System\dTtfXxf.exe
  2⤵
  PID:8188
- C:\Windows\System\zcLJdEM.exe
  C:\Windows\System\zcLJdEM.exe
  2⤵
  PID:7176
- C:\Windows\System\eayYxmt.exe
  C:\Windows\System\eayYxmt.exe
  2⤵
  PID:7316
- C:\Windows\System\cvrCpMW.exe
  C:\Windows\System\cvrCpMW.exe
  2⤵
  PID:7480
- C:\Windows\System\piVUktk.exe
  C:\Windows\System\piVUktk.exe
  2⤵
  PID:7608
- C:\Windows\System\EMtFVwo.exe
  C:\Windows\System\EMtFVwo.exe
  2⤵
  PID:7732
- C:\Windows\System\nYFKdAR.exe
  C:\Windows\System\nYFKdAR.exe
  2⤵
  PID:6236
- C:\Windows\System\VFyEqnE.exe
  C:\Windows\System\VFyEqnE.exe
  2⤵
  PID:8136
- C:\Windows\System\LDXfPNh.exe
  C:\Windows\System\LDXfPNh.exe
  2⤵
  PID:7720
- C:\Windows\System\uxvJtcR.exe
  C:\Windows\System\uxvJtcR.exe
  2⤵
  PID:7780
- C:\Windows\System\aDmJPdk.exe
  C:\Windows\System\aDmJPdk.exe
  2⤵
  PID:7368
- C:\Windows\System\CwpQtRE.exe
  C:\Windows\System\CwpQtRE.exe
  2⤵
  PID:7960
- C:\Windows\System\cisdwVm.exe
  C:\Windows\System\cisdwVm.exe
  2⤵
  PID:8172
- C:\Windows\System\wjBUQgL.exe
  C:\Windows\System\wjBUQgL.exe
  2⤵
  PID:8052
- C:\Windows\System\hNBtuZl.exe
  C:\Windows\System\hNBtuZl.exe
  2⤵
  PID:8024
- C:\Windows\System\EGJBMbu.exe
  C:\Windows\System\EGJBMbu.exe
  2⤵
  PID:8088
- C:\Windows\System\NjTAJAv.exe
  C:\Windows\System\NjTAJAv.exe
  2⤵
  PID:8072
- C:\Windows\System\OAPsUVy.exe
  C:\Windows\System\OAPsUVy.exe
  2⤵
  PID:7992
- C:\Windows\System\bGdPPaR.exe
  C:\Windows\System\bGdPPaR.exe
  2⤵
  PID:8008
- C:\Windows\System\QxYPiKc.exe
  C:\Windows\System\QxYPiKc.exe
  2⤵
  PID:7224
- C:\Windows\System\XCruzXL.exe
  C:\Windows\System\XCruzXL.exe
  2⤵
  PID:7796
- C:\Windows\System\plyijEs.exe
  C:\Windows\System\plyijEs.exe
  2⤵
  PID:7876
- C:\Windows\System\BjnIebW.exe
  C:\Windows\System\BjnIebW.exe
  2⤵
  PID:7864
- C:\Windows\System\JNQFKko.exe
  C:\Windows\System\JNQFKko.exe
  2⤵
  PID:7352
- C:\Windows\System\coyyuTT.exe
  C:\Windows\System\coyyuTT.exe
  2⤵
  PID:7508
- C:\Windows\System\zjCQdkK.exe
  C:\Windows\System\zjCQdkK.exe
  2⤵
  PID:7464
- C:\Windows\System\qFazclh.exe
  C:\Windows\System\qFazclh.exe
  2⤵
  PID:7540
- C:\Windows\System\wLyOFWb.exe
  C:\Windows\System\wLyOFWb.exe
  2⤵
  PID:7656
- C:\Windows\System\OOnKDzp.exe
  C:\Windows\System\OOnKDzp.exe
  2⤵
  PID:8124
- C:\Windows\System\dGzDCwd.exe
  C:\Windows\System\dGzDCwd.exe
  2⤵
  PID:7528
- C:\Windows\System\VNDWkAE.exe
  C:\Windows\System\VNDWkAE.exe
  2⤵
  PID:6812
- C:\Windows\System\FDuPBeM.exe
  C:\Windows\System\FDuPBeM.exe
  2⤵
  PID:7828
- C:\Windows\System\MSIRLYZ.exe
  C:\Windows\System\MSIRLYZ.exe
  2⤵
  PID:8204
- C:\Windows\System\cGPDqDx.exe
  C:\Windows\System\cGPDqDx.exe
  2⤵
  PID:8220
- C:\Windows\System\gKevQzZ.exe
  C:\Windows\System\gKevQzZ.exe
  2⤵
  PID:8236
- C:\Windows\System\MEJRdYT.exe
  C:\Windows\System\MEJRdYT.exe
  2⤵
  PID:8252
- C:\Windows\System\aagkrxH.exe
  C:\Windows\System\aagkrxH.exe
  2⤵
  PID:8268
- C:\Windows\System\dAHgZMK.exe
  C:\Windows\System\dAHgZMK.exe
  2⤵
  PID:8284
- C:\Windows\System\ZtmnpMn.exe
  C:\Windows\System\ZtmnpMn.exe
  2⤵
  PID:8300
- C:\Windows\System\CUvCGUf.exe
  C:\Windows\System\CUvCGUf.exe
  2⤵
  PID:8316
- C:\Windows\System\fLfsEzw.exe
  C:\Windows\System\fLfsEzw.exe
  2⤵
  PID:8332
- C:\Windows\System\bwbGDco.exe
  C:\Windows\System\bwbGDco.exe
  2⤵
  PID:8348
- C:\Windows\System\SKwazZa.exe
  C:\Windows\System\SKwazZa.exe
  2⤵
  PID:8364
- C:\Windows\System\RustOyY.exe
  C:\Windows\System\RustOyY.exe
  2⤵
  PID:8380
- C:\Windows\System\WpRccBJ.exe
  C:\Windows\System\WpRccBJ.exe
  2⤵
  PID:8396
- C:\Windows\System\vFRMJRA.exe
  C:\Windows\System\vFRMJRA.exe
  2⤵
  PID:8412
- C:\Windows\System\wbbsslC.exe
  C:\Windows\System\wbbsslC.exe
  2⤵
  PID:8428
- C:\Windows\System\weVDtvA.exe
  C:\Windows\System\weVDtvA.exe
  2⤵
  PID:8444
- C:\Windows\System\HxHRKkb.exe
  C:\Windows\System\HxHRKkb.exe
  2⤵
  PID:8460
- C:\Windows\System\wFJPwIO.exe
  C:\Windows\System\wFJPwIO.exe
  2⤵
  PID:8476
- C:\Windows\System\YEMrLHM.exe
  C:\Windows\System\YEMrLHM.exe
  2⤵
  PID:8492
- C:\Windows\System\EHWKsoe.exe
  C:\Windows\System\EHWKsoe.exe
  2⤵
  PID:8508
- C:\Windows\System\uEhtSjx.exe
  C:\Windows\System\uEhtSjx.exe
  2⤵
  PID:8524
- C:\Windows\System\nwcDOoP.exe
  C:\Windows\System\nwcDOoP.exe
  2⤵
  PID:8540
- C:\Windows\System\KoZbgIR.exe
  C:\Windows\System\KoZbgIR.exe
  2⤵
  PID:8556
- C:\Windows\System\gCGNmrs.exe
  C:\Windows\System\gCGNmrs.exe
  2⤵
  PID:8572
- C:\Windows\System\GFgtXIr.exe
  C:\Windows\System\GFgtXIr.exe
  2⤵
  PID:8588
- C:\Windows\System\kGaHVtK.exe
  C:\Windows\System\kGaHVtK.exe
  2⤵
  PID:8604
- C:\Windows\System\DLlTsdk.exe
  C:\Windows\System\DLlTsdk.exe
  2⤵
  PID:8620
- C:\Windows\System\CDcbGzL.exe
  C:\Windows\System\CDcbGzL.exe
  2⤵
  PID:8636
- C:\Windows\System\vflsdhE.exe
  C:\Windows\System\vflsdhE.exe
  2⤵
  PID:8656
- C:\Windows\System\bqxVwAY.exe
  C:\Windows\System\bqxVwAY.exe
  2⤵
  PID:8672
- C:\Windows\System\FoyxJge.exe
  C:\Windows\System\FoyxJge.exe
  2⤵
  PID:8688
- C:\Windows\System\obnprer.exe
  C:\Windows\System\obnprer.exe
  2⤵
  PID:8704
- C:\Windows\System\sbhJhsB.exe
  C:\Windows\System\sbhJhsB.exe
  2⤵
  PID:8720
- C:\Windows\System\KcJuoMZ.exe
  C:\Windows\System\KcJuoMZ.exe
  2⤵
  PID:8736
- C:\Windows\System\SzPrXZD.exe
  C:\Windows\System\SzPrXZD.exe
  2⤵
  PID:8752
- C:\Windows\System\oIkFCOm.exe
  C:\Windows\System\oIkFCOm.exe
  2⤵
  PID:8768
- C:\Windows\System\fsEmpeH.exe
  C:\Windows\System\fsEmpeH.exe
  2⤵
  PID:8784
- C:\Windows\System\ktAAnvZ.exe
  C:\Windows\System\ktAAnvZ.exe
  2⤵
  PID:8800
- C:\Windows\System\gLCVWrl.exe
  C:\Windows\System\gLCVWrl.exe
  2⤵
  PID:8816
- C:\Windows\System\ZDLELuq.exe
  C:\Windows\System\ZDLELuq.exe
  2⤵
  PID:8832
- C:\Windows\System\PztPJyV.exe
  C:\Windows\System\PztPJyV.exe
  2⤵
  PID:8848
- C:\Windows\System\zFnWtJI.exe
  C:\Windows\System\zFnWtJI.exe
  2⤵
  PID:8864
- C:\Windows\System\CEUGsdT.exe
  C:\Windows\System\CEUGsdT.exe
  2⤵
  PID:8880
- C:\Windows\System\KhxHkPU.exe
  C:\Windows\System\KhxHkPU.exe
  2⤵
  PID:8896
- C:\Windows\System\yyWtetk.exe
  C:\Windows\System\yyWtetk.exe
  2⤵
  PID:8912
- C:\Windows\System\HyQDfTI.exe
  C:\Windows\System\HyQDfTI.exe
  2⤵
  PID:8928
- C:\Windows\System\NFQBZNP.exe
  C:\Windows\System\NFQBZNP.exe
  2⤵
  PID:8944
- C:\Windows\System\HKVVyxK.exe
  C:\Windows\System\HKVVyxK.exe
  2⤵
  PID:8960
- C:\Windows\System\wLnLfey.exe
  C:\Windows\System\wLnLfey.exe
  2⤵
  PID:8976
- C:\Windows\System\AfGDyel.exe
  C:\Windows\System\AfGDyel.exe
  2⤵
  PID:8992
- C:\Windows\System\XtpwSue.exe
  C:\Windows\System\XtpwSue.exe
  2⤵
  PID:9008
- C:\Windows\System\dPYnYiw.exe
  C:\Windows\System\dPYnYiw.exe
  2⤵
  PID:9024
- C:\Windows\System\juOBzZi.exe
  C:\Windows\System\juOBzZi.exe
  2⤵
  PID:9040
- C:\Windows\System\mFYLflB.exe
  C:\Windows\System\mFYLflB.exe
  2⤵
  PID:9056
- C:\Windows\System\PYzBGhZ.exe
  C:\Windows\System\PYzBGhZ.exe
  2⤵
  PID:9072
- C:\Windows\System\kMBxfdq.exe
  C:\Windows\System\kMBxfdq.exe
  2⤵
  PID:9088
- C:\Windows\System\XZsvOjn.exe
  C:\Windows\System\XZsvOjn.exe
  2⤵
  PID:9104
- C:\Windows\System\OEJCThd.exe
  C:\Windows\System\OEJCThd.exe
  2⤵
  PID:9120
- C:\Windows\System\fmQXnrH.exe
  C:\Windows\System\fmQXnrH.exe
  2⤵
  PID:9140
- C:\Windows\System\yRGimEn.exe
  C:\Windows\System\yRGimEn.exe
  2⤵
  PID:9156
- C:\Windows\System\VPTaDGl.exe
  C:\Windows\System\VPTaDGl.exe
  2⤵
  PID:9176
- C:\Windows\System\dcsYGzh.exe
  C:\Windows\System\dcsYGzh.exe
  2⤵
  PID:9192
- C:\Windows\System\sLeZrtf.exe
  C:\Windows\System\sLeZrtf.exe
  2⤵
  PID:9208
- C:\Windows\System\PZegjbh.exe
  C:\Windows\System\PZegjbh.exe
  2⤵
  PID:8184
- C:\Windows\System\dWoTrgI.exe
  C:\Windows\System\dWoTrgI.exe
  2⤵
  PID:8232
- C:\Windows\System\rZQMizS.exe
  C:\Windows\System\rZQMizS.exe
  2⤵
  PID:8296
- C:\Windows\System\rRGEOZG.exe
  C:\Windows\System\rRGEOZG.exe
  2⤵
  PID:8360
- C:\Windows\System\QoNUvZL.exe
  C:\Windows\System\QoNUvZL.exe
  2⤵
  PID:7620
- C:\Windows\System\Oddzjgj.exe
  C:\Windows\System\Oddzjgj.exe
  2⤵
  PID:8484
- C:\Windows\System\uFtgUMA.exe
  C:\Windows\System\uFtgUMA.exe
  2⤵
  PID:8548
- C:\Windows\System\ImUMRgV.exe
  C:\Windows\System\ImUMRgV.exe
  2⤵
  PID:8612
- C:\Windows\System\GJONbWz.exe
  C:\Windows\System\GJONbWz.exe
  2⤵
  PID:8344
- C:\Windows\System\LtLTVvT.exe
  C:\Windows\System\LtLTVvT.exe
  2⤵
  PID:7284
- C:\Windows\System\PIDICjZ.exe
  C:\Windows\System\PIDICjZ.exe
  2⤵
  PID:8408
- C:\Windows\System\rMLoNpC.exe
  C:\Windows\System\rMLoNpC.exe
  2⤵
  PID:8684
- C:\Windows\System\DcZpEOC.exe
  C:\Windows\System\DcZpEOC.exe
  2⤵
  PID:8700
- C:\Windows\System\PwxDoaq.exe
  C:\Windows\System\PwxDoaq.exe
  2⤵
  PID:8796
- C:\Windows\System\hntqUSY.exe
  C:\Windows\System\hntqUSY.exe
  2⤵
  PID:8892
- C:\Windows\System\Rydotdc.exe
  C:\Windows\System\Rydotdc.exe
  2⤵
  PID:8924
- C:\Windows\System\IPxzhCF.exe
  C:\Windows\System\IPxzhCF.exe
  2⤵
  PID:8984
- C:\Windows\System\zinYnnT.exe
  C:\Windows\System\zinYnnT.exe
  2⤵
  PID:9032
- C:\Windows\System\eiuantw.exe
  C:\Windows\System\eiuantw.exe
  2⤵
  PID:9080
- C:\Windows\System\AqdzjWj.exe
  C:\Windows\System\AqdzjWj.exe
  2⤵
  PID:9068
- C:\Windows\System\cEluXxF.exe
  C:\Windows\System\cEluXxF.exe
  2⤵
  PID:7288
- C:\Windows\System\hFVyxGW.exe
  C:\Windows\System\hFVyxGW.exe
  2⤵
  PID:9164
- C:\Windows\System\yMJSoSY.exe
  C:\Windows\System\yMJSoSY.exe
  2⤵
  PID:9168
- C:\Windows\System\nyyWzEm.exe
  C:\Windows\System\nyyWzEm.exe
  2⤵
  PID:9184
- C:\Windows\System\LPNbvPN.exe
  C:\Windows\System\LPNbvPN.exe
  2⤵
  PID:8200
- C:\Windows\System\IjHcwHK.exe
  C:\Windows\System\IjHcwHK.exe
  2⤵
  PID:8452
- C:\Windows\System\yTefbbi.exe
  C:\Windows\System\yTefbbi.exe
  2⤵
  PID:8392
- C:\Windows\System\qYyDBDL.exe
  C:\Windows\System\qYyDBDL.exe
  2⤵
  PID:8584
- C:\Windows\System\KOwIzrs.exe
  C:\Windows\System\KOwIzrs.exe
  2⤵
  PID:8532
- C:\Windows\System\WXbAepz.exe
  C:\Windows\System\WXbAepz.exe
  2⤵
  PID:8468
- C:\Windows\System\KaIJsGi.exe
  C:\Windows\System\KaIJsGi.exe
  2⤵
  PID:8648
- C:\Windows\System\wSAYFpp.exe
  C:\Windows\System\wSAYFpp.exe
  2⤵
  PID:8680
- C:\Windows\System\PFgispy.exe
  C:\Windows\System\PFgispy.exe
  2⤵
  PID:8472
- C:\Windows\System\yjMrHxR.exe
  C:\Windows\System\yjMrHxR.exe
  2⤵
  PID:8404
- C:\Windows\System\dSpWFAC.exe
  C:\Windows\System\dSpWFAC.exe
  2⤵
  PID:9064
- C:\Windows\System\kxFDdiS.exe
  C:\Windows\System\kxFDdiS.exe
  2⤵
  PID:9112
- C:\Windows\System\ckvnJTW.exe
  C:\Windows\System\ckvnJTW.exe
  2⤵
  PID:8840
- C:\Windows\System\RhdrlnZ.exe
  C:\Windows\System\RhdrlnZ.exe
  2⤵
  PID:8760
- C:\Windows\System\yuvUpgg.exe
  C:\Windows\System\yuvUpgg.exe
  2⤵
  PID:8244
- C:\Windows\System\RVgsNBA.exe
  C:\Windows\System\RVgsNBA.exe
  2⤵
  PID:8716
- C:\Windows\System\EWMVGXc.exe
  C:\Windows\System\EWMVGXc.exe
  2⤵
  PID:8876
- C:\Windows\System\GMqFCRX.exe
  C:\Windows\System\GMqFCRX.exe
  2⤵
  PID:8728
- C:\Windows\System\xOMlvmr.exe
  C:\Windows\System\xOMlvmr.exe
  2⤵
  PID:8888
- C:\Windows\System\ZhTckjv.exe
  C:\Windows\System\ZhTckjv.exe
  2⤵
  PID:8988
- C:\Windows\System\ebnsytj.exe
  C:\Windows\System\ebnsytj.exe
  2⤵
  PID:8936
- C:\Windows\System\AMtAMOs.exe
  C:\Windows\System\AMtAMOs.exe
  2⤵
  PID:8952
- C:\Windows\System\wSmwXoj.exe
  C:\Windows\System\wSmwXoj.exe
  2⤵
  PID:8808
- C:\Windows\System\aXNInBF.exe
  C:\Windows\System\aXNInBF.exe
  2⤵
  PID:9000
- C:\Windows\System\wnpqMdg.exe
  C:\Windows\System\wnpqMdg.exe
  2⤵
  PID:7476
- C:\Windows\System\JonzWDn.exe
  C:\Windows\System\JonzWDn.exe
  2⤵
  PID:9200
- C:\Windows\System\ajOOrci.exe
  C:\Windows\System\ajOOrci.exe
  2⤵
  PID:8328
- C:\Windows\System\GJFOKzo.exe
  C:\Windows\System\GJFOKzo.exe
  2⤵
  PID:8580
- C:\Windows\System\GCVCBTn.exe
  C:\Windows\System\GCVCBTn.exe
  2⤵
  PID:8420
- C:\Windows\System\gAeAReR.exe
  C:\Windows\System\gAeAReR.exe
  2⤵
  PID:8596
- C:\Windows\System\yFdvbnL.exe
  C:\Windows\System\yFdvbnL.exe
  2⤵
  PID:8968
- C:\Windows\System\SLxqgsU.exe
  C:\Windows\System\SLxqgsU.exe
  2⤵
  PID:8504
- C:\Windows\System\hTaPkNN.exe
  C:\Windows\System\hTaPkNN.exe
  2⤵
  PID:8376
- C:\Windows\System\QhFcXgd.exe
  C:\Windows\System\QhFcXgd.exe
  2⤵
  PID:8276
- C:\Windows\System\iPuQIif.exe
  C:\Windows\System\iPuQIif.exe
  2⤵
  PID:8356
- C:\Windows\System\DqdIWmH.exe
  C:\Windows\System\DqdIWmH.exe
  2⤵
  PID:9136
- C:\Windows\System\ZZHhXTa.exe
  C:\Windows\System\ZZHhXTa.exe
  2⤵
  PID:8908
- C:\Windows\System\ciRuySA.exe
  C:\Windows\System\ciRuySA.exe
  2⤵
  PID:8664
- C:\Windows\System\nxoDjNO.exe
  C:\Windows\System\nxoDjNO.exe
  2⤵
  PID:7844
- C:\Windows\System\oAzaAqi.exe
  C:\Windows\System\oAzaAqi.exe
  2⤵
  PID:8568
- C:\Windows\System\AXnHZHx.exe
  C:\Windows\System\AXnHZHx.exe
  2⤵
  PID:8668
- C:\Windows\System\UCbKYWM.exe
  C:\Windows\System\UCbKYWM.exe
  2⤵
  PID:8628
- C:\Windows\System\XGjHoPz.exe
  C:\Windows\System\XGjHoPz.exe
  2⤵
  PID:9220
- C:\Windows\System\lphPJdY.exe
  C:\Windows\System\lphPJdY.exe
  2⤵
  PID:9236
- C:\Windows\System\EffeYTT.exe
  C:\Windows\System\EffeYTT.exe
  2⤵
  PID:9252
- C:\Windows\System\DrnuyQY.exe
  C:\Windows\System\DrnuyQY.exe
  2⤵
  PID:9268
- C:\Windows\System\FiIclGc.exe
  C:\Windows\System\FiIclGc.exe
  2⤵
  PID:9284
- C:\Windows\System\rgzEQFO.exe
  C:\Windows\System\rgzEQFO.exe
  2⤵
  PID:9300
- C:\Windows\System\QWBpKRx.exe
  C:\Windows\System\QWBpKRx.exe
  2⤵
  PID:9316
- C:\Windows\System\ZARbkhj.exe
  C:\Windows\System\ZARbkhj.exe
  2⤵
  PID:9332
- C:\Windows\System\DiFZzuF.exe
  C:\Windows\System\DiFZzuF.exe
  2⤵
  PID:9348
- C:\Windows\System\PRdqRVb.exe
  C:\Windows\System\PRdqRVb.exe
  2⤵
  PID:9364
- C:\Windows\System\iPAkKDz.exe
  C:\Windows\System\iPAkKDz.exe
  2⤵
  PID:9380
- C:\Windows\System\OSzGSaz.exe
  C:\Windows\System\OSzGSaz.exe
  2⤵
  PID:9396
- C:\Windows\System\NRZlQCO.exe
  C:\Windows\System\NRZlQCO.exe
  2⤵
  PID:9412
- C:\Windows\System\OfEOrFG.exe
  C:\Windows\System\OfEOrFG.exe
  2⤵
  PID:9428
- C:\Windows\System\esMBKTz.exe
  C:\Windows\System\esMBKTz.exe
  2⤵
  PID:9444
- C:\Windows\System\OCHZAlU.exe
  C:\Windows\System\OCHZAlU.exe
  2⤵
  PID:9460
- C:\Windows\System\EmNMReh.exe
  C:\Windows\System\EmNMReh.exe
  2⤵
  PID:9476
- C:\Windows\System\WTPIzyQ.exe
  C:\Windows\System\WTPIzyQ.exe
  2⤵
  PID:9492
- C:\Windows\System\WfVgRGs.exe
  C:\Windows\System\WfVgRGs.exe
  2⤵
  PID:9508
- C:\Windows\System\MkKynNK.exe
  C:\Windows\System\MkKynNK.exe
  2⤵
  PID:9524
- C:\Windows\System\nAbVfhz.exe
  C:\Windows\System\nAbVfhz.exe
  2⤵
  PID:9540
- C:\Windows\System\JqsUkRD.exe
  C:\Windows\System\JqsUkRD.exe
  2⤵
  PID:9556
- C:\Windows\System\jMAbBaD.exe
  C:\Windows\System\jMAbBaD.exe
  2⤵
  PID:9572
- C:\Windows\System\FqdclLD.exe
  C:\Windows\System\FqdclLD.exe
  2⤵
  PID:9588
- C:\Windows\System\kPYiPPP.exe
  C:\Windows\System\kPYiPPP.exe
  2⤵
  PID:9604
- C:\Windows\System\ToDNekH.exe
  C:\Windows\System\ToDNekH.exe
  2⤵
  PID:9620
- C:\Windows\System\LPHdHLB.exe
  C:\Windows\System\LPHdHLB.exe
  2⤵
  PID:9636
- C:\Windows\System\SxwYHZD.exe
  C:\Windows\System\SxwYHZD.exe
  2⤵
  PID:9652
- C:\Windows\System\PqifRba.exe
  C:\Windows\System\PqifRba.exe
  2⤵
  PID:9668
- C:\Windows\System\xFrJzKY.exe
  C:\Windows\System\xFrJzKY.exe
  2⤵
  PID:9684
- C:\Windows\System\heUddJy.exe
  C:\Windows\System\heUddJy.exe
  2⤵
  PID:9700
- C:\Windows\System\iWbXyUS.exe
  C:\Windows\System\iWbXyUS.exe
  2⤵
  PID:9716
- C:\Windows\System\FeeBckK.exe
  C:\Windows\System\FeeBckK.exe
  2⤵
  PID:9732
- C:\Windows\System\hbaoAVr.exe
  C:\Windows\System\hbaoAVr.exe
  2⤵
  PID:9748
- C:\Windows\System\INAonVG.exe
  C:\Windows\System\INAonVG.exe
  2⤵
  PID:9764
- C:\Windows\System\lzcvXJH.exe
  C:\Windows\System\lzcvXJH.exe
  2⤵
  PID:9780
- C:\Windows\System\zDtporE.exe
  C:\Windows\System\zDtporE.exe
  2⤵
  PID:9796
- C:\Windows\System\uwodLwb.exe
  C:\Windows\System\uwodLwb.exe
  2⤵
  PID:9812
- C:\Windows\System\WRpzMux.exe
  C:\Windows\System\WRpzMux.exe
  2⤵
  PID:9828
- C:\Windows\System\PgmnNyO.exe
  C:\Windows\System\PgmnNyO.exe
  2⤵
  PID:9844
- C:\Windows\System\cynksrl.exe
  C:\Windows\System\cynksrl.exe
  2⤵
  PID:9860
- C:\Windows\System\abZDWfJ.exe
  C:\Windows\System\abZDWfJ.exe
  2⤵
  PID:9876
- C:\Windows\System\XQrwnbO.exe
  C:\Windows\System\XQrwnbO.exe
  2⤵
  PID:9892
- C:\Windows\System\qFJOnLB.exe
  C:\Windows\System\qFJOnLB.exe
  2⤵
  PID:9912
- C:\Windows\System\AuUqnnk.exe
  C:\Windows\System\AuUqnnk.exe
  2⤵
  PID:9928
- C:\Windows\System\XfjGnhm.exe
  C:\Windows\System\XfjGnhm.exe
  2⤵
  PID:9944
- C:\Windows\System\rQUwLTD.exe
  C:\Windows\System\rQUwLTD.exe
  2⤵
  PID:9960
- C:\Windows\System\ttzIxmm.exe
  C:\Windows\System\ttzIxmm.exe
  2⤵
  PID:9976
- C:\Windows\System\BCUsiBo.exe
  C:\Windows\System\BCUsiBo.exe
  2⤵
  PID:9992
- C:\Windows\System\vtgRebP.exe
  C:\Windows\System\vtgRebP.exe
  2⤵
  PID:10008
- C:\Windows\System\EdAwMEl.exe
  C:\Windows\System\EdAwMEl.exe
  2⤵
  PID:10024
- C:\Windows\System\BUEimwD.exe
  C:\Windows\System\BUEimwD.exe
  2⤵
  PID:10040
- C:\Windows\System\QVOfcUf.exe
  C:\Windows\System\QVOfcUf.exe
  2⤵
  PID:10056
- C:\Windows\System\qYUZsWT.exe
  C:\Windows\System\qYUZsWT.exe
  2⤵
  PID:10072
- C:\Windows\System\tySFeKe.exe
  C:\Windows\System\tySFeKe.exe
  2⤵
  PID:10088
- C:\Windows\System\keZDtQB.exe
  C:\Windows\System\keZDtQB.exe
  2⤵
  PID:10104
- C:\Windows\System\zMEQLjF.exe
  C:\Windows\System\zMEQLjF.exe
  2⤵
  PID:10120
- C:\Windows\System\ijFaFwM.exe
  C:\Windows\System\ijFaFwM.exe
  2⤵
  PID:10136
- C:\Windows\System\QbGPWFF.exe
  C:\Windows\System\QbGPWFF.exe
  2⤵
  PID:10152
- C:\Windows\System\fDYhMCr.exe
  C:\Windows\System\fDYhMCr.exe
  2⤵
  PID:10168
- C:\Windows\System\vvADkIx.exe
  C:\Windows\System\vvADkIx.exe
  2⤵
  PID:10184
- C:\Windows\System\luRjgMM.exe
  C:\Windows\System\luRjgMM.exe
  2⤵
  PID:10200
- C:\Windows\System\jUTahkB.exe
  C:\Windows\System\jUTahkB.exe
  2⤵
  PID:10220
- C:\Windows\System\lBBmxSO.exe
  C:\Windows\System\lBBmxSO.exe
  2⤵
  PID:10236
- C:\Windows\System\jJHGFnn.exe
  C:\Windows\System\jJHGFnn.exe
  2⤵
  PID:9260
- C:\Windows\System\phceQME.exe
  C:\Windows\System\phceQME.exe
  2⤵
  PID:9324
- C:\Windows\System\dHyCnlz.exe
  C:\Windows\System\dHyCnlz.exe
  2⤵
  PID:8168
- C:\Windows\System\hLeLwPE.exe
  C:\Windows\System\hLeLwPE.exe
  2⤵
  PID:9344
- C:\Windows\System\TjeRCmh.exe
  C:\Windows\System\TjeRCmh.exe
  2⤵
  PID:9404
- C:\Windows\System\PdvTJBu.exe
  C:\Windows\System\PdvTJBu.exe
  2⤵
  PID:9436
- C:\Windows\System\tHjNFkI.exe
  C:\Windows\System\tHjNFkI.exe
  2⤵
  PID:9504
- C:\Windows\System\BmsYOCl.exe
  C:\Windows\System\BmsYOCl.exe
  2⤵
  PID:9548
- C:\Windows\System\UDpuoxJ.exe
  C:\Windows\System\UDpuoxJ.exe
  2⤵
  PID:9580
- C:\Windows\System\RrOiUme.exe
  C:\Windows\System\RrOiUme.exe
  2⤵
  PID:9628
- C:\Windows\System\pxtJtXL.exe
  C:\Windows\System\pxtJtXL.exe
  2⤵
  PID:9632
- C:\Windows\System\ZSjUbvf.exe
  C:\Windows\System\ZSjUbvf.exe
  2⤵
  PID:9648
- C:\Windows\System\IHhNwZF.exe
  C:\Windows\System\IHhNwZF.exe
  2⤵
  PID:9740
- C:\Windows\System\XyxgNir.exe
  C:\Windows\System\XyxgNir.exe
  2⤵
  PID:9724
- C:\Windows\System\jAjoMuj.exe
  C:\Windows\System\jAjoMuj.exe
  2⤵
  PID:9760
- C:\Windows\System\vvTrVhY.exe
  C:\Windows\System\vvTrVhY.exe
  2⤵
  PID:9836
- C:\Windows\System\knCquMO.exe
  C:\Windows\System\knCquMO.exe
  2⤵
  PID:9900
- C:\Windows\System\zdYWrJa.exe
  C:\Windows\System\zdYWrJa.exe
  2⤵
  PID:9940
- C:\Windows\System\scXeujq.exe
  C:\Windows\System\scXeujq.exe
  2⤵
  PID:9820
- C:\Windows\System\wRBmPFm.exe
  C:\Windows\System\wRBmPFm.exe
  2⤵
  PID:9852
- C:\Windows\System\vEseanE.exe
  C:\Windows\System\vEseanE.exe
  2⤵
  PID:9884
- C:\Windows\System\PYkpUlc.exe
  C:\Windows\System\PYkpUlc.exe
  2⤵
  PID:9952
- C:\Windows\System\nZaEDOa.exe
  C:\Windows\System\nZaEDOa.exe
  2⤵
  PID:10016
- C:\Windows\System\sFMWDuh.exe
  C:\Windows\System\sFMWDuh.exe
  2⤵
  PID:10052
- C:\Windows\System\TWjcCmj.exe
  C:\Windows\System\TWjcCmj.exe
  2⤵
  PID:10100
- C:\Windows\System\zRkAEbS.exe
  C:\Windows\System\zRkAEbS.exe
  2⤵
  PID:10160
- C:\Windows\System\UOSZJri.exe
  C:\Windows\System\UOSZJri.exe
  2⤵
  PID:9488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BiqGjPY.exe

Filesize
2.2MB

MD5
13bcf83a3d80845e7dc9daa8725dec2f

SHA1
80981e50e50a45ffa0e456606246b61d08fc1805

SHA256
81bd48574d49ec69442b5fbf99e503390a9bef70617e1ea43b55e36c7b70a1e4

SHA512
c0f0d8e5b6e264024c971973bc83bef7ac44b724d3b8174d38aaa85ff0eeb8bd0bea009a2dc1f44985e5874576bdf7084b343e8951cc812332002d7262b24d3a

Download Submit
C:\Windows\system\FcJLvwz.exe

Filesize
2.2MB

MD5
679077e24149a7bad2b7ccd022b488dc

SHA1
d2e203578352f9ec5112c93aae02985fd8a27470

SHA256
657eea5f3f797f8b254104324ab3b82ff8ab653ef2b7e487e416430d5395a29e

SHA512
0c6508731ead432baede3eb8e9f826b7b3ff3f4ce01b6c235509579683a7119ba12f50e5f3837100751eaef091baa23979cb026a339e3d75acd2b5bc5e3c4d4d

Download Submit
C:\Windows\system\GizanSX.exe

Filesize
2.2MB

MD5
8a14237c7cc78491985579a570e514f3

SHA1
62cbc7753a46445f88e2aaa9bf252e1a11896e99

SHA256
c6bd45c8bfc269505d8cd6bc0fd3afeacc21e02199c554ced0f9fb948bd5e6ef

SHA512
5192075472a423c5429ec4e4656fc5f115e9a155bb3192eaa2f39e7fe374485e788f1e68f7770e3e1be7d4575a16b2a3cc2e52827539001263f1ebbc662f0feb

Download Submit
C:\Windows\system\HIPivvf.exe

Filesize
2.2MB

MD5
a8c14651eec331b71cee621cd3bbef51

SHA1
222db1a63757bdefa22bafcc20ffa35a2837748d

SHA256
d3324b9582263f82f1c3a4428f8d8b008c49c741c15b1075ff6d076c1fa779d8

SHA512
c635758338f64ab250c220550e951c69e0d9c95adb0a765205605830cd67b86c926930cb9a6fe6af1b79e05ca85f686c804a7e12e961c5cee17ecc420908606c

Download Submit
C:\Windows\system\HKAQaJm.exe

Filesize
2.2MB

MD5
0b70994a760329e2faf9d368069f1fe5

SHA1
7622914db0f0e9fd2d7af00c2d16cd4d1c8c552d

SHA256
408577d5618cc491ef5a1f0d0ab42d7a14353f66223d7156c97ead97f819e9ae

SHA512
da887d18a81cd02859ccabc4cb6e3a82ef3f7a17dece11d0f5c9e17270ede395b30160b4bb606e50d25dfa3416528732e40ea5dfa3a7f99062a64fff29adac55

Download Submit
C:\Windows\system\JkossAn.exe

Filesize
2.2MB

MD5
d6613d22cd9b341ab141ef24523fa00e

SHA1
6c5d229e14ac3306b45103c65262c8d6882994a9

SHA256
8a0de482a4acb50eb6d545fede2a69eb2f22eafb780463dbb570cd6f548742f9

SHA512
4026f9a99284ec8f5dba6b02f5c0c92a6fb412ad5d1ce6bdfe50a4c4f29f0120f3c39f5358e2bd364e294581237dbf2e3f009c06c44ee96b07af7fe042b75b33

Download Submit
C:\Windows\system\Kkqadnv.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\system\LFqNLZg.exe

Filesize
2.2MB

MD5
dfc4c6fd018651869c1fa2f0ca416986

SHA1
a73d8b48cdcd09ee502def4e7f51eeb470326bad

SHA256
3ea71cd4a1365630525407ce7b89a78ea16351b9da048ba5bbb95374fa5634cc

SHA512
bfa2efe4440a0eddb0d77bb1cb9b893ed2c72d6f885f367c450d3dd41df557934c053b663077fb895124f6fbd9b0d5a1475860ea3492da54075510ee334f0097

Download Submit
C:\Windows\system\Nhaqecf.exe

Filesize
2.2MB

MD5
59b7658e12fbd8c7c19da08ac377788d

SHA1
a457ba3043e605378d76ecd323f463432408526c

SHA256
4f519e5b0ff9f5dc09c0cd6f2e8b9a027dafa576e3264f52e7c785e42543e890

SHA512
64905c34f56e156b9a322a89ccefcca4616db930313996dfe358456f8a93556044b24422817ca44fddab21545d4562e322e09b370dd059931f8da6d578b9bfc1

Download Submit
C:\Windows\system\OHerXUE.exe

Filesize
2.2MB

MD5
ced38edbf8855cd94757ce3c6ae53184

SHA1
03513731ff85065e558a9decf2671e075aa21441

SHA256
02105ea4ae079b3fdb0467c0edaa38fc7c020b6511a160ab437c204f0a05068e

SHA512
97d8e80b3f7eecebe43ba542751e3d27927ceb52ad9514260e98fd48705493be41e1dbb119d16d2ddbf9e6bd8e55703ac352cee8346c52e01ecf2ac5dff718d9

Download Submit
C:\Windows\system\SbfCBqo.exe

Filesize
2.2MB

MD5
a080d47ef94cc77b90aaaab329b4379c

SHA1
e930df2be52b9addb17688e04b405e0e9a81e662

SHA256
4a116337bad8f04d6a0a934f6b93279a11f759fed1066230ea44dbcab64c89fb

SHA512
f3bb733dd7f4e2cb5ebedff5953e9d5697fcabdf4d96f21332163e663b05fa91a413608a026148e894af62da72936dba4c7ea423f0923527afd5a23bbee731c2

Download Submit
C:\Windows\system\TlfskAh.exe

Filesize
2.2MB

MD5
4a608062736f8436bc7a6e16c9d9227a

SHA1
bef2e741a313ca939f0a0ae71cb43879989f62b7

SHA256
6223b7b3c15cc36fc88ea07c302f803713531462207e2fffa3a7654c07b38cd9

SHA512
0b7c85ef8936403d26550f72d9cdea0cbd4d07693f67be44f32c56bf26936587e4e32bf702640eb98c1c9661b0ce1f60fcfd65975eec13758c4df842fbb075d9

Download Submit
C:\Windows\system\UeXtgDn.exe

Filesize
2.2MB

MD5
b9b5d503bc8b7306aa80f19626131e03

SHA1
e733b6c5edc5b84576c24046b25bfd33bd9af1cf

SHA256
2adb1541b38da005c60a293e167683e2e5aab9c685d5d4f3221388ece24f98c3

SHA512
3d61f6f50c3ce8e39efc11d603574b31a49e5a7f114702e1e6f55332683bcd6f517f9ea7c838adef45a34ee32eb011d3222f8b3b69e81df0daf7bb7d78add54d

Download Submit
C:\Windows\system\XYbJKaq.exe

Filesize
2.2MB

MD5
17a56146e05020d78f9a719b5548654f

SHA1
2f5f816a6b53006d3f635698038f87b7858b6c83

SHA256
19e1884384b09247832dd4c5e82c57d2746b31611061c95f8024d0152fa74c4e

SHA512
af1874d3ed16c439dcf06182eedaf4c4a6a755a0f73425e7a60c7192e0776f18074cb921b34b827d95618b0e9214d1f3fd7f92830658536ecbd7ae90722b4e20

Download Submit
C:\Windows\system\YhVZfBF.exe

Filesize
2.2MB

MD5
318b2c98dd175d08aaf3bd519e19e0d1

SHA1
05621bfa12ce7a4fbea16f3006a8f89e52ca20bc

SHA256
bbf1fac27dc990dafc409ebed7fc8eae054edd30331398d107fa0a8b3493f123

SHA512
38efd1c9e4bf5a2fda58c592059bf0637da50381010c98055b25d76dc381553fb9a0f03520b972cc22f0eda055c23a327d370671438df8f5aac3b268d1c7d35d

Download Submit
C:\Windows\system\ZBklOgN.exe

Filesize
2.2MB

MD5
e1906209b793ddce72160630de219102

SHA1
3c83f7e0206b949511f76e24688491bb01246635

SHA256
cf66c205daad714620f34c25a2fa9eed0f35ad083e165a482d80654e4a25353d

SHA512
62fd3b155795f921a7c3c850a90612f810a5fdf8bae1046b7415b1543262eb27d51690eac39a551d44acaadc4b7e655041ae528f25122c475caa8fdc6e2a4b60

Download Submit
C:\Windows\system\aiiZHUN.exe

Filesize
2.2MB

MD5
373aaf23d22ade10095c681e7710bac2

SHA1
24db07ed59a42295888feb92231f303a5186d8a9

SHA256
960505aed74bc09c1ca746b7642742dd1fcb6a3130780fb41b17cfa4b3ed1df7

SHA512
ec0d2b86c1974dbb15f30dd111dd0756889a0abdb418810329d6864047d7c77847760d703d5856ad0beeb461ae6b9d9b1422d264a7e96244ab0ebd199fc745e7

Download Submit
C:\Windows\system\cTVZEFo.exe

Filesize
2.2MB

MD5
e1a691fc51e1f8b6912692bf04294ec2

SHA1
f5447c97cf45b857408c0d8d5d4c158d31ace72c

SHA256
bc7348b497d48a315de2a46e1cf073f84c967290751212624966fab03d96ba34

SHA512
a34491e6ea1455a4ba9a3137c9933b9924fcfeaa4987c2c725b305a567c6dedd3d79fd50a161b5f349de65c332976e9a61659dd1d49f04e2e57c33cdc25b8f1d

Download Submit
C:\Windows\system\efcNTYR.exe

Filesize
2.2MB

MD5
f229c0b22152e61fed83accecc9d8288

SHA1
43539b47df9e8092d64b81d41d6432eb8d493830

SHA256
88b42a4a3d872ed01a74a628d81cfd5b3669a25d802d07209d0428e2d81ad788

SHA512
a2331482f97fcdca8d044724eef784c3ddaabd2ce56d20add2756586840721da0986100625ffdbbfb5f74247452659758df3fa57fdbab49f89b6d9fbde77ec56

Download Submit
C:\Windows\system\jxzOVhi.exe

Filesize
2.2MB

MD5
73f0be515a2b2da3aed337630b0e1076

SHA1
26f9c66888a18647c11aa943d4af9fce24adb32f

SHA256
096f8d709ddcb784302a52c37b98e958d4ca804217057dca4d490c4705f94afc

SHA512
d4ad17133df4aa5d99bb231975829bb289d1f323c4461b7d09cae5cc667afefe89bbcf6250366f7705b8c7426f773aa98e3ada52acd6d66ba574f649b860b8a8

Download Submit
C:\Windows\system\kVDSLlA.exe

Filesize
2.2MB

MD5
ea41a77fc7ce8e5b96dea27eab300e1a

SHA1
ce7761b9cfcaff7fb9a8f7f70fdfeb9cdf15c888

SHA256
308fe438e9a0bbccf0c6f7bc51ee442ca0eb5f8520ac4935cbacedd8ceaaaebe

SHA512
2f3d812e1295c0a3d9e4be79d33448cb8577ca510c3c79f8b642de4dc4bbbaf4693f83069711e85725ff33bdeccc8acff24eb83c9ac9ed23eb0b2356a5481e6c

Download Submit
C:\Windows\system\mGIQdoY.exe

Filesize
2.2MB

MD5
3b70f7f228276ef6696a2d6ab93467d2

SHA1
140ac8980ec81d151dcdd913eca082f459c12fc1

SHA256
c3e83909b527e7eb9e936a03ebe49f6d48bfdf5821525ddf241ff7564424b287

SHA512
250d3eb68355efec573230b43414f14c4c20423f566adf498040c9d5a403641da723e223c086b097c46da1e782228ea1d8418bc8959f2f5e1569ce5af90ab083

Download Submit
C:\Windows\system\mffhrYI.exe

Filesize
2.2MB

MD5
f906595f187f01b436cfd91d3008dfcf

SHA1
d42dbf4494558583927c27da77e5d309341226ab

SHA256
85c22206fcdbcf82ec85733c98490ce76c2193a9a3a24c36a4eda509c7a8f5e0

SHA512
67ee7c110237d3afa0d1019f554b0131648215412f58f021ef7c66e94ea3362f058e37bf72e9f0bb14ca5b582b977fa72bcede7567086d24c99b466aad0502aa

Download Submit
C:\Windows\system\mpOUKkI.exe

Filesize
2.2MB

MD5
90f14fa3ab6eaaa613bba7ebdf2d2dc2

SHA1
af17fa7611aa6b1a0084ab22fea640e8b3d41b2e

SHA256
b831ce83368e8c119f335ca1d3efd3016baf514f8bbd3a5a9d88d5cfd3e3e6f4

SHA512
98c7b4ad577bfb5ccecdac9161588dcdecf136c3453f627b0767210a21cd7568aa14934c70f5a463679a73a55ba270e09689c1edd84f06a53e7ba6c902ae3fe4

Download Submit
C:\Windows\system\nRiaGSs.exe

Filesize
2.2MB

MD5
12e8908586c3c632ccc793a46e54cc78

SHA1
32b1420fe093eb96a814f97a3d03466324f53984

SHA256
7ee3392f8154d176d9e9001710fc775ab3bf41f8ec7ceeb14ca4f6aeba90f431

SHA512
f795eb1a63fb5e2ece663b238e7c0a7597ad681cf1a077dd56f9b67370c45ed7e47e36382f063c4b79794eed8b58450f747fc3ab78f662c15a5bb052cab3d01a

Download Submit
C:\Windows\system\nUaSDyA.exe

Filesize
2.2MB

MD5
2cc82a31d51e240cd8aca6613991dcdc

SHA1
7c8b7834151de62326c283ccabe45335f440d99f

SHA256
7e9fcdcd9db2a76527ebe35387e41958ef586eb86eaaa29794322a96b151a91b

SHA512
a44acb7b6da4616e2e1cd8c0cd2d7d72807f13ac432fb33e6c4e38a7a477a46de88364ca13db01e814f3e7cf23d3da7c1196968415e83226a1e55da299ce5819

Download Submit
C:\Windows\system\qyWboXz.exe

Filesize
2.2MB

MD5
acf92438095b95b1a06340769ed9df39

SHA1
2651aca55a54e618bd133dc82d5bf8f24882261a

SHA256
fb176cb830e8110edb66994205106dd3f5efc80e215ff9b2f37699aa1f0ea427

SHA512
abfa49545bacc107962f8925fe7d25fc9a5c7cf6ea10b4d954b79d301e2af0b0cf3ade142f1afceb0fd38e21106e44101c257022a0d98bb4cc8af387061364b9

Download Submit
C:\Windows\system\slGRyQT.exe

Filesize
2.2MB

MD5
48a89bc66c195eefd27fea4e320e12f1

SHA1
3ca7b8ee90bf6e060ccee9b3fcee6883e86ef4d3

SHA256
3d7d5d97191e33b6d6ba1fb2a8d96740a4bcdd37665d8fef360468ccc9025b88

SHA512
d799a3386e1dba6bd8ebaf5b70f06beba1c0cd2696e67004368932e5ac29b0cb78797cd33b8fd8b3a88f89e20a59b5a3c656bf2c25cc18368be9f8bb70528f94

Download Submit
C:\Windows\system\vNiGFCw.exe

Filesize
2.2MB

MD5
9c32b9f4de13ef30d14a930242361162

SHA1
ca01a36d76b902980684f9d2a617583ba7569301

SHA256
8ca382491e91b97148a3e82c0571aebd09de4e9a57e2557bfdcfb1d462a2eebf

SHA512
f8bc1ebd963c77a022162dfd22c811b6df5c82d35b21c7adeb5446aedefc18e33f2515e3b83a88a5a158583611ceed2841588df601a19253d5a38c6ac15c328b

Download Submit
C:\Windows\system\wNXYrDk.exe

Filesize
2.2MB

MD5
bff71bd86e08bfd38f7743941f79f786

SHA1
64381815e31f6b552085670d1b1f4d3dda35054b

SHA256
c2a7303c0c0caee743ecddc9f90549bedef85c96a2008536e6124ebdd8b11282

SHA512
488fd8b069838f93cf5d1c1e02bffc6062b6eee7c8c126de1ed01806324e4f9e75ee065384a79e2e0753ecea455974347749946a03fb2baee80b80e4bd94550a

Download Submit
\Windows\system\TcydusW.exe

Filesize
2.2MB

MD5
87242e973f835eec78c52d07b226f89c

SHA1
9d68decbe39e0b8de81b0047db55c5f18eadcc0b

SHA256
ddbe1daa9757b0563adcf50e1c3d519e24bdf751fdbf5afba52f8e354b270d99

SHA512
02c316489a1c6f3e9b873dc8ad0dec9b46182d54e4464306d16c0b8906e344228125f90d3e49a25536617c5b64ffc3729574b9fa2a9eab4aa57d300c1b02f7ff

Download Submit
\Windows\system\hbpmPTO.exe

Filesize
2.2MB

MD5
e7c368eb863fbf9c6802b2552750327d

SHA1
0c805c50abfcfa4a6d2eefbcbe8a5c215047049e

SHA256
4bc600714fb89fccbac90afccbfb499e4e848f98d261b15dd3d967fe07972077

SHA512
dc0642e4abd008c9f5d973ba16a8d9e75200eb20d55f7d592e563146e5d4144517e8515e0d864ed2c42e24eeb0e9bd64ef8350614fd93f1ef3230a464961b09d

Download Submit
\Windows\system\jJbXVOJ.exe

Filesize
2.2MB

MD5
da114f5b3d50b079dae74fc84dcb2b80

SHA1
8db5a5c27a9a0b7701f99bebbe3578a261860f9b

SHA256
6d23c490f49364ff48ca3ae5fb6656d028895a5386d633e5a0f779cc6c0ad20a

SHA512
594617c5259bb4ddd6ed1abdbf51257301b99c79dec09c7d0f7f31c82035b3cc16bd3eda1bd6654eb418867b30c0f84469cf6d8c25f04065a28e822e90b922d0

Download Submit
memory/2220-70-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2220-63-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-8294-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2220-18-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2220-72-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2220-66-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-1579-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-68-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-52-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2220-75-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-99-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-6-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-69-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2472-194-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2472-49-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2472-74-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2472-50-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2472-73-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

Filesize
9.6MB

Download
memory/2472-21-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2472-22-0x000007FEF5FAE000-0x000007FEF5FAF000-memory.dmp

Filesize
4KB

Download
memory/2472-56-0x0000000002660000-0x0000000002668000-memory.dmp

Filesize
32KB

Download
memory/2500-71-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2500-5296-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2508-3453-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2508-5412-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2508-8-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2532-20-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4561-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2556-95-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2616-65-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2616-5285-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2640-51-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-4562-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-5300-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-67-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-104-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-5301-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-5168-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2872-59-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2988-76-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download