xmrig | adc1d4d4de7c05b5d4fa32c8e4deb16fed67355f9eca2658d76e15b7a33241d8

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
Size

1.9MB
MD5

0f85deb6b3434fbecfccc7e7fd043efc
SHA1

1a7cf4438161a6471c0925bd0f353ef2368dac2b
SHA256

adc1d4d4de7c05b5d4fa32c8e4deb16fed67355f9eca2658d76e15b7a33241d8
SHA512

c071fd2e06ddce47e9d9c56d6116490ddeccdddd0927f154b4a78912ee4b04cd56e234d51c9f17bc9be155c6b165558b0b5d3e7fb23ba4cdb17fdd556b7eaf5f
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1b:NABk

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2840-74-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/812-147-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2740-158-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2444-155-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2680-153-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2068-152-0x0000000003080000-0x0000000003472000-memory.dmp	xmrig
behavioral1/memory/2720-151-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2788-140-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2960-139-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2904-90-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1664	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2840	BhriDTE.exe
2904	ImdCEIs.exe
2960	nlBLbLJ.exe
2788	lMzlzBG.exe
812	MRkePoL.exe
2720	idfXsjw.exe
2680	bkxdgcs.exe
2444	cLgbvWZ.exe
2740	chpTmWC.exe
2564	LyOTlOl.exe
1260	mlIWMtD.exe
1912	KNMWXtt.exe
1808	mgqhSar.exe
2000	oBzCHiT.exe
1388	uuPfrqS.exe
2216	vvXCsdw.exe
1184	guyckGc.exe
1968	fEtpggM.exe
1320	UlBajYL.exe
2728	WgHyfLX.exe
2264	EDQUXsB.exe
2856	sdjubfE.exe
1924	pZCrioP.exe
2784	PNticbu.exe
2524	lkQJQIm.exe
2040	RmZouCf.exe
2924	bJLXqNp.exe
1936	UUOgJuX.exe
2208	qxSoFaj.exe
1236	AgzwHmk.exe
1508	GmxjAjx.exe
2220	PKxQzgd.exe
1596	cLWwrkZ.exe
1772	WobjHNp.exe
1820	xGEGLpw.exe
2800	ZWfgPUr.exe
1240	tbWlxql.exe
1132	UbFmDOc.exe
1848	OTCroUU.exe
896	dsSZCuN.exe
1532	qnKNtBi.exe
3016	zrRiTfP.exe
1660	vbJWBQS.exe
344	XiZShhr.exe
2860	JsGmidq.exe
1496	ErQnsSe.exe
888	OJUhZHo.exe
2088	uDPxJPr.exe
1792	OnAXsbj.exe
2776	ljezeAv.exe
2744	TONPrwy.exe
2764	hRjxnBV.exe
1328	KsbKKnz.exe
1292	fwFnnmE.exe
1344	qVjpVUf.exe
612	KASYdiQ.exe
2032	qOIdbLR.exe
2812	uVsBIqk.exe
1444	MxkqnaB.exe
2160	IpuvcAd.exe
3060	ePlLiBR.exe
2016	CDpQQom.exe
2664	vEEpXSZ.exe
2952	XrGgHRa.exe

Loads dropped DLL 64 IoCs

pid	Process
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2068-1-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x000d000000012271-3.dat	upx
behavioral1/files/0x0012000000015ca9-8.dat	upx
behavioral1/files/0x0007000000016ca1-35.dat	upx
behavioral1/files/0x0006000000016cf2-45.dat	upx
behavioral1/files/0x0006000000016d10-55.dat	upx
behavioral1/files/0x0006000000016d21-65.dat	upx
behavioral1/memory/2840-74-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x0006000000016d46-83.dat	upx
behavioral1/files/0x0006000000017436-136.dat	upx
behavioral1/memory/812-147-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x0006000000016d2d-192.dat	upx
behavioral1/files/0x0006000000016d79-98.dat	upx
behavioral1/files/0x0006000000016d19-181.dat	upx
behavioral1/files/0x0006000000016d01-179.dat	upx
behavioral1/files/0x0006000000017577-175.dat	upx
behavioral1/files/0x00060000000175f7-173.dat	upx
behavioral1/files/0x0006000000016ccd-168.dat	upx
behavioral1/memory/2740-158-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2444-155-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2680-153-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2720-151-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x00060000000174ef-149.dat	upx
behavioral1/files/0x00060000000173e2-135.dat	upx
behavioral1/files/0x000600000001738e-134.dat	upx
behavioral1/files/0x000600000001708c-133.dat	upx
behavioral1/files/0x0006000000016d7d-132.dat	upx
behavioral1/files/0x0006000000016d73-131.dat	upx
behavioral1/files/0x0006000000016d57-129.dat	upx
behavioral1/files/0x00060000000173e5-126.dat	upx
behavioral1/files/0x000600000001738f-117.dat	upx
behavioral1/files/0x00060000000171ad-111.dat	upx
behavioral1/files/0x0006000000016fa9-104.dat	upx
behavioral1/files/0x0006000000016d5f-91.dat	upx
behavioral1/files/0x0006000000016d4f-84.dat	upx
behavioral1/files/0x0006000000016d3e-75.dat	upx
behavioral1/files/0x0008000000015ced-54.dat	upx
behavioral1/files/0x00060000000175fd-188.dat	upx
behavioral1/files/0x0007000000016c5b-141.dat	upx
behavioral1/memory/2788-140-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2960-139-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/files/0x0007000000015d13-96.dat	upx
behavioral1/memory/2904-90-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-82.dat	upx
behavioral1/files/0x0007000000015d1e-34.dat	upx
behavioral1/files/0x0007000000015d02-25.dat	upx
behavioral1/files/0x0008000000015ce1-24.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AtrhfjV.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\unYNCko.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\sDfAIQp.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\nTZXdXb.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\pgpMnNK.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\NbKkGBv.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\JOfMeEc.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\brBuPJA.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\qUMNbwL.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\yfBVvue.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\qFOZuCi.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\YrFnAHl.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\nHQgokO.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\VSlvkMx.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\HjVVIOP.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\EMCRaEm.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\TdaoTbm.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\mheypke.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\dyHcBxC.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\jDJQsrW.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\hhOSdHm.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\iIqKPzY.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\HyQnfyh.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\oFkNsaJ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\kuBkWMG.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\eXPcPiU.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\hIKMQUp.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\crZGizd.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\KTprnUW.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\KFGQvxU.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\VfnEoSV.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\Rodfrcs.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ZLALriD.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ffJWwuw.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\CuXCpDt.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\tbDrRGi.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\qAqqJGf.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\jYqNbEh.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\XItioUY.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\KHyNfKR.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\cgwVwwU.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\fiZwIla.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\Ukbmeuf.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\TLqGyLr.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\fVWmObZ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ERtUsdT.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\RwRbNcw.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\lDfkvoA.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\rPYeDFd.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\EogYcSP.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\lqkfxaR.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\SEOVIhN.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\gjTGjgF.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ZkKkaHZ.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\YOJSnLu.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\KtaUYUU.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\HrHrPUW.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ioTReqI.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\pcoxOLa.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ONIzCwB.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\LEWSQNi.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\ouzlccv.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\LtijYIT.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
File created	C:\Windows\System\cfogyJe.exe	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	powershell.exe
1664	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
Token: SeDebugPrivilege	1664	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1664	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	29
PID 2068 wrote to memory of 1664	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	29
PID 2068 wrote to memory of 1664	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	29
PID 2068 wrote to memory of 2840	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2840	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2840	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2904	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2904	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2904	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2960	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2960	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2960	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2444	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2444	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2444	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2788	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	34
PID 2068 wrote to memory of 2788	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	34
PID 2068 wrote to memory of 2788	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	34
PID 2068 wrote to memory of 1808	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	35
PID 2068 wrote to memory of 1808	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	35
PID 2068 wrote to memory of 1808	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	35
PID 2068 wrote to memory of 812	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	36
PID 2068 wrote to memory of 812	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	36
PID 2068 wrote to memory of 812	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	36
PID 2068 wrote to memory of 2728	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2728	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2728	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2720	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2720	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2720	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2856	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2856	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2856	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2680	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	40
PID 2068 wrote to memory of 2680	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	40
PID 2068 wrote to memory of 2680	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	40
PID 2068 wrote to memory of 2784	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	41
PID 2068 wrote to memory of 2784	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	41
PID 2068 wrote to memory of 2784	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	41
PID 2068 wrote to memory of 2740	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	42
PID 2068 wrote to memory of 2740	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	42
PID 2068 wrote to memory of 2740	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	42
PID 2068 wrote to memory of 2524	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	43
PID 2068 wrote to memory of 2524	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	43
PID 2068 wrote to memory of 2524	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	43
PID 2068 wrote to memory of 2564	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	44
PID 2068 wrote to memory of 2564	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	44
PID 2068 wrote to memory of 2564	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	44
PID 2068 wrote to memory of 2924	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	45
PID 2068 wrote to memory of 2924	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	45
PID 2068 wrote to memory of 2924	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	45
PID 2068 wrote to memory of 1260	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1260	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1260	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1936	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	47
PID 2068 wrote to memory of 1936	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	47
PID 2068 wrote to memory of 1936	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	47
PID 2068 wrote to memory of 1912	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1912	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1912	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	48
PID 2068 wrote to memory of 2208	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	49
PID 2068 wrote to memory of 2208	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	49
PID 2068 wrote to memory of 2208	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	49
PID 2068 wrote to memory of 2000	2068	0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f85deb6b3434fbecfccc7e7fd043efc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System\BhriDTE.exe
  C:\Windows\System\BhriDTE.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ImdCEIs.exe
  C:\Windows\System\ImdCEIs.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\nlBLbLJ.exe
  C:\Windows\System\nlBLbLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\cLgbvWZ.exe
  C:\Windows\System\cLgbvWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\lMzlzBG.exe
  C:\Windows\System\lMzlzBG.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\mgqhSar.exe
  C:\Windows\System\mgqhSar.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\MRkePoL.exe
  C:\Windows\System\MRkePoL.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\WgHyfLX.exe
  C:\Windows\System\WgHyfLX.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\idfXsjw.exe
  C:\Windows\System\idfXsjw.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\sdjubfE.exe
  C:\Windows\System\sdjubfE.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\bkxdgcs.exe
  C:\Windows\System\bkxdgcs.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\PNticbu.exe
  C:\Windows\System\PNticbu.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\chpTmWC.exe
  C:\Windows\System\chpTmWC.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\lkQJQIm.exe
  C:\Windows\System\lkQJQIm.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\LyOTlOl.exe
  C:\Windows\System\LyOTlOl.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\bJLXqNp.exe
  C:\Windows\System\bJLXqNp.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\mlIWMtD.exe
  C:\Windows\System\mlIWMtD.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\UUOgJuX.exe
  C:\Windows\System\UUOgJuX.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\KNMWXtt.exe
  C:\Windows\System\KNMWXtt.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\qxSoFaj.exe
  C:\Windows\System\qxSoFaj.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\oBzCHiT.exe
  C:\Windows\System\oBzCHiT.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\AgzwHmk.exe
  C:\Windows\System\AgzwHmk.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\uuPfrqS.exe
  C:\Windows\System\uuPfrqS.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\GmxjAjx.exe
  C:\Windows\System\GmxjAjx.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\vvXCsdw.exe
  C:\Windows\System\vvXCsdw.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\PKxQzgd.exe
  C:\Windows\System\PKxQzgd.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\guyckGc.exe
  C:\Windows\System\guyckGc.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\WobjHNp.exe
  C:\Windows\System\WobjHNp.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\fEtpggM.exe
  C:\Windows\System\fEtpggM.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\xGEGLpw.exe
  C:\Windows\System\xGEGLpw.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\UlBajYL.exe
  C:\Windows\System\UlBajYL.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\ZWfgPUr.exe
  C:\Windows\System\ZWfgPUr.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\EDQUXsB.exe
  C:\Windows\System\EDQUXsB.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\tbWlxql.exe
  C:\Windows\System\tbWlxql.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\pZCrioP.exe
  C:\Windows\System\pZCrioP.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\UbFmDOc.exe
  C:\Windows\System\UbFmDOc.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\RmZouCf.exe
  C:\Windows\System\RmZouCf.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\OTCroUU.exe
  C:\Windows\System\OTCroUU.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\cLWwrkZ.exe
  C:\Windows\System\cLWwrkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\qnKNtBi.exe
  C:\Windows\System\qnKNtBi.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\dsSZCuN.exe
  C:\Windows\System\dsSZCuN.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\zrRiTfP.exe
  C:\Windows\System\zrRiTfP.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\vbJWBQS.exe
  C:\Windows\System\vbJWBQS.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\XiZShhr.exe
  C:\Windows\System\XiZShhr.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\JsGmidq.exe
  C:\Windows\System\JsGmidq.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\WwHuGNg.exe
  C:\Windows\System\WwHuGNg.exe
  2⤵
  PID:900
- C:\Windows\System\ErQnsSe.exe
  C:\Windows\System\ErQnsSe.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\CIyEezY.exe
  C:\Windows\System\CIyEezY.exe
  2⤵
  PID:2376
- C:\Windows\System\OJUhZHo.exe
  C:\Windows\System\OJUhZHo.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\jewpPMH.exe
  C:\Windows\System\jewpPMH.exe
  2⤵
  PID:2132
- C:\Windows\System\uDPxJPr.exe
  C:\Windows\System\uDPxJPr.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\wMWMrco.exe
  C:\Windows\System\wMWMrco.exe
  2⤵
  PID:2980
- C:\Windows\System\OnAXsbj.exe
  C:\Windows\System\OnAXsbj.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\MRGveRZ.exe
  C:\Windows\System\MRGveRZ.exe
  2⤵
  PID:2732
- C:\Windows\System\ljezeAv.exe
  C:\Windows\System\ljezeAv.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\jHdlHlP.exe
  C:\Windows\System\jHdlHlP.exe
  2⤵
  PID:1680
- C:\Windows\System\TONPrwy.exe
  C:\Windows\System\TONPrwy.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\khxhMzU.exe
  C:\Windows\System\khxhMzU.exe
  2⤵
  PID:2592
- C:\Windows\System\hRjxnBV.exe
  C:\Windows\System\hRjxnBV.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\DGmzznT.exe
  C:\Windows\System\DGmzznT.exe
  2⤵
  PID:2168
- C:\Windows\System\KsbKKnz.exe
  C:\Windows\System\KsbKKnz.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\wIclQOi.exe
  C:\Windows\System\wIclQOi.exe
  2⤵
  PID:2580
- C:\Windows\System\fwFnnmE.exe
  C:\Windows\System\fwFnnmE.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\aSEHXSr.exe
  C:\Windows\System\aSEHXSr.exe
  2⤵
  PID:2268
- C:\Windows\System\qVjpVUf.exe
  C:\Windows\System\qVjpVUf.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\iSClKaR.exe
  C:\Windows\System\iSClKaR.exe
  2⤵
  PID:1648
- C:\Windows\System\KASYdiQ.exe
  C:\Windows\System\KASYdiQ.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\vvYDuAQ.exe
  C:\Windows\System\vvYDuAQ.exe
  2⤵
  PID:2928
- C:\Windows\System\qOIdbLR.exe
  C:\Windows\System\qOIdbLR.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\IUsASCy.exe
  C:\Windows\System\IUsASCy.exe
  2⤵
  PID:2704
- C:\Windows\System\uVsBIqk.exe
  C:\Windows\System\uVsBIqk.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\DbekMzS.exe
  C:\Windows\System\DbekMzS.exe
  2⤵
  PID:2164
- C:\Windows\System\MxkqnaB.exe
  C:\Windows\System\MxkqnaB.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\LOjNqxq.exe
  C:\Windows\System\LOjNqxq.exe
  2⤵
  PID:2172
- C:\Windows\System\IpuvcAd.exe
  C:\Windows\System\IpuvcAd.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\jEWNVyp.exe
  C:\Windows\System\jEWNVyp.exe
  2⤵
  PID:1288
- C:\Windows\System\ePlLiBR.exe
  C:\Windows\System\ePlLiBR.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\SxCHMlm.exe
  C:\Windows\System\SxCHMlm.exe
  2⤵
  PID:316
- C:\Windows\System\CDpQQom.exe
  C:\Windows\System\CDpQQom.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\holnUzM.exe
  C:\Windows\System\holnUzM.exe
  2⤵
  PID:1560
- C:\Windows\System\vEEpXSZ.exe
  C:\Windows\System\vEEpXSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\SdDZLyU.exe
  C:\Windows\System\SdDZLyU.exe
  2⤵
  PID:2820
- C:\Windows\System\XrGgHRa.exe
  C:\Windows\System\XrGgHRa.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\OhWlGPw.exe
  C:\Windows\System\OhWlGPw.exe
  2⤵
  PID:2632
- C:\Windows\System\IGzvaCz.exe
  C:\Windows\System\IGzvaCz.exe
  2⤵
  PID:1180
- C:\Windows\System\hpdTjCC.exe
  C:\Windows\System\hpdTjCC.exe
  2⤵
  PID:3084
- C:\Windows\System\QJQXxtv.exe
  C:\Windows\System\QJQXxtv.exe
  2⤵
  PID:3100
- C:\Windows\System\XmUniNc.exe
  C:\Windows\System\XmUniNc.exe
  2⤵
  PID:3116
- C:\Windows\System\tVvaoVN.exe
  C:\Windows\System\tVvaoVN.exe
  2⤵
  PID:3132
- C:\Windows\System\zZWnwuM.exe
  C:\Windows\System\zZWnwuM.exe
  2⤵
  PID:3148
- C:\Windows\System\SAzSyKG.exe
  C:\Windows\System\SAzSyKG.exe
  2⤵
  PID:3164
- C:\Windows\System\DacPquB.exe
  C:\Windows\System\DacPquB.exe
  2⤵
  PID:3180
- C:\Windows\System\BmNnFRL.exe
  C:\Windows\System\BmNnFRL.exe
  2⤵
  PID:3208
- C:\Windows\System\SadBzPg.exe
  C:\Windows\System\SadBzPg.exe
  2⤵
  PID:3228
- C:\Windows\System\jEHHviI.exe
  C:\Windows\System\jEHHviI.exe
  2⤵
  PID:3244
- C:\Windows\System\NQHmQIx.exe
  C:\Windows\System\NQHmQIx.exe
  2⤵
  PID:3264
- C:\Windows\System\Dtslbjc.exe
  C:\Windows\System\Dtslbjc.exe
  2⤵
  PID:3280
- C:\Windows\System\yFoCujA.exe
  C:\Windows\System\yFoCujA.exe
  2⤵
  PID:3296
- C:\Windows\System\CfvnCbP.exe
  C:\Windows\System\CfvnCbP.exe
  2⤵
  PID:3312
- C:\Windows\System\rdonEOD.exe
  C:\Windows\System\rdonEOD.exe
  2⤵
  PID:3328
- C:\Windows\System\pchJqac.exe
  C:\Windows\System\pchJqac.exe
  2⤵
  PID:3344
- C:\Windows\System\IFAlCvj.exe
  C:\Windows\System\IFAlCvj.exe
  2⤵
  PID:3360
- C:\Windows\System\gLHrMqc.exe
  C:\Windows\System\gLHrMqc.exe
  2⤵
  PID:3376
- C:\Windows\System\FlmyBMG.exe
  C:\Windows\System\FlmyBMG.exe
  2⤵
  PID:3392
- C:\Windows\System\SLwXlal.exe
  C:\Windows\System\SLwXlal.exe
  2⤵
  PID:3416
- C:\Windows\System\iCEDCbM.exe
  C:\Windows\System\iCEDCbM.exe
  2⤵
  PID:3432
- C:\Windows\System\UYwVySi.exe
  C:\Windows\System\UYwVySi.exe
  2⤵
  PID:3448
- C:\Windows\System\ihQFCFo.exe
  C:\Windows\System\ihQFCFo.exe
  2⤵
  PID:3472
- C:\Windows\System\NhqlWLz.exe
  C:\Windows\System\NhqlWLz.exe
  2⤵
  PID:3492
- C:\Windows\System\FoTEWmW.exe
  C:\Windows\System\FoTEWmW.exe
  2⤵
  PID:3508
- C:\Windows\System\teaaRmr.exe
  C:\Windows\System\teaaRmr.exe
  2⤵
  PID:3528
- C:\Windows\System\DLSxFPf.exe
  C:\Windows\System\DLSxFPf.exe
  2⤵
  PID:3544
- C:\Windows\System\YlPJBPG.exe
  C:\Windows\System\YlPJBPG.exe
  2⤵
  PID:3560
- C:\Windows\System\XBVJoMa.exe
  C:\Windows\System\XBVJoMa.exe
  2⤵
  PID:3576
- C:\Windows\System\RvuqzPe.exe
  C:\Windows\System\RvuqzPe.exe
  2⤵
  PID:3592
- C:\Windows\System\kmukWPh.exe
  C:\Windows\System\kmukWPh.exe
  2⤵
  PID:3608
- C:\Windows\System\ukKxoRX.exe
  C:\Windows\System\ukKxoRX.exe
  2⤵
  PID:3632
- C:\Windows\System\SsXMwoT.exe
  C:\Windows\System\SsXMwoT.exe
  2⤵
  PID:3656
- C:\Windows\System\KeMzgzy.exe
  C:\Windows\System\KeMzgzy.exe
  2⤵
  PID:3676
- C:\Windows\System\eZgMUnP.exe
  C:\Windows\System\eZgMUnP.exe
  2⤵
  PID:3692
- C:\Windows\System\UniLfJm.exe
  C:\Windows\System\UniLfJm.exe
  2⤵
  PID:3708
- C:\Windows\System\QonNBvO.exe
  C:\Windows\System\QonNBvO.exe
  2⤵
  PID:3732
- C:\Windows\System\LAiERKv.exe
  C:\Windows\System\LAiERKv.exe
  2⤵
  PID:3748
- C:\Windows\System\CDdrRlV.exe
  C:\Windows\System\CDdrRlV.exe
  2⤵
  PID:3764
- C:\Windows\System\yZPbKfk.exe
  C:\Windows\System\yZPbKfk.exe
  2⤵
  PID:3780
- C:\Windows\System\AnDEAlU.exe
  C:\Windows\System\AnDEAlU.exe
  2⤵
  PID:3800
- C:\Windows\System\vUaWZCt.exe
  C:\Windows\System\vUaWZCt.exe
  2⤵
  PID:3816
- C:\Windows\System\CUulRTV.exe
  C:\Windows\System\CUulRTV.exe
  2⤵
  PID:3832
- C:\Windows\System\hNiooij.exe
  C:\Windows\System\hNiooij.exe
  2⤵
  PID:3848
- C:\Windows\System\kPJtlGl.exe
  C:\Windows\System\kPJtlGl.exe
  2⤵
  PID:3864
- C:\Windows\System\tlLQYla.exe
  C:\Windows\System\tlLQYla.exe
  2⤵
  PID:3880
- C:\Windows\System\zfqyVMl.exe
  C:\Windows\System\zfqyVMl.exe
  2⤵
  PID:3908
- C:\Windows\System\fJSSTlN.exe
  C:\Windows\System\fJSSTlN.exe
  2⤵
  PID:3924
- C:\Windows\System\TiCodbx.exe
  C:\Windows\System\TiCodbx.exe
  2⤵
  PID:3940
- C:\Windows\System\ANrQpBF.exe
  C:\Windows\System\ANrQpBF.exe
  2⤵
  PID:3956
- C:\Windows\System\IcmLzGH.exe
  C:\Windows\System\IcmLzGH.exe
  2⤵
  PID:3972
- C:\Windows\System\zjPYiKL.exe
  C:\Windows\System\zjPYiKL.exe
  2⤵
  PID:3992
- C:\Windows\System\OFbvPzv.exe
  C:\Windows\System\OFbvPzv.exe
  2⤵
  PID:4008
- C:\Windows\System\JSHTmkx.exe
  C:\Windows\System\JSHTmkx.exe
  2⤵
  PID:4024
- C:\Windows\System\FBTECPd.exe
  C:\Windows\System\FBTECPd.exe
  2⤵
  PID:4040
- C:\Windows\System\cKWQpCb.exe
  C:\Windows\System\cKWQpCb.exe
  2⤵
  PID:4056
- C:\Windows\System\sBmZTPi.exe
  C:\Windows\System\sBmZTPi.exe
  2⤵
  PID:4072
- C:\Windows\System\YsWJcbs.exe
  C:\Windows\System\YsWJcbs.exe
  2⤵
  PID:4088
- C:\Windows\System\mXidPhu.exe
  C:\Windows\System\mXidPhu.exe
  2⤵
  PID:2432
- C:\Windows\System\hViXhho.exe
  C:\Windows\System\hViXhho.exe
  2⤵
  PID:2416
- C:\Windows\System\UGwsXSg.exe
  C:\Windows\System\UGwsXSg.exe
  2⤵
  PID:2372
- C:\Windows\System\XhBYhJK.exe
  C:\Windows\System\XhBYhJK.exe
  2⤵
  PID:1796
- C:\Windows\System\DNufzsB.exe
  C:\Windows\System\DNufzsB.exe
  2⤵
  PID:3144
- C:\Windows\System\MsDiiWT.exe
  C:\Windows\System\MsDiiWT.exe
  2⤵
  PID:3220
- C:\Windows\System\zWtWGfl.exe
  C:\Windows\System\zWtWGfl.exe
  2⤵
  PID:3260
- C:\Windows\System\HEKvayp.exe
  C:\Windows\System\HEKvayp.exe
  2⤵
  PID:3324
- C:\Windows\System\APXBRqR.exe
  C:\Windows\System\APXBRqR.exe
  2⤵
  PID:3424
- C:\Windows\System\NKKpYaL.exe
  C:\Windows\System\NKKpYaL.exe
  2⤵
  PID:3460
- C:\Windows\System\DtegOAF.exe
  C:\Windows\System\DtegOAF.exe
  2⤵
  PID:2804
- C:\Windows\System\YnptFFj.exe
  C:\Windows\System\YnptFFj.exe
  2⤵
  PID:3572
- C:\Windows\System\NKQfYgR.exe
  C:\Windows\System\NKQfYgR.exe
  2⤵
  PID:3652
- C:\Windows\System\PmlXQGx.exe
  C:\Windows\System\PmlXQGx.exe
  2⤵
  PID:3688
- C:\Windows\System\RlhMvBd.exe
  C:\Windows\System\RlhMvBd.exe
  2⤵
  PID:3720
- C:\Windows\System\IuSAyNR.exe
  C:\Windows\System\IuSAyNR.exe
  2⤵
  PID:2640
- C:\Windows\System\hLzVXbS.exe
  C:\Windows\System\hLzVXbS.exe
  2⤵
  PID:3824
- C:\Windows\System\qmzivYY.exe
  C:\Windows\System\qmzivYY.exe
  2⤵
  PID:3856
- C:\Windows\System\GFHmArx.exe
  C:\Windows\System\GFHmArx.exe
  2⤵
  PID:1436
- C:\Windows\System\WedaoxD.exe
  C:\Windows\System\WedaoxD.exe
  2⤵
  PID:852
- C:\Windows\System\MyKVtsI.exe
  C:\Windows\System\MyKVtsI.exe
  2⤵
  PID:4068
- C:\Windows\System\OgtUHps.exe
  C:\Windows\System\OgtUHps.exe
  2⤵
  PID:308
- C:\Windows\System\ANtWfeO.exe
  C:\Windows\System\ANtWfeO.exe
  2⤵
  PID:584
- C:\Windows\System\qDoPoKM.exe
  C:\Windows\System\qDoPoKM.exe
  2⤵
  PID:3140
- C:\Windows\System\AcuQPDV.exe
  C:\Windows\System\AcuQPDV.exe
  2⤵
  PID:2044
- C:\Windows\System\wBdSMaZ.exe
  C:\Windows\System\wBdSMaZ.exe
  2⤵
  PID:696
- C:\Windows\System\FlGOEmk.exe
  C:\Windows\System\FlGOEmk.exe
  2⤵
  PID:2756
- C:\Windows\System\JeMWYnq.exe
  C:\Windows\System\JeMWYnq.exe
  2⤵
  PID:3724
- C:\Windows\System\WuKgnuz.exe
  C:\Windows\System\WuKgnuz.exe
  2⤵
  PID:3892
- C:\Windows\System\xjEVXka.exe
  C:\Windows\System\xjEVXka.exe
  2⤵
  PID:3968
- C:\Windows\System\egYDlgZ.exe
  C:\Windows\System\egYDlgZ.exe
  2⤵
  PID:4064
- C:\Windows\System\zgeFOYN.exe
  C:\Windows\System\zgeFOYN.exe
  2⤵
  PID:664
- C:\Windows\System\EYuQNdQ.exe
  C:\Windows\System\EYuQNdQ.exe
  2⤵
  PID:3384
- C:\Windows\System\LcMOpYS.exe
  C:\Windows\System\LcMOpYS.exe
  2⤵
  PID:3900
- C:\Windows\System\XJLzDnT.exe
  C:\Windows\System\XJLzDnT.exe
  2⤵
  PID:4104
- C:\Windows\System\jRtyUeG.exe
  C:\Windows\System\jRtyUeG.exe
  2⤵
  PID:4120
- C:\Windows\System\jbxzdTu.exe
  C:\Windows\System\jbxzdTu.exe
  2⤵
  PID:4136
- C:\Windows\System\pTAyVGm.exe
  C:\Windows\System\pTAyVGm.exe
  2⤵
  PID:4152
- C:\Windows\System\FaCJxXC.exe
  C:\Windows\System\FaCJxXC.exe
  2⤵
  PID:4176
- C:\Windows\System\wYEEJwK.exe
  C:\Windows\System\wYEEJwK.exe
  2⤵
  PID:4192
- C:\Windows\System\lokJCUe.exe
  C:\Windows\System\lokJCUe.exe
  2⤵
  PID:4208
- C:\Windows\System\bsvqnDa.exe
  C:\Windows\System\bsvqnDa.exe
  2⤵
  PID:4232
- C:\Windows\System\nJeAEOy.exe
  C:\Windows\System\nJeAEOy.exe
  2⤵
  PID:4248
- C:\Windows\System\ZfiBpzX.exe
  C:\Windows\System\ZfiBpzX.exe
  2⤵
  PID:4264
- C:\Windows\System\LbOzqDw.exe
  C:\Windows\System\LbOzqDw.exe
  2⤵
  PID:4284
- C:\Windows\System\FvvmbfG.exe
  C:\Windows\System\FvvmbfG.exe
  2⤵
  PID:4300
- C:\Windows\System\yigvYwj.exe
  C:\Windows\System\yigvYwj.exe
  2⤵
  PID:4316
- C:\Windows\System\wIlpeoS.exe
  C:\Windows\System\wIlpeoS.exe
  2⤵
  PID:4340
- C:\Windows\System\KUIqoAo.exe
  C:\Windows\System\KUIqoAo.exe
  2⤵
  PID:4356
- C:\Windows\System\CEgeNdj.exe
  C:\Windows\System\CEgeNdj.exe
  2⤵
  PID:4372
- C:\Windows\System\SGIcvqw.exe
  C:\Windows\System\SGIcvqw.exe
  2⤵
  PID:4388
- C:\Windows\System\nGxqtXa.exe
  C:\Windows\System\nGxqtXa.exe
  2⤵
  PID:4404
- C:\Windows\System\wSnuXwp.exe
  C:\Windows\System\wSnuXwp.exe
  2⤵
  PID:4424
- C:\Windows\System\jhJmqKd.exe
  C:\Windows\System\jhJmqKd.exe
  2⤵
  PID:4440
- C:\Windows\System\zYmDIdt.exe
  C:\Windows\System\zYmDIdt.exe
  2⤵
  PID:4456
- C:\Windows\System\lQZwRFL.exe
  C:\Windows\System\lQZwRFL.exe
  2⤵
  PID:4472
- C:\Windows\System\RVbhcXA.exe
  C:\Windows\System\RVbhcXA.exe
  2⤵
  PID:4488
- C:\Windows\System\UwRDJni.exe
  C:\Windows\System\UwRDJni.exe
  2⤵
  PID:4504
- C:\Windows\System\EhhrdIK.exe
  C:\Windows\System\EhhrdIK.exe
  2⤵
  PID:4532
- C:\Windows\System\OJVSlac.exe
  C:\Windows\System\OJVSlac.exe
  2⤵
  PID:4548
- C:\Windows\System\xyFHLAW.exe
  C:\Windows\System\xyFHLAW.exe
  2⤵
  PID:4564
- C:\Windows\System\tOIMtnn.exe
  C:\Windows\System\tOIMtnn.exe
  2⤵
  PID:4580
- C:\Windows\System\YtJAWlX.exe
  C:\Windows\System\YtJAWlX.exe
  2⤵
  PID:4604
- C:\Windows\System\TLqGyLr.exe
  C:\Windows\System\TLqGyLr.exe
  2⤵
  PID:4624
- C:\Windows\System\PttlYRG.exe
  C:\Windows\System\PttlYRG.exe
  2⤵
  PID:4640
- C:\Windows\System\BCuGmFj.exe
  C:\Windows\System\BCuGmFj.exe
  2⤵
  PID:4656
- C:\Windows\System\KQeatIm.exe
  C:\Windows\System\KQeatIm.exe
  2⤵
  PID:4672
- C:\Windows\System\oFofMww.exe
  C:\Windows\System\oFofMww.exe
  2⤵
  PID:4688
- C:\Windows\System\afkZLTX.exe
  C:\Windows\System\afkZLTX.exe
  2⤵
  PID:4704
- C:\Windows\System\zzUkgxp.exe
  C:\Windows\System\zzUkgxp.exe
  2⤵
  PID:4720
- C:\Windows\System\XdUGVhU.exe
  C:\Windows\System\XdUGVhU.exe
  2⤵
  PID:4740
- C:\Windows\System\AWMEfjb.exe
  C:\Windows\System\AWMEfjb.exe
  2⤵
  PID:4764
- C:\Windows\System\lZfOWnt.exe
  C:\Windows\System\lZfOWnt.exe
  2⤵
  PID:4780
- C:\Windows\System\uqUxrxC.exe
  C:\Windows\System\uqUxrxC.exe
  2⤵
  PID:4796
- C:\Windows\System\yPorVgZ.exe
  C:\Windows\System\yPorVgZ.exe
  2⤵
  PID:4812
- C:\Windows\System\JnPnWoS.exe
  C:\Windows\System\JnPnWoS.exe
  2⤵
  PID:4828
- C:\Windows\System\RyqrJnC.exe
  C:\Windows\System\RyqrJnC.exe
  2⤵
  PID:4844
- C:\Windows\System\QGudItl.exe
  C:\Windows\System\QGudItl.exe
  2⤵
  PID:4860
- C:\Windows\System\hjgjPae.exe
  C:\Windows\System\hjgjPae.exe
  2⤵
  PID:4880
- C:\Windows\System\rPFNMma.exe
  C:\Windows\System\rPFNMma.exe
  2⤵
  PID:4896
- C:\Windows\System\tbXPcyF.exe
  C:\Windows\System\tbXPcyF.exe
  2⤵
  PID:4912
- C:\Windows\System\EiErimt.exe
  C:\Windows\System\EiErimt.exe
  2⤵
  PID:4932
- C:\Windows\System\ViKUMuN.exe
  C:\Windows\System\ViKUMuN.exe
  2⤵
  PID:4948
- C:\Windows\System\GqInIrU.exe
  C:\Windows\System\GqInIrU.exe
  2⤵
  PID:4964
- C:\Windows\System\fOrmRzx.exe
  C:\Windows\System\fOrmRzx.exe
  2⤵
  PID:4980
- C:\Windows\System\uwWBXsj.exe
  C:\Windows\System\uwWBXsj.exe
  2⤵
  PID:5000
- C:\Windows\System\RogDgiW.exe
  C:\Windows\System\RogDgiW.exe
  2⤵
  PID:5016
- C:\Windows\System\BxTmUnE.exe
  C:\Windows\System\BxTmUnE.exe
  2⤵
  PID:5032
- C:\Windows\System\HUfJOoX.exe
  C:\Windows\System\HUfJOoX.exe
  2⤵
  PID:5048
- C:\Windows\System\cWQtKcq.exe
  C:\Windows\System\cWQtKcq.exe
  2⤵
  PID:5064
- C:\Windows\System\viqajsD.exe
  C:\Windows\System\viqajsD.exe
  2⤵
  PID:5080
- C:\Windows\System\haAOcLP.exe
  C:\Windows\System\haAOcLP.exe
  2⤵
  PID:5096
- C:\Windows\System\peunUhm.exe
  C:\Windows\System\peunUhm.exe
  2⤵
  PID:5112
- C:\Windows\System\sNygmAs.exe
  C:\Windows\System\sNygmAs.exe
  2⤵
  PID:3252
- C:\Windows\System\FLxVHzZ.exe
  C:\Windows\System\FLxVHzZ.exe
  2⤵
  PID:3888
- C:\Windows\System\PdZoHrs.exe
  C:\Windows\System\PdZoHrs.exe
  2⤵
  PID:4160
- C:\Windows\System\hxzRnjk.exe
  C:\Windows\System\hxzRnjk.exe
  2⤵
  PID:4200
- C:\Windows\System\YKQDYeB.exe
  C:\Windows\System\YKQDYeB.exe
  2⤵
  PID:4272
- C:\Windows\System\qSSzchW.exe
  C:\Windows\System\qSSzchW.exe
  2⤵
  PID:4312
- C:\Windows\System\xnwfKVG.exe
  C:\Windows\System\xnwfKVG.exe
  2⤵
  PID:4380
- C:\Windows\System\yLqrjUQ.exe
  C:\Windows\System\yLqrjUQ.exe
  2⤵
  PID:2404
- C:\Windows\System\wrEtDeb.exe
  C:\Windows\System\wrEtDeb.exe
  2⤵
  PID:4452
- C:\Windows\System\GnsbeEN.exe
  C:\Windows\System\GnsbeEN.exe
  2⤵
  PID:4516
- C:\Windows\System\UxWAeyX.exe
  C:\Windows\System\UxWAeyX.exe
  2⤵
  PID:4556
- C:\Windows\System\HRgMeoz.exe
  C:\Windows\System\HRgMeoz.exe
  2⤵
  PID:4600
- C:\Windows\System\DMtuuWf.exe
  C:\Windows\System\DMtuuWf.exe
  2⤵
  PID:560
- C:\Windows\System\ffysdsp.exe
  C:\Windows\System\ffysdsp.exe
  2⤵
  PID:1428
- C:\Windows\System\uorQLvl.exe
  C:\Windows\System\uorQLvl.exe
  2⤵
  PID:4700
- C:\Windows\System\SfCjMaP.exe
  C:\Windows\System\SfCjMaP.exe
  2⤵
  PID:4772
- C:\Windows\System\kusXSGk.exe
  C:\Windows\System\kusXSGk.exe
  2⤵
  PID:4808
- C:\Windows\System\NggGopr.exe
  C:\Windows\System\NggGopr.exe
  2⤵
  PID:4840
- C:\Windows\System\nfGoejs.exe
  C:\Windows\System\nfGoejs.exe
  2⤵
  PID:4904
- C:\Windows\System\WJrBqof.exe
  C:\Windows\System\WJrBqof.exe
  2⤵
  PID:2488
- C:\Windows\System\UCBKXyI.exe
  C:\Windows\System\UCBKXyI.exe
  2⤵
  PID:5012
- C:\Windows\System\HdDRaBd.exe
  C:\Windows\System\HdDRaBd.exe
  2⤵
  PID:688
- C:\Windows\System\ZNkSnYF.exe
  C:\Windows\System\ZNkSnYF.exe
  2⤵
  PID:2876
- C:\Windows\System\fgjSeFn.exe
  C:\Windows\System\fgjSeFn.exe
  2⤵
  PID:2864
- C:\Windows\System\HWRhiOj.exe
  C:\Windows\System\HWRhiOj.exe
  2⤵
  PID:5136
- C:\Windows\System\ZVAvfkK.exe
  C:\Windows\System\ZVAvfkK.exe
  2⤵
  PID:5152
- C:\Windows\System\vyVjhKK.exe
  C:\Windows\System\vyVjhKK.exe
  2⤵
  PID:5172
- C:\Windows\System\BQMVeoe.exe
  C:\Windows\System\BQMVeoe.exe
  2⤵
  PID:5188
- C:\Windows\System\flayfSh.exe
  C:\Windows\System\flayfSh.exe
  2⤵
  PID:5204
- C:\Windows\System\SbLtJcU.exe
  C:\Windows\System\SbLtJcU.exe
  2⤵
  PID:5220
- C:\Windows\System\SxIqOgV.exe
  C:\Windows\System\SxIqOgV.exe
  2⤵
  PID:5236
- C:\Windows\System\yenqTjD.exe
  C:\Windows\System\yenqTjD.exe
  2⤵
  PID:5252
- C:\Windows\System\SEyZGfq.exe
  C:\Windows\System\SEyZGfq.exe
  2⤵
  PID:5268
- C:\Windows\System\qrLyhdd.exe
  C:\Windows\System\qrLyhdd.exe
  2⤵
  PID:5288
- C:\Windows\System\juQPVAu.exe
  C:\Windows\System\juQPVAu.exe
  2⤵
  PID:5304
- C:\Windows\System\LLIrnAJ.exe
  C:\Windows\System\LLIrnAJ.exe
  2⤵
  PID:5320
- C:\Windows\System\beVdvZI.exe
  C:\Windows\System\beVdvZI.exe
  2⤵
  PID:5336
- C:\Windows\System\DwlZUOr.exe
  C:\Windows\System\DwlZUOr.exe
  2⤵
  PID:5356
- C:\Windows\System\zywvtax.exe
  C:\Windows\System\zywvtax.exe
  2⤵
  PID:5372
- C:\Windows\System\vdQyTeG.exe
  C:\Windows\System\vdQyTeG.exe
  2⤵
  PID:5388
- C:\Windows\System\WniwjDq.exe
  C:\Windows\System\WniwjDq.exe
  2⤵
  PID:5404
- C:\Windows\System\toRVAQD.exe
  C:\Windows\System\toRVAQD.exe
  2⤵
  PID:5420
- C:\Windows\System\TWENANu.exe
  C:\Windows\System\TWENANu.exe
  2⤵
  PID:5436
- C:\Windows\System\xgjUZrQ.exe
  C:\Windows\System\xgjUZrQ.exe
  2⤵
  PID:5848
- C:\Windows\System\NGUNaRG.exe
  C:\Windows\System\NGUNaRG.exe
  2⤵
  PID:5904
- C:\Windows\System\pZGpbQU.exe
  C:\Windows\System\pZGpbQU.exe
  2⤵
  PID:5924
- C:\Windows\System\SZunQJc.exe
  C:\Windows\System\SZunQJc.exe
  2⤵
  PID:6024
- C:\Windows\System\rBbfmDv.exe
  C:\Windows\System\rBbfmDv.exe
  2⤵
  PID:1360
- C:\Windows\System\ZoDpuwk.exe
  C:\Windows\System\ZoDpuwk.exe
  2⤵
  PID:3056
- C:\Windows\System\PJlPfng.exe
  C:\Windows\System\PJlPfng.exe
  2⤵
  PID:2028
- C:\Windows\System\LwSnrbM.exe
  C:\Windows\System\LwSnrbM.exe
  2⤵
  PID:1980
- C:\Windows\System\UFczmja.exe
  C:\Windows\System\UFczmja.exe
  2⤵
  PID:5108
- C:\Windows\System\PmcQqJW.exe
  C:\Windows\System\PmcQqJW.exe
  2⤵
  PID:4168
- C:\Windows\System\BXmQmBn.exe
  C:\Windows\System\BXmQmBn.exe
  2⤵
  PID:4412
- C:\Windows\System\afzmdgd.exe
  C:\Windows\System\afzmdgd.exe
  2⤵
  PID:2484
- C:\Windows\System\PiygZTD.exe
  C:\Windows\System\PiygZTD.exe
  2⤵
  PID:1492
- C:\Windows\System\iuoAkyI.exe
  C:\Windows\System\iuoAkyI.exe
  2⤵
  PID:2288
- C:\Windows\System\cTSNlcT.exe
  C:\Windows\System\cTSNlcT.exe
  2⤵
  PID:764
- C:\Windows\System\SrEmHld.exe
  C:\Windows\System\SrEmHld.exe
  2⤵
  PID:5180
- C:\Windows\System\VplEvor.exe
  C:\Windows\System\VplEvor.exe
  2⤵
  PID:5244
- C:\Windows\System\heKnAjU.exe
  C:\Windows\System\heKnAjU.exe
  2⤵
  PID:5284
- C:\Windows\System\RcWBkCs.exe
  C:\Windows\System\RcWBkCs.exe
  2⤵
  PID:5348
- C:\Windows\System\pmRjGiM.exe
  C:\Windows\System\pmRjGiM.exe
  2⤵
  PID:5412
- C:\Windows\System\NGZWowp.exe
  C:\Windows\System\NGZWowp.exe
  2⤵
  PID:5452
- C:\Windows\System\DhooevU.exe
  C:\Windows\System\DhooevU.exe
  2⤵
  PID:5468
- C:\Windows\System\ONIzCwB.exe
  C:\Windows\System\ONIzCwB.exe
  2⤵
  PID:2528
- C:\Windows\System\YmvAjGT.exe
  C:\Windows\System\YmvAjGT.exe
  2⤵
  PID:5480
- C:\Windows\System\tcwAPoi.exe
  C:\Windows\System\tcwAPoi.exe
  2⤵
  PID:5496
- C:\Windows\System\aUKhHme.exe
  C:\Windows\System\aUKhHme.exe
  2⤵
  PID:5512
- C:\Windows\System\RoJeaWN.exe
  C:\Windows\System\RoJeaWN.exe
  2⤵
  PID:5532
- C:\Windows\System\DWpbeCs.exe
  C:\Windows\System\DWpbeCs.exe
  2⤵
  PID:5548
- C:\Windows\System\gmSPgaP.exe
  C:\Windows\System\gmSPgaP.exe
  2⤵
  PID:3936
- C:\Windows\System\zMsdEmn.exe
  C:\Windows\System\zMsdEmn.exe
  2⤵
  PID:4080
- C:\Windows\System\kUttfyJ.exe
  C:\Windows\System\kUttfyJ.exe
  2⤵
  PID:4184
- C:\Windows\System\lpbxSFE.exe
  C:\Windows\System\lpbxSFE.exe
  2⤵
  PID:5616
- C:\Windows\System\NqENLjv.exe
  C:\Windows\System\NqENLjv.exe
  2⤵
  PID:5632
- C:\Windows\System\NfHWJqZ.exe
  C:\Windows\System\NfHWJqZ.exe
  2⤵
  PID:5652
- C:\Windows\System\dSqOnZf.exe
  C:\Windows\System\dSqOnZf.exe
  2⤵
  PID:4680
- C:\Windows\System\jqINyWW.exe
  C:\Windows\System\jqINyWW.exe
  2⤵
  PID:5692
- C:\Windows\System\uhYntPb.exe
  C:\Windows\System\uhYntPb.exe
  2⤵
  PID:4872
- C:\Windows\System\PjOGPhc.exe
  C:\Windows\System\PjOGPhc.exe
  2⤵
  PID:5260
- C:\Windows\System\KlrmPPT.exe
  C:\Windows\System\KlrmPPT.exe
  2⤵
  PID:5364
- C:\Windows\System\AdjcGjP.exe
  C:\Windows\System\AdjcGjP.exe
  2⤵
  PID:2328
- C:\Windows\System\NDTikfH.exe
  C:\Windows\System\NDTikfH.exe
  2⤵
  PID:2104
- C:\Windows\System\AvYxMwq.exe
  C:\Windows\System\AvYxMwq.exe
  2⤵
  PID:1052
- C:\Windows\System\cFPAueV.exe
  C:\Windows\System\cFPAueV.exe
  2⤵
  PID:836
- C:\Windows\System\eYgYnZf.exe
  C:\Windows\System\eYgYnZf.exe
  2⤵
  PID:2988
- C:\Windows\System\MZmiLQh.exe
  C:\Windows\System\MZmiLQh.exe
  2⤵
  PID:2240
- C:\Windows\System\SMBhMSI.exe
  C:\Windows\System\SMBhMSI.exe
  2⤵
  PID:3096
- C:\Windows\System\RFGqugj.exe
  C:\Windows\System\RFGqugj.exe
  2⤵
  PID:2748
- C:\Windows\System\bXAPkZi.exe
  C:\Windows\System\bXAPkZi.exe
  2⤵
  PID:2608
- C:\Windows\System\RsuWygI.exe
  C:\Windows\System\RsuWygI.exe
  2⤵
  PID:2284
- C:\Windows\System\jRpBARF.exe
  C:\Windows\System\jRpBARF.exe
  2⤵
  PID:3196
- C:\Windows\System\IFZxfLk.exe
  C:\Windows\System\IFZxfLk.exe
  2⤵
  PID:3440
- C:\Windows\System\iCLpplx.exe
  C:\Windows\System\iCLpplx.exe
  2⤵
  PID:3488
- C:\Windows\System\RNTVDjJ.exe
  C:\Windows\System\RNTVDjJ.exe
  2⤵
  PID:3552
- C:\Windows\System\DKlpNiA.exe
  C:\Windows\System\DKlpNiA.exe
  2⤵
  PID:3616
- C:\Windows\System\hpvoDWo.exe
  C:\Windows\System\hpvoDWo.exe
  2⤵
  PID:3664
- C:\Windows\System\KsFhziZ.exe
  C:\Windows\System\KsFhziZ.exe
  2⤵
  PID:3704
- C:\Windows\System\fqoYPrS.exe
  C:\Windows\System\fqoYPrS.exe
  2⤵
  PID:3808
- C:\Windows\System\GRzBQns.exe
  C:\Windows\System\GRzBQns.exe
  2⤵
  PID:3872
- C:\Windows\System\UNkSNmD.exe
  C:\Windows\System\UNkSNmD.exe
  2⤵
  PID:3952
- C:\Windows\System\LcJyjvw.exe
  C:\Windows\System\LcJyjvw.exe
  2⤵
  PID:4016
- C:\Windows\System\hyzsnTV.exe
  C:\Windows\System\hyzsnTV.exe
  2⤵
  PID:880
- C:\Windows\System\IYodooR.exe
  C:\Windows\System\IYodooR.exe
  2⤵
  PID:3828
- C:\Windows\System\QCJVahY.exe
  C:\Windows\System\QCJVahY.exe
  2⤵
  PID:4032
- C:\Windows\System\LuSxgFV.exe
  C:\Windows\System\LuSxgFV.exe
  2⤵
  PID:2452
- C:\Windows\System\MQgkFNp.exe
  C:\Windows\System\MQgkFNp.exe
  2⤵
  PID:2480
- C:\Windows\System\qQvNtde.exe
  C:\Windows\System\qQvNtde.exe
  2⤵
  PID:3932
- C:\Windows\System\cREkhjp.exe
  C:\Windows\System\cREkhjp.exe
  2⤵
  PID:3792
- C:\Windows\System\ffJWwuw.exe
  C:\Windows\System\ffJWwuw.exe
  2⤵
  PID:4228
- C:\Windows\System\qPjPjcl.exe
  C:\Windows\System\qPjPjcl.exe
  2⤵
  PID:4324
- C:\Windows\System\iXZTSBx.exe
  C:\Windows\System\iXZTSBx.exe
  2⤵
  PID:4396
- C:\Windows\System\nVpmGRL.exe
  C:\Windows\System\nVpmGRL.exe
  2⤵
  PID:4464
- C:\Windows\System\QzCMZKH.exe
  C:\Windows\System\QzCMZKH.exe
  2⤵
  PID:4540
- C:\Windows\System\DzSxpjG.exe
  C:\Windows\System\DzSxpjG.exe
  2⤵
  PID:4612
- C:\Windows\System\DZaVstY.exe
  C:\Windows\System\DZaVstY.exe
  2⤵
  PID:4684
- C:\Windows\System\zWrmOet.exe
  C:\Windows\System\zWrmOet.exe
  2⤵
  PID:4752
- C:\Windows\System\OFnXAcM.exe
  C:\Windows\System\OFnXAcM.exe
  2⤵
  PID:4820
- C:\Windows\System\wYAGckd.exe
  C:\Windows\System\wYAGckd.exe
  2⤵
  PID:4892
- C:\Windows\System\ZgfiKuc.exe
  C:\Windows\System\ZgfiKuc.exe
  2⤵
  PID:4960
- C:\Windows\System\tILHdDk.exe
  C:\Windows\System\tILHdDk.exe
  2⤵
  PID:5056
- C:\Windows\System\NkBSjXn.exe
  C:\Windows\System\NkBSjXn.exe
  2⤵
  PID:1988
- C:\Windows\System\CgvdWwy.exe
  C:\Windows\System\CgvdWwy.exe
  2⤵
  PID:4240
- C:\Windows\System\cRLmBTK.exe
  C:\Windows\System\cRLmBTK.exe
  2⤵
  PID:1592
- C:\Windows\System\jnzaCyo.exe
  C:\Windows\System\jnzaCyo.exe
  2⤵
  PID:4632
- C:\Windows\System\kUPLRVj.exe
  C:\Windows\System\kUPLRVj.exe
  2⤵
  PID:4804
- C:\Windows\System\eJSuzoV.exe
  C:\Windows\System\eJSuzoV.exe
  2⤵
  PID:2884
- C:\Windows\System\hjkDwyb.exe
  C:\Windows\System\hjkDwyb.exe
  2⤵
  PID:5196
- C:\Windows\System\snVKkhi.exe
  C:\Windows\System\snVKkhi.exe
  2⤵
  PID:5300
- C:\Windows\System\ThfXLHb.exe
  C:\Windows\System\ThfXLHb.exe
  2⤵
  PID:5808
- C:\Windows\System\NkCSAdL.exe
  C:\Windows\System\NkCSAdL.exe
  2⤵
  PID:5832
- C:\Windows\System\mIvqyij.exe
  C:\Windows\System\mIvqyij.exe
  2⤵
  PID:1992
- C:\Windows\System\kbEOuCZ.exe
  C:\Windows\System\kbEOuCZ.exe
  2⤵
  PID:5912
- C:\Windows\System\kXyMLTx.exe
  C:\Windows\System\kXyMLTx.exe
  2⤵
  PID:2888
- C:\Windows\System\bkkfqtL.exe
  C:\Windows\System\bkkfqtL.exe
  2⤵
  PID:5868
- C:\Windows\System\ZCAIqoS.exe
  C:\Windows\System\ZCAIqoS.exe
  2⤵
  PID:5888
- C:\Windows\System\YHkuHNG.exe
  C:\Windows\System\YHkuHNG.exe
  2⤵
  PID:2228
- C:\Windows\System\cVrOiNy.exe
  C:\Windows\System\cVrOiNy.exe
  2⤵
  PID:5932
- C:\Windows\System\DluZKxi.exe
  C:\Windows\System\DluZKxi.exe
  2⤵
  PID:5952
- C:\Windows\System\ABLarDc.exe
  C:\Windows\System\ABLarDc.exe
  2⤵
  PID:5984
- C:\Windows\System\EyTLblM.exe
  C:\Windows\System\EyTLblM.exe
  2⤵
  PID:3020
- C:\Windows\System\HhaIrAO.exe
  C:\Windows\System\HhaIrAO.exe
  2⤵
  PID:2552
- C:\Windows\System\MOhzVpn.exe
  C:\Windows\System\MOhzVpn.exe
  2⤵
  PID:6008
- C:\Windows\System\mcwMGaz.exe
  C:\Windows\System\mcwMGaz.exe
  2⤵
  PID:6072
- C:\Windows\System\xZodOKI.exe
  C:\Windows\System\xZodOKI.exe
  2⤵
  PID:6088
- C:\Windows\System\XKeLWAi.exe
  C:\Windows\System\XKeLWAi.exe
  2⤵
  PID:6104
- C:\Windows\System\EenRdtb.exe
  C:\Windows\System\EenRdtb.exe
  2⤵
  PID:1860
- C:\Windows\System\BjKogqw.exe
  C:\Windows\System\BjKogqw.exe
  2⤵
  PID:1472
- C:\Windows\System\NXQpMfD.exe
  C:\Windows\System\NXQpMfD.exe
  2⤵
  PID:6116
- C:\Windows\System\cVkglsX.exe
  C:\Windows\System\cVkglsX.exe
  2⤵
  PID:6136
- C:\Windows\System\zVvSsTM.exe
  C:\Windows\System\zVvSsTM.exe
  2⤵
  PID:2232
- C:\Windows\System\Jjdvrsv.exe
  C:\Windows\System\Jjdvrsv.exe
  2⤵
  PID:2496
- C:\Windows\System\zoiGABY.exe
  C:\Windows\System\zoiGABY.exe
  2⤵
  PID:2532
- C:\Windows\System\QouTLAV.exe
  C:\Windows\System\QouTLAV.exe
  2⤵
  PID:5976
- C:\Windows\System\xdcKXfA.exe
  C:\Windows\System\xdcKXfA.exe
  2⤵
  PID:1948
- C:\Windows\System\VYboaey.exe
  C:\Windows\System\VYboaey.exe
  2⤵
  PID:1244
- C:\Windows\System\BYcjuRj.exe
  C:\Windows\System\BYcjuRj.exe
  2⤵
  PID:496
- C:\Windows\System\pUPCdtn.exe
  C:\Windows\System\pUPCdtn.exe
  2⤵
  PID:2304
- C:\Windows\System\VcqkuMT.exe
  C:\Windows\System\VcqkuMT.exe
  2⤵
  PID:3356
- C:\Windows\System\jKMLyMR.exe
  C:\Windows\System\jKMLyMR.exe
  2⤵
  PID:4736
- C:\Windows\System\umijFwD.exe
  C:\Windows\System\umijFwD.exe
  2⤵
  PID:5148
- C:\Windows\System\JFVvRFu.exe
  C:\Windows\System\JFVvRFu.exe
  2⤵
  PID:5384
- C:\Windows\System\PeYmNFL.exe
  C:\Windows\System\PeYmNFL.exe
  2⤵
  PID:4276
- C:\Windows\System\vfrodia.exe
  C:\Windows\System\vfrodia.exe
  2⤵
  PID:4944
- C:\Windows\System\JjEiUSR.exe
  C:\Windows\System\JjEiUSR.exe
  2⤵
  PID:5216
- C:\Windows\System\eDmXQry.exe
  C:\Windows\System\eDmXQry.exe
  2⤵
  PID:5448
- C:\Windows\System\hKpXaBJ.exe
  C:\Windows\System\hKpXaBJ.exe
  2⤵
  PID:5520
- C:\Windows\System\GjvdzUj.exe
  C:\Windows\System\GjvdzUj.exe
  2⤵
  PID:5460
- C:\Windows\System\BjHlcaM.exe
  C:\Windows\System\BjHlcaM.exe
  2⤵
  PID:5508
- C:\Windows\System\JJDeECd.exe
  C:\Windows\System\JJDeECd.exe
  2⤵
  PID:5580
- C:\Windows\System\otuznTd.exe
  C:\Windows\System\otuznTd.exe
  2⤵
  PID:3920
- C:\Windows\System\oGoFXzO.exe
  C:\Windows\System\oGoFXzO.exe
  2⤵
  PID:2808
- C:\Windows\System\GSMCqdc.exe
  C:\Windows\System\GSMCqdc.exe
  2⤵
  PID:5624
- C:\Windows\System\nKxGRiD.exe
  C:\Windows\System\nKxGRiD.exe
  2⤵
  PID:5648
- C:\Windows\System\fsKMcaI.exe
  C:\Windows\System\fsKMcaI.exe
  2⤵
  PID:5700
- C:\Windows\System\iHUkjCF.exe
  C:\Windows\System\iHUkjCF.exe
  2⤵
  PID:5688
- C:\Windows\System\IVoWcEO.exe
  C:\Windows\System\IVoWcEO.exe
  2⤵
  PID:5028
- C:\Windows\System\TeQSOFf.exe
  C:\Windows\System\TeQSOFf.exe
  2⤵
  PID:5716
- C:\Windows\System\GvZhrDJ.exe
  C:\Windows\System\GvZhrDJ.exe
  2⤵
  PID:5732
- C:\Windows\System\pPPCvDG.exe
  C:\Windows\System\pPPCvDG.exe
  2⤵
  PID:5740
- C:\Windows\System\KDUCjbE.exe
  C:\Windows\System\KDUCjbE.exe
  2⤵
  PID:5160
- C:\Windows\System\ZknLdii.exe
  C:\Windows\System\ZknLdii.exe
  2⤵
  PID:2124
- C:\Windows\System\zOIofik.exe
  C:\Windows\System\zOIofik.exe
  2⤵
  PID:1668
- C:\Windows\System\QoGluSf.exe
  C:\Windows\System\QoGluSf.exe
  2⤵
  PID:5760
- C:\Windows\System\rRGxJTr.exe
  C:\Windows\System\rRGxJTr.exe
  2⤵
  PID:3484
- C:\Windows\System\hUsCtIx.exe
  C:\Windows\System\hUsCtIx.exe
  2⤵
  PID:1908
- C:\Windows\System\gDyQiPL.exe
  C:\Windows\System\gDyQiPL.exe
  2⤵
  PID:3372
- C:\Windows\System\ZcqOmFV.exe
  C:\Windows\System\ZcqOmFV.exe
  2⤵
  PID:3204
- C:\Windows\System\sDYyOOu.exe
  C:\Windows\System\sDYyOOu.exe
  2⤵
  PID:3340
- C:\Windows\System\EnRVqGV.exe
  C:\Windows\System\EnRVqGV.exe
  2⤵
  PID:3408
- C:\Windows\System\yqatrSG.exe
  C:\Windows\System\yqatrSG.exe
  2⤵
  PID:3624
- C:\Windows\System\XVnMAvd.exe
  C:\Windows\System\XVnMAvd.exe
  2⤵
  PID:3776
- C:\Windows\System\XzigxQj.exe
  C:\Windows\System\XzigxQj.exe
  2⤵
  PID:4052
- C:\Windows\System\UTOjLxM.exe
  C:\Windows\System\UTOjLxM.exe
  2⤵
  PID:3844
- C:\Windows\System\dxlJqse.exe
  C:\Windows\System\dxlJqse.exe
  2⤵
  PID:3080
- C:\Windows\System\EoDLEAJ.exe
  C:\Windows\System\EoDLEAJ.exe
  2⤵
  PID:3456
- C:\Windows\System\afZNjiV.exe
  C:\Windows\System\afZNjiV.exe
  2⤵
  PID:3540
- C:\Windows\System\RgjEGvk.exe
  C:\Windows\System\RgjEGvk.exe
  2⤵
  PID:1116
- C:\Windows\System\IWJTjav.exe
  C:\Windows\System\IWJTjav.exe
  2⤵
  PID:1500
- C:\Windows\System\fFhdJmz.exe
  C:\Windows\System\fFhdJmz.exe
  2⤵
  PID:3648
- C:\Windows\System\WuCAzBv.exe
  C:\Windows\System\WuCAzBv.exe
  2⤵
  PID:4260
- C:\Windows\System\lQOfCTA.exe
  C:\Windows\System\lQOfCTA.exe
  2⤵
  PID:4436
- C:\Windows\System\sFIeTTT.exe
  C:\Windows\System\sFIeTTT.exe
  2⤵
  PID:4712
- C:\Windows\System\hCOqFmz.exe
  C:\Windows\System\hCOqFmz.exe
  2⤵
  PID:4992
- C:\Windows\System\WbdmIBj.exe
  C:\Windows\System\WbdmIBj.exe
  2⤵
  PID:4220
- C:\Windows\System\TRUyRKR.exe
  C:\Windows\System\TRUyRKR.exe
  2⤵
  PID:4524
- C:\Windows\System\YfFEiEg.exe
  C:\Windows\System\YfFEiEg.exe
  2⤵
  PID:4496
- C:\Windows\System\QnfvKKM.exe
  C:\Windows\System\QnfvKKM.exe
  2⤵
  PID:4420
- C:\Windows\System\hogdgWV.exe
  C:\Windows\System\hogdgWV.exe
  2⤵
  PID:3240
- C:\Windows\System\LHzXxiC.exe
  C:\Windows\System\LHzXxiC.exe
  2⤵
  PID:4876
- C:\Windows\System\muMKPCh.exe
  C:\Windows\System\muMKPCh.exe
  2⤵
  PID:4500
- C:\Windows\System\crmvYuH.exe
  C:\Windows\System\crmvYuH.exe
  2⤵
  PID:5428
- C:\Windows\System\ViRUwkc.exe
  C:\Windows\System\ViRUwkc.exe
  2⤵
  PID:376
- C:\Windows\System\dDgHoDq.exe
  C:\Windows\System\dDgHoDq.exe
  2⤵
  PID:3304
- C:\Windows\System\rArWlsb.exe
  C:\Windows\System\rArWlsb.exe
  2⤵
  PID:5780
- C:\Windows\System\wzzMkuN.exe
  C:\Windows\System\wzzMkuN.exe
  2⤵
  PID:5800
- C:\Windows\System\OzAOxjD.exe
  C:\Windows\System\OzAOxjD.exe
  2⤵
  PID:2852
- C:\Windows\System\nLGDmdG.exe
  C:\Windows\System\nLGDmdG.exe
  2⤵
  PID:1312
- C:\Windows\System\UDjtiGz.exe
  C:\Windows\System\UDjtiGz.exe
  2⤵
  PID:5876
- C:\Windows\System\wyHvDQv.exe
  C:\Windows\System\wyHvDQv.exe
  2⤵
  PID:6020
- C:\Windows\System\exQXSWd.exe
  C:\Windows\System\exQXSWd.exe
  2⤵
  PID:5980
- C:\Windows\System\AAMQqMo.exe
  C:\Windows\System\AAMQqMo.exe
  2⤵
  PID:5896
- C:\Windows\System\PxDsRWO.exe
  C:\Windows\System\PxDsRWO.exe
  2⤵
  PID:5864
- C:\Windows\System\vbJHtFs.exe
  C:\Windows\System\vbJHtFs.exe
  2⤵
  PID:5940
- C:\Windows\System\kyMqSIK.exe
  C:\Windows\System\kyMqSIK.exe
  2⤵
  PID:6048
- C:\Windows\System\PdToWWn.exe
  C:\Windows\System\PdToWWn.exe
  2⤵
  PID:6060
- C:\Windows\System\OsdLkqO.exe
  C:\Windows\System\OsdLkqO.exe
  2⤵
  PID:2892
- C:\Windows\System\hciDVrU.exe
  C:\Windows\System\hciDVrU.exe
  2⤵
  PID:1620
- C:\Windows\System\ZGFAshi.exe
  C:\Windows\System\ZGFAshi.exe
  2⤵
  PID:1096
- C:\Windows\System\RnIJdKf.exe
  C:\Windows\System\RnIJdKf.exe
  2⤵
  PID:6132
- C:\Windows\System\upeZtUN.exe
  C:\Windows\System\upeZtUN.exe
  2⤵
  PID:5964
- C:\Windows\System\kDLrsXc.exe
  C:\Windows\System\kDLrsXc.exe
  2⤵
  PID:2116
- C:\Windows\System\THFBWdq.exe
  C:\Windows\System\THFBWdq.exe
  2⤵
  PID:5280
- C:\Windows\System\wYbXQUm.exe
  C:\Windows\System\wYbXQUm.exe
  2⤵
  PID:5344
- C:\Windows\System\zggUTMT.exe
  C:\Windows\System\zggUTMT.exe
  2⤵
  PID:6128
- C:\Windows\System\MXYBdSI.exe
  C:\Windows\System\MXYBdSI.exe
  2⤵
  PID:2236
- C:\Windows\System\MAsqwiT.exe
  C:\Windows\System\MAsqwiT.exe
  2⤵
  PID:1744
- C:\Windows\System\PnGANhB.exe
  C:\Windows\System\PnGANhB.exe
  2⤵
  PID:2992
- C:\Windows\System\tYnYwxv.exe
  C:\Windows\System\tYnYwxv.exe
  2⤵
  PID:5144
- C:\Windows\System\OAnqCmQ.exe
  C:\Windows\System\OAnqCmQ.exe
  2⤵
  PID:5212
- C:\Windows\System\LrZyLBK.exe
  C:\Windows\System\LrZyLBK.exe
  2⤵
  PID:5612
- C:\Windows\System\wkpokGv.exe
  C:\Windows\System\wkpokGv.exe
  2⤵
  PID:5660
- C:\Windows\System\IgoDCZP.exe
  C:\Windows\System\IgoDCZP.exe
  2⤵
  PID:3896
- C:\Windows\System\dvTEFpS.exe
  C:\Windows\System\dvTEFpS.exe
  2⤵
  PID:1036
- C:\Windows\System\MAJwNyz.exe
  C:\Windows\System\MAJwNyz.exe
  2⤵
  PID:3588
- C:\Windows\System\jJUwLJu.exe
  C:\Windows\System\jJUwLJu.exe
  2⤵
  PID:5592
- C:\Windows\System\knXLqZI.exe
  C:\Windows\System\knXLqZI.exe
  2⤵
  PID:3520
- C:\Windows\System\SRFDsFI.exe
  C:\Windows\System\SRFDsFI.exe
  2⤵
  PID:5588
- C:\Windows\System\TpgPVLl.exe
  C:\Windows\System\TpgPVLl.exe
  2⤵
  PID:632
- C:\Windows\System\zTZiExE.exe
  C:\Windows\System\zTZiExE.exe
  2⤵
  PID:2868
- C:\Windows\System\VIBVgkD.exe
  C:\Windows\System\VIBVgkD.exe
  2⤵
  PID:3988
- C:\Windows\System\DBEtrfw.exe
  C:\Windows\System\DBEtrfw.exe
  2⤵
  PID:760
- C:\Windows\System\JYnHrdf.exe
  C:\Windows\System\JYnHrdf.exe
  2⤵
  PID:3468
- C:\Windows\System\rbMlNvR.exe
  C:\Windows\System\rbMlNvR.exe
  2⤵
  PID:3760
- C:\Windows\System\CnFgOxg.exe
  C:\Windows\System\CnFgOxg.exe
  2⤵
  PID:3700
- C:\Windows\System\RkgzJsR.exe
  C:\Windows\System\RkgzJsR.exe
  2⤵
  PID:4112
- C:\Windows\System\VXJPrMJ.exe
  C:\Windows\System\VXJPrMJ.exe
  2⤵
  PID:4004
- C:\Windows\System\uFMzaEd.exe
  C:\Windows\System\uFMzaEd.exe
  2⤵
  PID:4432
- C:\Windows\System\AvkDTms.exe
  C:\Windows\System\AvkDTms.exe
  2⤵
  PID:4128
- C:\Windows\System\zOVlOLj.exe
  C:\Windows\System\zOVlOLj.exe
  2⤵
  PID:4224
- C:\Windows\System\Ildiiob.exe
  C:\Windows\System\Ildiiob.exe
  2⤵
  PID:5432
- C:\Windows\System\izJuaxG.exe
  C:\Windows\System\izJuaxG.exe
  2⤵
  PID:5092
- C:\Windows\System\iSBzbTA.exe
  C:\Windows\System\iSBzbTA.exe
  2⤵
  PID:4792
- C:\Windows\System\oBvcKTb.exe
  C:\Windows\System\oBvcKTb.exe
  2⤵
  PID:5232
- C:\Windows\System\dHLiGKt.exe
  C:\Windows\System\dHLiGKt.exe
  2⤵
  PID:2492
- C:\Windows\System\ThrMlpv.exe
  C:\Windows\System\ThrMlpv.exe
  2⤵
  PID:5368
- C:\Windows\System\xWWitPO.exe
  C:\Windows\System\xWWitPO.exe
  2⤵
  PID:3156
- C:\Windows\System\svnqrJi.exe
  C:\Windows\System\svnqrJi.exe
  2⤵
  PID:5844
- C:\Windows\System\kiHTvsY.exe
  C:\Windows\System\kiHTvsY.exe
  2⤵
  PID:1612
- C:\Windows\System\Lujtpmq.exe
  C:\Windows\System\Lujtpmq.exe
  2⤵
  PID:5996
- C:\Windows\System\RTjgtEB.exe
  C:\Windows\System\RTjgtEB.exe
  2⤵
  PID:6080
- C:\Windows\System\hGXRvao.exe
  C:\Windows\System\hGXRvao.exe
  2⤵
  PID:2628
- C:\Windows\System\yufBPTI.exe
  C:\Windows\System\yufBPTI.exe
  2⤵
  PID:2464
- C:\Windows\System\EGYzhZq.exe
  C:\Windows\System\EGYzhZq.exe
  2⤵
  PID:2320
- C:\Windows\System\cLVdfSq.exe
  C:\Windows\System\cLVdfSq.exe
  2⤵
  PID:6032
- C:\Windows\System\JBFrkvS.exe
  C:\Windows\System\JBFrkvS.exe
  2⤵
  PID:5564
- C:\Windows\System\FBkiijg.exe
  C:\Windows\System\FBkiijg.exe
  2⤵
  PID:5044
- C:\Windows\System\xyOvZEA.exe
  C:\Windows\System\xyOvZEA.exe
  2⤵
  PID:5568
- C:\Windows\System\AOdymqv.exe
  C:\Windows\System\AOdymqv.exe
  2⤵
  PID:5968
- C:\Windows\System\KRhmnWJ.exe
  C:\Windows\System\KRhmnWJ.exe
  2⤵
  PID:832
- C:\Windows\System\SkJSPDW.exe
  C:\Windows\System\SkJSPDW.exe
  2⤵
  PID:984
- C:\Windows\System\QOJnwzz.exe
  C:\Windows\System\QOJnwzz.exe
  2⤵
  PID:1368
- C:\Windows\System\HmXtHPY.exe
  C:\Windows\System\HmXtHPY.exe
  2⤵
  PID:3744
- C:\Windows\System\ZbuKLLx.exe
  C:\Windows\System\ZbuKLLx.exe
  2⤵
  PID:3216
- C:\Windows\System\DTUpxWV.exe
  C:\Windows\System\DTUpxWV.exe
  2⤵
  PID:4132
- C:\Windows\System\XMVumqw.exe
  C:\Windows\System\XMVumqw.exe
  2⤵
  PID:5164
- C:\Windows\System\HWPfEJi.exe
  C:\Windows\System\HWPfEJi.exe
  2⤵
  PID:5792
- C:\Windows\System\CNFZdFB.exe
  C:\Windows\System\CNFZdFB.exe
  2⤵
  PID:580
- C:\Windows\System\klABDgv.exe
  C:\Windows\System\klABDgv.exe
  2⤵
  PID:5664
- C:\Windows\System\qQgqnYY.exe
  C:\Windows\System\qQgqnYY.exe
  2⤵
  PID:6092
- C:\Windows\System\tCHmeWb.exe
  C:\Windows\System\tCHmeWb.exe
  2⤵
  PID:6068
- C:\Windows\System\RIYvdcy.exe
  C:\Windows\System\RIYvdcy.exe
  2⤵
  PID:2624
- C:\Windows\System\RuykyzZ.exe
  C:\Windows\System\RuykyzZ.exe
  2⤵
  PID:6148
- C:\Windows\System\HhTHxQm.exe
  C:\Windows\System\HhTHxQm.exe
  2⤵
  PID:6164
- C:\Windows\System\GzZrnYe.exe
  C:\Windows\System\GzZrnYe.exe
  2⤵
  PID:6180
- C:\Windows\System\VzPsSWr.exe
  C:\Windows\System\VzPsSWr.exe
  2⤵
  PID:6196
- C:\Windows\System\ziElPZs.exe
  C:\Windows\System\ziElPZs.exe
  2⤵
  PID:6212
- C:\Windows\System\ZdGcXfo.exe
  C:\Windows\System\ZdGcXfo.exe
  2⤵
  PID:6228
- C:\Windows\System\iLvKIkw.exe
  C:\Windows\System\iLvKIkw.exe
  2⤵
  PID:6244
- C:\Windows\System\ZjPKCzG.exe
  C:\Windows\System\ZjPKCzG.exe
  2⤵
  PID:6260
- C:\Windows\System\hXYEkeo.exe
  C:\Windows\System\hXYEkeo.exe
  2⤵
  PID:6276
- C:\Windows\System\fFHdtbS.exe
  C:\Windows\System\fFHdtbS.exe
  2⤵
  PID:6292
- C:\Windows\System\lfatjCH.exe
  C:\Windows\System\lfatjCH.exe
  2⤵
  PID:6308
- C:\Windows\System\xuXHSZh.exe
  C:\Windows\System\xuXHSZh.exe
  2⤵
  PID:6324
- C:\Windows\System\DZdhpnG.exe
  C:\Windows\System\DZdhpnG.exe
  2⤵
  PID:6340
- C:\Windows\System\LJsdQcz.exe
  C:\Windows\System\LJsdQcz.exe
  2⤵
  PID:6356
- C:\Windows\System\KiYbGvz.exe
  C:\Windows\System\KiYbGvz.exe
  2⤵
  PID:6372
- C:\Windows\System\bYFVGJJ.exe
  C:\Windows\System\bYFVGJJ.exe
  2⤵
  PID:6392
- C:\Windows\System\yactlZQ.exe
  C:\Windows\System\yactlZQ.exe
  2⤵
  PID:6408
- C:\Windows\System\qaaUnuB.exe
  C:\Windows\System\qaaUnuB.exe
  2⤵
  PID:6424
- C:\Windows\System\PrlFdmE.exe
  C:\Windows\System\PrlFdmE.exe
  2⤵
  PID:6440
- C:\Windows\System\gDFOYkg.exe
  C:\Windows\System\gDFOYkg.exe
  2⤵
  PID:6456
- C:\Windows\System\MgYZwWo.exe
  C:\Windows\System\MgYZwWo.exe
  2⤵
  PID:6472
- C:\Windows\System\mdRWmfI.exe
  C:\Windows\System\mdRWmfI.exe
  2⤵
  PID:6488
- C:\Windows\System\dipEnpS.exe
  C:\Windows\System\dipEnpS.exe
  2⤵
  PID:6504
- C:\Windows\System\nSEcbuk.exe
  C:\Windows\System\nSEcbuk.exe
  2⤵
  PID:6520
- C:\Windows\System\NShifLj.exe
  C:\Windows\System\NShifLj.exe
  2⤵
  PID:6536
- C:\Windows\System\ZMXXFTE.exe
  C:\Windows\System\ZMXXFTE.exe
  2⤵
  PID:6552
- C:\Windows\System\pvmQUUK.exe
  C:\Windows\System\pvmQUUK.exe
  2⤵
  PID:6568
- C:\Windows\System\LJNgYME.exe
  C:\Windows\System\LJNgYME.exe
  2⤵
  PID:6584
- C:\Windows\System\IReeHtQ.exe
  C:\Windows\System\IReeHtQ.exe
  2⤵
  PID:6600
- C:\Windows\System\OqATVMH.exe
  C:\Windows\System\OqATVMH.exe
  2⤵
  PID:6616
- C:\Windows\System\GiAjJUJ.exe
  C:\Windows\System\GiAjJUJ.exe
  2⤵
  PID:6632
- C:\Windows\System\AouWYuq.exe
  C:\Windows\System\AouWYuq.exe
  2⤵
  PID:6648
- C:\Windows\System\GoXdbSw.exe
  C:\Windows\System\GoXdbSw.exe
  2⤵
  PID:6664
- C:\Windows\System\yHseVjT.exe
  C:\Windows\System\yHseVjT.exe
  2⤵
  PID:6680
- C:\Windows\System\GqQYYKp.exe
  C:\Windows\System\GqQYYKp.exe
  2⤵
  PID:6696
- C:\Windows\System\pCqltbO.exe
  C:\Windows\System\pCqltbO.exe
  2⤵
  PID:6712
- C:\Windows\System\mUmktYT.exe
  C:\Windows\System\mUmktYT.exe
  2⤵
  PID:6728
- C:\Windows\System\LePdcdP.exe
  C:\Windows\System\LePdcdP.exe
  2⤵
  PID:6744
- C:\Windows\System\lQiwRTR.exe
  C:\Windows\System\lQiwRTR.exe
  2⤵
  PID:6760
- C:\Windows\System\USfDkiu.exe
  C:\Windows\System\USfDkiu.exe
  2⤵
  PID:6776
- C:\Windows\System\JluFDVJ.exe
  C:\Windows\System\JluFDVJ.exe
  2⤵
  PID:6792
- C:\Windows\System\nAfXfGN.exe
  C:\Windows\System\nAfXfGN.exe
  2⤵
  PID:6808
- C:\Windows\System\MCUBptU.exe
  C:\Windows\System\MCUBptU.exe
  2⤵
  PID:6824
- C:\Windows\System\ynbQXUv.exe
  C:\Windows\System\ynbQXUv.exe
  2⤵
  PID:6840
- C:\Windows\System\yYsosty.exe
  C:\Windows\System\yYsosty.exe
  2⤵
  PID:6856
- C:\Windows\System\wdrbnyf.exe
  C:\Windows\System\wdrbnyf.exe
  2⤵
  PID:6872
- C:\Windows\System\GWHOQxN.exe
  C:\Windows\System\GWHOQxN.exe
  2⤵
  PID:6888
- C:\Windows\System\LXPnoxy.exe
  C:\Windows\System\LXPnoxy.exe
  2⤵
  PID:6904
- C:\Windows\System\hWGBhxz.exe
  C:\Windows\System\hWGBhxz.exe
  2⤵
  PID:6920
- C:\Windows\System\pCASARk.exe
  C:\Windows\System\pCASARk.exe
  2⤵
  PID:6936
- C:\Windows\System\IkSrKhz.exe
  C:\Windows\System\IkSrKhz.exe
  2⤵
  PID:6952
- C:\Windows\System\oErPzuR.exe
  C:\Windows\System\oErPzuR.exe
  2⤵
  PID:6968
- C:\Windows\System\FNVOcjB.exe
  C:\Windows\System\FNVOcjB.exe
  2⤵
  PID:6984
- C:\Windows\System\WzqTKGh.exe
  C:\Windows\System\WzqTKGh.exe
  2⤵
  PID:7000
- C:\Windows\System\pfvLNTo.exe
  C:\Windows\System\pfvLNTo.exe
  2⤵
  PID:7016
- C:\Windows\System\QjQSvTD.exe
  C:\Windows\System\QjQSvTD.exe
  2⤵
  PID:7032
- C:\Windows\System\vidChqQ.exe
  C:\Windows\System\vidChqQ.exe
  2⤵
  PID:7048
- C:\Windows\System\JCbdLki.exe
  C:\Windows\System\JCbdLki.exe
  2⤵
  PID:7064
- C:\Windows\System\YBmTSOS.exe
  C:\Windows\System\YBmTSOS.exe
  2⤵
  PID:7080
- C:\Windows\System\ucfZGtm.exe
  C:\Windows\System\ucfZGtm.exe
  2⤵
  PID:7096
- C:\Windows\System\CvPTkCg.exe
  C:\Windows\System\CvPTkCg.exe
  2⤵
  PID:7112
- C:\Windows\System\vWAYzSe.exe
  C:\Windows\System\vWAYzSe.exe
  2⤵
  PID:7128
- C:\Windows\System\sCVbcBP.exe
  C:\Windows\System\sCVbcBP.exe
  2⤵
  PID:7144
- C:\Windows\System\LPUTMWK.exe
  C:\Windows\System\LPUTMWK.exe
  2⤵
  PID:7160
- C:\Windows\System\YjYqxAz.exe
  C:\Windows\System\YjYqxAz.exe
  2⤵
  PID:4696
- C:\Windows\System\pbmmqmI.exe
  C:\Windows\System\pbmmqmI.exe
  2⤵
  PID:6192
- C:\Windows\System\CAiyBhg.exe
  C:\Windows\System\CAiyBhg.exe
  2⤵
  PID:6256
- C:\Windows\System\WtvaZLR.exe
  C:\Windows\System\WtvaZLR.exe
  2⤵
  PID:2932
- C:\Windows\System\FZrVIxH.exe
  C:\Windows\System\FZrVIxH.exe
  2⤵
  PID:6288
- C:\Windows\System\sWHqqvC.exe
  C:\Windows\System\sWHqqvC.exe
  2⤵
  PID:6364
- C:\Windows\System\AQaXGsE.exe
  C:\Windows\System\AQaXGsE.exe
  2⤵
  PID:6056
- C:\Windows\System\NeYSPsU.exe
  C:\Windows\System\NeYSPsU.exe
  2⤵
  PID:2536
- C:\Windows\System\mTholhP.exe
  C:\Windows\System\mTholhP.exe
  2⤵
  PID:3400
- C:\Windows\System\qQJUYUp.exe
  C:\Windows\System\qQJUYUp.exe
  2⤵
  PID:3684
- C:\Windows\System\vKgZaYY.exe
  C:\Windows\System\vKgZaYY.exe
  2⤵
  PID:4364
- C:\Windows\System\UpUOAnB.exe
  C:\Windows\System\UpUOAnB.exe
  2⤵
  PID:5400
- C:\Windows\System\WGcdqBg.exe
  C:\Windows\System\WGcdqBg.exe
  2⤵
  PID:4592
- C:\Windows\System\XpWTpHJ.exe
  C:\Windows\System\XpWTpHJ.exe
  2⤵
  PID:5476
- C:\Windows\System\gZYmVsi.exe
  C:\Windows\System\gZYmVsi.exe
  2⤵
  PID:5684
- C:\Windows\System\azmfMpK.exe
  C:\Windows\System\azmfMpK.exe
  2⤵
  PID:4292
- C:\Windows\System\rCTHTPY.exe
  C:\Windows\System\rCTHTPY.exe
  2⤵
  PID:5992
- C:\Windows\System\MNgNsWG.exe
  C:\Windows\System\MNgNsWG.exe
  2⤵
  PID:6204
- C:\Windows\System\nutYDPp.exe
  C:\Windows\System\nutYDPp.exe
  2⤵
  PID:6272
- C:\Windows\System\GaqEddD.exe
  C:\Windows\System\GaqEddD.exe
  2⤵
  PID:6052
- C:\Windows\System\bKLvPRs.exe
  C:\Windows\System\bKLvPRs.exe
  2⤵
  PID:6432
- C:\Windows\System\vuAqYLw.exe
  C:\Windows\System\vuAqYLw.exe
  2⤵
  PID:6468
- C:\Windows\System\BFSWkFX.exe
  C:\Windows\System\BFSWkFX.exe
  2⤵
  PID:6384
- C:\Windows\System\wuTkfPN.exe
  C:\Windows\System\wuTkfPN.exe
  2⤵
  PID:6564
- C:\Windows\System\xZdobYR.exe
  C:\Windows\System\xZdobYR.exe
  2⤵
  PID:6448
- C:\Windows\System\jKPTnCG.exe
  C:\Windows\System\jKPTnCG.exe
  2⤵
  PID:6512
- C:\Windows\System\ZLSIOVg.exe
  C:\Windows\System\ZLSIOVg.exe
  2⤵
  PID:6640
- C:\Windows\System\USDsAPW.exe
  C:\Windows\System\USDsAPW.exe
  2⤵
  PID:6580
- C:\Windows\System\sDeNYPH.exe
  C:\Windows\System\sDeNYPH.exe
  2⤵
  PID:6624
- C:\Windows\System\YGfbfCK.exe
  C:\Windows\System\YGfbfCK.exe
  2⤵
  PID:6660
- C:\Windows\System\xTRNEdx.exe
  C:\Windows\System\xTRNEdx.exe
  2⤵
  PID:6724
- C:\Windows\System\KtSEJLh.exe
  C:\Windows\System\KtSEJLh.exe
  2⤵
  PID:6736
- C:\Windows\System\XLJutib.exe
  C:\Windows\System\XLJutib.exe
  2⤵
  PID:6768
- C:\Windows\System\SkQNkQG.exe
  C:\Windows\System\SkQNkQG.exe
  2⤵
  PID:6832
- C:\Windows\System\zxdskaj.exe
  C:\Windows\System\zxdskaj.exe
  2⤵
  PID:6896
- C:\Windows\System\KZVdaqb.exe
  C:\Windows\System\KZVdaqb.exe
  2⤵
  PID:6784
- C:\Windows\System\EEfjMsm.exe
  C:\Windows\System\EEfjMsm.exe
  2⤵
  PID:6996
- C:\Windows\System\ECRqXab.exe
  C:\Windows\System\ECRqXab.exe
  2⤵
  PID:6992
- C:\Windows\System\NvNQTia.exe
  C:\Windows\System\NvNQTia.exe
  2⤵
  PID:6820
- C:\Windows\System\mhurhMH.exe
  C:\Windows\System\mhurhMH.exe
  2⤵
  PID:6948
- C:\Windows\System\qGOPmaQ.exe
  C:\Windows\System\qGOPmaQ.exe
  2⤵
  PID:7040
- C:\Windows\System\SQjbetI.exe
  C:\Windows\System\SQjbetI.exe
  2⤵
  PID:6980
- C:\Windows\System\dMsegDT.exe
  C:\Windows\System\dMsegDT.exe
  2⤵
  PID:7076
- C:\Windows\System\bJgCLGA.exe
  C:\Windows\System\bJgCLGA.exe
  2⤵
  PID:7120
- C:\Windows\System\HcQwGom.exe
  C:\Windows\System\HcQwGom.exe
  2⤵
  PID:7140
- C:\Windows\System\BOAPpIF.exe
  C:\Windows\System\BOAPpIF.exe
  2⤵
  PID:3192
- C:\Windows\System\jWGKDwE.exe
  C:\Windows\System\jWGKDwE.exe
  2⤵
  PID:3308
- C:\Windows\System\noDbLhr.exe
  C:\Windows\System\noDbLhr.exe
  2⤵
  PID:6316
- C:\Windows\System\wMxPdzw.exe
  C:\Windows\System\wMxPdzw.exe
  2⤵
  PID:2468
- C:\Windows\System\FHarUND.exe
  C:\Windows\System\FHarUND.exe
  2⤵
  PID:6004
- C:\Windows\System\NNKvqdU.exe
  C:\Windows\System\NNKvqdU.exe
  2⤵
  PID:2368
- C:\Windows\System\CvvCVhe.exe
  C:\Windows\System\CvvCVhe.exe
  2⤵
  PID:6040
- C:\Windows\System\RMbLchG.exe
  C:\Windows\System\RMbLchG.exe
  2⤵
  PID:3404
- C:\Windows\System\GgKLXyA.exe
  C:\Windows\System\GgKLXyA.exe
  2⤵
  PID:6240
- C:\Windows\System\zAkEJbv.exe
  C:\Windows\System\zAkEJbv.exe
  2⤵
  PID:5492
- C:\Windows\System\MjwFfsK.exe
  C:\Windows\System\MjwFfsK.exe
  2⤵
  PID:6332
- C:\Windows\System\LVPQuFC.exe
  C:\Windows\System\LVPQuFC.exe
  2⤵
  PID:6560
- C:\Windows\System\LkhSyQX.exe
  C:\Windows\System\LkhSyQX.exe
  2⤵
  PID:6608
- C:\Windows\System\jAHvInv.exe
  C:\Windows\System\jAHvInv.exe
  2⤵
  PID:6708
- C:\Windows\System\IQloGLQ.exe
  C:\Windows\System\IQloGLQ.exe
  2⤵
  PID:6804
- C:\Windows\System\mNILAcl.exe
  C:\Windows\System\mNILAcl.exe
  2⤵
  PID:6672
- C:\Windows\System\lwWuAWt.exe
  C:\Windows\System\lwWuAWt.exe
  2⤵
  PID:6752
- C:\Windows\System\OfMyZLa.exe
  C:\Windows\System\OfMyZLa.exe
  2⤵
  PID:6944
- C:\Windows\System\KqTHLaV.exe
  C:\Windows\System\KqTHLaV.exe
  2⤵
  PID:6864
- C:\Windows\System\XVieiks.exe
  C:\Windows\System\XVieiks.exe
  2⤵
  PID:6964
- C:\Windows\System\HLtTgjw.exe
  C:\Windows\System\HLtTgjw.exe
  2⤵
  PID:7152
- C:\Windows\System\RwTcLwm.exe
  C:\Windows\System\RwTcLwm.exe
  2⤵
  PID:7108
- C:\Windows\System\KoxyLIl.exe
  C:\Windows\System\KoxyLIl.exe
  2⤵
  PID:4084
- C:\Windows\System\IWEFAzS.exe
  C:\Windows\System\IWEFAzS.exe
  2⤵
  PID:4336
- C:\Windows\System\chiHscM.exe
  C:\Windows\System\chiHscM.exe
  2⤵
  PID:6336
- C:\Windows\System\WyPGzSW.exe
  C:\Windows\System\WyPGzSW.exe
  2⤵
  PID:6252
- C:\Windows\System\VMUTwGz.exe
  C:\Windows\System\VMUTwGz.exe
  2⤵
  PID:6176
- C:\Windows\System\rMDWcUS.exe
  C:\Windows\System\rMDWcUS.exe
  2⤵
  PID:6612
- C:\Windows\System\RIskwcO.exe
  C:\Windows\System\RIskwcO.exe
  2⤵
  PID:6496
- C:\Windows\System\yTBCtCZ.exe
  C:\Windows\System\yTBCtCZ.exe
  2⤵
  PID:6932
- C:\Windows\System\rOtHUpg.exe
  C:\Windows\System\rOtHUpg.exe
  2⤵
  PID:6756
- C:\Windows\System\hqlqHVZ.exe
  C:\Windows\System\hqlqHVZ.exe
  2⤵
  PID:6720
- C:\Windows\System\lYXCFrT.exe
  C:\Windows\System\lYXCFrT.exe
  2⤵
  PID:6912
- C:\Windows\System\tZhiQgv.exe
  C:\Windows\System\tZhiQgv.exe
  2⤵
  PID:6188
- C:\Windows\System\fpNFlfb.exe
  C:\Windows\System\fpNFlfb.exe
  2⤵
  PID:5328
- C:\Windows\System\EWisXcS.exe
  C:\Windows\System\EWisXcS.exe
  2⤵
  PID:7180
- C:\Windows\System\FZHNzlr.exe
  C:\Windows\System\FZHNzlr.exe
  2⤵
  PID:7196
- C:\Windows\System\xscyQeK.exe
  C:\Windows\System\xscyQeK.exe
  2⤵
  PID:7212
- C:\Windows\System\gzsYfpQ.exe
  C:\Windows\System\gzsYfpQ.exe
  2⤵
  PID:7228
- C:\Windows\System\sjJZtpt.exe
  C:\Windows\System\sjJZtpt.exe
  2⤵
  PID:7244
- C:\Windows\System\yKtrxXp.exe
  C:\Windows\System\yKtrxXp.exe
  2⤵
  PID:7260
- C:\Windows\System\lNrRrVr.exe
  C:\Windows\System\lNrRrVr.exe
  2⤵
  PID:7276
- C:\Windows\System\UtNHDxW.exe
  C:\Windows\System\UtNHDxW.exe
  2⤵
  PID:7292
- C:\Windows\System\lKAICYK.exe
  C:\Windows\System\lKAICYK.exe
  2⤵
  PID:7308
- C:\Windows\System\ZNMtbQu.exe
  C:\Windows\System\ZNMtbQu.exe
  2⤵
  PID:7324
- C:\Windows\System\rdIswbk.exe
  C:\Windows\System\rdIswbk.exe
  2⤵
  PID:7340
- C:\Windows\System\UdhhflK.exe
  C:\Windows\System\UdhhflK.exe
  2⤵
  PID:7356
- C:\Windows\System\aQFYYCT.exe
  C:\Windows\System\aQFYYCT.exe
  2⤵
  PID:7372
- C:\Windows\System\bFMnFwt.exe
  C:\Windows\System\bFMnFwt.exe
  2⤵
  PID:7388
- C:\Windows\System\fMeRyoD.exe
  C:\Windows\System\fMeRyoD.exe
  2⤵
  PID:7404
- C:\Windows\System\LRYqySu.exe
  C:\Windows\System\LRYqySu.exe
  2⤵
  PID:7420
- C:\Windows\System\YoMRFWd.exe
  C:\Windows\System\YoMRFWd.exe
  2⤵
  PID:7436
- C:\Windows\System\FCYFGpU.exe
  C:\Windows\System\FCYFGpU.exe
  2⤵
  PID:7452
- C:\Windows\System\efwRvHm.exe
  C:\Windows\System\efwRvHm.exe
  2⤵
  PID:7468
- C:\Windows\System\KUQaIoz.exe
  C:\Windows\System\KUQaIoz.exe
  2⤵
  PID:7484
- C:\Windows\System\BPERCYm.exe
  C:\Windows\System\BPERCYm.exe
  2⤵
  PID:7500
- C:\Windows\System\kOespbE.exe
  C:\Windows\System\kOespbE.exe
  2⤵
  PID:7516
- C:\Windows\System\VzqCigJ.exe
  C:\Windows\System\VzqCigJ.exe
  2⤵
  PID:7532
- C:\Windows\System\mbHUFzR.exe
  C:\Windows\System\mbHUFzR.exe
  2⤵
  PID:7548
- C:\Windows\System\OYmidmp.exe
  C:\Windows\System\OYmidmp.exe
  2⤵
  PID:7568
- C:\Windows\System\wMIlzus.exe
  C:\Windows\System\wMIlzus.exe
  2⤵
  PID:7584
- C:\Windows\System\vFGTrWO.exe
  C:\Windows\System\vFGTrWO.exe
  2⤵
  PID:7600
- C:\Windows\System\IImCuvk.exe
  C:\Windows\System\IImCuvk.exe
  2⤵
  PID:7616
- C:\Windows\System\Bcyxblu.exe
  C:\Windows\System\Bcyxblu.exe
  2⤵
  PID:7632
- C:\Windows\System\TPsvvyX.exe
  C:\Windows\System\TPsvvyX.exe
  2⤵
  PID:7648
- C:\Windows\System\gCpPINU.exe
  C:\Windows\System\gCpPINU.exe
  2⤵
  PID:7664
- C:\Windows\System\traaVlo.exe
  C:\Windows\System\traaVlo.exe
  2⤵
  PID:7680
- C:\Windows\System\bwhbwDH.exe
  C:\Windows\System\bwhbwDH.exe
  2⤵
  PID:7696
- C:\Windows\System\QyBZqQh.exe
  C:\Windows\System\QyBZqQh.exe
  2⤵
  PID:7712
- C:\Windows\System\bEwwZaC.exe
  C:\Windows\System\bEwwZaC.exe
  2⤵
  PID:7728
- C:\Windows\System\zwCzQfj.exe
  C:\Windows\System\zwCzQfj.exe
  2⤵
  PID:7744
- C:\Windows\System\mnYjUMG.exe
  C:\Windows\System\mnYjUMG.exe
  2⤵
  PID:7760
- C:\Windows\System\kIpAEXL.exe
  C:\Windows\System\kIpAEXL.exe
  2⤵
  PID:7776
- C:\Windows\System\dzyGLSM.exe
  C:\Windows\System\dzyGLSM.exe
  2⤵
  PID:7792
- C:\Windows\System\ytLlqmO.exe
  C:\Windows\System\ytLlqmO.exe
  2⤵
  PID:7808
- C:\Windows\System\HjBdmaa.exe
  C:\Windows\System\HjBdmaa.exe
  2⤵
  PID:7824
- C:\Windows\System\JwIlmkf.exe
  C:\Windows\System\JwIlmkf.exe
  2⤵
  PID:7840
- C:\Windows\System\oqLXiyp.exe
  C:\Windows\System\oqLXiyp.exe
  2⤵
  PID:7856
- C:\Windows\System\XdnMbRW.exe
  C:\Windows\System\XdnMbRW.exe
  2⤵
  PID:7872
- C:\Windows\System\DtpaQwb.exe
  C:\Windows\System\DtpaQwb.exe
  2⤵
  PID:7888
- C:\Windows\System\FFGQfXl.exe
  C:\Windows\System\FFGQfXl.exe
  2⤵
  PID:7904
- C:\Windows\System\kxXfjxD.exe
  C:\Windows\System\kxXfjxD.exe
  2⤵
  PID:7920
- C:\Windows\System\PMZjKuS.exe
  C:\Windows\System\PMZjKuS.exe
  2⤵
  PID:7936
- C:\Windows\System\ulJsJgL.exe
  C:\Windows\System\ulJsJgL.exe
  2⤵
  PID:7952
- C:\Windows\System\gXeeZWr.exe
  C:\Windows\System\gXeeZWr.exe
  2⤵
  PID:7968
- C:\Windows\System\RcZvMTZ.exe
  C:\Windows\System\RcZvMTZ.exe
  2⤵
  PID:7984
- C:\Windows\System\SNflNAE.exe
  C:\Windows\System\SNflNAE.exe
  2⤵
  PID:8000
- C:\Windows\System\FrLKtLy.exe
  C:\Windows\System\FrLKtLy.exe
  2⤵
  PID:8016
- C:\Windows\System\GwlMWTP.exe
  C:\Windows\System\GwlMWTP.exe
  2⤵
  PID:8032
- C:\Windows\System\DYnLhkH.exe
  C:\Windows\System\DYnLhkH.exe
  2⤵
  PID:8048
- C:\Windows\System\gFvrwyn.exe
  C:\Windows\System\gFvrwyn.exe
  2⤵
  PID:8064
- C:\Windows\System\YaxCZlG.exe
  C:\Windows\System\YaxCZlG.exe
  2⤵
  PID:8080
- C:\Windows\System\ARHDacu.exe
  C:\Windows\System\ARHDacu.exe
  2⤵
  PID:8100
- C:\Windows\System\HQpHwCu.exe
  C:\Windows\System\HQpHwCu.exe
  2⤵
  PID:8116
- C:\Windows\System\VzvaRtp.exe
  C:\Windows\System\VzvaRtp.exe
  2⤵
  PID:8132
- C:\Windows\System\PGYSAeA.exe
  C:\Windows\System\PGYSAeA.exe
  2⤵
  PID:8148
- C:\Windows\System\wHbotBF.exe
  C:\Windows\System\wHbotBF.exe
  2⤵
  PID:8164
- C:\Windows\System\dibBqnf.exe
  C:\Windows\System\dibBqnf.exe
  2⤵
  PID:8180
- C:\Windows\System\VzkXVuI.exe
  C:\Windows\System\VzkXVuI.exe
  2⤵
  PID:6484
- C:\Windows\System\AwvLwwn.exe
  C:\Windows\System\AwvLwwn.exe
  2⤵
  PID:6352
- C:\Windows\System\yCGbUIt.exe
  C:\Windows\System\yCGbUIt.exe
  2⤵
  PID:6960
- C:\Windows\System\oZORJKc.exe
  C:\Windows\System\oZORJKc.exe
  2⤵
  PID:7028
- C:\Windows\System\dsKWwlD.exe
  C:\Windows\System\dsKWwlD.exe
  2⤵
  PID:7224
- C:\Windows\System\zwlUDia.exe
  C:\Windows\System\zwlUDia.exe
  2⤵
  PID:6656
- C:\Windows\System\nKFrilS.exe
  C:\Windows\System\nKFrilS.exe
  2⤵
  PID:7204
- C:\Windows\System\ZSxnkfa.exe
  C:\Windows\System\ZSxnkfa.exe
  2⤵
  PID:7268
- C:\Windows\System\UrlrycU.exe
  C:\Windows\System\UrlrycU.exe
  2⤵
  PID:6388
- C:\Windows\System\MsVpGDJ.exe
  C:\Windows\System\MsVpGDJ.exe
  2⤵
  PID:7304
- C:\Windows\System\SpNagpl.exe
  C:\Windows\System\SpNagpl.exe
  2⤵
  PID:7284
- C:\Windows\System\umKgufE.exe
  C:\Windows\System\umKgufE.exe
  2⤵
  PID:7380
- C:\Windows\System\YRYdOex.exe
  C:\Windows\System\YRYdOex.exe
  2⤵
  PID:7444
- C:\Windows\System\GUTvciv.exe
  C:\Windows\System\GUTvciv.exe
  2⤵
  PID:7364
- C:\Windows\System\UHwbfkw.exe
  C:\Windows\System\UHwbfkw.exe
  2⤵
  PID:7448
- C:\Windows\System\IznzUjH.exe
  C:\Windows\System\IznzUjH.exe
  2⤵
  PID:7528
- C:\Windows\System\cplcOVS.exe
  C:\Windows\System\cplcOVS.exe
  2⤵
  PID:7556
- C:\Windows\System\xajfala.exe
  C:\Windows\System\xajfala.exe
  2⤵
  PID:7564
- C:\Windows\System\AmMzNEk.exe
  C:\Windows\System\AmMzNEk.exe
  2⤵
  PID:7724
- C:\Windows\System\HguayJx.exe
  C:\Windows\System\HguayJx.exe
  2⤵
  PID:7756
- C:\Windows\System\GFVmwmN.exe
  C:\Windows\System\GFVmwmN.exe
  2⤵
  PID:7816
- C:\Windows\System\CFHUAGb.exe
  C:\Windows\System\CFHUAGb.exe
  2⤵
  PID:7480
- C:\Windows\System\cgehbOK.exe
  C:\Windows\System\cgehbOK.exe
  2⤵
  PID:7544
- C:\Windows\System\IFbeXBY.exe
  C:\Windows\System\IFbeXBY.exe
  2⤵
  PID:7612
- C:\Windows\System\HXbthrj.exe
  C:\Windows\System\HXbthrj.exe
  2⤵
  PID:7676
- C:\Windows\System\LPePbZJ.exe
  C:\Windows\System\LPePbZJ.exe
  2⤵
  PID:7740
- C:\Windows\System\fSxZZzs.exe
  C:\Windows\System\fSxZZzs.exe
  2⤵
  PID:7804
- C:\Windows\System\HFXkFPO.exe
  C:\Windows\System\HFXkFPO.exe
  2⤵
  PID:7916
- C:\Windows\System\AMcAirO.exe
  C:\Windows\System\AMcAirO.exe
  2⤵
  PID:7868
- C:\Windows\System\CHHpbez.exe
  C:\Windows\System\CHHpbez.exe
  2⤵
  PID:7964
- C:\Windows\System\rvHMVOC.exe
  C:\Windows\System\rvHMVOC.exe
  2⤵
  PID:7836
- C:\Windows\System\hoRzyeE.exe
  C:\Windows\System\hoRzyeE.exe
  2⤵
  PID:8012
- C:\Windows\System\UuzHkje.exe
  C:\Windows\System\UuzHkje.exe
  2⤵
  PID:8040
- C:\Windows\System\RQCEbXh.exe
  C:\Windows\System\RQCEbXh.exe
  2⤵
  PID:8076
- C:\Windows\System\fdhqtmx.exe
  C:\Windows\System\fdhqtmx.exe
  2⤵
  PID:8112
- C:\Windows\System\nnJJkVJ.exe
  C:\Windows\System\nnJJkVJ.exe
  2⤵
  PID:8172
- C:\Windows\System\QyLahYi.exe
  C:\Windows\System\QyLahYi.exe
  2⤵
  PID:8176
- C:\Windows\System\lRogYYI.exe
  C:\Windows\System\lRogYYI.exe
  2⤵
  PID:6268
- C:\Windows\System\zXegBZS.exe
  C:\Windows\System\zXegBZS.exe
  2⤵
  PID:3256
- C:\Windows\System\myMTGsc.exe
  C:\Windows\System\myMTGsc.exe
  2⤵
  PID:6596
- C:\Windows\System\WTZhZpi.exe
  C:\Windows\System\WTZhZpi.exe
  2⤵
  PID:7172
- C:\Windows\System\eREsfbJ.exe
  C:\Windows\System\eREsfbJ.exe
  2⤵
  PID:876
- C:\Windows\System\uRsXMvV.exe
  C:\Windows\System\uRsXMvV.exe
  2⤵
  PID:7428
- C:\Windows\System\mTxXvSH.exe
  C:\Windows\System\mTxXvSH.exe
  2⤵
  PID:7288
- C:\Windows\System\NEnLJmC.exe
  C:\Windows\System\NEnLJmC.exe
  2⤵
  PID:7412
- C:\Windows\System\lxDZvFO.exe
  C:\Windows\System\lxDZvFO.exe
  2⤵
  PID:7592
- C:\Windows\System\vEezTht.exe
  C:\Windows\System\vEezTht.exe
  2⤵
  PID:7788
- C:\Windows\System\FkzKuJj.exe
  C:\Windows\System\FkzKuJj.exe
  2⤵
  PID:7512
- C:\Windows\System\CENzkoH.exe
  C:\Windows\System\CENzkoH.exe
  2⤵
  PID:7580
- C:\Windows\System\ANpZBKh.exe
  C:\Windows\System\ANpZBKh.exe
  2⤵
  PID:7708
- C:\Windows\System\hpnUatJ.exe
  C:\Windows\System\hpnUatJ.exe
  2⤵
  PID:7800
- C:\Windows\System\OvfGNkB.exe
  C:\Windows\System\OvfGNkB.exe
  2⤵
  PID:7976
- C:\Windows\System\OeJtKfC.exe
  C:\Windows\System\OeJtKfC.exe
  2⤵
  PID:7928
- C:\Windows\System\EymXMTT.exe
  C:\Windows\System\EymXMTT.exe
  2⤵
  PID:8108
- C:\Windows\System\GiKikKn.exe
  C:\Windows\System\GiKikKn.exe
  2⤵
  PID:8128
- C:\Windows\System\EwdPcUn.exe
  C:\Windows\System\EwdPcUn.exe
  2⤵
  PID:5820
- C:\Windows\System\UGIQcvY.exe
  C:\Windows\System\UGIQcvY.exe
  2⤵
  PID:7220
- C:\Windows\System\gmchfye.exe
  C:\Windows\System\gmchfye.exe
  2⤵
  PID:7660
- C:\Windows\System\eTvQRmF.exe
  C:\Windows\System\eTvQRmF.exe
  2⤵
  PID:7320
- C:\Windows\System\SgPIaHx.exe
  C:\Windows\System\SgPIaHx.exe
  2⤵
  PID:7476
- C:\Windows\System\PKVrYFZ.exe
  C:\Windows\System\PKVrYFZ.exe
  2⤵
  PID:2012
- C:\Windows\System\mIzCxNr.exe
  C:\Windows\System\mIzCxNr.exe
  2⤵
  PID:7492
- C:\Windows\System\lgdKojI.exe
  C:\Windows\System\lgdKojI.exe
  2⤵
  PID:2792
- C:\Windows\System\iMBSFWG.exe
  C:\Windows\System\iMBSFWG.exe
  2⤵
  PID:7608
- C:\Windows\System\ZjoxdOD.exe
  C:\Windows\System\ZjoxdOD.exe
  2⤵
  PID:8140
- C:\Windows\System\lPvwvkX.exe
  C:\Windows\System\lPvwvkX.exe
  2⤵
  PID:8028
- C:\Windows\System\zwyriGn.exe
  C:\Windows\System\zwyriGn.exe
  2⤵
  PID:7348
- C:\Windows\System\luWgmDT.exe
  C:\Windows\System\luWgmDT.exe
  2⤵
  PID:7400
- C:\Windows\System\hPNamMO.exe
  C:\Windows\System\hPNamMO.exe
  2⤵
  PID:8188
- C:\Windows\System\DzkPxlM.exe
  C:\Windows\System\DzkPxlM.exe
  2⤵
  PID:7012
- C:\Windows\System\UIoQWgI.exe
  C:\Windows\System\UIoQWgI.exe
  2⤵
  PID:7644
- C:\Windows\System\AkEPGIz.exe
  C:\Windows\System\AkEPGIz.exe
  2⤵
  PID:7772
- C:\Windows\System\jcsXVEv.exe
  C:\Windows\System\jcsXVEv.exe
  2⤵
  PID:7720
- C:\Windows\System\jaqBkag.exe
  C:\Windows\System\jaqBkag.exe
  2⤵
  PID:7252
- C:\Windows\System\TXLMuJm.exe
  C:\Windows\System\TXLMuJm.exe
  2⤵
  PID:7992
- C:\Windows\System\PbVsnrI.exe
  C:\Windows\System\PbVsnrI.exe
  2⤵
  PID:7948
- C:\Windows\System\wigGYnG.exe
  C:\Windows\System\wigGYnG.exe
  2⤵
  PID:8208
- C:\Windows\System\cvrTnQA.exe
  C:\Windows\System\cvrTnQA.exe
  2⤵
  PID:8224
- C:\Windows\System\yoPLYAd.exe
  C:\Windows\System\yoPLYAd.exe
  2⤵
  PID:8240
- C:\Windows\System\OiuIJpX.exe
  C:\Windows\System\OiuIJpX.exe
  2⤵
  PID:8256
- C:\Windows\System\gjceWFM.exe
  C:\Windows\System\gjceWFM.exe
  2⤵
  PID:8272
- C:\Windows\System\luzGKzF.exe
  C:\Windows\System\luzGKzF.exe
  2⤵
  PID:8288
- C:\Windows\System\vmOEhvX.exe
  C:\Windows\System\vmOEhvX.exe
  2⤵
  PID:8304
- C:\Windows\System\WALLhIh.exe
  C:\Windows\System\WALLhIh.exe
  2⤵
  PID:8320
- C:\Windows\System\OLBkRui.exe
  C:\Windows\System\OLBkRui.exe
  2⤵
  PID:8336
- C:\Windows\System\makiytj.exe
  C:\Windows\System\makiytj.exe
  2⤵
  PID:8352
- C:\Windows\System\nFQHcHA.exe
  C:\Windows\System\nFQHcHA.exe
  2⤵
  PID:8368
- C:\Windows\System\PjllBBR.exe
  C:\Windows\System\PjllBBR.exe
  2⤵
  PID:8384
- C:\Windows\System\uLSKZkC.exe
  C:\Windows\System\uLSKZkC.exe
  2⤵
  PID:8400
- C:\Windows\System\WPAXOrU.exe
  C:\Windows\System\WPAXOrU.exe
  2⤵
  PID:8416
- C:\Windows\System\xlHDtcm.exe
  C:\Windows\System\xlHDtcm.exe
  2⤵
  PID:8432
- C:\Windows\System\YMaRjMP.exe
  C:\Windows\System\YMaRjMP.exe
  2⤵
  PID:8448
- C:\Windows\System\ctjZwGP.exe
  C:\Windows\System\ctjZwGP.exe
  2⤵
  PID:8464
- C:\Windows\System\jZrlQhI.exe
  C:\Windows\System\jZrlQhI.exe
  2⤵
  PID:8480
- C:\Windows\System\xCMgGvl.exe
  C:\Windows\System\xCMgGvl.exe
  2⤵
  PID:8496
- C:\Windows\System\tPOxmet.exe
  C:\Windows\System\tPOxmet.exe
  2⤵
  PID:8512
- C:\Windows\System\JZDPCpB.exe
  C:\Windows\System\JZDPCpB.exe
  2⤵
  PID:8532
- C:\Windows\System\npfIduq.exe
  C:\Windows\System\npfIduq.exe
  2⤵
  PID:8548
- C:\Windows\System\GOeWOXk.exe
  C:\Windows\System\GOeWOXk.exe
  2⤵
  PID:8564
- C:\Windows\System\xFlSzkw.exe
  C:\Windows\System\xFlSzkw.exe
  2⤵
  PID:8580
- C:\Windows\System\gRMfYcQ.exe
  C:\Windows\System\gRMfYcQ.exe
  2⤵
  PID:8596
- C:\Windows\System\iiCQkFK.exe
  C:\Windows\System\iiCQkFK.exe
  2⤵
  PID:8612
- C:\Windows\System\sFCVKYH.exe
  C:\Windows\System\sFCVKYH.exe
  2⤵
  PID:8628
- C:\Windows\System\rHzKrhj.exe
  C:\Windows\System\rHzKrhj.exe
  2⤵
  PID:8644
- C:\Windows\System\DUxxUqL.exe
  C:\Windows\System\DUxxUqL.exe
  2⤵
  PID:8660
- C:\Windows\System\MQgtlri.exe
  C:\Windows\System\MQgtlri.exe
  2⤵
  PID:8676
- C:\Windows\System\rbwfvlu.exe
  C:\Windows\System\rbwfvlu.exe
  2⤵
  PID:8692
- C:\Windows\System\iHSrUbS.exe
  C:\Windows\System\iHSrUbS.exe
  2⤵
  PID:8708
- C:\Windows\System\CLnYCVd.exe
  C:\Windows\System\CLnYCVd.exe
  2⤵
  PID:8724
- C:\Windows\System\eLlgXPq.exe
  C:\Windows\System\eLlgXPq.exe
  2⤵
  PID:8740
- C:\Windows\System\qHIdytV.exe
  C:\Windows\System\qHIdytV.exe
  2⤵
  PID:8756
- C:\Windows\System\ipIsEBu.exe
  C:\Windows\System\ipIsEBu.exe
  2⤵
  PID:8772
- C:\Windows\System\KoULSjF.exe
  C:\Windows\System\KoULSjF.exe
  2⤵
  PID:8788
- C:\Windows\System\WHGLzwx.exe
  C:\Windows\System\WHGLzwx.exe
  2⤵
  PID:8808
- C:\Windows\System\aQsMiTe.exe
  C:\Windows\System\aQsMiTe.exe
  2⤵
  PID:8824
- C:\Windows\System\iYzhqqZ.exe
  C:\Windows\System\iYzhqqZ.exe
  2⤵
  PID:8840
- C:\Windows\System\ZIJgsdW.exe
  C:\Windows\System\ZIJgsdW.exe
  2⤵
  PID:8856
- C:\Windows\System\cprzskk.exe
  C:\Windows\System\cprzskk.exe
  2⤵
  PID:8872
- C:\Windows\System\nzxAZrM.exe
  C:\Windows\System\nzxAZrM.exe
  2⤵
  PID:8888
- C:\Windows\System\NarsGwB.exe
  C:\Windows\System\NarsGwB.exe
  2⤵
  PID:8904
- C:\Windows\System\FdYNsol.exe
  C:\Windows\System\FdYNsol.exe
  2⤵
  PID:8920
- C:\Windows\System\LqEFTio.exe
  C:\Windows\System\LqEFTio.exe
  2⤵
  PID:8936
- C:\Windows\System\DmXwyQj.exe
  C:\Windows\System\DmXwyQj.exe
  2⤵
  PID:8952
- C:\Windows\System\OrkeElE.exe
  C:\Windows\System\OrkeElE.exe
  2⤵
  PID:8968
- C:\Windows\System\dmAWNPz.exe
  C:\Windows\System\dmAWNPz.exe
  2⤵
  PID:8984
- C:\Windows\System\SNIbtIu.exe
  C:\Windows\System\SNIbtIu.exe
  2⤵
  PID:9000
- C:\Windows\System\sxdZzjE.exe
  C:\Windows\System\sxdZzjE.exe
  2⤵
  PID:9016
- C:\Windows\System\SEABmrL.exe
  C:\Windows\System\SEABmrL.exe
  2⤵
  PID:9032
- C:\Windows\System\LTQbZvy.exe
  C:\Windows\System\LTQbZvy.exe
  2⤵
  PID:9048
- C:\Windows\System\QTBzDOt.exe
  C:\Windows\System\QTBzDOt.exe
  2⤵
  PID:9068
- C:\Windows\System\wvXpuvD.exe
  C:\Windows\System\wvXpuvD.exe
  2⤵
  PID:9084
- C:\Windows\System\YZRrXxi.exe
  C:\Windows\System\YZRrXxi.exe
  2⤵
  PID:9100
- C:\Windows\System\NSwFFSL.exe
  C:\Windows\System\NSwFFSL.exe
  2⤵
  PID:9116
- C:\Windows\System\caaFmde.exe
  C:\Windows\System\caaFmde.exe
  2⤵
  PID:9132
- C:\Windows\System\QuBczYb.exe
  C:\Windows\System\QuBczYb.exe
  2⤵
  PID:9148
- C:\Windows\System\ecbdVJD.exe
  C:\Windows\System\ecbdVJD.exe
  2⤵
  PID:9164
- C:\Windows\System\PFdnLFm.exe
  C:\Windows\System\PFdnLFm.exe
  2⤵
  PID:9180
- C:\Windows\System\WagXfTw.exe
  C:\Windows\System\WagXfTw.exe
  2⤵
  PID:9196
- C:\Windows\System\USOdXBz.exe
  C:\Windows\System\USOdXBz.exe
  2⤵
  PID:9212
- C:\Windows\System\eTIQzgN.exe
  C:\Windows\System\eTIQzgN.exe
  2⤵
  PID:8204
- C:\Windows\System\wYQmziu.exe
  C:\Windows\System\wYQmziu.exe
  2⤵
  PID:8264
- C:\Windows\System\XZlyaeW.exe
  C:\Windows\System\XZlyaeW.exe
  2⤵
  PID:8232
- C:\Windows\System\eRQgFeS.exe
  C:\Windows\System\eRQgFeS.exe
  2⤵
  PID:8316
- C:\Windows\System\nblmjPZ.exe
  C:\Windows\System\nblmjPZ.exe
  2⤵
  PID:8344
- C:\Windows\System\tIKdaXO.exe
  C:\Windows\System\tIKdaXO.exe
  2⤵
  PID:8364
- C:\Windows\System\dmYcWFz.exe
  C:\Windows\System\dmYcWFz.exe
  2⤵
  PID:8408
- C:\Windows\System\dMrzgsR.exe
  C:\Windows\System\dMrzgsR.exe
  2⤵
  PID:8440
- C:\Windows\System\eHrELAx.exe
  C:\Windows\System\eHrELAx.exe
  2⤵
  PID:8472
- C:\Windows\System\FejvUWm.exe
  C:\Windows\System\FejvUWm.exe
  2⤵
  PID:8520
- C:\Windows\System\XbRhPFN.exe
  C:\Windows\System\XbRhPFN.exe
  2⤵
  PID:8504
- C:\Windows\System\rmRhiwP.exe
  C:\Windows\System\rmRhiwP.exe
  2⤵
  PID:8572
- C:\Windows\System\eXLBlNg.exe
  C:\Windows\System\eXLBlNg.exe
  2⤵
  PID:8604
- C:\Windows\System\aPLTxvV.exe
  C:\Windows\System\aPLTxvV.exe
  2⤵
  PID:8624
- C:\Windows\System\OoGEPxK.exe
  C:\Windows\System\OoGEPxK.exe
  2⤵
  PID:8656
- C:\Windows\System\CgarrDz.exe
  C:\Windows\System\CgarrDz.exe
  2⤵
  PID:8668
- C:\Windows\System\bbYGRXk.exe
  C:\Windows\System\bbYGRXk.exe
  2⤵
  PID:8748
- C:\Windows\System\rIWrjEr.exe
  C:\Windows\System\rIWrjEr.exe
  2⤵
  PID:8700
- C:\Windows\System\nCRKAVa.exe
  C:\Windows\System\nCRKAVa.exe
  2⤵
  PID:8796
- C:\Windows\System\dogtDJl.exe
  C:\Windows\System\dogtDJl.exe
  2⤵
  PID:8800
- C:\Windows\System\pvbdYte.exe
  C:\Windows\System\pvbdYte.exe
  2⤵
  PID:8848
- C:\Windows\System\ryKjbdI.exe
  C:\Windows\System\ryKjbdI.exe
  2⤵
  PID:8912
- C:\Windows\System\VAteUkS.exe
  C:\Windows\System\VAteUkS.exe
  2⤵
  PID:8944
- C:\Windows\System\kYnbxgN.exe
  C:\Windows\System\kYnbxgN.exe
  2⤵
  PID:8932
- C:\Windows\System\pqnXlRH.exe
  C:\Windows\System\pqnXlRH.exe
  2⤵
  PID:9008
- C:\Windows\System\kuqbREg.exe
  C:\Windows\System\kuqbREg.exe
  2⤵
  PID:9076
- C:\Windows\System\xvrZPMR.exe
  C:\Windows\System\xvrZPMR.exe
  2⤵
  PID:9080
- C:\Windows\System\GDVCSNQ.exe
  C:\Windows\System\GDVCSNQ.exe
  2⤵
  PID:9144
- C:\Windows\System\PFrHJFQ.exe
  C:\Windows\System\PFrHJFQ.exe
  2⤵
  PID:9024
- C:\Windows\System\WbcpuUw.exe
  C:\Windows\System\WbcpuUw.exe
  2⤵
  PID:9124
- C:\Windows\System\nZgQVqO.exe
  C:\Windows\System\nZgQVqO.exe
  2⤵
  PID:9176
- C:\Windows\System\bKJAsGJ.exe
  C:\Windows\System\bKJAsGJ.exe
  2⤵
  PID:9208
- C:\Windows\System\zmavFZS.exe
  C:\Windows\System\zmavFZS.exe
  2⤵
  PID:8300
- C:\Windows\System\IgLHrou.exe
  C:\Windows\System\IgLHrou.exe
  2⤵
  PID:8296
- C:\Windows\System\zpZEVKC.exe
  C:\Windows\System\zpZEVKC.exe
  2⤵
  PID:8360
- C:\Windows\System\bZswRhb.exe
  C:\Windows\System\bZswRhb.exe
  2⤵
  PID:8392
- C:\Windows\System\HaZfXrX.exe
  C:\Windows\System\HaZfXrX.exe
  2⤵
  PID:8544
- C:\Windows\System\MbJfPfH.exe
  C:\Windows\System\MbJfPfH.exe
  2⤵
  PID:8540
- C:\Windows\System\EyOkXBN.exe
  C:\Windows\System\EyOkXBN.exe
  2⤵
  PID:8672
- C:\Windows\System\OoTlfFR.exe
  C:\Windows\System\OoTlfFR.exe
  2⤵
  PID:8608
- C:\Windows\System\GlaMyxq.exe
  C:\Windows\System\GlaMyxq.exe
  2⤵
  PID:8784
- C:\Windows\System\kQZpMep.exe
  C:\Windows\System\kQZpMep.exe
  2⤵
  PID:8884
- C:\Windows\System\yrqUDDK.exe
  C:\Windows\System\yrqUDDK.exe
  2⤵
  PID:8900
- C:\Windows\System\GbYWKtF.exe
  C:\Windows\System\GbYWKtF.exe
  2⤵
  PID:8896
- C:\Windows\System\agNgsbe.exe
  C:\Windows\System\agNgsbe.exe
  2⤵
  PID:8980
- C:\Windows\System\NouujPC.exe
  C:\Windows\System\NouujPC.exe
  2⤵
  PID:9140
- C:\Windows\System\WEYUVBh.exe
  C:\Windows\System\WEYUVBh.exe
  2⤵
  PID:9204
- C:\Windows\System\FnQJFVn.exe
  C:\Windows\System\FnQJFVn.exe
  2⤵
  PID:9160
- C:\Windows\System\QNrfNtQ.exe
  C:\Windows\System\QNrfNtQ.exe
  2⤵
  PID:8428
- C:\Windows\System\yDcvnFk.exe
  C:\Windows\System\yDcvnFk.exe
  2⤵
  PID:8780
- C:\Windows\System\FuALAEe.exe
  C:\Windows\System\FuALAEe.exe
  2⤵
  PID:8332
- C:\Windows\System\wUZzSfJ.exe
  C:\Windows\System\wUZzSfJ.exe
  2⤵
  PID:8880
- C:\Windows\System\hxPeskD.exe
  C:\Windows\System\hxPeskD.exe
  2⤵
  PID:9112
- C:\Windows\System\KKqSYOd.exe
  C:\Windows\System\KKqSYOd.exe
  2⤵
  PID:9220
- C:\Windows\System\gkvAJUa.exe
  C:\Windows\System\gkvAJUa.exe
  2⤵
  PID:9236
- C:\Windows\System\oYpGvaq.exe
  C:\Windows\System\oYpGvaq.exe
  2⤵
  PID:9252
- C:\Windows\System\MoWWzIm.exe
  C:\Windows\System\MoWWzIm.exe
  2⤵
  PID:9268
- C:\Windows\System\VDUtKrW.exe
  C:\Windows\System\VDUtKrW.exe
  2⤵
  PID:9284
- C:\Windows\System\fAiIDeJ.exe
  C:\Windows\System\fAiIDeJ.exe
  2⤵
  PID:9300
- C:\Windows\System\RXZxyJK.exe
  C:\Windows\System\RXZxyJK.exe
  2⤵
  PID:9316
- C:\Windows\System\BAHtTYl.exe
  C:\Windows\System\BAHtTYl.exe
  2⤵
  PID:9332
- C:\Windows\System\VUVHFHO.exe
  C:\Windows\System\VUVHFHO.exe
  2⤵
  PID:9348
- C:\Windows\System\YTWQgUY.exe
  C:\Windows\System\YTWQgUY.exe
  2⤵
  PID:9364
- C:\Windows\System\YtFMpDV.exe
  C:\Windows\System\YtFMpDV.exe
  2⤵
  PID:9380
- C:\Windows\System\OdZVQDz.exe
  C:\Windows\System\OdZVQDz.exe
  2⤵
  PID:9396
- C:\Windows\System\LDVorBx.exe
  C:\Windows\System\LDVorBx.exe
  2⤵
  PID:9412
- C:\Windows\System\LjDelWM.exe
  C:\Windows\System\LjDelWM.exe
  2⤵
  PID:9428
- C:\Windows\System\swQttVr.exe
  C:\Windows\System\swQttVr.exe
  2⤵
  PID:9444
- C:\Windows\System\HZlrXbN.exe
  C:\Windows\System\HZlrXbN.exe
  2⤵
  PID:9472
- C:\Windows\System\PdDPVxV.exe
  C:\Windows\System\PdDPVxV.exe
  2⤵
  PID:9492
- C:\Windows\System\IPlnBNX.exe
  C:\Windows\System\IPlnBNX.exe
  2⤵
  PID:9508
- C:\Windows\System\jOWgcNN.exe
  C:\Windows\System\jOWgcNN.exe
  2⤵
  PID:9524
- C:\Windows\System\zeVRVyP.exe
  C:\Windows\System\zeVRVyP.exe
  2⤵
  PID:9540
- C:\Windows\System\IyhlcNs.exe
  C:\Windows\System\IyhlcNs.exe
  2⤵
  PID:9556
- C:\Windows\System\NeowUij.exe
  C:\Windows\System\NeowUij.exe
  2⤵
  PID:9572
- C:\Windows\System\kdhHOaC.exe
  C:\Windows\System\kdhHOaC.exe
  2⤵
  PID:9588
- C:\Windows\System\EMWsPTy.exe
  C:\Windows\System\EMWsPTy.exe
  2⤵
  PID:9604
- C:\Windows\System\UhTssKN.exe
  C:\Windows\System\UhTssKN.exe
  2⤵
  PID:9620
- C:\Windows\System\FCwUFpS.exe
  C:\Windows\System\FCwUFpS.exe
  2⤵
  PID:9636
- C:\Windows\System\DpxpqtK.exe
  C:\Windows\System\DpxpqtK.exe
  2⤵
  PID:9652
- C:\Windows\System\ggZkmvu.exe
  C:\Windows\System\ggZkmvu.exe
  2⤵
  PID:9668
- C:\Windows\System\yLaHMyt.exe
  C:\Windows\System\yLaHMyt.exe
  2⤵
  PID:9684
- C:\Windows\System\guuLXuY.exe
  C:\Windows\System\guuLXuY.exe
  2⤵
  PID:9700
- C:\Windows\System\Cqjxvte.exe
  C:\Windows\System\Cqjxvte.exe
  2⤵
  PID:9716
- C:\Windows\System\gsNDPrd.exe
  C:\Windows\System\gsNDPrd.exe
  2⤵
  PID:9732
- C:\Windows\System\rWjfwqk.exe
  C:\Windows\System\rWjfwqk.exe
  2⤵
  PID:9748
- C:\Windows\System\aMzXBNg.exe
  C:\Windows\System\aMzXBNg.exe
  2⤵
  PID:9764
- C:\Windows\System\SbEixvl.exe
  C:\Windows\System\SbEixvl.exe
  2⤵
  PID:9780
- C:\Windows\System\COHsLmY.exe
  C:\Windows\System\COHsLmY.exe
  2⤵
  PID:9796
- C:\Windows\System\wfsgLir.exe
  C:\Windows\System\wfsgLir.exe
  2⤵
  PID:9812
- C:\Windows\System\pqXKCLM.exe
  C:\Windows\System\pqXKCLM.exe
  2⤵
  PID:9828
- C:\Windows\System\KTGvxrV.exe
  C:\Windows\System\KTGvxrV.exe
  2⤵
  PID:9844
- C:\Windows\System\DwrelkE.exe
  C:\Windows\System\DwrelkE.exe
  2⤵
  PID:9864
- C:\Windows\System\nmVFcGX.exe
  C:\Windows\System\nmVFcGX.exe
  2⤵
  PID:9880
- C:\Windows\System\pKwhnpR.exe
  C:\Windows\System\pKwhnpR.exe
  2⤵
  PID:9896
- C:\Windows\System\HXLUbSr.exe
  C:\Windows\System\HXLUbSr.exe
  2⤵
  PID:9912
- C:\Windows\System\mRAQVUG.exe
  C:\Windows\System\mRAQVUG.exe
  2⤵
  PID:9928
- C:\Windows\System\ZiQUzTu.exe
  C:\Windows\System\ZiQUzTu.exe
  2⤵
  PID:9944
- C:\Windows\System\rKDwQyq.exe
  C:\Windows\System\rKDwQyq.exe
  2⤵
  PID:9960
- C:\Windows\System\ViozHXU.exe
  C:\Windows\System\ViozHXU.exe
  2⤵
  PID:9976
- C:\Windows\System\PgTpHlL.exe
  C:\Windows\System\PgTpHlL.exe
  2⤵
  PID:9992
- C:\Windows\System\jWNYEwS.exe
  C:\Windows\System\jWNYEwS.exe
  2⤵
  PID:10008
- C:\Windows\System\xmgOsdK.exe
  C:\Windows\System\xmgOsdK.exe
  2⤵
  PID:10024
- C:\Windows\System\FtWFORe.exe
  C:\Windows\System\FtWFORe.exe
  2⤵
  PID:10040
- C:\Windows\System\FVTDKJD.exe
  C:\Windows\System\FVTDKJD.exe
  2⤵
  PID:10056
- C:\Windows\System\bFBMxGn.exe
  C:\Windows\System\bFBMxGn.exe
  2⤵
  PID:10072
- C:\Windows\System\BYodFHB.exe
  C:\Windows\System\BYodFHB.exe
  2⤵
  PID:10088
- C:\Windows\System\euUYqsj.exe
  C:\Windows\System\euUYqsj.exe
  2⤵
  PID:10104
- C:\Windows\System\aPZppJp.exe
  C:\Windows\System\aPZppJp.exe
  2⤵
  PID:10120
- C:\Windows\System\iKsUmjt.exe
  C:\Windows\System\iKsUmjt.exe
  2⤵
  PID:10136
- C:\Windows\System\lLhlkTo.exe
  C:\Windows\System\lLhlkTo.exe
  2⤵
  PID:10152
- C:\Windows\System\KoKYxNq.exe
  C:\Windows\System\KoKYxNq.exe
  2⤵
  PID:10168
- C:\Windows\System\TWpUeZk.exe
  C:\Windows\System\TWpUeZk.exe
  2⤵
  PID:10184
- C:\Windows\System\LBUPbas.exe
  C:\Windows\System\LBUPbas.exe
  2⤵
  PID:10200
- C:\Windows\System\tWGsIyb.exe
  C:\Windows\System\tWGsIyb.exe
  2⤵
  PID:10220
- C:\Windows\System\WnHSUdq.exe
  C:\Windows\System\WnHSUdq.exe
  2⤵
  PID:8836
- C:\Windows\System\Vjjxgvt.exe
  C:\Windows\System\Vjjxgvt.exe
  2⤵
  PID:8556
- C:\Windows\System\XQrYfJV.exe
  C:\Windows\System\XQrYfJV.exe
  2⤵
  PID:8720
- C:\Windows\System\PuOXEUp.exe
  C:\Windows\System\PuOXEUp.exe
  2⤵
  PID:9192
- C:\Windows\System\HVXQrSX.exe
  C:\Windows\System\HVXQrSX.exe
  2⤵
  PID:9244
- C:\Windows\System\iSKVfYL.exe
  C:\Windows\System\iSKVfYL.exe
  2⤵
  PID:9308
- C:\Windows\System\tBJwtTB.exe
  C:\Windows\System\tBJwtTB.exe
  2⤵
  PID:8964
- C:\Windows\System\cJFHzIp.exe
  C:\Windows\System\cJFHzIp.exe
  2⤵
  PID:9228
- C:\Windows\System\ILzGGXa.exe
  C:\Windows\System\ILzGGXa.exe
  2⤵
  PID:9292
- C:\Windows\System\DmHjtza.exe
  C:\Windows\System\DmHjtza.exe
  2⤵
  PID:9324
- C:\Windows\System\IDUvrmK.exe
  C:\Windows\System\IDUvrmK.exe
  2⤵
  PID:9356
- C:\Windows\System\uRSyOoi.exe
  C:\Windows\System\uRSyOoi.exe
  2⤵
  PID:9404
- C:\Windows\System\IqNJkJn.exe
  C:\Windows\System\IqNJkJn.exe
  2⤵
  PID:9420
- C:\Windows\System\kPRVYDG.exe
  C:\Windows\System\kPRVYDG.exe
  2⤵
  PID:9460
- C:\Windows\System\dnuIaym.exe
  C:\Windows\System\dnuIaym.exe
  2⤵
  PID:9520
- C:\Windows\System\eHuOXDv.exe
  C:\Windows\System\eHuOXDv.exe
  2⤵
  PID:9580
- C:\Windows\System\TrrpCFi.exe
  C:\Windows\System\TrrpCFi.exe
  2⤵
  PID:9536
- C:\Windows\System\nottQao.exe
  C:\Windows\System\nottQao.exe
  2⤵
  PID:9596
- C:\Windows\System\IByVQRA.exe
  C:\Windows\System\IByVQRA.exe
  2⤵
  PID:9648
- C:\Windows\System\zKfJpwy.exe
  C:\Windows\System\zKfJpwy.exe
  2⤵
  PID:9712
- C:\Windows\System\laJLVhg.exe
  C:\Windows\System\laJLVhg.exe
  2⤵
  PID:9628
- C:\Windows\System\nrqOHpc.exe
  C:\Windows\System\nrqOHpc.exe
  2⤵
  PID:9664
- C:\Windows\System\inIhPSB.exe
  C:\Windows\System\inIhPSB.exe
  2⤵
  PID:9728
- C:\Windows\System\GZNngkK.exe
  C:\Windows\System\GZNngkK.exe
  2⤵
  PID:9804
- C:\Windows\System\XMzdTSC.exe
  C:\Windows\System\XMzdTSC.exe
  2⤵
  PID:9872
- C:\Windows\System\aeiZqBH.exe
  C:\Windows\System\aeiZqBH.exe
  2⤵
  PID:9936
- C:\Windows\System\AmJZWvS.exe
  C:\Windows\System\AmJZWvS.exe
  2⤵
  PID:9972
- C:\Windows\System\EKAytRo.exe
  C:\Windows\System\EKAytRo.exe
  2⤵
  PID:10004
- C:\Windows\System\wgxyDzc.exe
  C:\Windows\System\wgxyDzc.exe
  2⤵
  PID:9888
- C:\Windows\System\ydglPwB.exe
  C:\Windows\System\ydglPwB.exe
  2⤵
  PID:10032
- C:\Windows\System\xQjiDCW.exe
  C:\Windows\System\xQjiDCW.exe
  2⤵
  PID:9984
- C:\Windows\System\vFqXyUj.exe
  C:\Windows\System\vFqXyUj.exe
  2⤵
  PID:10064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\KNMWXtt.exe

Filesize
1.9MB

MD5
aab89803878ebe16db1b617a811c2ec2

SHA1
6a0847ed714a2e303a2f6cf1d37de616fc38c777

SHA256
eec5066950596c3a282911295d521339640f32c5713b4ae8cd0db216dbbb0c0c

SHA512
ccb23906de32bf99ed76999be68d238d39efb1312616b2b6219e8896b635457660ae25a4e857a5ed32aeb7e4c6508ae9db71aaf6ea8090c3e1f309ba12e20f29

Download Submit
C:\Windows\system\LyOTlOl.exe

Filesize
1.9MB

MD5
5bd74cf0b7fa37e07a73d68fc934f0af

SHA1
1da39a3dc4d07e050ff2cd7dfb2ee4a5de5e7989

SHA256
59b398d349ed705ab2adf710d2f5b9be88fb08b555bb97a88a84c1fff62ba1d6

SHA512
b5d1fd90e1d3dc1a3b8f42f433eaa9254db1a711da67541dabe7492218cfcd92087b18f60bdf13578deff97be56e2e71f186013cca791fe46d1d8cd0eb7ae823

Download Submit
C:\Windows\system\MRkePoL.exe

Filesize
1.9MB

MD5
939d8341115cbf2c57036af0b1ab4d43

SHA1
997a36e9a324c971f983bc13febba612b0f8fea6

SHA256
b83a6c6d2a8d8081d7dcb7e411ff1b40ce377b8403d2df2f8851f7a95de76116

SHA512
5c4c96863915598fd2b127f3a1b58c291d3c7998f96260ee9f05365c30f567f3e80fc62705ced6c72137e98caddc603288916ca69812c1e5fdfd8d19e5d9ea79

Download Submit
C:\Windows\system\PNticbu.exe

Filesize
1.9MB

MD5
d7ce092d2c8c236de795c51b97c0d308

SHA1
06a585b4e3419a2cd4bea7c63383e61229168413

SHA256
9f3ff5d5a10765fde7d9a3c7c0596c5db644df981f494e51f29048fb16539b32

SHA512
86aa6ff64fa04f4458a55ea1bedca3e81f648c7dc4cbd27b80d45f9514339b9b1f772026cfbbe28e8ce751816371fed148c94af1a03d13a46f8294e254d156b6

Download Submit
C:\Windows\system\RmZouCf.exe

Filesize
1.9MB

MD5
070dfdc510beec3ed29d609322e13001

SHA1
1fe247b68d09a37529f9eda5634f5c037b4da2c1

SHA256
1b602674c0efa6d380f6f2162d8bd89cf4fb1968117ba88020e6351e9fb0f2ad

SHA512
f49d5d2778f6f8509d9a41e28f18f3bf1f4b4beeff34797786d3af4118c8bdff91058474626869eea7b5712015481822c5ff5180753603649379b8200369c075

Download Submit
C:\Windows\system\UlBajYL.exe

Filesize
1.9MB

MD5
7634af3b2101aad2e8dcc3e18bebc896

SHA1
18b8dfab9ab6f696648d67fe0c6654ab40264ea2

SHA256
6931c5812f94aaaf7681e7caf0cb78aee0d36f50947c54363e3fb3eb3544ef1d

SHA512
892a8d5c28bb5d8919f5d0efb54d8a463b42a9eb546e1b856d09a8d1c5e964eebc78b146ea146c0c945c010d0a7eddd8418fd211c3b95aed00e8bd7c941b3090

Download Submit
C:\Windows\system\WgHyfLX.exe

Filesize
1.9MB

MD5
334992d21a641b22f50f1f543615ff61

SHA1
25366159df2ec576361876d3b440da6eeac991f5

SHA256
547c9f428395406f2ac09cb4c14f4bd7ac5ebc09d63ce9f038a510cb7073f07e

SHA512
ad965783b30b3be6d7a48791645f68350a87ed30f2f3099bf0385c885ddcf2bf47b7058f4bd5cf32501ebf57796d34134cebdcfcfcdb96ee2d4478afe377b85a

Download Submit
C:\Windows\system\bJLXqNp.exe

Filesize
1.9MB

MD5
e25bb8154197450bfc55ad49a3d9ba7e

SHA1
64fe86c36e439cf12d4f62fc384885a022e1b041

SHA256
49a5f261f6b2b617d724925117a771772fe3be6763fe3fe824c6f7764f9e7c51

SHA512
d9bfb2aa498d687114d8feb40134e359c6f79801a8ced41bd7fbd9666b2e646cde51abfcca6e50ae5968e5db5a0ba25725575a54b5a032df78d4f74ff6c8c638

Download Submit
C:\Windows\system\bkxdgcs.exe

Filesize
1.9MB

MD5
a72a67be1959f90a5e3f837c01c332b4

SHA1
541e4056af1dff5e538e4cac16174768b3d18062

SHA256
f363c177ec253c9108eca77f13ab1296645fe956d02d31d39bc01784befe0ff1

SHA512
77054b7164449bfb6406a0c8a2ae9bba460d509a172e1c8aea60ee82e4c85cda5eab079ad6a0289af82167297cd6bf3dd2e4fe6ea3dec23229efaf9ba07d29b8

Download Submit
C:\Windows\system\cLgbvWZ.exe

Filesize
1.9MB

MD5
b26f1a8cea30588c8e936811e93de2a7

SHA1
5f2f4af253a0637346233a79cb48b4d54b928c1b

SHA256
ed461b631e31cd34b7d35b099f3e7689f370cb4c564454f09e6ba1e8d5155e6f

SHA512
37526f201cb50b558f74fd8e6325ee3d69ba29400647fa3711a14fdaca78257d1f700e254c255e6a9b183e783445b2bf63904a52fbc7cccf7dce683c70aeacc1

Download Submit
C:\Windows\system\fEtpggM.exe

Filesize
1.9MB

MD5
b9b726aefedf2a8ffde30c086e98e3d5

SHA1
9b0da3622a173fb30c15d73587628ba0a93cd505

SHA256
ccc8f915cd03bce7b2a9a01cc5acc68ad5a4efd2a8715d85f96f4e1bac355514

SHA512
483dffa81ff80b871dc4157a42694ec39f15ba7faa23dbb35095d1b6f5b585be68f29b4f6934ac12476d88f7553dd3d6fa0898df9fa4b6b15b58f3ffdeaa8fc9

Download Submit
C:\Windows\system\guyckGc.exe

Filesize
1.9MB

MD5
620297e8b0da6097873965736fcd5714

SHA1
c840446b0e98e2dbe682a0fbb12a7281107e9342

SHA256
0421c636a425c0471aba4a0b3cb179c0c4e429426e87803382be90f03b12ab54

SHA512
696c9d4774d0d03577f9be5043c1cda241866edad50435ff988025c9bb22f3ff3860394927a2fa983f55c33f3595a56e773de2592d503c46a32f88e60d7f176d

Download Submit
C:\Windows\system\lMzlzBG.exe

Filesize
1.9MB

MD5
659e6fae38f95352046c62aac8274537

SHA1
0d090b7f1848e2b2a679b5472e46a4322470d50b

SHA256
ae0c6f15ae08891dbadf3d6040c91693e7bb5996bcd7235fbde7e19ceed4c766

SHA512
cd1a0a084d373866672cd49ae95d139caefdcb1f5a91190783df81bd5037e8a1c23a12a56a15445a06734308225a1109df4d9ab56c203850e590af75c273f161

Download Submit
C:\Windows\system\lkQJQIm.exe

Filesize
1.9MB

MD5
7a5f6ca4905a35b3188b6e7e0f7ed7f9

SHA1
5fb4181ddac33a37f27ab6a29cff128ba2a11550

SHA256
b8f2cc5b805a6a0da52b06d312dda2f51c32e36c10e9e33741e948530170d55d

SHA512
ff934c320ffc4a6118e329659dbca3f262f7abfa79080327e374c1b11194209863876c673510793283b958374ca22a263a0156cda0c310a9293b246bc3606f61

Download Submit
C:\Windows\system\mgqhSar.exe

Filesize
1.9MB

MD5
e63d3bc0a97fa54980adb6851e39e54f

SHA1
fd8f7e59f46b6477cd63607a7270bdae398778a4

SHA256
6996f3a1331c437f9940b3bf4fa6b2c8fe6cfc2061066727392968ebee5a35bb

SHA512
80620432b56a4959c89081e1fc6b7f7ca110893f3c6e96c947cb9a8a8cff837da63b8c17506abd10c8f81e02fff602c0056ef39b4a3ce17ee70a6cd9eb9a72d2

Download Submit
C:\Windows\system\mlIWMtD.exe

Filesize
1.9MB

MD5
4c9bd1705b3ebc2b2dd79142c724b396

SHA1
17c5b5ded7a36bf68327c7ecb5be70afcbd0430a

SHA256
2e7aeeabd5a111e350fc3eef2654dce798a33ccd97ce07bdc2b8a52254aca8bb

SHA512
14b0d1de86e1a486b72569b93a7ff35ad3a13a65ec6b1293495568c6d2a32da56fe3747697eb0f57b0f9ff03d235f4902cc7d08144727139ddb9eb82311581cf

Download Submit
C:\Windows\system\nlBLbLJ.exe

Filesize
1.9MB

MD5
70ac0c14284c71390fac75d96329ab1a

SHA1
d9b169b1bcb7e1d1494a13a1387578a851e0373a

SHA256
0982b8c00793a6d5dc02fd7b7c2e1d0a98a0c93dc5132ecab804b8c9044820f3

SHA512
186942967b632e81e95a8eeb5d36cf8e4a32a0407752aa8faea66fc7975d690645ec93563c0f1d18d476a37472ca24b3e5973ba3f0d1c89baa7ba921291d98f3

Download Submit
C:\Windows\system\oBzCHiT.exe

Filesize
1.9MB

MD5
30a18826176e9dd37ac69bfc281a9ecc

SHA1
b990fa811e323bcbf6483d928d04c92888bb289a

SHA256
db80e7ce4d206aa40c1809714889c6a551473c8b8e60d53e6d3fa516d1853612

SHA512
e922836f39557c144084332680366c399cbd2bc910f0814f0ff98d7e7102800f37580017cf5b16f6a93a3fb24bc6ec1739c3360c377724912417e6be1603996f

Download Submit
C:\Windows\system\pZCrioP.exe

Filesize
1.9MB

MD5
1d61ac3a729ff0cad686457718c13f3a

SHA1
ffa7f0e8dd4d503cf7ba2d47ed70c0a578acaf19

SHA256
8e10a69e0fb0b856ddea4d78ce8db9b5f3ef7496985f5ad3c5363a115e2e75f8

SHA512
de723cb7eb2889446fa9a3293e34fb96c90ed876f6107562505ad6091d6bb46fbc835f10e5b2f28934609804f0638e17eacc3874893fb236a36f4c9f3f1cf776

Download Submit
C:\Windows\system\sdjubfE.exe

Filesize
1.9MB

MD5
922d31dd90a5736388987ca257493ccd

SHA1
477696f3ca05e9d32c541d78a1d9be55ce1aeb67

SHA256
57b6517c5bbf30ba57e45805d2c776a2860f75577112eae1ae3c09dab556534d

SHA512
7da8194a464fbaaf611c0990dd41d0522da280d182b3357118560851026f959b441c6d123d1216893c2706a7e3ff288a0526e16cd5659d2a1aafd16a4f6a11b9

Download Submit
C:\Windows\system\uuPfrqS.exe

Filesize
1.9MB

MD5
03b84d4643bfe1324704641f89901072

SHA1
b0b1899577d3f0535ae220f0ba3a34a3935ec86a

SHA256
51762a02e2a2b6a68eb74e491b465ecfe8adf5e0e7b9ae5cdce0d53104b695e5

SHA512
344315e3944648b1a58896270c4bec2bd99622da69841c92327ff62c9f7991f81d74b8bbffe4a12d8e92a7f34f492803c894477314eb5538b6e2515e538b374d

Download Submit
C:\Windows\system\vvXCsdw.exe

Filesize
1.9MB

MD5
f04a987e83d9c67bc499f188cf77e4a2

SHA1
8745444f9bea58a3a2885ac0e6d3f96220130524

SHA256
8cb2607d378c6d59e4b31e81bb1973cacd595834f89b1d9a51fb7df6fa24931a

SHA512
b36b1f50586be7730a46382c865df5243918df0d03394e3004b913ecb26f299c68b66df2178173a768b4be3a95624146a955f9d07b46ac0abc19b8cc1f05673e

Download Submit
\Windows\system\AgzwHmk.exe

Filesize
1.9MB

MD5
bb3337aedae092c37eb7c7c477536f39

SHA1
ad47adcd0f7c303a4b1d53a686c0f5688b00187c

SHA256
d48156b4552184d985d7aa66b76191e9f24d808133314da8d46535f7c29937b4

SHA512
0fd1fcc501accc9364bdc92af6716b8e7e782f9ff92970517c2f94b6faa276237aaacf2858abfd679be59fa5df1518d19b0e95336d4b061d2256515494d87c79

Download Submit
\Windows\system\BhriDTE.exe

Filesize
1.9MB

MD5
c419d884450863e9ec91a85cab18ac28

SHA1
34c818511faf99e7add8887e1c411b3200c377bf

SHA256
08f1fa734ca717421b80d10b2558417663a3086f7dc7e2d37b5bfbf1808379c0

SHA512
c232390f99237044f47174bfd2e0c496c41c4470787070530a7c5c519221d841a822c5e87ebebf2eebf3d8d6d013b14d071017193020282fd3ca6c8b7213919b

Download Submit
\Windows\system\EDQUXsB.exe

Filesize
1.9MB

MD5
68c8f8fc7ec9cc08fe199cd648e3f901

SHA1
42efacaa2cf6f69566fb21ee68bc3232d244cf59

SHA256
bc5ee737ee4796f6ecc1811338c41e10763cfd807da86b8dfe41c60c2211c7a9

SHA512
8c0708210b9dcb943e0b8bf8924c6f0c16ecdaf49f661e504bea957ad97ca5c32a3d7e1cdcdcd2ae97babe842dd223d81614e329080e963dc4ea887149405e5b

Download Submit
\Windows\system\GmxjAjx.exe

Filesize
1.9MB

MD5
70830610d0bb5533438ac8b241ed7374

SHA1
5b950facfcdbe6fc52570a7e9bdd3545b0c0e0ea

SHA256
78bb135fedf0301655b4490d10d63505933ff535b7f3de8be3173a63a084678f

SHA512
e1c3e23c2a6b49aa5c0aa5d0ba3e78a8331c5ff6f00609bb9f82ce8ee30d1b4bb2a63b6fc24715fefdfeaf1f7d05b0c6dd8536a586e75a8724bf8132b29566d7

Download Submit
\Windows\system\ImdCEIs.exe

Filesize
1.9MB

MD5
745a620776baf10ff583c22f235e6df9

SHA1
027992189585a358c747e4564cd0b1776c8cbfae

SHA256
ef38c471afc92b6183c754788c7bc70d0b59c7a899bc3cfc31b82b70f8778b6d

SHA512
9e413b16d0d350303ef49ef1decbaf4bb399f6dccb9de65f64bda8f9b5347f31eceb9a8473505da2daa720cc9b9d0b0f0e61ec14c7df6721a8987356d0824c99

Download Submit
\Windows\system\PKxQzgd.exe

Filesize
1.9MB

MD5
7e4ad60457fdaf2579db36b9aae3d344

SHA1
e5f5e5eca9d704fe90f8b52dfcc7c0680aefaab3

SHA256
eb62551d83fe4eb48ee31d2402d475c8cbd9799e7f042f50344cda71a34faee5

SHA512
ab523c0a90e88c814216d1e5c3bf909e1d1e0b6ea1998f3a835f482f4711a687a91263bb8396c414d2e9f05e68623f5f57b74b6202e2e88cd671296edd302307

Download Submit
\Windows\system\UUOgJuX.exe

Filesize
1.9MB

MD5
ff83257b8f6543efab192dc6ab1ca13c

SHA1
64aefe6fde751eae897da23c27cd88eb1f2bf56f

SHA256
9935e230ed1d6b69647c97ef299ece847e43765195b68f4bb271439543f8e01f

SHA512
e740b53697570222e2fbf237cb5690f5a1fdae306eafdced5750305f306ed628821444b5de08e44148fbb4256901d8bb6597c9a4e2fb43ada4abe23c4fa73a0c

Download Submit
\Windows\system\UbFmDOc.exe

Filesize
1.9MB

MD5
b15dd58abaec617e83e885b22922b0e8

SHA1
72733ac789388f87cfdbf4c86b5fc3035ef4d716

SHA256
054ec47e697d712dfd33385f4b58920647559f384dd769306a3366e5f94e0787

SHA512
056c48bf7299532645f51fdf3aad852cdde4f44bddd87a1025215199ebd7fd6a8237e82e8d630fba3d3686802865d0dee14532efd95cdb01d88b6587d30f45f1

Download Submit
\Windows\system\WobjHNp.exe

Filesize
1.9MB

MD5
01491959fa9e0d25d4bba0ec08b752b7

SHA1
33ba0a9a6c11d5f562e1bfdea92f64f5da7a55f7

SHA256
dc8cba16e1d4923c1c783b1ccb2e2d0ae0596affa4fff37d85978c9fbfe61db5

SHA512
0c7156eda646a0707ed508f3a94e0ca7f3fa2a607c1a4ff56676b20908d56b2f9dfe3ce8bbe471e9d415782c1377138fa66dd99fe41ce11ed55741f40674afae

Download Submit
\Windows\system\ZWfgPUr.exe

Filesize
1.9MB

MD5
1d1d2fbb7c1fa8a71b100ca68fd5554d

SHA1
999e0e73b3e40782c25c8db2f961205233fbad76

SHA256
4bad2f375801d6a1654ac737a44d5e49a79642e70c0780260d8c9aee1c8d3f59

SHA512
aa41ebbd76f2698811f2f0735c29bc4d0e86d3ba569324cde39933ceae24e1e89dc5fd628851862776abdec61d7e60942c88f219c9919bd466602f11bf5ff15d

Download Submit
\Windows\system\chpTmWC.exe

Filesize
1.9MB

MD5
db4987a5f96d2dd4bfc4fdb3966220e1

SHA1
0e570f908cf278a31e6f0918d93b4e9e29153b0b

SHA256
28d7c32792428fca1c71d30293130b67f0917aeca720aad23aee4e7cd0614da4

SHA512
7d5d8d034115e026d987524b718190faaeb9c8545d91a105d585150bc31cee927f35a316606e0f87a67815c202e517b4e884be5a681915ca35bbd39a31c582df

Download Submit
\Windows\system\idfXsjw.exe

Filesize
1.9MB

MD5
7f6b19f4d703516c6f469252fbe6e84e

SHA1
6757056ec90c876d1f3088adc6b01bb0f7513357

SHA256
808a8bee8d95fdaa5516bef7e6359d7461906e4e9deadfbbd2d29bafc6be9550

SHA512
cf56ecaa76cca48629f471213de6e8522cb37f9f88c596cd439f5a2884724aa04a95851ee117b1d3adc89dedbae64deb667630410dfbdfaa390588f9e382336b

Download Submit
\Windows\system\qxSoFaj.exe

Filesize
1.9MB

MD5
2f887d6f8ec7e2b5afeb174fa934ca1a

SHA1
767e3a663fc8549c3191a0a5924810cb12f05cc8

SHA256
9c4bb733496d1c23186fc409aed508883555ec94fae442ee42ee34a29682e505

SHA512
432cf1a2a9334f7d9742220cb7268b48dd00546a279d5cdf65bc657eca00a0af6882c9e1b342120186bd8b49a4f586ce2256bc005a6eebae24e151d3856010a9

Download Submit
\Windows\system\tbWlxql.exe

Filesize
1.9MB

MD5
cb39270c570baafa2472f2bebac8e92e

SHA1
6ea065f8d195ccfabbf2b94ee66ba528e97fb81a

SHA256
9af395d9f566cc7576dd96f011aedf19d7c449f96855b941f058e09b2a444630

SHA512
af70320981297bf552a1ba66b7c4fbffe4e09af7d16259ca78d2e5a80e872879e013cfe06539fb5ed6ede828a4a68e7559dc9da6c0108f3e3bc51ae94c5cb648

Download Submit
\Windows\system\xGEGLpw.exe

Filesize
1.9MB

MD5
2e3a65b32e9f08ed3c2ec0f742d59168

SHA1
24233c9db2ccd57eaa58580785962c0364802134

SHA256
0c280253c6791ae19d29c6da3beb439e29110714b7b99f5ad7270bb34d0cf204

SHA512
8341d14d70df863bbff0d7d64a2992a560c18617c385e7e3f3df1a77978133e632839d7ae19b79834e122abb3f31df50160446558af873151889284fc074f446

Download Submit
memory/812-147-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-508-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/1664-1165-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/2068-156-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-78-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2068-160-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2068-157-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-159-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-1-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2068-150-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-7-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-146-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-152-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2068-127-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2068-161-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2068-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2068-154-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2068-144-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-155-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2680-153-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-151-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-158-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2788-140-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2840-74-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-90-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-139-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download