xmrig | 8737674684000595f33b9bccacde0db7dc16013deaf023d0a782c8baf2509501

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
Size

2.2MB
MD5

10466726947deaabb48419d6b5b653d7
SHA1

82a1fc0edca40f9fcef42e20023c38ef3e6c85de
SHA256

8737674684000595f33b9bccacde0db7dc16013deaf023d0a782c8baf2509501
SHA512

406355c276b808b27b8dba07dd5a75e5772e297543fb4804cf3f6cc4593bc4e37d91aab2ea684635dff74f1efc2180763b99f591fecb8f97b63460ddc1fe3ecc
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cb6k:NABT

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2540-9-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2484-25-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/1056-219-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2696-407-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2492-204-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2696-218-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2848-217-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/3024-215-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2428-213-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2416-206-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2380-202-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2516-201-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2368-209-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2648-27-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2428-4465-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2368-4941-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2492-5004-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2540-5179-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2648-5401-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2416-5418-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2380-5416-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2848-5415-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/1056-5453-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2540	tBSUPQT.exe
2484	zRMISMT.exe
2648	bwvDymr.exe
2516	ldaVIqC.exe
2380	dyVjFIQ.exe
2492	bblyTFj.exe
2416	MSMNXFo.exe
2368	rxZfVhJ.exe
2428	qrWoxKo.exe
3024	ODNzvwC.exe
2848	zBrtikC.exe
1056	OfBkkbT.exe
1384	ZtqDZTd.exe
564	PbyzRQp.exe
756	sjsSBQn.exe
2640	HVRqNmY.exe
2600	zTUkOmJ.exe
1532	vHWorTd.exe
1800	HEGCLDM.exe
2016	zfXduDx.exe
1916	KJumUzI.exe
2172	TqEdUSs.exe
1252	UxKYNnH.exe
1472	HzVZTfP.exe
940	WStHHZN.exe
1172	CWtKKYK.exe
1688	aShjCpD.exe
1684	UiGdsJg.exe
3036	rZklNHj.exe
2736	ffjqwrK.exe
772	GsEAnZM.exe
1744	uAcGSYR.exe
2788	HWMXkvq.exe
808	CNaaeVR.exe
2044	dBJNAIS.exe
436	LAtoxoI.exe
1152	ldKEHtX.exe
1564	cQXFiOL.exe
2004	JUmpsXu.exe
1544	NfjItFp.exe
3000	SBEEUPz.exe
2176	whTeHNI.exe
2284	RSRuLdk.exe
576	sBsisDM.exe
2268	BumYSej.exe
2128	JgwvxDp.exe
2988	TKfNAra.exe
1608	jerrcEE.exe
2796	AyHwyUF.exe
2448	qFoYvCc.exe
2076	hzvGrxK.exe
2272	KISjhDO.exe
2824	ZUdTVSA.exe
2764	yQPtnuU.exe
2800	tEcxuUm.exe
2056	CUGGesj.exe
2900	IDSsfAt.exe
2472	wlzNdPX.exe
2376	ybIZWdu.exe
2624	OvcDrHr.exe
2384	SoKWrNz.exe
2856	fXWMttM.exe
1160	WkZGRyQ.exe
2080	oQEdHRB.exe

Loads dropped DLL 64 IoCs

pid	Process
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2696-0-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x000d0000000122d1-3.dat	upx
behavioral1/memory/2540-9-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/files/0x00230000000122f8-10.dat	upx
behavioral1/files/0x000900000001267d-17.dat	upx
behavioral1/memory/2484-25-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-36.dat	upx
behavioral1/files/0x000800000001269e-30.dat	upx
behavioral1/files/0x00090000000126f7-41.dat	upx
behavioral1/files/0x00090000000139d6-47.dat	upx
behavioral1/files/0x0006000000014c67-52.dat	upx
behavioral1/files/0x0006000000014e3d-57.dat	upx
behavioral1/files/0x0006000000014fe1-66.dat	upx
behavioral1/files/0x0006000000014ec4-63.dat	upx
behavioral1/files/0x0006000000015264-72.dat	upx
behavioral1/files/0x00060000000155d4-82.dat	upx
behavioral1/files/0x000600000001560a-96.dat	upx
behavioral1/files/0x00060000000155e2-93.dat	upx
behavioral1/files/0x0006000000015a2d-103.dat	upx
behavioral1/files/0x0006000000015c52-132.dat	upx
behavioral1/files/0x0006000000015c69-142.dat	upx
behavioral1/files/0x0006000000015c87-152.dat	upx
behavioral1/files/0x0006000000015d88-163.dat	upx
behavioral1/files/0x0006000000015e02-172.dat	upx
behavioral1/files/0x0006000000015db4-166.dat	upx
behavioral1/memory/1056-219-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2696-407-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2492-204-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2848-217-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/3024-215-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2428-213-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2416-206-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2380-202-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2516-201-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2368-209-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0006000000015cb9-156.dat	upx
behavioral1/files/0x0006000000015c7c-147.dat	upx
behavioral1/files/0x0006000000015c5d-137.dat	upx
behavioral1/files/0x0006000000015c2f-122.dat	upx
behavioral1/files/0x0006000000015c3c-126.dat	upx
behavioral1/files/0x0006000000015c0d-112.dat	upx
behavioral1/files/0x0006000000015c23-116.dat	upx
behavioral1/files/0x0006000000015a98-106.dat	upx
behavioral1/files/0x00060000000155d9-87.dat	upx
behavioral1/files/0x0006000000015364-76.dat	upx
behavioral1/memory/2648-27-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2428-4465-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2368-4941-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2492-5004-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2540-5179-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2648-5401-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2416-5418-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2380-5416-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2848-5415-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/1056-5453-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2516-5451-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/3024-5450-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2484-5449-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xPHdZDB.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\jpyJglI.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\VJNldID.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\dwDVtjE.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\uSbpcWr.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\GlExEAl.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\hHwXIzP.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\qDeKzpJ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\vUurcRK.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\SkeNJyJ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\qVylRJu.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\fJtWAHW.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\IYiobQI.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\RPTjzQd.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\Aqlarok.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\PApJbQg.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\PzGcMeS.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\GsEAnZM.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\FwYeRuz.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\LnhFLyV.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\nmAzSCc.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\GVbeVvJ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\nlMRimr.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\SMCaUYf.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\IVjWRgF.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\hxhpkbH.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\LkDFKIr.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\PwXKOTO.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\rmaWjXZ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\qVAPHzY.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\lFHZkqQ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\OAvlroe.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\aSswXpH.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\AuMIlBE.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\qrWoxKo.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\CWtKKYK.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\BNBKLdT.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\uaHvFqr.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\DiudNLg.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\RqmjRuL.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\TerBHlh.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\lqlNlKR.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\vGftlQl.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\YFUCAyb.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\ZZgkkJP.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\ZQuudJY.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\bdpaaOY.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\cTcVRXF.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\dpbbzKR.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\OAuEwCZ.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\dKlSUmE.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\pvaqtoH.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\WWdipqh.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\TbnSIhS.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\dtYyplN.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\UVHiFWt.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\bLfUdfe.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\NfYfUTx.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\WSDilEe.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\RptSwej.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\GrfNAFO.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\iIuCTsC.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\EAollXR.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
File created	C:\Windows\System\MUfXouG.exe	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeLockMemoryPrivilege	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1740	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	29
PID 2696 wrote to memory of 1740	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	29
PID 2696 wrote to memory of 1740	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	29
PID 2696 wrote to memory of 2540	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2540	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2540	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	30
PID 2696 wrote to memory of 2484	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	31
PID 2696 wrote to memory of 2484	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	31
PID 2696 wrote to memory of 2484	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	31
PID 2696 wrote to memory of 2648	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2648	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2648	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	32
PID 2696 wrote to memory of 2516	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2516	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2516	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	33
PID 2696 wrote to memory of 2380	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	34
PID 2696 wrote to memory of 2380	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	34
PID 2696 wrote to memory of 2380	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	34
PID 2696 wrote to memory of 2492	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	35
PID 2696 wrote to memory of 2492	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	35
PID 2696 wrote to memory of 2492	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	35
PID 2696 wrote to memory of 2416	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	36
PID 2696 wrote to memory of 2416	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	36
PID 2696 wrote to memory of 2416	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	36
PID 2696 wrote to memory of 2368	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	37
PID 2696 wrote to memory of 2368	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	37
PID 2696 wrote to memory of 2368	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	37
PID 2696 wrote to memory of 2428	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	38
PID 2696 wrote to memory of 2428	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	38
PID 2696 wrote to memory of 2428	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	38
PID 2696 wrote to memory of 3024	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	39
PID 2696 wrote to memory of 3024	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	39
PID 2696 wrote to memory of 3024	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	39
PID 2696 wrote to memory of 2848	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	40
PID 2696 wrote to memory of 2848	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	40
PID 2696 wrote to memory of 2848	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	40
PID 2696 wrote to memory of 1056	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	41
PID 2696 wrote to memory of 1056	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	41
PID 2696 wrote to memory of 1056	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	41
PID 2696 wrote to memory of 1384	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	42
PID 2696 wrote to memory of 1384	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	42
PID 2696 wrote to memory of 1384	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	42
PID 2696 wrote to memory of 564	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	43
PID 2696 wrote to memory of 564	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	43
PID 2696 wrote to memory of 564	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	43
PID 2696 wrote to memory of 756	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	44
PID 2696 wrote to memory of 756	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	44
PID 2696 wrote to memory of 756	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	44
PID 2696 wrote to memory of 2640	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	45
PID 2696 wrote to memory of 2640	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	45
PID 2696 wrote to memory of 2640	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	45
PID 2696 wrote to memory of 2600	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	46
PID 2696 wrote to memory of 2600	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	46
PID 2696 wrote to memory of 2600	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	46
PID 2696 wrote to memory of 1532	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	47
PID 2696 wrote to memory of 1532	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	47
PID 2696 wrote to memory of 1532	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	47
PID 2696 wrote to memory of 1800	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	48
PID 2696 wrote to memory of 1800	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	48
PID 2696 wrote to memory of 1800	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	48
PID 2696 wrote to memory of 2016	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	49
PID 2696 wrote to memory of 2016	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	49
PID 2696 wrote to memory of 2016	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	49
PID 2696 wrote to memory of 1916	2696	10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10466726947deaabb48419d6b5b653d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System\tBSUPQT.exe
  C:\Windows\System\tBSUPQT.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\zRMISMT.exe
  C:\Windows\System\zRMISMT.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\bwvDymr.exe
  C:\Windows\System\bwvDymr.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ldaVIqC.exe
  C:\Windows\System\ldaVIqC.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\dyVjFIQ.exe
  C:\Windows\System\dyVjFIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\bblyTFj.exe
  C:\Windows\System\bblyTFj.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\MSMNXFo.exe
  C:\Windows\System\MSMNXFo.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\rxZfVhJ.exe
  C:\Windows\System\rxZfVhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\qrWoxKo.exe
  C:\Windows\System\qrWoxKo.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ODNzvwC.exe
  C:\Windows\System\ODNzvwC.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\zBrtikC.exe
  C:\Windows\System\zBrtikC.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\OfBkkbT.exe
  C:\Windows\System\OfBkkbT.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\ZtqDZTd.exe
  C:\Windows\System\ZtqDZTd.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\PbyzRQp.exe
  C:\Windows\System\PbyzRQp.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\sjsSBQn.exe
  C:\Windows\System\sjsSBQn.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\HVRqNmY.exe
  C:\Windows\System\HVRqNmY.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\zTUkOmJ.exe
  C:\Windows\System\zTUkOmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\vHWorTd.exe
  C:\Windows\System\vHWorTd.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\HEGCLDM.exe
  C:\Windows\System\HEGCLDM.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\zfXduDx.exe
  C:\Windows\System\zfXduDx.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\KJumUzI.exe
  C:\Windows\System\KJumUzI.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\TqEdUSs.exe
  C:\Windows\System\TqEdUSs.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\UxKYNnH.exe
  C:\Windows\System\UxKYNnH.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\HzVZTfP.exe
  C:\Windows\System\HzVZTfP.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\WStHHZN.exe
  C:\Windows\System\WStHHZN.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\CWtKKYK.exe
  C:\Windows\System\CWtKKYK.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\aShjCpD.exe
  C:\Windows\System\aShjCpD.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\UiGdsJg.exe
  C:\Windows\System\UiGdsJg.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\rZklNHj.exe
  C:\Windows\System\rZklNHj.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\ffjqwrK.exe
  C:\Windows\System\ffjqwrK.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\GsEAnZM.exe
  C:\Windows\System\GsEAnZM.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\uAcGSYR.exe
  C:\Windows\System\uAcGSYR.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\HWMXkvq.exe
  C:\Windows\System\HWMXkvq.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\CNaaeVR.exe
  C:\Windows\System\CNaaeVR.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\dBJNAIS.exe
  C:\Windows\System\dBJNAIS.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\LAtoxoI.exe
  C:\Windows\System\LAtoxoI.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\ldKEHtX.exe
  C:\Windows\System\ldKEHtX.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\cQXFiOL.exe
  C:\Windows\System\cQXFiOL.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\JUmpsXu.exe
  C:\Windows\System\JUmpsXu.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\NfjItFp.exe
  C:\Windows\System\NfjItFp.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\SBEEUPz.exe
  C:\Windows\System\SBEEUPz.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\AyHwyUF.exe
  C:\Windows\System\AyHwyUF.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\whTeHNI.exe
  C:\Windows\System\whTeHNI.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\hzvGrxK.exe
  C:\Windows\System\hzvGrxK.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\RSRuLdk.exe
  C:\Windows\System\RSRuLdk.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\KISjhDO.exe
  C:\Windows\System\KISjhDO.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\sBsisDM.exe
  C:\Windows\System\sBsisDM.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\ZUdTVSA.exe
  C:\Windows\System\ZUdTVSA.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\BumYSej.exe
  C:\Windows\System\BumYSej.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\yQPtnuU.exe
  C:\Windows\System\yQPtnuU.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\JgwvxDp.exe
  C:\Windows\System\JgwvxDp.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\tEcxuUm.exe
  C:\Windows\System\tEcxuUm.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\TKfNAra.exe
  C:\Windows\System\TKfNAra.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\CUGGesj.exe
  C:\Windows\System\CUGGesj.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\jerrcEE.exe
  C:\Windows\System\jerrcEE.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\IDSsfAt.exe
  C:\Windows\System\IDSsfAt.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\qFoYvCc.exe
  C:\Windows\System\qFoYvCc.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\wlzNdPX.exe
  C:\Windows\System\wlzNdPX.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\ybIZWdu.exe
  C:\Windows\System\ybIZWdu.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\OvcDrHr.exe
  C:\Windows\System\OvcDrHr.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\SoKWrNz.exe
  C:\Windows\System\SoKWrNz.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\fXWMttM.exe
  C:\Windows\System\fXWMttM.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\WkZGRyQ.exe
  C:\Windows\System\WkZGRyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\oQEdHRB.exe
  C:\Windows\System\oQEdHRB.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\thbCEWU.exe
  C:\Windows\System\thbCEWU.exe
  2⤵
  PID:328
- C:\Windows\System\NFDKmBH.exe
  C:\Windows\System\NFDKmBH.exe
  2⤵
  PID:2340
- C:\Windows\System\GandppM.exe
  C:\Windows\System\GandppM.exe
  2⤵
  PID:836
- C:\Windows\System\kLyOFbQ.exe
  C:\Windows\System\kLyOFbQ.exe
  2⤵
  PID:2588
- C:\Windows\System\BUwCBed.exe
  C:\Windows\System\BUwCBed.exe
  2⤵
  PID:1668
- C:\Windows\System\ECnAxft.exe
  C:\Windows\System\ECnAxft.exe
  2⤵
  PID:2544
- C:\Windows\System\VktBEgP.exe
  C:\Windows\System\VktBEgP.exe
  2⤵
  PID:1928
- C:\Windows\System\MMleIqg.exe
  C:\Windows\System\MMleIqg.exe
  2⤵
  PID:1640
- C:\Windows\System\teROJKq.exe
  C:\Windows\System\teROJKq.exe
  2⤵
  PID:1824
- C:\Windows\System\fuZaXkB.exe
  C:\Windows\System\fuZaXkB.exe
  2⤵
  PID:2708
- C:\Windows\System\XNZwiIo.exe
  C:\Windows\System\XNZwiIo.exe
  2⤵
  PID:1592
- C:\Windows\System\CQpklCb.exe
  C:\Windows\System\CQpklCb.exe
  2⤵
  PID:2740
- C:\Windows\System\UwPiRZW.exe
  C:\Windows\System\UwPiRZW.exe
  2⤵
  PID:2948
- C:\Windows\System\lwqRhQf.exe
  C:\Windows\System\lwqRhQf.exe
  2⤵
  PID:572
- C:\Windows\System\OHApkUe.exe
  C:\Windows\System\OHApkUe.exe
  2⤵
  PID:1992
- C:\Windows\System\oIJPzON.exe
  C:\Windows\System\oIJPzON.exe
  2⤵
  PID:2212
- C:\Windows\System\QVtqUhe.exe
  C:\Windows\System\QVtqUhe.exe
  2⤵
  PID:3032
- C:\Windows\System\CJpOVpe.exe
  C:\Windows\System\CJpOVpe.exe
  2⤵
  PID:1632
- C:\Windows\System\ZeLKmAw.exe
  C:\Windows\System\ZeLKmAw.exe
  2⤵
  PID:2676
- C:\Windows\System\txFERYN.exe
  C:\Windows\System\txFERYN.exe
  2⤵
  PID:2336
- C:\Windows\System\JMgLtII.exe
  C:\Windows\System\JMgLtII.exe
  2⤵
  PID:1480
- C:\Windows\System\wfVFjBq.exe
  C:\Windows\System\wfVFjBq.exe
  2⤵
  PID:1840
- C:\Windows\System\KnvSghs.exe
  C:\Windows\System\KnvSghs.exe
  2⤵
  PID:956
- C:\Windows\System\FryaHwS.exe
  C:\Windows\System\FryaHwS.exe
  2⤵
  PID:2040
- C:\Windows\System\jwdPFPw.exe
  C:\Windows\System\jwdPFPw.exe
  2⤵
  PID:2732
- C:\Windows\System\FYXucgi.exe
  C:\Windows\System\FYXucgi.exe
  2⤵
  PID:3004
- C:\Windows\System\MUfXouG.exe
  C:\Windows\System\MUfXouG.exe
  2⤵
  PID:2148
- C:\Windows\System\JGXDHSC.exe
  C:\Windows\System\JGXDHSC.exe
  2⤵
  PID:2812
- C:\Windows\System\nFcozId.exe
  C:\Windows\System\nFcozId.exe
  2⤵
  PID:2260
- C:\Windows\System\igKmNWN.exe
  C:\Windows\System\igKmNWN.exe
  2⤵
  PID:2036
- C:\Windows\System\deJwCii.exe
  C:\Windows\System\deJwCii.exe
  2⤵
  PID:2644
- C:\Windows\System\OjHyzbC.exe
  C:\Windows\System\OjHyzbC.exe
  2⤵
  PID:1304
- C:\Windows\System\zVGFMyt.exe
  C:\Windows\System\zVGFMyt.exe
  2⤵
  PID:548
- C:\Windows\System\EycULFM.exe
  C:\Windows\System\EycULFM.exe
  2⤵
  PID:1548
- C:\Windows\System\IofAXBS.exe
  C:\Windows\System\IofAXBS.exe
  2⤵
  PID:2320
- C:\Windows\System\BdqAdCQ.exe
  C:\Windows\System\BdqAdCQ.exe
  2⤵
  PID:2316
- C:\Windows\System\fGlOLOF.exe
  C:\Windows\System\fGlOLOF.exe
  2⤵
  PID:2884
- C:\Windows\System\PKSoYJT.exe
  C:\Windows\System\PKSoYJT.exe
  2⤵
  PID:1612
- C:\Windows\System\TANAYty.exe
  C:\Windows\System\TANAYty.exe
  2⤵
  PID:2868
- C:\Windows\System\SvxYMsU.exe
  C:\Windows\System\SvxYMsU.exe
  2⤵
  PID:2248
- C:\Windows\System\OdPoGGF.exe
  C:\Windows\System\OdPoGGF.exe
  2⤵
  PID:1496
- C:\Windows\System\sPbvpPN.exe
  C:\Windows\System\sPbvpPN.exe
  2⤵
  PID:2916
- C:\Windows\System\GktIqpC.exe
  C:\Windows\System\GktIqpC.exe
  2⤵
  PID:2864
- C:\Windows\System\NBGUKnH.exe
  C:\Windows\System\NBGUKnH.exe
  2⤵
  PID:2792
- C:\Windows\System\fOQOUdw.exe
  C:\Windows\System\fOQOUdw.exe
  2⤵
  PID:2352
- C:\Windows\System\dyhfWlx.exe
  C:\Windows\System\dyhfWlx.exe
  2⤵
  PID:2420
- C:\Windows\System\FcyVLfR.exe
  C:\Windows\System\FcyVLfR.exe
  2⤵
  PID:1156
- C:\Windows\System\PuWHdOH.exe
  C:\Windows\System\PuWHdOH.exe
  2⤵
  PID:1656
- C:\Windows\System\MYwvIWe.exe
  C:\Windows\System\MYwvIWe.exe
  2⤵
  PID:2020
- C:\Windows\System\kXdPaVQ.exe
  C:\Windows\System\kXdPaVQ.exe
  2⤵
  PID:2584
- C:\Windows\System\TCMgMxg.exe
  C:\Windows\System\TCMgMxg.exe
  2⤵
  PID:696
- C:\Windows\System\Syiheld.exe
  C:\Windows\System\Syiheld.exe
  2⤵
  PID:2184
- C:\Windows\System\YLFhMIb.exe
  C:\Windows\System\YLFhMIb.exe
  2⤵
  PID:1784
- C:\Windows\System\WxZWJRP.exe
  C:\Windows\System\WxZWJRP.exe
  2⤵
  PID:932
- C:\Windows\System\SCjThEx.exe
  C:\Windows\System\SCjThEx.exe
  2⤵
  PID:1748
- C:\Windows\System\qkgzXSz.exe
  C:\Windows\System\qkgzXSz.exe
  2⤵
  PID:2452
- C:\Windows\System\fogiXUO.exe
  C:\Windows\System\fogiXUO.exe
  2⤵
  PID:1068
- C:\Windows\System\ZVsEeLd.exe
  C:\Windows\System\ZVsEeLd.exe
  2⤵
  PID:3008
- C:\Windows\System\WMbAsam.exe
  C:\Windows\System\WMbAsam.exe
  2⤵
  PID:2164
- C:\Windows\System\slkzEfx.exe
  C:\Windows\System\slkzEfx.exe
  2⤵
  PID:1264
- C:\Windows\System\yVEGWJE.exe
  C:\Windows\System\yVEGWJE.exe
  2⤵
  PID:852
- C:\Windows\System\wdBipiM.exe
  C:\Windows\System\wdBipiM.exe
  2⤵
  PID:2356
- C:\Windows\System\vKneQjF.exe
  C:\Windows\System\vKneQjF.exe
  2⤵
  PID:1960
- C:\Windows\System\OexAvTT.exe
  C:\Windows\System\OexAvTT.exe
  2⤵
  PID:2436
- C:\Windows\System\PTvwRGZ.exe
  C:\Windows\System\PTvwRGZ.exe
  2⤵
  PID:2392
- C:\Windows\System\bvbOMyF.exe
  C:\Windows\System\bvbOMyF.exe
  2⤵
  PID:1844
- C:\Windows\System\NWDySQL.exe
  C:\Windows\System\NWDySQL.exe
  2⤵
  PID:2464
- C:\Windows\System\xYUaRtv.exe
  C:\Windows\System\xYUaRtv.exe
  2⤵
  PID:2520
- C:\Windows\System\IEEkUvg.exe
  C:\Windows\System\IEEkUvg.exe
  2⤵
  PID:1368
- C:\Windows\System\KAHbyvA.exe
  C:\Windows\System\KAHbyvA.exe
  2⤵
  PID:2688
- C:\Windows\System\fdHpCNQ.exe
  C:\Windows\System\fdHpCNQ.exe
  2⤵
  PID:1980
- C:\Windows\System\CICWTKd.exe
  C:\Windows\System\CICWTKd.exe
  2⤵
  PID:2324
- C:\Windows\System\WjTEhog.exe
  C:\Windows\System\WjTEhog.exe
  2⤵
  PID:2712
- C:\Windows\System\BuNncHW.exe
  C:\Windows\System\BuNncHW.exe
  2⤵
  PID:1724
- C:\Windows\System\vqLKQwc.exe
  C:\Windows\System\vqLKQwc.exe
  2⤵
  PID:1148
- C:\Windows\System\jQEQams.exe
  C:\Windows\System\jQEQams.exe
  2⤵
  PID:524
- C:\Windows\System\HRgIQLZ.exe
  C:\Windows\System\HRgIQLZ.exe
  2⤵
  PID:3060
- C:\Windows\System\NALPNxq.exe
  C:\Windows\System\NALPNxq.exe
  2⤵
  PID:1524
- C:\Windows\System\VZonnFh.exe
  C:\Windows\System\VZonnFh.exe
  2⤵
  PID:2828
- C:\Windows\System\nsfPJtN.exe
  C:\Windows\System\nsfPJtN.exe
  2⤵
  PID:1696
- C:\Windows\System\qagWppL.exe
  C:\Windows\System\qagWppL.exe
  2⤵
  PID:2508
- C:\Windows\System\ZwJJBOt.exe
  C:\Windows\System\ZwJJBOt.exe
  2⤵
  PID:2568
- C:\Windows\System\bFRkCQi.exe
  C:\Windows\System\bFRkCQi.exe
  2⤵
  PID:2008
- C:\Windows\System\IjNftRi.exe
  C:\Windows\System\IjNftRi.exe
  2⤵
  PID:2288
- C:\Windows\System\IsXfEDL.exe
  C:\Windows\System\IsXfEDL.exe
  2⤵
  PID:2592
- C:\Windows\System\KUZhtuZ.exe
  C:\Windows\System\KUZhtuZ.exe
  2⤵
  PID:2156
- C:\Windows\System\WcaJnIu.exe
  C:\Windows\System\WcaJnIu.exe
  2⤵
  PID:3012
- C:\Windows\System\rBPPMkQ.exe
  C:\Windows\System\rBPPMkQ.exe
  2⤵
  PID:1168
- C:\Windows\System\epMrPDD.exe
  C:\Windows\System\epMrPDD.exe
  2⤵
  PID:2616
- C:\Windows\System\EqQQAfp.exe
  C:\Windows\System\EqQQAfp.exe
  2⤵
  PID:952
- C:\Windows\System\hsvlsOs.exe
  C:\Windows\System\hsvlsOs.exe
  2⤵
  PID:2840
- C:\Windows\System\PyihWJE.exe
  C:\Windows\System\PyihWJE.exe
  2⤵
  PID:1772
- C:\Windows\System\DfSNzZw.exe
  C:\Windows\System\DfSNzZw.exe
  2⤵
  PID:2968
- C:\Windows\System\gThuXdV.exe
  C:\Windows\System\gThuXdV.exe
  2⤵
  PID:2612
- C:\Windows\System\gLonWxW.exe
  C:\Windows\System\gLonWxW.exe
  2⤵
  PID:2896
- C:\Windows\System\eMIUndK.exe
  C:\Windows\System\eMIUndK.exe
  2⤵
  PID:3260
- C:\Windows\System\crLzJOA.exe
  C:\Windows\System\crLzJOA.exe
  2⤵
  PID:3276
- C:\Windows\System\tVWBGTK.exe
  C:\Windows\System\tVWBGTK.exe
  2⤵
  PID:3292
- C:\Windows\System\PoVeFJh.exe
  C:\Windows\System\PoVeFJh.exe
  2⤵
  PID:3308
- C:\Windows\System\QmFstFx.exe
  C:\Windows\System\QmFstFx.exe
  2⤵
  PID:3324
- C:\Windows\System\rFxTUGO.exe
  C:\Windows\System\rFxTUGO.exe
  2⤵
  PID:3340
- C:\Windows\System\EPPmhhU.exe
  C:\Windows\System\EPPmhhU.exe
  2⤵
  PID:3356
- C:\Windows\System\qjLSzEz.exe
  C:\Windows\System\qjLSzEz.exe
  2⤵
  PID:3372
- C:\Windows\System\fXdxJps.exe
  C:\Windows\System\fXdxJps.exe
  2⤵
  PID:3392
- C:\Windows\System\YksBYWX.exe
  C:\Windows\System\YksBYWX.exe
  2⤵
  PID:3408
- C:\Windows\System\auInFWQ.exe
  C:\Windows\System\auInFWQ.exe
  2⤵
  PID:3424
- C:\Windows\System\PsEBGIA.exe
  C:\Windows\System\PsEBGIA.exe
  2⤵
  PID:3440
- C:\Windows\System\vPPjhFk.exe
  C:\Windows\System\vPPjhFk.exe
  2⤵
  PID:3488
- C:\Windows\System\OPTIIrq.exe
  C:\Windows\System\OPTIIrq.exe
  2⤵
  PID:3544
- C:\Windows\System\xEKzUVg.exe
  C:\Windows\System\xEKzUVg.exe
  2⤵
  PID:3568
- C:\Windows\System\Hiqktde.exe
  C:\Windows\System\Hiqktde.exe
  2⤵
  PID:3584
- C:\Windows\System\lUYmrow.exe
  C:\Windows\System\lUYmrow.exe
  2⤵
  PID:3600
- C:\Windows\System\mlxqxHe.exe
  C:\Windows\System\mlxqxHe.exe
  2⤵
  PID:3620
- C:\Windows\System\rTzXSLD.exe
  C:\Windows\System\rTzXSLD.exe
  2⤵
  PID:3636
- C:\Windows\System\JqIUZzR.exe
  C:\Windows\System\JqIUZzR.exe
  2⤵
  PID:3652
- C:\Windows\System\IQwYtAQ.exe
  C:\Windows\System\IQwYtAQ.exe
  2⤵
  PID:3668
- C:\Windows\System\pJQcNLA.exe
  C:\Windows\System\pJQcNLA.exe
  2⤵
  PID:3684
- C:\Windows\System\PWeirCx.exe
  C:\Windows\System\PWeirCx.exe
  2⤵
  PID:3700
- C:\Windows\System\XsxzKyj.exe
  C:\Windows\System\XsxzKyj.exe
  2⤵
  PID:3716
- C:\Windows\System\UeQohox.exe
  C:\Windows\System\UeQohox.exe
  2⤵
  PID:3772
- C:\Windows\System\PnawCqS.exe
  C:\Windows\System\PnawCqS.exe
  2⤵
  PID:3788
- C:\Windows\System\CrzJhSV.exe
  C:\Windows\System\CrzJhSV.exe
  2⤵
  PID:3816
- C:\Windows\System\RWbhjWV.exe
  C:\Windows\System\RWbhjWV.exe
  2⤵
  PID:3832
- C:\Windows\System\LWvIFgr.exe
  C:\Windows\System\LWvIFgr.exe
  2⤵
  PID:3848
- C:\Windows\System\djIMjzD.exe
  C:\Windows\System\djIMjzD.exe
  2⤵
  PID:3864
- C:\Windows\System\ymrIwvI.exe
  C:\Windows\System\ymrIwvI.exe
  2⤵
  PID:3880
- C:\Windows\System\VfHJjea.exe
  C:\Windows\System\VfHJjea.exe
  2⤵
  PID:3896
- C:\Windows\System\oBRiZFY.exe
  C:\Windows\System\oBRiZFY.exe
  2⤵
  PID:3912
- C:\Windows\System\TslOhqn.exe
  C:\Windows\System\TslOhqn.exe
  2⤵
  PID:3932
- C:\Windows\System\ceskwzW.exe
  C:\Windows\System\ceskwzW.exe
  2⤵
  PID:3948
- C:\Windows\System\IifIAhq.exe
  C:\Windows\System\IifIAhq.exe
  2⤵
  PID:3964
- C:\Windows\System\TtFiFNa.exe
  C:\Windows\System\TtFiFNa.exe
  2⤵
  PID:3980
- C:\Windows\System\yRpjcLi.exe
  C:\Windows\System\yRpjcLi.exe
  2⤵
  PID:4000
- C:\Windows\System\tJaivQs.exe
  C:\Windows\System\tJaivQs.exe
  2⤵
  PID:4016
- C:\Windows\System\TydCizt.exe
  C:\Windows\System\TydCizt.exe
  2⤵
  PID:4032
- C:\Windows\System\iJYxlxB.exe
  C:\Windows\System\iJYxlxB.exe
  2⤵
  PID:4048
- C:\Windows\System\RUEGMSW.exe
  C:\Windows\System\RUEGMSW.exe
  2⤵
  PID:4064
- C:\Windows\System\lsbWXge.exe
  C:\Windows\System\lsbWXge.exe
  2⤵
  PID:4080
- C:\Windows\System\GNmVfea.exe
  C:\Windows\System\GNmVfea.exe
  2⤵
  PID:2716
- C:\Windows\System\eOhIvoy.exe
  C:\Windows\System\eOhIvoy.exe
  2⤵
  PID:3064
- C:\Windows\System\pGJPIrb.exe
  C:\Windows\System\pGJPIrb.exe
  2⤵
  PID:628
- C:\Windows\System\ezQJUzt.exe
  C:\Windows\System\ezQJUzt.exe
  2⤵
  PID:3084
- C:\Windows\System\CnuqVzx.exe
  C:\Windows\System\CnuqVzx.exe
  2⤵
  PID:3144
- C:\Windows\System\PmpBSTM.exe
  C:\Windows\System\PmpBSTM.exe
  2⤵
  PID:3212
- C:\Windows\System\KDaRyXh.exe
  C:\Windows\System\KDaRyXh.exe
  2⤵
  PID:3224
- C:\Windows\System\zoKaymK.exe
  C:\Windows\System\zoKaymK.exe
  2⤵
  PID:2756
- C:\Windows\System\dZUoHXz.exe
  C:\Windows\System\dZUoHXz.exe
  2⤵
  PID:2216
- C:\Windows\System\BcvLoYz.exe
  C:\Windows\System\BcvLoYz.exe
  2⤵
  PID:3300
- C:\Windows\System\PJClESF.exe
  C:\Windows\System\PJClESF.exe
  2⤵
  PID:3240
- C:\Windows\System\CnYVPEJ.exe
  C:\Windows\System\CnYVPEJ.exe
  2⤵
  PID:3316
- C:\Windows\System\EgoPmYA.exe
  C:\Windows\System\EgoPmYA.exe
  2⤵
  PID:3384
- C:\Windows\System\hvcBbbJ.exe
  C:\Windows\System\hvcBbbJ.exe
  2⤵
  PID:3420
- C:\Windows\System\qGRAsoL.exe
  C:\Windows\System\qGRAsoL.exe
  2⤵
  PID:3468
- C:\Windows\System\TGzAGWX.exe
  C:\Windows\System\TGzAGWX.exe
  2⤵
  PID:3400
- C:\Windows\System\rhTVihY.exe
  C:\Windows\System\rhTVihY.exe
  2⤵
  PID:1628
- C:\Windows\System\IQHLxMb.exe
  C:\Windows\System\IQHLxMb.exe
  2⤵
  PID:2064
- C:\Windows\System\CGLYgJP.exe
  C:\Windows\System\CGLYgJP.exe
  2⤵
  PID:2772
- C:\Windows\System\veSqsdh.exe
  C:\Windows\System\veSqsdh.exe
  2⤵
  PID:3268
- C:\Windows\System\yYZzNUm.exe
  C:\Windows\System\yYZzNUm.exe
  2⤵
  PID:3336
- C:\Windows\System\VddZXyI.exe
  C:\Windows\System\VddZXyI.exe
  2⤵
  PID:3404
- C:\Windows\System\mUahBGg.exe
  C:\Windows\System\mUahBGg.exe
  2⤵
  PID:3500
- C:\Windows\System\HgNkndy.exe
  C:\Windows\System\HgNkndy.exe
  2⤵
  PID:3512
- C:\Windows\System\xZwukcG.exe
  C:\Windows\System\xZwukcG.exe
  2⤵
  PID:3696
- C:\Windows\System\OhIBJRb.exe
  C:\Windows\System\OhIBJRb.exe
  2⤵
  PID:3736
- C:\Windows\System\cEOFLKx.exe
  C:\Windows\System\cEOFLKx.exe
  2⤵
  PID:3752
- C:\Windows\System\SALNSqm.exe
  C:\Windows\System\SALNSqm.exe
  2⤵
  PID:3768
- C:\Windows\System\vFotdBQ.exe
  C:\Windows\System\vFotdBQ.exe
  2⤵
  PID:3804
- C:\Windows\System\gFltjOA.exe
  C:\Windows\System\gFltjOA.exe
  2⤵
  PID:3840
- C:\Windows\System\DqYNtYa.exe
  C:\Windows\System\DqYNtYa.exe
  2⤵
  PID:3616
- C:\Windows\System\ZKuyLnl.exe
  C:\Windows\System\ZKuyLnl.exe
  2⤵
  PID:3904
- C:\Windows\System\oZXIMCI.exe
  C:\Windows\System\oZXIMCI.exe
  2⤵
  PID:3712
- C:\Windows\System\fHkNANu.exe
  C:\Windows\System\fHkNANu.exe
  2⤵
  PID:4008
- C:\Windows\System\cVDlZtX.exe
  C:\Windows\System\cVDlZtX.exe
  2⤵
  PID:1968
- C:\Windows\System\EUqbhGL.exe
  C:\Windows\System\EUqbhGL.exe
  2⤵
  PID:3080
- C:\Windows\System\jHprvgl.exe
  C:\Windows\System\jHprvgl.exe
  2⤵
  PID:3956
- C:\Windows\System\OIKDaOA.exe
  C:\Windows\System\OIKDaOA.exe
  2⤵
  PID:3988
- C:\Windows\System\doIJiRS.exe
  C:\Windows\System\doIJiRS.exe
  2⤵
  PID:4088
- C:\Windows\System\BwSCIxX.exe
  C:\Windows\System\BwSCIxX.exe
  2⤵
  PID:2488
- C:\Windows\System\KSJdoYu.exe
  C:\Windows\System\KSJdoYu.exe
  2⤵
  PID:3152
- C:\Windows\System\fUAgkrr.exe
  C:\Windows\System\fUAgkrr.exe
  2⤵
  PID:3092
- C:\Windows\System\VlAxhlj.exe
  C:\Windows\System\VlAxhlj.exe
  2⤵
  PID:3100
- C:\Windows\System\OhuqdBz.exe
  C:\Windows\System\OhuqdBz.exe
  2⤵
  PID:3172
- C:\Windows\System\pSrErop.exe
  C:\Windows\System\pSrErop.exe
  2⤵
  PID:3132
- C:\Windows\System\SRUcNYR.exe
  C:\Windows\System\SRUcNYR.exe
  2⤵
  PID:3204
- C:\Windows\System\rJKTVli.exe
  C:\Windows\System\rJKTVli.exe
  2⤵
  PID:3232
- C:\Windows\System\iFRIGYc.exe
  C:\Windows\System\iFRIGYc.exe
  2⤵
  PID:2396
- C:\Windows\System\JVfcnhH.exe
  C:\Windows\System\JVfcnhH.exe
  2⤵
  PID:3332
- C:\Windows\System\UKIshuS.exe
  C:\Windows\System\UKIshuS.exe
  2⤵
  PID:3236
- C:\Windows\System\EjokhxZ.exe
  C:\Windows\System\EjokhxZ.exe
  2⤵
  PID:3480
- C:\Windows\System\ejnHXSo.exe
  C:\Windows\System\ejnHXSo.exe
  2⤵
  PID:3348
- C:\Windows\System\yGmlSmB.exe
  C:\Windows\System\yGmlSmB.exe
  2⤵
  PID:3452
- C:\Windows\System\xtvFBFT.exe
  C:\Windows\System\xtvFBFT.exe
  2⤵
  PID:3520
- C:\Windows\System\sxSFsbt.exe
  C:\Windows\System\sxSFsbt.exe
  2⤵
  PID:3564
- C:\Windows\System\pGNEqmi.exe
  C:\Windows\System\pGNEqmi.exe
  2⤵
  PID:3756
- C:\Windows\System\OgUFMWi.exe
  C:\Windows\System\OgUFMWi.exe
  2⤵
  PID:3580
- C:\Windows\System\XIlvhlu.exe
  C:\Windows\System\XIlvhlu.exe
  2⤵
  PID:3304
- C:\Windows\System\gKqRajj.exe
  C:\Windows\System\gKqRajj.exe
  2⤵
  PID:3724
- C:\Windows\System\qRLdUVU.exe
  C:\Windows\System\qRLdUVU.exe
  2⤵
  PID:3608
- C:\Windows\System\xBhzbiq.exe
  C:\Windows\System\xBhzbiq.exe
  2⤵
  PID:3784
- C:\Windows\System\LouOcsk.exe
  C:\Windows\System\LouOcsk.exe
  2⤵
  PID:3972
- C:\Windows\System\RLPdjqO.exe
  C:\Windows\System\RLPdjqO.exe
  2⤵
  PID:3748
- C:\Windows\System\eStMEpR.exe
  C:\Windows\System\eStMEpR.exe
  2⤵
  PID:3876
- C:\Windows\System\xJerAYc.exe
  C:\Windows\System\xJerAYc.exe
  2⤵
  PID:3744
- C:\Windows\System\aoRxHmE.exe
  C:\Windows\System\aoRxHmE.exe
  2⤵
  PID:1768
- C:\Windows\System\nlMRimr.exe
  C:\Windows\System\nlMRimr.exe
  2⤵
  PID:3164
- C:\Windows\System\dpbbzKR.exe
  C:\Windows\System\dpbbzKR.exe
  2⤵
  PID:3288
- C:\Windows\System\pnCdTmF.exe
  C:\Windows\System\pnCdTmF.exe
  2⤵
  PID:3200
- C:\Windows\System\yQvcgNh.exe
  C:\Windows\System\yQvcgNh.exe
  2⤵
  PID:3532
- C:\Windows\System\cWGQflA.exe
  C:\Windows\System\cWGQflA.exe
  2⤵
  PID:2204
- C:\Windows\System\ltPmJxS.exe
  C:\Windows\System\ltPmJxS.exe
  2⤵
  PID:1680
- C:\Windows\System\SqzWbde.exe
  C:\Windows\System\SqzWbde.exe
  2⤵
  PID:3556
- C:\Windows\System\zwtDuYF.exe
  C:\Windows\System\zwtDuYF.exe
  2⤵
  PID:3928
- C:\Windows\System\lzyJnwO.exe
  C:\Windows\System\lzyJnwO.exe
  2⤵
  PID:3216
- C:\Windows\System\zidBgvh.exe
  C:\Windows\System\zidBgvh.exe
  2⤵
  PID:3380
- C:\Windows\System\jDViNWf.exe
  C:\Windows\System\jDViNWf.exe
  2⤵
  PID:3180
- C:\Windows\System\ObXxHpI.exe
  C:\Windows\System\ObXxHpI.exe
  2⤵
  PID:3536
- C:\Windows\System\rlZMRmL.exe
  C:\Windows\System\rlZMRmL.exe
  2⤵
  PID:960
- C:\Windows\System\pvaqtoH.exe
  C:\Windows\System\pvaqtoH.exe
  2⤵
  PID:1048
- C:\Windows\System\vfUnaoT.exe
  C:\Windows\System\vfUnaoT.exe
  2⤵
  PID:3872
- C:\Windows\System\KKMiPdW.exe
  C:\Windows\System\KKMiPdW.exe
  2⤵
  PID:3284
- C:\Windows\System\FOOFMVo.exe
  C:\Windows\System\FOOFMVo.exe
  2⤵
  PID:3680
- C:\Windows\System\LwimNjC.exe
  C:\Windows\System\LwimNjC.exe
  2⤵
  PID:1952
- C:\Windows\System\JnlHHVm.exe
  C:\Windows\System\JnlHHVm.exe
  2⤵
  PID:3764
- C:\Windows\System\kMHjGGl.exe
  C:\Windows\System\kMHjGGl.exe
  2⤵
  PID:3196
- C:\Windows\System\eIYcMcN.exe
  C:\Windows\System\eIYcMcN.exe
  2⤵
  PID:3828
- C:\Windows\System\QpERhiJ.exe
  C:\Windows\System\QpERhiJ.exe
  2⤵
  PID:752
- C:\Windows\System\fvQINmW.exe
  C:\Windows\System\fvQINmW.exe
  2⤵
  PID:3824
- C:\Windows\System\RgZdBah.exe
  C:\Windows\System\RgZdBah.exe
  2⤵
  PID:3628
- C:\Windows\System\wovqItA.exe
  C:\Windows\System\wovqItA.exe
  2⤵
  PID:800
- C:\Windows\System\CXywKxo.exe
  C:\Windows\System\CXywKxo.exe
  2⤵
  PID:3524
- C:\Windows\System\tujocmG.exe
  C:\Windows\System\tujocmG.exe
  2⤵
  PID:3664
- C:\Windows\System\oAZXnaF.exe
  C:\Windows\System\oAZXnaF.exe
  2⤵
  PID:3160
- C:\Windows\System\gzPCCGa.exe
  C:\Windows\System\gzPCCGa.exe
  2⤵
  PID:3168
- C:\Windows\System\HjUenbJ.exe
  C:\Windows\System\HjUenbJ.exe
  2⤵
  PID:3676
- C:\Windows\System\pnnsEEC.exe
  C:\Windows\System\pnnsEEC.exe
  2⤵
  PID:3184
- C:\Windows\System\kPrDumB.exe
  C:\Windows\System\kPrDumB.exe
  2⤵
  PID:3940
- C:\Windows\System\GtsnTqD.exe
  C:\Windows\System\GtsnTqD.exe
  2⤵
  PID:3228
- C:\Windows\System\YYsgBrf.exe
  C:\Windows\System\YYsgBrf.exe
  2⤵
  PID:3416
- C:\Windows\System\UbDKkYj.exe
  C:\Windows\System\UbDKkYj.exe
  2⤵
  PID:3476
- C:\Windows\System\jpVSTPT.exe
  C:\Windows\System\jpVSTPT.exe
  2⤵
  PID:4112
- C:\Windows\System\ZjxduoD.exe
  C:\Windows\System\ZjxduoD.exe
  2⤵
  PID:4132
- C:\Windows\System\XCGiklD.exe
  C:\Windows\System\XCGiklD.exe
  2⤵
  PID:4152
- C:\Windows\System\zUTQMUk.exe
  C:\Windows\System\zUTQMUk.exe
  2⤵
  PID:4168
- C:\Windows\System\pEWLirY.exe
  C:\Windows\System\pEWLirY.exe
  2⤵
  PID:4184
- C:\Windows\System\JutBuPV.exe
  C:\Windows\System\JutBuPV.exe
  2⤵
  PID:4204
- C:\Windows\System\ynMOKsB.exe
  C:\Windows\System\ynMOKsB.exe
  2⤵
  PID:4220
- C:\Windows\System\xfjFjos.exe
  C:\Windows\System\xfjFjos.exe
  2⤵
  PID:4236
- C:\Windows\System\fZxVaQz.exe
  C:\Windows\System\fZxVaQz.exe
  2⤵
  PID:4276
- C:\Windows\System\iWKRQCP.exe
  C:\Windows\System\iWKRQCP.exe
  2⤵
  PID:4292
- C:\Windows\System\WYRVotK.exe
  C:\Windows\System\WYRVotK.exe
  2⤵
  PID:4308
- C:\Windows\System\XKUutbH.exe
  C:\Windows\System\XKUutbH.exe
  2⤵
  PID:4328
- C:\Windows\System\flXRCJy.exe
  C:\Windows\System\flXRCJy.exe
  2⤵
  PID:4344
- C:\Windows\System\fHJWFpF.exe
  C:\Windows\System\fHJWFpF.exe
  2⤵
  PID:4360
- C:\Windows\System\vSiJJGS.exe
  C:\Windows\System\vSiJJGS.exe
  2⤵
  PID:4376
- C:\Windows\System\ntTpxkP.exe
  C:\Windows\System\ntTpxkP.exe
  2⤵
  PID:4392
- C:\Windows\System\qGZyaRO.exe
  C:\Windows\System\qGZyaRO.exe
  2⤵
  PID:4412
- C:\Windows\System\XFRPUeU.exe
  C:\Windows\System\XFRPUeU.exe
  2⤵
  PID:4432
- C:\Windows\System\CITiZMI.exe
  C:\Windows\System\CITiZMI.exe
  2⤵
  PID:4448
- C:\Windows\System\kfuYWFK.exe
  C:\Windows\System\kfuYWFK.exe
  2⤵
  PID:4464
- C:\Windows\System\dmrowLr.exe
  C:\Windows\System\dmrowLr.exe
  2⤵
  PID:4492
- C:\Windows\System\etbclBL.exe
  C:\Windows\System\etbclBL.exe
  2⤵
  PID:4516
- C:\Windows\System\dcYIUYE.exe
  C:\Windows\System\dcYIUYE.exe
  2⤵
  PID:4532
- C:\Windows\System\UErjbmh.exe
  C:\Windows\System\UErjbmh.exe
  2⤵
  PID:4552
- C:\Windows\System\vDNlpVR.exe
  C:\Windows\System\vDNlpVR.exe
  2⤵
  PID:4568
- C:\Windows\System\nWhYZHO.exe
  C:\Windows\System\nWhYZHO.exe
  2⤵
  PID:4584
- C:\Windows\System\KODYTZq.exe
  C:\Windows\System\KODYTZq.exe
  2⤵
  PID:4604
- C:\Windows\System\sBOjDpA.exe
  C:\Windows\System\sBOjDpA.exe
  2⤵
  PID:4624
- C:\Windows\System\wJrFjaf.exe
  C:\Windows\System\wJrFjaf.exe
  2⤵
  PID:4640
- C:\Windows\System\AlvBJxy.exe
  C:\Windows\System\AlvBJxy.exe
  2⤵
  PID:4656
- C:\Windows\System\OOZVxqC.exe
  C:\Windows\System\OOZVxqC.exe
  2⤵
  PID:4672
- C:\Windows\System\xHtgsbq.exe
  C:\Windows\System\xHtgsbq.exe
  2⤵
  PID:4688
- C:\Windows\System\BrayvJJ.exe
  C:\Windows\System\BrayvJJ.exe
  2⤵
  PID:4704
- C:\Windows\System\rUFDvdX.exe
  C:\Windows\System\rUFDvdX.exe
  2⤵
  PID:4724
- C:\Windows\System\zUNQxXh.exe
  C:\Windows\System\zUNQxXh.exe
  2⤵
  PID:4740
- C:\Windows\System\vcvjcLA.exe
  C:\Windows\System\vcvjcLA.exe
  2⤵
  PID:4756
- C:\Windows\System\PnJCYpY.exe
  C:\Windows\System\PnJCYpY.exe
  2⤵
  PID:4772
- C:\Windows\System\TyjjuNF.exe
  C:\Windows\System\TyjjuNF.exe
  2⤵
  PID:4788
- C:\Windows\System\nYZplsu.exe
  C:\Windows\System\nYZplsu.exe
  2⤵
  PID:4808
- C:\Windows\System\DiAlDgG.exe
  C:\Windows\System\DiAlDgG.exe
  2⤵
  PID:4824
- C:\Windows\System\bEmYVyK.exe
  C:\Windows\System\bEmYVyK.exe
  2⤵
  PID:4840
- C:\Windows\System\rAYZBpd.exe
  C:\Windows\System\rAYZBpd.exe
  2⤵
  PID:4856
- C:\Windows\System\XNCSaMy.exe
  C:\Windows\System\XNCSaMy.exe
  2⤵
  PID:4872
- C:\Windows\System\cehQmxh.exe
  C:\Windows\System\cehQmxh.exe
  2⤵
  PID:4888
- C:\Windows\System\dPLURfi.exe
  C:\Windows\System\dPLURfi.exe
  2⤵
  PID:4932
- C:\Windows\System\XvNYwvo.exe
  C:\Windows\System\XvNYwvo.exe
  2⤵
  PID:4972
- C:\Windows\System\ltwjdNo.exe
  C:\Windows\System\ltwjdNo.exe
  2⤵
  PID:4996
- C:\Windows\System\tWgfCjw.exe
  C:\Windows\System\tWgfCjw.exe
  2⤵
  PID:5012
- C:\Windows\System\SjZfCql.exe
  C:\Windows\System\SjZfCql.exe
  2⤵
  PID:5028
- C:\Windows\System\EvBKzju.exe
  C:\Windows\System\EvBKzju.exe
  2⤵
  PID:5044
- C:\Windows\System\wnkRxuO.exe
  C:\Windows\System\wnkRxuO.exe
  2⤵
  PID:5060
- C:\Windows\System\xPsUTPt.exe
  C:\Windows\System\xPsUTPt.exe
  2⤵
  PID:5076
- C:\Windows\System\dScugAU.exe
  C:\Windows\System\dScugAU.exe
  2⤵
  PID:5092
- C:\Windows\System\IaRMifQ.exe
  C:\Windows\System\IaRMifQ.exe
  2⤵
  PID:5108
- C:\Windows\System\YOQfSEb.exe
  C:\Windows\System\YOQfSEb.exe
  2⤵
  PID:1476
- C:\Windows\System\pqxiKFh.exe
  C:\Windows\System\pqxiKFh.exe
  2⤵
  PID:672
- C:\Windows\System\XcKnApe.exe
  C:\Windows\System\XcKnApe.exe
  2⤵
  PID:4192
- C:\Windows\System\TgwamRa.exe
  C:\Windows\System\TgwamRa.exe
  2⤵
  PID:1624
- C:\Windows\System\RdLJkTk.exe
  C:\Windows\System\RdLJkTk.exe
  2⤵
  PID:3888
- C:\Windows\System\JrXnpMU.exe
  C:\Windows\System\JrXnpMU.exe
  2⤵
  PID:4216
- C:\Windows\System\PxsOwQk.exe
  C:\Windows\System\PxsOwQk.exe
  2⤵
  PID:4260
- C:\Windows\System\rhlIPqh.exe
  C:\Windows\System\rhlIPqh.exe
  2⤵
  PID:4368
- C:\Windows\System\RHxIeCU.exe
  C:\Windows\System\RHxIeCU.exe
  2⤵
  PID:4060
- C:\Windows\System\bTctpVX.exe
  C:\Windows\System\bTctpVX.exe
  2⤵
  PID:4164
- C:\Windows\System\bTUjRLU.exe
  C:\Windows\System\bTUjRLU.exe
  2⤵
  PID:4420
- C:\Windows\System\bligKwJ.exe
  C:\Windows\System\bligKwJ.exe
  2⤵
  PID:4440
- C:\Windows\System\RZuNJFV.exe
  C:\Windows\System\RZuNJFV.exe
  2⤵
  PID:4320
- C:\Windows\System\kHtyqrO.exe
  C:\Windows\System\kHtyqrO.exe
  2⤵
  PID:4428
- C:\Windows\System\YTcrYZh.exe
  C:\Windows\System\YTcrYZh.exe
  2⤵
  PID:4408
- C:\Windows\System\pPemQod.exe
  C:\Windows\System\pPemQod.exe
  2⤵
  PID:4508
- C:\Windows\System\sVxyXZg.exe
  C:\Windows\System\sVxyXZg.exe
  2⤵
  PID:4480
- C:\Windows\System\erBCfpo.exe
  C:\Windows\System\erBCfpo.exe
  2⤵
  PID:4528
- C:\Windows\System\DiudNLg.exe
  C:\Windows\System\DiudNLg.exe
  2⤵
  PID:4564
- C:\Windows\System\aSkgKUo.exe
  C:\Windows\System\aSkgKUo.exe
  2⤵
  PID:4612
- C:\Windows\System\GtZIAqu.exe
  C:\Windows\System\GtZIAqu.exe
  2⤵
  PID:4636
- C:\Windows\System\JrKtBIi.exe
  C:\Windows\System\JrKtBIi.exe
  2⤵
  PID:4700
- C:\Windows\System\oIedpue.exe
  C:\Windows\System\oIedpue.exe
  2⤵
  PID:4684
- C:\Windows\System\xBiTuhw.exe
  C:\Windows\System\xBiTuhw.exe
  2⤵
  PID:4736
- C:\Windows\System\qVAPHzY.exe
  C:\Windows\System\qVAPHzY.exe
  2⤵
  PID:4800
- C:\Windows\System\bssxTWL.exe
  C:\Windows\System\bssxTWL.exe
  2⤵
  PID:4864
- C:\Windows\System\aszmtEy.exe
  C:\Windows\System\aszmtEy.exe
  2⤵
  PID:4784
- C:\Windows\System\kIjerhY.exe
  C:\Windows\System\kIjerhY.exe
  2⤵
  PID:4916
- C:\Windows\System\WWdipqh.exe
  C:\Windows\System\WWdipqh.exe
  2⤵
  PID:4752
- C:\Windows\System\VnhVlww.exe
  C:\Windows\System\VnhVlww.exe
  2⤵
  PID:4928
- C:\Windows\System\oUAFzyc.exe
  C:\Windows\System\oUAFzyc.exe
  2⤵
  PID:4852
- C:\Windows\System\MNZaqGd.exe
  C:\Windows\System\MNZaqGd.exe
  2⤵
  PID:4720
- C:\Windows\System\ZiWTUsy.exe
  C:\Windows\System\ZiWTUsy.exe
  2⤵
  PID:4964
- C:\Windows\System\pJEYvHr.exe
  C:\Windows\System\pJEYvHr.exe
  2⤵
  PID:4988
- C:\Windows\System\ucVynVN.exe
  C:\Windows\System\ucVynVN.exe
  2⤵
  PID:5052
- C:\Windows\System\HwmKHJC.exe
  C:\Windows\System\HwmKHJC.exe
  2⤵
  PID:5116
- C:\Windows\System\NiXenVe.exe
  C:\Windows\System\NiXenVe.exe
  2⤵
  PID:5036
- C:\Windows\System\aLDFLZe.exe
  C:\Windows\System\aLDFLZe.exe
  2⤵
  PID:5104
- C:\Windows\System\MeQCjSb.exe
  C:\Windows\System\MeQCjSb.exe
  2⤵
  PID:4300
- C:\Windows\System\eiKOWas.exe
  C:\Windows\System\eiKOWas.exe
  2⤵
  PID:4012
- C:\Windows\System\UeRQLcT.exe
  C:\Windows\System\UeRQLcT.exe
  2⤵
  PID:4120
- C:\Windows\System\PinLxpU.exe
  C:\Windows\System\PinLxpU.exe
  2⤵
  PID:3096
- C:\Windows\System\zkqahJf.exe
  C:\Windows\System\zkqahJf.exe
  2⤵
  PID:4356
- C:\Windows\System\ECrDbOv.exe
  C:\Windows\System\ECrDbOv.exe
  2⤵
  PID:4476
- C:\Windows\System\gUEXLYj.exe
  C:\Windows\System\gUEXLYj.exe
  2⤵
  PID:4284
- C:\Windows\System\rbgxqPh.exe
  C:\Windows\System\rbgxqPh.exe
  2⤵
  PID:4404
- C:\Windows\System\NqDuqDr.exe
  C:\Windows\System\NqDuqDr.exe
  2⤵
  PID:4560
- C:\Windows\System\QCIUAOr.exe
  C:\Windows\System\QCIUAOr.exe
  2⤵
  PID:4664
- C:\Windows\System\jtXxOxA.exe
  C:\Windows\System\jtXxOxA.exe
  2⤵
  PID:4832
- C:\Windows\System\iLysUIi.exe
  C:\Windows\System\iLysUIi.exe
  2⤵
  PID:4796
- C:\Windows\System\wWtYVeP.exe
  C:\Windows\System\wWtYVeP.exe
  2⤵
  PID:4884
- C:\Windows\System\YihmNaq.exe
  C:\Windows\System\YihmNaq.exe
  2⤵
  PID:4816
- C:\Windows\System\AwSEsIg.exe
  C:\Windows\System\AwSEsIg.exe
  2⤵
  PID:4948
- C:\Windows\System\cSTDVuR.exe
  C:\Windows\System\cSTDVuR.exe
  2⤵
  PID:5040
- C:\Windows\System\qXAHWuD.exe
  C:\Windows\System\qXAHWuD.exe
  2⤵
  PID:5004
- C:\Windows\System\phRybUC.exe
  C:\Windows\System\phRybUC.exe
  2⤵
  PID:5072
- C:\Windows\System\FBJnltO.exe
  C:\Windows\System\FBJnltO.exe
  2⤵
  PID:3464
- C:\Windows\System\MTmkUKN.exe
  C:\Windows\System\MTmkUKN.exe
  2⤵
  PID:3860
- C:\Windows\System\xQgmIcb.exe
  C:\Windows\System\xQgmIcb.exe
  2⤵
  PID:4576
- C:\Windows\System\zukhaTA.exe
  C:\Windows\System\zukhaTA.exe
  2⤵
  PID:4272
- C:\Windows\System\QWBKuVn.exe
  C:\Windows\System\QWBKuVn.exe
  2⤵
  PID:4616
- C:\Windows\System\WTNenou.exe
  C:\Windows\System\WTNenou.exe
  2⤵
  PID:4944
- C:\Windows\System\njanGYz.exe
  C:\Windows\System\njanGYz.exe
  2⤵
  PID:1752
- C:\Windows\System\LokliYE.exe
  C:\Windows\System\LokliYE.exe
  2⤵
  PID:4652
- C:\Windows\System\DwgjyxL.exe
  C:\Windows\System\DwgjyxL.exe
  2⤵
  PID:4908
- C:\Windows\System\fqJVTEc.exe
  C:\Windows\System\fqJVTEc.exe
  2⤵
  PID:5024
- C:\Windows\System\rmUtkLh.exe
  C:\Windows\System\rmUtkLh.exe
  2⤵
  PID:4248
- C:\Windows\System\XfYvmub.exe
  C:\Windows\System\XfYvmub.exe
  2⤵
  PID:4140
- C:\Windows\System\WpeWbmF.exe
  C:\Windows\System\WpeWbmF.exe
  2⤵
  PID:4540
- C:\Windows\System\JfkxALc.exe
  C:\Windows\System\JfkxALc.exe
  2⤵
  PID:4324
- C:\Windows\System\kLNRhEI.exe
  C:\Windows\System\kLNRhEI.exe
  2⤵
  PID:4512
- C:\Windows\System\IbLfBlC.exe
  C:\Windows\System\IbLfBlC.exe
  2⤵
  PID:4968
- C:\Windows\System\ElZBxay.exe
  C:\Windows\System\ElZBxay.exe
  2⤵
  PID:4820
- C:\Windows\System\gpLAyTH.exe
  C:\Windows\System\gpLAyTH.exe
  2⤵
  PID:4104
- C:\Windows\System\HuIipWs.exe
  C:\Windows\System\HuIipWs.exe
  2⤵
  PID:4900
- C:\Windows\System\vfVYOyD.exe
  C:\Windows\System\vfVYOyD.exe
  2⤵
  PID:4316
- C:\Windows\System\ixjuMsu.exe
  C:\Windows\System\ixjuMsu.exe
  2⤵
  PID:4340
- C:\Windows\System\cCYGRVC.exe
  C:\Windows\System\cCYGRVC.exe
  2⤵
  PID:5124
- C:\Windows\System\oMDfiDO.exe
  C:\Windows\System\oMDfiDO.exe
  2⤵
  PID:5140
- C:\Windows\System\cmfxNXg.exe
  C:\Windows\System\cmfxNXg.exe
  2⤵
  PID:5164
- C:\Windows\System\URNmrzo.exe
  C:\Windows\System\URNmrzo.exe
  2⤵
  PID:5180
- C:\Windows\System\FuOXvrE.exe
  C:\Windows\System\FuOXvrE.exe
  2⤵
  PID:5196
- C:\Windows\System\Yxwqilk.exe
  C:\Windows\System\Yxwqilk.exe
  2⤵
  PID:5212
- C:\Windows\System\kaUXojq.exe
  C:\Windows\System\kaUXojq.exe
  2⤵
  PID:5228
- C:\Windows\System\hWKWNZt.exe
  C:\Windows\System\hWKWNZt.exe
  2⤵
  PID:5244
- C:\Windows\System\nyYPSAY.exe
  C:\Windows\System\nyYPSAY.exe
  2⤵
  PID:5260
- C:\Windows\System\ClfiJnH.exe
  C:\Windows\System\ClfiJnH.exe
  2⤵
  PID:5276
- C:\Windows\System\rYwNBoi.exe
  C:\Windows\System\rYwNBoi.exe
  2⤵
  PID:5292
- C:\Windows\System\zfYKleD.exe
  C:\Windows\System\zfYKleD.exe
  2⤵
  PID:5308
- C:\Windows\System\QBiWEFP.exe
  C:\Windows\System\QBiWEFP.exe
  2⤵
  PID:5344
- C:\Windows\System\qnLsuOW.exe
  C:\Windows\System\qnLsuOW.exe
  2⤵
  PID:5360
- C:\Windows\System\KxAkRek.exe
  C:\Windows\System\KxAkRek.exe
  2⤵
  PID:5376
- C:\Windows\System\WaIwcLQ.exe
  C:\Windows\System\WaIwcLQ.exe
  2⤵
  PID:5396
- C:\Windows\System\LYwxCqE.exe
  C:\Windows\System\LYwxCqE.exe
  2⤵
  PID:5412
- C:\Windows\System\ltvGmeW.exe
  C:\Windows\System\ltvGmeW.exe
  2⤵
  PID:5428
- C:\Windows\System\pTAiJXB.exe
  C:\Windows\System\pTAiJXB.exe
  2⤵
  PID:5448
- C:\Windows\System\HbICTWI.exe
  C:\Windows\System\HbICTWI.exe
  2⤵
  PID:5464
- C:\Windows\System\wmsBeFv.exe
  C:\Windows\System\wmsBeFv.exe
  2⤵
  PID:5480
- C:\Windows\System\BmlZPFH.exe
  C:\Windows\System\BmlZPFH.exe
  2⤵
  PID:5500
- C:\Windows\System\UphdFYj.exe
  C:\Windows\System\UphdFYj.exe
  2⤵
  PID:5516
- C:\Windows\System\EIWhJHh.exe
  C:\Windows\System\EIWhJHh.exe
  2⤵
  PID:5532
- C:\Windows\System\wqYOtkr.exe
  C:\Windows\System\wqYOtkr.exe
  2⤵
  PID:5552
- C:\Windows\System\SRTuaIz.exe
  C:\Windows\System\SRTuaIz.exe
  2⤵
  PID:5568
- C:\Windows\System\KkumVXw.exe
  C:\Windows\System\KkumVXw.exe
  2⤵
  PID:5584
- C:\Windows\System\sucuVSJ.exe
  C:\Windows\System\sucuVSJ.exe
  2⤵
  PID:5612
- C:\Windows\System\rkHflXa.exe
  C:\Windows\System\rkHflXa.exe
  2⤵
  PID:5720
- C:\Windows\System\VazZQYl.exe
  C:\Windows\System\VazZQYl.exe
  2⤵
  PID:5740
- C:\Windows\System\DPjbHIg.exe
  C:\Windows\System\DPjbHIg.exe
  2⤵
  PID:5756
- C:\Windows\System\FYLNbpf.exe
  C:\Windows\System\FYLNbpf.exe
  2⤵
  PID:5792
- C:\Windows\System\jIVaXHk.exe
  C:\Windows\System\jIVaXHk.exe
  2⤵
  PID:5812
- C:\Windows\System\VzciEOf.exe
  C:\Windows\System\VzciEOf.exe
  2⤵
  PID:5828
- C:\Windows\System\xgyibhn.exe
  C:\Windows\System\xgyibhn.exe
  2⤵
  PID:5844
- C:\Windows\System\CtsWivS.exe
  C:\Windows\System\CtsWivS.exe
  2⤵
  PID:5860
- C:\Windows\System\iYWHKMT.exe
  C:\Windows\System\iYWHKMT.exe
  2⤵
  PID:5876
- C:\Windows\System\AJevTiy.exe
  C:\Windows\System\AJevTiy.exe
  2⤵
  PID:5892
- C:\Windows\System\SLtvVjF.exe
  C:\Windows\System\SLtvVjF.exe
  2⤵
  PID:5908
- C:\Windows\System\VofFdUs.exe
  C:\Windows\System\VofFdUs.exe
  2⤵
  PID:5948
- C:\Windows\System\cDyPdqE.exe
  C:\Windows\System\cDyPdqE.exe
  2⤵
  PID:5964
- C:\Windows\System\dKlSUmE.exe
  C:\Windows\System\dKlSUmE.exe
  2⤵
  PID:5980
- C:\Windows\System\XJBVLZv.exe
  C:\Windows\System\XJBVLZv.exe
  2⤵
  PID:5996
- C:\Windows\System\KJJoIiV.exe
  C:\Windows\System\KJJoIiV.exe
  2⤵
  PID:6012
- C:\Windows\System\cImEpWU.exe
  C:\Windows\System\cImEpWU.exe
  2⤵
  PID:6032
- C:\Windows\System\fWoDjqE.exe
  C:\Windows\System\fWoDjqE.exe
  2⤵
  PID:6052
- C:\Windows\System\ojmwcZD.exe
  C:\Windows\System\ojmwcZD.exe
  2⤵
  PID:6068
- C:\Windows\System\cWqxRbl.exe
  C:\Windows\System\cWqxRbl.exe
  2⤵
  PID:6092
- C:\Windows\System\PJaSlfi.exe
  C:\Windows\System\PJaSlfi.exe
  2⤵
  PID:6108
- C:\Windows\System\DgXcVgX.exe
  C:\Windows\System\DgXcVgX.exe
  2⤵
  PID:6124
- C:\Windows\System\uwvMTYO.exe
  C:\Windows\System\uwvMTYO.exe
  2⤵
  PID:6140
- C:\Windows\System\Ixaetbb.exe
  C:\Windows\System\Ixaetbb.exe
  2⤵
  PID:4748
- C:\Windows\System\LUwkwBo.exe
  C:\Windows\System\LUwkwBo.exe
  2⤵
  PID:5136
- C:\Windows\System\CYGlAQP.exe
  C:\Windows\System\CYGlAQP.exe
  2⤵
  PID:5224
- C:\Windows\System\VmycmMk.exe
  C:\Windows\System\VmycmMk.exe
  2⤵
  PID:5284
- C:\Windows\System\PhDhokx.exe
  C:\Windows\System\PhDhokx.exe
  2⤵
  PID:5332
- C:\Windows\System\RBqwlqm.exe
  C:\Windows\System\RBqwlqm.exe
  2⤵
  PID:5320
- C:\Windows\System\WQgvywg.exe
  C:\Windows\System\WQgvywg.exe
  2⤵
  PID:5444
- C:\Windows\System\tJFwwcS.exe
  C:\Windows\System\tJFwwcS.exe
  2⤵
  PID:5240
- C:\Windows\System\hqPtlfw.exe
  C:\Windows\System\hqPtlfw.exe
  2⤵
  PID:5304
- C:\Windows\System\mztXPOT.exe
  C:\Windows\System\mztXPOT.exe
  2⤵
  PID:5352
- C:\Windows\System\nWhLnlu.exe
  C:\Windows\System\nWhLnlu.exe
  2⤵
  PID:5548
- C:\Windows\System\UzyvNQi.exe
  C:\Windows\System\UzyvNQi.exe
  2⤵
  PID:5424
- C:\Windows\System\SyoFFOe.exe
  C:\Windows\System\SyoFFOe.exe
  2⤵
  PID:5544
- C:\Windows\System\UzQzWGA.exe
  C:\Windows\System\UzQzWGA.exe
  2⤵
  PID:5528
- C:\Windows\System\yNinbnF.exe
  C:\Windows\System\yNinbnF.exe
  2⤵
  PID:5324
- C:\Windows\System\LKOLveC.exe
  C:\Windows\System\LKOLveC.exe
  2⤵
  PID:5628
- C:\Windows\System\lpPHvCl.exe
  C:\Windows\System\lpPHvCl.exe
  2⤵
  PID:5648
- C:\Windows\System\mgqgGad.exe
  C:\Windows\System\mgqgGad.exe
  2⤵
  PID:5668
- C:\Windows\System\opfSAmr.exe
  C:\Windows\System\opfSAmr.exe
  2⤵
  PID:5692
- C:\Windows\System\nwzGVTt.exe
  C:\Windows\System\nwzGVTt.exe
  2⤵
  PID:5712
- C:\Windows\System\QBjRoMK.exe
  C:\Windows\System\QBjRoMK.exe
  2⤵
  PID:5736
- C:\Windows\System\JWLjVgQ.exe
  C:\Windows\System\JWLjVgQ.exe
  2⤵
  PID:5856
- C:\Windows\System\hWmfYmR.exe
  C:\Windows\System\hWmfYmR.exe
  2⤵
  PID:5820
- C:\Windows\System\kUTWayu.exe
  C:\Windows\System\kUTWayu.exe
  2⤵
  PID:5936
- C:\Windows\System\xATRnde.exe
  C:\Windows\System\xATRnde.exe
  2⤵
  PID:5972
- C:\Windows\System\bBYqmaU.exe
  C:\Windows\System\bBYqmaU.exe
  2⤵
  PID:6080
- C:\Windows\System\yYHPwnU.exe
  C:\Windows\System\yYHPwnU.exe
  2⤵
  PID:5192
- C:\Windows\System\GDDDQUJ.exe
  C:\Windows\System\GDDDQUJ.exe
  2⤵
  PID:6116
- C:\Windows\System\mWopvae.exe
  C:\Windows\System\mWopvae.exe
  2⤵
  PID:5316
- C:\Windows\System\vaXqMLw.exe
  C:\Windows\System\vaXqMLw.exe
  2⤵
  PID:5408
- C:\Windows\System\EoWTgrY.exe
  C:\Windows\System\EoWTgrY.exe
  2⤵
  PID:5356
- C:\Windows\System\yZUIBrB.exe
  C:\Windows\System\yZUIBrB.exe
  2⤵
  PID:5660
- C:\Windows\System\XgUeCYK.exe
  C:\Windows\System\XgUeCYK.exe
  2⤵
  PID:5956
- C:\Windows\System\sOvXRBv.exe
  C:\Windows\System\sOvXRBv.exe
  2⤵
  PID:6020
- C:\Windows\System\wMpiAEw.exe
  C:\Windows\System\wMpiAEw.exe
  2⤵
  PID:6100
- C:\Windows\System\HpDMnkV.exe
  C:\Windows\System\HpDMnkV.exe
  2⤵
  PID:3996
- C:\Windows\System\LfLDgsS.exe
  C:\Windows\System\LfLDgsS.exe
  2⤵
  PID:5172
- C:\Windows\System\pqegsGr.exe
  C:\Windows\System\pqegsGr.exe
  2⤵
  PID:3220
- C:\Windows\System\lTGnxXn.exe
  C:\Windows\System\lTGnxXn.exe
  2⤵
  PID:5456
- C:\Windows\System\bDnsVTf.exe
  C:\Windows\System\bDnsVTf.exe
  2⤵
  PID:5656
- C:\Windows\System\mMGVyeT.exe
  C:\Windows\System\mMGVyeT.exe
  2⤵
  PID:5436
- C:\Windows\System\khGCGfJ.exe
  C:\Windows\System\khGCGfJ.exe
  2⤵
  PID:5640
- C:\Windows\System\mgAxoSI.exe
  C:\Windows\System\mgAxoSI.exe
  2⤵
  PID:5636
- C:\Windows\System\TfauOLp.exe
  C:\Windows\System\TfauOLp.exe
  2⤵
  PID:5748
- C:\Windows\System\iiblwEm.exe
  C:\Windows\System\iiblwEm.exe
  2⤵
  PID:5800
- C:\Windows\System\DdXVlGO.exe
  C:\Windows\System\DdXVlGO.exe
  2⤵
  PID:5732
- C:\Windows\System\FwYeRuz.exe
  C:\Windows\System\FwYeRuz.exe
  2⤵
  PID:5788
- C:\Windows\System\GGBbkQe.exe
  C:\Windows\System\GGBbkQe.exe
  2⤵
  PID:5888
- C:\Windows\System\KEgaWXd.exe
  C:\Windows\System\KEgaWXd.exe
  2⤵
  PID:5772
- C:\Windows\System\XkxKLWI.exe
  C:\Windows\System\XkxKLWI.exe
  2⤵
  PID:6044
- C:\Windows\System\LJncyEs.exe
  C:\Windows\System\LJncyEs.exe
  2⤵
  PID:5944
- C:\Windows\System\qnHkUlo.exe
  C:\Windows\System\qnHkUlo.exe
  2⤵
  PID:4252
- C:\Windows\System\CtxDeiD.exe
  C:\Windows\System\CtxDeiD.exe
  2⤵
  PID:5208
- C:\Windows\System\nWJivlx.exe
  C:\Windows\System\nWJivlx.exe
  2⤵
  PID:5992
- C:\Windows\System\GMzVIrS.exe
  C:\Windows\System\GMzVIrS.exe
  2⤵
  PID:6132
- C:\Windows\System\ApyLcku.exe
  C:\Windows\System\ApyLcku.exe
  2⤵
  PID:6028
- C:\Windows\System\NzDZUEh.exe
  C:\Windows\System\NzDZUEh.exe
  2⤵
  PID:5696
- C:\Windows\System\xQkImXb.exe
  C:\Windows\System\xQkImXb.exe
  2⤵
  PID:5132
- C:\Windows\System\YFUCAyb.exe
  C:\Windows\System\YFUCAyb.exe
  2⤵
  PID:5776
- C:\Windows\System\PwXKOTO.exe
  C:\Windows\System\PwXKOTO.exe
  2⤵
  PID:5624
- C:\Windows\System\wPUnaQb.exe
  C:\Windows\System\wPUnaQb.exe
  2⤵
  PID:6060
- C:\Windows\System\sEQYoqZ.exe
  C:\Windows\System\sEQYoqZ.exe
  2⤵
  PID:5272
- C:\Windows\System\sbfVbOg.exe
  C:\Windows\System\sbfVbOg.exe
  2⤵
  PID:5904
- C:\Windows\System\wtnOarq.exe
  C:\Windows\System\wtnOarq.exe
  2⤵
  PID:5476
- C:\Windows\System\udMaENU.exe
  C:\Windows\System\udMaENU.exe
  2⤵
  PID:5540
- C:\Windows\System\MeaIdrA.exe
  C:\Windows\System\MeaIdrA.exe
  2⤵
  PID:5688
- C:\Windows\System\BnuErIU.exe
  C:\Windows\System\BnuErIU.exe
  2⤵
  PID:5752
- C:\Windows\System\hEPBpqi.exe
  C:\Windows\System\hEPBpqi.exe
  2⤵
  PID:5676
- C:\Windows\System\crbyuJg.exe
  C:\Windows\System\crbyuJg.exe
  2⤵
  PID:6064
- C:\Windows\System\cnoNLQT.exe
  C:\Windows\System\cnoNLQT.exe
  2⤵
  PID:5920
- C:\Windows\System\eIJqbZx.exe
  C:\Windows\System\eIJqbZx.exe
  2⤵
  PID:6008
- C:\Windows\System\BVkTdhk.exe
  C:\Windows\System\BVkTdhk.exe
  2⤵
  PID:5592
- C:\Windows\System\USoSUeb.exe
  C:\Windows\System\USoSUeb.exe
  2⤵
  PID:6136
- C:\Windows\System\GzBHjiB.exe
  C:\Windows\System\GzBHjiB.exe
  2⤵
  PID:6164
- C:\Windows\System\esOyKWn.exe
  C:\Windows\System\esOyKWn.exe
  2⤵
  PID:6180
- C:\Windows\System\PmffQAh.exe
  C:\Windows\System\PmffQAh.exe
  2⤵
  PID:6200
- C:\Windows\System\HBLCfDs.exe
  C:\Windows\System\HBLCfDs.exe
  2⤵
  PID:6216
- C:\Windows\System\XRcHhDR.exe
  C:\Windows\System\XRcHhDR.exe
  2⤵
  PID:6236
- C:\Windows\System\yyzPEsf.exe
  C:\Windows\System\yyzPEsf.exe
  2⤵
  PID:6252
- C:\Windows\System\tgpLKZu.exe
  C:\Windows\System\tgpLKZu.exe
  2⤵
  PID:6272
- C:\Windows\System\AgITvie.exe
  C:\Windows\System\AgITvie.exe
  2⤵
  PID:6292
- C:\Windows\System\tqcBMfX.exe
  C:\Windows\System\tqcBMfX.exe
  2⤵
  PID:6308
- C:\Windows\System\HNqcEaE.exe
  C:\Windows\System\HNqcEaE.exe
  2⤵
  PID:6324
- C:\Windows\System\QKptewU.exe
  C:\Windows\System\QKptewU.exe
  2⤵
  PID:6340
- C:\Windows\System\LNJjcWj.exe
  C:\Windows\System\LNJjcWj.exe
  2⤵
  PID:6356
- C:\Windows\System\KfXJaKz.exe
  C:\Windows\System\KfXJaKz.exe
  2⤵
  PID:6372
- C:\Windows\System\iKsASeH.exe
  C:\Windows\System\iKsASeH.exe
  2⤵
  PID:6388
- C:\Windows\System\ShGQVbF.exe
  C:\Windows\System\ShGQVbF.exe
  2⤵
  PID:6404
- C:\Windows\System\NQFIfKq.exe
  C:\Windows\System\NQFIfKq.exe
  2⤵
  PID:6420
- C:\Windows\System\vhYzPcV.exe
  C:\Windows\System\vhYzPcV.exe
  2⤵
  PID:6436
- C:\Windows\System\ZqjVzHV.exe
  C:\Windows\System\ZqjVzHV.exe
  2⤵
  PID:6452
- C:\Windows\System\rXFGZPz.exe
  C:\Windows\System\rXFGZPz.exe
  2⤵
  PID:6468
- C:\Windows\System\xAIkVFL.exe
  C:\Windows\System\xAIkVFL.exe
  2⤵
  PID:6484
- C:\Windows\System\ICgNNjS.exe
  C:\Windows\System\ICgNNjS.exe
  2⤵
  PID:6504
- C:\Windows\System\onGwSJP.exe
  C:\Windows\System\onGwSJP.exe
  2⤵
  PID:6520
- C:\Windows\System\uYcsLWH.exe
  C:\Windows\System\uYcsLWH.exe
  2⤵
  PID:6536
- C:\Windows\System\okqddXF.exe
  C:\Windows\System\okqddXF.exe
  2⤵
  PID:6564
- C:\Windows\System\uqEIoBQ.exe
  C:\Windows\System\uqEIoBQ.exe
  2⤵
  PID:6584
- C:\Windows\System\TRzSAWw.exe
  C:\Windows\System\TRzSAWw.exe
  2⤵
  PID:6604
- C:\Windows\System\DljTkOo.exe
  C:\Windows\System\DljTkOo.exe
  2⤵
  PID:6620
- C:\Windows\System\yTwcBFG.exe
  C:\Windows\System\yTwcBFG.exe
  2⤵
  PID:6636
- C:\Windows\System\qwJUVbi.exe
  C:\Windows\System\qwJUVbi.exe
  2⤵
  PID:6652
- C:\Windows\System\tZmgsLh.exe
  C:\Windows\System\tZmgsLh.exe
  2⤵
  PID:6668
- C:\Windows\System\LnhFLyV.exe
  C:\Windows\System\LnhFLyV.exe
  2⤵
  PID:6684
- C:\Windows\System\FeKQTHa.exe
  C:\Windows\System\FeKQTHa.exe
  2⤵
  PID:6708
- C:\Windows\System\uZsWuMh.exe
  C:\Windows\System\uZsWuMh.exe
  2⤵
  PID:6732
- C:\Windows\System\PMxTaXL.exe
  C:\Windows\System\PMxTaXL.exe
  2⤵
  PID:6752
- C:\Windows\System\tmoGVne.exe
  C:\Windows\System\tmoGVne.exe
  2⤵
  PID:6768
- C:\Windows\System\mRHsrnv.exe
  C:\Windows\System\mRHsrnv.exe
  2⤵
  PID:6784
- C:\Windows\System\SMCaUYf.exe
  C:\Windows\System\SMCaUYf.exe
  2⤵
  PID:6800
- C:\Windows\System\sDmHRgR.exe
  C:\Windows\System\sDmHRgR.exe
  2⤵
  PID:6816
- C:\Windows\System\OiISuxc.exe
  C:\Windows\System\OiISuxc.exe
  2⤵
  PID:6832
- C:\Windows\System\wPqfqcQ.exe
  C:\Windows\System\wPqfqcQ.exe
  2⤵
  PID:6856
- C:\Windows\System\ObTdDBC.exe
  C:\Windows\System\ObTdDBC.exe
  2⤵
  PID:6872
- C:\Windows\System\nmAzSCc.exe
  C:\Windows\System\nmAzSCc.exe
  2⤵
  PID:6888
- C:\Windows\System\UixlTJb.exe
  C:\Windows\System\UixlTJb.exe
  2⤵
  PID:6904
- C:\Windows\System\TAbUOXt.exe
  C:\Windows\System\TAbUOXt.exe
  2⤵
  PID:6920
- C:\Windows\System\qZVTTnV.exe
  C:\Windows\System\qZVTTnV.exe
  2⤵
  PID:6936
- C:\Windows\System\AilQJlo.exe
  C:\Windows\System\AilQJlo.exe
  2⤵
  PID:6964
- C:\Windows\System\NfYfUTx.exe
  C:\Windows\System\NfYfUTx.exe
  2⤵
  PID:6980
- C:\Windows\System\qJQeyLh.exe
  C:\Windows\System\qJQeyLh.exe
  2⤵
  PID:6996
- C:\Windows\System\YraVTJH.exe
  C:\Windows\System\YraVTJH.exe
  2⤵
  PID:7012
- C:\Windows\System\JRZTWuN.exe
  C:\Windows\System\JRZTWuN.exe
  2⤵
  PID:7028
- C:\Windows\System\nUyFMvK.exe
  C:\Windows\System\nUyFMvK.exe
  2⤵
  PID:7044
- C:\Windows\System\DdTjwVz.exe
  C:\Windows\System\DdTjwVz.exe
  2⤵
  PID:7060
- C:\Windows\System\AILRxYK.exe
  C:\Windows\System\AILRxYK.exe
  2⤵
  PID:7076
- C:\Windows\System\DpRfEkN.exe
  C:\Windows\System\DpRfEkN.exe
  2⤵
  PID:7092
- C:\Windows\System\mfLhLWS.exe
  C:\Windows\System\mfLhLWS.exe
  2⤵
  PID:7112
- C:\Windows\System\OEExWFa.exe
  C:\Windows\System\OEExWFa.exe
  2⤵
  PID:7132
- C:\Windows\System\OaHvGXt.exe
  C:\Windows\System\OaHvGXt.exe
  2⤵
  PID:7148
- C:\Windows\System\rMZUHIH.exe
  C:\Windows\System\rMZUHIH.exe
  2⤵
  PID:6088
- C:\Windows\System\OxXTcOB.exe
  C:\Windows\System\OxXTcOB.exe
  2⤵
  PID:6188
- C:\Windows\System\IFFpOhh.exe
  C:\Windows\System\IFFpOhh.exe
  2⤵
  PID:6232
- C:\Windows\System\DbfVDVj.exe
  C:\Windows\System\DbfVDVj.exe
  2⤵
  PID:6368
- C:\Windows\System\XbhFHcf.exe
  C:\Windows\System\XbhFHcf.exe
  2⤵
  PID:6364
- C:\Windows\System\ReMJoCF.exe
  C:\Windows\System\ReMJoCF.exe
  2⤵
  PID:6416
- C:\Windows\System\olfvTlm.exe
  C:\Windows\System\olfvTlm.exe
  2⤵
  PID:6476
- C:\Windows\System\cnQauES.exe
  C:\Windows\System\cnQauES.exe
  2⤵
  PID:6428
- C:\Windows\System\ZuwMfLj.exe
  C:\Windows\System\ZuwMfLj.exe
  2⤵
  PID:6556
- C:\Windows\System\AFZLrBZ.exe
  C:\Windows\System\AFZLrBZ.exe
  2⤵
  PID:6532
- C:\Windows\System\nEhtGIY.exe
  C:\Windows\System\nEhtGIY.exe
  2⤵
  PID:6628
- C:\Windows\System\HtJNdyB.exe
  C:\Windows\System\HtJNdyB.exe
  2⤵
  PID:6572
- C:\Windows\System\ElXAkKr.exe
  C:\Windows\System\ElXAkKr.exe
  2⤵
  PID:6680
- C:\Windows\System\viMQHCN.exe
  C:\Windows\System\viMQHCN.exe
  2⤵
  PID:6648
- C:\Windows\System\NqkQLPz.exe
  C:\Windows\System\NqkQLPz.exe
  2⤵
  PID:6700
- C:\Windows\System\NumCjYJ.exe
  C:\Windows\System\NumCjYJ.exe
  2⤵
  PID:6812
- C:\Windows\System\SLWEVZc.exe
  C:\Windows\System\SLWEVZc.exe
  2⤵
  PID:6616
- C:\Windows\System\zKekzqY.exe
  C:\Windows\System\zKekzqY.exe
  2⤵
  PID:6728
- C:\Windows\System\JeYbrOR.exe
  C:\Windows\System\JeYbrOR.exe
  2⤵
  PID:6824
- C:\Windows\System\jVPpAME.exe
  C:\Windows\System\jVPpAME.exe
  2⤵
  PID:6912
- C:\Windows\System\NkxVwee.exe
  C:\Windows\System\NkxVwee.exe
  2⤵
  PID:6960
- C:\Windows\System\iraVZwi.exe
  C:\Windows\System\iraVZwi.exe
  2⤵
  PID:6864
- C:\Windows\System\GbhLknm.exe
  C:\Windows\System\GbhLknm.exe
  2⤵
  PID:7084
- C:\Windows\System\lDyHLnL.exe
  C:\Windows\System\lDyHLnL.exe
  2⤵
  PID:7128
- C:\Windows\System\EwwtxPk.exe
  C:\Windows\System\EwwtxPk.exe
  2⤵
  PID:7104
- C:\Windows\System\GKpNDrp.exe
  C:\Windows\System\GKpNDrp.exe
  2⤵
  PID:7140
- C:\Windows\System\QnZcMHO.exe
  C:\Windows\System\QnZcMHO.exe
  2⤵
  PID:7004
- C:\Windows\System\YONbmPW.exe
  C:\Windows\System\YONbmPW.exe
  2⤵
  PID:7144
- C:\Windows\System\mxqBPEL.exe
  C:\Windows\System\mxqBPEL.exe
  2⤵
  PID:6172
- C:\Windows\System\KhUvKgb.exe
  C:\Windows\System\KhUvKgb.exe
  2⤵
  PID:5780
- C:\Windows\System\vqURPYN.exe
  C:\Windows\System\vqURPYN.exe
  2⤵
  PID:6152
- C:\Windows\System\pwHBaPt.exe
  C:\Windows\System\pwHBaPt.exe
  2⤵
  PID:6288
- C:\Windows\System\tyZLYHH.exe
  C:\Windows\System\tyZLYHH.exe
  2⤵
  PID:6352
- C:\Windows\System\NHiLUUL.exe
  C:\Windows\System\NHiLUUL.exe
  2⤵
  PID:6380
- C:\Windows\System\EFWKwpQ.exe
  C:\Windows\System\EFWKwpQ.exe
  2⤵
  PID:5680
- C:\Windows\System\TaQrUMj.exe
  C:\Windows\System\TaQrUMj.exe
  2⤵
  PID:6244
- C:\Windows\System\EeGNCsH.exe
  C:\Windows\System\EeGNCsH.exe
  2⤵
  PID:6412
- C:\Windows\System\rlfnKkR.exe
  C:\Windows\System\rlfnKkR.exe
  2⤵
  PID:6548
- C:\Windows\System\efJXnFS.exe
  C:\Windows\System\efJXnFS.exe
  2⤵
  PID:6600
- C:\Windows\System\XlUhpCl.exe
  C:\Windows\System\XlUhpCl.exe
  2⤵
  PID:6228
- C:\Windows\System\QlYEGvI.exe
  C:\Windows\System\QlYEGvI.exe
  2⤵
  PID:6740
- C:\Windows\System\hAESjZJ.exe
  C:\Windows\System\hAESjZJ.exe
  2⤵
  PID:6848
- C:\Windows\System\GFoMkdP.exe
  C:\Windows\System\GFoMkdP.exe
  2⤵
  PID:6780
- C:\Windows\System\dMJZhRW.exe
  C:\Windows\System\dMJZhRW.exe
  2⤵
  PID:6644
- C:\Windows\System\QerjGeW.exe
  C:\Windows\System\QerjGeW.exe
  2⤵
  PID:6792
- C:\Windows\System\ujEbGmE.exe
  C:\Windows\System\ujEbGmE.exe
  2⤵
  PID:6988
- C:\Windows\System\PkLftFo.exe
  C:\Windows\System\PkLftFo.exe
  2⤵
  PID:7040
- C:\Windows\System\vJoZLJg.exe
  C:\Windows\System\vJoZLJg.exe
  2⤵
  PID:5900
- C:\Windows\System\iVKscPP.exe
  C:\Windows\System\iVKscPP.exe
  2⤵
  PID:5492
- C:\Windows\System\QAISmOr.exe
  C:\Windows\System\QAISmOr.exe
  2⤵
  PID:6264
- C:\Windows\System\nPKbzQR.exe
  C:\Windows\System\nPKbzQR.exe
  2⤵
  PID:6332
- C:\Windows\System\heFyYAw.exe
  C:\Windows\System\heFyYAw.exe
  2⤵
  PID:7008
- C:\Windows\System\zqJHZpL.exe
  C:\Windows\System\zqJHZpL.exe
  2⤵
  PID:6596
- C:\Windows\System\WuCMAtJ.exe
  C:\Windows\System\WuCMAtJ.exe
  2⤵
  PID:5804
- C:\Windows\System\MlfPxHW.exe
  C:\Windows\System\MlfPxHW.exe
  2⤵
  PID:6400
- C:\Windows\System\xRmqrYX.exe
  C:\Windows\System\xRmqrYX.exe
  2⤵
  PID:6348
- C:\Windows\System\qDeKzpJ.exe
  C:\Windows\System\qDeKzpJ.exe
  2⤵
  PID:6884
- C:\Windows\System\ZKMgJHr.exe
  C:\Windows\System\ZKMgJHr.exe
  2⤵
  PID:6716
- C:\Windows\System\xduhUFG.exe
  C:\Windows\System\xduhUFG.exe
  2⤵
  PID:6956
- C:\Windows\System\oNeYYhi.exe
  C:\Windows\System\oNeYYhi.exe
  2⤵
  PID:6500
- C:\Windows\System\szxEqUP.exe
  C:\Windows\System\szxEqUP.exe
  2⤵
  PID:7120
- C:\Windows\System\AKcCpjb.exe
  C:\Windows\System\AKcCpjb.exe
  2⤵
  PID:6512
- C:\Windows\System\IaqdQzQ.exe
  C:\Windows\System\IaqdQzQ.exe
  2⤵
  PID:6748
- C:\Windows\System\qqOSyTn.exe
  C:\Windows\System\qqOSyTn.exe
  2⤵
  PID:6208
- C:\Windows\System\leBPULk.exe
  C:\Windows\System\leBPULk.exe
  2⤵
  PID:6664
- C:\Windows\System\RNuIynQ.exe
  C:\Windows\System\RNuIynQ.exe
  2⤵
  PID:6464
- C:\Windows\System\QFjCnQF.exe
  C:\Windows\System\QFjCnQF.exe
  2⤵
  PID:7160
- C:\Windows\System\igzrlJN.exe
  C:\Windows\System\igzrlJN.exe
  2⤵
  PID:7052
- C:\Windows\System\uJcNnUl.exe
  C:\Windows\System\uJcNnUl.exe
  2⤵
  PID:6552
- C:\Windows\System\YIEsIpY.exe
  C:\Windows\System\YIEsIpY.exe
  2⤵
  PID:7180
- C:\Windows\System\tgmwlBi.exe
  C:\Windows\System\tgmwlBi.exe
  2⤵
  PID:7196
- C:\Windows\System\vqFWWHN.exe
  C:\Windows\System\vqFWWHN.exe
  2⤵
  PID:7212
- C:\Windows\System\gGrgKHh.exe
  C:\Windows\System\gGrgKHh.exe
  2⤵
  PID:7228
- C:\Windows\System\OnjDVLK.exe
  C:\Windows\System\OnjDVLK.exe
  2⤵
  PID:7244
- C:\Windows\System\mlFTUzU.exe
  C:\Windows\System\mlFTUzU.exe
  2⤵
  PID:7260
- C:\Windows\System\ZNSiXBo.exe
  C:\Windows\System\ZNSiXBo.exe
  2⤵
  PID:7280
- C:\Windows\System\jvRkRZT.exe
  C:\Windows\System\jvRkRZT.exe
  2⤵
  PID:7296
- C:\Windows\System\BFgEWOH.exe
  C:\Windows\System\BFgEWOH.exe
  2⤵
  PID:7312
- C:\Windows\System\Pjqxeeq.exe
  C:\Windows\System\Pjqxeeq.exe
  2⤵
  PID:7328
- C:\Windows\System\GWxYxbs.exe
  C:\Windows\System\GWxYxbs.exe
  2⤵
  PID:7356
- C:\Windows\System\ZWyiMDi.exe
  C:\Windows\System\ZWyiMDi.exe
  2⤵
  PID:7404
- C:\Windows\System\XKNcABZ.exe
  C:\Windows\System\XKNcABZ.exe
  2⤵
  PID:7420
- C:\Windows\System\zknxGOr.exe
  C:\Windows\System\zknxGOr.exe
  2⤵
  PID:7444
- C:\Windows\System\LcYXgdw.exe
  C:\Windows\System\LcYXgdw.exe
  2⤵
  PID:7460
- C:\Windows\System\GChWyVd.exe
  C:\Windows\System\GChWyVd.exe
  2⤵
  PID:7480
- C:\Windows\System\bjXsOHi.exe
  C:\Windows\System\bjXsOHi.exe
  2⤵
  PID:7500
- C:\Windows\System\FpEOwez.exe
  C:\Windows\System\FpEOwez.exe
  2⤵
  PID:7516
- C:\Windows\System\VBEwbqO.exe
  C:\Windows\System\VBEwbqO.exe
  2⤵
  PID:7532
- C:\Windows\System\vUurcRK.exe
  C:\Windows\System\vUurcRK.exe
  2⤵
  PID:7548
- C:\Windows\System\fBsQkMo.exe
  C:\Windows\System\fBsQkMo.exe
  2⤵
  PID:7564
- C:\Windows\System\HLDnVZc.exe
  C:\Windows\System\HLDnVZc.exe
  2⤵
  PID:7580
- C:\Windows\System\HQefKRx.exe
  C:\Windows\System\HQefKRx.exe
  2⤵
  PID:7600
- C:\Windows\System\hycXwBf.exe
  C:\Windows\System\hycXwBf.exe
  2⤵
  PID:7624
- C:\Windows\System\pLqzYdC.exe
  C:\Windows\System\pLqzYdC.exe
  2⤵
  PID:7640
- C:\Windows\System\ocQNxmS.exe
  C:\Windows\System\ocQNxmS.exe
  2⤵
  PID:7656
- C:\Windows\System\uVizAmX.exe
  C:\Windows\System\uVizAmX.exe
  2⤵
  PID:7676
- C:\Windows\System\zUTbzXY.exe
  C:\Windows\System\zUTbzXY.exe
  2⤵
  PID:7692
- C:\Windows\System\RVwCVYC.exe
  C:\Windows\System\RVwCVYC.exe
  2⤵
  PID:7708
- C:\Windows\System\tvkSEDK.exe
  C:\Windows\System\tvkSEDK.exe
  2⤵
  PID:7724
- C:\Windows\System\zeogkEb.exe
  C:\Windows\System\zeogkEb.exe
  2⤵
  PID:7740
- C:\Windows\System\nFEbznF.exe
  C:\Windows\System\nFEbznF.exe
  2⤵
  PID:7756
- C:\Windows\System\SoVrnxc.exe
  C:\Windows\System\SoVrnxc.exe
  2⤵
  PID:7776
- C:\Windows\System\FHaSfAG.exe
  C:\Windows\System\FHaSfAG.exe
  2⤵
  PID:7792
- C:\Windows\System\BDXJQZa.exe
  C:\Windows\System\BDXJQZa.exe
  2⤵
  PID:7808
- C:\Windows\System\tELTzCP.exe
  C:\Windows\System\tELTzCP.exe
  2⤵
  PID:7824
- C:\Windows\System\WtbTRLI.exe
  C:\Windows\System\WtbTRLI.exe
  2⤵
  PID:7840
- C:\Windows\System\xHGyeim.exe
  C:\Windows\System\xHGyeim.exe
  2⤵
  PID:7856
- C:\Windows\System\DJVGwlb.exe
  C:\Windows\System\DJVGwlb.exe
  2⤵
  PID:7876
- C:\Windows\System\CEPcCaV.exe
  C:\Windows\System\CEPcCaV.exe
  2⤵
  PID:7892
- C:\Windows\System\txlOTSD.exe
  C:\Windows\System\txlOTSD.exe
  2⤵
  PID:7916
- C:\Windows\System\EtmIkoB.exe
  C:\Windows\System\EtmIkoB.exe
  2⤵
  PID:7932
- C:\Windows\System\OmycHqY.exe
  C:\Windows\System\OmycHqY.exe
  2⤵
  PID:7948
- C:\Windows\System\JYNfoTR.exe
  C:\Windows\System\JYNfoTR.exe
  2⤵
  PID:7964
- C:\Windows\System\lVvwkEI.exe
  C:\Windows\System\lVvwkEI.exe
  2⤵
  PID:7980
- C:\Windows\System\aAqERfn.exe
  C:\Windows\System\aAqERfn.exe
  2⤵
  PID:7996
- C:\Windows\System\bUKIixx.exe
  C:\Windows\System\bUKIixx.exe
  2⤵
  PID:8016
- C:\Windows\System\diIuwlL.exe
  C:\Windows\System\diIuwlL.exe
  2⤵
  PID:8032
- C:\Windows\System\SmponCZ.exe
  C:\Windows\System\SmponCZ.exe
  2⤵
  PID:8048
- C:\Windows\System\gNWcXUT.exe
  C:\Windows\System\gNWcXUT.exe
  2⤵
  PID:8068
- C:\Windows\System\vXEmPBY.exe
  C:\Windows\System\vXEmPBY.exe
  2⤵
  PID:8084
- C:\Windows\System\uxQLUjp.exe
  C:\Windows\System\uxQLUjp.exe
  2⤵
  PID:8100
- C:\Windows\System\ZsYwWZA.exe
  C:\Windows\System\ZsYwWZA.exe
  2⤵
  PID:8116
- C:\Windows\System\UNOBOXf.exe
  C:\Windows\System\UNOBOXf.exe
  2⤵
  PID:8132
- C:\Windows\System\vDysYRk.exe
  C:\Windows\System\vDysYRk.exe
  2⤵
  PID:8148
- C:\Windows\System\uIZyChi.exe
  C:\Windows\System\uIZyChi.exe
  2⤵
  PID:8164
- C:\Windows\System\uTqaJQg.exe
  C:\Windows\System\uTqaJQg.exe
  2⤵
  PID:8184
- C:\Windows\System\TgnhOVT.exe
  C:\Windows\System\TgnhOVT.exe
  2⤵
  PID:7188
- C:\Windows\System\IVjWRgF.exe
  C:\Windows\System\IVjWRgF.exe
  2⤵
  PID:7252
- C:\Windows\System\iVyMcMF.exe
  C:\Windows\System\iVyMcMF.exe
  2⤵
  PID:7176
- C:\Windows\System\BAbxINw.exe
  C:\Windows\System\BAbxINw.exe
  2⤵
  PID:7236
- C:\Windows\System\kKKeWOT.exe
  C:\Windows\System\kKKeWOT.exe
  2⤵
  PID:7268
- C:\Windows\System\UanWEoK.exe
  C:\Windows\System\UanWEoK.exe
  2⤵
  PID:7340
- C:\Windows\System\zmhYzZc.exe
  C:\Windows\System\zmhYzZc.exe
  2⤵
  PID:7292
- C:\Windows\System\nLFSKge.exe
  C:\Windows\System\nLFSKge.exe
  2⤵
  PID:7368
- C:\Windows\System\RJqZjXP.exe
  C:\Windows\System\RJqZjXP.exe
  2⤵
  PID:7392
- C:\Windows\System\sQmylyc.exe
  C:\Windows\System\sQmylyc.exe
  2⤵
  PID:7428
- C:\Windows\System\WzWNuSS.exe
  C:\Windows\System\WzWNuSS.exe
  2⤵
  PID:7432
- C:\Windows\System\WfPULGr.exe
  C:\Windows\System\WfPULGr.exe
  2⤵
  PID:7512
- C:\Windows\System\WrFezNK.exe
  C:\Windows\System\WrFezNK.exe
  2⤵
  PID:7488
- C:\Windows\System\oDgwPfd.exe
  C:\Windows\System\oDgwPfd.exe
  2⤵
  PID:7528
- C:\Windows\System\jpyJglI.exe
  C:\Windows\System\jpyJglI.exe
  2⤵
  PID:7608
- C:\Windows\System\aCpWixL.exe
  C:\Windows\System\aCpWixL.exe
  2⤵
  PID:7668
- C:\Windows\System\qzDCUlp.exe
  C:\Windows\System\qzDCUlp.exe
  2⤵
  PID:7592
- C:\Windows\System\FxPWOmX.exe
  C:\Windows\System\FxPWOmX.exe
  2⤵
  PID:7688
- C:\Windows\System\wmbKlFz.exe
  C:\Windows\System\wmbKlFz.exe
  2⤵
  PID:7652
- C:\Windows\System\ZpKDMuy.exe
  C:\Windows\System\ZpKDMuy.exe
  2⤵
  PID:7848
- C:\Windows\System\IrbFMOn.exe
  C:\Windows\System\IrbFMOn.exe
  2⤵
  PID:7884
- C:\Windows\System\TlZwWNz.exe
  C:\Windows\System\TlZwWNz.exe
  2⤵
  PID:7804
- C:\Windows\System\AIrXQQt.exe
  C:\Windows\System\AIrXQQt.exe
  2⤵
  PID:7900
- C:\Windows\System\PnspqSl.exe
  C:\Windows\System\PnspqSl.exe
  2⤵
  PID:7832
- C:\Windows\System\yCNhceN.exe
  C:\Windows\System\yCNhceN.exe
  2⤵
  PID:8008
- C:\Windows\System\uanRLwV.exe
  C:\Windows\System\uanRLwV.exe
  2⤵
  PID:7992
- C:\Windows\System\lJokUrW.exe
  C:\Windows\System\lJokUrW.exe
  2⤵
  PID:8056
- C:\Windows\System\RqmjRuL.exe
  C:\Windows\System\RqmjRuL.exe
  2⤵
  PID:8096
- C:\Windows\System\hsBszBx.exe
  C:\Windows\System\hsBszBx.exe
  2⤵
  PID:8156
- C:\Windows\System\fXtpzbb.exe
  C:\Windows\System\fXtpzbb.exe
  2⤵
  PID:6496
- C:\Windows\System\nrAVNqs.exe
  C:\Windows\System\nrAVNqs.exe
  2⤵
  PID:7308
- C:\Windows\System\xigquRQ.exe
  C:\Windows\System\xigquRQ.exe
  2⤵
  PID:7400
- C:\Windows\System\ydKFvEX.exe
  C:\Windows\System\ydKFvEX.exe
  2⤵
  PID:7272
- C:\Windows\System\RKLwWOy.exe
  C:\Windows\System\RKLwWOy.exe
  2⤵
  PID:7380
- C:\Windows\System\kfjprmT.exe
  C:\Windows\System\kfjprmT.exe
  2⤵
  PID:7752
- C:\Windows\System\GyNqpMv.exe
  C:\Windows\System\GyNqpMv.exe
  2⤵
  PID:5708
- C:\Windows\System\HDPFmhp.exe
  C:\Windows\System\HDPFmhp.exe
  2⤵
  PID:7820
- C:\Windows\System\XOBDeGF.exe
  C:\Windows\System\XOBDeGF.exe
  2⤵
  PID:7636
- C:\Windows\System\hsVsROV.exe
  C:\Windows\System\hsVsROV.exe
  2⤵
  PID:7496
- C:\Windows\System\NjxiuKN.exe
  C:\Windows\System\NjxiuKN.exe
  2⤵
  PID:7704
- C:\Windows\System\NaOZncX.exe
  C:\Windows\System\NaOZncX.exe
  2⤵
  PID:7616
- C:\Windows\System\IZhBvSb.exe
  C:\Windows\System\IZhBvSb.exe
  2⤵
  PID:7620
- C:\Windows\System\xDeUSll.exe
  C:\Windows\System\xDeUSll.exe
  2⤵
  PID:7768
- C:\Windows\System\oZQrXjX.exe
  C:\Windows\System\oZQrXjX.exe
  2⤵
  PID:8364
- C:\Windows\System\AxszGOf.exe
  C:\Windows\System\AxszGOf.exe
  2⤵
  PID:8380
- C:\Windows\System\eTtCwVU.exe
  C:\Windows\System\eTtCwVU.exe
  2⤵
  PID:8404
- C:\Windows\System\SNhoBDA.exe
  C:\Windows\System\SNhoBDA.exe
  2⤵
  PID:8420
- C:\Windows\System\pYSjWxk.exe
  C:\Windows\System\pYSjWxk.exe
  2⤵
  PID:8492
- C:\Windows\System\CxdhKxS.exe
  C:\Windows\System\CxdhKxS.exe
  2⤵
  PID:8512
- C:\Windows\System\OKYozIH.exe
  C:\Windows\System\OKYozIH.exe
  2⤵
  PID:8536
- C:\Windows\System\jtEMqux.exe
  C:\Windows\System\jtEMqux.exe
  2⤵
  PID:8552
- C:\Windows\System\PyAxWjW.exe
  C:\Windows\System\PyAxWjW.exe
  2⤵
  PID:8572
- C:\Windows\System\duCzGix.exe
  C:\Windows\System\duCzGix.exe
  2⤵
  PID:8592
- C:\Windows\System\NPIDTUp.exe
  C:\Windows\System\NPIDTUp.exe
  2⤵
  PID:8608
- C:\Windows\System\UUlScXE.exe
  C:\Windows\System\UUlScXE.exe
  2⤵
  PID:8696
- C:\Windows\System\CzAfzyn.exe
  C:\Windows\System\CzAfzyn.exe
  2⤵
  PID:8712
- C:\Windows\System\CkGtozR.exe
  C:\Windows\System\CkGtozR.exe
  2⤵
  PID:8728
- C:\Windows\System\LblrPXO.exe
  C:\Windows\System\LblrPXO.exe
  2⤵
  PID:8744
- C:\Windows\System\yhrGoIX.exe
  C:\Windows\System\yhrGoIX.exe
  2⤵
  PID:8760
- C:\Windows\System\GSvrjAi.exe
  C:\Windows\System\GSvrjAi.exe
  2⤵
  PID:8776
- C:\Windows\System\mDazJdH.exe
  C:\Windows\System\mDazJdH.exe
  2⤵
  PID:8792
- C:\Windows\System\OaOrWol.exe
  C:\Windows\System\OaOrWol.exe
  2⤵
  PID:8808
- C:\Windows\System\GUzvXfR.exe
  C:\Windows\System\GUzvXfR.exe
  2⤵
  PID:8836
- C:\Windows\System\rcATXoT.exe
  C:\Windows\System\rcATXoT.exe
  2⤵
  PID:8856
- C:\Windows\System\YYjlsUq.exe
  C:\Windows\System\YYjlsUq.exe
  2⤵
  PID:8872
- C:\Windows\System\gjcWpbs.exe
  C:\Windows\System\gjcWpbs.exe
  2⤵
  PID:8892
- C:\Windows\System\spYLptc.exe
  C:\Windows\System\spYLptc.exe
  2⤵
  PID:8908
- C:\Windows\System\ziOTuxJ.exe
  C:\Windows\System\ziOTuxJ.exe
  2⤵
  PID:8928
- C:\Windows\System\XwFUXAM.exe
  C:\Windows\System\XwFUXAM.exe
  2⤵
  PID:8944
- C:\Windows\System\WWYYYCO.exe
  C:\Windows\System\WWYYYCO.exe
  2⤵
  PID:8960
- C:\Windows\System\RTGfyzP.exe
  C:\Windows\System\RTGfyzP.exe
  2⤵
  PID:9000
- C:\Windows\System\qwPdGGH.exe
  C:\Windows\System\qwPdGGH.exe
  2⤵
  PID:9020
- C:\Windows\System\VuSvICM.exe
  C:\Windows\System\VuSvICM.exe
  2⤵
  PID:9036
- C:\Windows\System\yOUmTro.exe
  C:\Windows\System\yOUmTro.exe
  2⤵
  PID:9052
- C:\Windows\System\stuBcwt.exe
  C:\Windows\System\stuBcwt.exe
  2⤵
  PID:9068
- C:\Windows\System\QDGYgeh.exe
  C:\Windows\System\QDGYgeh.exe
  2⤵
  PID:9096
- C:\Windows\System\AOJEnDi.exe
  C:\Windows\System\AOJEnDi.exe
  2⤵
  PID:9136
- C:\Windows\System\WJjAYYh.exe
  C:\Windows\System\WJjAYYh.exe
  2⤵
  PID:9152
- C:\Windows\System\mNOqYHV.exe
  C:\Windows\System\mNOqYHV.exe
  2⤵
  PID:9172
- C:\Windows\System\rMbeYwW.exe
  C:\Windows\System\rMbeYwW.exe
  2⤵
  PID:9188
- C:\Windows\System\cyDDHGQ.exe
  C:\Windows\System\cyDDHGQ.exe
  2⤵
  PID:9204
- C:\Windows\System\qGEnEnw.exe
  C:\Windows\System\qGEnEnw.exe
  2⤵
  PID:1464
- C:\Windows\System\agNVziX.exe
  C:\Windows\System\agNVziX.exe
  2⤵
  PID:7416
- C:\Windows\System\knXLjTU.exe
  C:\Windows\System\knXLjTU.exe
  2⤵
  PID:7452
- C:\Windows\System\RPTjzQd.exe
  C:\Windows\System\RPTjzQd.exe
  2⤵
  PID:5404
- C:\Windows\System\XavmVMM.exe
  C:\Windows\System\XavmVMM.exe
  2⤵
  PID:8044
- C:\Windows\System\cwnhBgK.exe
  C:\Windows\System\cwnhBgK.exe
  2⤵
  PID:7412
- C:\Windows\System\eBewvLK.exe
  C:\Windows\System\eBewvLK.exe
  2⤵
  PID:6304
- C:\Windows\System\oLFIgjz.exe
  C:\Windows\System\oLFIgjz.exe
  2⤵
  PID:7352
- C:\Windows\System\hqGuzah.exe
  C:\Windows\System\hqGuzah.exe
  2⤵
  PID:7376
- C:\Windows\System\WUbGvwx.exe
  C:\Windows\System\WUbGvwx.exe
  2⤵
  PID:8092
- C:\Windows\System\lrDvNuD.exe
  C:\Windows\System\lrDvNuD.exe
  2⤵
  PID:7972
- C:\Windows\System\jiLzjMo.exe
  C:\Windows\System\jiLzjMo.exe
  2⤵
  PID:8344
- C:\Windows\System\hKPNVUn.exe
  C:\Windows\System\hKPNVUn.exe
  2⤵
  PID:8440
- C:\Windows\System\pawKZxi.exe
  C:\Windows\System\pawKZxi.exe
  2⤵
  PID:8204
- C:\Windows\System\HuOuDop.exe
  C:\Windows\System\HuOuDop.exe
  2⤵
  PID:8256
- C:\Windows\System\GRHJccN.exe
  C:\Windows\System\GRHJccN.exe
  2⤵
  PID:8276
- C:\Windows\System\dFKmLPx.exe
  C:\Windows\System\dFKmLPx.exe
  2⤵
  PID:8288
- C:\Windows\System\REKxRFB.exe
  C:\Windows\System\REKxRFB.exe
  2⤵
  PID:8304
- C:\Windows\System\lFHZkqQ.exe
  C:\Windows\System\lFHZkqQ.exe
  2⤵
  PID:8320
- C:\Windows\System\cfvSRew.exe
  C:\Windows\System\cfvSRew.exe
  2⤵
  PID:8336
- C:\Windows\System\fciYyku.exe
  C:\Windows\System\fciYyku.exe
  2⤵
  PID:8392
- C:\Windows\System\EysqWjo.exe
  C:\Windows\System\EysqWjo.exe
  2⤵
  PID:8240
- C:\Windows\System\XkkvmRp.exe
  C:\Windows\System\XkkvmRp.exe
  2⤵
  PID:8460
- C:\Windows\System\LZJtDJN.exe
  C:\Windows\System\LZJtDJN.exe
  2⤵
  PID:8624
- C:\Windows\System\eapVljl.exe
  C:\Windows\System\eapVljl.exe
  2⤵
  PID:8816
- C:\Windows\System\MjKXDSC.exe
  C:\Windows\System\MjKXDSC.exe
  2⤵
  PID:8868
- C:\Windows\System\VlgTsMo.exe
  C:\Windows\System\VlgTsMo.exe
  2⤵
  PID:8972
- C:\Windows\System\zRTGDJf.exe
  C:\Windows\System\zRTGDJf.exe
  2⤵
  PID:8976
- C:\Windows\System\zKqXWHv.exe
  C:\Windows\System\zKqXWHv.exe
  2⤵
  PID:8988
- C:\Windows\System\bduFEpw.exe
  C:\Windows\System\bduFEpw.exe
  2⤵
  PID:8888
- C:\Windows\System\HIkyDfo.exe
  C:\Windows\System\HIkyDfo.exe
  2⤵
  PID:9104
- C:\Windows\System\jElWJOU.exe
  C:\Windows\System\jElWJOU.exe
  2⤵
  PID:9116
- C:\Windows\System\TewEKoE.exe
  C:\Windows\System\TewEKoE.exe
  2⤵
  PID:9108
- C:\Windows\System\ZvUMZMk.exe
  C:\Windows\System\ZvUMZMk.exe
  2⤵
  PID:9044
- C:\Windows\System\YVzPnzs.exe
  C:\Windows\System\YVzPnzs.exe
  2⤵
  PID:9168
- C:\Windows\System\wEeQgYJ.exe
  C:\Windows\System\wEeQgYJ.exe
  2⤵
  PID:9180
- C:\Windows\System\qfmZtvY.exe
  C:\Windows\System\qfmZtvY.exe
  2⤵
  PID:8200
- C:\Windows\System\MqFRvSV.exe
  C:\Windows\System\MqFRvSV.exe
  2⤵
  PID:8356
- C:\Windows\System\pNUPFhY.exe
  C:\Windows\System\pNUPFhY.exe
  2⤵
  PID:8412
- C:\Windows\System\NGmGSbU.exe
  C:\Windows\System\NGmGSbU.exe
  2⤵
  PID:8828
- C:\Windows\System\FHRNyZk.exe
  C:\Windows\System\FHRNyZk.exe
  2⤵
  PID:8124
- C:\Windows\System\aiiQhxT.exe
  C:\Windows\System\aiiQhxT.exe
  2⤵
  PID:8296
- C:\Windows\System\Aqlarok.exe
  C:\Windows\System\Aqlarok.exe
  2⤵
  PID:9124
- C:\Windows\System\XeYjKWN.exe
  C:\Windows\System\XeYjKWN.exe
  2⤵
  PID:8236
- C:\Windows\System\JDoYRKV.exe
  C:\Windows\System\JDoYRKV.exe
  2⤵
  PID:8228
- C:\Windows\System\snTdzzJ.exe
  C:\Windows\System\snTdzzJ.exe
  2⤵
  PID:8348
- C:\Windows\System\nXTLGfh.exe
  C:\Windows\System\nXTLGfh.exe
  2⤵
  PID:8224
- C:\Windows\System\zgydFFm.exe
  C:\Windows\System\zgydFFm.exe
  2⤵
  PID:8500
- C:\Windows\System\RQWCEiY.exe
  C:\Windows\System\RQWCEiY.exe
  2⤵
  PID:8848
- C:\Windows\System\AKecrBZ.exe
  C:\Windows\System\AKecrBZ.exe
  2⤵
  PID:8772
- C:\Windows\System\vMshPZa.exe
  C:\Windows\System\vMshPZa.exe
  2⤵
  PID:8704
- C:\Windows\System\qXBvNBg.exe
  C:\Windows\System\qXBvNBg.exe
  2⤵
  PID:8680
- C:\Windows\System\rWaorMw.exe
  C:\Windows\System\rWaorMw.exe
  2⤵
  PID:8688
- C:\Windows\System\hjQfpCs.exe
  C:\Windows\System\hjQfpCs.exe
  2⤵
  PID:8784
- C:\Windows\System\cJdXPHa.exe
  C:\Windows\System\cJdXPHa.exe
  2⤵
  PID:8900
- C:\Windows\System\gaksGKK.exe
  C:\Windows\System\gaksGKK.exe
  2⤵
  PID:8864
- C:\Windows\System\eWyeNpw.exe
  C:\Windows\System\eWyeNpw.exe
  2⤵
  PID:9060
- C:\Windows\System\GwfTQdU.exe
  C:\Windows\System\GwfTQdU.exe
  2⤵
  PID:9008
- C:\Windows\System\bCDMdHA.exe
  C:\Windows\System\bCDMdHA.exe
  2⤵
  PID:7456
- C:\Windows\System\rmnkCIN.exe
  C:\Windows\System\rmnkCIN.exe
  2⤵
  PID:7940
- C:\Windows\System\rhKPjoj.exe
  C:\Windows\System\rhKPjoj.exe
  2⤵
  PID:7868
- C:\Windows\System\BVYuXdb.exe
  C:\Windows\System\BVYuXdb.exe
  2⤵
  PID:8212
- C:\Windows\System\EeNZEiD.exe
  C:\Windows\System\EeNZEiD.exe
  2⤵
  PID:8272
- C:\Windows\System\rJJkcgs.exe
  C:\Windows\System\rJJkcgs.exe
  2⤵
  PID:7588
- C:\Windows\System\BfMFMBw.exe
  C:\Windows\System\BfMFMBw.exe
  2⤵
  PID:8248
- C:\Windows\System\TerBHlh.exe
  C:\Windows\System\TerBHlh.exe
  2⤵
  PID:8476
- C:\Windows\System\xsqLmCC.exe
  C:\Windows\System\xsqLmCC.exe
  2⤵
  PID:7560
- C:\Windows\System\mxwfktf.exe
  C:\Windows\System\mxwfktf.exe
  2⤵
  PID:8636
- C:\Windows\System\qVGfuKA.exe
  C:\Windows\System\qVGfuKA.exe
  2⤵
  PID:8824
- C:\Windows\System\VPzClJL.exe
  C:\Windows\System\VPzClJL.exe
  2⤵
  PID:8568
- C:\Windows\System\mvAGRES.exe
  C:\Windows\System\mvAGRES.exe
  2⤵
  PID:8560
- C:\Windows\System\YiIwnlf.exe
  C:\Windows\System\YiIwnlf.exe
  2⤵
  PID:8880
- C:\Windows\System\xlbLapa.exe
  C:\Windows\System\xlbLapa.exe
  2⤵
  PID:8940
- C:\Windows\System\YzXjvsb.exe
  C:\Windows\System\YzXjvsb.exe
  2⤵
  PID:7440
- C:\Windows\System\nHCCByM.exe
  C:\Windows\System\nHCCByM.exe
  2⤵
  PID:8660
- C:\Windows\System\IJjZNPi.exe
  C:\Windows\System\IJjZNPi.exe
  2⤵
  PID:8676
- C:\Windows\System\kbrTlDG.exe
  C:\Windows\System\kbrTlDG.exe
  2⤵
  PID:9200
- C:\Windows\System\qBuoVxQ.exe
  C:\Windows\System\qBuoVxQ.exe
  2⤵
  PID:8436
- C:\Windows\System\enyhhbs.exe
  C:\Windows\System\enyhhbs.exe
  2⤵
  PID:8504
- C:\Windows\System\rZPJxlL.exe
  C:\Windows\System\rZPJxlL.exe
  2⤵
  PID:7556
- C:\Windows\System\PsggDxt.exe
  C:\Windows\System\PsggDxt.exe
  2⤵
  PID:9160
- C:\Windows\System\qqvLMCa.exe
  C:\Windows\System\qqvLMCa.exe
  2⤵
  PID:9048
- C:\Windows\System\BkJdHxp.exe
  C:\Windows\System\BkJdHxp.exe
  2⤵
  PID:8028
- C:\Windows\System\kVDwGTg.exe
  C:\Windows\System\kVDwGTg.exe
  2⤵
  PID:9128
- C:\Windows\System\mzInDph.exe
  C:\Windows\System\mzInDph.exe
  2⤵
  PID:7256
- C:\Windows\System\doajSkB.exe
  C:\Windows\System\doajSkB.exe
  2⤵
  PID:7388
- C:\Windows\System\BeROEUQ.exe
  C:\Windows\System\BeROEUQ.exe
  2⤵
  PID:8416
- C:\Windows\System\WyWsScr.exe
  C:\Windows\System\WyWsScr.exe
  2⤵
  PID:8480
- C:\Windows\System\ZyMxDCI.exe
  C:\Windows\System\ZyMxDCI.exe
  2⤵
  PID:8620
- C:\Windows\System\cNDEdDe.exe
  C:\Windows\System\cNDEdDe.exe
  2⤵
  PID:8328
- C:\Windows\System\nrPkFdh.exe
  C:\Windows\System\nrPkFdh.exe
  2⤵
  PID:8588
- C:\Windows\System\hVvKOrG.exe
  C:\Windows\System\hVvKOrG.exe
  2⤵
  PID:8656
- C:\Windows\System\JWEnapF.exe
  C:\Windows\System\JWEnapF.exe
  2⤵
  PID:8708
- C:\Windows\System\hdaenwk.exe
  C:\Windows\System\hdaenwk.exe
  2⤵
  PID:7276
- C:\Windows\System\OeavqYH.exe
  C:\Windows\System\OeavqYH.exe
  2⤵
  PID:7700
- C:\Windows\System\UuFkKwO.exe
  C:\Windows\System\UuFkKwO.exe
  2⤵
  PID:8324
- C:\Windows\System\DYzcYQV.exe
  C:\Windows\System\DYzcYQV.exe
  2⤵
  PID:8668
- C:\Windows\System\uKddZtx.exe
  C:\Windows\System\uKddZtx.exe
  2⤵
  PID:8936
- C:\Windows\System\RwhtgoO.exe
  C:\Windows\System\RwhtgoO.exe
  2⤵
  PID:8488
- C:\Windows\System\TJkEfNv.exe
  C:\Windows\System\TJkEfNv.exe
  2⤵
  PID:9112
- C:\Windows\System\rIxIMxx.exe
  C:\Windows\System\rIxIMxx.exe
  2⤵
  PID:7772
- C:\Windows\System\ubQJZSO.exe
  C:\Windows\System\ubQJZSO.exe
  2⤵
  PID:9132
- C:\Windows\System\UMBpYkX.exe
  C:\Windows\System\UMBpYkX.exe
  2⤵
  PID:8268
- C:\Windows\System\STggXPL.exe
  C:\Windows\System\STggXPL.exe
  2⤵
  PID:7596
- C:\Windows\System\MFoSdxL.exe
  C:\Windows\System\MFoSdxL.exe
  2⤵
  PID:9212
- C:\Windows\System\pXmPsgm.exe
  C:\Windows\System\pXmPsgm.exe
  2⤵
  PID:8316
- C:\Windows\System\BNBKLdT.exe
  C:\Windows\System\BNBKLdT.exe
  2⤵
  PID:8544
- C:\Windows\System\wyxdYeS.exe
  C:\Windows\System\wyxdYeS.exe
  2⤵
  PID:9228
- C:\Windows\System\PEZbiXH.exe
  C:\Windows\System\PEZbiXH.exe
  2⤵
  PID:9244
- C:\Windows\System\nBKXDvi.exe
  C:\Windows\System\nBKXDvi.exe
  2⤵
  PID:9260
- C:\Windows\System\gKOVThp.exe
  C:\Windows\System\gKOVThp.exe
  2⤵
  PID:9288
- C:\Windows\System\ffbaFWP.exe
  C:\Windows\System\ffbaFWP.exe
  2⤵
  PID:9304
- C:\Windows\System\zhwCWrc.exe
  C:\Windows\System\zhwCWrc.exe
  2⤵
  PID:9320
- C:\Windows\System\xkFLjAx.exe
  C:\Windows\System\xkFLjAx.exe
  2⤵
  PID:9336
- C:\Windows\System\QANngnU.exe
  C:\Windows\System\QANngnU.exe
  2⤵
  PID:9352
- C:\Windows\System\wwVplcW.exe
  C:\Windows\System\wwVplcW.exe
  2⤵
  PID:9368
- C:\Windows\System\obELzgh.exe
  C:\Windows\System\obELzgh.exe
  2⤵
  PID:9388
- C:\Windows\System\XphPDis.exe
  C:\Windows\System\XphPDis.exe
  2⤵
  PID:9412
- C:\Windows\System\iIMfmrI.exe
  C:\Windows\System\iIMfmrI.exe
  2⤵
  PID:9460
- C:\Windows\System\EVYVzvo.exe
  C:\Windows\System\EVYVzvo.exe
  2⤵
  PID:9476
- C:\Windows\System\QBSurlh.exe
  C:\Windows\System\QBSurlh.exe
  2⤵
  PID:9492
- C:\Windows\System\nUArRJs.exe
  C:\Windows\System\nUArRJs.exe
  2⤵
  PID:9544
- C:\Windows\System\kQTlSuD.exe
  C:\Windows\System\kQTlSuD.exe
  2⤵
  PID:9560
- C:\Windows\System\pPAWSEP.exe
  C:\Windows\System\pPAWSEP.exe
  2⤵
  PID:9576
- C:\Windows\System\IyeYzLw.exe
  C:\Windows\System\IyeYzLw.exe
  2⤵
  PID:9592
- C:\Windows\System\HAxrtFi.exe
  C:\Windows\System\HAxrtFi.exe
  2⤵
  PID:9608
- C:\Windows\System\YOrtBbr.exe
  C:\Windows\System\YOrtBbr.exe
  2⤵
  PID:9628
- C:\Windows\System\MOlJWjh.exe
  C:\Windows\System\MOlJWjh.exe
  2⤵
  PID:9656
- C:\Windows\System\BsmLtwW.exe
  C:\Windows\System\BsmLtwW.exe
  2⤵
  PID:9680
- C:\Windows\System\ByKIowO.exe
  C:\Windows\System\ByKIowO.exe
  2⤵
  PID:9704
- C:\Windows\System\IVDiRmt.exe
  C:\Windows\System\IVDiRmt.exe
  2⤵
  PID:9720
- C:\Windows\System\qziamGz.exe
  C:\Windows\System\qziamGz.exe
  2⤵
  PID:9736
- C:\Windows\System\hxhpkbH.exe
  C:\Windows\System\hxhpkbH.exe
  2⤵
  PID:9752
- C:\Windows\System\cuhAmIx.exe
  C:\Windows\System\cuhAmIx.exe
  2⤵
  PID:9772
- C:\Windows\System\xbDRJAp.exe
  C:\Windows\System\xbDRJAp.exe
  2⤵
  PID:9788
- C:\Windows\System\idtLmdK.exe
  C:\Windows\System\idtLmdK.exe
  2⤵
  PID:9804
- C:\Windows\System\PXvgYmH.exe
  C:\Windows\System\PXvgYmH.exe
  2⤵
  PID:9820
- C:\Windows\System\ZvndEXI.exe
  C:\Windows\System\ZvndEXI.exe
  2⤵
  PID:9836
- C:\Windows\System\WSDilEe.exe
  C:\Windows\System\WSDilEe.exe
  2⤵
  PID:9852
- C:\Windows\System\xCvMUEv.exe
  C:\Windows\System\xCvMUEv.exe
  2⤵
  PID:9868
- C:\Windows\System\OubLneo.exe
  C:\Windows\System\OubLneo.exe
  2⤵
  PID:9892
- C:\Windows\System\HuSOAxW.exe
  C:\Windows\System\HuSOAxW.exe
  2⤵
  PID:9908
- C:\Windows\System\cBhWoct.exe
  C:\Windows\System\cBhWoct.exe
  2⤵
  PID:9924
- C:\Windows\System\OvluJEu.exe
  C:\Windows\System\OvluJEu.exe
  2⤵
  PID:9940
- C:\Windows\System\iCtKQFN.exe
  C:\Windows\System\iCtKQFN.exe
  2⤵
  PID:9956
- C:\Windows\System\KMEbpnW.exe
  C:\Windows\System\KMEbpnW.exe
  2⤵
  PID:9972
- C:\Windows\System\DnhtuVL.exe
  C:\Windows\System\DnhtuVL.exe
  2⤵
  PID:9988
- C:\Windows\System\AQstFaM.exe
  C:\Windows\System\AQstFaM.exe
  2⤵
  PID:10004
- C:\Windows\System\NXaQCZk.exe
  C:\Windows\System\NXaQCZk.exe
  2⤵
  PID:10020
- C:\Windows\System\DUDdXfS.exe
  C:\Windows\System\DUDdXfS.exe
  2⤵
  PID:10036
- C:\Windows\System\bVyfAVJ.exe
  C:\Windows\System\bVyfAVJ.exe
  2⤵
  PID:10052
- C:\Windows\System\LaeUYjG.exe
  C:\Windows\System\LaeUYjG.exe
  2⤵
  PID:10072
- C:\Windows\System\NBRZxOX.exe
  C:\Windows\System\NBRZxOX.exe
  2⤵
  PID:10088
- C:\Windows\System\XglXJPU.exe
  C:\Windows\System\XglXJPU.exe
  2⤵
  PID:10104
- C:\Windows\System\yVwwNoK.exe
  C:\Windows\System\yVwwNoK.exe
  2⤵
  PID:10120
- C:\Windows\System\LDrtrhT.exe
  C:\Windows\System\LDrtrhT.exe
  2⤵
  PID:10136
- C:\Windows\System\eUmFXeV.exe
  C:\Windows\System\eUmFXeV.exe
  2⤵
  PID:10152
- C:\Windows\System\qDMnGsh.exe
  C:\Windows\System\qDMnGsh.exe
  2⤵
  PID:10168
- C:\Windows\System\gAdPKJQ.exe
  C:\Windows\System\gAdPKJQ.exe
  2⤵
  PID:10184
- C:\Windows\System\cnPNoMh.exe
  C:\Windows\System\cnPNoMh.exe
  2⤵
  PID:10200
- C:\Windows\System\oqlsrWK.exe
  C:\Windows\System\oqlsrWK.exe
  2⤵
  PID:10216
- C:\Windows\System\TmSxImC.exe
  C:\Windows\System\TmSxImC.exe
  2⤵
  PID:10232
- C:\Windows\System\pWWjhje.exe
  C:\Windows\System\pWWjhje.exe
  2⤵
  PID:9224
- C:\Windows\System\lCeNEZB.exe
  C:\Windows\System\lCeNEZB.exe
  2⤵
  PID:9028
- C:\Windows\System\sSFiRiN.exe
  C:\Windows\System\sSFiRiN.exe
  2⤵
  PID:9236
- C:\Windows\System\CPhVzTw.exe
  C:\Windows\System\CPhVzTw.exe
  2⤵
  PID:9012
- C:\Windows\System\LcKmdhx.exe
  C:\Windows\System\LcKmdhx.exe
  2⤵
  PID:9272
- C:\Windows\System\gYYqPln.exe
  C:\Windows\System\gYYqPln.exe
  2⤵
  PID:9332
- C:\Windows\System\dnFDEaq.exe
  C:\Windows\System\dnFDEaq.exe
  2⤵
  PID:9360
- C:\Windows\System\oGDJUfk.exe
  C:\Windows\System\oGDJUfk.exe
  2⤵
  PID:7908
- C:\Windows\System\rUYCiPb.exe
  C:\Windows\System\rUYCiPb.exe
  2⤵
  PID:8956
- C:\Windows\System\JfkmMxa.exe
  C:\Windows\System\JfkmMxa.exe
  2⤵
  PID:9404
- C:\Windows\System\prElxMA.exe
  C:\Windows\System\prElxMA.exe
  2⤵
  PID:9472
- C:\Windows\System\EqQBOET.exe
  C:\Windows\System\EqQBOET.exe
  2⤵
  PID:9508
- C:\Windows\System\DTfRJOg.exe
  C:\Windows\System\DTfRJOg.exe
  2⤵
  PID:9436
- C:\Windows\System\FtWSFJc.exe
  C:\Windows\System\FtWSFJc.exe
  2⤵
  PID:9452
- C:\Windows\System\gwwCgtF.exe
  C:\Windows\System\gwwCgtF.exe
  2⤵
  PID:8264
- C:\Windows\System\tHAEZOI.exe
  C:\Windows\System\tHAEZOI.exe
  2⤵
  PID:9524
- C:\Windows\System\rkhEpND.exe
  C:\Windows\System\rkhEpND.exe
  2⤵
  PID:9540
- C:\Windows\System\WNWVGDz.exe
  C:\Windows\System\WNWVGDz.exe
  2⤵
  PID:9600
- C:\Windows\System\leeTcUt.exe
  C:\Windows\System\leeTcUt.exe
  2⤵
  PID:9588
- C:\Windows\System\KnhOFjG.exe
  C:\Windows\System\KnhOFjG.exe
  2⤵
  PID:9648
- C:\Windows\System\cHQhenV.exe
  C:\Windows\System\cHQhenV.exe
  2⤵
  PID:9696
- C:\Windows\System\OHYLrBT.exe
  C:\Windows\System\OHYLrBT.exe
  2⤵
  PID:9712
- C:\Windows\System\HIVXolD.exe
  C:\Windows\System\HIVXolD.exe
  2⤵
  PID:9768
- C:\Windows\System\wFOGbQM.exe
  C:\Windows\System\wFOGbQM.exe
  2⤵
  PID:9828
- C:\Windows\System\iyCqSJz.exe
  C:\Windows\System\iyCqSJz.exe
  2⤵
  PID:9676
- C:\Windows\System\vxDCrLE.exe
  C:\Windows\System\vxDCrLE.exe
  2⤵
  PID:9784
- C:\Windows\System\RMLiplg.exe
  C:\Windows\System\RMLiplg.exe
  2⤵
  PID:9844
- C:\Windows\System\CisgQyN.exe
  C:\Windows\System\CisgQyN.exe
  2⤵
  PID:9880
- C:\Windows\System\kLDcIqq.exe
  C:\Windows\System\kLDcIqq.exe
  2⤵
  PID:10044
- C:\Windows\System\yvpHLvj.exe
  C:\Windows\System\yvpHLvj.exe
  2⤵
  PID:9996
- C:\Windows\System\PLDZtko.exe
  C:\Windows\System\PLDZtko.exe
  2⤵
  PID:10028
- C:\Windows\System\ayidoqd.exe
  C:\Windows\System\ayidoqd.exe
  2⤵
  PID:10132
- C:\Windows\System\EsziQHF.exe
  C:\Windows\System\EsziQHF.exe
  2⤵
  PID:10164
- C:\Windows\System\iDceWNB.exe
  C:\Windows\System\iDceWNB.exe
  2⤵
  PID:10196
- C:\Windows\System\slViIIQ.exe
  C:\Windows\System\slViIIQ.exe
  2⤵
  PID:9256
- C:\Windows\System\lHtyOLI.exe
  C:\Windows\System\lHtyOLI.exe
  2⤵
  PID:9220
- C:\Windows\System\PknjbzK.exe
  C:\Windows\System\PknjbzK.exe
  2⤵
  PID:9300
- C:\Windows\System\FfpvARC.exe
  C:\Windows\System\FfpvARC.exe
  2⤵
  PID:9488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CWtKKYK.exe

Filesize
2.3MB

MD5
50ab88c9387ae264b558d7b19326e255

SHA1
ba0a5c4092b5a628004dd77dbdddd103508232ef

SHA256
02cf22099d05bfc6a917c84c0a12879cc1cfd0d92eb842b485772fb86ab7a9c6

SHA512
b887d762749faf2a788fea751586f18440f3a6d4324d7e01b7d95eeea7634a7bb7e7562aab049a5ed37c276e63492a07e0a4503e7c3f83cfcfc25a598649ecdb

Download Submit
C:\Windows\system\GsEAnZM.exe

Filesize
2.3MB

MD5
f73487c0fa0f9d92eb25517085c59d11

SHA1
a24675f9eeb8fff0b8cff285b55040ac5395173d

SHA256
0a1100979e642c581c7f8bcbf624e556603bb1d7993e1f9af0f4c5b32b12f3d4

SHA512
7bae3b9e0112007c0ae56d3c2fd4df546a9afd2fbf49e5af49e415d603e06c5fc7462d012c794093aef7f3c3c2d1663d361b15d32fd78cc7b0688da200cc961c

Download Submit
C:\Windows\system\HEGCLDM.exe

Filesize
2.2MB

MD5
bd1e52c57ba80f663158035a8dbd96ec

SHA1
1e9ab634024f8458872e9708efa6a0068f8c35a8

SHA256
c2da5c79048487322fac04b404e73e3710d4067ba4d18b92f8008c4f5413c40c

SHA512
c9c5709f2be724593d4557008442005555287c3e14bbefd631743862bd44f44fb7b8b1d8dc27aafa228ccfeab956d808e2998c7610a67043b9875db547ae6682

Download Submit
C:\Windows\system\HVRqNmY.exe

Filesize
2.2MB

MD5
8d679ec8bba402a944a30590ff39c9fe

SHA1
85079523aacfb9e7fbed7c2f4eae724b50380853

SHA256
088860f197658f4ebf8808a40fdbabc10a917af2f8495b6d38d5c42e34879b9b

SHA512
12e0ff293a43714803f1382f4b3247777e0e0e0ddab77001ffaa3fb88b95f7607bca1167839c9866fa6413c3279c93d4e5720441a948996ff70c8aabdda98840

Download Submit
C:\Windows\system\HzVZTfP.exe

Filesize
2.2MB

MD5
243cade80a4334ec717188bef3ff407e

SHA1
d443ced345af929a7a5d592f893e16b74c4069f4

SHA256
8c3ce7d64b765636cb51f92ee42e1c51ed443a4cf07c24897894c4dc0a013c21

SHA512
323d808e4a717dee1ec3657310621e7ef5023b2b43ef45729646eeaed17cd6e0c63cf84df6fa1e1a91e7c60a7d1a35b4b0e4c3f8fed85c96a1a9ef1a1993be5d

Download Submit
C:\Windows\system\KJumUzI.exe

Filesize
2.2MB

MD5
a2dace12698150acf085c31cbe1ce7c3

SHA1
07b9d95faa18948b0dd19cad8c02f71accaf835d

SHA256
8e9d0617d0cd88398bbcd33774901a960fc81cd1dbee636966a0217d5f0411f6

SHA512
a2df271b1cad797ee9a81d6e48fa41765d0baeefa71bd49a5a54eeea2e0abda218b4a41d026263eceeb136a8747ec116c08e280eed89688b3dccb76203eda424

Download Submit
C:\Windows\system\MSMNXFo.exe

Filesize
2.2MB

MD5
38babd5fc94d65a07b77a4dfa83ae78e

SHA1
052d10c44585a979e3f5eb65ae4f0e7cea976a9d

SHA256
d9636c8f3821911d1b1a1869b873c831564e69302336f1cd3a94f6e42a0745e2

SHA512
048a8f4bfd9490723124e3d1040dd7df64fbada57ad85fac2cbcc01be1e8979ac58af8b02ccce840a03796b81655001ccd5e2ecb6309db678e0696b137efd895

Download Submit
C:\Windows\system\ODNzvwC.exe

Filesize
2.2MB

MD5
c88a5917be2ca586806343ff97ef54c3

SHA1
85c680753a17c322910fcf313c3e7904f57b2986

SHA256
3b2900859b1410835a69528f5ef71c397ee9eff280878cf259ec364bc4238f01

SHA512
06eb73f4ea92216880e2492c7e82c0708a0021339cc7d34c29516e67671e90210c46f17ec732585198ac73cafdc48d4b3b83a8cf378c369c03d41000f55c85e9

Download Submit
C:\Windows\system\OfBkkbT.exe

Filesize
2.2MB

MD5
6a34b8c2a5515741324daf6ee7bcf485

SHA1
1db8d4ceecd361ef185d2b495bed2f4b4e4d0d7e

SHA256
060f5de4b8b887f692ecb3849ca2184b73f3d13dd59122788cdc4c6ced2d3516

SHA512
1121c671ac641923871695192c88de19046b5985d30150de5f72c8437bc9a2729e674f829cd1cc58dd26e2da3aa2216fedaa0effa085ba8ad5eccb166ea02ce6

Download Submit
C:\Windows\system\PbyzRQp.exe

Filesize
2.2MB

MD5
66d02b1c38336f9ad7ae026c8386dcef

SHA1
285d4b0533b690684e512177bd2bfab4acd191f4

SHA256
46d49f9a58e0424509d69012229c2ab2bfd8ffc00eec51469def0ee10ef1c0d8

SHA512
98cb5b1839b7a947f0623077a3ed6090ef6f7d6ee85cc130744370777f2ce96557cfc02dcc672cc18c3b0c5f2828b5b34c7c5e8ac51252cd6465f7423ab5a0e2

Download Submit
C:\Windows\system\TqEdUSs.exe

Filesize
2.2MB

MD5
ae04ec4ad2e3ad4ed511875c99a7b4a2

SHA1
f8fad3d81e310a871cd9850fbd93ac9bb83c1a68

SHA256
66136429359a8b308d432db5cde30fc4bab64c62f5519fe1782f5b5dc438b65c

SHA512
9489637e4ee778e74c31514fec7abb5424d6db604435f8222e50c217061e93baacb5058cd8d7f17b0fbb02c8cdb17859f5e0f41463227364202a0e1b51cb54a4

Download Submit
C:\Windows\system\UiGdsJg.exe

Filesize
2.3MB

MD5
bab111e0512ec9ea2d03360d4fb096a1

SHA1
6e7b1e2397e26c5bfed58aaf33d94cc48973c6ee

SHA256
7488dec366be1b0bf24a457e75ed28102f872a7eb86f6999688e7b1b5daeb5c8

SHA512
8b16493fe314c7641aa3e70415c4cd611f644002c2e52960affb0e3d03cd5ba3fff69e2417580484330f59082d5a912cfaa5b537eb513276793c17c3dcf8916f

Download Submit
C:\Windows\system\UxKYNnH.exe

Filesize
2.2MB

MD5
a0741e13df5ed4e4ba6c4414c1a41d1c

SHA1
0bf4db877ce4ac39f1f5d967a49a254c7c45e192

SHA256
f6195a749dfdeebbc55c711b74d9d087e86728aef0e61b03f81b0a117a4afcc7

SHA512
0e3e1ef112a4971054f58b3b73c70fcdddc62d287607273d5a778df8d56e0ed41ac5b8f49bd7c5d7a0936f64ace8c7036bdc8249162e033ed3de1920d4954464

Download Submit
C:\Windows\system\WStHHZN.exe

Filesize
2.2MB

MD5
c8793a742c11315e3502bc938fe4b2d8

SHA1
e904d095c373e5e57a21b04dae35d59026603553

SHA256
bb006d150616e0d51535be3a0cb9af9f7a264bc7695084553a892ad098a54c86

SHA512
deea0f869bccf0525447a6f6cd4d71a31be8310cbbb4c5de4c08e8ad50f76dff8fff26e4a64b0bdd4df24aa5940981747ec717a9e8041e353a844e415fa71fd0

Download Submit
C:\Windows\system\ZtqDZTd.exe

Filesize
2.2MB

MD5
5cc5d7297b40a5382733ca63af58512c

SHA1
01ef866763da94df32b47bcdc55289ae1e9aca12

SHA256
82d19052916f2a9ab183c34456bbc8c8aa9815f7a3663a5ef041091d89e8b179

SHA512
786f217d1ab3229b860ae722b5bf7a5ec10a8b75fc5a20464215d455866add83a87d8a6262b3a5c28e0a25a5ba969273f30ca06648df09780f06059d16628bef

Download Submit
C:\Windows\system\aShjCpD.exe

Filesize
2.3MB

MD5
a13de94846cd2cce0d484d6af63eef6c

SHA1
e70713ffe53e44aaadd386b0d32b3519e9ca6bfd

SHA256
49cb54e0c49790ef7c1a4a0661f2b22a8062da0c1147a127fff85cef5cd393da

SHA512
6af27a95ddcb1d7614517e9e64f3be0e05e3f03d7df9a58240c40cdd24a439b75a8aad61b2e142b3b758e1994fbeb18931a5736790c556660776a93ec9864d70

Download Submit
C:\Windows\system\bblyTFj.exe

Filesize
2.2MB

MD5
685572e7e6c6499e70ff578159855296

SHA1
be8369b70a207e93da557e912fac163416804ca8

SHA256
0e12c21bc0d09db00d128330777dff64bfa4dafd1df4518966e60417b3f3b634

SHA512
d3142d6949f9827d67aa6ea7d6675013d06e194e5f8d81edd8722f0fbdc5f57f60713b6f643ce11a51964fae7cddb95bcf01ff3fdd0cb7fe3fde0ba417683c97

Download Submit
C:\Windows\system\bwvDymr.exe

Filesize
2.2MB

MD5
e919f4be95ca0d0c498c5d63a028bb72

SHA1
56e3463fa0c9723b252d0ca3de634c98b172ab7b

SHA256
b95ad3040fc9b02eb85ec608cd09f35a44183bc0bde5f81ecf7993d4c630b318

SHA512
fcbd53d9742b4a0046a3714128f8b5a8ada2e0ed6c6290ac80eca130d6609b2317122c271812da5e68b16af0401b02334f073c7fe34d5252168aec49a011d0d1

Download Submit
C:\Windows\system\dyVjFIQ.exe

Filesize
2.2MB

MD5
52dd8f928f9e572de3a8f0563a1d7494

SHA1
d7587cacc7995d01474413ff6aa5ded6e12386b2

SHA256
72757a626012371a327a84f9b91de16502e29620324051f89b0b5bad30ed7222

SHA512
7019443aaeeb45a9e5d9d7b1fa8683f6e127364173120bff169448d64a1aeefaaf89da1548068274759390b9ba4757a82242214044b14417416fea1d319236bc

Download Submit
C:\Windows\system\ffjqwrK.exe

Filesize
2.3MB

MD5
58e67c0f5df6dc20d9cac867d4e59d7f

SHA1
f989495d40214c3b05ff3e9903298f516358c5e1

SHA256
8e76f3bda7b00e3d4c588a91b788de1a96a77a0b76923f5efbf5c710dcb14ee5

SHA512
d828deb6c58a3ab92f61e192ce9a36e175effef832b330233e3bc3814a133e15f726652f0ef82c5bfe0dab8c9ec6f7e097f9bd5d2e14d20e765219450657f243

Download Submit
C:\Windows\system\qrWoxKo.exe

Filesize
2.2MB

MD5
c7105400a91b26deed2e3cd3b4a84d1d

SHA1
b7b89d17f7b18f665a435c69c2321b5eb8d3bac5

SHA256
e7c58113acae2ed00c5bfe6aa28eab1777b67655e17478d85bc632fc4e1548d0

SHA512
bc6a44938e2c4096fccfe9c4c49ac078392bab81335c82737bdad0ac1ccee663e4099335872bc88c8d837e2f3fde94a1dcb52469ea0074c91163b90157dcf63c

Download Submit
C:\Windows\system\rZklNHj.exe

Filesize
2.3MB

MD5
6aec495991b0e2c7f9d42f70c6c45176

SHA1
de3b5d47de2a15336fc96be8ba16657474bbc6f3

SHA256
0ea746695ba6586bd436fcd4a572db4a50ca1496b19e3b8d7204bff15ffd08cb

SHA512
3e28cd294c291cfceb9064ef904ef2cb74b38db66f1a8f47ad8fa022309393c264eb0bc96fb68f8773f44e93723107e9ce5c5d7971cfc7d1aeb285720bb886f5

Download Submit
C:\Windows\system\rxZfVhJ.exe

Filesize
2.2MB

MD5
c2687d64ad565128a1b73f066e774c33

SHA1
5608bbc1f9360a0880f9bb7904de9ae5d33edf51

SHA256
fb8fcc5a57fe15d3e6821339c65f130e35655040b6d624732a0209a08f7ed9aa

SHA512
5a7efa1e6f2ff81a0b995224850d9398d24390de1fea0523adc5e506b0c55990a9b297f6648574810ab456aad5f32804d119061c817f4c1bb64b84e055383ed2

Download Submit
C:\Windows\system\sjsSBQn.exe

Filesize
2.2MB

MD5
7d02d8f3e7ce055a3fa380b5a5f13a7f

SHA1
a998e21074e0350418771c516fb192f17c14b528

SHA256
b49fe9b15906c48764440f6a1a3b15f98d8c353c0a7160dc026740fc3b1151ae

SHA512
b17ee4c9149e5084f660e4f4f512b0ed999a8ee10e960d97868ce8047bc4b1210d371600e9b8dc0e75ad69a9e6e98f8d9fdb636cf236ac5477ff9cb8b0916bf5

Download Submit
C:\Windows\system\uAcGSYR.exe

Filesize
2.3MB

MD5
d1762f6eee16f5d8d4fd3b8f09cd41d5

SHA1
81d2aa5fae80f2e759ff5b34de4ce7da06ff930e

SHA256
5b6a0e5e6d20945c17d9ba66b6b70ced971c134b3b74209c9cfe526eb7c635c5

SHA512
f8547a474a476ef6fe14890d4c2bd5df039e3135037b7ad1ee20c32e0882b6291cf00c8c9063772bba4fa362e0dfcd7664a3cf521085969ebc3242fcd080c5c4

Download Submit
C:\Windows\system\vHWorTd.exe

Filesize
2.2MB

MD5
9481698e3333359af7bf46fa7f10b1a5

SHA1
5aba13b73afd956fb6ba3c2d4c0095ca14fd8214

SHA256
9282c6a688d7e60798dac0fb93fe7366d29ad083be1048fe9d8fcbe3faa28cb1

SHA512
9294ffc325fe96f4343794761de6a1fec9b45ed3b0cf2a16e0e1eaa2ebabc2ff20a22cb0f41afef86bf50ee798bf4b1f8bee3c95c5d7efdbcb16478cf18c9c67

Download Submit
C:\Windows\system\zBrtikC.exe

Filesize
2.2MB

MD5
6b6b5796a376577e539ee321a9be6df7

SHA1
31ab3b48aed1ee7130cb7f4e045c47ea040895cb

SHA256
2581ee6cee86cfd818c2aeded9f7d91c9baa8d8c084a927e83ee51d73b32cf26

SHA512
2379a705b865381626349c391b3372ee8853b8762e5bc61959c7f1b6cada263d9581ee115829fb15ffb808deeb7d8911c3061678ba6844ae273ae02e6560adb4

Download Submit
C:\Windows\system\zTUkOmJ.exe

Filesize
2.2MB

MD5
d133d0a07ae96c4fbbce6ffe0f9823a4

SHA1
fc1bcbc9d452057d23fc64ededc9a9f94b711fa4

SHA256
74fc4782aea911bd2c72e31070f9789a8c951b3f5e140fb4e9ae80f9e09fb33a

SHA512
2e44003e0aa25e45efe02b855defe65d5bc1b29b88d5dd311d70a0bc319b3ba36e469b90e79b2ce82e4c379891628daf512e3bb38bc67958ed5b4fd51b9c354d

Download Submit
C:\Windows\system\zfXduDx.exe

Filesize
2.2MB

MD5
1518b92862cc7d9c2445ea55e7dd7647

SHA1
4d573315bbb0ab2898367e1040eec064ceb06d58

SHA256
7379b163b2b51eb9aace27cce075ccf6eda25b5633d363fbf057d5abbe6c7017

SHA512
c2ae62c2bd69e504602eeb0e23da3dc76c0cff5047103a770a495fe139964a332bfa4795eb508b0434597587e93d4383859e04b1efef9e8ec7aacc97487d00be

Download Submit
\Windows\system\ldaVIqC.exe

Filesize
2.2MB

MD5
22bc16017335889b2d7b9b836a6ec2d1

SHA1
bbc753f85bc08876a9017ccab722918c5a045cee

SHA256
27e044539daefd04b6f896a4d6a825a79ab1004ccbf0989c5a5552ea72d54bfa

SHA512
f760af7cb14f0917a5f5b36efec88486e6fec23244098420951e5008f31ffaba45a7977725709f508c1b5edaa9dc97aabacfff3c1cd01dd784a15b37526b0d9a

Download Submit
\Windows\system\tBSUPQT.exe

Filesize
2.2MB

MD5
273c75358fb5c4516578e583789d4d72

SHA1
9ab291a31feb9a5873348a4cd8a5b8efb66a3249

SHA256
d216cbfb89a9236e4e6bf1e534ae20f0fb44080035fa3f71e659d0fb0d4a1d06

SHA512
0b641cccfdf213b0d45387e3405404f71ee400f0af5bf186583016080feee1f68f718737df7911de4c25001dcaab1a454f199d62a225389a1f9e60fd275387d4

Download Submit
\Windows\system\zRMISMT.exe

Filesize
2.2MB

MD5
2f0d1f0753fc04c21ae4eacd8c96bf00

SHA1
7ccb228d8b5488fe9c4b7e17f0193cb74bbd79b6

SHA256
53c9779ce37c85b5c7183e5d2e60f66b4776de46916e08fe4f1b8555ab25ffea

SHA512
bf678bb168ff86445a32ba6b2cb4769844d5b2bc5f5ba70a2b396d40f762ea3558c5171da669be9fb66731432fcca3b4fafb236ed7276b16b38d10173cdb307e

Download Submit
memory/1056-5453-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1056-219-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1740-179-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/1740-485-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-28-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/1740-223-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-178-0x000000001B410000-0x000000001B6F2000-memory.dmp

Filesize
2.9MB

Download
memory/1740-199-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmp

Filesize
9.6MB

Download
memory/1740-29-0x000007FEF628E000-0x000007FEF628F000-memory.dmp

Filesize
4KB

Download
memory/2368-4941-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2368-209-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2380-202-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-5416-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-206-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-5418-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-4465-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2428-213-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2484-25-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2484-5449-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2492-5004-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-204-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-5451-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2516-201-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2540-5179-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2540-9-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5401-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2648-27-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2696-216-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2696-207-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2696-8-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2696-26-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2696-24-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-203-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-205-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-214-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2696-0-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2696-211-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-218-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2696-407-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2696-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2848-5415-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2848-217-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5450-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/3024-215-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download