xmrig | a8170c2337faf6a89599d275c073f1d14bd7291d339b4c5d7835abae79107409

Analysis

max time kernel
133s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
Size

2.3MB
MD5

112f60d53a6370cd33cdf26bdc256718
SHA1

d9b5d7def6b0defeb74572eda087fe75131f4613
SHA256

a8170c2337faf6a89599d275c073f1d14bd7291d339b4c5d7835abae79107409
SHA512

3a797dd9fae57417ea32877b559fa626d587798b7b71bd2bb01d53d32f131a77013da0156340f2702df6a6a719321079bb95c4a153dc5eed582d7228ada992c7
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9ceg:NABX

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2600-34-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2500-74-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/960-115-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2068-87-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2972-85-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2672-48-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2716-45-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2604-44-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2684-43-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2740-36-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2356-16-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1908	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2356	oIoeUkc.exe
2600	dvuzpPv.exe
2684	GyFOGbv.exe
2604	hfyrwmH.exe
2672	DKiHBmP.exe
2716	yiLTdVA.exe
2500	pmrsDkb.exe
2972	smYSUPR.exe
2068	rIqlNoB.exe
960	NlLDtiA.exe
2788	ywoItQT.exe
1744	tzkzSsq.exe
2812	birDzRn.exe
2728	XiElgYo.exe
1868	WmjTMkr.exe
1436	PAxHuzW.exe
2120	cLbXKjM.exe
1120	pXZVbPG.exe
1964	pEtURRE.exe
1760	URgIpKL.exe
2096	ZeHTRvI.exe
956	uKfkNUd.exe
2656	ibnRWcL.exe
2560	GNVQfbv.exe
1324	aURkVdQ.exe
2540	mgGRWhR.exe
2856	CzxQngg.exe
2984	iCbdhvr.exe
1196	CyvsUce.exe
3064	sEINFPr.exe
2844	BNzoduq.exe
1640	dOtlKSo.exe
324	QyKmGVp.exe
1536	ssYPiSk.exe
1212	CSIwcAE.exe
1912	nMVgcUS.exe
1688	vZMNVsm.exe
912	hasLgbI.exe
1176	SQxxlAM.exe
2028	YkDfSiV.exe
2408	OjTtDvG.exe
624	XrHamwh.exe
2920	VWOhTFa.exe
2712	OvUiegw.exe
380	NQgYKxS.exe
888	Ykeczhf.exe
2416	pezUzJL.exe
1628	KGWQvtn.exe
2676	qdtuOEU.exe
2792	JRimEbM.exe
2584	ExrWOGn.exe
2016	ITctRtH.exe
1584	fctHAvU.exe
2440	HvsaFvh.exe
2188	VLFeREB.exe
1156	ANiIDnR.exe
768	DpTamsJ.exe
824	ubJNBdq.exe
1124	yPLABnx.exe
804	EhmwdQa.exe
2412	qruvZNE.exe
1676	RMJdRGr.exe
2928	WLkTIhi.exe
1784	hFLPiGv.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x000a000000014120-5.dat	upx
behavioral1/files/0x00080000000146b8-23.dat	upx
behavioral1/files/0x0007000000014667-30.dat	upx
behavioral1/memory/2600-34-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x00070000000146a2-28.dat	upx
behavioral1/files/0x00080000000146c0-52.dat	upx
behavioral1/memory/2500-74-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x0007000000014af6-72.dat	upx
behavioral1/memory/960-115-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x0006000000015c52-127.dat	upx
behavioral1/files/0x0006000000015c9f-146.dat	upx
behavioral1/files/0x0006000000015c78-138.dat	upx
behavioral1/files/0x0006000000015cce-160.dat	upx
behavioral1/files/0x0006000000014b31-165.dat	upx
behavioral1/files/0x0006000000015626-184.dat	upx
behavioral1/files/0x0007000000014abe-59.dat	upx
behavioral1/files/0x0006000000015018-94.dat	upx
behavioral1/files/0x0006000000015c6b-191.dat	upx
behavioral1/files/0x0006000000015c3d-189.dat	upx
behavioral1/files/0x0006000000015cfe-185.dat	upx
behavioral1/files/0x0006000000014de9-171.dat	upx
behavioral1/files/0x0006000000015cee-167.dat	upx
behavioral1/files/0x0006000000015cb6-148.dat	upx
behavioral1/files/0x0006000000015616-120.dat	upx
behavioral1/files/0x00060000000155f7-119.dat	upx
behavioral1/files/0x0006000000015605-109.dat	upx
behavioral1/files/0x00060000000155ed-105.dat	upx
behavioral1/files/0x0006000000014ef8-103.dat	upx
behavioral1/files/0x00060000000155f3-101.dat	upx
behavioral1/memory/2068-87-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2972-85-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0006000000014b70-83.dat	upx
behavioral1/files/0x000f000000005578-82.dat	upx
behavioral1/files/0x0006000000015c83-139.dat	upx
behavioral1/files/0x0006000000015cf6-177.dat	upx
behavioral1/files/0x0006000000015b6f-130.dat	upx
behavioral1/files/0x00080000000149f5-71.dat	upx
behavioral1/memory/2672-48-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2716-45-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2604-44-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2684-43-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/files/0x0008000000014539-27.dat	upx
behavioral1/memory/2356-16-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x00090000000143ec-15.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KcfUzZs.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\AMtAdeq.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\pOqBulw.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\EcgrXtC.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\OqNrIEp.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\mngboyY.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\PpWJKSz.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\HmkOgET.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\cLmavKx.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\AejEKGo.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\muxmSzg.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\bDSwXqF.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\cZwQSfs.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\uGgoIWv.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\zKlxZTZ.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\jSCMwyY.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\BUyYSqu.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\ASLPAOs.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\cHanXDA.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\iVixecB.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\QiNyDhH.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\xUhJTcD.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\jodZlsx.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\gLIrSOX.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\qZRmnea.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\slaZXcz.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\NlLDtiA.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\JRimEbM.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\YwHhZIJ.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\JKySQBQ.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\rfEoapP.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\eYiojzr.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\QCbKABr.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\JfNYpOD.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\OZklcEF.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\THVunzP.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\kqFLXyZ.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\wdAAwCt.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\pkkzgmp.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\EQrcWBS.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\JdPtKdW.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\JpBCSHi.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\RzyVcTl.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\WMvmMCX.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\TpyFTdU.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\jymSLQq.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\bYvagsS.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\iTbYUol.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\LduOrAV.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\GseAzKP.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\JLUCLbU.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\SoEtCAy.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\IROEGAE.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\clXfAIr.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\vSimbHV.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\CDWpfeC.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\WZcUgHG.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\rAZVMpC.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\VEONxLx.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\wtTtBVA.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\IdzRbrs.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\VXAiNUb.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\IcMzzIt.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
File created	C:\Windows\System\ANiIDnR.exe	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
Token: SeDebugPrivilege	1908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1908	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	29
PID 2740 wrote to memory of 1908	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	29
PID 2740 wrote to memory of 1908	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	29
PID 2740 wrote to memory of 2356	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2356	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2356	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2600	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2600	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2600	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2684	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	32
PID 2740 wrote to memory of 2684	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	32
PID 2740 wrote to memory of 2684	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	32
PID 2740 wrote to memory of 2672	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	33
PID 2740 wrote to memory of 2672	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	33
PID 2740 wrote to memory of 2672	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	33
PID 2740 wrote to memory of 2604	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	34
PID 2740 wrote to memory of 2604	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	34
PID 2740 wrote to memory of 2604	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	34
PID 2740 wrote to memory of 2716	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	35
PID 2740 wrote to memory of 2716	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	35
PID 2740 wrote to memory of 2716	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	35
PID 2740 wrote to memory of 2500	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	36
PID 2740 wrote to memory of 2500	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	36
PID 2740 wrote to memory of 2500	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	36
PID 2740 wrote to memory of 960	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	37
PID 2740 wrote to memory of 960	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	37
PID 2740 wrote to memory of 960	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	37
PID 2740 wrote to memory of 2972	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	38
PID 2740 wrote to memory of 2972	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	38
PID 2740 wrote to memory of 2972	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	38
PID 2740 wrote to memory of 1760	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	39
PID 2740 wrote to memory of 1760	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	39
PID 2740 wrote to memory of 1760	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	39
PID 2740 wrote to memory of 2068	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	40
PID 2740 wrote to memory of 2068	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	40
PID 2740 wrote to memory of 2068	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	40
PID 2740 wrote to memory of 956	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	41
PID 2740 wrote to memory of 956	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	41
PID 2740 wrote to memory of 956	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	41
PID 2740 wrote to memory of 2788	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	42
PID 2740 wrote to memory of 2788	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	42
PID 2740 wrote to memory of 2788	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	42
PID 2740 wrote to memory of 2656	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	43
PID 2740 wrote to memory of 2656	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	43
PID 2740 wrote to memory of 2656	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	43
PID 2740 wrote to memory of 1744	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	44
PID 2740 wrote to memory of 1744	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	44
PID 2740 wrote to memory of 1744	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	44
PID 2740 wrote to memory of 2560	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	45
PID 2740 wrote to memory of 2560	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	45
PID 2740 wrote to memory of 2560	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	45
PID 2740 wrote to memory of 2812	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	46
PID 2740 wrote to memory of 2812	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	46
PID 2740 wrote to memory of 2812	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	46
PID 2740 wrote to memory of 2540	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	47
PID 2740 wrote to memory of 2540	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	47
PID 2740 wrote to memory of 2540	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	47
PID 2740 wrote to memory of 2728	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	48
PID 2740 wrote to memory of 2728	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	48
PID 2740 wrote to memory of 2728	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	48
PID 2740 wrote to memory of 2856	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	49
PID 2740 wrote to memory of 2856	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	49
PID 2740 wrote to memory of 2856	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	49
PID 2740 wrote to memory of 1868	2740	112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\112f60d53a6370cd33cdf26bdc256718_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\System\oIoeUkc.exe
  C:\Windows\System\oIoeUkc.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\dvuzpPv.exe
  C:\Windows\System\dvuzpPv.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\GyFOGbv.exe
  C:\Windows\System\GyFOGbv.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\DKiHBmP.exe
  C:\Windows\System\DKiHBmP.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\hfyrwmH.exe
  C:\Windows\System\hfyrwmH.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\yiLTdVA.exe
  C:\Windows\System\yiLTdVA.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\pmrsDkb.exe
  C:\Windows\System\pmrsDkb.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\NlLDtiA.exe
  C:\Windows\System\NlLDtiA.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\smYSUPR.exe
  C:\Windows\System\smYSUPR.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\URgIpKL.exe
  C:\Windows\System\URgIpKL.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\rIqlNoB.exe
  C:\Windows\System\rIqlNoB.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\uKfkNUd.exe
  C:\Windows\System\uKfkNUd.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\ywoItQT.exe
  C:\Windows\System\ywoItQT.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ibnRWcL.exe
  C:\Windows\System\ibnRWcL.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\tzkzSsq.exe
  C:\Windows\System\tzkzSsq.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\GNVQfbv.exe
  C:\Windows\System\GNVQfbv.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\birDzRn.exe
  C:\Windows\System\birDzRn.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\mgGRWhR.exe
  C:\Windows\System\mgGRWhR.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\XiElgYo.exe
  C:\Windows\System\XiElgYo.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\CzxQngg.exe
  C:\Windows\System\CzxQngg.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\WmjTMkr.exe
  C:\Windows\System\WmjTMkr.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\iCbdhvr.exe
  C:\Windows\System\iCbdhvr.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\PAxHuzW.exe
  C:\Windows\System\PAxHuzW.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\CyvsUce.exe
  C:\Windows\System\CyvsUce.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\cLbXKjM.exe
  C:\Windows\System\cLbXKjM.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\sEINFPr.exe
  C:\Windows\System\sEINFPr.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\pXZVbPG.exe
  C:\Windows\System\pXZVbPG.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\BNzoduq.exe
  C:\Windows\System\BNzoduq.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\pEtURRE.exe
  C:\Windows\System\pEtURRE.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\QyKmGVp.exe
  C:\Windows\System\QyKmGVp.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\ZeHTRvI.exe
  C:\Windows\System\ZeHTRvI.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\ssYPiSk.exe
  C:\Windows\System\ssYPiSk.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\aURkVdQ.exe
  C:\Windows\System\aURkVdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\CSIwcAE.exe
  C:\Windows\System\CSIwcAE.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\dOtlKSo.exe
  C:\Windows\System\dOtlKSo.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\nMVgcUS.exe
  C:\Windows\System\nMVgcUS.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\vZMNVsm.exe
  C:\Windows\System\vZMNVsm.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\hasLgbI.exe
  C:\Windows\System\hasLgbI.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\SQxxlAM.exe
  C:\Windows\System\SQxxlAM.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\YkDfSiV.exe
  C:\Windows\System\YkDfSiV.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\OjTtDvG.exe
  C:\Windows\System\OjTtDvG.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\XrHamwh.exe
  C:\Windows\System\XrHamwh.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\VWOhTFa.exe
  C:\Windows\System\VWOhTFa.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\OvUiegw.exe
  C:\Windows\System\OvUiegw.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\NQgYKxS.exe
  C:\Windows\System\NQgYKxS.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\hFLPiGv.exe
  C:\Windows\System\hFLPiGv.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\Ykeczhf.exe
  C:\Windows\System\Ykeczhf.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\jdtjLbG.exe
  C:\Windows\System\jdtjLbG.exe
  2⤵
  PID:3048
- C:\Windows\System\pezUzJL.exe
  C:\Windows\System\pezUzJL.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\CBpxEbP.exe
  C:\Windows\System\CBpxEbP.exe
  2⤵
  PID:2380
- C:\Windows\System\KGWQvtn.exe
  C:\Windows\System\KGWQvtn.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\yXBFDKc.exe
  C:\Windows\System\yXBFDKc.exe
  2⤵
  PID:2316
- C:\Windows\System\qdtuOEU.exe
  C:\Windows\System\qdtuOEU.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\eCgkLPT.exe
  C:\Windows\System\eCgkLPT.exe
  2⤵
  PID:2668
- C:\Windows\System\JRimEbM.exe
  C:\Windows\System\JRimEbM.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\nePMQdg.exe
  C:\Windows\System\nePMQdg.exe
  2⤵
  PID:2720
- C:\Windows\System\ExrWOGn.exe
  C:\Windows\System\ExrWOGn.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\xKCPGLd.exe
  C:\Windows\System\xKCPGLd.exe
  2⤵
  PID:2548
- C:\Windows\System\ITctRtH.exe
  C:\Windows\System\ITctRtH.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\buRWwkX.exe
  C:\Windows\System\buRWwkX.exe
  2⤵
  PID:2588
- C:\Windows\System\fctHAvU.exe
  C:\Windows\System\fctHAvU.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\YulBOxO.exe
  C:\Windows\System\YulBOxO.exe
  2⤵
  PID:2300
- C:\Windows\System\HvsaFvh.exe
  C:\Windows\System\HvsaFvh.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\kwUSEUE.exe
  C:\Windows\System\kwUSEUE.exe
  2⤵
  PID:1444
- C:\Windows\System\VLFeREB.exe
  C:\Windows\System\VLFeREB.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\uEgwNEU.exe
  C:\Windows\System\uEgwNEU.exe
  2⤵
  PID:2212
- C:\Windows\System\ANiIDnR.exe
  C:\Windows\System\ANiIDnR.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\XgTNXgf.exe
  C:\Windows\System\XgTNXgf.exe
  2⤵
  PID:1488
- C:\Windows\System\DpTamsJ.exe
  C:\Windows\System\DpTamsJ.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\urRlaaM.exe
  C:\Windows\System\urRlaaM.exe
  2⤵
  PID:320
- C:\Windows\System\ubJNBdq.exe
  C:\Windows\System\ubJNBdq.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\HiOqMbh.exe
  C:\Windows\System\HiOqMbh.exe
  2⤵
  PID:2568
- C:\Windows\System\yPLABnx.exe
  C:\Windows\System\yPLABnx.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\WtdsRGQ.exe
  C:\Windows\System\WtdsRGQ.exe
  2⤵
  PID:592
- C:\Windows\System\EhmwdQa.exe
  C:\Windows\System\EhmwdQa.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\KkqNetX.exe
  C:\Windows\System\KkqNetX.exe
  2⤵
  PID:1696
- C:\Windows\System\qruvZNE.exe
  C:\Windows\System\qruvZNE.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\iVixecB.exe
  C:\Windows\System\iVixecB.exe
  2⤵
  PID:1580
- C:\Windows\System\RMJdRGr.exe
  C:\Windows\System\RMJdRGr.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\JtLOqWJ.exe
  C:\Windows\System\JtLOqWJ.exe
  2⤵
  PID:1684
- C:\Windows\System\WLkTIhi.exe
  C:\Windows\System\WLkTIhi.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\UHHWpqz.exe
  C:\Windows\System\UHHWpqz.exe
  2⤵
  PID:1148
- C:\Windows\System\SFmeaSQ.exe
  C:\Windows\System\SFmeaSQ.exe
  2⤵
  PID:3000
- C:\Windows\System\puJgEEw.exe
  C:\Windows\System\puJgEEw.exe
  2⤵
  PID:2232
- C:\Windows\System\nLZyzdN.exe
  C:\Windows\System\nLZyzdN.exe
  2⤵
  PID:2228
- C:\Windows\System\cJSLbAG.exe
  C:\Windows\System\cJSLbAG.exe
  2⤵
  PID:2292
- C:\Windows\System\AMAFmvd.exe
  C:\Windows\System\AMAFmvd.exe
  2⤵
  PID:1656
- C:\Windows\System\YdwjqAH.exe
  C:\Windows\System\YdwjqAH.exe
  2⤵
  PID:1140
- C:\Windows\System\kACjEDf.exe
  C:\Windows\System\kACjEDf.exe
  2⤵
  PID:3004
- C:\Windows\System\XRpzsMK.exe
  C:\Windows\System\XRpzsMK.exe
  2⤵
  PID:2696
- C:\Windows\System\ffJyWfZ.exe
  C:\Windows\System\ffJyWfZ.exe
  2⤵
  PID:2364
- C:\Windows\System\QCSDoif.exe
  C:\Windows\System\QCSDoif.exe
  2⤵
  PID:480
- C:\Windows\System\trWknyi.exe
  C:\Windows\System\trWknyi.exe
  2⤵
  PID:1816
- C:\Windows\System\rbyaQxv.exe
  C:\Windows\System\rbyaQxv.exe
  2⤵
  PID:2704
- C:\Windows\System\nCQYpgT.exe
  C:\Windows\System\nCQYpgT.exe
  2⤵
  PID:2220
- C:\Windows\System\uyUMHIv.exe
  C:\Windows\System\uyUMHIv.exe
  2⤵
  PID:1796
- C:\Windows\System\labaERz.exe
  C:\Windows\System\labaERz.exe
  2⤵
  PID:3084
- C:\Windows\System\CXycQWU.exe
  C:\Windows\System\CXycQWU.exe
  2⤵
  PID:3100
- C:\Windows\System\JpBCSHi.exe
  C:\Windows\System\JpBCSHi.exe
  2⤵
  PID:3116
- C:\Windows\System\AtEIdzR.exe
  C:\Windows\System\AtEIdzR.exe
  2⤵
  PID:3132
- C:\Windows\System\tyWywqf.exe
  C:\Windows\System\tyWywqf.exe
  2⤵
  PID:3148
- C:\Windows\System\jtBDAcP.exe
  C:\Windows\System\jtBDAcP.exe
  2⤵
  PID:3164
- C:\Windows\System\fOTCbLh.exe
  C:\Windows\System\fOTCbLh.exe
  2⤵
  PID:3180
- C:\Windows\System\cckZpUK.exe
  C:\Windows\System\cckZpUK.exe
  2⤵
  PID:3196
- C:\Windows\System\AlufIuC.exe
  C:\Windows\System\AlufIuC.exe
  2⤵
  PID:3212
- C:\Windows\System\tiyiKrs.exe
  C:\Windows\System\tiyiKrs.exe
  2⤵
  PID:3228
- C:\Windows\System\OdndoYp.exe
  C:\Windows\System\OdndoYp.exe
  2⤵
  PID:3244
- C:\Windows\System\peOPNbv.exe
  C:\Windows\System\peOPNbv.exe
  2⤵
  PID:3260
- C:\Windows\System\HwOSxkL.exe
  C:\Windows\System\HwOSxkL.exe
  2⤵
  PID:3276
- C:\Windows\System\hvqLnVu.exe
  C:\Windows\System\hvqLnVu.exe
  2⤵
  PID:3292
- C:\Windows\System\agazlUz.exe
  C:\Windows\System\agazlUz.exe
  2⤵
  PID:3308
- C:\Windows\System\nEVxkJm.exe
  C:\Windows\System\nEVxkJm.exe
  2⤵
  PID:3324
- C:\Windows\System\qbaGCwh.exe
  C:\Windows\System\qbaGCwh.exe
  2⤵
  PID:3340
- C:\Windows\System\bRFxWdJ.exe
  C:\Windows\System\bRFxWdJ.exe
  2⤵
  PID:3356
- C:\Windows\System\kRGYYHU.exe
  C:\Windows\System\kRGYYHU.exe
  2⤵
  PID:3376
- C:\Windows\System\ThqvKSs.exe
  C:\Windows\System\ThqvKSs.exe
  2⤵
  PID:3392
- C:\Windows\System\UgoqXcw.exe
  C:\Windows\System\UgoqXcw.exe
  2⤵
  PID:3408
- C:\Windows\System\uAVcMMd.exe
  C:\Windows\System\uAVcMMd.exe
  2⤵
  PID:3424
- C:\Windows\System\dftHkKc.exe
  C:\Windows\System\dftHkKc.exe
  2⤵
  PID:3440
- C:\Windows\System\YizuGPC.exe
  C:\Windows\System\YizuGPC.exe
  2⤵
  PID:3456
- C:\Windows\System\kDDJNZP.exe
  C:\Windows\System\kDDJNZP.exe
  2⤵
  PID:3472
- C:\Windows\System\cpBdPCG.exe
  C:\Windows\System\cpBdPCG.exe
  2⤵
  PID:3492
- C:\Windows\System\LmIiaVY.exe
  C:\Windows\System\LmIiaVY.exe
  2⤵
  PID:3508
- C:\Windows\System\WZcUgHG.exe
  C:\Windows\System\WZcUgHG.exe
  2⤵
  PID:3524
- C:\Windows\System\xelqpyy.exe
  C:\Windows\System\xelqpyy.exe
  2⤵
  PID:3544
- C:\Windows\System\mRJGQkM.exe
  C:\Windows\System\mRJGQkM.exe
  2⤵
  PID:3560
- C:\Windows\System\TmYNsJL.exe
  C:\Windows\System\TmYNsJL.exe
  2⤵
  PID:3588
- C:\Windows\System\LVBcPJI.exe
  C:\Windows\System\LVBcPJI.exe
  2⤵
  PID:3604
- C:\Windows\System\mQqZrtf.exe
  C:\Windows\System\mQqZrtf.exe
  2⤵
  PID:3620
- C:\Windows\System\dwdTxYB.exe
  C:\Windows\System\dwdTxYB.exe
  2⤵
  PID:3636
- C:\Windows\System\icCcLFa.exe
  C:\Windows\System\icCcLFa.exe
  2⤵
  PID:3652
- C:\Windows\System\qJNKaII.exe
  C:\Windows\System\qJNKaII.exe
  2⤵
  PID:3668
- C:\Windows\System\RMOjOhP.exe
  C:\Windows\System\RMOjOhP.exe
  2⤵
  PID:3696
- C:\Windows\System\yuAjtcm.exe
  C:\Windows\System\yuAjtcm.exe
  2⤵
  PID:3712
- C:\Windows\System\ESHNQOo.exe
  C:\Windows\System\ESHNQOo.exe
  2⤵
  PID:3728
- C:\Windows\System\OPmuWrp.exe
  C:\Windows\System\OPmuWrp.exe
  2⤵
  PID:3744
- C:\Windows\System\jymSLQq.exe
  C:\Windows\System\jymSLQq.exe
  2⤵
  PID:3764
- C:\Windows\System\JuttHMR.exe
  C:\Windows\System\JuttHMR.exe
  2⤵
  PID:3780
- C:\Windows\System\qSQckmA.exe
  C:\Windows\System\qSQckmA.exe
  2⤵
  PID:3796
- C:\Windows\System\JkETdac.exe
  C:\Windows\System\JkETdac.exe
  2⤵
  PID:3812
- C:\Windows\System\HPXszhN.exe
  C:\Windows\System\HPXszhN.exe
  2⤵
  PID:3828
- C:\Windows\System\BFesvNp.exe
  C:\Windows\System\BFesvNp.exe
  2⤵
  PID:3844
- C:\Windows\System\hMzKjaW.exe
  C:\Windows\System\hMzKjaW.exe
  2⤵
  PID:3860
- C:\Windows\System\BmshBUf.exe
  C:\Windows\System\BmshBUf.exe
  2⤵
  PID:3880
- C:\Windows\System\ZHlaqAX.exe
  C:\Windows\System\ZHlaqAX.exe
  2⤵
  PID:3900
- C:\Windows\System\LTDFDNp.exe
  C:\Windows\System\LTDFDNp.exe
  2⤵
  PID:3916
- C:\Windows\System\LeGwnqB.exe
  C:\Windows\System\LeGwnqB.exe
  2⤵
  PID:3932
- C:\Windows\System\cDkvSkT.exe
  C:\Windows\System\cDkvSkT.exe
  2⤵
  PID:3948
- C:\Windows\System\hgWvZMY.exe
  C:\Windows\System\hgWvZMY.exe
  2⤵
  PID:3964
- C:\Windows\System\enoVOJz.exe
  C:\Windows\System\enoVOJz.exe
  2⤵
  PID:3980
- C:\Windows\System\MUfKGom.exe
  C:\Windows\System\MUfKGom.exe
  2⤵
  PID:3996
- C:\Windows\System\DlvgDUF.exe
  C:\Windows\System\DlvgDUF.exe
  2⤵
  PID:4012
- C:\Windows\System\kmyCXoA.exe
  C:\Windows\System\kmyCXoA.exe
  2⤵
  PID:4032
- C:\Windows\System\zuhuvOV.exe
  C:\Windows\System\zuhuvOV.exe
  2⤵
  PID:4048
- C:\Windows\System\jYeEpKI.exe
  C:\Windows\System\jYeEpKI.exe
  2⤵
  PID:4064
- C:\Windows\System\iqaVojr.exe
  C:\Windows\System\iqaVojr.exe
  2⤵
  PID:4080
- C:\Windows\System\LiBlQKc.exe
  C:\Windows\System\LiBlQKc.exe
  2⤵
  PID:568
- C:\Windows\System\VDqDTzS.exe
  C:\Windows\System\VDqDTzS.exe
  2⤵
  PID:2132
- C:\Windows\System\cYexefA.exe
  C:\Windows\System\cYexefA.exe
  2⤵
  PID:2136
- C:\Windows\System\WNzOQUt.exe
  C:\Windows\System\WNzOQUt.exe
  2⤵
  PID:2392
- C:\Windows\System\TffnxCx.exe
  C:\Windows\System\TffnxCx.exe
  2⤵
  PID:2980
- C:\Windows\System\EoqaLLJ.exe
  C:\Windows\System\EoqaLLJ.exe
  2⤵
  PID:3252
- C:\Windows\System\WcANKef.exe
  C:\Windows\System\WcANKef.exe
  2⤵
  PID:3320
- C:\Windows\System\JtYjbCq.exe
  C:\Windows\System\JtYjbCq.exe
  2⤵
  PID:3388
- C:\Windows\System\AcHwqaT.exe
  C:\Windows\System\AcHwqaT.exe
  2⤵
  PID:3452
- C:\Windows\System\sUaOVCY.exe
  C:\Windows\System\sUaOVCY.exe
  2⤵
  PID:3516
- C:\Windows\System\IbZKPmA.exe
  C:\Windows\System\IbZKPmA.exe
  2⤵
  PID:3596
- C:\Windows\System\hibwGxm.exe
  C:\Windows\System\hibwGxm.exe
  2⤵
  PID:3632
- C:\Windows\System\MiNJmFV.exe
  C:\Windows\System\MiNJmFV.exe
  2⤵
  PID:2456
- C:\Windows\System\NiHZysj.exe
  C:\Windows\System\NiHZysj.exe
  2⤵
  PID:1200
- C:\Windows\System\wESugGp.exe
  C:\Windows\System\wESugGp.exe
  2⤵
  PID:1644
- C:\Windows\System\gTZtguc.exe
  C:\Windows\System\gTZtguc.exe
  2⤵
  PID:964
- C:\Windows\System\ykBFPBU.exe
  C:\Windows\System\ykBFPBU.exe
  2⤵
  PID:1184
- C:\Windows\System\HRBaVVH.exe
  C:\Windows\System\HRBaVVH.exe
  2⤵
  PID:3808
- C:\Windows\System\vHqypcE.exe
  C:\Windows\System\vHqypcE.exe
  2⤵
  PID:3836
- C:\Windows\System\PvvdQqW.exe
  C:\Windows\System\PvvdQqW.exe
  2⤵
  PID:3912
- C:\Windows\System\CKxPzhJ.exe
  C:\Windows\System\CKxPzhJ.exe
  2⤵
  PID:3972
- C:\Windows\System\UCoLAVz.exe
  C:\Windows\System\UCoLAVz.exe
  2⤵
  PID:1860
- C:\Windows\System\HipqlZc.exe
  C:\Windows\System\HipqlZc.exe
  2⤵
  PID:4028
- C:\Windows\System\cZXYKLd.exe
  C:\Windows\System\cZXYKLd.exe
  2⤵
  PID:2948
- C:\Windows\System\GfekXLY.exe
  C:\Windows\System\GfekXLY.exe
  2⤵
  PID:4112
- C:\Windows\System\MdpbRRY.exe
  C:\Windows\System\MdpbRRY.exe
  2⤵
  PID:4128
- C:\Windows\System\sTQRZGL.exe
  C:\Windows\System\sTQRZGL.exe
  2⤵
  PID:4144
- C:\Windows\System\erhOSrv.exe
  C:\Windows\System\erhOSrv.exe
  2⤵
  PID:4160
- C:\Windows\System\Qvjkght.exe
  C:\Windows\System\Qvjkght.exe
  2⤵
  PID:4176
- C:\Windows\System\xUhJTcD.exe
  C:\Windows\System\xUhJTcD.exe
  2⤵
  PID:4192
- C:\Windows\System\PFjluLp.exe
  C:\Windows\System\PFjluLp.exe
  2⤵
  PID:4208
- C:\Windows\System\bGseszj.exe
  C:\Windows\System\bGseszj.exe
  2⤵
  PID:4224
- C:\Windows\System\RasViys.exe
  C:\Windows\System\RasViys.exe
  2⤵
  PID:4240
- C:\Windows\System\jmyCovZ.exe
  C:\Windows\System\jmyCovZ.exe
  2⤵
  PID:4256
- C:\Windows\System\uYfMAbf.exe
  C:\Windows\System\uYfMAbf.exe
  2⤵
  PID:4272
- C:\Windows\System\DnxnpZI.exe
  C:\Windows\System\DnxnpZI.exe
  2⤵
  PID:4292
- C:\Windows\System\lvrgqOY.exe
  C:\Windows\System\lvrgqOY.exe
  2⤵
  PID:4308
- C:\Windows\System\JCMQHaO.exe
  C:\Windows\System\JCMQHaO.exe
  2⤵
  PID:4324
- C:\Windows\System\SzTCfKE.exe
  C:\Windows\System\SzTCfKE.exe
  2⤵
  PID:4340
- C:\Windows\System\AoqrjHg.exe
  C:\Windows\System\AoqrjHg.exe
  2⤵
  PID:4356
- C:\Windows\System\Rgnqmca.exe
  C:\Windows\System\Rgnqmca.exe
  2⤵
  PID:4372
- C:\Windows\System\gfGotzz.exe
  C:\Windows\System\gfGotzz.exe
  2⤵
  PID:4388
- C:\Windows\System\wAZRJjA.exe
  C:\Windows\System\wAZRJjA.exe
  2⤵
  PID:4404
- C:\Windows\System\eRcArhd.exe
  C:\Windows\System\eRcArhd.exe
  2⤵
  PID:4420
- C:\Windows\System\bQsYapK.exe
  C:\Windows\System\bQsYapK.exe
  2⤵
  PID:4440
- C:\Windows\System\pEXJhVy.exe
  C:\Windows\System\pEXJhVy.exe
  2⤵
  PID:4456
- C:\Windows\System\VPAyKPp.exe
  C:\Windows\System\VPAyKPp.exe
  2⤵
  PID:4472
- C:\Windows\System\PjbgpLC.exe
  C:\Windows\System\PjbgpLC.exe
  2⤵
  PID:4488
- C:\Windows\System\JEOGEjX.exe
  C:\Windows\System\JEOGEjX.exe
  2⤵
  PID:4504
- C:\Windows\System\HvljGHj.exe
  C:\Windows\System\HvljGHj.exe
  2⤵
  PID:4520
- C:\Windows\System\cCFXtKn.exe
  C:\Windows\System\cCFXtKn.exe
  2⤵
  PID:4536
- C:\Windows\System\aLXdDkO.exe
  C:\Windows\System\aLXdDkO.exe
  2⤵
  PID:4552
- C:\Windows\System\aljlxNC.exe
  C:\Windows\System\aljlxNC.exe
  2⤵
  PID:4568
- C:\Windows\System\bIkiMLD.exe
  C:\Windows\System\bIkiMLD.exe
  2⤵
  PID:4584
- C:\Windows\System\JeoobcG.exe
  C:\Windows\System\JeoobcG.exe
  2⤵
  PID:4600
- C:\Windows\System\STkugxz.exe
  C:\Windows\System\STkugxz.exe
  2⤵
  PID:4616
- C:\Windows\System\zStNvOG.exe
  C:\Windows\System\zStNvOG.exe
  2⤵
  PID:4632
- C:\Windows\System\OHXWeiV.exe
  C:\Windows\System\OHXWeiV.exe
  2⤵
  PID:4648
- C:\Windows\System\zNiXMCG.exe
  C:\Windows\System\zNiXMCG.exe
  2⤵
  PID:4664
- C:\Windows\System\DSIjbSm.exe
  C:\Windows\System\DSIjbSm.exe
  2⤵
  PID:4680
- C:\Windows\System\nUCoQSX.exe
  C:\Windows\System\nUCoQSX.exe
  2⤵
  PID:4696
- C:\Windows\System\NkybYog.exe
  C:\Windows\System\NkybYog.exe
  2⤵
  PID:4712
- C:\Windows\System\byqniok.exe
  C:\Windows\System\byqniok.exe
  2⤵
  PID:4728
- C:\Windows\System\LUevhxR.exe
  C:\Windows\System\LUevhxR.exe
  2⤵
  PID:4744
- C:\Windows\System\BmigUkq.exe
  C:\Windows\System\BmigUkq.exe
  2⤵
  PID:4760
- C:\Windows\System\yNzTvdY.exe
  C:\Windows\System\yNzTvdY.exe
  2⤵
  PID:4776
- C:\Windows\System\llwqtSg.exe
  C:\Windows\System\llwqtSg.exe
  2⤵
  PID:4792
- C:\Windows\System\KNjCPnD.exe
  C:\Windows\System\KNjCPnD.exe
  2⤵
  PID:4808
- C:\Windows\System\cCCceMd.exe
  C:\Windows\System\cCCceMd.exe
  2⤵
  PID:4824
- C:\Windows\System\aCEhxbW.exe
  C:\Windows\System\aCEhxbW.exe
  2⤵
  PID:4864
- C:\Windows\System\RUoidEp.exe
  C:\Windows\System\RUoidEp.exe
  2⤵
  PID:4928
- C:\Windows\System\cMbyCfV.exe
  C:\Windows\System\cMbyCfV.exe
  2⤵
  PID:4944
- C:\Windows\System\wSVnfEb.exe
  C:\Windows\System\wSVnfEb.exe
  2⤵
  PID:4960
- C:\Windows\System\VkyVDlr.exe
  C:\Windows\System\VkyVDlr.exe
  2⤵
  PID:4976
- C:\Windows\System\nSIOwed.exe
  C:\Windows\System\nSIOwed.exe
  2⤵
  PID:4992
- C:\Windows\System\oMFtbBb.exe
  C:\Windows\System\oMFtbBb.exe
  2⤵
  PID:5008
- C:\Windows\System\MJcDOxd.exe
  C:\Windows\System\MJcDOxd.exe
  2⤵
  PID:5024
- C:\Windows\System\VWGZCBe.exe
  C:\Windows\System\VWGZCBe.exe
  2⤵
  PID:5040
- C:\Windows\System\QDXhUiE.exe
  C:\Windows\System\QDXhUiE.exe
  2⤵
  PID:5064
- C:\Windows\System\awgawWk.exe
  C:\Windows\System\awgawWk.exe
  2⤵
  PID:5080
- C:\Windows\System\vprOcIx.exe
  C:\Windows\System\vprOcIx.exe
  2⤵
  PID:5096
- C:\Windows\System\VBpsARC.exe
  C:\Windows\System\VBpsARC.exe
  2⤵
  PID:5112
- C:\Windows\System\rFGlKcg.exe
  C:\Windows\System\rFGlKcg.exe
  2⤵
  PID:2280
- C:\Windows\System\NDTyQGC.exe
  C:\Windows\System\NDTyQGC.exe
  2⤵
  PID:3008
- C:\Windows\System\lQdYFZz.exe
  C:\Windows\System\lQdYFZz.exe
  2⤵
  PID:2756
- C:\Windows\System\nigelxt.exe
  C:\Windows\System\nigelxt.exe
  2⤵
  PID:3192
- C:\Windows\System\QnzkIgB.exe
  C:\Windows\System\QnzkIgB.exe
  2⤵
  PID:3352
- C:\Windows\System\HpVpQcl.exe
  C:\Windows\System\HpVpQcl.exe
  2⤵
  PID:3484
- C:\Windows\System\xkqnGAZ.exe
  C:\Windows\System\xkqnGAZ.exe
  2⤵
  PID:2724
- C:\Windows\System\WsKicDS.exe
  C:\Windows\System\WsKicDS.exe
  2⤵
  PID:3736
- C:\Windows\System\LmQJXCf.exe
  C:\Windows\System\LmQJXCf.exe
  2⤵
  PID:4004
- C:\Windows\System\UshnlHd.exe
  C:\Windows\System\UshnlHd.exe
  2⤵
  PID:1604
- C:\Windows\System\iuzvRRZ.exe
  C:\Windows\System\iuzvRRZ.exe
  2⤵
  PID:684
- C:\Windows\System\XdsPCRQ.exe
  C:\Windows\System\XdsPCRQ.exe
  2⤵
  PID:4156
- C:\Windows\System\vRkypUj.exe
  C:\Windows\System\vRkypUj.exe
  2⤵
  PID:4220
- C:\Windows\System\kaEgqXy.exe
  C:\Windows\System\kaEgqXy.exe
  2⤵
  PID:4280
- C:\Windows\System\ayITeuq.exe
  C:\Windows\System\ayITeuq.exe
  2⤵
  PID:2988
- C:\Windows\System\EtGlgPE.exe
  C:\Windows\System\EtGlgPE.exe
  2⤵
  PID:1660
- C:\Windows\System\oUvOlDu.exe
  C:\Windows\System\oUvOlDu.exe
  2⤵
  PID:2236
- C:\Windows\System\ghegGTp.exe
  C:\Windows\System\ghegGTp.exe
  2⤵
  PID:3080
- C:\Windows\System\MiYjKAL.exe
  C:\Windows\System\MiYjKAL.exe
  2⤵
  PID:3172
- C:\Windows\System\CgaJVHL.exe
  C:\Windows\System\CgaJVHL.exe
  2⤵
  PID:5036
- C:\Windows\System\jYbJNSy.exe
  C:\Windows\System\jYbJNSy.exe
  2⤵
  PID:948
- C:\Windows\System\diUMtgi.exe
  C:\Windows\System\diUMtgi.exe
  2⤵
  PID:1068
- C:\Windows\System\OAnzlqA.exe
  C:\Windows\System\OAnzlqA.exe
  2⤵
  PID:5076
- C:\Windows\System\iztlBah.exe
  C:\Windows\System\iztlBah.exe
  2⤵
  PID:2636
- C:\Windows\System\TdgdWdi.exe
  C:\Windows\System\TdgdWdi.exe
  2⤵
  PID:3488
- C:\Windows\System\fzBELeO.exe
  C:\Windows\System\fzBELeO.exe
  2⤵
  PID:2400
- C:\Windows\System\vJDayIE.exe
  C:\Windows\System\vJDayIE.exe
  2⤵
  PID:5032
- C:\Windows\System\yHsWNor.exe
  C:\Windows\System\yHsWNor.exe
  2⤵
  PID:5108
- C:\Windows\System\ZBHaPvP.exe
  C:\Windows\System\ZBHaPvP.exe
  2⤵
  PID:4072
- C:\Windows\System\IFWtWGH.exe
  C:\Windows\System\IFWtWGH.exe
  2⤵
  PID:4252
- C:\Windows\System\oJSSNkc.exe
  C:\Windows\System\oJSSNkc.exe
  2⤵
  PID:1752
- C:\Windows\System\dFVKSds.exe
  C:\Windows\System\dFVKSds.exe
  2⤵
  PID:1092
- C:\Windows\System\OzTjoaK.exe
  C:\Windows\System\OzTjoaK.exe
  2⤵
  PID:904
- C:\Windows\System\tGsTjLw.exe
  C:\Windows\System\tGsTjLw.exe
  2⤵
  PID:1680
- C:\Windows\System\SCUYCmY.exe
  C:\Windows\System\SCUYCmY.exe
  2⤵
  PID:3372
- C:\Windows\System\oZMAFXJ.exe
  C:\Windows\System\oZMAFXJ.exe
  2⤵
  PID:3436
- C:\Windows\System\oUNKSpD.exe
  C:\Windows\System\oUNKSpD.exe
  2⤵
  PID:3504
- C:\Windows\System\bWTQIPa.exe
  C:\Windows\System\bWTQIPa.exe
  2⤵
  PID:3568
- C:\Windows\System\jhKlHPw.exe
  C:\Windows\System\jhKlHPw.exe
  2⤵
  PID:3584
- C:\Windows\System\SWCzfkS.exe
  C:\Windows\System\SWCzfkS.exe
  2⤵
  PID:3676
- C:\Windows\System\daJUzUj.exe
  C:\Windows\System\daJUzUj.exe
  2⤵
  PID:3688
- C:\Windows\System\BMXPSGE.exe
  C:\Windows\System\BMXPSGE.exe
  2⤵
  PID:3752
- C:\Windows\System\ZYGTpYU.exe
  C:\Windows\System\ZYGTpYU.exe
  2⤵
  PID:3820
- C:\Windows\System\fvyZYIL.exe
  C:\Windows\System\fvyZYIL.exe
  2⤵
  PID:3876
- C:\Windows\System\EAcxzUf.exe
  C:\Windows\System\EAcxzUf.exe
  2⤵
  PID:3928
- C:\Windows\System\jGOdgot.exe
  C:\Windows\System\jGOdgot.exe
  2⤵
  PID:3988
- C:\Windows\System\gWJsHUw.exe
  C:\Windows\System\gWJsHUw.exe
  2⤵
  PID:4056
- C:\Windows\System\uOTqYzo.exe
  C:\Windows\System\uOTqYzo.exe
  2⤵
  PID:2808
- C:\Windows\System\tlueNSx.exe
  C:\Windows\System\tlueNSx.exe
  2⤵
  PID:3124
- C:\Windows\System\MFiYCRd.exe
  C:\Windows\System\MFiYCRd.exe
  2⤵
  PID:2476
- C:\Windows\System\dARBxuO.exe
  C:\Windows\System\dARBxuO.exe
  2⤵
  PID:1864
- C:\Windows\System\WYoiuBH.exe
  C:\Windows\System\WYoiuBH.exe
  2⤵
  PID:2504
- C:\Windows\System\URjIDJv.exe
  C:\Windows\System\URjIDJv.exe
  2⤵
  PID:2464
- C:\Windows\System\vNDUmvu.exe
  C:\Windows\System\vNDUmvu.exe
  2⤵
  PID:3288
- C:\Windows\System\BEBtgik.exe
  C:\Windows\System\BEBtgik.exe
  2⤵
  PID:3552
- C:\Windows\System\gsLArgw.exe
  C:\Windows\System\gsLArgw.exe
  2⤵
  PID:1116
- C:\Windows\System\acuxKyo.exe
  C:\Windows\System\acuxKyo.exe
  2⤵
  PID:3772
- C:\Windows\System\zSxQvrH.exe
  C:\Windows\System\zSxQvrH.exe
  2⤵
  PID:4040
- C:\Windows\System\bHnUWOQ.exe
  C:\Windows\System\bHnUWOQ.exe
  2⤵
  PID:4140
- C:\Windows\System\XPbbgHt.exe
  C:\Windows\System\XPbbgHt.exe
  2⤵
  PID:4204
- C:\Windows\System\tAeeeRU.exe
  C:\Windows\System\tAeeeRU.exe
  2⤵
  PID:4468
- C:\Windows\System\myDueva.exe
  C:\Windows\System\myDueva.exe
  2⤵
  PID:4396
- C:\Windows\System\hvXVQTG.exe
  C:\Windows\System\hvXVQTG.exe
  2⤵
  PID:4336
- C:\Windows\System\enFrYlw.exe
  C:\Windows\System\enFrYlw.exe
  2⤵
  PID:4300
- C:\Windows\System\nxufwVr.exe
  C:\Windows\System\nxufwVr.exe
  2⤵
  PID:4528
- C:\Windows\System\svRpqgH.exe
  C:\Windows\System\svRpqgH.exe
  2⤵
  PID:4592
- C:\Windows\System\HkoBkvw.exe
  C:\Windows\System\HkoBkvw.exe
  2⤵
  PID:4656
- C:\Windows\System\TUXMZGr.exe
  C:\Windows\System\TUXMZGr.exe
  2⤵
  PID:4720
- C:\Windows\System\JBaZLXC.exe
  C:\Windows\System\JBaZLXC.exe
  2⤵
  PID:4784
- C:\Windows\System\mSLdeOy.exe
  C:\Windows\System\mSLdeOy.exe
  2⤵
  PID:4872
- C:\Windows\System\Slcrwcd.exe
  C:\Windows\System\Slcrwcd.exe
  2⤵
  PID:4888
- C:\Windows\System\MHLFPSO.exe
  C:\Windows\System\MHLFPSO.exe
  2⤵
  PID:4904
- C:\Windows\System\csjaOGm.exe
  C:\Windows\System\csjaOGm.exe
  2⤵
  PID:4920
- C:\Windows\System\QCbKABr.exe
  C:\Windows\System\QCbKABr.exe
  2⤵
  PID:4984
- C:\Windows\System\kjLNPJc.exe
  C:\Windows\System\kjLNPJc.exe
  2⤵
  PID:5048
- C:\Windows\System\Vihaskq.exe
  C:\Windows\System\Vihaskq.exe
  2⤵
  PID:5088
- C:\Windows\System\dyyYgox.exe
  C:\Windows\System\dyyYgox.exe
  2⤵
  PID:2884
- C:\Windows\System\nMkKpMj.exe
  C:\Windows\System\nMkKpMj.exe
  2⤵
  PID:2776
- C:\Windows\System\svWaQEh.exe
  C:\Windows\System\svWaQEh.exe
  2⤵
  PID:336
- C:\Windows\System\YwHhZIJ.exe
  C:\Windows\System\YwHhZIJ.exe
  2⤵
  PID:4316
- C:\Windows\System\enUVDXb.exe
  C:\Windows\System\enUVDXb.exe
  2⤵
  PID:2544
- C:\Windows\System\CPGKuwd.exe
  C:\Windows\System\CPGKuwd.exe
  2⤵
  PID:4412
- C:\Windows\System\qXhBXSk.exe
  C:\Windows\System\qXhBXSk.exe
  2⤵
  PID:4480
- C:\Windows\System\lDJBxOE.exe
  C:\Windows\System\lDJBxOE.exe
  2⤵
  PID:4544
- C:\Windows\System\owFmqsU.exe
  C:\Windows\System\owFmqsU.exe
  2⤵
  PID:4608
- C:\Windows\System\ubBsbBn.exe
  C:\Windows\System\ubBsbBn.exe
  2⤵
  PID:4672
- C:\Windows\System\zlIdLbj.exe
  C:\Windows\System\zlIdLbj.exe
  2⤵
  PID:4736
- C:\Windows\System\rGoeLFx.exe
  C:\Windows\System\rGoeLFx.exe
  2⤵
  PID:4800
- C:\Windows\System\ZYuUNQq.exe
  C:\Windows\System\ZYuUNQq.exe
  2⤵
  PID:4844
- C:\Windows\System\pugdqJj.exe
  C:\Windows\System\pugdqJj.exe
  2⤵
  PID:4856
- C:\Windows\System\JkvHTPc.exe
  C:\Windows\System\JkvHTPc.exe
  2⤵
  PID:4968
- C:\Windows\System\QOecRml.exe
  C:\Windows\System\QOecRml.exe
  2⤵
  PID:1788
- C:\Windows\System\KcfUzZs.exe
  C:\Windows\System\KcfUzZs.exe
  2⤵
  PID:3144
- C:\Windows\System\FRNZgJV.exe
  C:\Windows\System\FRNZgJV.exe
  2⤵
  PID:5072
- C:\Windows\System\AzVIAEp.exe
  C:\Windows\System\AzVIAEp.exe
  2⤵
  PID:3708
- C:\Windows\System\FgRkbAK.exe
  C:\Windows\System\FgRkbAK.exe
  2⤵
  PID:5104
- C:\Windows\System\jylPlLb.exe
  C:\Windows\System\jylPlLb.exe
  2⤵
  PID:3240
- C:\Windows\System\EcgrXtC.exe
  C:\Windows\System\EcgrXtC.exe
  2⤵
  PID:2688
- C:\Windows\System\mmhuvIf.exe
  C:\Windows\System\mmhuvIf.exe
  2⤵
  PID:1476
- C:\Windows\System\DDmAEKT.exe
  C:\Windows\System\DDmAEKT.exe
  2⤵
  PID:3368
- C:\Windows\System\oajWIhs.exe
  C:\Windows\System\oajWIhs.exe
  2⤵
  PID:3540
- C:\Windows\System\bjPilFa.exe
  C:\Windows\System\bjPilFa.exe
  2⤵
  PID:3644
- C:\Windows\System\JQFOTeP.exe
  C:\Windows\System\JQFOTeP.exe
  2⤵
  PID:3680
- C:\Windows\System\ErNLpvV.exe
  C:\Windows\System\ErNLpvV.exe
  2⤵
  PID:3792
- C:\Windows\System\uZlsmzT.exe
  C:\Windows\System\uZlsmzT.exe
  2⤵
  PID:3924
- C:\Windows\System\jCEtohG.exe
  C:\Windows\System\jCEtohG.exe
  2⤵
  PID:4020
- C:\Windows\System\rbqxvPs.exe
  C:\Windows\System\rbqxvPs.exe
  2⤵
  PID:3156
- C:\Windows\System\eyktQnP.exe
  C:\Windows\System\eyktQnP.exe
  2⤵
  PID:2652
- C:\Windows\System\HLonLnD.exe
  C:\Windows\System\HLonLnD.exe
  2⤵
  PID:1720
- C:\Windows\System\CVOKnDr.exe
  C:\Windows\System\CVOKnDr.exe
  2⤵
  PID:1708
- C:\Windows\System\xbPipEj.exe
  C:\Windows\System\xbPipEj.exe
  2⤵
  PID:3804
- C:\Windows\System\diIxmuS.exe
  C:\Windows\System\diIxmuS.exe
  2⤵
  PID:4172
- C:\Windows\System\fPwGZiR.exe
  C:\Windows\System\fPwGZiR.exe
  2⤵
  PID:4496
- C:\Windows\System\HyDDLdk.exe
  C:\Windows\System\HyDDLdk.exe
  2⤵
  PID:4400
- C:\Windows\System\QQARZRu.exe
  C:\Windows\System\QQARZRu.exe
  2⤵
  PID:4560
- C:\Windows\System\rXTwqmp.exe
  C:\Windows\System\rXTwqmp.exe
  2⤵
  PID:4688
- C:\Windows\System\MCQoAxl.exe
  C:\Windows\System\MCQoAxl.exe
  2⤵
  PID:4752
- C:\Windows\System\VBfaEhF.exe
  C:\Windows\System\VBfaEhF.exe
  2⤵
  PID:2896
- C:\Windows\System\oAEwviR.exe
  C:\Windows\System\oAEwviR.exe
  2⤵
  PID:4912
- C:\Windows\System\aSUOjYU.exe
  C:\Windows\System\aSUOjYU.exe
  2⤵
  PID:5016
- C:\Windows\System\opYpRDp.exe
  C:\Windows\System\opYpRDp.exe
  2⤵
  PID:5060
- C:\Windows\System\IROEGAE.exe
  C:\Windows\System\IROEGAE.exe
  2⤵
  PID:3220
- C:\Windows\System\RzyVcTl.exe
  C:\Windows\System\RzyVcTl.exe
  2⤵
  PID:4188
- C:\Windows\System\xkHyhpp.exe
  C:\Windows\System\xkHyhpp.exe
  2⤵
  PID:4348
- C:\Windows\System\OhEMInw.exe
  C:\Windows\System\OhEMInw.exe
  2⤵
  PID:4452
- C:\Windows\System\boGHZMh.exe
  C:\Windows\System\boGHZMh.exe
  2⤵
  PID:4640
- C:\Windows\System\XVZinws.exe
  C:\Windows\System\XVZinws.exe
  2⤵
  PID:4708
- C:\Windows\System\aEYpFbf.exe
  C:\Windows\System\aEYpFbf.exe
  2⤵
  PID:4836
- C:\Windows\System\VTSlfWz.exe
  C:\Windows\System\VTSlfWz.exe
  2⤵
  PID:4940
- C:\Windows\System\kchioVL.exe
  C:\Windows\System\kchioVL.exe
  2⤵
  PID:3140
- C:\Windows\System\wbjtolG.exe
  C:\Windows\System\wbjtolG.exe
  2⤵
  PID:2164
- C:\Windows\System\UeAaQjZ.exe
  C:\Windows\System\UeAaQjZ.exe
  2⤵
  PID:3236
- C:\Windows\System\objLhUH.exe
  C:\Windows\System\objLhUH.exe
  2⤵
  PID:2664
- C:\Windows\System\bvRByRC.exe
  C:\Windows\System\bvRByRC.exe
  2⤵
  PID:3500
- C:\Windows\System\DOYWxrK.exe
  C:\Windows\System\DOYWxrK.exe
  2⤵
  PID:2764
- C:\Windows\System\ILALwJM.exe
  C:\Windows\System\ILALwJM.exe
  2⤵
  PID:3892
- C:\Windows\System\ZoSeXjn.exe
  C:\Windows\System\ZoSeXjn.exe
  2⤵
  PID:3160
- C:\Windows\System\ZwTnlts.exe
  C:\Windows\System\ZwTnlts.exe
  2⤵
  PID:2640
- C:\Windows\System\BzTHmnI.exe
  C:\Windows\System\BzTHmnI.exe
  2⤵
  PID:1060
- C:\Windows\System\pDzzFiD.exe
  C:\Windows\System\pDzzFiD.exe
  2⤵
  PID:4108
- C:\Windows\System\VzfzNGu.exe
  C:\Windows\System\VzfzNGu.exe
  2⤵
  PID:2744
- C:\Windows\System\WFcrhBi.exe
  C:\Windows\System\WFcrhBi.exe
  2⤵
  PID:4236
- C:\Windows\System\PoXzOwX.exe
  C:\Windows\System\PoXzOwX.exe
  2⤵
  PID:452
- C:\Windows\System\jRsEICg.exe
  C:\Windows\System\jRsEICg.exe
  2⤵
  PID:4884
- C:\Windows\System\OsUGzXh.exe
  C:\Windows\System\OsUGzXh.exe
  2⤵
  PID:5056
- C:\Windows\System\WasTJAC.exe
  C:\Windows\System\WasTJAC.exe
  2⤵
  PID:1168
- C:\Windows\System\zjDrChT.exe
  C:\Windows\System\zjDrChT.exe
  2⤵
  PID:1748
- C:\Windows\System\EeuGFsd.exe
  C:\Windows\System\EeuGFsd.exe
  2⤵
  PID:4576
- C:\Windows\System\LytpXtC.exe
  C:\Windows\System\LytpXtC.exe
  2⤵
  PID:4704
- C:\Windows\System\ZKnkrfF.exe
  C:\Windows\System\ZKnkrfF.exe
  2⤵
  PID:596
- C:\Windows\System\yXgdcae.exe
  C:\Windows\System\yXgdcae.exe
  2⤵
  PID:2516
- C:\Windows\System\jUnumCU.exe
  C:\Windows\System\jUnumCU.exe
  2⤵
  PID:3404
- C:\Windows\System\zqhXEbF.exe
  C:\Windows\System\zqhXEbF.exe
  2⤵
  PID:3536
- C:\Windows\System\UtgAxAE.exe
  C:\Windows\System\UtgAxAE.exe
  2⤵
  PID:3092
- C:\Windows\System\PRiYqmO.exe
  C:\Windows\System\PRiYqmO.exe
  2⤵
  PID:3316
- C:\Windows\System\PtGgMPi.exe
  C:\Windows\System\PtGgMPi.exe
  2⤵
  PID:4008
- C:\Windows\System\xTxnWiS.exe
  C:\Windows\System\xTxnWiS.exe
  2⤵
  PID:2852
- C:\Windows\System\MgIGMMC.exe
  C:\Windows\System\MgIGMMC.exe
  2⤵
  PID:4816
- C:\Windows\System\WVyvbuz.exe
  C:\Windows\System\WVyvbuz.exe
  2⤵
  PID:2840
- C:\Windows\System\VXAiNUb.exe
  C:\Windows\System\VXAiNUb.exe
  2⤵
  PID:1588
- C:\Windows\System\nIIDWhu.exe
  C:\Windows\System\nIIDWhu.exe
  2⤵
  PID:1572
- C:\Windows\System\FwlRGNV.exe
  C:\Windows\System\FwlRGNV.exe
  2⤵
  PID:2732
- C:\Windows\System\BgzMmiR.exe
  C:\Windows\System\BgzMmiR.exe
  2⤵
  PID:4768
- C:\Windows\System\XmyWvoZ.exe
  C:\Windows\System\XmyWvoZ.exe
  2⤵
  PID:2140
- C:\Windows\System\hAbTNQV.exe
  C:\Windows\System\hAbTNQV.exe
  2⤵
  PID:3432
- C:\Windows\System\iTbYUol.exe
  C:\Windows\System\iTbYUol.exe
  2⤵
  PID:2024
- C:\Windows\System\zDSeKsO.exe
  C:\Windows\System\zDSeKsO.exe
  2⤵
  PID:5128
- C:\Windows\System\qzkbErW.exe
  C:\Windows\System\qzkbErW.exe
  2⤵
  PID:5144
- C:\Windows\System\KqIwDvh.exe
  C:\Windows\System\KqIwDvh.exe
  2⤵
  PID:5160
- C:\Windows\System\nBEQZnr.exe
  C:\Windows\System\nBEQZnr.exe
  2⤵
  PID:5176
- C:\Windows\System\LAiubPG.exe
  C:\Windows\System\LAiubPG.exe
  2⤵
  PID:5192
- C:\Windows\System\jSUHrUj.exe
  C:\Windows\System\jSUHrUj.exe
  2⤵
  PID:5208
- C:\Windows\System\LCysmxb.exe
  C:\Windows\System\LCysmxb.exe
  2⤵
  PID:5224
- C:\Windows\System\sUinIvI.exe
  C:\Windows\System\sUinIvI.exe
  2⤵
  PID:5240
- C:\Windows\System\yJSGbeJ.exe
  C:\Windows\System\yJSGbeJ.exe
  2⤵
  PID:5256
- C:\Windows\System\AMtAdeq.exe
  C:\Windows\System\AMtAdeq.exe
  2⤵
  PID:5272
- C:\Windows\System\JDbyzXH.exe
  C:\Windows\System\JDbyzXH.exe
  2⤵
  PID:5288
- C:\Windows\System\XMKUwQL.exe
  C:\Windows\System\XMKUwQL.exe
  2⤵
  PID:5304
- C:\Windows\System\ynMViAd.exe
  C:\Windows\System\ynMViAd.exe
  2⤵
  PID:5320
- C:\Windows\System\dDPYuRW.exe
  C:\Windows\System\dDPYuRW.exe
  2⤵
  PID:5336
- C:\Windows\System\KEvFMXz.exe
  C:\Windows\System\KEvFMXz.exe
  2⤵
  PID:5352
- C:\Windows\System\agfgSzy.exe
  C:\Windows\System\agfgSzy.exe
  2⤵
  PID:5368
- C:\Windows\System\vMAgawW.exe
  C:\Windows\System\vMAgawW.exe
  2⤵
  PID:5384
- C:\Windows\System\kLCYNla.exe
  C:\Windows\System\kLCYNla.exe
  2⤵
  PID:5400
- C:\Windows\System\VcDPKZk.exe
  C:\Windows\System\VcDPKZk.exe
  2⤵
  PID:5416
- C:\Windows\System\KVKqoEx.exe
  C:\Windows\System\KVKqoEx.exe
  2⤵
  PID:5432
- C:\Windows\System\eiluHsF.exe
  C:\Windows\System\eiluHsF.exe
  2⤵
  PID:5448
- C:\Windows\System\xyYrOhV.exe
  C:\Windows\System\xyYrOhV.exe
  2⤵
  PID:5464
- C:\Windows\System\xfbMtbA.exe
  C:\Windows\System\xfbMtbA.exe
  2⤵
  PID:5480
- C:\Windows\System\GAJSdSH.exe
  C:\Windows\System\GAJSdSH.exe
  2⤵
  PID:5496
- C:\Windows\System\XYdIZbC.exe
  C:\Windows\System\XYdIZbC.exe
  2⤵
  PID:5512
- C:\Windows\System\xIsHgVh.exe
  C:\Windows\System\xIsHgVh.exe
  2⤵
  PID:5528
- C:\Windows\System\LduOrAV.exe
  C:\Windows\System\LduOrAV.exe
  2⤵
  PID:5544
- C:\Windows\System\uirMYJA.exe
  C:\Windows\System\uirMYJA.exe
  2⤵
  PID:5560
- C:\Windows\System\klPkJLr.exe
  C:\Windows\System\klPkJLr.exe
  2⤵
  PID:5576
- C:\Windows\System\KFbfmWw.exe
  C:\Windows\System\KFbfmWw.exe
  2⤵
  PID:5592
- C:\Windows\System\kiPvGIQ.exe
  C:\Windows\System\kiPvGIQ.exe
  2⤵
  PID:5608
- C:\Windows\System\wmqQLsI.exe
  C:\Windows\System\wmqQLsI.exe
  2⤵
  PID:5624
- C:\Windows\System\OsSqqwT.exe
  C:\Windows\System\OsSqqwT.exe
  2⤵
  PID:5640
- C:\Windows\System\fvxBqRg.exe
  C:\Windows\System\fvxBqRg.exe
  2⤵
  PID:5656
- C:\Windows\System\tDOtAll.exe
  C:\Windows\System\tDOtAll.exe
  2⤵
  PID:5672
- C:\Windows\System\rXmtKQa.exe
  C:\Windows\System\rXmtKQa.exe
  2⤵
  PID:5688
- C:\Windows\System\VWkEGlH.exe
  C:\Windows\System\VWkEGlH.exe
  2⤵
  PID:5704
- C:\Windows\System\vBMJxLN.exe
  C:\Windows\System\vBMJxLN.exe
  2⤵
  PID:5720
- C:\Windows\System\NZWZKzI.exe
  C:\Windows\System\NZWZKzI.exe
  2⤵
  PID:5736
- C:\Windows\System\cZwQSfs.exe
  C:\Windows\System\cZwQSfs.exe
  2⤵
  PID:5752
- C:\Windows\System\DmSGDwu.exe
  C:\Windows\System\DmSGDwu.exe
  2⤵
  PID:5768
- C:\Windows\System\lohSAMh.exe
  C:\Windows\System\lohSAMh.exe
  2⤵
  PID:5784
- C:\Windows\System\KgAsrgC.exe
  C:\Windows\System\KgAsrgC.exe
  2⤵
  PID:5800
- C:\Windows\System\uGgoIWv.exe
  C:\Windows\System\uGgoIWv.exe
  2⤵
  PID:5816
- C:\Windows\System\PJgFdpg.exe
  C:\Windows\System\PJgFdpg.exe
  2⤵
  PID:5832
- C:\Windows\System\ZGetkJr.exe
  C:\Windows\System\ZGetkJr.exe
  2⤵
  PID:5848
- C:\Windows\System\gMThLMw.exe
  C:\Windows\System\gMThLMw.exe
  2⤵
  PID:5864
- C:\Windows\System\QIhzMNB.exe
  C:\Windows\System\QIhzMNB.exe
  2⤵
  PID:5880
- C:\Windows\System\KdtGUox.exe
  C:\Windows\System\KdtGUox.exe
  2⤵
  PID:5896
- C:\Windows\System\KUHdDOp.exe
  C:\Windows\System\KUHdDOp.exe
  2⤵
  PID:5912
- C:\Windows\System\znrtlXh.exe
  C:\Windows\System\znrtlXh.exe
  2⤵
  PID:5928
- C:\Windows\System\BSDxqIx.exe
  C:\Windows\System\BSDxqIx.exe
  2⤵
  PID:5944
- C:\Windows\System\fSVwtKu.exe
  C:\Windows\System\fSVwtKu.exe
  2⤵
  PID:5960
- C:\Windows\System\QupWmiE.exe
  C:\Windows\System\QupWmiE.exe
  2⤵
  PID:5976
- C:\Windows\System\gfmUcCw.exe
  C:\Windows\System\gfmUcCw.exe
  2⤵
  PID:5992
- C:\Windows\System\fholMoZ.exe
  C:\Windows\System\fholMoZ.exe
  2⤵
  PID:6008
- C:\Windows\System\gYeIJnI.exe
  C:\Windows\System\gYeIJnI.exe
  2⤵
  PID:6024
- C:\Windows\System\wUwTwsa.exe
  C:\Windows\System\wUwTwsa.exe
  2⤵
  PID:6040
- C:\Windows\System\qBaKtLI.exe
  C:\Windows\System\qBaKtLI.exe
  2⤵
  PID:6056
- C:\Windows\System\XIMMpUI.exe
  C:\Windows\System\XIMMpUI.exe
  2⤵
  PID:6072
- C:\Windows\System\fVkOSlM.exe
  C:\Windows\System\fVkOSlM.exe
  2⤵
  PID:6088
- C:\Windows\System\nlYphEs.exe
  C:\Windows\System\nlYphEs.exe
  2⤵
  PID:6104
- C:\Windows\System\wAeVSdy.exe
  C:\Windows\System\wAeVSdy.exe
  2⤵
  PID:6120
- C:\Windows\System\MtXGfIW.exe
  C:\Windows\System\MtXGfIW.exe
  2⤵
  PID:6136
- C:\Windows\System\WARDYkN.exe
  C:\Windows\System\WARDYkN.exe
  2⤵
  PID:2644
- C:\Windows\System\XGkndXa.exe
  C:\Windows\System\XGkndXa.exe
  2⤵
  PID:1052
- C:\Windows\System\CfkPpXh.exe
  C:\Windows\System\CfkPpXh.exe
  2⤵
  PID:3868
- C:\Windows\System\jodZlsx.exe
  C:\Windows\System\jodZlsx.exe
  2⤵
  PID:2272
- C:\Windows\System\HMzAITd.exe
  C:\Windows\System\HMzAITd.exe
  2⤵
  PID:2804
- C:\Windows\System\tumSJMa.exe
  C:\Windows\System\tumSJMa.exe
  2⤵
  PID:5140
- C:\Windows\System\brCCgtf.exe
  C:\Windows\System\brCCgtf.exe
  2⤵
  PID:5172
- C:\Windows\System\idekVzC.exe
  C:\Windows\System\idekVzC.exe
  2⤵
  PID:5204
- C:\Windows\System\hvwvEyo.exe
  C:\Windows\System\hvwvEyo.exe
  2⤵
  PID:5236
- C:\Windows\System\ZVeKVbd.exe
  C:\Windows\System\ZVeKVbd.exe
  2⤵
  PID:5268
- C:\Windows\System\yPBhWwP.exe
  C:\Windows\System\yPBhWwP.exe
  2⤵
  PID:5300
- C:\Windows\System\YSvnUiV.exe
  C:\Windows\System\YSvnUiV.exe
  2⤵
  PID:5316
- C:\Windows\System\QFEAoIR.exe
  C:\Windows\System\QFEAoIR.exe
  2⤵
  PID:5348
- C:\Windows\System\UDiCYTH.exe
  C:\Windows\System\UDiCYTH.exe
  2⤵
  PID:5380
- C:\Windows\System\YGsBbYx.exe
  C:\Windows\System\YGsBbYx.exe
  2⤵
  PID:5412
- C:\Windows\System\SVXteKu.exe
  C:\Windows\System\SVXteKu.exe
  2⤵
  PID:1556
- C:\Windows\System\wwfnQBW.exe
  C:\Windows\System\wwfnQBW.exe
  2⤵
  PID:1820
- C:\Windows\System\FiTiICq.exe
  C:\Windows\System\FiTiICq.exe
  2⤵
  PID:5508
- C:\Windows\System\daamvLW.exe
  C:\Windows\System\daamvLW.exe
  2⤵
  PID:5540
- C:\Windows\System\pywNdme.exe
  C:\Windows\System\pywNdme.exe
  2⤵
  PID:5588
- C:\Windows\System\LwpGDbi.exe
  C:\Windows\System\LwpGDbi.exe
  2⤵
  PID:5604
- C:\Windows\System\ixEeBLU.exe
  C:\Windows\System\ixEeBLU.exe
  2⤵
  PID:5636
- C:\Windows\System\JBVqUWE.exe
  C:\Windows\System\JBVqUWE.exe
  2⤵
  PID:5668
- C:\Windows\System\cjMWeML.exe
  C:\Windows\System\cjMWeML.exe
  2⤵
  PID:5700
- C:\Windows\System\gLIrSOX.exe
  C:\Windows\System\gLIrSOX.exe
  2⤵
  PID:5732
- C:\Windows\System\kTdwgbR.exe
  C:\Windows\System\kTdwgbR.exe
  2⤵
  PID:5764
- C:\Windows\System\cljvIXu.exe
  C:\Windows\System\cljvIXu.exe
  2⤵
  PID:5796
- C:\Windows\System\sEQEcvl.exe
  C:\Windows\System\sEQEcvl.exe
  2⤵
  PID:5828
- C:\Windows\System\gBTEgKC.exe
  C:\Windows\System\gBTEgKC.exe
  2⤵
  PID:5860
- C:\Windows\System\mRklToa.exe
  C:\Windows\System\mRklToa.exe
  2⤵
  PID:5892
- C:\Windows\System\NCFZKCu.exe
  C:\Windows\System\NCFZKCu.exe
  2⤵
  PID:5940
- C:\Windows\System\sgdYxcA.exe
  C:\Windows\System\sgdYxcA.exe
  2⤵
  PID:6000
- C:\Windows\System\ezOEVYM.exe
  C:\Windows\System\ezOEVYM.exe
  2⤵
  PID:1880
- C:\Windows\System\CJzmJhr.exe
  C:\Windows\System\CJzmJhr.exe
  2⤵
  PID:6036
- C:\Windows\System\EhylvcO.exe
  C:\Windows\System\EhylvcO.exe
  2⤵
  PID:6052
- C:\Windows\System\LvSZqiR.exe
  C:\Windows\System\LvSZqiR.exe
  2⤵
  PID:6096
- C:\Windows\System\sfsFUDY.exe
  C:\Windows\System\sfsFUDY.exe
  2⤵
  PID:1492
- C:\Windows\System\NYQhpab.exe
  C:\Windows\System\NYQhpab.exe
  2⤵
  PID:2780
- C:\Windows\System\ezIExGi.exe
  C:\Windows\System\ezIExGi.exe
  2⤵
  PID:4756
- C:\Windows\System\JfNYpOD.exe
  C:\Windows\System\JfNYpOD.exe
  2⤵
  PID:3112
- C:\Windows\System\QkmyECE.exe
  C:\Windows\System\QkmyECE.exe
  2⤵
  PID:3956
- C:\Windows\System\KeyYVyU.exe
  C:\Windows\System\KeyYVyU.exe
  2⤵
  PID:5124
- C:\Windows\System\ELVFZep.exe
  C:\Windows\System\ELVFZep.exe
  2⤵
  PID:5188
- C:\Windows\System\MbOwtrL.exe
  C:\Windows\System\MbOwtrL.exe
  2⤵
  PID:1780
- C:\Windows\System\qGmKCCn.exe
  C:\Windows\System\qGmKCCn.exe
  2⤵
  PID:5284
- C:\Windows\System\mnPmqAQ.exe
  C:\Windows\System\mnPmqAQ.exe
  2⤵
  PID:5456
- C:\Windows\System\NPrTtya.exe
  C:\Windows\System\NPrTtya.exe
  2⤵
  PID:5344
- C:\Windows\System\lILKnsY.exe
  C:\Windows\System\lILKnsY.exe
  2⤵
  PID:5472
- C:\Windows\System\AUVdwFs.exe
  C:\Windows\System\AUVdwFs.exe
  2⤵
  PID:2648
- C:\Windows\System\Miedcwc.exe
  C:\Windows\System\Miedcwc.exe
  2⤵
  PID:2488
- C:\Windows\System\jKmQjUr.exe
  C:\Windows\System\jKmQjUr.exe
  2⤵
  PID:776
- C:\Windows\System\WmETPAG.exe
  C:\Windows\System\WmETPAG.exe
  2⤵
  PID:5728
- C:\Windows\System\fhRUKjw.exe
  C:\Windows\System\fhRUKjw.exe
  2⤵
  PID:5856
- C:\Windows\System\djiCHUy.exe
  C:\Windows\System\djiCHUy.exe
  2⤵
  PID:1972
- C:\Windows\System\dEFOyMK.exe
  C:\Windows\System\dEFOyMK.exe
  2⤵
  PID:640
- C:\Windows\System\JdPtKdW.exe
  C:\Windows\System\JdPtKdW.exe
  2⤵
  PID:5956
- C:\Windows\System\IsXCGLi.exe
  C:\Windows\System\IsXCGLi.exe
  2⤵
  PID:6100
- C:\Windows\System\CEFsURi.exe
  C:\Windows\System\CEFsURi.exe
  2⤵
  PID:1980
- C:\Windows\System\hMtZlqv.exe
  C:\Windows\System\hMtZlqv.exe
  2⤵
  PID:5296
- C:\Windows\System\mMmVmKn.exe
  C:\Windows\System\mMmVmKn.exe
  2⤵
  PID:5572
- C:\Windows\System\kdSHXEm.exe
  C:\Windows\System\kdSHXEm.exe
  2⤵
  PID:5220
- C:\Windows\System\ldEuBfu.exe
  C:\Windows\System\ldEuBfu.exe
  2⤵
  PID:5632
- C:\Windows\System\jUTmZYv.exe
  C:\Windows\System\jUTmZYv.exe
  2⤵
  PID:5888
- C:\Windows\System\OCjnHct.exe
  C:\Windows\System\OCjnHct.exe
  2⤵
  PID:6016
- C:\Windows\System\nVyFhnQ.exe
  C:\Windows\System\nVyFhnQ.exe
  2⤵
  PID:6116
- C:\Windows\System\TTXODIT.exe
  C:\Windows\System\TTXODIT.exe
  2⤵
  PID:3580
- C:\Windows\System\cysudMX.exe
  C:\Windows\System\cysudMX.exe
  2⤵
  PID:5440
- C:\Windows\System\dglkBzA.exe
  C:\Windows\System\dglkBzA.exe
  2⤵
  PID:5360
- C:\Windows\System\BPPNiob.exe
  C:\Windows\System\BPPNiob.exe
  2⤵
  PID:5536
- C:\Windows\System\Tfmbqyy.exe
  C:\Windows\System\Tfmbqyy.exe
  2⤵
  PID:5924
- C:\Windows\System\tHoqRgj.exe
  C:\Windows\System\tHoqRgj.exe
  2⤵
  PID:5936
- C:\Windows\System\yZbsQAj.exe
  C:\Windows\System\yZbsQAj.exe
  2⤵
  PID:6020
- C:\Windows\System\ZaUKPun.exe
  C:\Windows\System\ZaUKPun.exe
  2⤵
  PID:5520
- C:\Windows\System\qkXgDUF.exe
  C:\Windows\System\qkXgDUF.exe
  2⤵
  PID:6148
- C:\Windows\System\rdUbqyF.exe
  C:\Windows\System\rdUbqyF.exe
  2⤵
  PID:6164
- C:\Windows\System\uZufLaY.exe
  C:\Windows\System\uZufLaY.exe
  2⤵
  PID:6180
- C:\Windows\System\RBkzzBf.exe
  C:\Windows\System\RBkzzBf.exe
  2⤵
  PID:6196
- C:\Windows\System\wkHRaUp.exe
  C:\Windows\System\wkHRaUp.exe
  2⤵
  PID:6212
- C:\Windows\System\AerpRvI.exe
  C:\Windows\System\AerpRvI.exe
  2⤵
  PID:6228
- C:\Windows\System\pdPaDNf.exe
  C:\Windows\System\pdPaDNf.exe
  2⤵
  PID:6244
- C:\Windows\System\mBAfIVM.exe
  C:\Windows\System\mBAfIVM.exe
  2⤵
  PID:6260
- C:\Windows\System\VMcngoT.exe
  C:\Windows\System\VMcngoT.exe
  2⤵
  PID:6276
- C:\Windows\System\lHUIpmG.exe
  C:\Windows\System\lHUIpmG.exe
  2⤵
  PID:6292
- C:\Windows\System\VHUTxPH.exe
  C:\Windows\System\VHUTxPH.exe
  2⤵
  PID:6308
- C:\Windows\System\GYdKkmF.exe
  C:\Windows\System\GYdKkmF.exe
  2⤵
  PID:6324
- C:\Windows\System\koGKsgw.exe
  C:\Windows\System\koGKsgw.exe
  2⤵
  PID:6340
- C:\Windows\System\zMVVsfg.exe
  C:\Windows\System\zMVVsfg.exe
  2⤵
  PID:6356
- C:\Windows\System\hwUdQnt.exe
  C:\Windows\System\hwUdQnt.exe
  2⤵
  PID:6372
- C:\Windows\System\unUxjfl.exe
  C:\Windows\System\unUxjfl.exe
  2⤵
  PID:6388
- C:\Windows\System\FsNNIOr.exe
  C:\Windows\System\FsNNIOr.exe
  2⤵
  PID:6404
- C:\Windows\System\cHbkHiY.exe
  C:\Windows\System\cHbkHiY.exe
  2⤵
  PID:6420
- C:\Windows\System\MfXSbUW.exe
  C:\Windows\System\MfXSbUW.exe
  2⤵
  PID:6436
- C:\Windows\System\yAnvDWq.exe
  C:\Windows\System\yAnvDWq.exe
  2⤵
  PID:6452
- C:\Windows\System\OZklcEF.exe
  C:\Windows\System\OZklcEF.exe
  2⤵
  PID:6468
- C:\Windows\System\XmoohXX.exe
  C:\Windows\System\XmoohXX.exe
  2⤵
  PID:6484
- C:\Windows\System\bYvagsS.exe
  C:\Windows\System\bYvagsS.exe
  2⤵
  PID:6500
- C:\Windows\System\jmRXonp.exe
  C:\Windows\System\jmRXonp.exe
  2⤵
  PID:6516
- C:\Windows\System\naMDBWj.exe
  C:\Windows\System\naMDBWj.exe
  2⤵
  PID:6532
- C:\Windows\System\WtyMrbN.exe
  C:\Windows\System\WtyMrbN.exe
  2⤵
  PID:6548
- C:\Windows\System\jzJylGr.exe
  C:\Windows\System\jzJylGr.exe
  2⤵
  PID:6564
- C:\Windows\System\GXZKiGf.exe
  C:\Windows\System\GXZKiGf.exe
  2⤵
  PID:6580
- C:\Windows\System\wXVrTEZ.exe
  C:\Windows\System\wXVrTEZ.exe
  2⤵
  PID:6596
- C:\Windows\System\BmLsgYp.exe
  C:\Windows\System\BmLsgYp.exe
  2⤵
  PID:6612
- C:\Windows\System\BhZsQVN.exe
  C:\Windows\System\BhZsQVN.exe
  2⤵
  PID:6628
- C:\Windows\System\PQpfXiD.exe
  C:\Windows\System\PQpfXiD.exe
  2⤵
  PID:6644
- C:\Windows\System\uPzebOu.exe
  C:\Windows\System\uPzebOu.exe
  2⤵
  PID:6660
- C:\Windows\System\uUxxTde.exe
  C:\Windows\System\uUxxTde.exe
  2⤵
  PID:6676
- C:\Windows\System\PYqcSjM.exe
  C:\Windows\System\PYqcSjM.exe
  2⤵
  PID:6692
- C:\Windows\System\wxsfovJ.exe
  C:\Windows\System\wxsfovJ.exe
  2⤵
  PID:6708
- C:\Windows\System\pEvoDiq.exe
  C:\Windows\System\pEvoDiq.exe
  2⤵
  PID:6724
- C:\Windows\System\bKlzffl.exe
  C:\Windows\System\bKlzffl.exe
  2⤵
  PID:6740
- C:\Windows\System\iPWhSMd.exe
  C:\Windows\System\iPWhSMd.exe
  2⤵
  PID:6756
- C:\Windows\System\uobGaoL.exe
  C:\Windows\System\uobGaoL.exe
  2⤵
  PID:6772
- C:\Windows\System\mcKwOiN.exe
  C:\Windows\System\mcKwOiN.exe
  2⤵
  PID:6788
- C:\Windows\System\qsxVaNY.exe
  C:\Windows\System\qsxVaNY.exe
  2⤵
  PID:6804
- C:\Windows\System\hUcffev.exe
  C:\Windows\System\hUcffev.exe
  2⤵
  PID:6820
- C:\Windows\System\SKQnLwB.exe
  C:\Windows\System\SKQnLwB.exe
  2⤵
  PID:6836
- C:\Windows\System\UswfAcg.exe
  C:\Windows\System\UswfAcg.exe
  2⤵
  PID:6852
- C:\Windows\System\PdRKSUN.exe
  C:\Windows\System\PdRKSUN.exe
  2⤵
  PID:6868
- C:\Windows\System\qIaPwzJ.exe
  C:\Windows\System\qIaPwzJ.exe
  2⤵
  PID:6884
- C:\Windows\System\YYqfyZU.exe
  C:\Windows\System\YYqfyZU.exe
  2⤵
  PID:6900
- C:\Windows\System\zKlxZTZ.exe
  C:\Windows\System\zKlxZTZ.exe
  2⤵
  PID:6916
- C:\Windows\System\eejjaCp.exe
  C:\Windows\System\eejjaCp.exe
  2⤵
  PID:6932
- C:\Windows\System\iuWHKeK.exe
  C:\Windows\System\iuWHKeK.exe
  2⤵
  PID:6948
- C:\Windows\System\cLoElsW.exe
  C:\Windows\System\cLoElsW.exe
  2⤵
  PID:6964
- C:\Windows\System\UhOppZd.exe
  C:\Windows\System\UhOppZd.exe
  2⤵
  PID:6980
- C:\Windows\System\UwGbAjF.exe
  C:\Windows\System\UwGbAjF.exe
  2⤵
  PID:6996
- C:\Windows\System\fCfbZdS.exe
  C:\Windows\System\fCfbZdS.exe
  2⤵
  PID:7012
- C:\Windows\System\EzuFNdL.exe
  C:\Windows\System\EzuFNdL.exe
  2⤵
  PID:7028
- C:\Windows\System\OjLRdpv.exe
  C:\Windows\System\OjLRdpv.exe
  2⤵
  PID:7044
- C:\Windows\System\mHcFpFr.exe
  C:\Windows\System\mHcFpFr.exe
  2⤵
  PID:7060
- C:\Windows\System\AgKEHBi.exe
  C:\Windows\System\AgKEHBi.exe
  2⤵
  PID:7076
- C:\Windows\System\LUgRNKD.exe
  C:\Windows\System\LUgRNKD.exe
  2⤵
  PID:7092
- C:\Windows\System\HhcVyYO.exe
  C:\Windows\System\HhcVyYO.exe
  2⤵
  PID:7108
- C:\Windows\System\wtITOFH.exe
  C:\Windows\System\wtITOFH.exe
  2⤵
  PID:7124
- C:\Windows\System\uXzAgNW.exe
  C:\Windows\System\uXzAgNW.exe
  2⤵
  PID:7140
- C:\Windows\System\ONqWqYG.exe
  C:\Windows\System\ONqWqYG.exe
  2⤵
  PID:7156
- C:\Windows\System\CCJKthn.exe
  C:\Windows\System\CCJKthn.exe
  2⤵
  PID:5840
- C:\Windows\System\CFmeXJV.exe
  C:\Windows\System\CFmeXJV.exe
  2⤵
  PID:6080
- C:\Windows\System\WAHtidb.exe
  C:\Windows\System\WAHtidb.exe
  2⤵
  PID:2708
- C:\Windows\System\BozeYmI.exe
  C:\Windows\System\BozeYmI.exe
  2⤵
  PID:6188
- C:\Windows\System\tWFqGfT.exe
  C:\Windows\System\tWFqGfT.exe
  2⤵
  PID:2472
- C:\Windows\System\FhRIjdm.exe
  C:\Windows\System\FhRIjdm.exe
  2⤵
  PID:6256
- C:\Windows\System\ALTHgZb.exe
  C:\Windows\System\ALTHgZb.exe
  2⤵
  PID:6320
- C:\Windows\System\tPbksEp.exe
  C:\Windows\System\tPbksEp.exe
  2⤵
  PID:6384
- C:\Windows\System\AtOUZzb.exe
  C:\Windows\System\AtOUZzb.exe
  2⤵
  PID:6444
- C:\Windows\System\nKLphez.exe
  C:\Windows\System\nKLphez.exe
  2⤵
  PID:5792
- C:\Windows\System\WhTFAup.exe
  C:\Windows\System\WhTFAup.exe
  2⤵
  PID:5968
- C:\Windows\System\EPYRfaj.exe
  C:\Windows\System\EPYRfaj.exe
  2⤵
  PID:5392
- C:\Windows\System\TQKIuMY.exe
  C:\Windows\System\TQKIuMY.exe
  2⤵
  PID:2196
- C:\Windows\System\dbvOqbA.exe
  C:\Windows\System\dbvOqbA.exe
  2⤵
  PID:6204
- C:\Windows\System\ykHEDLu.exe
  C:\Windows\System\ykHEDLu.exe
  2⤵
  PID:6272
- C:\Windows\System\GseAzKP.exe
  C:\Windows\System\GseAzKP.exe
  2⤵
  PID:6336
- C:\Windows\System\uUlBSGT.exe
  C:\Windows\System\uUlBSGT.exe
  2⤵
  PID:6428
- C:\Windows\System\TZUMmyt.exe
  C:\Windows\System\TZUMmyt.exe
  2⤵
  PID:6492
- C:\Windows\System\QTPhRvT.exe
  C:\Windows\System\QTPhRvT.exe
  2⤵
  PID:6476
- C:\Windows\System\wavBgfu.exe
  C:\Windows\System\wavBgfu.exe
  2⤵
  PID:6540
- C:\Windows\System\MppSvvc.exe
  C:\Windows\System\MppSvvc.exe
  2⤵
  PID:6608
- C:\Windows\System\KbCFfLF.exe
  C:\Windows\System\KbCFfLF.exe
  2⤵
  PID:6588
- C:\Windows\System\lkVxstu.exe
  C:\Windows\System\lkVxstu.exe
  2⤵
  PID:6624
- C:\Windows\System\BeFoqku.exe
  C:\Windows\System\BeFoqku.exe
  2⤵
  PID:6652
- C:\Windows\System\cNGwTUC.exe
  C:\Windows\System\cNGwTUC.exe
  2⤵
  PID:6704
- C:\Windows\System\TcuegzD.exe
  C:\Windows\System\TcuegzD.exe
  2⤵
  PID:6796
- C:\Windows\System\Zwymzqd.exe
  C:\Windows\System\Zwymzqd.exe
  2⤵
  PID:6656
- C:\Windows\System\DqVmmyU.exe
  C:\Windows\System\DqVmmyU.exe
  2⤵
  PID:6752
- C:\Windows\System\VfEGdhL.exe
  C:\Windows\System\VfEGdhL.exe
  2⤵
  PID:6816
- C:\Windows\System\wqUjapT.exe
  C:\Windows\System\wqUjapT.exe
  2⤵
  PID:6864
- C:\Windows\System\RkmUZVp.exe
  C:\Windows\System\RkmUZVp.exe
  2⤵
  PID:6848
- C:\Windows\System\ybivVNy.exe
  C:\Windows\System\ybivVNy.exe
  2⤵
  PID:6908
- C:\Windows\System\JCEciCa.exe
  C:\Windows\System\JCEciCa.exe
  2⤵
  PID:6928
- C:\Windows\System\Hcuprkq.exe
  C:\Windows\System\Hcuprkq.exe
  2⤵
  PID:6992
- C:\Windows\System\jGofSZC.exe
  C:\Windows\System\jGofSZC.exe
  2⤵
  PID:7056
- C:\Windows\System\egaQncc.exe
  C:\Windows\System\egaQncc.exe
  2⤵
  PID:6972
- C:\Windows\System\xCNzQfk.exe
  C:\Windows\System\xCNzQfk.exe
  2⤵
  PID:7100
- C:\Windows\System\jSCMwyY.exe
  C:\Windows\System\jSCMwyY.exe
  2⤵
  PID:7072
- C:\Windows\System\mpoTCAv.exe
  C:\Windows\System\mpoTCAv.exe
  2⤵
  PID:7152
- C:\Windows\System\twbkIhy.exe
  C:\Windows\System\twbkIhy.exe
  2⤵
  PID:2512
- C:\Windows\System\WMNPOFw.exe
  C:\Windows\System\WMNPOFw.exe
  2⤵
  PID:5376
- C:\Windows\System\YRgbCDj.exe
  C:\Windows\System\YRgbCDj.exe
  2⤵
  PID:6352
- C:\Windows\System\lSxVGjI.exe
  C:\Windows\System\lSxVGjI.exe
  2⤵
  PID:6252
- C:\Windows\System\YvMremD.exe
  C:\Windows\System\YvMremD.exe
  2⤵
  PID:6176
- C:\Windows\System\PSRBTUa.exe
  C:\Windows\System\PSRBTUa.exe
  2⤵
  PID:6448
- C:\Windows\System\mPMcOkH.exe
  C:\Windows\System\mPMcOkH.exe
  2⤵
  PID:6672
- C:\Windows\System\KBSCsdP.exe
  C:\Windows\System\KBSCsdP.exe
  2⤵
  PID:6732
- C:\Windows\System\ihwktKi.exe
  C:\Windows\System\ihwktKi.exe
  2⤵
  PID:6860
- C:\Windows\System\nvdpAtP.exe
  C:\Windows\System\nvdpAtP.exe
  2⤵
  PID:6988
- C:\Windows\System\vPiWkOZ.exe
  C:\Windows\System\vPiWkOZ.exe
  2⤵
  PID:7068
- C:\Windows\System\LHULKVZ.exe
  C:\Windows\System\LHULKVZ.exe
  2⤵
  PID:6192
- C:\Windows\System\LoSIUtc.exe
  C:\Windows\System\LoSIUtc.exe
  2⤵
  PID:6512
- C:\Windows\System\puLpIJM.exe
  C:\Windows\System\puLpIJM.exe
  2⤵
  PID:6224
- C:\Windows\System\eVHHugq.exe
  C:\Windows\System\eVHHugq.exe
  2⤵
  PID:6668
- C:\Windows\System\ChcToyq.exe
  C:\Windows\System\ChcToyq.exe
  2⤵
  PID:5648
- C:\Windows\System\LprDZSu.exe
  C:\Windows\System\LprDZSu.exe
  2⤵
  PID:6236
- C:\Windows\System\BKyQNPg.exe
  C:\Windows\System\BKyQNPg.exe
  2⤵
  PID:6464
- C:\Windows\System\bjMjvrZ.exe
  C:\Windows\System\bjMjvrZ.exe
  2⤵
  PID:2092
- C:\Windows\System\gemeRZI.exe
  C:\Windows\System\gemeRZI.exe
  2⤵
  PID:7036
- C:\Windows\System\kEBBZYR.exe
  C:\Windows\System\kEBBZYR.exe
  2⤵
  PID:6684
- C:\Windows\System\IbNldLa.exe
  C:\Windows\System\IbNldLa.exe
  2⤵
  PID:6620
- C:\Windows\System\MHnSxpA.exe
  C:\Windows\System\MHnSxpA.exe
  2⤵
  PID:6172
- C:\Windows\System\xooEZcH.exe
  C:\Windows\System\xooEZcH.exe
  2⤵
  PID:7176
- C:\Windows\System\UCWVQwl.exe
  C:\Windows\System\UCWVQwl.exe
  2⤵
  PID:7192
- C:\Windows\System\dHyjNjc.exe
  C:\Windows\System\dHyjNjc.exe
  2⤵
  PID:7208
- C:\Windows\System\UxxAOMA.exe
  C:\Windows\System\UxxAOMA.exe
  2⤵
  PID:7224
- C:\Windows\System\esCoHKX.exe
  C:\Windows\System\esCoHKX.exe
  2⤵
  PID:7240
- C:\Windows\System\cpkcJIS.exe
  C:\Windows\System\cpkcJIS.exe
  2⤵
  PID:7256
- C:\Windows\System\QsCICNB.exe
  C:\Windows\System\QsCICNB.exe
  2⤵
  PID:7272
- C:\Windows\System\XWgEYmt.exe
  C:\Windows\System\XWgEYmt.exe
  2⤵
  PID:7288
- C:\Windows\System\ZAkvzJh.exe
  C:\Windows\System\ZAkvzJh.exe
  2⤵
  PID:7304
- C:\Windows\System\NWgPgli.exe
  C:\Windows\System\NWgPgli.exe
  2⤵
  PID:7320
- C:\Windows\System\KMnQXqq.exe
  C:\Windows\System\KMnQXqq.exe
  2⤵
  PID:7336
- C:\Windows\System\NQaWqKH.exe
  C:\Windows\System\NQaWqKH.exe
  2⤵
  PID:7352
- C:\Windows\System\JjfCTwS.exe
  C:\Windows\System\JjfCTwS.exe
  2⤵
  PID:7368
- C:\Windows\System\mVocGam.exe
  C:\Windows\System\mVocGam.exe
  2⤵
  PID:7384
- C:\Windows\System\oMEzjrw.exe
  C:\Windows\System\oMEzjrw.exe
  2⤵
  PID:7400
- C:\Windows\System\knvEXKp.exe
  C:\Windows\System\knvEXKp.exe
  2⤵
  PID:7416
- C:\Windows\System\ZvXqfTE.exe
  C:\Windows\System\ZvXqfTE.exe
  2⤵
  PID:7432
- C:\Windows\System\CJXsVgZ.exe
  C:\Windows\System\CJXsVgZ.exe
  2⤵
  PID:7448
- C:\Windows\System\uGlBtzB.exe
  C:\Windows\System\uGlBtzB.exe
  2⤵
  PID:7464
- C:\Windows\System\xlBAPqg.exe
  C:\Windows\System\xlBAPqg.exe
  2⤵
  PID:7480
- C:\Windows\System\mTyeCCY.exe
  C:\Windows\System\mTyeCCY.exe
  2⤵
  PID:7496
- C:\Windows\System\JqbQGEH.exe
  C:\Windows\System\JqbQGEH.exe
  2⤵
  PID:7512
- C:\Windows\System\jbgROIW.exe
  C:\Windows\System\jbgROIW.exe
  2⤵
  PID:7528
- C:\Windows\System\HACPRlS.exe
  C:\Windows\System\HACPRlS.exe
  2⤵
  PID:7544
- C:\Windows\System\KxknhTF.exe
  C:\Windows\System\KxknhTF.exe
  2⤵
  PID:7560
- C:\Windows\System\JLUCLbU.exe
  C:\Windows\System\JLUCLbU.exe
  2⤵
  PID:7576
- C:\Windows\System\onssxqy.exe
  C:\Windows\System\onssxqy.exe
  2⤵
  PID:7592
- C:\Windows\System\AdeQejW.exe
  C:\Windows\System\AdeQejW.exe
  2⤵
  PID:7608
- C:\Windows\System\TuZCYrw.exe
  C:\Windows\System\TuZCYrw.exe
  2⤵
  PID:7624
- C:\Windows\System\sLyCejz.exe
  C:\Windows\System\sLyCejz.exe
  2⤵
  PID:7640
- C:\Windows\System\asKbKkF.exe
  C:\Windows\System\asKbKkF.exe
  2⤵
  PID:7656
- C:\Windows\System\VyoOftV.exe
  C:\Windows\System\VyoOftV.exe
  2⤵
  PID:7672
- C:\Windows\System\zmGLqFH.exe
  C:\Windows\System\zmGLqFH.exe
  2⤵
  PID:7688
- C:\Windows\System\PoRkrzR.exe
  C:\Windows\System\PoRkrzR.exe
  2⤵
  PID:7704
- C:\Windows\System\gwuBWGb.exe
  C:\Windows\System\gwuBWGb.exe
  2⤵
  PID:7720
- C:\Windows\System\bfTVwLL.exe
  C:\Windows\System\bfTVwLL.exe
  2⤵
  PID:7736
- C:\Windows\System\oslXVST.exe
  C:\Windows\System\oslXVST.exe
  2⤵
  PID:7752
- C:\Windows\System\iQkkrHG.exe
  C:\Windows\System\iQkkrHG.exe
  2⤵
  PID:7768
- C:\Windows\System\SwhRvaK.exe
  C:\Windows\System\SwhRvaK.exe
  2⤵
  PID:7784
- C:\Windows\System\jjszZYW.exe
  C:\Windows\System\jjszZYW.exe
  2⤵
  PID:7800
- C:\Windows\System\txXJUpU.exe
  C:\Windows\System\txXJUpU.exe
  2⤵
  PID:7816
- C:\Windows\System\KpNYwql.exe
  C:\Windows\System\KpNYwql.exe
  2⤵
  PID:7832
- C:\Windows\System\emhVjwp.exe
  C:\Windows\System\emhVjwp.exe
  2⤵
  PID:7848
- C:\Windows\System\JQrQweA.exe
  C:\Windows\System\JQrQweA.exe
  2⤵
  PID:7864
- C:\Windows\System\SlIsgWe.exe
  C:\Windows\System\SlIsgWe.exe
  2⤵
  PID:7880
- C:\Windows\System\WSkWGZc.exe
  C:\Windows\System\WSkWGZc.exe
  2⤵
  PID:7896
- C:\Windows\System\kpkaWxs.exe
  C:\Windows\System\kpkaWxs.exe
  2⤵
  PID:7912
- C:\Windows\System\SJCnJet.exe
  C:\Windows\System\SJCnJet.exe
  2⤵
  PID:7928
- C:\Windows\System\tlOwJze.exe
  C:\Windows\System\tlOwJze.exe
  2⤵
  PID:7944
- C:\Windows\System\tvcgXBg.exe
  C:\Windows\System\tvcgXBg.exe
  2⤵
  PID:7960
- C:\Windows\System\avqxTLW.exe
  C:\Windows\System\avqxTLW.exe
  2⤵
  PID:7976
- C:\Windows\System\maBHfjn.exe
  C:\Windows\System\maBHfjn.exe
  2⤵
  PID:7992
- C:\Windows\System\xSjlhCo.exe
  C:\Windows\System\xSjlhCo.exe
  2⤵
  PID:8008
- C:\Windows\System\RXoUBrF.exe
  C:\Windows\System\RXoUBrF.exe
  2⤵
  PID:8024
- C:\Windows\System\mUFHncX.exe
  C:\Windows\System\mUFHncX.exe
  2⤵
  PID:8040
- C:\Windows\System\hHeILvs.exe
  C:\Windows\System\hHeILvs.exe
  2⤵
  PID:8056
- C:\Windows\System\RdcLYQL.exe
  C:\Windows\System\RdcLYQL.exe
  2⤵
  PID:8072
- C:\Windows\System\HQfGbVq.exe
  C:\Windows\System\HQfGbVq.exe
  2⤵
  PID:8088
- C:\Windows\System\KbWGCZI.exe
  C:\Windows\System\KbWGCZI.exe
  2⤵
  PID:8104
- C:\Windows\System\rigdFGG.exe
  C:\Windows\System\rigdFGG.exe
  2⤵
  PID:8120
- C:\Windows\System\uoAWCgv.exe
  C:\Windows\System\uoAWCgv.exe
  2⤵
  PID:8136
- C:\Windows\System\gTShWDx.exe
  C:\Windows\System\gTShWDx.exe
  2⤵
  PID:8152
- C:\Windows\System\jynLfqS.exe
  C:\Windows\System\jynLfqS.exe
  2⤵
  PID:8168
- C:\Windows\System\WprjcQc.exe
  C:\Windows\System\WprjcQc.exe
  2⤵
  PID:8184
- C:\Windows\System\nTFvTum.exe
  C:\Windows\System\nTFvTum.exe
  2⤵
  PID:7216
- C:\Windows\System\HeAQNDM.exe
  C:\Windows\System\HeAQNDM.exe
  2⤵
  PID:6876
- C:\Windows\System\LWIsKij.exe
  C:\Windows\System\LWIsKij.exe
  2⤵
  PID:7052
- C:\Windows\System\qOouRxY.exe
  C:\Windows\System\qOouRxY.exe
  2⤵
  PID:7148
- C:\Windows\System\EBABfCS.exe
  C:\Windows\System\EBABfCS.exe
  2⤵
  PID:6332
- C:\Windows\System\eVcukvr.exe
  C:\Windows\System\eVcukvr.exe
  2⤵
  PID:7280
- C:\Windows\System\jfWlJVr.exe
  C:\Windows\System\jfWlJVr.exe
  2⤵
  PID:6560
- C:\Windows\System\qzqxHBQ.exe
  C:\Windows\System\qzqxHBQ.exe
  2⤵
  PID:5776
- C:\Windows\System\GIsLAWR.exe
  C:\Windows\System\GIsLAWR.exe
  2⤵
  PID:6400
- C:\Windows\System\OFzMuok.exe
  C:\Windows\System\OFzMuok.exe
  2⤵
  PID:6940
- C:\Windows\System\fqhQyRO.exe
  C:\Windows\System\fqhQyRO.exe
  2⤵
  PID:7200
- C:\Windows\System\dEiHszd.exe
  C:\Windows\System\dEiHszd.exe
  2⤵
  PID:7284
- C:\Windows\System\smVooBU.exe
  C:\Windows\System\smVooBU.exe
  2⤵
  PID:7316
- C:\Windows\System\LVgbLbE.exe
  C:\Windows\System\LVgbLbE.exe
  2⤵
  PID:7360
- C:\Windows\System\xFABfoN.exe
  C:\Windows\System\xFABfoN.exe
  2⤵
  PID:7380
- C:\Windows\System\Volornh.exe
  C:\Windows\System\Volornh.exe
  2⤵
  PID:7428
- C:\Windows\System\YErIxgF.exe
  C:\Windows\System\YErIxgF.exe
  2⤵
  PID:7508
- C:\Windows\System\EXOqDBf.exe
  C:\Windows\System\EXOqDBf.exe
  2⤵
  PID:7412
- C:\Windows\System\sbqttkZ.exe
  C:\Windows\System\sbqttkZ.exe
  2⤵
  PID:7476
- C:\Windows\System\LfyYdUZ.exe
  C:\Windows\System\LfyYdUZ.exe
  2⤵
  PID:7568
- C:\Windows\System\BUTcGGZ.exe
  C:\Windows\System\BUTcGGZ.exe
  2⤵
  PID:7552
- C:\Windows\System\lFnRZSG.exe
  C:\Windows\System\lFnRZSG.exe
  2⤵
  PID:7648
- C:\Windows\System\CVeOvwd.exe
  C:\Windows\System\CVeOvwd.exe
  2⤵
  PID:7668
- C:\Windows\System\oaNTBaE.exe
  C:\Windows\System\oaNTBaE.exe
  2⤵
  PID:7700
- C:\Windows\System\XdeRXRJ.exe
  C:\Windows\System\XdeRXRJ.exe
  2⤵
  PID:7764
- C:\Windows\System\NsZunyp.exe
  C:\Windows\System\NsZunyp.exe
  2⤵
  PID:7824
- C:\Windows\System\rblgVhp.exe
  C:\Windows\System\rblgVhp.exe
  2⤵
  PID:7860
- C:\Windows\System\TVmeREM.exe
  C:\Windows\System\TVmeREM.exe
  2⤵
  PID:7892
- C:\Windows\System\fsKFFny.exe
  C:\Windows\System\fsKFFny.exe
  2⤵
  PID:7716
- C:\Windows\System\PzbGcgw.exe
  C:\Windows\System\PzbGcgw.exe
  2⤵
  PID:7808
- C:\Windows\System\JhKFuqz.exe
  C:\Windows\System\JhKFuqz.exe
  2⤵
  PID:7780
- C:\Windows\System\DPeMrqU.exe
  C:\Windows\System\DPeMrqU.exe
  2⤵
  PID:8020
- C:\Windows\System\wjPudjj.exe
  C:\Windows\System\wjPudjj.exe
  2⤵
  PID:7840
- C:\Windows\System\xZjOgUJ.exe
  C:\Windows\System\xZjOgUJ.exe
  2⤵
  PID:8116
- C:\Windows\System\KpblMQH.exe
  C:\Windows\System\KpblMQH.exe
  2⤵
  PID:7972
- C:\Windows\System\SoEtCAy.exe
  C:\Windows\System\SoEtCAy.exe
  2⤵
  PID:8180
- C:\Windows\System\CnzNzlQ.exe
  C:\Windows\System\CnzNzlQ.exe
  2⤵
  PID:6784
- C:\Windows\System\yoikkdW.exe
  C:\Windows\System\yoikkdW.exe
  2⤵
  PID:7968
- C:\Windows\System\ETzgSsg.exe
  C:\Windows\System\ETzgSsg.exe
  2⤵
  PID:8000
- C:\Windows\System\VUxjkQZ.exe
  C:\Windows\System\VUxjkQZ.exe
  2⤵
  PID:6960
- C:\Windows\System\bgxTKiX.exe
  C:\Windows\System\bgxTKiX.exe
  2⤵
  PID:8068
- C:\Windows\System\sCCGclF.exe
  C:\Windows\System\sCCGclF.exe
  2⤵
  PID:7232
- C:\Windows\System\tAdfoQo.exe
  C:\Windows\System\tAdfoQo.exe
  2⤵
  PID:7184
- C:\Windows\System\xNahuhT.exe
  C:\Windows\System\xNahuhT.exe
  2⤵
  PID:7344
- C:\Windows\System\AgmhhUA.exe
  C:\Windows\System\AgmhhUA.exe
  2⤵
  PID:6640
- C:\Windows\System\aHUoPkT.exe
  C:\Windows\System\aHUoPkT.exe
  2⤵
  PID:7348
- C:\Windows\System\upqYrCu.exe
  C:\Windows\System\upqYrCu.exe
  2⤵
  PID:7396
- C:\Windows\System\rIVUDfQ.exe
  C:\Windows\System\rIVUDfQ.exe
  2⤵
  PID:7408
- C:\Windows\System\TnKmHvQ.exe
  C:\Windows\System\TnKmHvQ.exe
  2⤵
  PID:7604
- C:\Windows\System\BZedFbn.exe
  C:\Windows\System\BZedFbn.exe
  2⤵
  PID:7732
- C:\Windows\System\tBqxIvb.exe
  C:\Windows\System\tBqxIvb.exe
  2⤵
  PID:7600
- C:\Windows\System\NgMBPgT.exe
  C:\Windows\System\NgMBPgT.exe
  2⤵
  PID:7728
- C:\Windows\System\tBOsDGg.exe
  C:\Windows\System\tBOsDGg.exe
  2⤵
  PID:7684
- C:\Windows\System\rxzgqRH.exe
  C:\Windows\System\rxzgqRH.exe
  2⤵
  PID:7856
- C:\Windows\System\ICKqktK.exe
  C:\Windows\System\ICKqktK.exe
  2⤵
  PID:8052
- C:\Windows\System\BmLfXmy.exe
  C:\Windows\System\BmLfXmy.exe
  2⤵
  PID:8084
- C:\Windows\System\zFhncXT.exe
  C:\Windows\System\zFhncXT.exe
  2⤵
  PID:8176
- C:\Windows\System\YTZDdel.exe
  C:\Windows\System\YTZDdel.exe
  2⤵
  PID:8148
- C:\Windows\System\WTiksta.exe
  C:\Windows\System\WTiksta.exe
  2⤵
  PID:8032
- C:\Windows\System\SXwTVxI.exe
  C:\Windows\System\SXwTVxI.exe
  2⤵
  PID:7024
- C:\Windows\System\EecPiWq.exe
  C:\Windows\System\EecPiWq.exe
  2⤵
  PID:5552
- C:\Windows\System\bsTsIew.exe
  C:\Windows\System\bsTsIew.exe
  2⤵
  PID:8164
- C:\Windows\System\mSgOpXb.exe
  C:\Windows\System\mSgOpXb.exe
  2⤵
  PID:7616
- C:\Windows\System\YlKhtNd.exe
  C:\Windows\System\YlKhtNd.exe
  2⤵
  PID:7424
- C:\Windows\System\UiOdXeD.exe
  C:\Windows\System\UiOdXeD.exe
  2⤵
  PID:7296
- C:\Windows\System\gcRmeBT.exe
  C:\Windows\System\gcRmeBT.exe
  2⤵
  PID:8080
- C:\Windows\System\IQVRsqo.exe
  C:\Windows\System\IQVRsqo.exe
  2⤵
  PID:7760
- C:\Windows\System\bjrrKRj.exe
  C:\Windows\System\bjrrKRj.exe
  2⤵
  PID:7952
- C:\Windows\System\jKbYDdh.exe
  C:\Windows\System\jKbYDdh.exe
  2⤵
  PID:7940
- C:\Windows\System\zUoIAui.exe
  C:\Windows\System\zUoIAui.exe
  2⤵
  PID:1516
- C:\Windows\System\AqHarBl.exe
  C:\Windows\System\AqHarBl.exe
  2⤵
  PID:6720
- C:\Windows\System\rMGgunP.exe
  C:\Windows\System\rMGgunP.exe
  2⤵
  PID:8208
- C:\Windows\System\GutqJgX.exe
  C:\Windows\System\GutqJgX.exe
  2⤵
  PID:8224
- C:\Windows\System\chpyLfV.exe
  C:\Windows\System\chpyLfV.exe
  2⤵
  PID:8240
- C:\Windows\System\jzXciOc.exe
  C:\Windows\System\jzXciOc.exe
  2⤵
  PID:8256
- C:\Windows\System\tjpMfoF.exe
  C:\Windows\System\tjpMfoF.exe
  2⤵
  PID:8272
- C:\Windows\System\hienVYd.exe
  C:\Windows\System\hienVYd.exe
  2⤵
  PID:8304
- C:\Windows\System\PcwREIE.exe
  C:\Windows\System\PcwREIE.exe
  2⤵
  PID:8320
- C:\Windows\System\wXaPiTF.exe
  C:\Windows\System\wXaPiTF.exe
  2⤵
  PID:8336
- C:\Windows\System\DeNanLC.exe
  C:\Windows\System\DeNanLC.exe
  2⤵
  PID:8352
- C:\Windows\System\WMvmMCX.exe
  C:\Windows\System\WMvmMCX.exe
  2⤵
  PID:8368
- C:\Windows\System\iNfaEsy.exe
  C:\Windows\System\iNfaEsy.exe
  2⤵
  PID:8384
- C:\Windows\System\OWLJbRg.exe
  C:\Windows\System\OWLJbRg.exe
  2⤵
  PID:8400
- C:\Windows\System\rknnnFg.exe
  C:\Windows\System\rknnnFg.exe
  2⤵
  PID:8420
- C:\Windows\System\xtWMqSL.exe
  C:\Windows\System\xtWMqSL.exe
  2⤵
  PID:8436
- C:\Windows\System\EeznFsH.exe
  C:\Windows\System\EeznFsH.exe
  2⤵
  PID:8452
- C:\Windows\System\DLCckPZ.exe
  C:\Windows\System\DLCckPZ.exe
  2⤵
  PID:8468
- C:\Windows\System\bZlBlqW.exe
  C:\Windows\System\bZlBlqW.exe
  2⤵
  PID:8484
- C:\Windows\System\KsVyzQY.exe
  C:\Windows\System\KsVyzQY.exe
  2⤵
  PID:8500
- C:\Windows\System\jGswqrj.exe
  C:\Windows\System\jGswqrj.exe
  2⤵
  PID:8516
- C:\Windows\System\tXPIVIS.exe
  C:\Windows\System\tXPIVIS.exe
  2⤵
  PID:8532
- C:\Windows\System\CAqvxiz.exe
  C:\Windows\System\CAqvxiz.exe
  2⤵
  PID:8548
- C:\Windows\System\gCdxUip.exe
  C:\Windows\System\gCdxUip.exe
  2⤵
  PID:8568
- C:\Windows\System\WdUZfxU.exe
  C:\Windows\System\WdUZfxU.exe
  2⤵
  PID:8584
- C:\Windows\System\BPjBFCt.exe
  C:\Windows\System\BPjBFCt.exe
  2⤵
  PID:8604
- C:\Windows\System\OdFHyXT.exe
  C:\Windows\System\OdFHyXT.exe
  2⤵
  PID:8620
- C:\Windows\System\NvwZpkl.exe
  C:\Windows\System\NvwZpkl.exe
  2⤵
  PID:8636
- C:\Windows\System\cHanXDA.exe
  C:\Windows\System\cHanXDA.exe
  2⤵
  PID:8720
- C:\Windows\System\acdKGpV.exe
  C:\Windows\System\acdKGpV.exe
  2⤵
  PID:8736
- C:\Windows\System\EUFgtxY.exe
  C:\Windows\System\EUFgtxY.exe
  2⤵
  PID:8756
- C:\Windows\System\lrktoPS.exe
  C:\Windows\System\lrktoPS.exe
  2⤵
  PID:8772
- C:\Windows\System\FqNHupc.exe
  C:\Windows\System\FqNHupc.exe
  2⤵
  PID:8788
- C:\Windows\System\fTMQvQO.exe
  C:\Windows\System\fTMQvQO.exe
  2⤵
  PID:8804
- C:\Windows\System\wGItyEo.exe
  C:\Windows\System\wGItyEo.exe
  2⤵
  PID:8820
- C:\Windows\System\JmQQmQh.exe
  C:\Windows\System\JmQQmQh.exe
  2⤵
  PID:8840
- C:\Windows\System\mMcFnKc.exe
  C:\Windows\System\mMcFnKc.exe
  2⤵
  PID:8856
- C:\Windows\System\erZIjpC.exe
  C:\Windows\System\erZIjpC.exe
  2⤵
  PID:8932
- C:\Windows\System\pOqBulw.exe
  C:\Windows\System\pOqBulw.exe
  2⤵
  PID:8956
- C:\Windows\System\LYuXhBh.exe
  C:\Windows\System\LYuXhBh.exe
  2⤵
  PID:8972
- C:\Windows\System\JjgqxcU.exe
  C:\Windows\System\JjgqxcU.exe
  2⤵
  PID:9048
- C:\Windows\System\mZFvsVR.exe
  C:\Windows\System\mZFvsVR.exe
  2⤵
  PID:9064
- C:\Windows\System\NkKWQuD.exe
  C:\Windows\System\NkKWQuD.exe
  2⤵
  PID:9080
- C:\Windows\System\xJqfGnX.exe
  C:\Windows\System\xJqfGnX.exe
  2⤵
  PID:9104
- C:\Windows\System\HsqbWAt.exe
  C:\Windows\System\HsqbWAt.exe
  2⤵
  PID:9120
- C:\Windows\System\uabQezv.exe
  C:\Windows\System\uabQezv.exe
  2⤵
  PID:9136
- C:\Windows\System\DYPiBHJ.exe
  C:\Windows\System\DYPiBHJ.exe
  2⤵
  PID:9152
- C:\Windows\System\tVehLFb.exe
  C:\Windows\System\tVehLFb.exe
  2⤵
  PID:9200
- C:\Windows\System\PWhntrj.exe
  C:\Windows\System\PWhntrj.exe
  2⤵
  PID:8016
- C:\Windows\System\khJXVmF.exe
  C:\Windows\System\khJXVmF.exe
  2⤵
  PID:8132
- C:\Windows\System\eZGDmas.exe
  C:\Windows\System\eZGDmas.exe
  2⤵
  PID:8268
- C:\Windows\System\cLmavKx.exe
  C:\Windows\System\cLmavKx.exe
  2⤵
  PID:8344
- C:\Windows\System\CUpqSzF.exe
  C:\Windows\System\CUpqSzF.exe
  2⤵
  PID:8380
- C:\Windows\System\GKGFbES.exe
  C:\Windows\System\GKGFbES.exe
  2⤵
  PID:8448
- C:\Windows\System\gkRkGBF.exe
  C:\Windows\System\gkRkGBF.exe
  2⤵
  PID:8512
- C:\Windows\System\TFfCJmw.exe
  C:\Windows\System\TFfCJmw.exe
  2⤵
  PID:8580
- C:\Windows\System\dQwfgWs.exe
  C:\Windows\System\dQwfgWs.exe
  2⤵
  PID:8248
- C:\Windows\System\aKjTBTn.exe
  C:\Windows\System\aKjTBTn.exe
  2⤵
  PID:8296
- C:\Windows\System\wcvBapy.exe
  C:\Windows\System\wcvBapy.exe
  2⤵
  PID:8496
- C:\Windows\System\oHTkrem.exe
  C:\Windows\System\oHTkrem.exe
  2⤵
  PID:7328
- C:\Windows\System\FWHhtRr.exe
  C:\Windows\System\FWHhtRr.exe
  2⤵
  PID:7936
- C:\Windows\System\INHVzOr.exe
  C:\Windows\System\INHVzOr.exe
  2⤵
  PID:8252
- C:\Windows\System\SCqYkub.exe
  C:\Windows\System\SCqYkub.exe
  2⤵
  PID:8332
- C:\Windows\System\KYlkWqR.exe
  C:\Windows\System\KYlkWqR.exe
  2⤵
  PID:8432
- C:\Windows\System\PxIFZaz.exe
  C:\Windows\System\PxIFZaz.exe
  2⤵
  PID:8300
- C:\Windows\System\SyeutyT.exe
  C:\Windows\System\SyeutyT.exe
  2⤵
  PID:8600
- C:\Windows\System\IqUJovC.exe
  C:\Windows\System\IqUJovC.exe
  2⤵
  PID:8660
- C:\Windows\System\QLSBvXv.exe
  C:\Windows\System\QLSBvXv.exe
  2⤵
  PID:8616
- C:\Windows\System\PRkqYkv.exe
  C:\Windows\System\PRkqYkv.exe
  2⤵
  PID:8684
- C:\Windows\System\HulXwbZ.exe
  C:\Windows\System\HulXwbZ.exe
  2⤵
  PID:8700
- C:\Windows\System\gdpYjib.exe
  C:\Windows\System\gdpYjib.exe
  2⤵
  PID:8744
- C:\Windows\System\PaNEtqX.exe
  C:\Windows\System\PaNEtqX.exe
  2⤵
  PID:8748
- C:\Windows\System\qBkHjqK.exe
  C:\Windows\System\qBkHjqK.exe
  2⤵
  PID:8848
- C:\Windows\System\MaeABmZ.exe
  C:\Windows\System\MaeABmZ.exe
  2⤵
  PID:8764
- C:\Windows\System\eUgVRGf.exe
  C:\Windows\System\eUgVRGf.exe
  2⤵
  PID:8864
- C:\Windows\System\fSnTfoQ.exe
  C:\Windows\System\fSnTfoQ.exe
  2⤵
  PID:8868
- C:\Windows\System\KhGAVuM.exe
  C:\Windows\System\KhGAVuM.exe
  2⤵
  PID:8876
- C:\Windows\System\cJcMdQA.exe
  C:\Windows\System\cJcMdQA.exe
  2⤵
  PID:8892
- C:\Windows\System\bQsSPUV.exe
  C:\Windows\System\bQsSPUV.exe
  2⤵
  PID:8908
- C:\Windows\System\mbYSEcE.exe
  C:\Windows\System\mbYSEcE.exe
  2⤵
  PID:8924
- C:\Windows\System\yaUoCTf.exe
  C:\Windows\System\yaUoCTf.exe
  2⤵
  PID:8952
- C:\Windows\System\huAYcBU.exe
  C:\Windows\System\huAYcBU.exe
  2⤵
  PID:8992
- C:\Windows\System\yMrEEks.exe
  C:\Windows\System\yMrEEks.exe
  2⤵
  PID:9016
- C:\Windows\System\ZucHUoJ.exe
  C:\Windows\System\ZucHUoJ.exe
  2⤵
  PID:9028
- C:\Windows\System\FsxUkuM.exe
  C:\Windows\System\FsxUkuM.exe
  2⤵
  PID:9036
- C:\Windows\System\CUhLTRt.exe
  C:\Windows\System\CUhLTRt.exe
  2⤵
  PID:9076
- C:\Windows\System\PZPkzMh.exe
  C:\Windows\System\PZPkzMh.exe
  2⤵
  PID:9092
- C:\Windows\System\aymaHsQ.exe
  C:\Windows\System\aymaHsQ.exe
  2⤵
  PID:9144
- C:\Windows\System\oKaYfsN.exe
  C:\Windows\System\oKaYfsN.exe
  2⤵
  PID:9164
- C:\Windows\System\uOnnLpc.exe
  C:\Windows\System\uOnnLpc.exe
  2⤵
  PID:7984
- C:\Windows\System\OLDEteW.exe
  C:\Windows\System\OLDEteW.exe
  2⤵
  PID:8236
- C:\Windows\System\dVhHePJ.exe
  C:\Windows\System\dVhHePJ.exe
  2⤵
  PID:8444
- C:\Windows\System\oxUsGQM.exe
  C:\Windows\System\oxUsGQM.exe
  2⤵
  PID:8544
- C:\Windows\System\CunqWUV.exe
  C:\Windows\System\CunqWUV.exe
  2⤵
  PID:1992
- C:\Windows\System\pqCnemo.exe
  C:\Windows\System\pqCnemo.exe
  2⤵
  PID:8428
- C:\Windows\System\ynTCoID.exe
  C:\Windows\System\ynTCoID.exe
  2⤵
  PID:8036
- C:\Windows\System\jCLmORc.exe
  C:\Windows\System\jCLmORc.exe
  2⤵
  PID:8288
- C:\Windows\System\oUCHsfg.exe
  C:\Windows\System\oUCHsfg.exe
  2⤵
  PID:8796
- C:\Windows\System\chRBUZT.exe
  C:\Windows\System\chRBUZT.exe
  2⤵
  PID:8948
- C:\Windows\System\NCnxjfM.exe
  C:\Windows\System\NCnxjfM.exe
  2⤵
  PID:8692
- C:\Windows\System\ezhaFTU.exe
  C:\Windows\System\ezhaFTU.exe
  2⤵
  PID:9160
- C:\Windows\System\vuNdnSF.exe
  C:\Windows\System\vuNdnSF.exe
  2⤵
  PID:8752
- C:\Windows\System\XhFBeRj.exe
  C:\Windows\System\XhFBeRj.exe
  2⤵
  PID:9056
- C:\Windows\System\XQsXtwL.exe
  C:\Windows\System\XQsXtwL.exe
  2⤵
  PID:8800
- C:\Windows\System\YSwMxIb.exe
  C:\Windows\System\YSwMxIb.exe
  2⤵
  PID:8880
- C:\Windows\System\eZqAwiX.exe
  C:\Windows\System\eZqAwiX.exe
  2⤵
  PID:8984
- C:\Windows\System\wcmGsIu.exe
  C:\Windows\System\wcmGsIu.exe
  2⤵
  PID:9060
- C:\Windows\System\hMKdvnp.exe
  C:\Windows\System\hMKdvnp.exe
  2⤵
  PID:8200
- C:\Windows\System\pbscpnH.exe
  C:\Windows\System\pbscpnH.exe
  2⤵
  PID:7444
- C:\Windows\System\zKEXxvM.exe
  C:\Windows\System\zKEXxvM.exe
  2⤵
  PID:8592
- C:\Windows\System\NHeufFF.exe
  C:\Windows\System\NHeufFF.exe
  2⤵
  PID:8712
- C:\Windows\System\rxUDkKT.exe
  C:\Windows\System\rxUDkKT.exe
  2⤵
  PID:8816
- C:\Windows\System\TZDyxXa.exe
  C:\Windows\System\TZDyxXa.exe
  2⤵
  PID:8904
- C:\Windows\System\soKKQEw.exe
  C:\Windows\System\soKKQEw.exe
  2⤵
  PID:8668
- C:\Windows\System\kcsNJGu.exe
  C:\Windows\System\kcsNJGu.exe
  2⤵
  PID:9024
- C:\Windows\System\EobxSKU.exe
  C:\Windows\System\EobxSKU.exe
  2⤵
  PID:8664
- C:\Windows\System\BormCRx.exe
  C:\Windows\System\BormCRx.exe
  2⤵
  PID:2396
- C:\Windows\System\ZjSqoRY.exe
  C:\Windows\System\ZjSqoRY.exe
  2⤵
  PID:8412
- C:\Windows\System\FmxBkKI.exe
  C:\Windows\System\FmxBkKI.exe
  2⤵
  PID:8416
- C:\Windows\System\ERLybRL.exe
  C:\Windows\System\ERLybRL.exe
  2⤵
  PID:8676
- C:\Windows\System\yiRStzH.exe
  C:\Windows\System\yiRStzH.exe
  2⤵
  PID:8560
- C:\Windows\System\kfUeZpU.exe
  C:\Windows\System\kfUeZpU.exe
  2⤵
  PID:8644
- C:\Windows\System\ctKamDO.exe
  C:\Windows\System\ctKamDO.exe
  2⤵
  PID:8704
- C:\Windows\System\UqUeVvP.exe
  C:\Windows\System\UqUeVvP.exe
  2⤵
  PID:8944
- C:\Windows\System\UgESwgq.exe
  C:\Windows\System\UgESwgq.exe
  2⤵
  PID:8348
- C:\Windows\System\sApUbbU.exe
  C:\Windows\System\sApUbbU.exe
  2⤵
  PID:8524
- C:\Windows\System\ZEykPkq.exe
  C:\Windows\System\ZEykPkq.exe
  2⤵
  PID:9224
- C:\Windows\System\HrhSUmZ.exe
  C:\Windows\System\HrhSUmZ.exe
  2⤵
  PID:9240
- C:\Windows\System\DphmjWm.exe
  C:\Windows\System\DphmjWm.exe
  2⤵
  PID:9256
- C:\Windows\System\hDQfJvZ.exe
  C:\Windows\System\hDQfJvZ.exe
  2⤵
  PID:9272
- C:\Windows\System\vZgQdil.exe
  C:\Windows\System\vZgQdil.exe
  2⤵
  PID:9288
- C:\Windows\System\iGbcXCe.exe
  C:\Windows\System\iGbcXCe.exe
  2⤵
  PID:9304
- C:\Windows\System\keWIrzt.exe
  C:\Windows\System\keWIrzt.exe
  2⤵
  PID:9320
- C:\Windows\System\ZwnCqYA.exe
  C:\Windows\System\ZwnCqYA.exe
  2⤵
  PID:9336
- C:\Windows\System\eVsQUpQ.exe
  C:\Windows\System\eVsQUpQ.exe
  2⤵
  PID:9352
- C:\Windows\System\ZDmPAiN.exe
  C:\Windows\System\ZDmPAiN.exe
  2⤵
  PID:9368
- C:\Windows\System\EllpnJa.exe
  C:\Windows\System\EllpnJa.exe
  2⤵
  PID:9384
- C:\Windows\System\EhlCWPm.exe
  C:\Windows\System\EhlCWPm.exe
  2⤵
  PID:9404
- C:\Windows\System\xCIazHU.exe
  C:\Windows\System\xCIazHU.exe
  2⤵
  PID:9424
- C:\Windows\System\LDrYEHD.exe
  C:\Windows\System\LDrYEHD.exe
  2⤵
  PID:9444
- C:\Windows\System\jMTjkTX.exe
  C:\Windows\System\jMTjkTX.exe
  2⤵
  PID:9460
- C:\Windows\System\AOZaVbH.exe
  C:\Windows\System\AOZaVbH.exe
  2⤵
  PID:9480
- C:\Windows\System\VGGwJjw.exe
  C:\Windows\System\VGGwJjw.exe
  2⤵
  PID:9496
- C:\Windows\System\keTZCwu.exe
  C:\Windows\System\keTZCwu.exe
  2⤵
  PID:9512
- C:\Windows\System\vVspwPp.exe
  C:\Windows\System\vVspwPp.exe
  2⤵
  PID:9528
- C:\Windows\System\VuYNEdf.exe
  C:\Windows\System\VuYNEdf.exe
  2⤵
  PID:9544
- C:\Windows\System\HwshKNW.exe
  C:\Windows\System\HwshKNW.exe
  2⤵
  PID:9560
- C:\Windows\System\vuzwJQA.exe
  C:\Windows\System\vuzwJQA.exe
  2⤵
  PID:9576
- C:\Windows\System\hIgFqQm.exe
  C:\Windows\System\hIgFqQm.exe
  2⤵
  PID:9648
- C:\Windows\System\PVUWepy.exe
  C:\Windows\System\PVUWepy.exe
  2⤵
  PID:9664
- C:\Windows\System\YZcZFfJ.exe
  C:\Windows\System\YZcZFfJ.exe
  2⤵
  PID:9680
- C:\Windows\System\NmBSVAX.exe
  C:\Windows\System\NmBSVAX.exe
  2⤵
  PID:9700
- C:\Windows\System\ByraMLl.exe
  C:\Windows\System\ByraMLl.exe
  2⤵
  PID:9716
- C:\Windows\System\IlxHQrn.exe
  C:\Windows\System\IlxHQrn.exe
  2⤵
  PID:9736
- C:\Windows\System\rmTimkM.exe
  C:\Windows\System\rmTimkM.exe
  2⤵
  PID:9752
- C:\Windows\System\YKrlkiE.exe
  C:\Windows\System\YKrlkiE.exe
  2⤵
  PID:9768
- C:\Windows\System\psjQslD.exe
  C:\Windows\System\psjQslD.exe
  2⤵
  PID:9784
- C:\Windows\System\JfdhHHH.exe
  C:\Windows\System\JfdhHHH.exe
  2⤵
  PID:9800
- C:\Windows\System\mngVfsu.exe
  C:\Windows\System\mngVfsu.exe
  2⤵
  PID:9816
- C:\Windows\System\jggcUDx.exe
  C:\Windows\System\jggcUDx.exe
  2⤵
  PID:9832
- C:\Windows\System\IGeVuKK.exe
  C:\Windows\System\IGeVuKK.exe
  2⤵
  PID:9848
- C:\Windows\System\NNzbwVv.exe
  C:\Windows\System\NNzbwVv.exe
  2⤵
  PID:9864
- C:\Windows\System\FUYCNqu.exe
  C:\Windows\System\FUYCNqu.exe
  2⤵
  PID:9880
- C:\Windows\System\xxGdxiZ.exe
  C:\Windows\System\xxGdxiZ.exe
  2⤵
  PID:9896
- C:\Windows\System\AejEKGo.exe
  C:\Windows\System\AejEKGo.exe
  2⤵
  PID:9912
- C:\Windows\System\ozVqVEn.exe
  C:\Windows\System\ozVqVEn.exe
  2⤵
  PID:9932
- C:\Windows\System\tOZAAiN.exe
  C:\Windows\System\tOZAAiN.exe
  2⤵
  PID:9948
- C:\Windows\System\pRsdXSp.exe
  C:\Windows\System\pRsdXSp.exe
  2⤵
  PID:9964
- C:\Windows\System\SHJdFhY.exe
  C:\Windows\System\SHJdFhY.exe
  2⤵
  PID:9980
- C:\Windows\System\DjaPnPm.exe
  C:\Windows\System\DjaPnPm.exe
  2⤵
  PID:10000
- C:\Windows\System\BBfIboJ.exe
  C:\Windows\System\BBfIboJ.exe
  2⤵
  PID:10020
- C:\Windows\System\tDuRMIt.exe
  C:\Windows\System\tDuRMIt.exe
  2⤵
  PID:10092
- C:\Windows\System\kvAZUBG.exe
  C:\Windows\System\kvAZUBG.exe
  2⤵
  PID:10112
- C:\Windows\System\jAJeNZQ.exe
  C:\Windows\System\jAJeNZQ.exe
  2⤵
  PID:10132
- C:\Windows\System\RRefDVv.exe
  C:\Windows\System\RRefDVv.exe
  2⤵
  PID:10148
- C:\Windows\System\SaRnnSL.exe
  C:\Windows\System\SaRnnSL.exe
  2⤵
  PID:10164
- C:\Windows\System\KfGENjH.exe
  C:\Windows\System\KfGENjH.exe
  2⤵
  PID:10180
- C:\Windows\System\uwtSvSo.exe
  C:\Windows\System\uwtSvSo.exe
  2⤵
  PID:10196
- C:\Windows\System\AxDRicc.exe
  C:\Windows\System\AxDRicc.exe
  2⤵
  PID:10216
- C:\Windows\System\AUobmSG.exe
  C:\Windows\System\AUobmSG.exe
  2⤵
  PID:10232
- C:\Windows\System\pmfkobl.exe
  C:\Windows\System\pmfkobl.exe
  2⤵
  PID:8916
- C:\Windows\System\bjeXlyI.exe
  C:\Windows\System\bjeXlyI.exe
  2⤵
  PID:9220
- C:\Windows\System\NnupLjV.exe
  C:\Windows\System\NnupLjV.exe
  2⤵
  PID:9284
- C:\Windows\System\mxpskye.exe
  C:\Windows\System\mxpskye.exe
  2⤵
  PID:9344
- C:\Windows\System\XfPoKEE.exe
  C:\Windows\System\XfPoKEE.exe
  2⤵
  PID:8920
- C:\Windows\System\CoLCIao.exe
  C:\Windows\System\CoLCIao.exe
  2⤵
  PID:8596
- C:\Windows\System\auDudNL.exe
  C:\Windows\System\auDudNL.exe
  2⤵
  PID:9236
- C:\Windows\System\yIFPIAD.exe
  C:\Windows\System\yIFPIAD.exe
  2⤵
  PID:9328
- C:\Windows\System\PYfQlam.exe
  C:\Windows\System\PYfQlam.exe
  2⤵
  PID:9380
- C:\Windows\System\uuToJkL.exe
  C:\Windows\System\uuToJkL.exe
  2⤵
  PID:9412
- C:\Windows\System\TMdlfvb.exe
  C:\Windows\System\TMdlfvb.exe
  2⤵
  PID:9452
- C:\Windows\System\uyLZVho.exe
  C:\Windows\System\uyLZVho.exe
  2⤵
  PID:9468
- C:\Windows\System\agiCqcn.exe
  C:\Windows\System\agiCqcn.exe
  2⤵
  PID:9520
- C:\Windows\System\dEXaVOc.exe
  C:\Windows\System\dEXaVOc.exe
  2⤵
  PID:9508
- C:\Windows\System\atOoGAY.exe
  C:\Windows\System\atOoGAY.exe
  2⤵
  PID:9556
- C:\Windows\System\UNsyzdC.exe
  C:\Windows\System\UNsyzdC.exe
  2⤵
  PID:9588
- C:\Windows\System\pHavKpD.exe
  C:\Windows\System\pHavKpD.exe
  2⤵
  PID:9604
- C:\Windows\System\XomhanA.exe
  C:\Windows\System\XomhanA.exe
  2⤵
  PID:9620
- C:\Windows\System\zkoDygG.exe
  C:\Windows\System\zkoDygG.exe
  2⤵
  PID:9676
- C:\Windows\System\JItEWiL.exe
  C:\Windows\System\JItEWiL.exe
  2⤵
  PID:9628
- C:\Windows\System\xgZaExQ.exe
  C:\Windows\System\xgZaExQ.exe
  2⤵
  PID:9748
- C:\Windows\System\SoRVrSX.exe
  C:\Windows\System\SoRVrSX.exe
  2⤵
  PID:9812
- C:\Windows\System\nivogzh.exe
  C:\Windows\System\nivogzh.exe
  2⤵
  PID:9876
- C:\Windows\System\CXDoSfA.exe
  C:\Windows\System\CXDoSfA.exe
  2⤵
  PID:9972
- C:\Windows\System\RluUeyV.exe
  C:\Windows\System\RluUeyV.exe
  2⤵
  PID:10016
- C:\Windows\System\jtWBVSU.exe
  C:\Windows\System\jtWBVSU.exe
  2⤵
  PID:9696
- C:\Windows\System\PzLiTLS.exe
  C:\Windows\System\PzLiTLS.exe
  2⤵
  PID:9728
- C:\Windows\System\EiZOLHY.exe
  C:\Windows\System\EiZOLHY.exe
  2⤵
  PID:9796
- C:\Windows\System\zWFFsHg.exe
  C:\Windows\System\zWFFsHg.exe
  2⤵
  PID:9856
- C:\Windows\System\JjawqjP.exe
  C:\Windows\System\JjawqjP.exe
  2⤵
  PID:9928
- C:\Windows\System\FVKbLUV.exe
  C:\Windows\System\FVKbLUV.exe
  2⤵
  PID:9988
- C:\Windows\System\YdyMMJB.exe
  C:\Windows\System\YdyMMJB.exe
  2⤵
  PID:10036
- C:\Windows\System\GDBfGpU.exe
  C:\Windows\System\GDBfGpU.exe
  2⤵
  PID:10056
- C:\Windows\System\aMKdKTS.exe
  C:\Windows\System\aMKdKTS.exe
  2⤵
  PID:10068
- C:\Windows\System\IsYZhyP.exe
  C:\Windows\System\IsYZhyP.exe
  2⤵
  PID:1600
- C:\Windows\System\hXXOqLi.exe
  C:\Windows\System\hXXOqLi.exe
  2⤵
  PID:10128
- C:\Windows\System\VtYATqT.exe
  C:\Windows\System\VtYATqT.exe
  2⤵
  PID:10104
- C:\Windows\System\XhpolLt.exe
  C:\Windows\System\XhpolLt.exe
  2⤵
  PID:10172
- C:\Windows\System\hVxiLpk.exe
  C:\Windows\System\hVxiLpk.exe
  2⤵
  PID:10212
- C:\Windows\System\WtoGDZQ.exe
  C:\Windows\System\WtoGDZQ.exe
  2⤵
  PID:10192
- C:\Windows\System\HzxxGAD.exe
  C:\Windows\System\HzxxGAD.exe
  2⤵
  PID:9280
- C:\Windows\System\HmTElTs.exe
  C:\Windows\System\HmTElTs.exe
  2⤵
  PID:9316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CyvsUce.exe

Filesize
2.3MB

MD5
0ddaa458f29401d1d54809976d38adc5

SHA1
07e91ff4197dea89abf04532fe3a5d3a5dd55084

SHA256
e93ab5a451a11a5da4448963b0d6dcacd357c0fc135ad78c533190fff378cc01

SHA512
9150b34de129812f53a8989aa4cdac74808c8240df5f5e4a3e60066cf1cb207644112c23503db3505332459e814ae1c52fa848aee817ab496908973f0272bc0a

Download Submit
C:\Windows\system\DKiHBmP.exe

Filesize
2.3MB

MD5
1ff4a18b42e274752c49468db5417b3e

SHA1
1b1e8c00aea6972badc95fd698af8c10c6719b6d

SHA256
80ee3cea6dfc9fd458faa473fd42700f7cd31d9fd3addbfe01f949458db24d1a

SHA512
b886140f0e729c32cd2000f6fe83a0ddb33989de68fb1239399877467d97688fb7d28045a0eeb9f2d66fa981fb78c9da9ab05e146f86b27b79f4c0dd27849633

Download Submit
C:\Windows\system\GyFOGbv.exe

Filesize
2.3MB

MD5
f91be3400d5c11065c4a29243d7b34b0

SHA1
db9cfdd92fa86848ddce6a577fe61f389e1e29b3

SHA256
341c02011be2c54816abe9c1d6929dbabcb41aa7f53f966a07ad2f33437ae023

SHA512
ba307abe0213cf250b304eb3da38a9a03c93c8e25c09bb2f3f7fee073619bd12ae1ce9809ef4f0c1b3f335d3af4bead272808ea2a0528b071d5a972609240782

Download Submit
C:\Windows\system\NlLDtiA.exe

Filesize
2.3MB

MD5
1a64220b0aa43cdc84cab6b6d5915d9d

SHA1
a43bd3d19527628151e07e6c4b5658e195b28f4a

SHA256
08bda066e766a76a85dea7f9833d63b112abd443cd986f83cc76be82f854d9a5

SHA512
ccbe77285a167c440888ee7cbd68383fbd8cc10bc72cf471a53aaf3c4e6115b71268cfd0ecdf6e1394e6c899b8a9e42957a71ff234502e09b74f61fb38b2edbb

Download Submit
C:\Windows\system\PAxHuzW.exe

Filesize
2.3MB

MD5
c5dddcbd6da67c7175253d2d9abbd562

SHA1
d74c6b76e32a155dd33e302b5084dd8d0b665067

SHA256
271d47e24b2b154f7270fa826b6821cce03a28b629e33653c34109708657e86d

SHA512
e3613ef1e1556e53e74afe978c646182c6ae42e1ed8cfa3a7ad775263e357d117dce5860e69d0709ebbdd7f344bc2c35110b5ea2df52066b810da72e12d31b12

Download Submit
C:\Windows\system\WmjTMkr.exe

Filesize
2.3MB

MD5
0b601f901081a072893c128ac179f2d9

SHA1
e8dd09ebfaf95cabaa1e04e4ca0f64b47bd1bb2b

SHA256
8be19917225bd3b1f87f0154ee98a0a6e35929eafe0b1fa03342036c06f0e3b4

SHA512
6be5405f4c04d1985a43296b40f1efbcfc2d777df4fc356f117a4d82c24449c9ef056c737cf72d6ebd27a651ccc68f15b1410a152ab662ccd21f134b422ae842

Download Submit
C:\Windows\system\XiElgYo.exe

Filesize
2.3MB

MD5
b246407456069aef33f30d90dc08a113

SHA1
66286b27953b3a462623b12ad530dfc2f669c438

SHA256
23d7b90b2fd681c604a684891448ca7629a362bddc5c3de5c96c41f309bfeac6

SHA512
555698dd4cd88c5240c4053df2e0c9f34283fc0cd66a0af4d10887209216c8033de49d1d919a2c872c7359208ee63b8ebfbba0b5608a27eb651c7890045d7889

Download Submit
C:\Windows\system\aURkVdQ.exe

Filesize
2.3MB

MD5
134dbbe1f663253520b64e7f2209852c

SHA1
6fdc445e79f6bc3a403c3007cf576fa7050bae96

SHA256
b40f83504a6dc89981d4a0322ce753d92f85969cb8cccf8ec0bdc475082c442e

SHA512
2ad7046410e509cc5400182adace266c32a037aa61baa239cd53b0c8f42667e2bf02b8c9cf940080b625bba4b37c2ea5f0114749b95e14bf12cdf00bd648f990

Download Submit
C:\Windows\system\birDzRn.exe

Filesize
2.3MB

MD5
98b5cf464b304a6e1cdd61320c1890e5

SHA1
97b3c28e781b69317f91da7551160874ede52443

SHA256
4adcce33e3fc799205b0720206e254f69ee900bb515b71ff22f5ea7cfca0b631

SHA512
ac27787f53a420a52223ae642a5ca4b142568e9c1d0d7917803bc44bafa15ce4c504824d4bf14e5233136a008bf3c97af39e083cb89ff20a7c018e2c3d4aba4a

Download Submit
C:\Windows\system\dvuzpPv.exe

Filesize
2.3MB

MD5
7a4f85b174576f53c42db10922f5e554

SHA1
892c4e92df1455c9176a8c91289df17f23c5eaca

SHA256
918ce8fb82b7f83fa7288768850def3940b82d853554bd8ab921a38ae68759f0

SHA512
c3bd46751bf2d190ed0053f7bc2c95ffb8dac415be6dd929d713812f367afe60a1e824622cd0edf7afdbdaa2653b3245a8363321966cf0a9e1c974220ccfa69a

Download Submit
C:\Windows\system\hfyrwmH.exe

Filesize
2.3MB

MD5
03b7a82bc01668daa98932f5200a9070

SHA1
7227eb6b21ac18d08c6aef848ff0e035b7a2d5c4

SHA256
9fd3ed47b33f69ad6145398a35dc0952d5a6087804af93dd766a4affbdb1744e

SHA512
e4e1746e15d6ba53bd0b4ff810c3f5590fcd8efaa6e377ae8884d63f615dd2252356027512f0fcdd0d93cf8c5f596c61a03fa57ab76c558620ddbb94309fb173

Download Submit
C:\Windows\system\iCbdhvr.exe

Filesize
2.3MB

MD5
b0e6e0938769ed2313f0766c86e05125

SHA1
f1a28564d2a1cd8b49aca72d0fddb89d5d28f590

SHA256
7a229e7c5434024ffe0e38a77f0831fbf0e6f3e579f3213ab13d30d9553e8296

SHA512
97f1eb531e6d519369534590221238fb85123405cf16e11fb187a609e0baeef9c3fdae9bdd4888d78ef91088cde7ea3db194fbb7869a41bbf1fee0b431e4fd05

Download Submit
C:\Windows\system\ibnRWcL.exe

Filesize
2.3MB

MD5
acdd91aa5308f0d53175c49c1519c8e4

SHA1
607651c3ce7652e0ad9df68b1d1973b93f1338b8

SHA256
2ea98917c934638f191787a2a188381f3a83195445c0324f599eb0d8c82de005

SHA512
fc52589aecec6df3bacc92734732eb281c132cbeee11705332294aa4fb50964d20d874e065d4ff2fe44f811ae347fe6d669d469ed748774b357b2d6da3eb505a

Download Submit
C:\Windows\system\oIoeUkc.exe

Filesize
2.3MB

MD5
9161072d8a754ebd680fe743850a4561

SHA1
4ac9833a88e25c7fb4377fb19c44fe5f00be8a24

SHA256
8482db9e96f5dc468ebdadf26468a2293032d02ed4d6b8159863921a74c90670

SHA512
10184d5fdc326a13c4d170314b8cc6352f745d30d8bad14b97528290b6141fbaf908819395d333877c53449d6cd08e189d3219af382f3596cea33f55e5bc9de9

Download Submit
C:\Windows\system\pEtURRE.exe

Filesize
2.3MB

MD5
ad841f7e6074f2fce9b84993b47528d0

SHA1
73f3f8685cdc39bd86e99bcc482294c5991db7c1

SHA256
b7d63e2db0146b62d83341eb61589758e8fa659c08a7ac54d5db5f62682496bb

SHA512
8cb4ffaa70fa461d283e544a096a1d80dd2fa9b03e38ca1f006e957c2d33c8365dd6cf65e50ffbe1ba66cb0f26c6059de38c2c34cc444c9b7ab283bd7f18d185

Download Submit
C:\Windows\system\pXZVbPG.exe

Filesize
2.3MB

MD5
ffc283144496a5714960d4e852495f82

SHA1
eba08f4d47afcfdabf28bf435f7d5cd2718e610c

SHA256
017e95e974d820906c0d38baf14094deba84f959f5e91474be24ad8d736a6087

SHA512
2061a62257fd4cf5d3da858eaff72dd5721c0da095269465e5423c9e5daab5869a74c5c9920b25c1993676c84b22627a009b49413a788feef4acfe692df3e0ef

Download Submit
C:\Windows\system\pmrsDkb.exe

Filesize
2.3MB

MD5
aea3c41223d7d44b6c4aa5dfeb86876d

SHA1
9d5f5045a641d03242965fe2096506a0ca43ff1e

SHA256
d24ae1a6e6ff5af4001007b2f34998b165b80f0f46cd188f246f3bf8c3d51542

SHA512
4ddd8fc03de27be0361e8bd9427763d522bcbd103f60b4ad4be98096e675f5795f2107593480d187d9b6a0cf96bf70e78ccb5a54ac1b4c5e96e8ea2e940a41db

Download Submit
C:\Windows\system\rIqlNoB.exe

Filesize
2.3MB

MD5
d8d07936d6e759475fd79e87b2bc850c

SHA1
40e2046c6c50d7dd67f5c233c170329880bfb343

SHA256
b5cbd0c646598aadb9b990e8f7b497826beffd8b470bd1554c083e0a8898db1a

SHA512
a6c2a6c09731f86b7a440220aa60be96e1efe40d74903d357a07b675596ea69b6ad563d677b69e755f958fae9fef8216cd2a16cf0214d439f26fcf7a29b5fc8f

Download Submit
C:\Windows\system\sEINFPr.exe

Filesize
2.3MB

MD5
d32e588358c66039118efbb6159bcb74

SHA1
ee3ec2704a549643e120960ebf169621304f10df

SHA256
043bf424a3afb72857ec25ea19bee33c837a38b928b033e07b561c72850056b2

SHA512
c1ae800dcedd0fd1f591c057bf02ef1deef9d59a776690ef3173a59c286e570ef4f7096c5bf98ad908769925d64ffd57c15d3c3bf93867884e06087e24b8dc0d

Download Submit
C:\Windows\system\smYSUPR.exe

Filesize
2.3MB

MD5
b8efbccd38daf125836c086ba894aadd

SHA1
fcca70c4b4a1266eefc787aa9ec4e5cafa58b9f2

SHA256
1870defc7613d354e48d7eaccaf22f753cf6739112567b8ec9a1831efa62c14f

SHA512
f5824773989ef101063fb37a3c88e4dad1e6c0220c2d2510fce5e4ca1b18933bc86549377027c8b003edd387ab94ee5c084e6bf9898a708a94eeb4d2d57571a5

Download Submit
C:\Windows\system\tzkzSsq.exe

Filesize
2.3MB

MD5
7ea8e32aa89ddf291bec5c578f32bf79

SHA1
fde2d8a3ee31c40b121d289ba9701646c5f4efca

SHA256
ed330552a55bf459fef7c832fd63e7d30c8aac9d9fa42c205751ff004ba9eb4b

SHA512
6d0a470eb49a7bdc6b88cbb4a9163e5b1c89ebd15e30ea98817bf2894ef67fa4a348d5948b18a2199dcc293d0e58b59ae2f42ecdd0199d98fbf5274a4c90e353

Download Submit
C:\Windows\system\uKfkNUd.exe

Filesize
2.3MB

MD5
fb478069833352345fb6b85170344538

SHA1
89614bc9c3bd929876cf7ddb3c8e6394262bece9

SHA256
753053477a72c2315587264deca52a4101f2c4285273b5d48794ec731563c55f

SHA512
547f337abc6f1f6dab9f43c7669992d4eac5376488631f71c775810a85bbc593c9deb41fd374817623d79414b6eb553f57941a315ffbe46e896d6ea909564587

Download Submit
C:\Windows\system\ywoItQT.exe

Filesize
2.3MB

MD5
43728c1f8fcf4776cf3afa23555ab1bc

SHA1
20d0ba1e4a711065cfdc076871521f98cb3f00b0

SHA256
3113c9d1485295afeb2b259ced521238fa64075444b19326ee1ee6bd811957b9

SHA512
cf13e875cfbd98a06d2a70cf5f3416879ba981501557d592a8ebfa8e2ec35a7f78279565f6dc2a3c9997cbe608b6da965744cccfe7396b445b90f420a2e657ca

Download Submit
\Windows\system\BNzoduq.exe

Filesize
2.3MB

MD5
d88aeb1bb42d77c72ad5337ca2673674

SHA1
b9da1d397b262dcf2c667c17c6bebf20b7c4b790

SHA256
cca68f5a9914b402424a2039c51b72ff8a28e41dd5395590eb39d9b9d706b651

SHA512
2f65cbd6b93d22955ca4a05d32569fa7d7a1bf0fe87f84645f83593d3e3ab48f0e6bbce06d340f6eec6ae5b4ab5882a8e9928d90cb6ce2891777773ce8fe1379

Download Submit
\Windows\system\CSIwcAE.exe

Filesize
2.3MB

MD5
ad7e858a178e735ed7cc094464a56404

SHA1
50a55bf73409a11e711ba9eeaa856d9efde3545b

SHA256
bcfc569253dd0cf8281b5d514dee86e134ecbab00ec07932d98cc17b1d7d2321

SHA512
2d80c4e1ed48f0f68d52a488ef7fa5dfd1300d508443936166e7f57e53011c574a9b28497eda7edfc82466dc356fb3064458a66a124b03002d81607fac3ee39c

Download Submit
\Windows\system\CzxQngg.exe

Filesize
2.3MB

MD5
1effb0343a744abf1f68361d74e9802e

SHA1
879e71c738dcd03f5376d625cf109356e5b11afe

SHA256
e014fe74f46dc1aaaa28382229d29a70fe361e8742437b39483531577236cdcc

SHA512
94eabd6ae60387c7bcd78701bca65a7010d99bd87427d2c9c045b4fe05f82b4f4139e1f04291a6e66c53ff2e4ee956eb2af69c93200a2c44a485b20c416d1d52

Download Submit
\Windows\system\GNVQfbv.exe

Filesize
2.3MB

MD5
1efa7bc0f045c5c614c29bf9d4dbbdc9

SHA1
0fc2821a847acc599bf7db91cf773911d909c19b

SHA256
e1cec14c2fa9025f5a840f03ce94a32f2655a9a0800b36fcbb667b9f6959e42c

SHA512
b971495513f6a8089d2d82a4025f64ecd44fdb7b4c7907d3ddbf277efeb0985efc4db1dc976b39e6a7552a98c8dfaafed61f74a8afae61c046c1c0561c510f9c

Download Submit
\Windows\system\QyKmGVp.exe

Filesize
2.3MB

MD5
cd0081bb952d3306d3ea5e0a7a89e26a

SHA1
74c21f04fef74a74d4f9f2a7a68b78ed00a369c9

SHA256
a39553662408e11372e987da0045a149a1fc84869c2c0b436978b4d8bf437906

SHA512
11d3449c9491668b6a2ffed2be964262687ad211d97286e64142aa89df9e05204179879becace2998b08e44e933ecd83c25864a5de2703df06401e71fbfa631b

Download Submit
\Windows\system\URgIpKL.exe

Filesize
2.3MB

MD5
396f3673a46c28e9cb426e21f1e2f737

SHA1
5d4f449957113a3ccb5bd4a02af42e036bf87131

SHA256
566b6cf2c688a9cd8a5a66684f29f43daf9ed0e4d82e39879f85ced65f5355db

SHA512
fd60adc160d8d4187deb75ef339c4a581bbc73f3d0e7d94b53dc7d0c6c84737c7244267eb028ef88061c49b61102017f66e066a03f41f2480a288eb7be028ecb

Download Submit
\Windows\system\ZeHTRvI.exe

Filesize
2.3MB

MD5
f79c28c772eb70238ba8ad9484ca814a

SHA1
df243992b4aa6e365407d3ea73fe512c60e54db3

SHA256
8dcc82fd27aa02bf998eb6f17c591de457ef176c4a53e3127b84be7db4ab4d96

SHA512
2685e495fafbf7326808a036e757f03fb6982ed6fb1ba12554ca182c79e1aaccfac41a166a2e419b0d9d868e661cd1acd4fd29eac42edbf4288f34a8f6f7f39c

Download Submit
\Windows\system\cLbXKjM.exe

Filesize
2.3MB

MD5
0a533d7bd2ff42a45c1001394643b9b3

SHA1
fe9feaeb79674129d30bc55777ae284263658506

SHA256
dc86fc349825b3ca146c12809d0574b1d2af5641116b9d66e05000ca92aba703

SHA512
753d059fb1e6d9dfb7ec2d62f40435dfbffa49c5681407136d05729695f318c035906ecf28d566534546742fbc825f33cc75086f4dac36859b23b63b58c7e582

Download Submit
\Windows\system\mgGRWhR.exe

Filesize
2.3MB

MD5
9424d025cc95b500c45069aa8cb86cea

SHA1
3afe8c036d7ffac864f8980242fa78af03d7a967

SHA256
0726f033c2385f4a88583c016fb90806c3fa3a16d7e5d4b94c7b04e54ee4fc1d

SHA512
004645d3fc1bdce60b679dc02eb5a3b92559b0a75cae5cf69bde69b949867c953d5aed17a312d1773ac1b967130108e154f16ca1083d7176af1eef6561c0a991

Download Submit
\Windows\system\ssYPiSk.exe

Filesize
2.3MB

MD5
34049894dc9251c668ccd394b1de6904

SHA1
f6ef97ef73962361ef980b36b9669d60d10a77dd

SHA256
f1714ccbcf6254a16f2d31bbddce9f1355c02adeada1638034b63104459e73ce

SHA512
9c98120b8ea995d57aa046db9ece7fee1a9a5bbfd8846bb5acde9f1057c787a3e471e56d6c2b56982b72de24abc1813ebabd28a626422d7777fceaa81af9ee93

Download Submit
\Windows\system\yiLTdVA.exe

Filesize
2.3MB

MD5
fc35aa6961fcb352f70486142dabf680

SHA1
7235a78611c7f097fbc4afe1c9460a26b9a993fb

SHA256
baf199d321837730cddc251663563b751d6898d28dc8a6ca72dbe02b82c953be

SHA512
b53535dbc679c720b0370db9ca54d0813df3c192c14a1c37553f3e7abea48bf1c1d17205e7330963740c856606f20e05d36b127a38265b71940806429c19d243

Download Submit
memory/960-115-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-166-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/1908-159-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2068-87-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2356-16-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-74-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2600-34-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-44-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-48-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-43-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2716-45-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2740-84-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2740-36-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-100-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2740-81-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2740-47-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-46-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-93-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-29-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2740-78-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-38-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2740-0-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2740-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2740-7-0x00000000030C0000-0x00000000034B2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-89-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2972-85-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download