xmrig | 7e33570c1a14089e66f7b543118da4541d677e8fae67227fe57e97a73883c846

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
Size

1.4MB
MD5

11f6688130affd4ec9dc739d403f3d7f
SHA1

5ae33fb319062156886b21d0fcb4e26404507170
SHA256

7e33570c1a14089e66f7b543118da4541d677e8fae67227fe57e97a73883c846
SHA512

b9d135ed345fa11587ff240d1ca2b99c28c40b82daca5036c073ba35f8c6e090c26cd5c3aecd2828ef29b0085573e120e4019318923e0fd6f1528b305fbef15b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwm:Lz071uv4BPMkibTIA5CJR

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2164-2-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2596-9-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2520-20-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2676-35-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2564-38-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/1636-63-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2164-69-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2700-76-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/864-70-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2148-90-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/1460-83-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2164-82-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2824-560-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2444-556-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/920-153-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2824-5508-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2700-5554-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2900	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2596	RFIarSH.exe
2520	xWUonSk.exe
2676	npOsuNf.exe
2564	cMeYmhE.exe
2444	nWxmrGP.exe
2824	ZdxiuaR.exe
1636	ZyaYdcA.exe
864	pYqvshJ.exe
2700	PJNhDbZ.exe
1460	BkaTVIS.exe
2148	mgNDokK.exe
920	wTeITPC.exe
1576	NssqZzU.exe
1488	zUKENBO.exe
2364	dFKjkYw.exe
588	rSdAFJx.exe
356	fgawTPj.exe
1656	fmXyqze.exe
1244	gErMYBJ.exe
1348	wrweqXo.exe
1704	YxShxHU.exe
3028	UQooUHF.exe
2896	nCPSeuU.exe
1424	yOADNSl.exe
2484	wUADVSY.exe
1572	pFFdjFJ.exe
3048	NnfMDKT.exe
1092	UAQWVaz.exe
1000	HJZuyOk.exe
1660	tafYlvZ.exe
1620	uEfDJKQ.exe
2192	emZBOwp.exe
2580	lAwsTZg.exe
1788	yjKbWHB.exe
1280	JWAryJH.exe
1968	edxiVBU.exe
344	YotFwLf.exe
1228	OGRPOUO.exe
2480	RLaTNGI.exe
608	bfkBpQq.exe
1900	nJGkRWB.exe
2092	RFgXQeZ.exe
1964	NUHXdDj.exe
2136	EsxrzWZ.exe
848	bTEYMJy.exe
2840	dKwJUyE.exe
1648	mmQAxJi.exe
896	ehkzkRl.exe
2320	JMgEHwV.exe
2964	wSaupTR.exe
2968	skvwASL.exe
1524	qSpGTmG.exe
2608	TIdNeHn.exe
2640	XmFioTb.exe
2428	LMnXSfY.exe
2560	ZEsRUVU.exe
2528	eYiCoRX.exe
2516	mTMEqgq.exe
3020	lhbjoPn.exe
108	bMMASRU.exe
2584	aSiWLcw.exe
2068	caoywuW.exe
2300	SRRVfhr.exe
2468	oWuoyOk.exe

Loads dropped DLL 64 IoCs

pid	Process
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2164-2-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x000b000000015cff-5.dat	upx
behavioral1/memory/2596-9-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/files/0x0035000000015d6b-10.dat	upx
behavioral1/memory/2520-20-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x0007000000015e32-12.dat	upx
behavioral1/files/0x000e0000000054ab-33.dat	upx
behavioral1/memory/2676-35-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2564-38-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x0008000000015f65-45.dat	upx
behavioral1/files/0x0007000000015fe5-50.dat	upx
behavioral1/files/0x000900000001621e-61.dat	upx
behavioral1/memory/1636-63-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2164-69-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2700-76-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/864-70-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x0035000000015d7f-73.dat	upx
behavioral1/files/0x0007000000016d18-67.dat	upx
behavioral1/files/0x0006000000016d34-86.dat	upx
behavioral1/memory/2148-90-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/1460-83-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/files/0x0006000000016d20-79.dat	upx
behavioral1/memory/2824-53-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2444-47-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x0006000000016d3a-91.dat	upx
behavioral1/files/0x0006000000016d3e-97.dat	upx
behavioral1/files/0x0006000000016d43-101.dat	upx
behavioral1/files/0x0006000000016d8e-113.dat	upx
behavioral1/files/0x000600000001708b-154.dat	upx
behavioral1/files/0x0005000000018665-183.dat	upx
behavioral1/files/0x00050000000186f6-188.dat	upx
behavioral1/files/0x00050000000186fa-193.dat	upx
behavioral1/memory/2824-560-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2444-556-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x0031000000018649-178.dat	upx
behavioral1/files/0x0015000000018644-173.dat	upx
behavioral1/files/0x0006000000017437-168.dat	upx
behavioral1/files/0x00060000000173d0-163.dat	upx
behavioral1/memory/920-153-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x00060000000171df-157.dat	upx
behavioral1/files/0x000600000001704a-137.dat	upx
behavioral1/files/0x0006000000016dbe-133.dat	upx
behavioral1/files/0x0006000000016db9-129.dat	upx
behavioral1/files/0x0006000000016db1-125.dat	upx
behavioral1/files/0x0006000000016da5-121.dat	upx
behavioral1/files/0x0006000000016d9d-117.dat	upx
behavioral1/files/0x0006000000016d74-109.dat	upx
behavioral1/files/0x0006000000016d5f-105.dat	upx
behavioral1/memory/2824-5508-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2700-5554-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KeKTCLq.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\iDHtpQo.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\UZbLMwy.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\AgnCCit.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\BEtdMzd.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\rGsgsFY.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\ZsCxlqw.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\epNkEah.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\pBIlEiH.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\kOPTGLp.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\mhSfgbV.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\ncynuuI.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\uTnYPnB.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\gIpTfDZ.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\qZzlUHH.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\FHRcOuL.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\uoWYoCV.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\oPUtyeV.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\kyIcASk.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\EbIisll.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\CRPBpuw.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\BAFECsS.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\duGWHKA.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\CHsJlKa.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\BcFPyZb.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\HUTXHjy.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\cKXLfFS.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\BYnBuGb.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\dLohvAe.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\zYEvZuU.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\RxJSGmM.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\QVfFtoc.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\rAWfZWn.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\eXQGqNw.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\DtWZNJF.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\MkJARVE.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\lGmEQXY.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\JbojCMB.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\HSOHeBV.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\ylFoqHA.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\TQUktgN.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\POoETHa.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\WUwPFBj.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\hAlZuSx.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\JBvKAZW.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\xbeuBWx.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\GtaSWJx.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\UOdJFfY.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\LNCLgXf.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\DVhcvtl.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\cEhlEqa.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\YAdeLMx.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\fdPdZra.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\JGbAKHC.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\ztlihna.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\MWgwuGX.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\wgCaBXv.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\NCnftQY.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\QkFyPcH.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\yDwzGML.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\mdAkdLo.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\IiTdCYR.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\rHjKiLo.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
File created	C:\Windows\System\ErPTrQM.exe	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2900	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	29
PID 2164 wrote to memory of 2900	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	29
PID 2164 wrote to memory of 2900	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	29
PID 2164 wrote to memory of 2596	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	30
PID 2164 wrote to memory of 2596	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	30
PID 2164 wrote to memory of 2596	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	30
PID 2164 wrote to memory of 2520	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2520	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2520	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	31
PID 2164 wrote to memory of 2676	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	32
PID 2164 wrote to memory of 2676	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	32
PID 2164 wrote to memory of 2676	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	32
PID 2164 wrote to memory of 2564	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	33
PID 2164 wrote to memory of 2564	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	33
PID 2164 wrote to memory of 2564	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	33
PID 2164 wrote to memory of 2444	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	34
PID 2164 wrote to memory of 2444	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	34
PID 2164 wrote to memory of 2444	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	34
PID 2164 wrote to memory of 2824	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	35
PID 2164 wrote to memory of 2824	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	35
PID 2164 wrote to memory of 2824	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	35
PID 2164 wrote to memory of 1636	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	36
PID 2164 wrote to memory of 1636	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	36
PID 2164 wrote to memory of 1636	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	36
PID 2164 wrote to memory of 864	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	37
PID 2164 wrote to memory of 864	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	37
PID 2164 wrote to memory of 864	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	37
PID 2164 wrote to memory of 2700	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	38
PID 2164 wrote to memory of 2700	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	38
PID 2164 wrote to memory of 2700	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	38
PID 2164 wrote to memory of 1460	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	39
PID 2164 wrote to memory of 1460	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	39
PID 2164 wrote to memory of 1460	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	39
PID 2164 wrote to memory of 2148	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	40
PID 2164 wrote to memory of 2148	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	40
PID 2164 wrote to memory of 2148	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	40
PID 2164 wrote to memory of 920	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	41
PID 2164 wrote to memory of 920	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	41
PID 2164 wrote to memory of 920	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	41
PID 2164 wrote to memory of 1576	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	42
PID 2164 wrote to memory of 1576	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	42
PID 2164 wrote to memory of 1576	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	42
PID 2164 wrote to memory of 1488	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	43
PID 2164 wrote to memory of 1488	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	43
PID 2164 wrote to memory of 1488	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	43
PID 2164 wrote to memory of 2364	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	44
PID 2164 wrote to memory of 2364	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	44
PID 2164 wrote to memory of 2364	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	44
PID 2164 wrote to memory of 588	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	45
PID 2164 wrote to memory of 588	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	45
PID 2164 wrote to memory of 588	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	45
PID 2164 wrote to memory of 356	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	46
PID 2164 wrote to memory of 356	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	46
PID 2164 wrote to memory of 356	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	46
PID 2164 wrote to memory of 1656	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	47
PID 2164 wrote to memory of 1656	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	47
PID 2164 wrote to memory of 1656	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	47
PID 2164 wrote to memory of 1244	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	48
PID 2164 wrote to memory of 1244	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	48
PID 2164 wrote to memory of 1244	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	48
PID 2164 wrote to memory of 1348	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	49
PID 2164 wrote to memory of 1348	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	49
PID 2164 wrote to memory of 1348	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	49
PID 2164 wrote to memory of 1704	2164	11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11f6688130affd4ec9dc739d403f3d7f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System\RFIarSH.exe
  C:\Windows\System\RFIarSH.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\xWUonSk.exe
  C:\Windows\System\xWUonSk.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\npOsuNf.exe
  C:\Windows\System\npOsuNf.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\cMeYmhE.exe
  C:\Windows\System\cMeYmhE.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\nWxmrGP.exe
  C:\Windows\System\nWxmrGP.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ZdxiuaR.exe
  C:\Windows\System\ZdxiuaR.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ZyaYdcA.exe
  C:\Windows\System\ZyaYdcA.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\pYqvshJ.exe
  C:\Windows\System\pYqvshJ.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\PJNhDbZ.exe
  C:\Windows\System\PJNhDbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\BkaTVIS.exe
  C:\Windows\System\BkaTVIS.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\mgNDokK.exe
  C:\Windows\System\mgNDokK.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\wTeITPC.exe
  C:\Windows\System\wTeITPC.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\NssqZzU.exe
  C:\Windows\System\NssqZzU.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\zUKENBO.exe
  C:\Windows\System\zUKENBO.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\dFKjkYw.exe
  C:\Windows\System\dFKjkYw.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\rSdAFJx.exe
  C:\Windows\System\rSdAFJx.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\fgawTPj.exe
  C:\Windows\System\fgawTPj.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\fmXyqze.exe
  C:\Windows\System\fmXyqze.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\gErMYBJ.exe
  C:\Windows\System\gErMYBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\wrweqXo.exe
  C:\Windows\System\wrweqXo.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\YxShxHU.exe
  C:\Windows\System\YxShxHU.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\UQooUHF.exe
  C:\Windows\System\UQooUHF.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\nCPSeuU.exe
  C:\Windows\System\nCPSeuU.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\yOADNSl.exe
  C:\Windows\System\yOADNSl.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\wUADVSY.exe
  C:\Windows\System\wUADVSY.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\pFFdjFJ.exe
  C:\Windows\System\pFFdjFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\NnfMDKT.exe
  C:\Windows\System\NnfMDKT.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\UAQWVaz.exe
  C:\Windows\System\UAQWVaz.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\HJZuyOk.exe
  C:\Windows\System\HJZuyOk.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\tafYlvZ.exe
  C:\Windows\System\tafYlvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\uEfDJKQ.exe
  C:\Windows\System\uEfDJKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\emZBOwp.exe
  C:\Windows\System\emZBOwp.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\lAwsTZg.exe
  C:\Windows\System\lAwsTZg.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\yjKbWHB.exe
  C:\Windows\System\yjKbWHB.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\JWAryJH.exe
  C:\Windows\System\JWAryJH.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\edxiVBU.exe
  C:\Windows\System\edxiVBU.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\YotFwLf.exe
  C:\Windows\System\YotFwLf.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\OGRPOUO.exe
  C:\Windows\System\OGRPOUO.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\RLaTNGI.exe
  C:\Windows\System\RLaTNGI.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\bfkBpQq.exe
  C:\Windows\System\bfkBpQq.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\nJGkRWB.exe
  C:\Windows\System\nJGkRWB.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\RFgXQeZ.exe
  C:\Windows\System\RFgXQeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\NUHXdDj.exe
  C:\Windows\System\NUHXdDj.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\EsxrzWZ.exe
  C:\Windows\System\EsxrzWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\bTEYMJy.exe
  C:\Windows\System\bTEYMJy.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\dKwJUyE.exe
  C:\Windows\System\dKwJUyE.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\mmQAxJi.exe
  C:\Windows\System\mmQAxJi.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ehkzkRl.exe
  C:\Windows\System\ehkzkRl.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\JMgEHwV.exe
  C:\Windows\System\JMgEHwV.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\wSaupTR.exe
  C:\Windows\System\wSaupTR.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\skvwASL.exe
  C:\Windows\System\skvwASL.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\qSpGTmG.exe
  C:\Windows\System\qSpGTmG.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\TIdNeHn.exe
  C:\Windows\System\TIdNeHn.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\XmFioTb.exe
  C:\Windows\System\XmFioTb.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\LMnXSfY.exe
  C:\Windows\System\LMnXSfY.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ZEsRUVU.exe
  C:\Windows\System\ZEsRUVU.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\eYiCoRX.exe
  C:\Windows\System\eYiCoRX.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\mTMEqgq.exe
  C:\Windows\System\mTMEqgq.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\lhbjoPn.exe
  C:\Windows\System\lhbjoPn.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\bMMASRU.exe
  C:\Windows\System\bMMASRU.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\aSiWLcw.exe
  C:\Windows\System\aSiWLcw.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\caoywuW.exe
  C:\Windows\System\caoywuW.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\SRRVfhr.exe
  C:\Windows\System\SRRVfhr.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\oWuoyOk.exe
  C:\Windows\System\oWuoyOk.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\yGUKpVk.exe
  C:\Windows\System\yGUKpVk.exe
  2⤵
  PID:2500
- C:\Windows\System\FiEhxMn.exe
  C:\Windows\System\FiEhxMn.exe
  2⤵
  PID:2916
- C:\Windows\System\BhuUhdO.exe
  C:\Windows\System\BhuUhdO.exe
  2⤵
  PID:1544
- C:\Windows\System\Hlfnbeo.exe
  C:\Windows\System\Hlfnbeo.exe
  2⤵
  PID:1604
- C:\Windows\System\jqPeaeZ.exe
  C:\Windows\System\jqPeaeZ.exe
  2⤵
  PID:1004
- C:\Windows\System\AzMfnHR.exe
  C:\Windows\System\AzMfnHR.exe
  2⤵
  PID:1252
- C:\Windows\System\xfskfpj.exe
  C:\Windows\System\xfskfpj.exe
  2⤵
  PID:1652
- C:\Windows\System\yNvaaJJ.exe
  C:\Windows\System\yNvaaJJ.exe
  2⤵
  PID:2548
- C:\Windows\System\JtePPUW.exe
  C:\Windows\System\JtePPUW.exe
  2⤵
  PID:2644
- C:\Windows\System\zIXRrJm.exe
  C:\Windows\System\zIXRrJm.exe
  2⤵
  PID:636
- C:\Windows\System\QNnnheX.exe
  C:\Windows\System\QNnnheX.exe
  2⤵
  PID:2228
- C:\Windows\System\gjCsQZE.exe
  C:\Windows\System\gjCsQZE.exe
  2⤵
  PID:2772
- C:\Windows\System\gUsxlcc.exe
  C:\Windows\System\gUsxlcc.exe
  2⤵
  PID:592
- C:\Windows\System\SdJKDCq.exe
  C:\Windows\System\SdJKDCq.exe
  2⤵
  PID:1556
- C:\Windows\System\TjGfGQe.exe
  C:\Windows\System\TjGfGQe.exe
  2⤵
  PID:320
- C:\Windows\System\NGfJrBS.exe
  C:\Windows\System\NGfJrBS.exe
  2⤵
  PID:1164
- C:\Windows\System\nNilEFs.exe
  C:\Windows\System\nNilEFs.exe
  2⤵
  PID:1924
- C:\Windows\System\aguqIaS.exe
  C:\Windows\System\aguqIaS.exe
  2⤵
  PID:328
- C:\Windows\System\IRZVNAi.exe
  C:\Windows\System\IRZVNAi.exe
  2⤵
  PID:1744
- C:\Windows\System\MuEjIMi.exe
  C:\Windows\System\MuEjIMi.exe
  2⤵
  PID:908
- C:\Windows\System\muIDyzG.exe
  C:\Windows\System\muIDyzG.exe
  2⤵
  PID:1016
- C:\Windows\System\uiXRAmW.exe
  C:\Windows\System\uiXRAmW.exe
  2⤵
  PID:1480
- C:\Windows\System\qjGwJaZ.exe
  C:\Windows\System\qjGwJaZ.exe
  2⤵
  PID:3056
- C:\Windows\System\GOOcnky.exe
  C:\Windows\System\GOOcnky.exe
  2⤵
  PID:1416
- C:\Windows\System\tCazVun.exe
  C:\Windows\System\tCazVun.exe
  2⤵
  PID:564
- C:\Windows\System\ctSvSjn.exe
  C:\Windows\System\ctSvSjn.exe
  2⤵
  PID:2008
- C:\Windows\System\wMbklCb.exe
  C:\Windows\System\wMbklCb.exe
  2⤵
  PID:1672
- C:\Windows\System\JVIPCvO.exe
  C:\Windows\System\JVIPCvO.exe
  2⤵
  PID:1860
- C:\Windows\System\RjtlZcJ.exe
  C:\Windows\System\RjtlZcJ.exe
  2⤵
  PID:2588
- C:\Windows\System\HUTXHjy.exe
  C:\Windows\System\HUTXHjy.exe
  2⤵
  PID:1496
- C:\Windows\System\rinjTta.exe
  C:\Windows\System\rinjTta.exe
  2⤵
  PID:2612
- C:\Windows\System\bPKofcC.exe
  C:\Windows\System\bPKofcC.exe
  2⤵
  PID:2636
- C:\Windows\System\ZzuXhvr.exe
  C:\Windows\System\ZzuXhvr.exe
  2⤵
  PID:2388
- C:\Windows\System\WGRkBlE.exe
  C:\Windows\System\WGRkBlE.exe
  2⤵
  PID:2592
- C:\Windows\System\YiTqKZx.exe
  C:\Windows\System\YiTqKZx.exe
  2⤵
  PID:324
- C:\Windows\System\hxojndO.exe
  C:\Windows\System\hxojndO.exe
  2⤵
  PID:1448
- C:\Windows\System\rdMrWFT.exe
  C:\Windows\System\rdMrWFT.exe
  2⤵
  PID:1728
- C:\Windows\System\ceurTnw.exe
  C:\Windows\System\ceurTnw.exe
  2⤵
  PID:2868
- C:\Windows\System\GowXSIA.exe
  C:\Windows\System\GowXSIA.exe
  2⤵
  PID:868
- C:\Windows\System\kzkTtdu.exe
  C:\Windows\System\kzkTtdu.exe
  2⤵
  PID:2380
- C:\Windows\System\BGKSgIg.exe
  C:\Windows\System\BGKSgIg.exe
  2⤵
  PID:780
- C:\Windows\System\pKeveEr.exe
  C:\Windows\System\pKeveEr.exe
  2⤵
  PID:2232
- C:\Windows\System\ZuKZarK.exe
  C:\Windows\System\ZuKZarK.exe
  2⤵
  PID:2660
- C:\Windows\System\ythcuUA.exe
  C:\Windows\System\ythcuUA.exe
  2⤵
  PID:1132
- C:\Windows\System\iWzMZqu.exe
  C:\Windows\System\iWzMZqu.exe
  2⤵
  PID:1028
- C:\Windows\System\FzTMhAp.exe
  C:\Windows\System\FzTMhAp.exe
  2⤵
  PID:788
- C:\Windows\System\faKbQQD.exe
  C:\Windows\System\faKbQQD.exe
  2⤵
  PID:1464
- C:\Windows\System\faLmaTE.exe
  C:\Windows\System\faLmaTE.exe
  2⤵
  PID:1088
- C:\Windows\System\MTiTAhM.exe
  C:\Windows\System\MTiTAhM.exe
  2⤵
  PID:336
- C:\Windows\System\MnoNYqA.exe
  C:\Windows\System\MnoNYqA.exe
  2⤵
  PID:2312
- C:\Windows\System\ExltGpA.exe
  C:\Windows\System\ExltGpA.exe
  2⤵
  PID:2776
- C:\Windows\System\tsjStef.exe
  C:\Windows\System\tsjStef.exe
  2⤵
  PID:1676
- C:\Windows\System\EHAQaJf.exe
  C:\Windows\System\EHAQaJf.exe
  2⤵
  PID:1052
- C:\Windows\System\QmCmBJG.exe
  C:\Windows\System\QmCmBJG.exe
  2⤵
  PID:2752
- C:\Windows\System\UutVjIO.exe
  C:\Windows\System\UutVjIO.exe
  2⤵
  PID:640
- C:\Windows\System\lSNWwOZ.exe
  C:\Windows\System\lSNWwOZ.exe
  2⤵
  PID:1200
- C:\Windows\System\MGLCrCK.exe
  C:\Windows\System\MGLCrCK.exe
  2⤵
  PID:996
- C:\Windows\System\DEHUkhm.exe
  C:\Windows\System\DEHUkhm.exe
  2⤵
  PID:2016
- C:\Windows\System\eqzZNBw.exe
  C:\Windows\System\eqzZNBw.exe
  2⤵
  PID:1680
- C:\Windows\System\paMmFro.exe
  C:\Windows\System\paMmFro.exe
  2⤵
  PID:1532
- C:\Windows\System\MLiUAWc.exe
  C:\Windows\System\MLiUAWc.exe
  2⤵
  PID:2748
- C:\Windows\System\PAUSczc.exe
  C:\Windows\System\PAUSczc.exe
  2⤵
  PID:2512
- C:\Windows\System\CNXEJPB.exe
  C:\Windows\System\CNXEJPB.exe
  2⤵
  PID:2408
- C:\Windows\System\nwtBGQH.exe
  C:\Windows\System\nwtBGQH.exe
  2⤵
  PID:2624
- C:\Windows\System\SjDEzHK.exe
  C:\Windows\System\SjDEzHK.exe
  2⤵
  PID:2448
- C:\Windows\System\SHlxhGJ.exe
  C:\Windows\System\SHlxhGJ.exe
  2⤵
  PID:2816
- C:\Windows\System\VgsDGJl.exe
  C:\Windows\System\VgsDGJl.exe
  2⤵
  PID:1188
- C:\Windows\System\xTUTRdZ.exe
  C:\Windows\System\xTUTRdZ.exe
  2⤵
  PID:2288
- C:\Windows\System\YcUNcuP.exe
  C:\Windows\System\YcUNcuP.exe
  2⤵
  PID:1260
- C:\Windows\System\yFnulFz.exe
  C:\Windows\System\yFnulFz.exe
  2⤵
  PID:1748
- C:\Windows\System\wjxNqsA.exe
  C:\Windows\System\wjxNqsA.exe
  2⤵
  PID:1564
- C:\Windows\System\jZXjDOJ.exe
  C:\Windows\System\jZXjDOJ.exe
  2⤵
  PID:1236
- C:\Windows\System\dmPqYyJ.exe
  C:\Windows\System\dmPqYyJ.exe
  2⤵
  PID:2348
- C:\Windows\System\qTRjsJp.exe
  C:\Windows\System\qTRjsJp.exe
  2⤵
  PID:2796
- C:\Windows\System\XcwTwwQ.exe
  C:\Windows\System\XcwTwwQ.exe
  2⤵
  PID:676
- C:\Windows\System\UcVeZoT.exe
  C:\Windows\System\UcVeZoT.exe
  2⤵
  PID:272
- C:\Windows\System\XxGAANE.exe
  C:\Windows\System\XxGAANE.exe
  2⤵
  PID:1616
- C:\Windows\System\KKQCCks.exe
  C:\Windows\System\KKQCCks.exe
  2⤵
  PID:1880
- C:\Windows\System\rWyAGPe.exe
  C:\Windows\System\rWyAGPe.exe
  2⤵
  PID:1540
- C:\Windows\System\wMTpYWX.exe
  C:\Windows\System\wMTpYWX.exe
  2⤵
  PID:488
- C:\Windows\System\pySCRdS.exe
  C:\Windows\System\pySCRdS.exe
  2⤵
  PID:3024
- C:\Windows\System\GkwFcZZ.exe
  C:\Windows\System\GkwFcZZ.exe
  2⤵
  PID:2992
- C:\Windows\System\gIZgYjg.exe
  C:\Windows\System\gIZgYjg.exe
  2⤵
  PID:552
- C:\Windows\System\GmvNLQJ.exe
  C:\Windows\System\GmvNLQJ.exe
  2⤵
  PID:2872
- C:\Windows\System\ZewcKEU.exe
  C:\Windows\System\ZewcKEU.exe
  2⤵
  PID:2928
- C:\Windows\System\WUyMBjP.exe
  C:\Windows\System\WUyMBjP.exe
  2⤵
  PID:2704
- C:\Windows\System\tZMKctD.exe
  C:\Windows\System\tZMKctD.exe
  2⤵
  PID:2884
- C:\Windows\System\qkmpjNT.exe
  C:\Windows\System\qkmpjNT.exe
  2⤵
  PID:1500
- C:\Windows\System\YDPLWwv.exe
  C:\Windows\System\YDPLWwv.exe
  2⤵
  PID:1932
- C:\Windows\System\DbGdcGk.exe
  C:\Windows\System\DbGdcGk.exe
  2⤵
  PID:720
- C:\Windows\System\TPVwtmO.exe
  C:\Windows\System\TPVwtmO.exe
  2⤵
  PID:2252
- C:\Windows\System\IzdiEaK.exe
  C:\Windows\System\IzdiEaK.exe
  2⤵
  PID:1224
- C:\Windows\System\wDwiUOq.exe
  C:\Windows\System\wDwiUOq.exe
  2⤵
  PID:2836
- C:\Windows\System\YCvcqpp.exe
  C:\Windows\System\YCvcqpp.exe
  2⤵
  PID:2036
- C:\Windows\System\nUGUGiD.exe
  C:\Windows\System\nUGUGiD.exe
  2⤵
  PID:3064
- C:\Windows\System\cGpGTQD.exe
  C:\Windows\System\cGpGTQD.exe
  2⤵
  PID:2308
- C:\Windows\System\cWUfIQI.exe
  C:\Windows\System\cWUfIQI.exe
  2⤵
  PID:2932
- C:\Windows\System\PSEIjoe.exe
  C:\Windows\System\PSEIjoe.exe
  2⤵
  PID:2860
- C:\Windows\System\HkMJFVc.exe
  C:\Windows\System\HkMJFVc.exe
  2⤵
  PID:2708
- C:\Windows\System\LAHVZTO.exe
  C:\Windows\System\LAHVZTO.exe
  2⤵
  PID:544
- C:\Windows\System\aYOjXzu.exe
  C:\Windows\System\aYOjXzu.exe
  2⤵
  PID:412
- C:\Windows\System\lOfsttJ.exe
  C:\Windows\System\lOfsttJ.exe
  2⤵
  PID:1536
- C:\Windows\System\isZJvQu.exe
  C:\Windows\System\isZJvQu.exe
  2⤵
  PID:992
- C:\Windows\System\amXwLdC.exe
  C:\Windows\System\amXwLdC.exe
  2⤵
  PID:2080
- C:\Windows\System\yCPyzjj.exe
  C:\Windows\System\yCPyzjj.exe
  2⤵
  PID:1716
- C:\Windows\System\TecCuTV.exe
  C:\Windows\System\TecCuTV.exe
  2⤵
  PID:1640
- C:\Windows\System\DPPuUTV.exe
  C:\Windows\System\DPPuUTV.exe
  2⤵
  PID:1904
- C:\Windows\System\zmACqtk.exe
  C:\Windows\System\zmACqtk.exe
  2⤵
  PID:2600
- C:\Windows\System\mmwSpHW.exe
  C:\Windows\System\mmwSpHW.exe
  2⤵
  PID:1780
- C:\Windows\System\vMFQKrf.exe
  C:\Windows\System\vMFQKrf.exe
  2⤵
  PID:3076
- C:\Windows\System\vmzyYFO.exe
  C:\Windows\System\vmzyYFO.exe
  2⤵
  PID:3092
- C:\Windows\System\lVUEmFv.exe
  C:\Windows\System\lVUEmFv.exe
  2⤵
  PID:3108
- C:\Windows\System\KibPCMK.exe
  C:\Windows\System\KibPCMK.exe
  2⤵
  PID:3124
- C:\Windows\System\UiBIJyo.exe
  C:\Windows\System\UiBIJyo.exe
  2⤵
  PID:3144
- C:\Windows\System\IrsEjYt.exe
  C:\Windows\System\IrsEjYt.exe
  2⤵
  PID:3160
- C:\Windows\System\zRIaAtx.exe
  C:\Windows\System\zRIaAtx.exe
  2⤵
  PID:3176
- C:\Windows\System\ZERaWHq.exe
  C:\Windows\System\ZERaWHq.exe
  2⤵
  PID:3192
- C:\Windows\System\gvfoqxS.exe
  C:\Windows\System\gvfoqxS.exe
  2⤵
  PID:3208
- C:\Windows\System\sLrcwMB.exe
  C:\Windows\System\sLrcwMB.exe
  2⤵
  PID:3224
- C:\Windows\System\CTjOGoS.exe
  C:\Windows\System\CTjOGoS.exe
  2⤵
  PID:3320
- C:\Windows\System\tTQHeRz.exe
  C:\Windows\System\tTQHeRz.exe
  2⤵
  PID:3336
- C:\Windows\System\cnPWhOR.exe
  C:\Windows\System\cnPWhOR.exe
  2⤵
  PID:3352
- C:\Windows\System\jiqNULF.exe
  C:\Windows\System\jiqNULF.exe
  2⤵
  PID:3368
- C:\Windows\System\SIJVlnJ.exe
  C:\Windows\System\SIJVlnJ.exe
  2⤵
  PID:3384
- C:\Windows\System\PCnJAQp.exe
  C:\Windows\System\PCnJAQp.exe
  2⤵
  PID:3400
- C:\Windows\System\xKDAeLU.exe
  C:\Windows\System\xKDAeLU.exe
  2⤵
  PID:3416
- C:\Windows\System\VupcMqg.exe
  C:\Windows\System\VupcMqg.exe
  2⤵
  PID:3432
- C:\Windows\System\GBJEVni.exe
  C:\Windows\System\GBJEVni.exe
  2⤵
  PID:3448
- C:\Windows\System\AgnCCit.exe
  C:\Windows\System\AgnCCit.exe
  2⤵
  PID:3464
- C:\Windows\System\XPbZIpb.exe
  C:\Windows\System\XPbZIpb.exe
  2⤵
  PID:3480
- C:\Windows\System\QdrNmFz.exe
  C:\Windows\System\QdrNmFz.exe
  2⤵
  PID:3496
- C:\Windows\System\aVlEnKz.exe
  C:\Windows\System\aVlEnKz.exe
  2⤵
  PID:3512
- C:\Windows\System\hwqHUjZ.exe
  C:\Windows\System\hwqHUjZ.exe
  2⤵
  PID:3532
- C:\Windows\System\eDaGTyS.exe
  C:\Windows\System\eDaGTyS.exe
  2⤵
  PID:3548
- C:\Windows\System\tIOXuxr.exe
  C:\Windows\System\tIOXuxr.exe
  2⤵
  PID:3568
- C:\Windows\System\RiUwHWd.exe
  C:\Windows\System\RiUwHWd.exe
  2⤵
  PID:3584
- C:\Windows\System\DXbvVrO.exe
  C:\Windows\System\DXbvVrO.exe
  2⤵
  PID:3600
- C:\Windows\System\OjQLcKZ.exe
  C:\Windows\System\OjQLcKZ.exe
  2⤵
  PID:3616
- C:\Windows\System\DauWitl.exe
  C:\Windows\System\DauWitl.exe
  2⤵
  PID:3632
- C:\Windows\System\OJoYvyQ.exe
  C:\Windows\System\OJoYvyQ.exe
  2⤵
  PID:3648
- C:\Windows\System\kxqKdCX.exe
  C:\Windows\System\kxqKdCX.exe
  2⤵
  PID:3668
- C:\Windows\System\ufaaqdP.exe
  C:\Windows\System\ufaaqdP.exe
  2⤵
  PID:3684
- C:\Windows\System\LMqCePX.exe
  C:\Windows\System\LMqCePX.exe
  2⤵
  PID:3700
- C:\Windows\System\ogcRIuP.exe
  C:\Windows\System\ogcRIuP.exe
  2⤵
  PID:3716
- C:\Windows\System\GzRtfvu.exe
  C:\Windows\System\GzRtfvu.exe
  2⤵
  PID:3732
- C:\Windows\System\qzvjfBU.exe
  C:\Windows\System\qzvjfBU.exe
  2⤵
  PID:3748
- C:\Windows\System\ZiXvOml.exe
  C:\Windows\System\ZiXvOml.exe
  2⤵
  PID:3768
- C:\Windows\System\MSdlCdS.exe
  C:\Windows\System\MSdlCdS.exe
  2⤵
  PID:3784
- C:\Windows\System\NwaohIe.exe
  C:\Windows\System\NwaohIe.exe
  2⤵
  PID:3800
- C:\Windows\System\taoESKj.exe
  C:\Windows\System\taoESKj.exe
  2⤵
  PID:3816
- C:\Windows\System\GiZeImn.exe
  C:\Windows\System\GiZeImn.exe
  2⤵
  PID:3832
- C:\Windows\System\zocEvjI.exe
  C:\Windows\System\zocEvjI.exe
  2⤵
  PID:3848
- C:\Windows\System\ntIFvoh.exe
  C:\Windows\System\ntIFvoh.exe
  2⤵
  PID:3864
- C:\Windows\System\TDPtMBV.exe
  C:\Windows\System\TDPtMBV.exe
  2⤵
  PID:3884
- C:\Windows\System\PkAOAKM.exe
  C:\Windows\System\PkAOAKM.exe
  2⤵
  PID:3900
- C:\Windows\System\yBIGGzt.exe
  C:\Windows\System\yBIGGzt.exe
  2⤵
  PID:3916
- C:\Windows\System\btMLwgO.exe
  C:\Windows\System\btMLwgO.exe
  2⤵
  PID:3932
- C:\Windows\System\jEKuWpp.exe
  C:\Windows\System\jEKuWpp.exe
  2⤵
  PID:3948
- C:\Windows\System\RCeOpJg.exe
  C:\Windows\System\RCeOpJg.exe
  2⤵
  PID:3964
- C:\Windows\System\WYWzpYv.exe
  C:\Windows\System\WYWzpYv.exe
  2⤵
  PID:3984
- C:\Windows\System\aJlUHui.exe
  C:\Windows\System\aJlUHui.exe
  2⤵
  PID:4000
- C:\Windows\System\RNOTfek.exe
  C:\Windows\System\RNOTfek.exe
  2⤵
  PID:4016
- C:\Windows\System\AkSXyZN.exe
  C:\Windows\System\AkSXyZN.exe
  2⤵
  PID:1388
- C:\Windows\System\aQORDnj.exe
  C:\Windows\System\aQORDnj.exe
  2⤵
  PID:3116
- C:\Windows\System\VptXGla.exe
  C:\Windows\System\VptXGla.exe
  2⤵
  PID:3156
- C:\Windows\System\ZjXGMxq.exe
  C:\Windows\System\ZjXGMxq.exe
  2⤵
  PID:3168
- C:\Windows\System\pNtExfx.exe
  C:\Windows\System\pNtExfx.exe
  2⤵
  PID:2000
- C:\Windows\System\YOqYwCq.exe
  C:\Windows\System\YOqYwCq.exe
  2⤵
  PID:2336
- C:\Windows\System\ibKHCJd.exe
  C:\Windows\System\ibKHCJd.exe
  2⤵
  PID:3136
- C:\Windows\System\dTBsZCG.exe
  C:\Windows\System\dTBsZCG.exe
  2⤵
  PID:3204
- C:\Windows\System\RhKyynY.exe
  C:\Windows\System\RhKyynY.exe
  2⤵
  PID:3244
- C:\Windows\System\SmzdaLe.exe
  C:\Windows\System\SmzdaLe.exe
  2⤵
  PID:3260
- C:\Windows\System\TpeDrgB.exe
  C:\Windows\System\TpeDrgB.exe
  2⤵
  PID:3280
- C:\Windows\System\INPVQpH.exe
  C:\Windows\System\INPVQpH.exe
  2⤵
  PID:3296
- C:\Windows\System\SzpzkJu.exe
  C:\Windows\System\SzpzkJu.exe
  2⤵
  PID:3312
- C:\Windows\System\nqCQdAZ.exe
  C:\Windows\System\nqCQdAZ.exe
  2⤵
  PID:3216
- C:\Windows\System\ipIQsho.exe
  C:\Windows\System\ipIQsho.exe
  2⤵
  PID:3560
- C:\Windows\System\przGRpy.exe
  C:\Windows\System\przGRpy.exe
  2⤵
  PID:3624
- C:\Windows\System\OYYzezO.exe
  C:\Windows\System\OYYzezO.exe
  2⤵
  PID:3856
- C:\Windows\System\AXYEIld.exe
  C:\Windows\System\AXYEIld.exe
  2⤵
  PID:3928
- C:\Windows\System\vCDYUmC.exe
  C:\Windows\System\vCDYUmC.exe
  2⤵
  PID:3944
- C:\Windows\System\qzvGfXV.exe
  C:\Windows\System\qzvGfXV.exe
  2⤵
  PID:3576
- C:\Windows\System\ahUImaJ.exe
  C:\Windows\System\ahUImaJ.exe
  2⤵
  PID:3740
- C:\Windows\System\vfDYOiC.exe
  C:\Windows\System\vfDYOiC.exe
  2⤵
  PID:3580
- C:\Windows\System\NtdBRrG.exe
  C:\Windows\System\NtdBRrG.exe
  2⤵
  PID:3676
- C:\Windows\System\yMFUJfc.exe
  C:\Windows\System\yMFUJfc.exe
  2⤵
  PID:3812
- C:\Windows\System\yRCebpd.exe
  C:\Windows\System\yRCebpd.exe
  2⤵
  PID:3880
- C:\Windows\System\FucSKFZ.exe
  C:\Windows\System\FucSKFZ.exe
  2⤵
  PID:4008
- C:\Windows\System\bratGSZ.exe
  C:\Windows\System\bratGSZ.exe
  2⤵
  PID:3088
- C:\Windows\System\JUeOAcZ.exe
  C:\Windows\System\JUeOAcZ.exe
  2⤵
  PID:3172
- C:\Windows\System\mmudUME.exe
  C:\Windows\System\mmudUME.exe
  2⤵
  PID:3292
- C:\Windows\System\fneHvRc.exe
  C:\Windows\System\fneHvRc.exe
  2⤵
  PID:3796
- C:\Windows\System\hxSKuwj.exe
  C:\Windows\System\hxSKuwj.exe
  2⤵
  PID:4044
- C:\Windows\System\tNkDyXN.exe
  C:\Windows\System\tNkDyXN.exe
  2⤵
  PID:4064
- C:\Windows\System\tIISVNE.exe
  C:\Windows\System\tIISVNE.exe
  2⤵
  PID:4084
- C:\Windows\System\pyWuddP.exe
  C:\Windows\System\pyWuddP.exe
  2⤵
  PID:2044
- C:\Windows\System\nOOUezu.exe
  C:\Windows\System\nOOUezu.exe
  2⤵
  PID:1452
- C:\Windows\System\BOAuWha.exe
  C:\Windows\System\BOAuWha.exe
  2⤵
  PID:1888
- C:\Windows\System\lgWfOdX.exe
  C:\Windows\System\lgWfOdX.exe
  2⤵
  PID:3240
- C:\Windows\System\suuYJLJ.exe
  C:\Windows\System\suuYJLJ.exe
  2⤵
  PID:3328
- C:\Windows\System\EwiojOE.exe
  C:\Windows\System\EwiojOE.exe
  2⤵
  PID:3424
- C:\Windows\System\GaSnOzM.exe
  C:\Windows\System\GaSnOzM.exe
  2⤵
  PID:3472
- C:\Windows\System\PVlcTTu.exe
  C:\Windows\System\PVlcTTu.exe
  2⤵
  PID:3528
- C:\Windows\System\jGvUeJK.exe
  C:\Windows\System\jGvUeJK.exe
  2⤵
  PID:3596
- C:\Windows\System\QPzCsvG.exe
  C:\Windows\System\QPzCsvG.exe
  2⤵
  PID:3696
- C:\Windows\System\wQkQCsD.exe
  C:\Windows\System\wQkQCsD.exe
  2⤵
  PID:3828
- C:\Windows\System\JWlZjiW.exe
  C:\Windows\System\JWlZjiW.exe
  2⤵
  PID:3996
- C:\Windows\System\NuXHWqX.exe
  C:\Windows\System\NuXHWqX.exe
  2⤵
  PID:3376
- C:\Windows\System\mYIRKXk.exe
  C:\Windows\System\mYIRKXk.exe
  2⤵
  PID:3504
- C:\Windows\System\zTAEYAD.exe
  C:\Windows\System\zTAEYAD.exe
  2⤵
  PID:3744
- C:\Windows\System\DJDZqmt.exe
  C:\Windows\System\DJDZqmt.exe
  2⤵
  PID:3912
- C:\Windows\System\gRMZKVV.exe
  C:\Windows\System\gRMZKVV.exe
  2⤵
  PID:448
- C:\Windows\System\VTVvKAL.exe
  C:\Windows\System\VTVvKAL.exe
  2⤵
  PID:3256
- C:\Windows\System\PFudAgg.exe
  C:\Windows\System\PFudAgg.exe
  2⤵
  PID:4052
- C:\Windows\System\JIHWotQ.exe
  C:\Windows\System\JIHWotQ.exe
  2⤵
  PID:1272
- C:\Windows\System\xurTJAc.exe
  C:\Windows\System\xurTJAc.exe
  2⤵
  PID:2864
- C:\Windows\System\XPowxSl.exe
  C:\Windows\System\XPowxSl.exe
  2⤵
  PID:3236
- C:\Windows\System\PelhzoK.exe
  C:\Windows\System\PelhzoK.exe
  2⤵
  PID:1504
- C:\Windows\System\LHRMxGP.exe
  C:\Windows\System\LHRMxGP.exe
  2⤵
  PID:3460
- C:\Windows\System\TPECNql.exe
  C:\Windows\System\TPECNql.exe
  2⤵
  PID:1248
- C:\Windows\System\TBVLMWJ.exe
  C:\Windows\System\TBVLMWJ.exe
  2⤵
  PID:3332
- C:\Windows\System\caxxOgD.exe
  C:\Windows\System\caxxOgD.exe
  2⤵
  PID:3764
- C:\Windows\System\JhhmViY.exe
  C:\Windows\System\JhhmViY.exe
  2⤵
  PID:3960
- C:\Windows\System\pUtLilP.exe
  C:\Windows\System\pUtLilP.exe
  2⤵
  PID:3380
- C:\Windows\System\OkdvbXy.exe
  C:\Windows\System\OkdvbXy.exe
  2⤵
  PID:3412
- C:\Windows\System\HGNlCRC.exe
  C:\Windows\System\HGNlCRC.exe
  2⤵
  PID:2368
- C:\Windows\System\gSWEaNf.exe
  C:\Windows\System\gSWEaNf.exe
  2⤵
  PID:4032
- C:\Windows\System\RYgemBK.exe
  C:\Windows\System\RYgemBK.exe
  2⤵
  PID:4056
- C:\Windows\System\GclisIx.exe
  C:\Windows\System\GclisIx.exe
  2⤵
  PID:2828
- C:\Windows\System\fDrWTnu.exe
  C:\Windows\System\fDrWTnu.exe
  2⤵
  PID:3104
- C:\Windows\System\GGhkMbS.exe
  C:\Windows\System\GGhkMbS.exe
  2⤵
  PID:3364
- C:\Windows\System\vpUjLLZ.exe
  C:\Windows\System\vpUjLLZ.exe
  2⤵
  PID:3712
- C:\Windows\System\RkKtnFE.exe
  C:\Windows\System\RkKtnFE.exe
  2⤵
  PID:2568
- C:\Windows\System\TjbRftK.exe
  C:\Windows\System\TjbRftK.exe
  2⤵
  PID:3892
- C:\Windows\System\zaPyCfG.exe
  C:\Windows\System\zaPyCfG.exe
  2⤵
  PID:3644
- C:\Windows\System\hAllTgt.exe
  C:\Windows\System\hAllTgt.exe
  2⤵
  PID:3640
- C:\Windows\System\UWiAAWX.exe
  C:\Windows\System\UWiAAWX.exe
  2⤵
  PID:3456
- C:\Windows\System\XWZPPlQ.exe
  C:\Windows\System\XWZPPlQ.exe
  2⤵
  PID:4076
- C:\Windows\System\THqZVSE.exe
  C:\Windows\System\THqZVSE.exe
  2⤵
  PID:2404
- C:\Windows\System\aRaMnSX.exe
  C:\Windows\System\aRaMnSX.exe
  2⤵
  PID:3692
- C:\Windows\System\tERnvdF.exe
  C:\Windows\System\tERnvdF.exe
  2⤵
  PID:3940
- C:\Windows\System\amSLzpV.exe
  C:\Windows\System\amSLzpV.exe
  2⤵
  PID:4036
- C:\Windows\System\UjbgvGP.exe
  C:\Windows\System\UjbgvGP.exe
  2⤵
  PID:3876
- C:\Windows\System\TFwzIwi.exe
  C:\Windows\System\TFwzIwi.exe
  2⤵
  PID:2452
- C:\Windows\System\CbbIRwB.exe
  C:\Windows\System\CbbIRwB.exe
  2⤵
  PID:4108
- C:\Windows\System\HcHSisF.exe
  C:\Windows\System\HcHSisF.exe
  2⤵
  PID:4124
- C:\Windows\System\DXlJhCM.exe
  C:\Windows\System\DXlJhCM.exe
  2⤵
  PID:4140
- C:\Windows\System\hANfFrO.exe
  C:\Windows\System\hANfFrO.exe
  2⤵
  PID:4160
- C:\Windows\System\zHJhymG.exe
  C:\Windows\System\zHJhymG.exe
  2⤵
  PID:4176
- C:\Windows\System\xUsqzAD.exe
  C:\Windows\System\xUsqzAD.exe
  2⤵
  PID:4192
- C:\Windows\System\kdIpfnV.exe
  C:\Windows\System\kdIpfnV.exe
  2⤵
  PID:4208
- C:\Windows\System\PIsDrql.exe
  C:\Windows\System\PIsDrql.exe
  2⤵
  PID:4224
- C:\Windows\System\InCQKMU.exe
  C:\Windows\System\InCQKMU.exe
  2⤵
  PID:4240
- C:\Windows\System\kHtKmcw.exe
  C:\Windows\System\kHtKmcw.exe
  2⤵
  PID:4260
- C:\Windows\System\qfXrIgn.exe
  C:\Windows\System\qfXrIgn.exe
  2⤵
  PID:4276
- C:\Windows\System\owmULUm.exe
  C:\Windows\System\owmULUm.exe
  2⤵
  PID:4292
- C:\Windows\System\lCYXmom.exe
  C:\Windows\System\lCYXmom.exe
  2⤵
  PID:4308
- C:\Windows\System\TQqpCiW.exe
  C:\Windows\System\TQqpCiW.exe
  2⤵
  PID:4324
- C:\Windows\System\amDTKdq.exe
  C:\Windows\System\amDTKdq.exe
  2⤵
  PID:4344
- C:\Windows\System\XkmVJyx.exe
  C:\Windows\System\XkmVJyx.exe
  2⤵
  PID:4360
- C:\Windows\System\OnHFMYT.exe
  C:\Windows\System\OnHFMYT.exe
  2⤵
  PID:4376
- C:\Windows\System\TYGYSmF.exe
  C:\Windows\System\TYGYSmF.exe
  2⤵
  PID:4392
- C:\Windows\System\oFmnLGk.exe
  C:\Windows\System\oFmnLGk.exe
  2⤵
  PID:4408
- C:\Windows\System\bUeWWsA.exe
  C:\Windows\System\bUeWWsA.exe
  2⤵
  PID:4428
- C:\Windows\System\ctqrdTw.exe
  C:\Windows\System\ctqrdTw.exe
  2⤵
  PID:4444
- C:\Windows\System\zPUejYi.exe
  C:\Windows\System\zPUejYi.exe
  2⤵
  PID:4460
- C:\Windows\System\ovetvqG.exe
  C:\Windows\System\ovetvqG.exe
  2⤵
  PID:4476
- C:\Windows\System\fzxRpvL.exe
  C:\Windows\System\fzxRpvL.exe
  2⤵
  PID:4492
- C:\Windows\System\SvWanYY.exe
  C:\Windows\System\SvWanYY.exe
  2⤵
  PID:4508
- C:\Windows\System\hlazbti.exe
  C:\Windows\System\hlazbti.exe
  2⤵
  PID:4664
- C:\Windows\System\adnWAeL.exe
  C:\Windows\System\adnWAeL.exe
  2⤵
  PID:4680
- C:\Windows\System\SiUADvf.exe
  C:\Windows\System\SiUADvf.exe
  2⤵
  PID:4700
- C:\Windows\System\wKKCRVL.exe
  C:\Windows\System\wKKCRVL.exe
  2⤵
  PID:4720
- C:\Windows\System\NZOhIYV.exe
  C:\Windows\System\NZOhIYV.exe
  2⤵
  PID:4736
- C:\Windows\System\BnoHxhi.exe
  C:\Windows\System\BnoHxhi.exe
  2⤵
  PID:4756
- C:\Windows\System\iVibiPV.exe
  C:\Windows\System\iVibiPV.exe
  2⤵
  PID:4772
- C:\Windows\System\GlyBSdX.exe
  C:\Windows\System\GlyBSdX.exe
  2⤵
  PID:4788
- C:\Windows\System\bvgMnYn.exe
  C:\Windows\System\bvgMnYn.exe
  2⤵
  PID:4808
- C:\Windows\System\QGcwtyo.exe
  C:\Windows\System\QGcwtyo.exe
  2⤵
  PID:4904
- C:\Windows\System\UzTYNCU.exe
  C:\Windows\System\UzTYNCU.exe
  2⤵
  PID:4920
- C:\Windows\System\jVdsEjm.exe
  C:\Windows\System\jVdsEjm.exe
  2⤵
  PID:4940
- C:\Windows\System\MGmzJvX.exe
  C:\Windows\System\MGmzJvX.exe
  2⤵
  PID:4960
- C:\Windows\System\cJrptKt.exe
  C:\Windows\System\cJrptKt.exe
  2⤵
  PID:4980
- C:\Windows\System\uxfwQMe.exe
  C:\Windows\System\uxfwQMe.exe
  2⤵
  PID:4996
- C:\Windows\System\sYlpKcB.exe
  C:\Windows\System\sYlpKcB.exe
  2⤵
  PID:5016
- C:\Windows\System\RtHpXcr.exe
  C:\Windows\System\RtHpXcr.exe
  2⤵
  PID:5044
- C:\Windows\System\tkjHJBh.exe
  C:\Windows\System\tkjHJBh.exe
  2⤵
  PID:5064
- C:\Windows\System\sxROeWD.exe
  C:\Windows\System\sxROeWD.exe
  2⤵
  PID:5088
- C:\Windows\System\VHCmrKE.exe
  C:\Windows\System\VHCmrKE.exe
  2⤵
  PID:5104
- C:\Windows\System\KNSPEoP.exe
  C:\Windows\System\KNSPEoP.exe
  2⤵
  PID:1944
- C:\Windows\System\iPTDBSw.exe
  C:\Windows\System\iPTDBSw.exe
  2⤵
  PID:4148
- C:\Windows\System\ajCYuJv.exe
  C:\Windows\System\ajCYuJv.exe
  2⤵
  PID:4216
- C:\Windows\System\HuboVjP.exe
  C:\Windows\System\HuboVjP.exe
  2⤵
  PID:4284
- C:\Windows\System\YAfWXPD.exe
  C:\Windows\System\YAfWXPD.exe
  2⤵
  PID:4156
- C:\Windows\System\KHtBXeh.exe
  C:\Windows\System\KHtBXeh.exe
  2⤵
  PID:4420
- C:\Windows\System\rOrKGXE.exe
  C:\Windows\System\rOrKGXE.exe
  2⤵
  PID:4516
- C:\Windows\System\aptgvHY.exe
  C:\Windows\System\aptgvHY.exe
  2⤵
  PID:4272
- C:\Windows\System\KdLOzEX.exe
  C:\Windows\System\KdLOzEX.exe
  2⤵
  PID:4404
- C:\Windows\System\OlJoBfE.exe
  C:\Windows\System\OlJoBfE.exe
  2⤵
  PID:3844
- C:\Windows\System\phDexPK.exe
  C:\Windows\System\phDexPK.exe
  2⤵
  PID:4100
- C:\Windows\System\ShYDoHG.exe
  C:\Windows\System\ShYDoHG.exe
  2⤵
  PID:4340
- C:\Windows\System\hUSDmbo.exe
  C:\Windows\System\hUSDmbo.exe
  2⤵
  PID:4172
- C:\Windows\System\vkqcvuI.exe
  C:\Windows\System\vkqcvuI.exe
  2⤵
  PID:4132
- C:\Windows\System\tWbrLhc.exe
  C:\Windows\System\tWbrLhc.exe
  2⤵
  PID:4564
- C:\Windows\System\LwlufWP.exe
  C:\Windows\System\LwlufWP.exe
  2⤵
  PID:4580
- C:\Windows\System\QoXfdtX.exe
  C:\Windows\System\QoXfdtX.exe
  2⤵
  PID:4616
- C:\Windows\System\aPrZgWD.exe
  C:\Windows\System\aPrZgWD.exe
  2⤵
  PID:4632
- C:\Windows\System\VXMAthl.exe
  C:\Windows\System\VXMAthl.exe
  2⤵
  PID:4648
- C:\Windows\System\FGtMUzr.exe
  C:\Windows\System\FGtMUzr.exe
  2⤵
  PID:4672
- C:\Windows\System\DMWPNTG.exe
  C:\Windows\System\DMWPNTG.exe
  2⤵
  PID:4696
- C:\Windows\System\XhObNog.exe
  C:\Windows\System\XhObNog.exe
  2⤵
  PID:4728
- C:\Windows\System\IvpgzFC.exe
  C:\Windows\System\IvpgzFC.exe
  2⤵
  PID:4732
- C:\Windows\System\QhVRDkM.exe
  C:\Windows\System\QhVRDkM.exe
  2⤵
  PID:4804
- C:\Windows\System\EZZWgJh.exe
  C:\Windows\System\EZZWgJh.exe
  2⤵
  PID:4820
- C:\Windows\System\UHDjrpp.exe
  C:\Windows\System\UHDjrpp.exe
  2⤵
  PID:4836
- C:\Windows\System\XCLeUsU.exe
  C:\Windows\System\XCLeUsU.exe
  2⤵
  PID:4520
- C:\Windows\System\NgseirH.exe
  C:\Windows\System\NgseirH.exe
  2⤵
  PID:4864
- C:\Windows\System\mxbXKVw.exe
  C:\Windows\System\mxbXKVw.exe
  2⤵
  PID:4868
- C:\Windows\System\pvjKBvn.exe
  C:\Windows\System\pvjKBvn.exe
  2⤵
  PID:4912
- C:\Windows\System\VnGtKKz.exe
  C:\Windows\System\VnGtKKz.exe
  2⤵
  PID:4936
- C:\Windows\System\jEiUnOu.exe
  C:\Windows\System\jEiUnOu.exe
  2⤵
  PID:4968
- C:\Windows\System\POtWddL.exe
  C:\Windows\System\POtWddL.exe
  2⤵
  PID:5004
- C:\Windows\System\ktbyCeH.exe
  C:\Windows\System\ktbyCeH.exe
  2⤵
  PID:5024
- C:\Windows\System\nmFSFik.exe
  C:\Windows\System\nmFSFik.exe
  2⤵
  PID:4188
- C:\Windows\System\RRmoEkD.exe
  C:\Windows\System\RRmoEkD.exe
  2⤵
  PID:4484
- C:\Windows\System\fzDUqpB.exe
  C:\Windows\System\fzDUqpB.exe
  2⤵
  PID:4424
- C:\Windows\System\hiaRteQ.exe
  C:\Windows\System\hiaRteQ.exe
  2⤵
  PID:4080
- C:\Windows\System\vEcoGdi.exe
  C:\Windows\System\vEcoGdi.exe
  2⤵
  PID:4236
- C:\Windows\System\nuMGBOx.exe
  C:\Windows\System\nuMGBOx.exe
  2⤵
  PID:4332
- C:\Windows\System\ZCVUqJE.exe
  C:\Windows\System\ZCVUqJE.exe
  2⤵
  PID:3188
- C:\Windows\System\yDxFZcp.exe
  C:\Windows\System\yDxFZcp.exe
  2⤵
  PID:4500
- C:\Windows\System\tYPyZrc.exe
  C:\Windows\System\tYPyZrc.exe
  2⤵
  PID:4596
- C:\Windows\System\ktiyguf.exe
  C:\Windows\System\ktiyguf.exe
  2⤵
  PID:4600
- C:\Windows\System\MHjrQYi.exe
  C:\Windows\System\MHjrQYi.exe
  2⤵
  PID:4368
- C:\Windows\System\BkeTOZV.exe
  C:\Windows\System\BkeTOZV.exe
  2⤵
  PID:4592
- C:\Windows\System\IxelbUD.exe
  C:\Windows\System\IxelbUD.exe
  2⤵
  PID:4624
- C:\Windows\System\hzFANqg.exe
  C:\Windows\System\hzFANqg.exe
  2⤵
  PID:4744
- C:\Windows\System\juCRqUP.exe
  C:\Windows\System\juCRqUP.exe
  2⤵
  PID:4816
- C:\Windows\System\UbrrjVR.exe
  C:\Windows\System\UbrrjVR.exe
  2⤵
  PID:4768
- C:\Windows\System\TJPOgfL.exe
  C:\Windows\System\TJPOgfL.exe
  2⤵
  PID:4848
- C:\Windows\System\bVEWpyY.exe
  C:\Windows\System\bVEWpyY.exe
  2⤵
  PID:4988
- C:\Windows\System\CyqLGFz.exe
  C:\Windows\System\CyqLGFz.exe
  2⤵
  PID:888
- C:\Windows\System\gEETDVk.exe
  C:\Windows\System\gEETDVk.exe
  2⤵
  PID:5112
- C:\Windows\System\DFNJkMs.exe
  C:\Windows\System\DFNJkMs.exe
  2⤵
  PID:4472
- C:\Windows\System\poEJrJV.exe
  C:\Windows\System\poEJrJV.exe
  2⤵
  PID:4120
- C:\Windows\System\uFAhBeH.exe
  C:\Windows\System\uFAhBeH.exe
  2⤵
  PID:4576
- C:\Windows\System\iwERwma.exe
  C:\Windows\System\iwERwma.exe
  2⤵
  PID:4784
- C:\Windows\System\TXeksrm.exe
  C:\Windows\System\TXeksrm.exe
  2⤵
  PID:4588
- C:\Windows\System\FwpTqjs.exe
  C:\Windows\System\FwpTqjs.exe
  2⤵
  PID:4204
- C:\Windows\System\onBaNHA.exe
  C:\Windows\System\onBaNHA.exe
  2⤵
  PID:4336
- C:\Windows\System\jOGgymc.exe
  C:\Windows\System\jOGgymc.exe
  2⤵
  PID:4860
- C:\Windows\System\IpSloia.exe
  C:\Windows\System\IpSloia.exe
  2⤵
  PID:4952
- C:\Windows\System\njeixXL.exe
  C:\Windows\System\njeixXL.exe
  2⤵
  PID:4928
- C:\Windows\System\xuobgOM.exe
  C:\Windows\System\xuobgOM.exe
  2⤵
  PID:5032
- C:\Windows\System\MNWzCCd.exe
  C:\Windows\System\MNWzCCd.exe
  2⤵
  PID:4304
- C:\Windows\System\mPMzKcV.exe
  C:\Windows\System\mPMzKcV.exe
  2⤵
  PID:4888
- C:\Windows\System\NpfBwxq.exe
  C:\Windows\System\NpfBwxq.exe
  2⤵
  PID:4400
- C:\Windows\System\cFGUDFC.exe
  C:\Windows\System\cFGUDFC.exe
  2⤵
  PID:4356
- C:\Windows\System\JExjbDp.exe
  C:\Windows\System\JExjbDp.exe
  2⤵
  PID:4136
- C:\Windows\System\nlXbWcS.exe
  C:\Windows\System\nlXbWcS.exe
  2⤵
  PID:4992
- C:\Windows\System\SrMVFnb.exe
  C:\Windows\System\SrMVFnb.exe
  2⤵
  PID:5080
- C:\Windows\System\mlYFWTv.exe
  C:\Windows\System\mlYFWTv.exe
  2⤵
  PID:5096
- C:\Windows\System\eWwmOQN.exe
  C:\Windows\System\eWwmOQN.exe
  2⤵
  PID:4452
- C:\Windows\System\JmNhLEd.exe
  C:\Windows\System\JmNhLEd.exe
  2⤵
  PID:4556
- C:\Windows\System\sGvWGYc.exe
  C:\Windows\System\sGvWGYc.exe
  2⤵
  PID:4644
- C:\Windows\System\SVXvpAw.exe
  C:\Windows\System\SVXvpAw.exe
  2⤵
  PID:5136
- C:\Windows\System\GReAVUN.exe
  C:\Windows\System\GReAVUN.exe
  2⤵
  PID:5152
- C:\Windows\System\dOSmiIi.exe
  C:\Windows\System\dOSmiIi.exe
  2⤵
  PID:5172
- C:\Windows\System\jftvXqv.exe
  C:\Windows\System\jftvXqv.exe
  2⤵
  PID:5204
- C:\Windows\System\PPGyZVM.exe
  C:\Windows\System\PPGyZVM.exe
  2⤵
  PID:5220
- C:\Windows\System\ZyQFPWa.exe
  C:\Windows\System\ZyQFPWa.exe
  2⤵
  PID:5240
- C:\Windows\System\ZdfVmQW.exe
  C:\Windows\System\ZdfVmQW.exe
  2⤵
  PID:5256
- C:\Windows\System\lzIvymB.exe
  C:\Windows\System\lzIvymB.exe
  2⤵
  PID:5272
- C:\Windows\System\RliNQnS.exe
  C:\Windows\System\RliNQnS.exe
  2⤵
  PID:5288
- C:\Windows\System\JfKvxVR.exe
  C:\Windows\System\JfKvxVR.exe
  2⤵
  PID:5304
- C:\Windows\System\TtGEEnS.exe
  C:\Windows\System\TtGEEnS.exe
  2⤵
  PID:5320
- C:\Windows\System\vYVvcfw.exe
  C:\Windows\System\vYVvcfw.exe
  2⤵
  PID:5336
- C:\Windows\System\sJsdzWr.exe
  C:\Windows\System\sJsdzWr.exe
  2⤵
  PID:5352
- C:\Windows\System\AgwNtcg.exe
  C:\Windows\System\AgwNtcg.exe
  2⤵
  PID:5376
- C:\Windows\System\WsJWrsQ.exe
  C:\Windows\System\WsJWrsQ.exe
  2⤵
  PID:5392
- C:\Windows\System\aIUMcZG.exe
  C:\Windows\System\aIUMcZG.exe
  2⤵
  PID:5408
- C:\Windows\System\ystpORO.exe
  C:\Windows\System\ystpORO.exe
  2⤵
  PID:5424
- C:\Windows\System\WwziavE.exe
  C:\Windows\System\WwziavE.exe
  2⤵
  PID:5444
- C:\Windows\System\DkZZEFs.exe
  C:\Windows\System\DkZZEFs.exe
  2⤵
  PID:5460
- C:\Windows\System\ohIrgqw.exe
  C:\Windows\System\ohIrgqw.exe
  2⤵
  PID:5476
- C:\Windows\System\CLaGKIs.exe
  C:\Windows\System\CLaGKIs.exe
  2⤵
  PID:5492
- C:\Windows\System\erhddzb.exe
  C:\Windows\System\erhddzb.exe
  2⤵
  PID:5508
- C:\Windows\System\GclHSPd.exe
  C:\Windows\System\GclHSPd.exe
  2⤵
  PID:5528
- C:\Windows\System\JmLLiJn.exe
  C:\Windows\System\JmLLiJn.exe
  2⤵
  PID:5544
- C:\Windows\System\aKcYqLm.exe
  C:\Windows\System\aKcYqLm.exe
  2⤵
  PID:5560
- C:\Windows\System\RDlkPAx.exe
  C:\Windows\System\RDlkPAx.exe
  2⤵
  PID:5576
- C:\Windows\System\LuIScGN.exe
  C:\Windows\System\LuIScGN.exe
  2⤵
  PID:5596
- C:\Windows\System\cTjfwnE.exe
  C:\Windows\System\cTjfwnE.exe
  2⤵
  PID:5612
- C:\Windows\System\vrfVYiq.exe
  C:\Windows\System\vrfVYiq.exe
  2⤵
  PID:5628
- C:\Windows\System\ANysZeE.exe
  C:\Windows\System\ANysZeE.exe
  2⤵
  PID:5644
- C:\Windows\System\NmltmFA.exe
  C:\Windows\System\NmltmFA.exe
  2⤵
  PID:5664
- C:\Windows\System\rhcADHg.exe
  C:\Windows\System\rhcADHg.exe
  2⤵
  PID:5680
- C:\Windows\System\mUcQuuj.exe
  C:\Windows\System\mUcQuuj.exe
  2⤵
  PID:5812
- C:\Windows\System\LPMCEaV.exe
  C:\Windows\System\LPMCEaV.exe
  2⤵
  PID:5828
- C:\Windows\System\OJGtJBO.exe
  C:\Windows\System\OJGtJBO.exe
  2⤵
  PID:5844
- C:\Windows\System\xhqUidz.exe
  C:\Windows\System\xhqUidz.exe
  2⤵
  PID:5860
- C:\Windows\System\CMorHEg.exe
  C:\Windows\System\CMorHEg.exe
  2⤵
  PID:5876
- C:\Windows\System\PFTqTYZ.exe
  C:\Windows\System\PFTqTYZ.exe
  2⤵
  PID:5896
- C:\Windows\System\nlQSZZa.exe
  C:\Windows\System\nlQSZZa.exe
  2⤵
  PID:5912
- C:\Windows\System\egcvCHA.exe
  C:\Windows\System\egcvCHA.exe
  2⤵
  PID:5948
- C:\Windows\System\TZPImlh.exe
  C:\Windows\System\TZPImlh.exe
  2⤵
  PID:5964
- C:\Windows\System\EOcTRrz.exe
  C:\Windows\System\EOcTRrz.exe
  2⤵
  PID:5980
- C:\Windows\System\WKBBmSL.exe
  C:\Windows\System\WKBBmSL.exe
  2⤵
  PID:5996
- C:\Windows\System\iGMfLui.exe
  C:\Windows\System\iGMfLui.exe
  2⤵
  PID:6012
- C:\Windows\System\gZzSDpC.exe
  C:\Windows\System\gZzSDpC.exe
  2⤵
  PID:6028
- C:\Windows\System\gCZYpDb.exe
  C:\Windows\System\gCZYpDb.exe
  2⤵
  PID:6048
- C:\Windows\System\khwoRdX.exe
  C:\Windows\System\khwoRdX.exe
  2⤵
  PID:6064
- C:\Windows\System\HLUEiRC.exe
  C:\Windows\System\HLUEiRC.exe
  2⤵
  PID:6080
- C:\Windows\System\paPxfYb.exe
  C:\Windows\System\paPxfYb.exe
  2⤵
  PID:6096
- C:\Windows\System\jVHjUZE.exe
  C:\Windows\System\jVHjUZE.exe
  2⤵
  PID:6116
- C:\Windows\System\krqqRjN.exe
  C:\Windows\System\krqqRjN.exe
  2⤵
  PID:6136
- C:\Windows\System\fiCYWOA.exe
  C:\Windows\System\fiCYWOA.exe
  2⤵
  PID:2912
- C:\Windows\System\WNkrXNE.exe
  C:\Windows\System\WNkrXNE.exe
  2⤵
  PID:3612
- C:\Windows\System\yaLdWXN.exe
  C:\Windows\System\yaLdWXN.exe
  2⤵
  PID:5160
- C:\Windows\System\ZMZzHYV.exe
  C:\Windows\System\ZMZzHYV.exe
  2⤵
  PID:5416
- C:\Windows\System\PzVdGcf.exe
  C:\Windows\System\PzVdGcf.exe
  2⤵
  PID:5488
- C:\Windows\System\uqZvEpS.exe
  C:\Windows\System\uqZvEpS.exe
  2⤵
  PID:5552
- C:\Windows\System\WdofsKL.exe
  C:\Windows\System\WdofsKL.exe
  2⤵
  PID:5620
- C:\Windows\System\QymAGmV.exe
  C:\Windows\System\QymAGmV.exe
  2⤵
  PID:5688
- C:\Windows\System\AciCnRm.exe
  C:\Windows\System\AciCnRm.exe
  2⤵
  PID:5520
- C:\Windows\System\DHHkjWm.exe
  C:\Windows\System\DHHkjWm.exe
  2⤵
  PID:4688
- C:\Windows\System\zVtDKIC.exe
  C:\Windows\System\zVtDKIC.exe
  2⤵
  PID:1664
- C:\Windows\System\bzegiDR.exe
  C:\Windows\System\bzegiDR.exe
  2⤵
  PID:5148
- C:\Windows\System\MdosXmt.exe
  C:\Windows\System\MdosXmt.exe
  2⤵
  PID:5200
- C:\Windows\System\xvQlyiH.exe
  C:\Windows\System\xvQlyiH.exe
  2⤵
  PID:5236
- C:\Windows\System\LGulgrD.exe
  C:\Windows\System\LGulgrD.exe
  2⤵
  PID:5732
- C:\Windows\System\qPTXgnG.exe
  C:\Windows\System\qPTXgnG.exe
  2⤵
  PID:5300
- C:\Windows\System\mLMxIzs.exe
  C:\Windows\System\mLMxIzs.exe
  2⤵
  PID:5636
- C:\Windows\System\uRSUrpC.exe
  C:\Windows\System\uRSUrpC.exe
  2⤵
  PID:5536
- C:\Windows\System\JYTksNJ.exe
  C:\Windows\System\JYTksNJ.exe
  2⤵
  PID:5468
- C:\Windows\System\kzarlpA.exe
  C:\Windows\System\kzarlpA.exe
  2⤵
  PID:5404
- C:\Windows\System\lmZpyVf.exe
  C:\Windows\System\lmZpyVf.exe
  2⤵
  PID:5364
- C:\Windows\System\GyYAAay.exe
  C:\Windows\System\GyYAAay.exe
  2⤵
  PID:5756
- C:\Windows\System\epaQlPU.exe
  C:\Windows\System\epaQlPU.exe
  2⤵
  PID:5776
- C:\Windows\System\PAskTVN.exe
  C:\Windows\System\PAskTVN.exe
  2⤵
  PID:5820
- C:\Windows\System\peAezpl.exe
  C:\Windows\System\peAezpl.exe
  2⤵
  PID:5872
- C:\Windows\System\VasoZLx.exe
  C:\Windows\System\VasoZLx.exe
  2⤵
  PID:5852
- C:\Windows\System\kajBeWX.exe
  C:\Windows\System\kajBeWX.exe
  2⤵
  PID:5992
- C:\Windows\System\cjbGqbe.exe
  C:\Windows\System\cjbGqbe.exe
  2⤵
  PID:6088
- C:\Windows\System\gCBBsEl.exe
  C:\Windows\System\gCBBsEl.exe
  2⤵
  PID:5072
- C:\Windows\System\JGbAKHC.exe
  C:\Windows\System\JGbAKHC.exe
  2⤵
  PID:5936
- C:\Windows\System\OtPIgtf.exe
  C:\Windows\System\OtPIgtf.exe
  2⤵
  PID:5940
- C:\Windows\System\yjpEgoZ.exe
  C:\Windows\System\yjpEgoZ.exe
  2⤵
  PID:5920
- C:\Windows\System\MDWEyQI.exe
  C:\Windows\System\MDWEyQI.exe
  2⤵
  PID:6044
- C:\Windows\System\bhNNqbs.exe
  C:\Windows\System\bhNNqbs.exe
  2⤵
  PID:6108
- C:\Windows\System\haNOSDT.exe
  C:\Windows\System\haNOSDT.exe
  2⤵
  PID:4852
- C:\Windows\System\EawSTrM.exe
  C:\Windows\System\EawSTrM.exe
  2⤵
  PID:5252
- C:\Windows\System\epZMTST.exe
  C:\Windows\System\epZMTST.exe
  2⤵
  PID:5316
- C:\Windows\System\nBZBoOu.exe
  C:\Windows\System\nBZBoOu.exe
  2⤵
  PID:5924
- C:\Windows\System\XIcsicP.exe
  C:\Windows\System\XIcsicP.exe
  2⤵
  PID:5388
- C:\Windows\System\oeFKNni.exe
  C:\Windows\System\oeFKNni.exe
  2⤵
  PID:5652
- C:\Windows\System\bhBBdiN.exe
  C:\Windows\System\bhBBdiN.exe
  2⤵
  PID:5228
- C:\Windows\System\mmnFNEj.exe
  C:\Windows\System\mmnFNEj.exe
  2⤵
  PID:5588
- C:\Windows\System\nZoWJVv.exe
  C:\Windows\System\nZoWJVv.exe
  2⤵
  PID:5192
- C:\Windows\System\dPKeLVd.exe
  C:\Windows\System\dPKeLVd.exe
  2⤵
  PID:5696
- C:\Windows\System\WzctyNe.exe
  C:\Windows\System\WzctyNe.exe
  2⤵
  PID:5712
- C:\Windows\System\DmUiRdC.exe
  C:\Windows\System\DmUiRdC.exe
  2⤵
  PID:5728
- C:\Windows\System\PKBdsJr.exe
  C:\Windows\System\PKBdsJr.exe
  2⤵
  PID:5372
- C:\Windows\System\lckEGSQ.exe
  C:\Windows\System\lckEGSQ.exe
  2⤵
  PID:5432
- C:\Windows\System\DagQbJD.exe
  C:\Windows\System\DagQbJD.exe
  2⤵
  PID:5792
- C:\Windows\System\ydfhzYh.exe
  C:\Windows\System\ydfhzYh.exe
  2⤵
  PID:5804
- C:\Windows\System\zVZRCUM.exe
  C:\Windows\System\zVZRCUM.exe
  2⤵
  PID:5908
- C:\Windows\System\dhZvUtv.exe
  C:\Windows\System\dhZvUtv.exe
  2⤵
  PID:5168
- C:\Windows\System\AguOOwP.exe
  C:\Windows\System\AguOOwP.exe
  2⤵
  PID:6076
- C:\Windows\System\AcfpzXR.exe
  C:\Windows\System\AcfpzXR.exe
  2⤵
  PID:5972
- C:\Windows\System\asQQQKn.exe
  C:\Windows\System\asQQQKn.exe
  2⤵
  PID:5484
- C:\Windows\System\bsTgqdW.exe
  C:\Windows\System\bsTgqdW.exe
  2⤵
  PID:4880
- C:\Windows\System\NIjOIxE.exe
  C:\Windows\System\NIjOIxE.exe
  2⤵
  PID:5312
- C:\Windows\System\bggeFgS.exe
  C:\Windows\System\bggeFgS.exe
  2⤵
  PID:4712
- C:\Windows\System\TVZaBLI.exe
  C:\Windows\System\TVZaBLI.exe
  2⤵
  PID:5268
- C:\Windows\System\fsWhSUt.exe
  C:\Windows\System\fsWhSUt.exe
  2⤵
  PID:4892
- C:\Windows\System\moEBgoR.exe
  C:\Windows\System\moEBgoR.exe
  2⤵
  PID:5672
- C:\Windows\System\mpAESHQ.exe
  C:\Windows\System\mpAESHQ.exe
  2⤵
  PID:5640
- C:\Windows\System\SwtvOLu.exe
  C:\Windows\System\SwtvOLu.exe
  2⤵
  PID:5764
- C:\Windows\System\hcrjdcU.exe
  C:\Windows\System\hcrjdcU.exe
  2⤵
  PID:5788
- C:\Windows\System\WeRPhsX.exe
  C:\Windows\System\WeRPhsX.exe
  2⤵
  PID:5500
- C:\Windows\System\uuCdYVI.exe
  C:\Windows\System\uuCdYVI.exe
  2⤵
  PID:5248
- C:\Windows\System\ecyqdwR.exe
  C:\Windows\System\ecyqdwR.exe
  2⤵
  PID:5384
- C:\Windows\System\KoFYJPG.exe
  C:\Windows\System\KoFYJPG.exe
  2⤵
  PID:4316
- C:\Windows\System\yzIRnTd.exe
  C:\Windows\System\yzIRnTd.exe
  2⤵
  PID:6156
- C:\Windows\System\zjEzysU.exe
  C:\Windows\System\zjEzysU.exe
  2⤵
  PID:6176
- C:\Windows\System\FyOjdDO.exe
  C:\Windows\System\FyOjdDO.exe
  2⤵
  PID:6192
- C:\Windows\System\hdesYnu.exe
  C:\Windows\System\hdesYnu.exe
  2⤵
  PID:6208
- C:\Windows\System\VqoVKBs.exe
  C:\Windows\System\VqoVKBs.exe
  2⤵
  PID:6224
- C:\Windows\System\cIXGLeC.exe
  C:\Windows\System\cIXGLeC.exe
  2⤵
  PID:6240
- C:\Windows\System\UeoHtZD.exe
  C:\Windows\System\UeoHtZD.exe
  2⤵
  PID:6256
- C:\Windows\System\vBDltwP.exe
  C:\Windows\System\vBDltwP.exe
  2⤵
  PID:6276
- C:\Windows\System\jifBLoO.exe
  C:\Windows\System\jifBLoO.exe
  2⤵
  PID:6292
- C:\Windows\System\DxIgvDj.exe
  C:\Windows\System\DxIgvDj.exe
  2⤵
  PID:6308
- C:\Windows\System\njJHnqg.exe
  C:\Windows\System\njJHnqg.exe
  2⤵
  PID:6324
- C:\Windows\System\bLNPUWP.exe
  C:\Windows\System\bLNPUWP.exe
  2⤵
  PID:6456
- C:\Windows\System\snssCLn.exe
  C:\Windows\System\snssCLn.exe
  2⤵
  PID:6476
- C:\Windows\System\CtUSMJr.exe
  C:\Windows\System\CtUSMJr.exe
  2⤵
  PID:6492
- C:\Windows\System\GromgNA.exe
  C:\Windows\System\GromgNA.exe
  2⤵
  PID:6508
- C:\Windows\System\CpxXrUM.exe
  C:\Windows\System\CpxXrUM.exe
  2⤵
  PID:6524
- C:\Windows\System\SUbGtMk.exe
  C:\Windows\System\SUbGtMk.exe
  2⤵
  PID:6544
- C:\Windows\System\RbngxrV.exe
  C:\Windows\System\RbngxrV.exe
  2⤵
  PID:6560
- C:\Windows\System\BTClzEx.exe
  C:\Windows\System\BTClzEx.exe
  2⤵
  PID:6576
- C:\Windows\System\QeFiFcb.exe
  C:\Windows\System\QeFiFcb.exe
  2⤵
  PID:6592
- C:\Windows\System\GNHpmBA.exe
  C:\Windows\System\GNHpmBA.exe
  2⤵
  PID:6608
- C:\Windows\System\KCCxKhK.exe
  C:\Windows\System\KCCxKhK.exe
  2⤵
  PID:6624
- C:\Windows\System\irrZhtC.exe
  C:\Windows\System\irrZhtC.exe
  2⤵
  PID:6640
- C:\Windows\System\kZVEBIF.exe
  C:\Windows\System\kZVEBIF.exe
  2⤵
  PID:6656
- C:\Windows\System\LiIQIbL.exe
  C:\Windows\System\LiIQIbL.exe
  2⤵
  PID:6676
- C:\Windows\System\vtgYPnk.exe
  C:\Windows\System\vtgYPnk.exe
  2⤵
  PID:6696
- C:\Windows\System\ECqWfeQ.exe
  C:\Windows\System\ECqWfeQ.exe
  2⤵
  PID:6712
- C:\Windows\System\WAbOjbt.exe
  C:\Windows\System\WAbOjbt.exe
  2⤵
  PID:6728
- C:\Windows\System\mhXldlN.exe
  C:\Windows\System\mhXldlN.exe
  2⤵
  PID:6744
- C:\Windows\System\INWXFeI.exe
  C:\Windows\System\INWXFeI.exe
  2⤵
  PID:6760
- C:\Windows\System\tEyPCIP.exe
  C:\Windows\System\tEyPCIP.exe
  2⤵
  PID:6776
- C:\Windows\System\RVaqxFg.exe
  C:\Windows\System\RVaqxFg.exe
  2⤵
  PID:6796
- C:\Windows\System\rBpBjDO.exe
  C:\Windows\System\rBpBjDO.exe
  2⤵
  PID:6812
- C:\Windows\System\AoFkSrX.exe
  C:\Windows\System\AoFkSrX.exe
  2⤵
  PID:6828
- C:\Windows\System\USqddeY.exe
  C:\Windows\System\USqddeY.exe
  2⤵
  PID:6852
- C:\Windows\System\WwclYFo.exe
  C:\Windows\System\WwclYFo.exe
  2⤵
  PID:6868
- C:\Windows\System\imnRufH.exe
  C:\Windows\System\imnRufH.exe
  2⤵
  PID:6884
- C:\Windows\System\pIUJgBJ.exe
  C:\Windows\System\pIUJgBJ.exe
  2⤵
  PID:6904
- C:\Windows\System\KoDkngy.exe
  C:\Windows\System\KoDkngy.exe
  2⤵
  PID:7000
- C:\Windows\System\HJeXono.exe
  C:\Windows\System\HJeXono.exe
  2⤵
  PID:7016
- C:\Windows\System\mLxuzvv.exe
  C:\Windows\System\mLxuzvv.exe
  2⤵
  PID:7032
- C:\Windows\System\uokGgTn.exe
  C:\Windows\System\uokGgTn.exe
  2⤵
  PID:7052
- C:\Windows\System\ehmmrum.exe
  C:\Windows\System\ehmmrum.exe
  2⤵
  PID:7068
- C:\Windows\System\ktXSprW.exe
  C:\Windows\System\ktXSprW.exe
  2⤵
  PID:7084
- C:\Windows\System\IMNRRoB.exe
  C:\Windows\System\IMNRRoB.exe
  2⤵
  PID:7104
- C:\Windows\System\uYsCugG.exe
  C:\Windows\System\uYsCugG.exe
  2⤵
  PID:7120
- C:\Windows\System\IsJKvcj.exe
  C:\Windows\System\IsJKvcj.exe
  2⤵
  PID:7136
- C:\Windows\System\numNrnu.exe
  C:\Windows\System\numNrnu.exe
  2⤵
  PID:7152
- C:\Windows\System\sWpJohu.exe
  C:\Windows\System\sWpJohu.exe
  2⤵
  PID:5116
- C:\Windows\System\WzfUsTK.exe
  C:\Windows\System\WzfUsTK.exe
  2⤵
  PID:5524
- C:\Windows\System\rbsXUok.exe
  C:\Windows\System\rbsXUok.exe
  2⤵
  PID:5472
- C:\Windows\System\LleKGHk.exe
  C:\Windows\System\LleKGHk.exe
  2⤵
  PID:5344
- C:\Windows\System\TDufFCb.exe
  C:\Windows\System\TDufFCb.exe
  2⤵
  PID:5568
- C:\Windows\System\rpLtRAR.exe
  C:\Windows\System\rpLtRAR.exe
  2⤵
  PID:6172
- C:\Windows\System\HPKrYYV.exe
  C:\Windows\System\HPKrYYV.exe
  2⤵
  PID:6336
- C:\Windows\System\sfwoAWN.exe
  C:\Windows\System\sfwoAWN.exe
  2⤵
  PID:6364
- C:\Windows\System\pLaAkTH.exe
  C:\Windows\System\pLaAkTH.exe
  2⤵
  PID:6380
- C:\Windows\System\hTlNOky.exe
  C:\Windows\System\hTlNOky.exe
  2⤵
  PID:6060
- C:\Windows\System\YnKlxTB.exe
  C:\Windows\System\YnKlxTB.exe
  2⤵
  PID:6384
- C:\Windows\System\vSJnHtO.exe
  C:\Windows\System\vSJnHtO.exe
  2⤵
  PID:6148
- C:\Windows\System\IaUeonv.exe
  C:\Windows\System\IaUeonv.exe
  2⤵
  PID:6188
- C:\Windows\System\MyhDIQs.exe
  C:\Windows\System\MyhDIQs.exe
  2⤵
  PID:6284
- C:\Windows\System\aVqWyJN.exe
  C:\Windows\System\aVqWyJN.exe
  2⤵
  PID:5284
- C:\Windows\System\NcSHTMS.exe
  C:\Windows\System\NcSHTMS.exe
  2⤵
  PID:6436
- C:\Windows\System\thMPGqe.exe
  C:\Windows\System\thMPGqe.exe
  2⤵
  PID:6452
- C:\Windows\System\egqkUpc.exe
  C:\Windows\System\egqkUpc.exe
  2⤵
  PID:6484
- C:\Windows\System\AbNhTqj.exe
  C:\Windows\System\AbNhTqj.exe
  2⤵
  PID:6552
- C:\Windows\System\HLTvRMU.exe
  C:\Windows\System\HLTvRMU.exe
  2⤵
  PID:6588
- C:\Windows\System\ZLuBZwX.exe
  C:\Windows\System\ZLuBZwX.exe
  2⤵
  PID:6652
- C:\Windows\System\FSyrqto.exe
  C:\Windows\System\FSyrqto.exe
  2⤵
  PID:6636
- C:\Windows\System\mSpyKBT.exe
  C:\Windows\System\mSpyKBT.exe
  2⤵
  PID:6504
- C:\Windows\System\vqwTFHn.exe
  C:\Windows\System\vqwTFHn.exe
  2⤵
  PID:6604
- C:\Windows\System\QiDltOj.exe
  C:\Windows\System\QiDltOj.exe
  2⤵
  PID:6704
- C:\Windows\System\njEMEhs.exe
  C:\Windows\System\njEMEhs.exe
  2⤵
  PID:6740
- C:\Windows\System\ZswvLCe.exe
  C:\Windows\System\ZswvLCe.exe
  2⤵
  PID:6756
- C:\Windows\System\VJZzXJf.exe
  C:\Windows\System\VJZzXJf.exe
  2⤵
  PID:6824
- C:\Windows\System\EHKQsZQ.exe
  C:\Windows\System\EHKQsZQ.exe
  2⤵
  PID:6896
- C:\Windows\System\nzciIuj.exe
  C:\Windows\System\nzciIuj.exe
  2⤵
  PID:6840
- C:\Windows\System\rguDDZT.exe
  C:\Windows\System\rguDDZT.exe
  2⤵
  PID:6880
- C:\Windows\System\jTPUjap.exe
  C:\Windows\System\jTPUjap.exe
  2⤵
  PID:6916
- C:\Windows\System\UnHuvPN.exe
  C:\Windows\System\UnHuvPN.exe
  2⤵
  PID:6932
- C:\Windows\System\bAlZriB.exe
  C:\Windows\System\bAlZriB.exe
  2⤵
  PID:6948
- C:\Windows\System\rmZMVuk.exe
  C:\Windows\System\rmZMVuk.exe
  2⤵
  PID:7008
- C:\Windows\System\ZeLktyd.exe
  C:\Windows\System\ZeLktyd.exe
  2⤵
  PID:7044
- C:\Windows\System\pHWaFHN.exe
  C:\Windows\System\pHWaFHN.exe
  2⤵
  PID:7116
- C:\Windows\System\EgCmtem.exe
  C:\Windows\System\EgCmtem.exe
  2⤵
  PID:6808
- C:\Windows\System\bSBEXMw.exe
  C:\Windows\System\bSBEXMw.exe
  2⤵
  PID:5744
- C:\Windows\System\jwbchHm.exe
  C:\Windows\System\jwbchHm.exe
  2⤵
  PID:6968
- C:\Windows\System\nchfRSg.exe
  C:\Windows\System\nchfRSg.exe
  2⤵
  PID:6996
- C:\Windows\System\fcRdhhH.exe
  C:\Windows\System\fcRdhhH.exe
  2⤵
  PID:7132
- C:\Windows\System\NrRuORe.exe
  C:\Windows\System\NrRuORe.exe
  2⤵
  PID:5840
- C:\Windows\System\WIWgwCZ.exe
  C:\Windows\System\WIWgwCZ.exe
  2⤵
  PID:6352
- C:\Windows\System\nLHvpng.exe
  C:\Windows\System\nLHvpng.exe
  2⤵
  PID:6040
- C:\Windows\System\acUBWmP.exe
  C:\Windows\System\acUBWmP.exe
  2⤵
  PID:6248
- C:\Windows\System\FkZbpRa.exe
  C:\Windows\System\FkZbpRa.exe
  2⤵
  PID:6392
- C:\Windows\System\IPYDHcm.exe
  C:\Windows\System\IPYDHcm.exe
  2⤵
  PID:7064
- C:\Windows\System\JAiNmhR.exe
  C:\Windows\System\JAiNmhR.exe
  2⤵
  PID:7060
- C:\Windows\System\ePZbwXB.exe
  C:\Windows\System\ePZbwXB.exe
  2⤵
  PID:6416
- C:\Windows\System\wbFHtCx.exe
  C:\Windows\System\wbFHtCx.exe
  2⤵
  PID:7024
- C:\Windows\System\VEoUiud.exe
  C:\Windows\System\VEoUiud.exe
  2⤵
  PID:6468
- C:\Windows\System\XAkFvPf.exe
  C:\Windows\System\XAkFvPf.exe
  2⤵
  PID:5132
- C:\Windows\System\dLTrCXh.exe
  C:\Windows\System\dLTrCXh.exe
  2⤵
  PID:6532
- C:\Windows\System\ScIVHOQ.exe
  C:\Windows\System\ScIVHOQ.exe
  2⤵
  PID:6600
- C:\Windows\System\bWjlvEU.exe
  C:\Windows\System\bWjlvEU.exe
  2⤵
  PID:6792
- C:\Windows\System\Tysympr.exe
  C:\Windows\System\Tysympr.exe
  2⤵
  PID:6940
- C:\Windows\System\ISQKkyy.exe
  C:\Windows\System\ISQKkyy.exe
  2⤵
  PID:6804
- C:\Windows\System\YwTQQpX.exe
  C:\Windows\System\YwTQQpX.exe
  2⤵
  PID:7012
- C:\Windows\System\JIkXocY.exe
  C:\Windows\System\JIkXocY.exe
  2⤵
  PID:4628
- C:\Windows\System\UulYzVE.exe
  C:\Windows\System\UulYzVE.exe
  2⤵
  PID:6444
- C:\Windows\System\PlCWLNO.exe
  C:\Windows\System\PlCWLNO.exe
  2⤵
  PID:6620
- C:\Windows\System\RMKHMMp.exe
  C:\Windows\System\RMKHMMp.exe
  2⤵
  PID:6672
- C:\Windows\System\aeCcToG.exe
  C:\Windows\System\aeCcToG.exe
  2⤵
  PID:6752
- C:\Windows\System\YDWPiWZ.exe
  C:\Windows\System\YDWPiWZ.exe
  2⤵
  PID:6984
- C:\Windows\System\UajgmFd.exe
  C:\Windows\System\UajgmFd.exe
  2⤵
  PID:6960
- C:\Windows\System\eZDmIXs.exe
  C:\Windows\System\eZDmIXs.exe
  2⤵
  PID:6976
- C:\Windows\System\BUPDjNu.exe
  C:\Windows\System\BUPDjNu.exe
  2⤵
  PID:6688
- C:\Windows\System\gSQUfJN.exe
  C:\Windows\System\gSQUfJN.exe
  2⤵
  PID:5800
- C:\Windows\System\XUrPTQz.exe
  C:\Windows\System\XUrPTQz.exe
  2⤵
  PID:6408
- C:\Windows\System\TTlLJhR.exe
  C:\Windows\System\TTlLJhR.exe
  2⤵
  PID:6372
- C:\Windows\System\lBhHqKL.exe
  C:\Windows\System\lBhHqKL.exe
  2⤵
  PID:6184
- C:\Windows\System\BkdynSo.exe
  C:\Windows\System\BkdynSo.exe
  2⤵
  PID:6736
- C:\Windows\System\KeKTCLq.exe
  C:\Windows\System\KeKTCLq.exe
  2⤵
  PID:6516
- C:\Windows\System\BTvXFor.exe
  C:\Windows\System\BTvXFor.exe
  2⤵
  PID:6128
- C:\Windows\System\NmqiQfo.exe
  C:\Windows\System\NmqiQfo.exe
  2⤵
  PID:6912
- C:\Windows\System\IeubTtJ.exe
  C:\Windows\System\IeubTtJ.exe
  2⤵
  PID:6356
- C:\Windows\System\WnOQrXz.exe
  C:\Windows\System\WnOQrXz.exe
  2⤵
  PID:6500
- C:\Windows\System\WUrKCKs.exe
  C:\Windows\System\WUrKCKs.exe
  2⤵
  PID:6956
- C:\Windows\System\oNGKqPm.exe
  C:\Windows\System\oNGKqPm.exe
  2⤵
  PID:6648
- C:\Windows\System\JJLVvqf.exe
  C:\Windows\System\JJLVvqf.exe
  2⤵
  PID:5604
- C:\Windows\System\cFgOjTl.exe
  C:\Windows\System\cFgOjTl.exe
  2⤵
  PID:6412
- C:\Windows\System\FdfXxzS.exe
  C:\Windows\System\FdfXxzS.exe
  2⤵
  PID:6848
- C:\Windows\System\mOiVwGR.exe
  C:\Windows\System\mOiVwGR.exe
  2⤵
  PID:7100
- C:\Windows\System\DRLlJAc.exe
  C:\Windows\System\DRLlJAc.exe
  2⤵
  PID:6236
- C:\Windows\System\AzdrPxf.exe
  C:\Windows\System\AzdrPxf.exe
  2⤵
  PID:6928
- C:\Windows\System\oTbUWSH.exe
  C:\Windows\System\oTbUWSH.exe
  2⤵
  PID:5960
- C:\Windows\System\JUgeuVw.exe
  C:\Windows\System\JUgeuVw.exe
  2⤵
  PID:6692
- C:\Windows\System\NoZQaoH.exe
  C:\Windows\System\NoZQaoH.exe
  2⤵
  PID:7148
- C:\Windows\System\LxPJnWU.exe
  C:\Windows\System\LxPJnWU.exe
  2⤵
  PID:7180
- C:\Windows\System\GlXLwcZ.exe
  C:\Windows\System\GlXLwcZ.exe
  2⤵
  PID:7196
- C:\Windows\System\zBjSAkr.exe
  C:\Windows\System\zBjSAkr.exe
  2⤵
  PID:7212
- C:\Windows\System\zDxJbBe.exe
  C:\Windows\System\zDxJbBe.exe
  2⤵
  PID:7228
- C:\Windows\System\gPVeKiz.exe
  C:\Windows\System\gPVeKiz.exe
  2⤵
  PID:7248
- C:\Windows\System\csfDZtl.exe
  C:\Windows\System\csfDZtl.exe
  2⤵
  PID:7264
- C:\Windows\System\uCBiDNE.exe
  C:\Windows\System\uCBiDNE.exe
  2⤵
  PID:7280
- C:\Windows\System\ythKYaK.exe
  C:\Windows\System\ythKYaK.exe
  2⤵
  PID:7300
- C:\Windows\System\YtvQVgv.exe
  C:\Windows\System\YtvQVgv.exe
  2⤵
  PID:7316
- C:\Windows\System\wgsgDHQ.exe
  C:\Windows\System\wgsgDHQ.exe
  2⤵
  PID:7332
- C:\Windows\System\rECVkBb.exe
  C:\Windows\System\rECVkBb.exe
  2⤵
  PID:7348
- C:\Windows\System\nuUtNvP.exe
  C:\Windows\System\nuUtNvP.exe
  2⤵
  PID:7364
- C:\Windows\System\DMLiPEj.exe
  C:\Windows\System\DMLiPEj.exe
  2⤵
  PID:7380
- C:\Windows\System\CjxKTTe.exe
  C:\Windows\System\CjxKTTe.exe
  2⤵
  PID:7400
- C:\Windows\System\Brgkeos.exe
  C:\Windows\System\Brgkeos.exe
  2⤵
  PID:7416
- C:\Windows\System\nwvxmZu.exe
  C:\Windows\System\nwvxmZu.exe
  2⤵
  PID:7432
- C:\Windows\System\iXZPbxb.exe
  C:\Windows\System\iXZPbxb.exe
  2⤵
  PID:7448
- C:\Windows\System\FpnLeaO.exe
  C:\Windows\System\FpnLeaO.exe
  2⤵
  PID:7464
- C:\Windows\System\SdvUsul.exe
  C:\Windows\System\SdvUsul.exe
  2⤵
  PID:7480
- C:\Windows\System\XFYrQUV.exe
  C:\Windows\System\XFYrQUV.exe
  2⤵
  PID:7496
- C:\Windows\System\cwPZSpC.exe
  C:\Windows\System\cwPZSpC.exe
  2⤵
  PID:7516
- C:\Windows\System\SaFnCqu.exe
  C:\Windows\System\SaFnCqu.exe
  2⤵
  PID:7532
- C:\Windows\System\JSapbWe.exe
  C:\Windows\System\JSapbWe.exe
  2⤵
  PID:7548
- C:\Windows\System\jGxpnCj.exe
  C:\Windows\System\jGxpnCj.exe
  2⤵
  PID:7564
- C:\Windows\System\sSVwwdZ.exe
  C:\Windows\System\sSVwwdZ.exe
  2⤵
  PID:7580
- C:\Windows\System\GlKyuVl.exe
  C:\Windows\System\GlKyuVl.exe
  2⤵
  PID:7596
- C:\Windows\System\AjCtTYS.exe
  C:\Windows\System\AjCtTYS.exe
  2⤵
  PID:7616
- C:\Windows\System\WSxiOsx.exe
  C:\Windows\System\WSxiOsx.exe
  2⤵
  PID:7632
- C:\Windows\System\eFMtbUN.exe
  C:\Windows\System\eFMtbUN.exe
  2⤵
  PID:7648
- C:\Windows\System\vCPAyxK.exe
  C:\Windows\System\vCPAyxK.exe
  2⤵
  PID:7776
- C:\Windows\System\DEvRCam.exe
  C:\Windows\System\DEvRCam.exe
  2⤵
  PID:7792
- C:\Windows\System\QDhEUfY.exe
  C:\Windows\System\QDhEUfY.exe
  2⤵
  PID:7808
- C:\Windows\System\MATMVki.exe
  C:\Windows\System\MATMVki.exe
  2⤵
  PID:7824
- C:\Windows\System\oLUcNud.exe
  C:\Windows\System\oLUcNud.exe
  2⤵
  PID:7840
- C:\Windows\System\xFCDMpG.exe
  C:\Windows\System\xFCDMpG.exe
  2⤵
  PID:7856
- C:\Windows\System\KodEntR.exe
  C:\Windows\System\KodEntR.exe
  2⤵
  PID:7872
- C:\Windows\System\YUqmiJW.exe
  C:\Windows\System\YUqmiJW.exe
  2⤵
  PID:7896
- C:\Windows\System\nfVDSgb.exe
  C:\Windows\System\nfVDSgb.exe
  2⤵
  PID:7912
- C:\Windows\System\lTagzuc.exe
  C:\Windows\System\lTagzuc.exe
  2⤵
  PID:7928
- C:\Windows\System\QZVwhHU.exe
  C:\Windows\System\QZVwhHU.exe
  2⤵
  PID:7944
- C:\Windows\System\UuLZgqW.exe
  C:\Windows\System\UuLZgqW.exe
  2⤵
  PID:7960
- C:\Windows\System\MMVTtNc.exe
  C:\Windows\System\MMVTtNc.exe
  2⤵
  PID:7976
- C:\Windows\System\vtVIHos.exe
  C:\Windows\System\vtVIHos.exe
  2⤵
  PID:7992
- C:\Windows\System\TBKvBes.exe
  C:\Windows\System\TBKvBes.exe
  2⤵
  PID:8008
- C:\Windows\System\XhBJJjZ.exe
  C:\Windows\System\XhBJJjZ.exe
  2⤵
  PID:8024
- C:\Windows\System\shtHtmg.exe
  C:\Windows\System\shtHtmg.exe
  2⤵
  PID:8044
- C:\Windows\System\kMKwRgu.exe
  C:\Windows\System\kMKwRgu.exe
  2⤵
  PID:8064
- C:\Windows\System\hTqYthJ.exe
  C:\Windows\System\hTqYthJ.exe
  2⤵
  PID:8080
- C:\Windows\System\SGaiygf.exe
  C:\Windows\System\SGaiygf.exe
  2⤵
  PID:8176
- C:\Windows\System\gWnGlcC.exe
  C:\Windows\System\gWnGlcC.exe
  2⤵
  PID:7244
- C:\Windows\System\clLUTQJ.exe
  C:\Windows\System\clLUTQJ.exe
  2⤵
  PID:7288
- C:\Windows\System\zWMFAok.exe
  C:\Windows\System\zWMFAok.exe
  2⤵
  PID:7344
- C:\Windows\System\ALYcEvi.exe
  C:\Windows\System\ALYcEvi.exe
  2⤵
  PID:7544
- C:\Windows\System\DFnVknf.exe
  C:\Windows\System\DFnVknf.exe
  2⤵
  PID:7572
- C:\Windows\System\tplbREB.exe
  C:\Windows\System\tplbREB.exe
  2⤵
  PID:7612
- C:\Windows\System\mrLBMNj.exe
  C:\Windows\System\mrLBMNj.exe
  2⤵
  PID:7528
- C:\Windows\System\pidNuEI.exe
  C:\Windows\System\pidNuEI.exe
  2⤵
  PID:7644
- C:\Windows\System\AvgXkbS.exe
  C:\Windows\System\AvgXkbS.exe
  2⤵
  PID:7460
- C:\Windows\System\dInCeTJ.exe
  C:\Windows\System\dInCeTJ.exe
  2⤵
  PID:7628
- C:\Windows\System\kXsfiTi.exe
  C:\Windows\System\kXsfiTi.exe
  2⤵
  PID:7676
- C:\Windows\System\zVraHZR.exe
  C:\Windows\System\zVraHZR.exe
  2⤵
  PID:7680
- C:\Windows\System\PriZBHf.exe
  C:\Windows\System\PriZBHf.exe
  2⤵
  PID:7704
- C:\Windows\System\BOQiDAv.exe
  C:\Windows\System\BOQiDAv.exe
  2⤵
  PID:7724
- C:\Windows\System\KLQWJyL.exe
  C:\Windows\System\KLQWJyL.exe
  2⤵
  PID:7736
- C:\Windows\System\QTWzSpU.exe
  C:\Windows\System\QTWzSpU.exe
  2⤵
  PID:7772
- C:\Windows\System\GvlhOsv.exe
  C:\Windows\System\GvlhOsv.exe
  2⤵
  PID:7848
- C:\Windows\System\LHeXsTa.exe
  C:\Windows\System\LHeXsTa.exe
  2⤵
  PID:7888
- C:\Windows\System\MzbkOTu.exe
  C:\Windows\System\MzbkOTu.exe
  2⤵
  PID:7804
- C:\Windows\System\pZslbXr.exe
  C:\Windows\System\pZslbXr.exe
  2⤵
  PID:7908
- C:\Windows\System\jhcLtGP.exe
  C:\Windows\System\jhcLtGP.exe
  2⤵
  PID:7972
- C:\Windows\System\fRPNXvl.exe
  C:\Windows\System\fRPNXvl.exe
  2⤵
  PID:8036
- C:\Windows\System\JdwsjyC.exe
  C:\Windows\System\JdwsjyC.exe
  2⤵
  PID:7924
- C:\Windows\System\bjkcDDy.exe
  C:\Windows\System\bjkcDDy.exe
  2⤵
  PID:7920
- C:\Windows\System\HTKVamS.exe
  C:\Windows\System\HTKVamS.exe
  2⤵
  PID:8020
- C:\Windows\System\tYXRqbN.exe
  C:\Windows\System\tYXRqbN.exe
  2⤵
  PID:8060
- C:\Windows\System\bRegOlb.exe
  C:\Windows\System\bRegOlb.exe
  2⤵
  PID:8108
- C:\Windows\System\yiCxMyr.exe
  C:\Windows\System\yiCxMyr.exe
  2⤵
  PID:8124
- C:\Windows\System\tKmnqeD.exe
  C:\Windows\System\tKmnqeD.exe
  2⤵
  PID:8140
- C:\Windows\System\diRRYzF.exe
  C:\Windows\System\diRRYzF.exe
  2⤵
  PID:8156
- C:\Windows\System\ImXaJsD.exe
  C:\Windows\System\ImXaJsD.exe
  2⤵
  PID:8184
- C:\Windows\System\LqNHmYa.exe
  C:\Windows\System\LqNHmYa.exe
  2⤵
  PID:6268
- C:\Windows\System\kCWVKsg.exe
  C:\Windows\System\kCWVKsg.exe
  2⤵
  PID:6432
- C:\Windows\System\cxSAnlY.exe
  C:\Windows\System\cxSAnlY.exe
  2⤵
  PID:6992
- C:\Windows\System\tbUXtmX.exe
  C:\Windows\System\tbUXtmX.exe
  2⤵
  PID:7240
- C:\Windows\System\zbFpFFR.exe
  C:\Windows\System\zbFpFFR.exe
  2⤵
  PID:7192
- C:\Windows\System\HmTppQo.exe
  C:\Windows\System\HmTppQo.exe
  2⤵
  PID:7236
- C:\Windows\System\aoLMuTD.exe
  C:\Windows\System\aoLMuTD.exe
  2⤵
  PID:7220
- C:\Windows\System\idyzizq.exe
  C:\Windows\System\idyzizq.exe
  2⤵
  PID:7356
- C:\Windows\System\IdgmLJj.exe
  C:\Windows\System\IdgmLJj.exe
  2⤵
  PID:7440
- C:\Windows\System\zXceXBy.exe
  C:\Windows\System\zXceXBy.exe
  2⤵
  PID:7540
- C:\Windows\System\LsNKGVK.exe
  C:\Windows\System\LsNKGVK.exe
  2⤵
  PID:7604
- C:\Windows\System\YYOhlsg.exe
  C:\Windows\System\YYOhlsg.exe
  2⤵
  PID:7640
- C:\Windows\System\jVqyamF.exe
  C:\Windows\System\jVqyamF.exe
  2⤵
  PID:7588
- C:\Windows\System\EbYTQYT.exe
  C:\Windows\System\EbYTQYT.exe
  2⤵
  PID:7712
- C:\Windows\System\keiZVjK.exe
  C:\Windows\System\keiZVjK.exe
  2⤵
  PID:7756
- C:\Windows\System\ixrKZdn.exe
  C:\Windows\System\ixrKZdn.exe
  2⤵
  PID:7836
- C:\Windows\System\fSmTSkb.exe
  C:\Windows\System\fSmTSkb.exe
  2⤵
  PID:7720
- C:\Windows\System\XnwUmWl.exe
  C:\Windows\System\XnwUmWl.exe
  2⤵
  PID:7800
- C:\Windows\System\nMCjsbP.exe
  C:\Windows\System\nMCjsbP.exe
  2⤵
  PID:7768
- C:\Windows\System\jHltyKg.exe
  C:\Windows\System\jHltyKg.exe
  2⤵
  PID:7748
- C:\Windows\System\XBEMJma.exe
  C:\Windows\System\XBEMJma.exe
  2⤵
  PID:8016
- C:\Windows\System\iTFGUZV.exe
  C:\Windows\System\iTFGUZV.exe
  2⤵
  PID:7940
- C:\Windows\System\JUJaYXP.exe
  C:\Windows\System\JUJaYXP.exe
  2⤵
  PID:8116
- C:\Windows\System\tGZgohK.exe
  C:\Windows\System\tGZgohK.exe
  2⤵
  PID:8152
- C:\Windows\System\zVOPPcg.exe
  C:\Windows\System\zVOPPcg.exe
  2⤵
  PID:8172
- C:\Windows\System\JWbEjlb.exe
  C:\Windows\System\JWbEjlb.exe
  2⤵
  PID:8104
- C:\Windows\System\GgJnqzl.exe
  C:\Windows\System\GgJnqzl.exe
  2⤵
  PID:5944
- C:\Windows\System\RIXjcVQ.exe
  C:\Windows\System\RIXjcVQ.exe
  2⤵
  PID:7472
- C:\Windows\System\ZMthBzL.exe
  C:\Windows\System\ZMthBzL.exe
  2⤵
  PID:7340
- C:\Windows\System\JVXqgDE.exe
  C:\Windows\System\JVXqgDE.exe
  2⤵
  PID:7424
- C:\Windows\System\FTfylwb.exe
  C:\Windows\System\FTfylwb.exe
  2⤵
  PID:7664
- C:\Windows\System\eUxFCIm.exe
  C:\Windows\System\eUxFCIm.exe
  2⤵
  PID:7864
- C:\Windows\System\pJOagYa.exe
  C:\Windows\System\pJOagYa.exe
  2⤵
  PID:8088
- C:\Windows\System\xCLDKOi.exe
  C:\Windows\System\xCLDKOi.exe
  2⤵
  PID:7984
- C:\Windows\System\AezlJRi.exe
  C:\Windows\System\AezlJRi.exe
  2⤵
  PID:7260
- C:\Windows\System\EuKZpCd.exe
  C:\Windows\System\EuKZpCd.exe
  2⤵
  PID:8004
- C:\Windows\System\rdcLovk.exe
  C:\Windows\System\rdcLovk.exe
  2⤵
  PID:8204
- C:\Windows\System\NofvJYJ.exe
  C:\Windows\System\NofvJYJ.exe
  2⤵
  PID:8232
- C:\Windows\System\UOdJFfY.exe
  C:\Windows\System\UOdJFfY.exe
  2⤵
  PID:8248
- C:\Windows\System\IzkxTxr.exe
  C:\Windows\System\IzkxTxr.exe
  2⤵
  PID:8264
- C:\Windows\System\skyiTfh.exe
  C:\Windows\System\skyiTfh.exe
  2⤵
  PID:8280
- C:\Windows\System\fwpUQAo.exe
  C:\Windows\System\fwpUQAo.exe
  2⤵
  PID:8296
- C:\Windows\System\ZDpeHpt.exe
  C:\Windows\System\ZDpeHpt.exe
  2⤵
  PID:8312
- C:\Windows\System\jpwSTUW.exe
  C:\Windows\System\jpwSTUW.exe
  2⤵
  PID:8328
- C:\Windows\System\aiKIRJf.exe
  C:\Windows\System\aiKIRJf.exe
  2⤵
  PID:8344
- C:\Windows\System\WQsmuEe.exe
  C:\Windows\System\WQsmuEe.exe
  2⤵
  PID:8360
- C:\Windows\System\EoLPpCz.exe
  C:\Windows\System\EoLPpCz.exe
  2⤵
  PID:8376
- C:\Windows\System\wFRIDwn.exe
  C:\Windows\System\wFRIDwn.exe
  2⤵
  PID:8392
- C:\Windows\System\xtdDhiX.exe
  C:\Windows\System\xtdDhiX.exe
  2⤵
  PID:8408
- C:\Windows\System\kcDAUvt.exe
  C:\Windows\System\kcDAUvt.exe
  2⤵
  PID:8424
- C:\Windows\System\uTnYPnB.exe
  C:\Windows\System\uTnYPnB.exe
  2⤵
  PID:8448
- C:\Windows\System\InBjOQT.exe
  C:\Windows\System\InBjOQT.exe
  2⤵
  PID:8468
- C:\Windows\System\YFpnPDW.exe
  C:\Windows\System\YFpnPDW.exe
  2⤵
  PID:8484
- C:\Windows\System\OpQZTKM.exe
  C:\Windows\System\OpQZTKM.exe
  2⤵
  PID:8500
- C:\Windows\System\LLYBZWz.exe
  C:\Windows\System\LLYBZWz.exe
  2⤵
  PID:8520
- C:\Windows\System\xapiUFS.exe
  C:\Windows\System\xapiUFS.exe
  2⤵
  PID:8536
- C:\Windows\System\BIBYzFz.exe
  C:\Windows\System\BIBYzFz.exe
  2⤵
  PID:8552
- C:\Windows\System\lKMXajJ.exe
  C:\Windows\System\lKMXajJ.exe
  2⤵
  PID:8572
- C:\Windows\System\dySEyKS.exe
  C:\Windows\System\dySEyKS.exe
  2⤵
  PID:8592
- C:\Windows\System\zwXwDRk.exe
  C:\Windows\System\zwXwDRk.exe
  2⤵
  PID:8608
- C:\Windows\System\RrXDHky.exe
  C:\Windows\System\RrXDHky.exe
  2⤵
  PID:8632
- C:\Windows\System\VPoLkZl.exe
  C:\Windows\System\VPoLkZl.exe
  2⤵
  PID:8652
- C:\Windows\System\YxJkywm.exe
  C:\Windows\System\YxJkywm.exe
  2⤵
  PID:8680
- C:\Windows\System\FKITXbb.exe
  C:\Windows\System\FKITXbb.exe
  2⤵
  PID:8732
- C:\Windows\System\TNRryEB.exe
  C:\Windows\System\TNRryEB.exe
  2⤵
  PID:8752
- C:\Windows\System\BYDMfez.exe
  C:\Windows\System\BYDMfez.exe
  2⤵
  PID:8768
- C:\Windows\System\FnmfIxn.exe
  C:\Windows\System\FnmfIxn.exe
  2⤵
  PID:8788
- C:\Windows\System\NFHhCnP.exe
  C:\Windows\System\NFHhCnP.exe
  2⤵
  PID:8804
- C:\Windows\System\SknEmMn.exe
  C:\Windows\System\SknEmMn.exe
  2⤵
  PID:8820
- C:\Windows\System\JYfuEpn.exe
  C:\Windows\System\JYfuEpn.exe
  2⤵
  PID:8840
- C:\Windows\System\QPFhnda.exe
  C:\Windows\System\QPFhnda.exe
  2⤵
  PID:8856
- C:\Windows\System\aOhcJRn.exe
  C:\Windows\System\aOhcJRn.exe
  2⤵
  PID:8872
- C:\Windows\System\ShnFMjm.exe
  C:\Windows\System\ShnFMjm.exe
  2⤵
  PID:8888
- C:\Windows\System\vYZkdQh.exe
  C:\Windows\System\vYZkdQh.exe
  2⤵
  PID:8904
- C:\Windows\System\fuHeMDu.exe
  C:\Windows\System\fuHeMDu.exe
  2⤵
  PID:8920
- C:\Windows\System\RyKAoWB.exe
  C:\Windows\System\RyKAoWB.exe
  2⤵
  PID:8936
- C:\Windows\System\lSuikIJ.exe
  C:\Windows\System\lSuikIJ.exe
  2⤵
  PID:8952
- C:\Windows\System\mSedZrE.exe
  C:\Windows\System\mSedZrE.exe
  2⤵
  PID:8968
- C:\Windows\System\dwKreWz.exe
  C:\Windows\System\dwKreWz.exe
  2⤵
  PID:8984
- C:\Windows\System\RSvroLX.exe
  C:\Windows\System\RSvroLX.exe
  2⤵
  PID:9000
- C:\Windows\System\hUwjwaX.exe
  C:\Windows\System\hUwjwaX.exe
  2⤵
  PID:9016
- C:\Windows\System\JGjdRAn.exe
  C:\Windows\System\JGjdRAn.exe
  2⤵
  PID:9032
- C:\Windows\System\JFEhOkY.exe
  C:\Windows\System\JFEhOkY.exe
  2⤵
  PID:9048
- C:\Windows\System\KZRvrVo.exe
  C:\Windows\System\KZRvrVo.exe
  2⤵
  PID:9064
- C:\Windows\System\RxPaqbh.exe
  C:\Windows\System\RxPaqbh.exe
  2⤵
  PID:9080
- C:\Windows\System\xSzQMJC.exe
  C:\Windows\System\xSzQMJC.exe
  2⤵
  PID:9096
- C:\Windows\System\dwoddqd.exe
  C:\Windows\System\dwoddqd.exe
  2⤵
  PID:9120
- C:\Windows\System\TpuLdWr.exe
  C:\Windows\System\TpuLdWr.exe
  2⤵
  PID:9136
- C:\Windows\System\wpxrfNz.exe
  C:\Windows\System\wpxrfNz.exe
  2⤵
  PID:9152
- C:\Windows\System\sRdjZvz.exe
  C:\Windows\System\sRdjZvz.exe
  2⤵
  PID:9172
- C:\Windows\System\NqXiwGe.exe
  C:\Windows\System\NqXiwGe.exe
  2⤵
  PID:7276
- C:\Windows\System\hfdoYOv.exe
  C:\Windows\System\hfdoYOv.exe
  2⤵
  PID:7388
- C:\Windows\System\zSmhjHR.exe
  C:\Windows\System\zSmhjHR.exe
  2⤵
  PID:7112
- C:\Windows\System\bYGgRcS.exe
  C:\Windows\System\bYGgRcS.exe
  2⤵
  PID:6540
- C:\Windows\System\FCTVmmK.exe
  C:\Windows\System\FCTVmmK.exe
  2⤵
  PID:7392
- C:\Windows\System\UgVMVky.exe
  C:\Windows\System\UgVMVky.exe
  2⤵
  PID:7292
- C:\Windows\System\ywdvGFj.exe
  C:\Windows\System\ywdvGFj.exe
  2⤵
  PID:7880
- C:\Windows\System\SpvlTqI.exe
  C:\Windows\System\SpvlTqI.exe
  2⤵
  PID:7728
- C:\Windows\System\UAMJGPX.exe
  C:\Windows\System\UAMJGPX.exe
  2⤵
  PID:7428
- C:\Windows\System\YvfJiyA.exe
  C:\Windows\System\YvfJiyA.exe
  2⤵
  PID:8240
- C:\Windows\System\PRKSTWe.exe
  C:\Windows\System\PRKSTWe.exe
  2⤵
  PID:8216
- C:\Windows\System\LqyXVeo.exe
  C:\Windows\System\LqyXVeo.exe
  2⤵
  PID:8340
- C:\Windows\System\yHjUWge.exe
  C:\Windows\System\yHjUWge.exe
  2⤵
  PID:8404
- C:\Windows\System\CWnUIYD.exe
  C:\Windows\System\CWnUIYD.exe
  2⤵
  PID:8220
- C:\Windows\System\KZfnrAv.exe
  C:\Windows\System\KZfnrAv.exe
  2⤵
  PID:6348
- C:\Windows\System\zyeKUsc.exe
  C:\Windows\System\zyeKUsc.exe
  2⤵
  PID:8256
- C:\Windows\System\GxleGTp.exe
  C:\Windows\System\GxleGTp.exe
  2⤵
  PID:8420
- C:\Windows\System\pjAnZrQ.exe
  C:\Windows\System\pjAnZrQ.exe
  2⤵
  PID:8436
- C:\Windows\System\atuGuZg.exe
  C:\Windows\System\atuGuZg.exe
  2⤵
  PID:8480
- C:\Windows\System\zYPpRyt.exe
  C:\Windows\System\zYPpRyt.exe
  2⤵
  PID:8516
- C:\Windows\System\OqGRrqd.exe
  C:\Windows\System\OqGRrqd.exe
  2⤵
  PID:8544
- C:\Windows\System\DJEgsLC.exe
  C:\Windows\System\DJEgsLC.exe
  2⤵
  PID:8532
- C:\Windows\System\ArIjptT.exe
  C:\Windows\System\ArIjptT.exe
  2⤵
  PID:8604
- C:\Windows\System\BuJgyAq.exe
  C:\Windows\System\BuJgyAq.exe
  2⤵
  PID:8644
- C:\Windows\System\vGlIsLb.exe
  C:\Windows\System\vGlIsLb.exe
  2⤵
  PID:8660
- C:\Windows\System\DUqETaO.exe
  C:\Windows\System\DUqETaO.exe
  2⤵
  PID:8668
- C:\Windows\System\PYfMZEW.exe
  C:\Windows\System\PYfMZEW.exe
  2⤵
  PID:8708
- C:\Windows\System\NTwXtWp.exe
  C:\Windows\System\NTwXtWp.exe
  2⤵
  PID:8692
- C:\Windows\System\WyJSKgH.exe
  C:\Windows\System\WyJSKgH.exe
  2⤵
  PID:8744
- C:\Windows\System\dyEPlle.exe
  C:\Windows\System\dyEPlle.exe
  2⤵
  PID:8780
- C:\Windows\System\SqFCbQB.exe
  C:\Windows\System\SqFCbQB.exe
  2⤵
  PID:8848
- C:\Windows\System\tJKnXiK.exe
  C:\Windows\System\tJKnXiK.exe
  2⤵
  PID:8912
- C:\Windows\System\QaTmZBv.exe
  C:\Windows\System\QaTmZBv.exe
  2⤵
  PID:8976
- C:\Windows\System\UnsyZsr.exe
  C:\Windows\System\UnsyZsr.exe
  2⤵
  PID:8728
- C:\Windows\System\CplsRKi.exe
  C:\Windows\System\CplsRKi.exe
  2⤵
  PID:9012
- C:\Windows\System\BzFHNIV.exe
  C:\Windows\System\BzFHNIV.exe
  2⤵
  PID:8896
- C:\Windows\System\ZsFLZLK.exe
  C:\Windows\System\ZsFLZLK.exe
  2⤵
  PID:9076
- C:\Windows\System\fxfKHzP.exe
  C:\Windows\System\fxfKHzP.exe
  2⤵
  PID:8992
- C:\Windows\System\GFERGjX.exe
  C:\Windows\System\GFERGjX.exe
  2⤵
  PID:9028
- C:\Windows\System\QWBQZhY.exe
  C:\Windows\System\QWBQZhY.exe
  2⤵
  PID:8928
- C:\Windows\System\YjUMsod.exe
  C:\Windows\System\YjUMsod.exe
  2⤵
  PID:8864
- C:\Windows\System\RYbMQGF.exe
  C:\Windows\System\RYbMQGF.exe
  2⤵
  PID:9128
- C:\Windows\System\uHwKSAV.exe
  C:\Windows\System\uHwKSAV.exe
  2⤵
  PID:9284
- C:\Windows\System\sVcHdns.exe
  C:\Windows\System\sVcHdns.exe
  2⤵
  PID:9328
- C:\Windows\System\SipCctu.exe
  C:\Windows\System\SipCctu.exe
  2⤵
  PID:9352
- C:\Windows\System\WaddGXZ.exe
  C:\Windows\System\WaddGXZ.exe
  2⤵
  PID:9368
- C:\Windows\System\cpNRVrL.exe
  C:\Windows\System\cpNRVrL.exe
  2⤵
  PID:9384
- C:\Windows\System\dOVvYUR.exe
  C:\Windows\System\dOVvYUR.exe
  2⤵
  PID:9400
- C:\Windows\System\YjpBsVG.exe
  C:\Windows\System\YjpBsVG.exe
  2⤵
  PID:9416
- C:\Windows\System\ocWFASD.exe
  C:\Windows\System\ocWFASD.exe
  2⤵
  PID:9432
- C:\Windows\System\vKXVFWU.exe
  C:\Windows\System\vKXVFWU.exe
  2⤵
  PID:9448
- C:\Windows\System\ozaCEzh.exe
  C:\Windows\System\ozaCEzh.exe
  2⤵
  PID:9464
- C:\Windows\System\kWpODLG.exe
  C:\Windows\System\kWpODLG.exe
  2⤵
  PID:9480
- C:\Windows\System\IFAnmiG.exe
  C:\Windows\System\IFAnmiG.exe
  2⤵
  PID:9496
- C:\Windows\System\RrrUeuw.exe
  C:\Windows\System\RrrUeuw.exe
  2⤵
  PID:9512
- C:\Windows\System\tSrswPG.exe
  C:\Windows\System\tSrswPG.exe
  2⤵
  PID:9532
- C:\Windows\System\cFzHuyA.exe
  C:\Windows\System\cFzHuyA.exe
  2⤵
  PID:9548
- C:\Windows\System\YDwmYvm.exe
  C:\Windows\System\YDwmYvm.exe
  2⤵
  PID:9564
- C:\Windows\System\BGEexgY.exe
  C:\Windows\System\BGEexgY.exe
  2⤵
  PID:9664
- C:\Windows\System\lvDWayH.exe
  C:\Windows\System\lvDWayH.exe
  2⤵
  PID:9680
- C:\Windows\System\nlyocWD.exe
  C:\Windows\System\nlyocWD.exe
  2⤵
  PID:9696
- C:\Windows\System\mmaFoMt.exe
  C:\Windows\System\mmaFoMt.exe
  2⤵
  PID:9712
- C:\Windows\System\MwPPHDV.exe
  C:\Windows\System\MwPPHDV.exe
  2⤵
  PID:9728
- C:\Windows\System\CkrbYkJ.exe
  C:\Windows\System\CkrbYkJ.exe
  2⤵
  PID:9744
- C:\Windows\System\RNSUMJT.exe
  C:\Windows\System\RNSUMJT.exe
  2⤵
  PID:9760
- C:\Windows\System\YOtWcCa.exe
  C:\Windows\System\YOtWcCa.exe
  2⤵
  PID:9776
- C:\Windows\System\mdNoYvC.exe
  C:\Windows\System\mdNoYvC.exe
  2⤵
  PID:9792
- C:\Windows\System\aIccwNp.exe
  C:\Windows\System\aIccwNp.exe
  2⤵
  PID:9808
- C:\Windows\System\YOzZHXu.exe
  C:\Windows\System\YOzZHXu.exe
  2⤵
  PID:9824
- C:\Windows\System\utjTmzC.exe
  C:\Windows\System\utjTmzC.exe
  2⤵
  PID:9840
- C:\Windows\System\OUkJcJF.exe
  C:\Windows\System\OUkJcJF.exe
  2⤵
  PID:9876
- C:\Windows\System\YlyHJlc.exe
  C:\Windows\System\YlyHJlc.exe
  2⤵
  PID:9896
- C:\Windows\System\lBnNZJn.exe
  C:\Windows\System\lBnNZJn.exe
  2⤵
  PID:9912
- C:\Windows\System\LbJKEoI.exe
  C:\Windows\System\LbJKEoI.exe
  2⤵
  PID:9936
- C:\Windows\System\gLNPciA.exe
  C:\Windows\System\gLNPciA.exe
  2⤵
  PID:9952
- C:\Windows\System\itWcHvV.exe
  C:\Windows\System\itWcHvV.exe
  2⤵
  PID:9972
- C:\Windows\System\roOEMMl.exe
  C:\Windows\System\roOEMMl.exe
  2⤵
  PID:9988
- C:\Windows\System\oSQilQi.exe
  C:\Windows\System\oSQilQi.exe
  2⤵
  PID:10008
- C:\Windows\System\LvvSJnf.exe
  C:\Windows\System\LvvSJnf.exe
  2⤵
  PID:10024
- C:\Windows\System\nAGVxOF.exe
  C:\Windows\System\nAGVxOF.exe
  2⤵
  PID:10040
- C:\Windows\System\DtvYANh.exe
  C:\Windows\System\DtvYANh.exe
  2⤵
  PID:10056
- C:\Windows\System\yBIIvMr.exe
  C:\Windows\System\yBIIvMr.exe
  2⤵
  PID:10072
- C:\Windows\System\HaFmadl.exe
  C:\Windows\System\HaFmadl.exe
  2⤵
  PID:10088
- C:\Windows\System\viPwsLP.exe
  C:\Windows\System\viPwsLP.exe
  2⤵
  PID:10104
- C:\Windows\System\rVRZHMB.exe
  C:\Windows\System\rVRZHMB.exe
  2⤵
  PID:10120
- C:\Windows\System\HTEwHtd.exe
  C:\Windows\System\HTEwHtd.exe
  2⤵
  PID:10140
- C:\Windows\System\CaqBmGV.exe
  C:\Windows\System\CaqBmGV.exe
  2⤵
  PID:10160
- C:\Windows\System\ZsCxlqw.exe
  C:\Windows\System\ZsCxlqw.exe
  2⤵
  PID:10176
- C:\Windows\System\sWpEQyS.exe
  C:\Windows\System\sWpEQyS.exe
  2⤵
  PID:10196
- C:\Windows\System\AUnOAXD.exe
  C:\Windows\System\AUnOAXD.exe
  2⤵
  PID:10220
- C:\Windows\System\WAnoOxs.exe
  C:\Windows\System\WAnoOxs.exe
  2⤵
  PID:9184
- C:\Windows\System\dfHcJfi.exe
  C:\Windows\System\dfHcJfi.exe
  2⤵
  PID:7412
- C:\Windows\System\EdtwBIx.exe
  C:\Windows\System\EdtwBIx.exe
  2⤵
  PID:8136
- C:\Windows\System\WYICLNB.exe
  C:\Windows\System\WYICLNB.exe
  2⤵
  PID:8400
- C:\Windows\System\ZQepjOW.exe
  C:\Windows\System\ZQepjOW.exe
  2⤵
  PID:8476
- C:\Windows\System\dgIvogg.exe
  C:\Windows\System\dgIvogg.exe
  2⤵
  PID:8580
- C:\Windows\System\tBtXWUH.exe
  C:\Windows\System\tBtXWUH.exe
  2⤵
  PID:8676
- C:\Windows\System\FXJcUVI.exe
  C:\Windows\System\FXJcUVI.exe
  2⤵
  PID:8716
- C:\Windows\System\HeYcNUg.exe
  C:\Windows\System\HeYcNUg.exe
  2⤵
  PID:9196
- C:\Windows\System\GknVEjC.exe
  C:\Windows\System\GknVEjC.exe
  2⤵
  PID:9212
- C:\Windows\System\NnskQtL.exe
  C:\Windows\System\NnskQtL.exe
  2⤵
  PID:9476
- C:\Windows\System\eBgwGqb.exe
  C:\Windows\System\eBgwGqb.exe
  2⤵
  PID:9572
- C:\Windows\System\LkTQfge.exe
  C:\Windows\System\LkTQfge.exe
  2⤵
  PID:9576
- C:\Windows\System\GLeuAiH.exe
  C:\Windows\System\GLeuAiH.exe
  2⤵
  PID:7608
- C:\Windows\System\TVDpPYb.exe
  C:\Windows\System\TVDpPYb.exe
  2⤵
  PID:7692
- C:\Windows\System\vuZoDfI.exe
  C:\Windows\System\vuZoDfI.exe
  2⤵
  PID:8292
- C:\Windows\System\HAeClwH.exe
  C:\Windows\System\HAeClwH.exe
  2⤵
  PID:8444
- C:\Windows\System\bbTSUwa.exe
  C:\Windows\System\bbTSUwa.exe
  2⤵
  PID:8564
- C:\Windows\System\mlFdRMI.exe
  C:\Windows\System\mlFdRMI.exe
  2⤵
  PID:8828
- C:\Windows\System\nzekNsy.exe
  C:\Windows\System\nzekNsy.exe
  2⤵
  PID:8960
- C:\Windows\System\Uhfizpi.exe
  C:\Windows\System\Uhfizpi.exe
  2⤵
  PID:9116
- C:\Windows\System\uMOaXHj.exe
  C:\Windows\System\uMOaXHj.exe
  2⤵
  PID:9300
- C:\Windows\System\GCWPLXt.exe
  C:\Windows\System\GCWPLXt.exe
  2⤵
  PID:9316
- C:\Windows\System\nqOnNwv.exe
  C:\Windows\System\nqOnNwv.exe
  2⤵
  PID:9584
- C:\Windows\System\yhzjcBX.exe
  C:\Windows\System\yhzjcBX.exe
  2⤵
  PID:9360
- C:\Windows\System\oeHrVaF.exe
  C:\Windows\System\oeHrVaF.exe
  2⤵
  PID:9424
- C:\Windows\System\ihXOIee.exe
  C:\Windows\System\ihXOIee.exe
  2⤵
  PID:9488
- C:\Windows\System\cCLLvxd.exe
  C:\Windows\System\cCLLvxd.exe
  2⤵
  PID:9556
- C:\Windows\System\oNgulBS.exe
  C:\Windows\System\oNgulBS.exe
  2⤵
  PID:9616
- C:\Windows\System\oGCjvtr.exe
  C:\Windows\System\oGCjvtr.exe
  2⤵
  PID:9636
- C:\Windows\System\bWELJQY.exe
  C:\Windows\System\bWELJQY.exe
  2⤵
  PID:9648
- C:\Windows\System\hGfOpSh.exe
  C:\Windows\System\hGfOpSh.exe
  2⤵
  PID:9108
- C:\Windows\System\Jafqvdy.exe
  C:\Windows\System\Jafqvdy.exe
  2⤵
  PID:9724
- C:\Windows\System\emsuQij.exe
  C:\Windows\System\emsuQij.exe
  2⤵
  PID:9788
- C:\Windows\System\sulVuWg.exe
  C:\Windows\System\sulVuWg.exe
  2⤵
  PID:9676
- C:\Windows\System\FZHzmWy.exe
  C:\Windows\System\FZHzmWy.exe
  2⤵
  PID:10188
- C:\Windows\System\KQFEQMM.exe
  C:\Windows\System\KQFEQMM.exe
  2⤵
  PID:10236
- C:\Windows\System\KbYYLCI.exe
  C:\Windows\System\KbYYLCI.exe
  2⤵
  PID:8388
- C:\Windows\System\mqLlDUn.exe
  C:\Windows\System\mqLlDUn.exe
  2⤵
  PID:9188
- C:\Windows\System\mliNBYI.exe
  C:\Windows\System\mliNBYI.exe
  2⤵
  PID:8528
- C:\Windows\System\BjiuUkK.exe
  C:\Windows\System\BjiuUkK.exe
  2⤵
  PID:10216
- C:\Windows\System\FvCgbnf.exe
  C:\Windows\System\FvCgbnf.exe
  2⤵
  PID:10172
- C:\Windows\System\NZuLIlI.exe
  C:\Windows\System\NZuLIlI.exe
  2⤵
  PID:10128
- C:\Windows\System\lBaVjTO.exe
  C:\Windows\System\lBaVjTO.exe
  2⤵
  PID:10036
- C:\Windows\System\BnzFwrh.exe
  C:\Windows\System\BnzFwrh.exe
  2⤵
  PID:9996
- C:\Windows\System\attDYNx.exe
  C:\Windows\System\attDYNx.exe
  2⤵
  PID:9928
- C:\Windows\System\SQHPfHP.exe
  C:\Windows\System\SQHPfHP.exe
  2⤵
  PID:9884
- C:\Windows\System\ccZpfge.exe
  C:\Windows\System\ccZpfge.exe
  2⤵
  PID:9204
- C:\Windows\System\JrGsIud.exe
  C:\Windows\System\JrGsIud.exe
  2⤵
  PID:8796
- C:\Windows\System\iXMrAJP.exe
  C:\Windows\System\iXMrAJP.exe
  2⤵
  PID:9072
- C:\Windows\System\nJIZeJa.exe
  C:\Windows\System\nJIZeJa.exe
  2⤵
  PID:9228
- C:\Windows\System\nVTzgwd.exe
  C:\Windows\System\nVTzgwd.exe
  2⤵
  PID:9252
- C:\Windows\System\SRDaPlQ.exe
  C:\Windows\System\SRDaPlQ.exe
  2⤵
  PID:9340
- C:\Windows\System\JePuPtM.exe
  C:\Windows\System\JePuPtM.exe
  2⤵
  PID:9148
- C:\Windows\System\tXeaoXc.exe
  C:\Windows\System\tXeaoXc.exe
  2⤵
  PID:9348
- C:\Windows\System\ecbTuno.exe
  C:\Windows\System\ecbTuno.exe
  2⤵
  PID:9412
- C:\Windows\System\BpBithF.exe
  C:\Windows\System\BpBithF.exe
  2⤵
  PID:8160
- C:\Windows\System\VeymtMC.exe
  C:\Windows\System\VeymtMC.exe
  2⤵
  PID:8640
- C:\Windows\System\mXvNCIa.exe
  C:\Windows\System\mXvNCIa.exe
  2⤵
  PID:8748
- C:\Windows\System\bPavlsc.exe
  C:\Windows\System\bPavlsc.exe
  2⤵
  PID:9540
- C:\Windows\System\ShzrrSM.exe
  C:\Windows\System\ShzrrSM.exe
  2⤵
  PID:8336
- C:\Windows\System\nNDDtHs.exe
  C:\Windows\System\nNDDtHs.exe
  2⤵
  PID:8464
- C:\Windows\System\JlXqPGL.exe
  C:\Windows\System\JlXqPGL.exe
  2⤵
  PID:9112
- C:\Windows\System\MhrAOSl.exe
  C:\Windows\System\MhrAOSl.exe
  2⤵
  PID:9592
- C:\Windows\System\XjgUJGK.exe
  C:\Windows\System\XjgUJGK.exe
  2⤵
  PID:9460
- C:\Windows\System\qZjMrYe.exe
  C:\Windows\System\qZjMrYe.exe
  2⤵
  PID:9296
- C:\Windows\System\ghxIgqs.exe
  C:\Windows\System\ghxIgqs.exe
  2⤵
  PID:9644
- C:\Windows\System\fViZpAn.exe
  C:\Windows\System\fViZpAn.exe
  2⤵
  PID:9392
- C:\Windows\System\TuhNMKf.exe
  C:\Windows\System\TuhNMKf.exe
  2⤵
  PID:9524
- C:\Windows\System\yLBBlrV.exe
  C:\Windows\System\yLBBlrV.exe
  2⤵
  PID:9672
- C:\Windows\System\OOcYCjn.exe
  C:\Windows\System\OOcYCjn.exe
  2⤵
  PID:8832
- C:\Windows\System\YmJkvLe.exe
  C:\Windows\System\YmJkvLe.exe
  2⤵
  PID:9804
- C:\Windows\System\QJmgwyz.exe
  C:\Windows\System\QJmgwyz.exe
  2⤵
  PID:9708
- C:\Windows\System\YEejNDa.exe
  C:\Windows\System\YEejNDa.exe
  2⤵
  PID:9772
- C:\Windows\System\QbIeoIG.exe
  C:\Windows\System\QbIeoIG.exe
  2⤵
  PID:9852
- C:\Windows\System\ZoCGYir.exe
  C:\Windows\System\ZoCGYir.exe
  2⤵
  PID:10112
- C:\Windows\System\bINYtbP.exe
  C:\Windows\System\bINYtbP.exe
  2⤵
  PID:9980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BkaTVIS.exe

Filesize
1.4MB

MD5
24a71ea43d6dd3058cfd60cafc4cc690

SHA1
54af3e90e91ee518553dac4bfe912e03673be809

SHA256
ba3387998ef72b50d6d6ec1c0099084d706d2f4974695c6ef274fd50348fd809

SHA512
d033d16f82a01dd998d4a9c273c645da9b42ac0417e92356cc7856f6c4700f209b1797471528e41137038882f69b202f5abdbf7b4d51180b397b97a4f0a5ef02

Download Submit
C:\Windows\system\HJZuyOk.exe

Filesize
1.4MB

MD5
8006b8eb43a0c957cd1d1e02a56931e6

SHA1
66c3f2c9ec0fefbfb2c9d18c2a17dff92247c67a

SHA256
b9bd0c09dfab87cd595ab36762a82b40290a8c37f8c5d652bffc4c437ad060e7

SHA512
f5deb8f2c1c37f88dbeacb42c8c65a1debf61c0bc73a424985c5109efe6b8c4366870b068875c0fca2b502bbd8c51bf45a6e86e33aecb3e0f1d6b37e592245d9

Download Submit
C:\Windows\system\NnfMDKT.exe

Filesize
1.4MB

MD5
1bbc6ae7811f48ac7749e1878544022c

SHA1
86bc9733cefdd38ca89565fa8cc132bc9a956c75

SHA256
afcbf178ccbdaa64858d84624b6bb3d644ec0b822e09d74debe48344ff73cc05

SHA512
a6b2deabc6b7f9fc9fca5a03386cc64c164d270b35fa5f48223648f16759303ae347de4fe3524fef0d10acb5e5903df8a931123c5dbca534a8bfa662647ddff2

Download Submit
C:\Windows\system\NssqZzU.exe

Filesize
1.4MB

MD5
8f8d49172ae688b7c9dfce27fa9db200

SHA1
73d703be15274d083fcf5be29432dd6284e86ba0

SHA256
6a11ae1a6be439769565425b5d8ab048045ebb946a5445ca9a543d453c2d8e78

SHA512
54db58503f4c030051b85d00ca6f3b0d76a58514553fc643fb981622325c139c784a313193131231cd5854b997f7a761dfb08af844806dff0b3af2f588fcf1da

Download Submit
C:\Windows\system\PJNhDbZ.exe

Filesize
1.4MB

MD5
4b4d54c4b7560dadd3391bc229afdd13

SHA1
2f928f6572ae5e0521342f0fec7db7c50e2c188e

SHA256
b09ff31a1e97d8886ad137164433eddc105ac1d364009a585295ff45dad07971

SHA512
f2128799f80d841b11d2661bef267704ee3139da3c4eb9d3d0821d5fb31fae394c09149fd29bf7d7dccb4ebda9e8a1915405a99bfc3ec55f1e44d438601e7602

Download Submit
C:\Windows\system\RFIarSH.exe

Filesize
1.4MB

MD5
a3e614228b36a77fad01e311291f63a2

SHA1
f6de5a184d221ec5608c19637f4f96395f967386

SHA256
b256a2d18c363972e58b85211a61843e687b6305b8e99c705d985495f64d7534

SHA512
fc773a2b7403c17c14f774e5282e66a165dc574080a54a3e22f5a0ff21ccffc9b6380626fda1d463cc2355fea91d11a1a4f3d8e9c91d1dc71776d53c8bec52c0

Download Submit
C:\Windows\system\UAQWVaz.exe

Filesize
1.4MB

MD5
3f27e94efa94c94bea3087bcac2dd8df

SHA1
938a3f6ab8dddabafc67c451ed1232faa86ade31

SHA256
d242eb87f5838662ff8af9655fcb755c76107e4ed98a6bdc6a843e477db7434f

SHA512
e3807a1f6549e02cf393d12296c42ecabb37e91109a123b12dbfaa49879765b0114dff398a4adc8f70f9ba6be726f61a5225a44dc4fdd28eec557e086399d9b9

Download Submit
C:\Windows\system\UQooUHF.exe

Filesize
1.4MB

MD5
1e909d75b4277254050ba57c6ba4318e

SHA1
a3f8a6f30154b01e7c797f21ab34b4f37366fd8a

SHA256
60670036d43671f50bdc26111c225ee04e626085a0347316d8b7c0be371fd160

SHA512
f3c3fea6969dda005de6ec40192e8f23cb1abec5409f956d3c6438c5bd2e6b9dc61254b5536cc26765bf9d76bbfa3d54a72a46a874bb5a151d749e2ad357d0f1

Download Submit
C:\Windows\system\YxShxHU.exe

Filesize
1.4MB

MD5
4291d75bde0a2a2532d00929f7209ff5

SHA1
746a41543f79bd7926b4d872b7ea3422a07ad6a4

SHA256
bb5bb9dd479e04d45b9966a68d752170c0f5c9cf4a509461930f509c33d8753b

SHA512
99598cc39bc1ebee6d0cea7bf1c9f77758908b5a380ce5d4eb185447b2571950e38c9d291520eff4dc55370bc83034b58206966accaa398ccdcc39eb4c6d80a0

Download Submit
C:\Windows\system\ZdxiuaR.exe

Filesize
1.4MB

MD5
1cbb0fd6b035e71432918a1478f47e87

SHA1
b8406e8dcb521b4ab5382a51d72e8b33900975a7

SHA256
556496fd9054044adb4b4b14aee37a32e8bae767d166f2a14cf5356d15e0e1e4

SHA512
6b2c8fde06b9421eb32db0b196f05e18946dcf9d1ec5a28f51dc53d0e86796a8d2ac44d0ce20ec2d01307c4c001775b8f15bead572a8ef6fbbe73ec3b5c699cf

Download Submit
C:\Windows\system\ZyaYdcA.exe

Filesize
1.4MB

MD5
eb4caf603dab1c8028c65197e738f1c5

SHA1
4221f9a90e5243b95a4c8c3b9d06574b25a54518

SHA256
7fbe9d5192dc48f34ad3807778209cae56c87631a61d69c17049345b70b4c970

SHA512
3c6297cfd750561a8dc03657cf9bc535ce128d0c1dfc9aa292bc3f900a3b1cd1e32c0c46339dcd6973f4954fdc9a72dd7c37b0dc8c15246c1d235c9f8157a110

Download Submit
C:\Windows\system\brwcEmZ.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\system\cMeYmhE.exe

Filesize
1.4MB

MD5
a4e7ac2883b2d8f26eab813addd21028

SHA1
89a113c1d5d8a186bd9d3b923f4bc490bc3888c6

SHA256
13032b1f79122d38ade84a91222c5ce65f05468f430232057cb6121021acb1cb

SHA512
79160ca03f7b5bc13eb98353196d140b7ccc1c255982601a18c98f46ab5fd5944f688ad35495d5db654b9cbaaa2bc31d98e196f673fef8ef04103e9d38373262

Download Submit
C:\Windows\system\dFKjkYw.exe

Filesize
1.4MB

MD5
958c33cfa058f7675a507fddb57e0760

SHA1
d1425de52755a15f59d6f39f1ec07c9b9bb25bcb

SHA256
06ec9a20e3a6da42727793733f296436c05ef8bcfad18691a01870e6f0a8b766

SHA512
31358cd6138f1bb72f4cac954078be46d1de3a347ef635058b7d4a0298360467be4ff6b9954b5ee9a138c392e14cf64179a5a027cbe6c7726f0d6f009c4fdcd8

Download Submit
C:\Windows\system\emZBOwp.exe

Filesize
1.4MB

MD5
b302f575f15eb7802fd29a60f0a587b5

SHA1
9f8cb5a4ae67d1839a8d281fddcafcf610e6252d

SHA256
f552e28031c1da78a5413e2195a72728ab7b30b5de51cd988b069a4818976cab

SHA512
3d062b7f9941c6454ebc6c83513bb5df48bb3bf2f36587bde8f5ec5b7b62a3e754e6e019a01ba7b6c29311f396317b21f992c0478bbf7da1863af8890a2a94d9

Download Submit
C:\Windows\system\fgawTPj.exe

Filesize
1.4MB

MD5
7b804ac95ac275e7795b05fe63457393

SHA1
0b8eab399d524fa7da88e7762d323f1a7d2a5ed9

SHA256
b161d144aa20b14d59177fc85ca5604a9e4d7f00014b1cac3932ea295417232d

SHA512
89d10cae9a4c8d60aa5d6ed1803fbc40e577eb3d71b543dd74d360cd9ff038c3c734f17b7e4596deac6a81e4a9a8b5c3c7a154a1ca465e1de1fa5c863d7cb634

Download Submit
C:\Windows\system\fmXyqze.exe

Filesize
1.4MB

MD5
7af98a8d513468f9b48104474bcd32f2

SHA1
cecfb9cfb1b3416f50815b01c4c2cf74a4b4ad00

SHA256
82811cf52795a8b7b4bb8556aeb25476ed35637982b468a086ab0d229983723c

SHA512
b33044277f6fa675f0a281b8e83ba77c6c70956a01e1b3288d55e7896155c71b8bd778e59a974305254a174446ba94ee3f973818a574ef36b8642d3f0cbdd4fc

Download Submit
C:\Windows\system\gErMYBJ.exe

Filesize
1.4MB

MD5
f4300b3ec3e81cf7b64c10d962169c36

SHA1
9cf3dd75a6489545d92f29487fbd932d29288720

SHA256
3292ada0a98dae698e5b0ebe50a5589f411498bd38efec99fb93c27a3cf3d3ff

SHA512
275b92215a551df704248c556ef4161efea7e5b620b5684f9b54e31f07c0dd4d3470d8e40057f1269af90a41eb069b01fe59c7eda4e0699ef2bad889a6a7728d

Download Submit
C:\Windows\system\mgNDokK.exe

Filesize
1.4MB

MD5
6155e8d2867100f7e8eaabfcd6dac90e

SHA1
ada8a4b20b26cfab0bdfa7f3af1473f2a44a06bf

SHA256
d3a6a649f9c2eb7d590dc021fb2879ffb3a2f530a36b4c6980b7c80bc11ac8c8

SHA512
a67eee63f55d04e764f5fe41313f354033197947c6b68cb560a5f67902353821819cd748e4987ef86964eeb1701e27c97e5d3a2e3306ae4512c11498548e7109

Download Submit
C:\Windows\system\nCPSeuU.exe

Filesize
1.4MB

MD5
c4510833d1420cf4fb9bcda8895475ce

SHA1
dd8badd3401e14c1055b632068d93c93768e9ec1

SHA256
288741ba488fbc2b9fc3a9ea081b8b0fa78e9cacbe3652a5176a1f60cff00766

SHA512
8f1d2a8a01a33979ad1dbb31afdc35fba6dd36481e4b90d8c48302a310cb37064224535cf519e44f5ad85b86342f2dbd38c62b3a7178f6a7c1905476a15b647b

Download Submit
C:\Windows\system\nWxmrGP.exe

Filesize
1.4MB

MD5
f9740ce052ded8564b56fb55fd4d38a2

SHA1
827fa0491e6c6bbad132776822e048ab84fb651d

SHA256
2d1732c430f6b32e3ffbf5ae0f56a393dc7938d03867d712e7af9b797491da17

SHA512
a98a78538ba6709f90a344afaf1eea87432450644db80d7f6f95cc32bdf802f5ee57278013adc7c8d8de9a75be90a1ea5ddcf019c72fa0d26352802b349e07c6

Download Submit
C:\Windows\system\npOsuNf.exe

Filesize
1.4MB

MD5
d2faf59cc77197740f107bd784625a13

SHA1
1ebaf865f235a04a1a0bca0723ed3e060d154e57

SHA256
9d37c797b59cfb85501ce9f684e3e54d1533eb58bede6c5a2469bb4b08fcdc76

SHA512
d222faff5583a6d3be88adfe6160b645ac7834fd709fa2dfe106f94c03bbbd2762191570baae87963b9129f877a1050859fc5c2a2e80bacd81a5b21146d67184

Download Submit
C:\Windows\system\pFFdjFJ.exe

Filesize
1.4MB

MD5
43f4006f8e48af91fdb883e23cf2f3e1

SHA1
34df515d83aa1c2bad684b65640728016e736176

SHA256
a9b383429bff280efaac657a34e891b6e16cac20ef1710217c007ce427182545

SHA512
9bebedc7b60b6d2eda7b1c13094fe93e0b334694160d785af48c6c9c340cd24dd165a76af172d344e6d3babd7157aebe4cdd8655c4a8dda276bd68ba0cfba2f2

Download Submit
C:\Windows\system\pYqvshJ.exe

Filesize
1.4MB

MD5
e41e8b79b6e8d1bf3e72d766157c2a37

SHA1
0e098b1fcd0bd7f6d92d8d255ce30855677aca2f

SHA256
04081292818993177c29789145a9d3631f205ca7d73e200921c03831629e30ad

SHA512
e9cb14a07ff54e7f00697d1f96b04aec0b26110c9762b1b2f0be97c40c924334b352b3f26cc80cddc98f009aef1ff08a368b17aac9cbda8af01b6240c05eaa07

Download Submit
C:\Windows\system\rSdAFJx.exe

Filesize
1.4MB

MD5
82882910f6f424eb9f1614783199a6b7

SHA1
ad2c29697d8ef45dc6c7f57d98901b644cc16d49

SHA256
b837eb10f688f5165e9afd304af5711154176ea70484d3901f3d29d79bfee758

SHA512
1084bc1006f0c7d5d5aafbae0d8b5d807b9b4f53dd2e9e59e00f9cd60c478a08779b81da4d1e909efb2a4a82a431bf5e2474de7b42c47798e46ec4cff5ea8ccb

Download Submit
C:\Windows\system\tafYlvZ.exe

Filesize
1.4MB

MD5
b8889391dd6c8103002f48ac057be9ba

SHA1
d54adca94c8c31f45917afd1d96eeb40d14aedeb

SHA256
74a4145be73b764674f27c276a14210cca83e78ba1dfeda30e1b4924021c4311

SHA512
681cf0dbeed8737cb7830173c1eb0353545d8aec56923407f535a1a1e8f1cbc9bd96bad4f68b6c4a489b2da2e0243893f3c40b58b7f7724e86c6ec7b305146a7

Download Submit
C:\Windows\system\uEfDJKQ.exe

Filesize
1.4MB

MD5
c694d13efb563d95438c20e9f56df492

SHA1
f2aa14512fae7475eafebdfbf0325c94225566f7

SHA256
fdee53c809f0c7dd3356f920d54604040b644793ffe3ca1d7477fc70621dadda

SHA512
f825e73bfcb950006610f53be02532d4c185dd0a85a5112d5bc3e53a253fd5f062b9c57f9b594f964f0fd918512cff22fba6bf6064e3f44257ac3bc6006e286a

Download Submit
C:\Windows\system\wUADVSY.exe

Filesize
1.4MB

MD5
80eeed1aff0043403915389df9e0aded

SHA1
de1ac442fd74e55cdb46add9fa4b0634d0d92fd9

SHA256
bf37d36f333ed3c2a09fdc389fc6587b8aabfb8ef88dfabc003fdf869b71c988

SHA512
97ae2eb4f3008121448c6f7086039eed98a45dd5a51aaddf6a988b3e97b67d6f2e98e3f87d4e6a5d140d2b21ad630b39df1917f9377a87590fad9ef3a48c2a96

Download Submit
C:\Windows\system\wrweqXo.exe

Filesize
1.4MB

MD5
45de5bd9569d5744400de0cfd8c12668

SHA1
9c82902f0fe93df0b3185e7a59b09a00cbe9da2e

SHA256
0fa47e237e511168aa84819d4bac2175d2f7f49ad961668f66b665030e488119

SHA512
b78f592a52cda20cc7df8fcce70a25e9cba9004b20d1c978dee631923f323d0ce9f5019adc327a4340f2ae9a2ec9e121524a41c4d0aeb5dacc1c75d0db4a5bee

Download Submit
C:\Windows\system\yOADNSl.exe

Filesize
1.4MB

MD5
fa95dca1a31ac636e11de1da11ac2d08

SHA1
848c7efff504f3e8c8d0ab7e7127ec7c027c3d22

SHA256
bf24aaf32ee784d3c33c03fef23fa1e00cab9cd90cedf99a0f1fa1931411e5a2

SHA512
b59c55ea52070b3b3947b707ec1b858f42f1e586fc9e605f80e47cd515a965637a2ca3bcab4a75d163bed40dcce5384dde25bd42f34ad0d610368e95b2cb8c58

Download Submit
C:\Windows\system\zUKENBO.exe

Filesize
1.4MB

MD5
3163a7d1476abce415388f29d9783094

SHA1
49ec23225aaa5cdcfce5feb3c637a9811ef73473

SHA256
ee95fe68cff201252b41af4bf44f1eaf9580833d3f89a00783e5c68d4c37275c

SHA512
0fc3974f776138617bbbccf5bf207b9df852bbb2846749112723859be9bfb3d189970bd7a1955a99c74a469b6b9e54e2db97c1aca182560832baf0c43f240bc8

Download Submit
\Windows\system\wTeITPC.exe

Filesize
1.4MB

MD5
dbb5b834a06ec45b3765f4c0bae684b6

SHA1
b816e4efecfd8b82aa1c434a0957a84eaf51841f

SHA256
36ec343c9b0f5ce7949ecc8eb282f9beb4eb28f2b9338434d6c65569bb707e02

SHA512
8da63f85af784f279a0486e98d3149a1df0b8d47862d0e56beeef69d001f09ff87777891bb13b6460678688610511faabe9cafa18e6e462c18fd6d6c4a17327d

Download Submit
\Windows\system\xWUonSk.exe

Filesize
1.4MB

MD5
7fc79d7dd1f4d182b31b77aed71e7041

SHA1
19d137c09d2c42d16a69f7a23550d0d01e63df15

SHA256
7b93b8e0d0335108172894f7e1b00f08fbff56c9a874733c1e6f11f296c50e71

SHA512
e4727e3a31e8b75126df433bc2ed3f15882a8540556381dd9c050708891938e01c984a95a8fd12fd7a7b995f27a6a990d71e102e125dd57a8d0e098d50eb9d79

Download Submit
memory/864-70-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/920-153-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/1460-83-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1636-63-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2148-90-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2164-39-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2164-1784-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2164-46-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2164-6492-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2164-52-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2164-5980-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2164-82-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-89-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2164-2-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2164-19-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2164-69-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2164-59-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2164-1140-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2164-8-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2164-40-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-556-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2444-47-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2520-20-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-38-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-9-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-35-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2700-76-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-5554-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-560-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2824-5508-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2824-53-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2900-26-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2900-21-0x000007FEF633E000-0x000007FEF633F000-memory.dmp

Filesize
4KB

Download
memory/2900-34-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-37-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-27-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2900-29-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-54-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-44-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download