xmrig | 896ab68d21c0295d113c2627f287ce2e92e3d930e29117a0cfc6dee7953c255d

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
Size

1.4MB
MD5

13c27f5f66aee7b124aeab04a161c036
SHA1

10846bea4ef3640ece65c4e631b8634760cd329c
SHA256

896ab68d21c0295d113c2627f287ce2e92e3d930e29117a0cfc6dee7953c255d
SHA512

39a313d3fe8e56b2557ea1b61337de3d17e346e796c0e8edd4686ec3971243d231af31c9c3b67b20e5f5592dc32f6ce2715c6541d128c41872239a7918dfe976
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwU:Lz071uv4BPMkibTIA5CJZ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2368-13-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2836-46-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2584-53-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2916-61-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2440-51-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2576-49-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2848-44-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2496-98-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2496-97-0x0000000003540000-0x0000000003932000-memory.dmp	xmrig
behavioral1/memory/2496-94-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2648-80-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2172	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2368	uRpWqxp.exe
2848	scfVyfl.exe
2836	YsNRqLZ.exe
2576	HfJFrhN.exe
2440	eNadYlt.exe
2584	PUwHwja.exe
2916	IHwJQQT.exe
332	UHFEjVY.exe
1684	bMxUXLf.exe
2648	VchHyMs.exe
2644	sJhUyBD.exe
1592	sUPcgNC.exe
1932	QOtOpsg.exe
1888	OiIFvZw.exe
1996	ybAtCnc.exe
280	ZTHoHpJ.exe
1336	oxbyqRx.exe
1612	CEYeXvq.exe
1688	moEIuwD.exe
1692	mHmOCeF.exe
2456	NmEayrG.exe
676	lELHPFQ.exe
2512	xzrUoUY.exe
1440	eeGbjwf.exe
2760	sSkpZri.exe
952	Adiqcbt.exe
1032	dJQLeqR.exe
1000	nHfUsGY.exe
1700	jUJEpWi.exe
1300	kgTtCds.exe
1848	yGlRPiS.exe
1444	WTMIWoT.exe
1408	afnfZwY.exe
840	unFhyzP.exe
2880	cSqtyUQ.exe
1908	zWAwQTl.exe
1280	YLJNXhv.exe
344	unOpojk.exe
1432	hQhxlIO.exe
1740	earMpSY.exe
1528	aBIyWPY.exe
2824	ZcvQuPW.exe
2712	bKaPinU.exe
2616	OkXXxMn.exe
2432	CuBpioh.exe
2532	sKJLSXK.exe
2596	WtZMFJr.exe
2668	WaIBSFe.exe
312	ObrTZjs.exe
3064	lUbDqcV.exe
1896	AwWLbpJ.exe
912	sHEPMxa.exe
2160	UnxVbIH.exe
844	iwhjAXH.exe
2952	vBDcShk.exe
2872	RGysevl.exe
1632	LaOlcDm.exe
1540	FdebNAK.exe
1924	awvetzp.exe
1644	zbVQsLI.exe
2864	aFBhRmB.exe
2680	tKehWbO.exe
2744	UuPtsZJ.exe
2528	mCBbCKQ.exe

Loads dropped DLL 64 IoCs

pid	Process
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2496-2-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x000c00000001225d-5.dat	upx
behavioral1/memory/2368-13-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x00320000000139f1-16.dat	upx
behavioral1/files/0x0016000000005586-23.dat	upx
behavioral1/files/0x0007000000014183-33.dat	upx
behavioral1/files/0x0008000000014171-28.dat	upx
behavioral1/files/0x000700000001418c-36.dat	upx
behavioral1/memory/2836-46-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2584-53-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0007000000014251-58.dat	upx
behavioral1/memory/2916-61-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2440-51-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2576-49-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2848-44-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/files/0x000800000001432f-64.dat	upx
behavioral1/files/0x0006000000014a60-69.dat	upx
behavioral1/files/0x0032000000013a3f-72.dat	upx
behavioral1/memory/332-67-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2644-86-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/files/0x0006000000014bd7-95.dat	upx
behavioral1/files/0x0006000000015083-111.dat	upx
behavioral1/files/0x00060000000150d9-114.dat	upx
behavioral1/files/0x0006000000015c9a-157.dat	upx
behavioral1/files/0x0006000000015ae3-143.dat	upx
behavioral1/files/0x0006000000015cc5-168.dat	upx
behavioral1/files/0x0006000000015ca8-160.dat	upx
behavioral1/files/0x0006000000015ce3-177.dat	upx
behavioral1/files/0x0006000000015d21-193.dat	upx
behavioral1/files/0x0006000000015cee-188.dat	upx
behavioral1/files/0x0006000000015cf8-186.dat	upx
behavioral1/files/0x0006000000015b85-182.dat	upx
behavioral1/files/0x0006000000015662-137.dat	upx
behavioral1/files/0x0006000000015d0a-197.dat	upx
behavioral1/files/0x0006000000015d39-196.dat	upx
behavioral1/files/0x0006000000015cd2-173.dat	upx
behavioral1/files/0x0006000000015cb1-166.dat	upx
behavioral1/files/0x0006000000015b50-150.dat	upx
behavioral1/files/0x00060000000153ee-127.dat	upx
behavioral1/files/0x00060000000158d9-141.dat	upx
behavioral1/files/0x000600000001565a-132.dat	upx
behavioral1/files/0x000600000001507a-121.dat	upx
behavioral1/files/0x0006000000014f57-106.dat	upx
behavioral1/files/0x0006000000014c2d-101.dat	upx
behavioral1/memory/2496-94-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-83.dat	upx
behavioral1/memory/2648-80-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/1684-78-0x000000013F540000-0x000000013F932000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qhyRrHZ.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\GCbdxKJ.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\LQInlIY.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\YsNRqLZ.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\bMxUXLf.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\oBSyXbr.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\rzbtLZE.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\hnxbPZe.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\WJcdrVI.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\TFsTDZf.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\xgFnrXD.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\TebpiUf.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\SidYxJh.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\oaKIkhP.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\EvfpGso.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\PZNnzVv.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\vBDcShk.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\JDsnzTk.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\YJcilAs.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\yPDteqh.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\jAzTRrx.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\oSuVNiz.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\geAtfkV.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\hDKmgjy.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\PdCxenq.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\wShbwtv.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\cCUsJwj.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\iBKLUDW.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\HdQausD.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\LHRwKuY.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\QlMIHQq.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\NdIUuYs.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\ccfcLxk.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\xkTjlEe.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\Lwussnw.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\DZkJfEf.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\YZamjNF.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\lbZhAOv.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\psLqEBG.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\fTIRqYm.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\qolwDmf.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\tKehWbO.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\ZffCFdC.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\BogjAQx.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\jfpoRyf.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\lprrpTQ.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\RaQipZZ.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\GHIqnFq.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\tNMREbY.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\zdoLSXA.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\xVWyesK.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\yUWHALT.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\uLGMeON.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\XAcXCBj.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\QBDwyGX.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\EprDKsK.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\frRedMY.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\Styibkw.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\cUPZbNM.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\DeYFqUL.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\QJpAzsQ.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\faKViuK.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\kfopIQL.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
File created	C:\Windows\System\yGlRPiS.exe	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2172	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	29
PID 2496 wrote to memory of 2172	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	29
PID 2496 wrote to memory of 2172	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	29
PID 2496 wrote to memory of 2368	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2368	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2368	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	30
PID 2496 wrote to memory of 2848	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2848	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2848	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2836	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	32
PID 2496 wrote to memory of 2836	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	32
PID 2496 wrote to memory of 2836	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	32
PID 2496 wrote to memory of 2576	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	33
PID 2496 wrote to memory of 2576	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	33
PID 2496 wrote to memory of 2576	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	33
PID 2496 wrote to memory of 2440	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	34
PID 2496 wrote to memory of 2440	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	34
PID 2496 wrote to memory of 2440	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	34
PID 2496 wrote to memory of 2584	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	35
PID 2496 wrote to memory of 2584	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	35
PID 2496 wrote to memory of 2584	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	35
PID 2496 wrote to memory of 2916	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	36
PID 2496 wrote to memory of 2916	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	36
PID 2496 wrote to memory of 2916	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	36
PID 2496 wrote to memory of 332	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	37
PID 2496 wrote to memory of 332	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	37
PID 2496 wrote to memory of 332	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	37
PID 2496 wrote to memory of 1684	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	38
PID 2496 wrote to memory of 1684	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	38
PID 2496 wrote to memory of 1684	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	38
PID 2496 wrote to memory of 2648	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	39
PID 2496 wrote to memory of 2648	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	39
PID 2496 wrote to memory of 2648	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	39
PID 2496 wrote to memory of 2644	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	40
PID 2496 wrote to memory of 2644	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	40
PID 2496 wrote to memory of 2644	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	40
PID 2496 wrote to memory of 1592	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	41
PID 2496 wrote to memory of 1592	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	41
PID 2496 wrote to memory of 1592	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	41
PID 2496 wrote to memory of 1932	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	42
PID 2496 wrote to memory of 1932	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	42
PID 2496 wrote to memory of 1932	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	42
PID 2496 wrote to memory of 1888	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	43
PID 2496 wrote to memory of 1888	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	43
PID 2496 wrote to memory of 1888	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	43
PID 2496 wrote to memory of 280	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	44
PID 2496 wrote to memory of 280	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	44
PID 2496 wrote to memory of 280	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	44
PID 2496 wrote to memory of 1996	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	45
PID 2496 wrote to memory of 1996	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	45
PID 2496 wrote to memory of 1996	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	45
PID 2496 wrote to memory of 1336	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	46
PID 2496 wrote to memory of 1336	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	46
PID 2496 wrote to memory of 1336	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	46
PID 2496 wrote to memory of 1612	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	47
PID 2496 wrote to memory of 1612	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	47
PID 2496 wrote to memory of 1612	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	47
PID 2496 wrote to memory of 1688	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	48
PID 2496 wrote to memory of 1688	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	48
PID 2496 wrote to memory of 1688	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	48
PID 2496 wrote to memory of 1692	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	49
PID 2496 wrote to memory of 1692	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	49
PID 2496 wrote to memory of 1692	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	49
PID 2496 wrote to memory of 2456	2496	13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13c27f5f66aee7b124aeab04a161c036_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System\uRpWqxp.exe
  C:\Windows\System\uRpWqxp.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\scfVyfl.exe
  C:\Windows\System\scfVyfl.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\YsNRqLZ.exe
  C:\Windows\System\YsNRqLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\HfJFrhN.exe
  C:\Windows\System\HfJFrhN.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\eNadYlt.exe
  C:\Windows\System\eNadYlt.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\PUwHwja.exe
  C:\Windows\System\PUwHwja.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\IHwJQQT.exe
  C:\Windows\System\IHwJQQT.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\UHFEjVY.exe
  C:\Windows\System\UHFEjVY.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\bMxUXLf.exe
  C:\Windows\System\bMxUXLf.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\VchHyMs.exe
  C:\Windows\System\VchHyMs.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\sJhUyBD.exe
  C:\Windows\System\sJhUyBD.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\sUPcgNC.exe
  C:\Windows\System\sUPcgNC.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\QOtOpsg.exe
  C:\Windows\System\QOtOpsg.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\OiIFvZw.exe
  C:\Windows\System\OiIFvZw.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\ZTHoHpJ.exe
  C:\Windows\System\ZTHoHpJ.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\ybAtCnc.exe
  C:\Windows\System\ybAtCnc.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\oxbyqRx.exe
  C:\Windows\System\oxbyqRx.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\CEYeXvq.exe
  C:\Windows\System\CEYeXvq.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\moEIuwD.exe
  C:\Windows\System\moEIuwD.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\mHmOCeF.exe
  C:\Windows\System\mHmOCeF.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\NmEayrG.exe
  C:\Windows\System\NmEayrG.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\xzrUoUY.exe
  C:\Windows\System\xzrUoUY.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\lELHPFQ.exe
  C:\Windows\System\lELHPFQ.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\dJQLeqR.exe
  C:\Windows\System\dJQLeqR.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\eeGbjwf.exe
  C:\Windows\System\eeGbjwf.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\afnfZwY.exe
  C:\Windows\System\afnfZwY.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\sSkpZri.exe
  C:\Windows\System\sSkpZri.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\unFhyzP.exe
  C:\Windows\System\unFhyzP.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\Adiqcbt.exe
  C:\Windows\System\Adiqcbt.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\YLJNXhv.exe
  C:\Windows\System\YLJNXhv.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\nHfUsGY.exe
  C:\Windows\System\nHfUsGY.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\WaIBSFe.exe
  C:\Windows\System\WaIBSFe.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\jUJEpWi.exe
  C:\Windows\System\jUJEpWi.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\ObrTZjs.exe
  C:\Windows\System\ObrTZjs.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\kgTtCds.exe
  C:\Windows\System\kgTtCds.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\lUbDqcV.exe
  C:\Windows\System\lUbDqcV.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\yGlRPiS.exe
  C:\Windows\System\yGlRPiS.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\sHEPMxa.exe
  C:\Windows\System\sHEPMxa.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\WTMIWoT.exe
  C:\Windows\System\WTMIWoT.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\UnxVbIH.exe
  C:\Windows\System\UnxVbIH.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\cSqtyUQ.exe
  C:\Windows\System\cSqtyUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\iwhjAXH.exe
  C:\Windows\System\iwhjAXH.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\zWAwQTl.exe
  C:\Windows\System\zWAwQTl.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\vBDcShk.exe
  C:\Windows\System\vBDcShk.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\unOpojk.exe
  C:\Windows\System\unOpojk.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\RGysevl.exe
  C:\Windows\System\RGysevl.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\hQhxlIO.exe
  C:\Windows\System\hQhxlIO.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\FdebNAK.exe
  C:\Windows\System\FdebNAK.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\earMpSY.exe
  C:\Windows\System\earMpSY.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\awvetzp.exe
  C:\Windows\System\awvetzp.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\aBIyWPY.exe
  C:\Windows\System\aBIyWPY.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\zbVQsLI.exe
  C:\Windows\System\zbVQsLI.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZcvQuPW.exe
  C:\Windows\System\ZcvQuPW.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\tKehWbO.exe
  C:\Windows\System\tKehWbO.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\bKaPinU.exe
  C:\Windows\System\bKaPinU.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\UuPtsZJ.exe
  C:\Windows\System\UuPtsZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\OkXXxMn.exe
  C:\Windows\System\OkXXxMn.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\mCBbCKQ.exe
  C:\Windows\System\mCBbCKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\CuBpioh.exe
  C:\Windows\System\CuBpioh.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\DfhnWqL.exe
  C:\Windows\System\DfhnWqL.exe
  2⤵
  PID:2480
- C:\Windows\System\sKJLSXK.exe
  C:\Windows\System\sKJLSXK.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\khNJMAc.exe
  C:\Windows\System\khNJMAc.exe
  2⤵
  PID:2560
- C:\Windows\System\WtZMFJr.exe
  C:\Windows\System\WtZMFJr.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\hIOtadP.exe
  C:\Windows\System\hIOtadP.exe
  2⤵
  PID:2780
- C:\Windows\System\AwWLbpJ.exe
  C:\Windows\System\AwWLbpJ.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\KhtBqfM.exe
  C:\Windows\System\KhtBqfM.exe
  2⤵
  PID:2308
- C:\Windows\System\LaOlcDm.exe
  C:\Windows\System\LaOlcDm.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\RJtaLND.exe
  C:\Windows\System\RJtaLND.exe
  2⤵
  PID:2808
- C:\Windows\System\aFBhRmB.exe
  C:\Windows\System\aFBhRmB.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\PtlhaGv.exe
  C:\Windows\System\PtlhaGv.exe
  2⤵
  PID:3000
- C:\Windows\System\cOwRpOv.exe
  C:\Windows\System\cOwRpOv.exe
  2⤵
  PID:1880
- C:\Windows\System\MgAFYGP.exe
  C:\Windows\System\MgAFYGP.exe
  2⤵
  PID:900
- C:\Windows\System\DZkJfEf.exe
  C:\Windows\System\DZkJfEf.exe
  2⤵
  PID:2124
- C:\Windows\System\SWfwWhS.exe
  C:\Windows\System\SWfwWhS.exe
  2⤵
  PID:1660
- C:\Windows\System\nsLMgKT.exe
  C:\Windows\System\nsLMgKT.exe
  2⤵
  PID:1460
- C:\Windows\System\BsCoYqi.exe
  C:\Windows\System\BsCoYqi.exe
  2⤵
  PID:1532
- C:\Windows\System\buUxFUS.exe
  C:\Windows\System\buUxFUS.exe
  2⤵
  PID:2540
- C:\Windows\System\frRedMY.exe
  C:\Windows\System\frRedMY.exe
  2⤵
  PID:1948
- C:\Windows\System\ZrHZQHy.exe
  C:\Windows\System\ZrHZQHy.exe
  2⤵
  PID:3004
- C:\Windows\System\bOLnIKI.exe
  C:\Windows\System\bOLnIKI.exe
  2⤵
  PID:2364
- C:\Windows\System\oBSyXbr.exe
  C:\Windows\System\oBSyXbr.exe
  2⤵
  PID:2152
- C:\Windows\System\fdhQHpE.exe
  C:\Windows\System\fdhQHpE.exe
  2⤵
  PID:2556
- C:\Windows\System\WDsLyZw.exe
  C:\Windows\System\WDsLyZw.exe
  2⤵
  PID:1876
- C:\Windows\System\EkerjXL.exe
  C:\Windows\System\EkerjXL.exe
  2⤵
  PID:1116
- C:\Windows\System\TlEntxk.exe
  C:\Windows\System\TlEntxk.exe
  2⤵
  PID:1788
- C:\Windows\System\gsIOIyf.exe
  C:\Windows\System\gsIOIyf.exe
  2⤵
  PID:412
- C:\Windows\System\spGOEQj.exe
  C:\Windows\System\spGOEQj.exe
  2⤵
  PID:948
- C:\Windows\System\gVyUGlH.exe
  C:\Windows\System\gVyUGlH.exe
  2⤵
  PID:944
- C:\Windows\System\CZnjvSS.exe
  C:\Windows\System\CZnjvSS.exe
  2⤵
  PID:1488
- C:\Windows\System\zSkedQB.exe
  C:\Windows\System\zSkedQB.exe
  2⤵
  PID:380
- C:\Windows\System\vpZLYji.exe
  C:\Windows\System\vpZLYji.exe
  2⤵
  PID:1564
- C:\Windows\System\bYTIJYK.exe
  C:\Windows\System\bYTIJYK.exe
  2⤵
  PID:1536
- C:\Windows\System\NAXzEtG.exe
  C:\Windows\System\NAXzEtG.exe
  2⤵
  PID:1588
- C:\Windows\System\BulqCMu.exe
  C:\Windows\System\BulqCMu.exe
  2⤵
  PID:664
- C:\Windows\System\mXgXMbr.exe
  C:\Windows\System\mXgXMbr.exe
  2⤵
  PID:1096
- C:\Windows\System\lAMAANE.exe
  C:\Windows\System\lAMAANE.exe
  2⤵
  PID:2332
- C:\Windows\System\TfMBHWF.exe
  C:\Windows\System\TfMBHWF.exe
  2⤵
  PID:2324
- C:\Windows\System\ctkUHZS.exe
  C:\Windows\System\ctkUHZS.exe
  2⤵
  PID:2716
- C:\Windows\System\MLxmBvp.exe
  C:\Windows\System\MLxmBvp.exe
  2⤵
  PID:3036
- C:\Windows\System\WSgzOga.exe
  C:\Windows\System\WSgzOga.exe
  2⤵
  PID:2732
- C:\Windows\System\cJMFMiY.exe
  C:\Windows\System\cJMFMiY.exe
  2⤵
  PID:1860
- C:\Windows\System\zDWelFG.exe
  C:\Windows\System\zDWelFG.exe
  2⤵
  PID:836
- C:\Windows\System\zcIyRpf.exe
  C:\Windows\System\zcIyRpf.exe
  2⤵
  PID:1008
- C:\Windows\System\vYDKBLl.exe
  C:\Windows\System\vYDKBLl.exe
  2⤵
  PID:3056
- C:\Windows\System\QZnAvLM.exe
  C:\Windows\System\QZnAvLM.exe
  2⤵
  PID:2672
- C:\Windows\System\MNXTTgW.exe
  C:\Windows\System\MNXTTgW.exe
  2⤵
  PID:2628
- C:\Windows\System\EYyfaDX.exe
  C:\Windows\System\EYyfaDX.exe
  2⤵
  PID:1992
- C:\Windows\System\JqdBrgY.exe
  C:\Windows\System\JqdBrgY.exe
  2⤵
  PID:1584
- C:\Windows\System\ZffCFdC.exe
  C:\Windows\System\ZffCFdC.exe
  2⤵
  PID:1580
- C:\Windows\System\PByHTcG.exe
  C:\Windows\System\PByHTcG.exe
  2⤵
  PID:2256
- C:\Windows\System\EvLJSuu.exe
  C:\Windows\System\EvLJSuu.exe
  2⤵
  PID:2664
- C:\Windows\System\NHmYzeA.exe
  C:\Windows\System\NHmYzeA.exe
  2⤵
  PID:1140
- C:\Windows\System\NCvRdht.exe
  C:\Windows\System\NCvRdht.exe
  2⤵
  PID:1676
- C:\Windows\System\PdCxenq.exe
  C:\Windows\System\PdCxenq.exe
  2⤵
  PID:488
- C:\Windows\System\GNvrvJd.exe
  C:\Windows\System\GNvrvJd.exe
  2⤵
  PID:3060
- C:\Windows\System\APhaRwJ.exe
  C:\Windows\System\APhaRwJ.exe
  2⤵
  PID:2108
- C:\Windows\System\ENbsssx.exe
  C:\Windows\System\ENbsssx.exe
  2⤵
  PID:2992
- C:\Windows\System\GXhzCZc.exe
  C:\Windows\System\GXhzCZc.exe
  2⤵
  PID:2524
- C:\Windows\System\IUghcAn.exe
  C:\Windows\System\IUghcAn.exe
  2⤵
  PID:1652
- C:\Windows\System\CibUqFG.exe
  C:\Windows\System\CibUqFG.exe
  2⤵
  PID:756
- C:\Windows\System\GtTlqYa.exe
  C:\Windows\System\GtTlqYa.exe
  2⤵
  PID:2564
- C:\Windows\System\wHbBNyP.exe
  C:\Windows\System\wHbBNyP.exe
  2⤵
  PID:2192
- C:\Windows\System\TgKLgvS.exe
  C:\Windows\System\TgKLgvS.exe
  2⤵
  PID:2700
- C:\Windows\System\NeGZPdG.exe
  C:\Windows\System\NeGZPdG.exe
  2⤵
  PID:2904
- C:\Windows\System\uiZRmuy.exe
  C:\Windows\System\uiZRmuy.exe
  2⤵
  PID:2704
- C:\Windows\System\tqkIxeQ.exe
  C:\Windows\System\tqkIxeQ.exe
  2⤵
  PID:3052
- C:\Windows\System\DJQcBDl.exe
  C:\Windows\System\DJQcBDl.exe
  2⤵
  PID:2264
- C:\Windows\System\mZTiuQC.exe
  C:\Windows\System\mZTiuQC.exe
  2⤵
  PID:1520
- C:\Windows\System\ceitpdq.exe
  C:\Windows\System\ceitpdq.exe
  2⤵
  PID:2888
- C:\Windows\System\AnoXZfS.exe
  C:\Windows\System\AnoXZfS.exe
  2⤵
  PID:1748
- C:\Windows\System\uaafZnm.exe
  C:\Windows\System\uaafZnm.exe
  2⤵
  PID:1856
- C:\Windows\System\UWbXemq.exe
  C:\Windows\System\UWbXemq.exe
  2⤵
  PID:3088
- C:\Windows\System\KGQAMaz.exe
  C:\Windows\System\KGQAMaz.exe
  2⤵
  PID:3104
- C:\Windows\System\oooQfWB.exe
  C:\Windows\System\oooQfWB.exe
  2⤵
  PID:3120
- C:\Windows\System\OgPAmSX.exe
  C:\Windows\System\OgPAmSX.exe
  2⤵
  PID:3140
- C:\Windows\System\PZJrzGo.exe
  C:\Windows\System\PZJrzGo.exe
  2⤵
  PID:3156
- C:\Windows\System\wRlqPib.exe
  C:\Windows\System\wRlqPib.exe
  2⤵
  PID:3172
- C:\Windows\System\SCGbzFu.exe
  C:\Windows\System\SCGbzFu.exe
  2⤵
  PID:3188
- C:\Windows\System\ytFKxtP.exe
  C:\Windows\System\ytFKxtP.exe
  2⤵
  PID:3204
- C:\Windows\System\orLTnfK.exe
  C:\Windows\System\orLTnfK.exe
  2⤵
  PID:3220
- C:\Windows\System\JDsnzTk.exe
  C:\Windows\System\JDsnzTk.exe
  2⤵
  PID:3236
- C:\Windows\System\BogjAQx.exe
  C:\Windows\System\BogjAQx.exe
  2⤵
  PID:3252
- C:\Windows\System\rxtNsqk.exe
  C:\Windows\System\rxtNsqk.exe
  2⤵
  PID:3272
- C:\Windows\System\MbibxAL.exe
  C:\Windows\System\MbibxAL.exe
  2⤵
  PID:3288
- C:\Windows\System\uYzfzTm.exe
  C:\Windows\System\uYzfzTm.exe
  2⤵
  PID:3304
- C:\Windows\System\guOkNnx.exe
  C:\Windows\System\guOkNnx.exe
  2⤵
  PID:3324
- C:\Windows\System\eQFtwox.exe
  C:\Windows\System\eQFtwox.exe
  2⤵
  PID:3340
- C:\Windows\System\AYUZHhT.exe
  C:\Windows\System\AYUZHhT.exe
  2⤵
  PID:3356
- C:\Windows\System\RQwXbls.exe
  C:\Windows\System\RQwXbls.exe
  2⤵
  PID:3372
- C:\Windows\System\LspcgJH.exe
  C:\Windows\System\LspcgJH.exe
  2⤵
  PID:3392
- C:\Windows\System\yRUqcAC.exe
  C:\Windows\System\yRUqcAC.exe
  2⤵
  PID:3408
- C:\Windows\System\eGdIwfb.exe
  C:\Windows\System\eGdIwfb.exe
  2⤵
  PID:3424
- C:\Windows\System\KrPNKoi.exe
  C:\Windows\System\KrPNKoi.exe
  2⤵
  PID:3440
- C:\Windows\System\ryicqTJ.exe
  C:\Windows\System\ryicqTJ.exe
  2⤵
  PID:3460
- C:\Windows\System\OOmkYRJ.exe
  C:\Windows\System\OOmkYRJ.exe
  2⤵
  PID:3476
- C:\Windows\System\JMDsYqh.exe
  C:\Windows\System\JMDsYqh.exe
  2⤵
  PID:3492
- C:\Windows\System\rURKVSi.exe
  C:\Windows\System\rURKVSi.exe
  2⤵
  PID:3508
- C:\Windows\System\OJTXEJi.exe
  C:\Windows\System\OJTXEJi.exe
  2⤵
  PID:3528
- C:\Windows\System\WCpLHtw.exe
  C:\Windows\System\WCpLHtw.exe
  2⤵
  PID:3544
- C:\Windows\System\grtheIN.exe
  C:\Windows\System\grtheIN.exe
  2⤵
  PID:3560
- C:\Windows\System\plhLQTY.exe
  C:\Windows\System\plhLQTY.exe
  2⤵
  PID:3576
- C:\Windows\System\lDybuao.exe
  C:\Windows\System\lDybuao.exe
  2⤵
  PID:3596
- C:\Windows\System\fvtdKAM.exe
  C:\Windows\System\fvtdKAM.exe
  2⤵
  PID:3696
- C:\Windows\System\gnXQteQ.exe
  C:\Windows\System\gnXQteQ.exe
  2⤵
  PID:3712
- C:\Windows\System\VZQPZdQ.exe
  C:\Windows\System\VZQPZdQ.exe
  2⤵
  PID:3728
- C:\Windows\System\PGmkHJW.exe
  C:\Windows\System\PGmkHJW.exe
  2⤵
  PID:3744
- C:\Windows\System\CUiDHfb.exe
  C:\Windows\System\CUiDHfb.exe
  2⤵
  PID:3760
- C:\Windows\System\SfGaAMe.exe
  C:\Windows\System\SfGaAMe.exe
  2⤵
  PID:3776
- C:\Windows\System\qzgDhPt.exe
  C:\Windows\System\qzgDhPt.exe
  2⤵
  PID:3796
- C:\Windows\System\SrioGog.exe
  C:\Windows\System\SrioGog.exe
  2⤵
  PID:3812
- C:\Windows\System\kDYQJLQ.exe
  C:\Windows\System\kDYQJLQ.exe
  2⤵
  PID:3932
- C:\Windows\System\QWxSQsV.exe
  C:\Windows\System\QWxSQsV.exe
  2⤵
  PID:3956
- C:\Windows\System\DRdgUJj.exe
  C:\Windows\System\DRdgUJj.exe
  2⤵
  PID:3972
- C:\Windows\System\OzVCjrn.exe
  C:\Windows\System\OzVCjrn.exe
  2⤵
  PID:3992
- C:\Windows\System\ZdmemaS.exe
  C:\Windows\System\ZdmemaS.exe
  2⤵
  PID:4012
- C:\Windows\System\PyikOsk.exe
  C:\Windows\System\PyikOsk.exe
  2⤵
  PID:4028
- C:\Windows\System\SdJaxGm.exe
  C:\Windows\System\SdJaxGm.exe
  2⤵
  PID:4052
- C:\Windows\System\EDtSZyy.exe
  C:\Windows\System\EDtSZyy.exe
  2⤵
  PID:4072
- C:\Windows\System\iaiWtuF.exe
  C:\Windows\System\iaiWtuF.exe
  2⤵
  PID:4092
- C:\Windows\System\Xaogtbz.exe
  C:\Windows\System\Xaogtbz.exe
  2⤵
  PID:2820
- C:\Windows\System\UPASIYm.exe
  C:\Windows\System\UPASIYm.exe
  2⤵
  PID:2184
- C:\Windows\System\sLLlWNq.exe
  C:\Windows\System\sLLlWNq.exe
  2⤵
  PID:1800
- C:\Windows\System\eqRSCuP.exe
  C:\Windows\System\eqRSCuP.exe
  2⤵
  PID:1728
- C:\Windows\System\osANwlt.exe
  C:\Windows\System\osANwlt.exe
  2⤵
  PID:2244
- C:\Windows\System\fxWRUdS.exe
  C:\Windows\System\fxWRUdS.exe
  2⤵
  PID:1420
- C:\Windows\System\SuZuxNE.exe
  C:\Windows\System\SuZuxNE.exe
  2⤵
  PID:3136
- C:\Windows\System\vzALwBb.exe
  C:\Windows\System\vzALwBb.exe
  2⤵
  PID:1356
- C:\Windows\System\AYFaIiG.exe
  C:\Windows\System\AYFaIiG.exe
  2⤵
  PID:3336
- C:\Windows\System\DPRVYwS.exe
  C:\Windows\System\DPRVYwS.exe
  2⤵
  PID:2236
- C:\Windows\System\UaePRNo.exe
  C:\Windows\System\UaePRNo.exe
  2⤵
  PID:3404
- C:\Windows\System\XcuokRb.exe
  C:\Windows\System\XcuokRb.exe
  2⤵
  PID:3500
- C:\Windows\System\buAeoDc.exe
  C:\Windows\System\buAeoDc.exe
  2⤵
  PID:3604
- C:\Windows\System\JMMbhvf.exe
  C:\Windows\System\JMMbhvf.exe
  2⤵
  PID:3616
- C:\Windows\System\NKocZSf.exe
  C:\Windows\System\NKocZSf.exe
  2⤵
  PID:3232
- C:\Windows\System\ViozKhg.exe
  C:\Windows\System\ViozKhg.exe
  2⤵
  PID:3640
- C:\Windows\System\hPwbeQG.exe
  C:\Windows\System\hPwbeQG.exe
  2⤵
  PID:3668
- C:\Windows\System\twgxwJl.exe
  C:\Windows\System\twgxwJl.exe
  2⤵
  PID:3688
- C:\Windows\System\rTtzwrY.exe
  C:\Windows\System\rTtzwrY.exe
  2⤵
  PID:2484
- C:\Windows\System\mSdgiac.exe
  C:\Windows\System\mSdgiac.exe
  2⤵
  PID:3016
- C:\Windows\System\ucSHzVs.exe
  C:\Windows\System\ucSHzVs.exe
  2⤵
  PID:3080
- C:\Windows\System\LdRLqRd.exe
  C:\Windows\System\LdRLqRd.exe
  2⤵
  PID:3148
- C:\Windows\System\lLdQtFE.exe
  C:\Windows\System\lLdQtFE.exe
  2⤵
  PID:3216
- C:\Windows\System\UKDuuQJ.exe
  C:\Windows\System\UKDuuQJ.exe
  2⤵
  PID:3792
- C:\Windows\System\FpfPqub.exe
  C:\Windows\System\FpfPqub.exe
  2⤵
  PID:3504
- C:\Windows\System\TFsTDZf.exe
  C:\Windows\System\TFsTDZf.exe
  2⤵
  PID:3852
- C:\Windows\System\FESQGtD.exe
  C:\Windows\System\FESQGtD.exe
  2⤵
  PID:3880
- C:\Windows\System\DzOqUmD.exe
  C:\Windows\System\DzOqUmD.exe
  2⤵
  PID:3280
- C:\Windows\System\ZsXuPdY.exe
  C:\Windows\System\ZsXuPdY.exe
  2⤵
  PID:3352
- C:\Windows\System\FrroDwm.exe
  C:\Windows\System\FrroDwm.exe
  2⤵
  PID:3420
- C:\Windows\System\YJcilAs.exe
  C:\Windows\System\YJcilAs.exe
  2⤵
  PID:3488
- C:\Windows\System\WtLNreM.exe
  C:\Windows\System\WtLNreM.exe
  2⤵
  PID:3556
- C:\Windows\System\BTYbHxK.exe
  C:\Windows\System\BTYbHxK.exe
  2⤵
  PID:3704
- C:\Windows\System\KQpUBVj.exe
  C:\Windows\System\KQpUBVj.exe
  2⤵
  PID:3772
- C:\Windows\System\BUQOUJk.exe
  C:\Windows\System\BUQOUJk.exe
  2⤵
  PID:3872
- C:\Windows\System\toshoIy.exe
  C:\Windows\System\toshoIy.exe
  2⤵
  PID:2088
- C:\Windows\System\oAIybcN.exe
  C:\Windows\System\oAIybcN.exe
  2⤵
  PID:2756
- C:\Windows\System\JlZCWXy.exe
  C:\Windows\System\JlZCWXy.exe
  2⤵
  PID:1576
- C:\Windows\System\izBzBKL.exe
  C:\Windows\System\izBzBKL.exe
  2⤵
  PID:1744
- C:\Windows\System\YfAHLXz.exe
  C:\Windows\System\YfAHLXz.exe
  2⤵
  PID:3964
- C:\Windows\System\dkVYbNZ.exe
  C:\Windows\System\dkVYbNZ.exe
  2⤵
  PID:3988
- C:\Windows\System\gyMvEuJ.exe
  C:\Windows\System\gyMvEuJ.exe
  2⤵
  PID:3984
- C:\Windows\System\WyEYqfn.exe
  C:\Windows\System\WyEYqfn.exe
  2⤵
  PID:2200
- C:\Windows\System\MBcXfgw.exe
  C:\Windows\System\MBcXfgw.exe
  2⤵
  PID:4036
- C:\Windows\System\SrXADyA.exe
  C:\Windows\System\SrXADyA.exe
  2⤵
  PID:1268
- C:\Windows\System\hywVRdA.exe
  C:\Windows\System\hywVRdA.exe
  2⤵
  PID:4064
- C:\Windows\System\zbUhzjk.exe
  C:\Windows\System\zbUhzjk.exe
  2⤵
  PID:1936
- C:\Windows\System\BHcClYO.exe
  C:\Windows\System\BHcClYO.exe
  2⤵
  PID:2696
- C:\Windows\System\YeWhIgW.exe
  C:\Windows\System\YeWhIgW.exe
  2⤵
  PID:2984
- C:\Windows\System\fdEaIga.exe
  C:\Windows\System\fdEaIga.exe
  2⤵
  PID:2544
- C:\Windows\System\xgFnrXD.exe
  C:\Windows\System\xgFnrXD.exe
  2⤵
  PID:928
- C:\Windows\System\qTrtJWI.exe
  C:\Windows\System\qTrtJWI.exe
  2⤵
  PID:2100
- C:\Windows\System\RyVDhRl.exe
  C:\Windows\System\RyVDhRl.exe
  2⤵
  PID:3260
- C:\Windows\System\Cgrqyhe.exe
  C:\Windows\System\Cgrqyhe.exe
  2⤵
  PID:3296
- C:\Windows\System\jautcHY.exe
  C:\Windows\System\jautcHY.exe
  2⤵
  PID:2224
- C:\Windows\System\ZCjwyFb.exe
  C:\Windows\System\ZCjwyFb.exe
  2⤵
  PID:3436
- C:\Windows\System\qClsxae.exe
  C:\Windows\System\qClsxae.exe
  2⤵
  PID:3572
- C:\Windows\System\BvoBotS.exe
  C:\Windows\System\BvoBotS.exe
  2⤵
  PID:3100
- C:\Windows\System\qhyRrHZ.exe
  C:\Windows\System\qhyRrHZ.exe
  2⤵
  PID:3624
- C:\Windows\System\PfhvKev.exe
  C:\Windows\System\PfhvKev.exe
  2⤵
  PID:3664
- C:\Windows\System\mqetbVv.exe
  C:\Windows\System\mqetbVv.exe
  2⤵
  PID:3684
- C:\Windows\System\USXrpjg.exe
  C:\Windows\System\USXrpjg.exe
  2⤵
  PID:572
- C:\Windows\System\AOeBlMZ.exe
  C:\Windows\System\AOeBlMZ.exe
  2⤵
  PID:1464
- C:\Windows\System\NEqCxmX.exe
  C:\Windows\System\NEqCxmX.exe
  2⤵
  PID:3180
- C:\Windows\System\bJaNFXt.exe
  C:\Windows\System\bJaNFXt.exe
  2⤵
  PID:3784
- C:\Windows\System\TuxTOge.exe
  C:\Windows\System\TuxTOge.exe
  2⤵
  PID:3832
- C:\Windows\System\gGELiOh.exe
  C:\Windows\System\gGELiOh.exe
  2⤵
  PID:3652
- C:\Windows\System\ajdwIqr.exe
  C:\Windows\System\ajdwIqr.exe
  2⤵
  PID:3888
- C:\Windows\System\mjRsZjr.exe
  C:\Windows\System\mjRsZjr.exe
  2⤵
  PID:3312
- C:\Windows\System\GrsYkrb.exe
  C:\Windows\System\GrsYkrb.exe
  2⤵
  PID:3388
- C:\Windows\System\PpMQjLs.exe
  C:\Windows\System\PpMQjLs.exe
  2⤵
  PID:3456
- C:\Windows\System\gTGEdKu.exe
  C:\Windows\System\gTGEdKu.exe
  2⤵
  PID:3588
- C:\Windows\System\pJrANLv.exe
  C:\Windows\System\pJrANLv.exe
  2⤵
  PID:3768
- C:\Windows\System\YJiIgan.exe
  C:\Windows\System\YJiIgan.exe
  2⤵
  PID:1964
- C:\Windows\System\UFmuBVZ.exe
  C:\Windows\System\UFmuBVZ.exe
  2⤵
  PID:3896
- C:\Windows\System\zOqQXpm.exe
  C:\Windows\System\zOqQXpm.exe
  2⤵
  PID:3920
- C:\Windows\System\ntZsnYd.exe
  C:\Windows\System\ntZsnYd.exe
  2⤵
  PID:112
- C:\Windows\System\HsFVmGR.exe
  C:\Windows\System\HsFVmGR.exe
  2⤵
  PID:3040
- C:\Windows\System\erEqPIC.exe
  C:\Windows\System\erEqPIC.exe
  2⤵
  PID:2380
- C:\Windows\System\PLqdeTV.exe
  C:\Windows\System\PLqdeTV.exe
  2⤵
  PID:3300
- C:\Windows\System\gqAkwve.exe
  C:\Windows\System\gqAkwve.exe
  2⤵
  PID:2792
- C:\Windows\System\xcVDaDA.exe
  C:\Windows\System\xcVDaDA.exe
  2⤵
  PID:3316
- C:\Windows\System\MtVasdb.exe
  C:\Windows\System\MtVasdb.exe
  2⤵
  PID:3740
- C:\Windows\System\zDlThEp.exe
  C:\Windows\System\zDlThEp.exe
  2⤵
  PID:2660
- C:\Windows\System\MkruEUy.exe
  C:\Windows\System\MkruEUy.exe
  2⤵
  PID:3952
- C:\Windows\System\kYHscJG.exe
  C:\Windows\System\kYHscJG.exe
  2⤵
  PID:4020
- C:\Windows\System\IwRfOQu.exe
  C:\Windows\System\IwRfOQu.exe
  2⤵
  PID:3612
- C:\Windows\System\akbNemy.exe
  C:\Windows\System\akbNemy.exe
  2⤵
  PID:3724
- C:\Windows\System\DCqmJKV.exe
  C:\Windows\System\DCqmJKV.exe
  2⤵
  PID:1780
- C:\Windows\System\ZcdYUqS.exe
  C:\Windows\System\ZcdYUqS.exe
  2⤵
  PID:4084
- C:\Windows\System\yjnpXkx.exe
  C:\Windows\System\yjnpXkx.exe
  2⤵
  PID:1252
- C:\Windows\System\kYuTEji.exe
  C:\Windows\System\kYuTEji.exe
  2⤵
  PID:1056
- C:\Windows\System\hTcanmE.exe
  C:\Windows\System\hTcanmE.exe
  2⤵
  PID:1852
- C:\Windows\System\GYJJXqa.exe
  C:\Windows\System\GYJJXqa.exe
  2⤵
  PID:2772
- C:\Windows\System\wQueKIG.exe
  C:\Windows\System\wQueKIG.exe
  2⤵
  PID:1988
- C:\Windows\System\dsxykwy.exe
  C:\Windows\System\dsxykwy.exe
  2⤵
  PID:3116
- C:\Windows\System\EZDcDpT.exe
  C:\Windows\System\EZDcDpT.exe
  2⤵
  PID:3200
- C:\Windows\System\TODHCsh.exe
  C:\Windows\System\TODHCsh.exe
  2⤵
  PID:1944
- C:\Windows\System\gqigbSS.exe
  C:\Windows\System\gqigbSS.exe
  2⤵
  PID:2492
- C:\Windows\System\GDHxHev.exe
  C:\Windows\System\GDHxHev.exe
  2⤵
  PID:3484
- C:\Windows\System\hbUuMUj.exe
  C:\Windows\System\hbUuMUj.exe
  2⤵
  PID:3828
- C:\Windows\System\xlmTQYo.exe
  C:\Windows\System\xlmTQYo.exe
  2⤵
  PID:3332
- C:\Windows\System\RZsNKjY.exe
  C:\Windows\System\RZsNKjY.exe
  2⤵
  PID:3032
- C:\Windows\System\quvgXcj.exe
  C:\Windows\System\quvgXcj.exe
  2⤵
  PID:1412
- C:\Windows\System\fLrjGRi.exe
  C:\Windows\System\fLrjGRi.exe
  2⤵
  PID:1604
- C:\Windows\System\sQnmctK.exe
  C:\Windows\System\sQnmctK.exe
  2⤵
  PID:3468
- C:\Windows\System\WzLlYFY.exe
  C:\Windows\System\WzLlYFY.exe
  2⤵
  PID:3916
- C:\Windows\System\suFHFMW.exe
  C:\Windows\System\suFHFMW.exe
  2⤵
  PID:352
- C:\Windows\System\gEtJJDy.exe
  C:\Windows\System\gEtJJDy.exe
  2⤵
  PID:4060
- C:\Windows\System\juWHNBY.exe
  C:\Windows\System\juWHNBY.exe
  2⤵
  PID:3980
- C:\Windows\System\cUmUWrO.exe
  C:\Windows\System\cUmUWrO.exe
  2⤵
  PID:2420
- C:\Windows\System\TihZpDG.exe
  C:\Windows\System\TihZpDG.exe
  2⤵
  PID:2568
- C:\Windows\System\Styibkw.exe
  C:\Windows\System\Styibkw.exe
  2⤵
  PID:2464
- C:\Windows\System\jfpoRyf.exe
  C:\Windows\System\jfpoRyf.exe
  2⤵
  PID:2924
- C:\Windows\System\YZamjNF.exe
  C:\Windows\System\YZamjNF.exe
  2⤵
  PID:4100
- C:\Windows\System\dNLrerm.exe
  C:\Windows\System\dNLrerm.exe
  2⤵
  PID:4120
- C:\Windows\System\wShbwtv.exe
  C:\Windows\System\wShbwtv.exe
  2⤵
  PID:4136
- C:\Windows\System\wkRpGcF.exe
  C:\Windows\System\wkRpGcF.exe
  2⤵
  PID:4156
- C:\Windows\System\YaHjTKW.exe
  C:\Windows\System\YaHjTKW.exe
  2⤵
  PID:4172
- C:\Windows\System\pjPlMXR.exe
  C:\Windows\System\pjPlMXR.exe
  2⤵
  PID:4188
- C:\Windows\System\hMvGFkA.exe
  C:\Windows\System\hMvGFkA.exe
  2⤵
  PID:4204
- C:\Windows\System\nzDAGAE.exe
  C:\Windows\System\nzDAGAE.exe
  2⤵
  PID:4220
- C:\Windows\System\pJWsrQL.exe
  C:\Windows\System\pJWsrQL.exe
  2⤵
  PID:4240
- C:\Windows\System\rfmkCkl.exe
  C:\Windows\System\rfmkCkl.exe
  2⤵
  PID:4256
- C:\Windows\System\QcYVyhQ.exe
  C:\Windows\System\QcYVyhQ.exe
  2⤵
  PID:4272
- C:\Windows\System\wnCwAyL.exe
  C:\Windows\System\wnCwAyL.exe
  2⤵
  PID:4304
- C:\Windows\System\sXOabum.exe
  C:\Windows\System\sXOabum.exe
  2⤵
  PID:4384
- C:\Windows\System\cUPZbNM.exe
  C:\Windows\System\cUPZbNM.exe
  2⤵
  PID:4400
- C:\Windows\System\BPzzdzQ.exe
  C:\Windows\System\BPzzdzQ.exe
  2⤵
  PID:4416
- C:\Windows\System\GCbdxKJ.exe
  C:\Windows\System\GCbdxKJ.exe
  2⤵
  PID:4432
- C:\Windows\System\WgvdpEp.exe
  C:\Windows\System\WgvdpEp.exe
  2⤵
  PID:4448
- C:\Windows\System\gDXZKeY.exe
  C:\Windows\System\gDXZKeY.exe
  2⤵
  PID:4472
- C:\Windows\System\rzbtLZE.exe
  C:\Windows\System\rzbtLZE.exe
  2⤵
  PID:4488
- C:\Windows\System\DaArdOk.exe
  C:\Windows\System\DaArdOk.exe
  2⤵
  PID:4504
- C:\Windows\System\AKwNPwm.exe
  C:\Windows\System\AKwNPwm.exe
  2⤵
  PID:4520
- C:\Windows\System\HUlkEnw.exe
  C:\Windows\System\HUlkEnw.exe
  2⤵
  PID:4540
- C:\Windows\System\PhACJWs.exe
  C:\Windows\System\PhACJWs.exe
  2⤵
  PID:4560
- C:\Windows\System\hIfEFvM.exe
  C:\Windows\System\hIfEFvM.exe
  2⤵
  PID:4576
- C:\Windows\System\uQEJkvD.exe
  C:\Windows\System\uQEJkvD.exe
  2⤵
  PID:4620
- C:\Windows\System\SzNwZCe.exe
  C:\Windows\System\SzNwZCe.exe
  2⤵
  PID:4640
- C:\Windows\System\LEUVERM.exe
  C:\Windows\System\LEUVERM.exe
  2⤵
  PID:4660
- C:\Windows\System\EoYbCSU.exe
  C:\Windows\System\EoYbCSU.exe
  2⤵
  PID:4676
- C:\Windows\System\bktXmeE.exe
  C:\Windows\System\bktXmeE.exe
  2⤵
  PID:4692
- C:\Windows\System\JaxyTwF.exe
  C:\Windows\System\JaxyTwF.exe
  2⤵
  PID:4708
- C:\Windows\System\cwyVvXf.exe
  C:\Windows\System\cwyVvXf.exe
  2⤵
  PID:4724
- C:\Windows\System\LcqMasP.exe
  C:\Windows\System\LcqMasP.exe
  2⤵
  PID:4748
- C:\Windows\System\eWkhwQH.exe
  C:\Windows\System\eWkhwQH.exe
  2⤵
  PID:4764
- C:\Windows\System\GbQXoHn.exe
  C:\Windows\System\GbQXoHn.exe
  2⤵
  PID:4780
- C:\Windows\System\PVCXkBs.exe
  C:\Windows\System\PVCXkBs.exe
  2⤵
  PID:4800
- C:\Windows\System\KaMZfOJ.exe
  C:\Windows\System\KaMZfOJ.exe
  2⤵
  PID:4820
- C:\Windows\System\rracEye.exe
  C:\Windows\System\rracEye.exe
  2⤵
  PID:4836
- C:\Windows\System\EYDprPl.exe
  C:\Windows\System\EYDprPl.exe
  2⤵
  PID:4856
- C:\Windows\System\PuDCnHX.exe
  C:\Windows\System\PuDCnHX.exe
  2⤵
  PID:4872
- C:\Windows\System\qULgSDj.exe
  C:\Windows\System\qULgSDj.exe
  2⤵
  PID:4888
- C:\Windows\System\lprrpTQ.exe
  C:\Windows\System\lprrpTQ.exe
  2⤵
  PID:4912
- C:\Windows\System\HwBkUZC.exe
  C:\Windows\System\HwBkUZC.exe
  2⤵
  PID:4928
- C:\Windows\System\lbZhAOv.exe
  C:\Windows\System\lbZhAOv.exe
  2⤵
  PID:4944
- C:\Windows\System\tYKuqqL.exe
  C:\Windows\System\tYKuqqL.exe
  2⤵
  PID:4964
- C:\Windows\System\DBJYpDu.exe
  C:\Windows\System\DBJYpDu.exe
  2⤵
  PID:4980
- C:\Windows\System\MccOXJq.exe
  C:\Windows\System\MccOXJq.exe
  2⤵
  PID:4996
- C:\Windows\System\pmVnSag.exe
  C:\Windows\System\pmVnSag.exe
  2⤵
  PID:5016
- C:\Windows\System\AhhdwiN.exe
  C:\Windows\System\AhhdwiN.exe
  2⤵
  PID:5036
- C:\Windows\System\oYGOypM.exe
  C:\Windows\System\oYGOypM.exe
  2⤵
  PID:5052
- C:\Windows\System\ElhVfBo.exe
  C:\Windows\System\ElhVfBo.exe
  2⤵
  PID:5068
- C:\Windows\System\qEwNLDG.exe
  C:\Windows\System\qEwNLDG.exe
  2⤵
  PID:5084
- C:\Windows\System\ixWISBp.exe
  C:\Windows\System\ixWISBp.exe
  2⤵
  PID:5100
- C:\Windows\System\Ygkhwco.exe
  C:\Windows\System\Ygkhwco.exe
  2⤵
  PID:2620
- C:\Windows\System\cOSbsrm.exe
  C:\Windows\System\cOSbsrm.exe
  2⤵
  PID:2388
- C:\Windows\System\eFyPkbn.exe
  C:\Windows\System\eFyPkbn.exe
  2⤵
  PID:4108
- C:\Windows\System\FsmQyvC.exe
  C:\Windows\System\FsmQyvC.exe
  2⤵
  PID:4112
- C:\Windows\System\pvFrFpe.exe
  C:\Windows\System\pvFrFpe.exe
  2⤵
  PID:4296
- C:\Windows\System\hjpzcqQ.exe
  C:\Windows\System\hjpzcqQ.exe
  2⤵
  PID:2520
- C:\Windows\System\WWnEJHG.exe
  C:\Windows\System\WWnEJHG.exe
  2⤵
  PID:4284
- C:\Windows\System\CNXBtJt.exe
  C:\Windows\System\CNXBtJt.exe
  2⤵
  PID:2428
- C:\Windows\System\UqZOyBj.exe
  C:\Windows\System\UqZOyBj.exe
  2⤵
  PID:4228
- C:\Windows\System\lpmjnKN.exe
  C:\Windows\System\lpmjnKN.exe
  2⤵
  PID:4144
- C:\Windows\System\lPWrxlD.exe
  C:\Windows\System\lPWrxlD.exe
  2⤵
  PID:4252
- C:\Windows\System\oivMAbb.exe
  C:\Windows\System\oivMAbb.exe
  2⤵
  PID:4264
- C:\Windows\System\lavKfhH.exe
  C:\Windows\System\lavKfhH.exe
  2⤵
  PID:4328
- C:\Windows\System\AHlETwF.exe
  C:\Windows\System\AHlETwF.exe
  2⤵
  PID:4344
- C:\Windows\System\hQKRIgw.exe
  C:\Windows\System\hQKRIgw.exe
  2⤵
  PID:4364
- C:\Windows\System\TUJRCAL.exe
  C:\Windows\System\TUJRCAL.exe
  2⤵
  PID:4380
- C:\Windows\System\NgsfsfI.exe
  C:\Windows\System\NgsfsfI.exe
  2⤵
  PID:4424
- C:\Windows\System\MtPJYzi.exe
  C:\Windows\System\MtPJYzi.exe
  2⤵
  PID:4468
- C:\Windows\System\BCDIFYS.exe
  C:\Windows\System\BCDIFYS.exe
  2⤵
  PID:4408
- C:\Windows\System\kETtRmM.exe
  C:\Windows\System\kETtRmM.exe
  2⤵
  PID:4536
- C:\Windows\System\lBJsaKq.exe
  C:\Windows\System\lBJsaKq.exe
  2⤵
  PID:4572
- C:\Windows\System\lbGZVab.exe
  C:\Windows\System\lbGZVab.exe
  2⤵
  PID:4584
- C:\Windows\System\NeVjekI.exe
  C:\Windows\System\NeVjekI.exe
  2⤵
  PID:4700
- C:\Windows\System\NDllDWq.exe
  C:\Windows\System\NDllDWq.exe
  2⤵
  PID:4852
- C:\Windows\System\fQApLeq.exe
  C:\Windows\System\fQApLeq.exe
  2⤵
  PID:4760
- C:\Windows\System\LgIGDjU.exe
  C:\Windows\System\LgIGDjU.exe
  2⤵
  PID:4832
- C:\Windows\System\xjyyoqT.exe
  C:\Windows\System\xjyyoqT.exe
  2⤵
  PID:4952
- C:\Windows\System\UjOiesT.exe
  C:\Windows\System\UjOiesT.exe
  2⤵
  PID:4920
- C:\Windows\System\qFBDYnp.exe
  C:\Windows\System\qFBDYnp.exe
  2⤵
  PID:4904
- C:\Windows\System\HjoXyMe.exe
  C:\Windows\System\HjoXyMe.exe
  2⤵
  PID:4972
- C:\Windows\System\sjOlyKv.exe
  C:\Windows\System\sjOlyKv.exe
  2⤵
  PID:2488
- C:\Windows\System\WbfDxuK.exe
  C:\Windows\System\WbfDxuK.exe
  2⤵
  PID:4164
- C:\Windows\System\ZLscIIn.exe
  C:\Windows\System\ZLscIIn.exe
  2⤵
  PID:4116
- C:\Windows\System\HuZyQqw.exe
  C:\Windows\System\HuZyQqw.exe
  2⤵
  PID:796
- C:\Windows\System\nRffFON.exe
  C:\Windows\System\nRffFON.exe
  2⤵
  PID:4528
- C:\Windows\System\FIlewmj.exe
  C:\Windows\System\FIlewmj.exe
  2⤵
  PID:5080
- C:\Windows\System\JFapblB.exe
  C:\Windows\System\JFapblB.exe
  2⤵
  PID:4088
- C:\Windows\System\aDawkgL.exe
  C:\Windows\System\aDawkgL.exe
  2⤵
  PID:3168
- C:\Windows\System\GlnzztV.exe
  C:\Windows\System\GlnzztV.exe
  2⤵
  PID:4232
- C:\Windows\System\pPShqnn.exe
  C:\Windows\System\pPShqnn.exe
  2⤵
  PID:4352
- C:\Windows\System\rXvCsah.exe
  C:\Windows\System\rXvCsah.exe
  2⤵
  PID:4500
- C:\Windows\System\PSowykT.exe
  C:\Windows\System\PSowykT.exe
  2⤵
  PID:4608
- C:\Windows\System\mWTOtsd.exe
  C:\Windows\System\mWTOtsd.exe
  2⤵
  PID:4600
- C:\Windows\System\eawnvtY.exe
  C:\Windows\System\eawnvtY.exe
  2⤵
  PID:4632
- C:\Windows\System\iKGccMk.exe
  C:\Windows\System\iKGccMk.exe
  2⤵
  PID:4732
- C:\Windows\System\vOSTzfC.exe
  C:\Windows\System\vOSTzfC.exe
  2⤵
  PID:4656
- C:\Windows\System\sflRhOb.exe
  C:\Windows\System\sflRhOb.exe
  2⤵
  PID:4460
- C:\Windows\System\iiAHVlw.exe
  C:\Windows\System\iiAHVlw.exe
  2⤵
  PID:4440
- C:\Windows\System\GLQnHTg.exe
  C:\Windows\System\GLQnHTg.exe
  2⤵
  PID:4376
- C:\Windows\System\xogMerb.exe
  C:\Windows\System\xogMerb.exe
  2⤵
  PID:4812
- C:\Windows\System\oZLeJxC.exe
  C:\Windows\System\oZLeJxC.exe
  2⤵
  PID:4720
- C:\Windows\System\TmBKjqf.exe
  C:\Windows\System\TmBKjqf.exe
  2⤵
  PID:4688
- C:\Windows\System\KGpYKYz.exe
  C:\Windows\System\KGpYKYz.exe
  2⤵
  PID:4828
- C:\Windows\System\nrKZzAb.exe
  C:\Windows\System\nrKZzAb.exe
  2⤵
  PID:5012
- C:\Windows\System\BEEaDAU.exe
  C:\Windows\System\BEEaDAU.exe
  2⤵
  PID:3736
- C:\Windows\System\hEyHUSI.exe
  C:\Windows\System\hEyHUSI.exe
  2⤵
  PID:5008
- C:\Windows\System\LjdBexJ.exe
  C:\Windows\System\LjdBexJ.exe
  2⤵
  PID:4236
- C:\Windows\System\OpvVfFp.exe
  C:\Windows\System\OpvVfFp.exe
  2⤵
  PID:4556
- C:\Windows\System\juadldK.exe
  C:\Windows\System\juadldK.exe
  2⤵
  PID:4672
- C:\Windows\System\EhcAwkw.exe
  C:\Windows\System\EhcAwkw.exe
  2⤵
  PID:4740
- C:\Windows\System\GZiYZJG.exe
  C:\Windows\System\GZiYZJG.exe
  2⤵
  PID:4716
- C:\Windows\System\QlhxtmC.exe
  C:\Windows\System\QlhxtmC.exe
  2⤵
  PID:4324
- C:\Windows\System\rxtRbFl.exe
  C:\Windows\System\rxtRbFl.exe
  2⤵
  PID:4652
- C:\Windows\System\GrkuMwf.exe
  C:\Windows\System\GrkuMwf.exe
  2⤵
  PID:4484
- C:\Windows\System\OEZuoYG.exe
  C:\Windows\System\OEZuoYG.exe
  2⤵
  PID:4628
- C:\Windows\System\hmGcvyg.exe
  C:\Windows\System\hmGcvyg.exe
  2⤵
  PID:3876
- C:\Windows\System\jGRTpJZ.exe
  C:\Windows\System\jGRTpJZ.exe
  2⤵
  PID:4212
- C:\Windows\System\BsPwWMc.exe
  C:\Windows\System\BsPwWMc.exe
  2⤵
  PID:4736
- C:\Windows\System\BSqcSuE.exe
  C:\Windows\System\BSqcSuE.exe
  2⤵
  PID:4796
- C:\Windows\System\kjUfGAH.exe
  C:\Windows\System\kjUfGAH.exe
  2⤵
  PID:5060
- C:\Windows\System\EpjJuXl.exe
  C:\Windows\System\EpjJuXl.exe
  2⤵
  PID:4396
- C:\Windows\System\nYKQJDD.exe
  C:\Windows\System\nYKQJDD.exe
  2⤵
  PID:4616
- C:\Windows\System\geFKgDD.exe
  C:\Windows\System\geFKgDD.exe
  2⤵
  PID:4684
- C:\Windows\System\uBHabDn.exe
  C:\Windows\System\uBHabDn.exe
  2⤵
  PID:5136
- C:\Windows\System\lkkkPXj.exe
  C:\Windows\System\lkkkPXj.exe
  2⤵
  PID:5152
- C:\Windows\System\wudusHK.exe
  C:\Windows\System\wudusHK.exe
  2⤵
  PID:5168
- C:\Windows\System\ERhJPuG.exe
  C:\Windows\System\ERhJPuG.exe
  2⤵
  PID:5184
- C:\Windows\System\GTmucDI.exe
  C:\Windows\System\GTmucDI.exe
  2⤵
  PID:5200
- C:\Windows\System\TXTxWqX.exe
  C:\Windows\System\TXTxWqX.exe
  2⤵
  PID:5216
- C:\Windows\System\DqwwWlf.exe
  C:\Windows\System\DqwwWlf.exe
  2⤵
  PID:5232
- C:\Windows\System\hilpWoE.exe
  C:\Windows\System\hilpWoE.exe
  2⤵
  PID:5248
- C:\Windows\System\DZMKtTV.exe
  C:\Windows\System\DZMKtTV.exe
  2⤵
  PID:5264
- C:\Windows\System\gfmWVgW.exe
  C:\Windows\System\gfmWVgW.exe
  2⤵
  PID:5280
- C:\Windows\System\RyQMKPn.exe
  C:\Windows\System\RyQMKPn.exe
  2⤵
  PID:5296
- C:\Windows\System\iIqLtVu.exe
  C:\Windows\System\iIqLtVu.exe
  2⤵
  PID:5316
- C:\Windows\System\wlQCIuK.exe
  C:\Windows\System\wlQCIuK.exe
  2⤵
  PID:5332
- C:\Windows\System\rSIDriL.exe
  C:\Windows\System\rSIDriL.exe
  2⤵
  PID:5348
- C:\Windows\System\kyGaqqC.exe
  C:\Windows\System\kyGaqqC.exe
  2⤵
  PID:5364
- C:\Windows\System\emeLkOh.exe
  C:\Windows\System\emeLkOh.exe
  2⤵
  PID:5380
- C:\Windows\System\lOuZYRi.exe
  C:\Windows\System\lOuZYRi.exe
  2⤵
  PID:5396
- C:\Windows\System\qvUUDBX.exe
  C:\Windows\System\qvUUDBX.exe
  2⤵
  PID:5416
- C:\Windows\System\mRpIlZn.exe
  C:\Windows\System\mRpIlZn.exe
  2⤵
  PID:5432
- C:\Windows\System\PyFdefy.exe
  C:\Windows\System\PyFdefy.exe
  2⤵
  PID:5448
- C:\Windows\System\XpcNTTw.exe
  C:\Windows\System\XpcNTTw.exe
  2⤵
  PID:5468
- C:\Windows\System\QRZCfyk.exe
  C:\Windows\System\QRZCfyk.exe
  2⤵
  PID:5484
- C:\Windows\System\SrxiNbZ.exe
  C:\Windows\System\SrxiNbZ.exe
  2⤵
  PID:5504
- C:\Windows\System\hytBOvm.exe
  C:\Windows\System\hytBOvm.exe
  2⤵
  PID:5524
- C:\Windows\System\OmFrKRT.exe
  C:\Windows\System\OmFrKRT.exe
  2⤵
  PID:5540
- C:\Windows\System\ZzFhMfw.exe
  C:\Windows\System\ZzFhMfw.exe
  2⤵
  PID:5556
- C:\Windows\System\BloLMtt.exe
  C:\Windows\System\BloLMtt.exe
  2⤵
  PID:5576
- C:\Windows\System\ixekShk.exe
  C:\Windows\System\ixekShk.exe
  2⤵
  PID:5592
- C:\Windows\System\wvOcVLc.exe
  C:\Windows\System\wvOcVLc.exe
  2⤵
  PID:5608
- C:\Windows\System\KrLLnUu.exe
  C:\Windows\System\KrLLnUu.exe
  2⤵
  PID:5624
- C:\Windows\System\lFXohBX.exe
  C:\Windows\System\lFXohBX.exe
  2⤵
  PID:5640
- C:\Windows\System\nvZjqVw.exe
  C:\Windows\System\nvZjqVw.exe
  2⤵
  PID:5656
- C:\Windows\System\wHYlqXw.exe
  C:\Windows\System\wHYlqXw.exe
  2⤵
  PID:5676
- C:\Windows\System\unaQHnf.exe
  C:\Windows\System\unaQHnf.exe
  2⤵
  PID:5692
- C:\Windows\System\nAaRmYc.exe
  C:\Windows\System\nAaRmYc.exe
  2⤵
  PID:5708
- C:\Windows\System\vhqogix.exe
  C:\Windows\System\vhqogix.exe
  2⤵
  PID:5724
- C:\Windows\System\NsmbKQd.exe
  C:\Windows\System\NsmbKQd.exe
  2⤵
  PID:5740
- C:\Windows\System\GHIqnFq.exe
  C:\Windows\System\GHIqnFq.exe
  2⤵
  PID:5756
- C:\Windows\System\HPGcaEo.exe
  C:\Windows\System\HPGcaEo.exe
  2⤵
  PID:5776
- C:\Windows\System\AxihEjh.exe
  C:\Windows\System\AxihEjh.exe
  2⤵
  PID:5792
- C:\Windows\System\CapcaPH.exe
  C:\Windows\System\CapcaPH.exe
  2⤵
  PID:5808
- C:\Windows\System\nrxSqNt.exe
  C:\Windows\System\nrxSqNt.exe
  2⤵
  PID:5824
- C:\Windows\System\wczXgpp.exe
  C:\Windows\System\wczXgpp.exe
  2⤵
  PID:5840
- C:\Windows\System\ZiRuOST.exe
  C:\Windows\System\ZiRuOST.exe
  2⤵
  PID:5860
- C:\Windows\System\ZpePBVQ.exe
  C:\Windows\System\ZpePBVQ.exe
  2⤵
  PID:5876
- C:\Windows\System\QDuhTOI.exe
  C:\Windows\System\QDuhTOI.exe
  2⤵
  PID:5892
- C:\Windows\System\HDclbvG.exe
  C:\Windows\System\HDclbvG.exe
  2⤵
  PID:5908
- C:\Windows\System\VKlPQuz.exe
  C:\Windows\System\VKlPQuz.exe
  2⤵
  PID:5924
- C:\Windows\System\objJFjP.exe
  C:\Windows\System\objJFjP.exe
  2⤵
  PID:5940
- C:\Windows\System\AWRjkFY.exe
  C:\Windows\System\AWRjkFY.exe
  2⤵
  PID:5956
- C:\Windows\System\UWQuBMx.exe
  C:\Windows\System\UWQuBMx.exe
  2⤵
  PID:5976
- C:\Windows\System\qZDSbZC.exe
  C:\Windows\System\qZDSbZC.exe
  2⤵
  PID:5996
- C:\Windows\System\tNMREbY.exe
  C:\Windows\System\tNMREbY.exe
  2⤵
  PID:6012
- C:\Windows\System\DUzoxHu.exe
  C:\Windows\System\DUzoxHu.exe
  2⤵
  PID:6028
- C:\Windows\System\uJtIuEm.exe
  C:\Windows\System\uJtIuEm.exe
  2⤵
  PID:6048
- C:\Windows\System\MqyWCuT.exe
  C:\Windows\System\MqyWCuT.exe
  2⤵
  PID:6064
- C:\Windows\System\CNqPsog.exe
  C:\Windows\System\CNqPsog.exe
  2⤵
  PID:6080
- C:\Windows\System\peKbrpU.exe
  C:\Windows\System\peKbrpU.exe
  2⤵
  PID:6096
- C:\Windows\System\MeItHRN.exe
  C:\Windows\System\MeItHRN.exe
  2⤵
  PID:6116
- C:\Windows\System\HgpWOED.exe
  C:\Windows\System\HgpWOED.exe
  2⤵
  PID:6132
- C:\Windows\System\FaBPbkS.exe
  C:\Windows\System\FaBPbkS.exe
  2⤵
  PID:2892
- C:\Windows\System\ZerdZZb.exe
  C:\Windows\System\ZerdZZb.exe
  2⤵
  PID:5004
- C:\Windows\System\dNgGUKJ.exe
  C:\Windows\System\dNgGUKJ.exe
  2⤵
  PID:5128
- C:\Windows\System\wemEzEG.exe
  C:\Windows\System\wemEzEG.exe
  2⤵
  PID:4552
- C:\Windows\System\bKucgID.exe
  C:\Windows\System\bKucgID.exe
  2⤵
  PID:5144
- C:\Windows\System\EZJVgaw.exe
  C:\Windows\System\EZJVgaw.exe
  2⤵
  PID:5212
- C:\Windows\System\AMzmaez.exe
  C:\Windows\System\AMzmaez.exe
  2⤵
  PID:5276
- C:\Windows\System\wcjkagR.exe
  C:\Windows\System\wcjkagR.exe
  2⤵
  PID:5340
- C:\Windows\System\grlIYyX.exe
  C:\Windows\System\grlIYyX.exe
  2⤵
  PID:5404
- C:\Windows\System\MzJbxfc.exe
  C:\Windows\System\MzJbxfc.exe
  2⤵
  PID:5224
- C:\Windows\System\WQeoqjr.exe
  C:\Windows\System\WQeoqjr.exe
  2⤵
  PID:5568
- C:\Windows\System\ZCEOCPS.exe
  C:\Windows\System\ZCEOCPS.exe
  2⤵
  PID:5500
- C:\Windows\System\eRqKZOL.exe
  C:\Windows\System\eRqKZOL.exe
  2⤵
  PID:5460
- C:\Windows\System\cvUgECp.exe
  C:\Windows\System\cvUgECp.exe
  2⤵
  PID:5388
- C:\Windows\System\VlBxFUZ.exe
  C:\Windows\System\VlBxFUZ.exe
  2⤵
  PID:5324
- C:\Windows\System\Jdmznmq.exe
  C:\Windows\System\Jdmznmq.exe
  2⤵
  PID:5604
- C:\Windows\System\pLNDGXZ.exe
  C:\Windows\System\pLNDGXZ.exe
  2⤵
  PID:5668
- C:\Windows\System\QXfRTsY.exe
  C:\Windows\System\QXfRTsY.exe
  2⤵
  PID:5732
- C:\Windows\System\RZmwgYi.exe
  C:\Windows\System\RZmwgYi.exe
  2⤵
  PID:5768
- C:\Windows\System\pWAardG.exe
  C:\Windows\System\pWAardG.exe
  2⤵
  PID:5132
- C:\Windows\System\XAcXCBj.exe
  C:\Windows\System\XAcXCBj.exe
  2⤵
  PID:5868
- C:\Windows\System\ViYGdhU.exe
  C:\Windows\System\ViYGdhU.exe
  2⤵
  PID:5856
- C:\Windows\System\AhlJZxi.exe
  C:\Windows\System\AhlJZxi.exe
  2⤵
  PID:5476
- C:\Windows\System\FJIQYYU.exe
  C:\Windows\System\FJIQYYU.exe
  2⤵
  PID:5520
- C:\Windows\System\yeCLDfn.exe
  C:\Windows\System\yeCLDfn.exe
  2⤵
  PID:5588
- C:\Windows\System\ElRielt.exe
  C:\Windows\System\ElRielt.exe
  2⤵
  PID:5684
- C:\Windows\System\oeRGMuQ.exe
  C:\Windows\System\oeRGMuQ.exe
  2⤵
  PID:5748
- C:\Windows\System\BazIPmN.exe
  C:\Windows\System\BazIPmN.exe
  2⤵
  PID:5816
- C:\Windows\System\saFhWCc.exe
  C:\Windows\System\saFhWCc.exe
  2⤵
  PID:5884
- C:\Windows\System\YxxsUxX.exe
  C:\Windows\System\YxxsUxX.exe
  2⤵
  PID:5948
- C:\Windows\System\kgvuKLx.exe
  C:\Windows\System\kgvuKLx.exe
  2⤵
  PID:5992
- C:\Windows\System\ZhkYkVP.exe
  C:\Windows\System\ZhkYkVP.exe
  2⤵
  PID:6060
- C:\Windows\System\XRtsDjd.exe
  C:\Windows\System\XRtsDjd.exe
  2⤵
  PID:6140
- C:\Windows\System\EmXuUWx.exe
  C:\Windows\System\EmXuUWx.exe
  2⤵
  PID:6128
- C:\Windows\System\mSaalQE.exe
  C:\Windows\System\mSaalQE.exe
  2⤵
  PID:4372
- C:\Windows\System\XPgWzAV.exe
  C:\Windows\System\XPgWzAV.exe
  2⤵
  PID:4008
- C:\Windows\System\JRIsRaY.exe
  C:\Windows\System\JRIsRaY.exe
  2⤵
  PID:3380
- C:\Windows\System\TqkNcmC.exe
  C:\Windows\System\TqkNcmC.exe
  2⤵
  PID:5160
- C:\Windows\System\dItwnjK.exe
  C:\Windows\System\dItwnjK.exe
  2⤵
  PID:4864
- C:\Windows\System\azkTagX.exe
  C:\Windows\System\azkTagX.exe
  2⤵
  PID:5664
- C:\Windows\System\pFRLkyh.exe
  C:\Windows\System\pFRLkyh.exe
  2⤵
  PID:5392
- C:\Windows\System\DvwOkAL.exe
  C:\Windows\System\DvwOkAL.exe
  2⤵
  PID:5536
- C:\Windows\System\SKfOQJs.exe
  C:\Windows\System\SKfOQJs.exe
  2⤵
  PID:5256
- C:\Windows\System\evYUfyR.exe
  C:\Windows\System\evYUfyR.exe
  2⤵
  PID:5260
- C:\Windows\System\ntvToND.exe
  C:\Windows\System\ntvToND.exe
  2⤵
  PID:5164
- C:\Windows\System\IpnODpy.exe
  C:\Windows\System\IpnODpy.exe
  2⤵
  PID:5972
- C:\Windows\System\cgrdsHu.exe
  C:\Windows\System\cgrdsHu.exe
  2⤵
  PID:6040
- C:\Windows\System\ptEEqJP.exe
  C:\Windows\System\ptEEqJP.exe
  2⤵
  PID:1640
- C:\Windows\System\VfMsMGm.exe
  C:\Windows\System\VfMsMGm.exe
  2⤵
  PID:6148
- C:\Windows\System\iSSqufv.exe
  C:\Windows\System\iSSqufv.exe
  2⤵
  PID:6168
- C:\Windows\System\XZRyJqJ.exe
  C:\Windows\System\XZRyJqJ.exe
  2⤵
  PID:6184
- C:\Windows\System\kWSoLeI.exe
  C:\Windows\System\kWSoLeI.exe
  2⤵
  PID:6200
- C:\Windows\System\mKYnQiz.exe
  C:\Windows\System\mKYnQiz.exe
  2⤵
  PID:6216
- C:\Windows\System\BwSVuyX.exe
  C:\Windows\System\BwSVuyX.exe
  2⤵
  PID:6232
- C:\Windows\System\rwseMjJ.exe
  C:\Windows\System\rwseMjJ.exe
  2⤵
  PID:6252
- C:\Windows\System\QkAFlTV.exe
  C:\Windows\System\QkAFlTV.exe
  2⤵
  PID:6268
- C:\Windows\System\IwtxaVv.exe
  C:\Windows\System\IwtxaVv.exe
  2⤵
  PID:6284
- C:\Windows\System\jMNMRTK.exe
  C:\Windows\System\jMNMRTK.exe
  2⤵
  PID:6304
- C:\Windows\System\tOdFvpS.exe
  C:\Windows\System\tOdFvpS.exe
  2⤵
  PID:6320
- C:\Windows\System\eMLgNAv.exe
  C:\Windows\System\eMLgNAv.exe
  2⤵
  PID:6336
- C:\Windows\System\mcnwyif.exe
  C:\Windows\System\mcnwyif.exe
  2⤵
  PID:6352
- C:\Windows\System\dNijvFf.exe
  C:\Windows\System\dNijvFf.exe
  2⤵
  PID:6368
- C:\Windows\System\DlBRqFh.exe
  C:\Windows\System\DlBRqFh.exe
  2⤵
  PID:6388
- C:\Windows\System\ixbcLkn.exe
  C:\Windows\System\ixbcLkn.exe
  2⤵
  PID:6404
- C:\Windows\System\vUagstK.exe
  C:\Windows\System\vUagstK.exe
  2⤵
  PID:6420
- C:\Windows\System\tcbbFDL.exe
  C:\Windows\System\tcbbFDL.exe
  2⤵
  PID:6440
- C:\Windows\System\pWlkXdQ.exe
  C:\Windows\System\pWlkXdQ.exe
  2⤵
  PID:6456
- C:\Windows\System\DjrYYQj.exe
  C:\Windows\System\DjrYYQj.exe
  2⤵
  PID:6476
- C:\Windows\System\QlMIHQq.exe
  C:\Windows\System\QlMIHQq.exe
  2⤵
  PID:6496
- C:\Windows\System\UYELdSV.exe
  C:\Windows\System\UYELdSV.exe
  2⤵
  PID:6512
- C:\Windows\System\HCHJtMX.exe
  C:\Windows\System\HCHJtMX.exe
  2⤵
  PID:6536
- C:\Windows\System\iWLoZvV.exe
  C:\Windows\System\iWLoZvV.exe
  2⤵
  PID:6552
- C:\Windows\System\BywvIvo.exe
  C:\Windows\System\BywvIvo.exe
  2⤵
  PID:6568
- C:\Windows\System\tMzLGUt.exe
  C:\Windows\System\tMzLGUt.exe
  2⤵
  PID:6584
- C:\Windows\System\KUWoNOI.exe
  C:\Windows\System\KUWoNOI.exe
  2⤵
  PID:6600
- C:\Windows\System\FTPEruz.exe
  C:\Windows\System\FTPEruz.exe
  2⤵
  PID:6616
- C:\Windows\System\cCUsJwj.exe
  C:\Windows\System\cCUsJwj.exe
  2⤵
  PID:6632
- C:\Windows\System\tiRCLFm.exe
  C:\Windows\System\tiRCLFm.exe
  2⤵
  PID:6652
- C:\Windows\System\JheZtDN.exe
  C:\Windows\System\JheZtDN.exe
  2⤵
  PID:6668
- C:\Windows\System\SCpjVTL.exe
  C:\Windows\System\SCpjVTL.exe
  2⤵
  PID:6684
- C:\Windows\System\sIZVJFx.exe
  C:\Windows\System\sIZVJFx.exe
  2⤵
  PID:6700
- C:\Windows\System\cxDlEkI.exe
  C:\Windows\System\cxDlEkI.exe
  2⤵
  PID:6716
- C:\Windows\System\DeYFqUL.exe
  C:\Windows\System\DeYFqUL.exe
  2⤵
  PID:6732
- C:\Windows\System\LzkoUrB.exe
  C:\Windows\System\LzkoUrB.exe
  2⤵
  PID:6748
- C:\Windows\System\twPenBn.exe
  C:\Windows\System\twPenBn.exe
  2⤵
  PID:6764
- C:\Windows\System\tQDFjaB.exe
  C:\Windows\System\tQDFjaB.exe
  2⤵
  PID:6780
- C:\Windows\System\JONELIf.exe
  C:\Windows\System\JONELIf.exe
  2⤵
  PID:6812
- C:\Windows\System\iEmeuPa.exe
  C:\Windows\System\iEmeuPa.exe
  2⤵
  PID:6832
- C:\Windows\System\WHzdnQS.exe
  C:\Windows\System\WHzdnQS.exe
  2⤵
  PID:6848
- C:\Windows\System\YJSvbXc.exe
  C:\Windows\System\YJSvbXc.exe
  2⤵
  PID:6864
- C:\Windows\System\XNsaDhE.exe
  C:\Windows\System\XNsaDhE.exe
  2⤵
  PID:6880
- C:\Windows\System\cbldJTF.exe
  C:\Windows\System\cbldJTF.exe
  2⤵
  PID:6896
- C:\Windows\System\zUDNDrQ.exe
  C:\Windows\System\zUDNDrQ.exe
  2⤵
  PID:6916
- C:\Windows\System\pScqiBC.exe
  C:\Windows\System\pScqiBC.exe
  2⤵
  PID:6932
- C:\Windows\System\TLHrmII.exe
  C:\Windows\System\TLHrmII.exe
  2⤵
  PID:6952
- C:\Windows\System\tcZsOfH.exe
  C:\Windows\System\tcZsOfH.exe
  2⤵
  PID:6968
- C:\Windows\System\wbSJkZL.exe
  C:\Windows\System\wbSJkZL.exe
  2⤵
  PID:6984
- C:\Windows\System\XKcXcsW.exe
  C:\Windows\System\XKcXcsW.exe
  2⤵
  PID:7000
- C:\Windows\System\lWINTBl.exe
  C:\Windows\System\lWINTBl.exe
  2⤵
  PID:7016
- C:\Windows\System\OFnHMSK.exe
  C:\Windows\System\OFnHMSK.exe
  2⤵
  PID:7032
- C:\Windows\System\JEuZYLK.exe
  C:\Windows\System\JEuZYLK.exe
  2⤵
  PID:7048
- C:\Windows\System\aplrRPZ.exe
  C:\Windows\System\aplrRPZ.exe
  2⤵
  PID:7064
- C:\Windows\System\SNFFttT.exe
  C:\Windows\System\SNFFttT.exe
  2⤵
  PID:7080
- C:\Windows\System\nYirBMZ.exe
  C:\Windows\System\nYirBMZ.exe
  2⤵
  PID:7096
- C:\Windows\System\ypCHWJK.exe
  C:\Windows\System\ypCHWJK.exe
  2⤵
  PID:7112
- C:\Windows\System\vhFXBqO.exe
  C:\Windows\System\vhFXBqO.exe
  2⤵
  PID:7132
- C:\Windows\System\zEKoxXh.exe
  C:\Windows\System\zEKoxXh.exe
  2⤵
  PID:7148
- C:\Windows\System\jmTCHAI.exe
  C:\Windows\System\jmTCHAI.exe
  2⤵
  PID:7164
- C:\Windows\System\rRdYEXs.exe
  C:\Windows\System\rRdYEXs.exe
  2⤵
  PID:5716
- C:\Windows\System\iBKLUDW.exe
  C:\Windows\System\iBKLUDW.exe
  2⤵
  PID:5648
- C:\Windows\System\gZfhxMK.exe
  C:\Windows\System\gZfhxMK.exe
  2⤵
  PID:5916
- C:\Windows\System\KkCFWNd.exe
  C:\Windows\System\KkCFWNd.exe
  2⤵
  PID:5192
- C:\Windows\System\enJROdc.exe
  C:\Windows\System\enJROdc.exe
  2⤵
  PID:4744
- C:\Windows\System\RSaxxPc.exe
  C:\Windows\System\RSaxxPc.exe
  2⤵
  PID:5988
- C:\Windows\System\spRwmKs.exe
  C:\Windows\System\spRwmKs.exe
  2⤵
  PID:6124
- C:\Windows\System\qEIqZeD.exe
  C:\Windows\System\qEIqZeD.exe
  2⤵
  PID:6292
- C:\Windows\System\frlodfO.exe
  C:\Windows\System\frlodfO.exe
  2⤵
  PID:5936
- C:\Windows\System\EmjQQPf.exe
  C:\Windows\System\EmjQQPf.exe
  2⤵
  PID:6156
- C:\Windows\System\iPZIRKI.exe
  C:\Windows\System\iPZIRKI.exe
  2⤵
  PID:6196
- C:\Windows\System\viPobeG.exe
  C:\Windows\System\viPobeG.exe
  2⤵
  PID:6264
- C:\Windows\System\pqBJvlP.exe
  C:\Windows\System\pqBJvlP.exe
  2⤵
  PID:6240
- C:\Windows\System\zdoLSXA.exe
  C:\Windows\System\zdoLSXA.exe
  2⤵
  PID:5440
- C:\Windows\System\NWrbIzu.exe
  C:\Windows\System\NWrbIzu.exe
  2⤵
  PID:5176
- C:\Windows\System\PEmZOSd.exe
  C:\Windows\System\PEmZOSd.exe
  2⤵
  PID:6360
- C:\Windows\System\KIdsbCs.exe
  C:\Windows\System\KIdsbCs.exe
  2⤵
  PID:5412
- C:\Windows\System\zrEIEXX.exe
  C:\Windows\System\zrEIEXX.exe
  2⤵
  PID:6036
- C:\Windows\System\uZXHPTz.exe
  C:\Windows\System\uZXHPTz.exe
  2⤵
  PID:6176
- C:\Windows\System\HdQausD.exe
  C:\Windows\System\HdQausD.exe
  2⤵
  PID:6244
- C:\Windows\System\ueYYRHy.exe
  C:\Windows\System\ueYYRHy.exe
  2⤵
  PID:6376
- C:\Windows\System\hmxSska.exe
  C:\Windows\System\hmxSska.exe
  2⤵
  PID:6380
- C:\Windows\System\emADRuT.exe
  C:\Windows\System\emADRuT.exe
  2⤵
  PID:6400
- C:\Windows\System\mGNKbkX.exe
  C:\Windows\System\mGNKbkX.exe
  2⤵
  PID:6524
- C:\Windows\System\cREqYfI.exe
  C:\Windows\System\cREqYfI.exe
  2⤵
  PID:6436
- C:\Windows\System\GmmMGPv.exe
  C:\Windows\System\GmmMGPv.exe
  2⤵
  PID:6532
- C:\Windows\System\qNzJuuB.exe
  C:\Windows\System\qNzJuuB.exe
  2⤵
  PID:6548
- C:\Windows\System\KndIzzS.exe
  C:\Windows\System\KndIzzS.exe
  2⤵
  PID:6664
- C:\Windows\System\vMghsNY.exe
  C:\Windows\System\vMghsNY.exe
  2⤵
  PID:6728
- C:\Windows\System\SOOBNHc.exe
  C:\Windows\System\SOOBNHc.exe
  2⤵
  PID:6796
- C:\Windows\System\TwNwXDF.exe
  C:\Windows\System\TwNwXDF.exe
  2⤵
  PID:6840
- C:\Windows\System\kFKtfMH.exe
  C:\Windows\System\kFKtfMH.exe
  2⤵
  PID:6576
- C:\Windows\System\GxTIAhO.exe
  C:\Windows\System\GxTIAhO.exe
  2⤵
  PID:6640
- C:\Windows\System\kkYwpSn.exe
  C:\Windows\System\kkYwpSn.exe
  2⤵
  PID:6676
- C:\Windows\System\Zrhabts.exe
  C:\Windows\System\Zrhabts.exe
  2⤵
  PID:6740
- C:\Windows\System\FaKDiuI.exe
  C:\Windows\System\FaKDiuI.exe
  2⤵
  PID:6820
- C:\Windows\System\Uszaqpu.exe
  C:\Windows\System\Uszaqpu.exe
  2⤵
  PID:6860
- C:\Windows\System\YALHSUD.exe
  C:\Windows\System\YALHSUD.exe
  2⤵
  PID:6908
- C:\Windows\System\DbNbjsN.exe
  C:\Windows\System\DbNbjsN.exe
  2⤵
  PID:6944
- C:\Windows\System\NdIUuYs.exe
  C:\Windows\System\NdIUuYs.exe
  2⤵
  PID:7008
- C:\Windows\System\ChvUFwR.exe
  C:\Windows\System\ChvUFwR.exe
  2⤵
  PID:7072
- C:\Windows\System\nGJzBpz.exe
  C:\Windows\System\nGJzBpz.exe
  2⤵
  PID:7140
- C:\Windows\System\CLjpaqT.exe
  C:\Windows\System\CLjpaqT.exe
  2⤵
  PID:5784
- C:\Windows\System\AOadzqF.exe
  C:\Windows\System\AOadzqF.exe
  2⤵
  PID:5048
- C:\Windows\System\vbqcrKy.exe
  C:\Windows\System\vbqcrKy.exe
  2⤵
  PID:5376
- C:\Windows\System\nunnZwd.exe
  C:\Windows\System\nunnZwd.exe
  2⤵
  PID:6996
- C:\Windows\System\EPeOGCQ.exe
  C:\Windows\System\EPeOGCQ.exe
  2⤵
  PID:7060
- C:\Windows\System\fmvgcAd.exe
  C:\Windows\System\fmvgcAd.exe
  2⤵
  PID:7128
- C:\Windows\System\FvBsKLr.exe
  C:\Windows\System\FvBsKLr.exe
  2⤵
  PID:5512
- C:\Windows\System\DiWMpJn.exe
  C:\Windows\System\DiWMpJn.exe
  2⤵
  PID:5848
- C:\Windows\System\psLqEBG.exe
  C:\Windows\System\psLqEBG.exe
  2⤵
  PID:5932
- C:\Windows\System\jKBIPeA.exe
  C:\Windows\System\jKBIPeA.exe
  2⤵
  PID:6056
- C:\Windows\System\aUCtUTu.exe
  C:\Windows\System\aUCtUTu.exe
  2⤵
  PID:5764
- C:\Windows\System\BENCVcW.exe
  C:\Windows\System\BENCVcW.exe
  2⤵
  PID:6416
- C:\Windows\System\JJhYeyP.exe
  C:\Windows\System\JJhYeyP.exe
  2⤵
  PID:2372
- C:\Windows\System\whnqICd.exe
  C:\Windows\System\whnqICd.exe
  2⤵
  PID:6396
- C:\Windows\System\loXgScb.exe
  C:\Windows\System\loXgScb.exe
  2⤵
  PID:6428
- C:\Windows\System\HroIxdB.exe
  C:\Windows\System\HroIxdB.exe
  2⤵
  PID:5572
- C:\Windows\System\rLNVZWL.exe
  C:\Windows\System\rLNVZWL.exe
  2⤵
  PID:5900
- C:\Windows\System\pxdivBI.exe
  C:\Windows\System\pxdivBI.exe
  2⤵
  PID:6792
- C:\Windows\System\NlOcrWL.exe
  C:\Windows\System\NlOcrWL.exe
  2⤵
  PID:6612
- C:\Windows\System\YnyeJrZ.exe
  C:\Windows\System\YnyeJrZ.exe
  2⤵
  PID:6468
- C:\Windows\System\axdedaf.exe
  C:\Windows\System\axdedaf.exe
  2⤵
  PID:6856
- C:\Windows\System\wrzmpqx.exe
  C:\Windows\System\wrzmpqx.exe
  2⤵
  PID:6824
- C:\Windows\System\TmwLlvB.exe
  C:\Windows\System\TmwLlvB.exe
  2⤵
  PID:6904
- C:\Windows\System\yVlvYSM.exe
  C:\Windows\System\yVlvYSM.exe
  2⤵
  PID:6776
- C:\Windows\System\QvYYYMU.exe
  C:\Windows\System\QvYYYMU.exe
  2⤵
  PID:7040
- C:\Windows\System\qCTfOSy.exe
  C:\Windows\System\qCTfOSy.exe
  2⤵
  PID:5636
- C:\Windows\System\ZzBzjpn.exe
  C:\Windows\System\ZzBzjpn.exe
  2⤵
  PID:6976
- C:\Windows\System\Xkrrrek.exe
  C:\Windows\System\Xkrrrek.exe
  2⤵
  PID:7108
- C:\Windows\System\bazysCA.exe
  C:\Windows\System\bazysCA.exe
  2⤵
  PID:6076
- C:\Windows\System\gmaHIgk.exe
  C:\Windows\System\gmaHIgk.exe
  2⤵
  PID:5800
- C:\Windows\System\MQvyMzb.exe
  C:\Windows\System\MQvyMzb.exe
  2⤵
  PID:6332
- C:\Windows\System\xPSTRjT.exe
  C:\Windows\System\xPSTRjT.exe
  2⤵
  PID:5328
- C:\Windows\System\tHukDIR.exe
  C:\Windows\System\tHukDIR.exe
  2⤵
  PID:6276
- C:\Windows\System\YvEyMKX.exe
  C:\Windows\System\YvEyMKX.exe
  2⤵
  PID:5272
- C:\Windows\System\AQAahSz.exe
  C:\Windows\System\AQAahSz.exe
  2⤵
  PID:6260
- C:\Windows\System\uvPUZWZ.exe
  C:\Windows\System\uvPUZWZ.exe
  2⤵
  PID:5288
- C:\Windows\System\rqUhkqH.exe
  C:\Windows\System\rqUhkqH.exe
  2⤵
  PID:6472
- C:\Windows\System\YdNPQqe.exe
  C:\Windows\System\YdNPQqe.exe
  2⤵
  PID:6712
- C:\Windows\System\OhLxQON.exe
  C:\Windows\System\OhLxQON.exe
  2⤵
  PID:5584
- C:\Windows\System\GxBkcWA.exe
  C:\Windows\System\GxBkcWA.exe
  2⤵
  PID:4496
- C:\Windows\System\pfKXJVc.exe
  C:\Windows\System\pfKXJVc.exe
  2⤵
  PID:6564
- C:\Windows\System\GRXIipM.exe
  C:\Windows\System\GRXIipM.exe
  2⤵
  PID:6596
- C:\Windows\System\AuVRumw.exe
  C:\Windows\System\AuVRumw.exe
  2⤵
  PID:6724
- C:\Windows\System\piGUosz.exe
  C:\Windows\System\piGUosz.exe
  2⤵
  PID:6940
- C:\Windows\System\ugWigdv.exe
  C:\Windows\System\ugWigdv.exe
  2⤵
  PID:7124
- C:\Windows\System\xirfTKp.exe
  C:\Windows\System\xirfTKp.exe
  2⤵
  PID:7160
- C:\Windows\System\YBMyKhc.exe
  C:\Windows\System\YBMyKhc.exe
  2⤵
  PID:6788
- C:\Windows\System\ZcPOLhh.exe
  C:\Windows\System\ZcPOLhh.exe
  2⤵
  PID:6772
- C:\Windows\System\pWLANem.exe
  C:\Windows\System\pWLANem.exe
  2⤵
  PID:6624
- C:\Windows\System\vHyXhtn.exe
  C:\Windows\System\vHyXhtn.exe
  2⤵
  PID:7184
- C:\Windows\System\XdwHDsm.exe
  C:\Windows\System\XdwHDsm.exe
  2⤵
  PID:7200
- C:\Windows\System\mFSqhah.exe
  C:\Windows\System\mFSqhah.exe
  2⤵
  PID:7216
- C:\Windows\System\anqIOcj.exe
  C:\Windows\System\anqIOcj.exe
  2⤵
  PID:7232
- C:\Windows\System\XYLQIhh.exe
  C:\Windows\System\XYLQIhh.exe
  2⤵
  PID:7252
- C:\Windows\System\wcqWUVQ.exe
  C:\Windows\System\wcqWUVQ.exe
  2⤵
  PID:7268
- C:\Windows\System\JVJfbHt.exe
  C:\Windows\System\JVJfbHt.exe
  2⤵
  PID:7284
- C:\Windows\System\AVYCbfW.exe
  C:\Windows\System\AVYCbfW.exe
  2⤵
  PID:7300
- C:\Windows\System\ZayPgOr.exe
  C:\Windows\System\ZayPgOr.exe
  2⤵
  PID:7316
- C:\Windows\System\iLYkYRj.exe
  C:\Windows\System\iLYkYRj.exe
  2⤵
  PID:7332
- C:\Windows\System\AUQELLY.exe
  C:\Windows\System\AUQELLY.exe
  2⤵
  PID:7348
- C:\Windows\System\lyglQtv.exe
  C:\Windows\System\lyglQtv.exe
  2⤵
  PID:7364
- C:\Windows\System\KswRywJ.exe
  C:\Windows\System\KswRywJ.exe
  2⤵
  PID:7380
- C:\Windows\System\zzbLIVe.exe
  C:\Windows\System\zzbLIVe.exe
  2⤵
  PID:7396
- C:\Windows\System\HWFmmtC.exe
  C:\Windows\System\HWFmmtC.exe
  2⤵
  PID:7412
- C:\Windows\System\TCMUvTe.exe
  C:\Windows\System\TCMUvTe.exe
  2⤵
  PID:7428
- C:\Windows\System\DidIwfI.exe
  C:\Windows\System\DidIwfI.exe
  2⤵
  PID:7444
- C:\Windows\System\LVgyiFf.exe
  C:\Windows\System\LVgyiFf.exe
  2⤵
  PID:7460
- C:\Windows\System\CVtxAcS.exe
  C:\Windows\System\CVtxAcS.exe
  2⤵
  PID:7476
- C:\Windows\System\CTaSYgC.exe
  C:\Windows\System\CTaSYgC.exe
  2⤵
  PID:7492
- C:\Windows\System\aBzmiAH.exe
  C:\Windows\System\aBzmiAH.exe
  2⤵
  PID:7508
- C:\Windows\System\yPDteqh.exe
  C:\Windows\System\yPDteqh.exe
  2⤵
  PID:7524
- C:\Windows\System\glGHTrL.exe
  C:\Windows\System\glGHTrL.exe
  2⤵
  PID:7540
- C:\Windows\System\AmonnIG.exe
  C:\Windows\System\AmonnIG.exe
  2⤵
  PID:7556
- C:\Windows\System\yPgoZSl.exe
  C:\Windows\System\yPgoZSl.exe
  2⤵
  PID:7572
- C:\Windows\System\XkBSNfK.exe
  C:\Windows\System\XkBSNfK.exe
  2⤵
  PID:7588
- C:\Windows\System\fGQyEcV.exe
  C:\Windows\System\fGQyEcV.exe
  2⤵
  PID:7604
- C:\Windows\System\DAgSXVp.exe
  C:\Windows\System\DAgSXVp.exe
  2⤵
  PID:7624
- C:\Windows\System\TxQopiH.exe
  C:\Windows\System\TxQopiH.exe
  2⤵
  PID:7640
- C:\Windows\System\htuJxni.exe
  C:\Windows\System\htuJxni.exe
  2⤵
  PID:7656
- C:\Windows\System\xVWyesK.exe
  C:\Windows\System\xVWyesK.exe
  2⤵
  PID:7672
- C:\Windows\System\jKSTOeV.exe
  C:\Windows\System\jKSTOeV.exe
  2⤵
  PID:7688
- C:\Windows\System\ZVsGxHo.exe
  C:\Windows\System\ZVsGxHo.exe
  2⤵
  PID:7708
- C:\Windows\System\ynhAwvZ.exe
  C:\Windows\System\ynhAwvZ.exe
  2⤵
  PID:7724
- C:\Windows\System\TrMQiXy.exe
  C:\Windows\System\TrMQiXy.exe
  2⤵
  PID:7740
- C:\Windows\System\JSBAFap.exe
  C:\Windows\System\JSBAFap.exe
  2⤵
  PID:7756
- C:\Windows\System\JsgEJmV.exe
  C:\Windows\System\JsgEJmV.exe
  2⤵
  PID:7772
- C:\Windows\System\iYAIgXs.exe
  C:\Windows\System\iYAIgXs.exe
  2⤵
  PID:7788
- C:\Windows\System\AISwkNe.exe
  C:\Windows\System\AISwkNe.exe
  2⤵
  PID:7804
- C:\Windows\System\PGNpwDF.exe
  C:\Windows\System\PGNpwDF.exe
  2⤵
  PID:7820
- C:\Windows\System\KeWWxlB.exe
  C:\Windows\System\KeWWxlB.exe
  2⤵
  PID:7836
- C:\Windows\System\uNntkiz.exe
  C:\Windows\System\uNntkiz.exe
  2⤵
  PID:7856
- C:\Windows\System\svASqhv.exe
  C:\Windows\System\svASqhv.exe
  2⤵
  PID:7872
- C:\Windows\System\LRooYMF.exe
  C:\Windows\System\LRooYMF.exe
  2⤵
  PID:7888
- C:\Windows\System\dupuMKB.exe
  C:\Windows\System\dupuMKB.exe
  2⤵
  PID:7908
- C:\Windows\System\xfKvITc.exe
  C:\Windows\System\xfKvITc.exe
  2⤵
  PID:7924
- C:\Windows\System\cPLpnnA.exe
  C:\Windows\System\cPLpnnA.exe
  2⤵
  PID:7940
- C:\Windows\System\XBJyzdd.exe
  C:\Windows\System\XBJyzdd.exe
  2⤵
  PID:7956
- C:\Windows\System\GEEdtoh.exe
  C:\Windows\System\GEEdtoh.exe
  2⤵
  PID:7972
- C:\Windows\System\UMFuxUg.exe
  C:\Windows\System\UMFuxUg.exe
  2⤵
  PID:7988
- C:\Windows\System\JKAfKQo.exe
  C:\Windows\System\JKAfKQo.exe
  2⤵
  PID:8004
- C:\Windows\System\OcvLIfI.exe
  C:\Windows\System\OcvLIfI.exe
  2⤵
  PID:8020
- C:\Windows\System\pPxsUdJ.exe
  C:\Windows\System\pPxsUdJ.exe
  2⤵
  PID:8048
- C:\Windows\System\NguNPcP.exe
  C:\Windows\System\NguNPcP.exe
  2⤵
  PID:8068
- C:\Windows\System\nFZJoSZ.exe
  C:\Windows\System\nFZJoSZ.exe
  2⤵
  PID:8084
- C:\Windows\System\vhGhxeD.exe
  C:\Windows\System\vhGhxeD.exe
  2⤵
  PID:8100
- C:\Windows\System\qTomhge.exe
  C:\Windows\System\qTomhge.exe
  2⤵
  PID:8116
- C:\Windows\System\bitmWml.exe
  C:\Windows\System\bitmWml.exe
  2⤵
  PID:8180
- C:\Windows\System\hTlwdnA.exe
  C:\Windows\System\hTlwdnA.exe
  2⤵
  PID:5208
- C:\Windows\System\GWPhJwg.exe
  C:\Windows\System\GWPhJwg.exe
  2⤵
  PID:7120
- C:\Windows\System\TWeFZbO.exe
  C:\Windows\System\TWeFZbO.exe
  2⤵
  PID:7224
- C:\Windows\System\cDVUmez.exe
  C:\Windows\System\cDVUmez.exe
  2⤵
  PID:5312
- C:\Windows\System\uxiIfdQ.exe
  C:\Windows\System\uxiIfdQ.exe
  2⤵
  PID:7176
- C:\Windows\System\HkZBpqy.exe
  C:\Windows\System\HkZBpqy.exe
  2⤵
  PID:6924
- C:\Windows\System\NGebTbJ.exe
  C:\Windows\System\NGebTbJ.exe
  2⤵
  PID:5552
- C:\Windows\System\wZauuIE.exe
  C:\Windows\System\wZauuIE.exe
  2⤵
  PID:7240
- C:\Windows\System\BiWUvYy.exe
  C:\Windows\System\BiWUvYy.exe
  2⤵
  PID:7328
- C:\Windows\System\TGqIgru.exe
  C:\Windows\System\TGqIgru.exe
  2⤵
  PID:7388
- C:\Windows\System\VUzFGdK.exe
  C:\Windows\System\VUzFGdK.exe
  2⤵
  PID:7424
- C:\Windows\System\xxymCZE.exe
  C:\Windows\System\xxymCZE.exe
  2⤵
  PID:7456
- C:\Windows\System\bZKpJtb.exe
  C:\Windows\System\bZKpJtb.exe
  2⤵
  PID:7312
- C:\Windows\System\bJXogYi.exe
  C:\Windows\System\bJXogYi.exe
  2⤵
  PID:7504
- C:\Windows\System\zUsDprV.exe
  C:\Windows\System\zUsDprV.exe
  2⤵
  PID:7440
- C:\Windows\System\hqwihXh.exe
  C:\Windows\System\hqwihXh.exe
  2⤵
  PID:7552
- C:\Windows\System\TNiWglg.exe
  C:\Windows\System\TNiWglg.exe
  2⤵
  PID:7564
- C:\Windows\System\wZPPZIi.exe
  C:\Windows\System\wZPPZIi.exe
  2⤵
  PID:7568
- C:\Windows\System\rYNhrDI.exe
  C:\Windows\System\rYNhrDI.exe
  2⤵
  PID:7684
- C:\Windows\System\fSQRRCh.exe
  C:\Windows\System\fSQRRCh.exe
  2⤵
  PID:7696
- C:\Windows\System\ICwdLdd.exe
  C:\Windows\System\ICwdLdd.exe
  2⤵
  PID:7636
- C:\Windows\System\TebpiUf.exe
  C:\Windows\System\TebpiUf.exe
  2⤵
  PID:7748
- C:\Windows\System\oimPBRZ.exe
  C:\Windows\System\oimPBRZ.exe
  2⤵
  PID:7784
- C:\Windows\System\DjllQZQ.exe
  C:\Windows\System\DjllQZQ.exe
  2⤵
  PID:7736
- C:\Windows\System\ddTNyEB.exe
  C:\Windows\System\ddTNyEB.exe
  2⤵
  PID:7800
- C:\Windows\System\HzReOXb.exe
  C:\Windows\System\HzReOXb.exe
  2⤵
  PID:7852
- C:\Windows\System\oWPlwfw.exe
  C:\Windows\System\oWPlwfw.exe
  2⤵
  PID:7920
- C:\Windows\System\fcfLQod.exe
  C:\Windows\System\fcfLQod.exe
  2⤵
  PID:7984
- C:\Windows\System\RTNBsJF.exe
  C:\Windows\System\RTNBsJF.exe
  2⤵
  PID:8016
- C:\Windows\System\itKWnvd.exe
  C:\Windows\System\itKWnvd.exe
  2⤵
  PID:7904
- C:\Windows\System\zfBodjL.exe
  C:\Windows\System\zfBodjL.exe
  2⤵
  PID:7996
- C:\Windows\System\crynBka.exe
  C:\Windows\System\crynBka.exe
  2⤵
  PID:7964
- C:\Windows\System\AmKOceD.exe
  C:\Windows\System\AmKOceD.exe
  2⤵
  PID:8112
- C:\Windows\System\TNyFdtM.exe
  C:\Windows\System\TNyFdtM.exe
  2⤵
  PID:8148
- C:\Windows\System\dGVvklD.exe
  C:\Windows\System\dGVvklD.exe
  2⤵
  PID:8092
- C:\Windows\System\MsdEBWd.exe
  C:\Windows\System\MsdEBWd.exe
  2⤵
  PID:8132
- C:\Windows\System\EJbUFIj.exe
  C:\Windows\System\EJbUFIj.exe
  2⤵
  PID:8152
- C:\Windows\System\krECWlC.exe
  C:\Windows\System\krECWlC.exe
  2⤵
  PID:8172
- C:\Windows\System\jXFiXmM.exe
  C:\Windows\System\jXFiXmM.exe
  2⤵
  PID:6228
- C:\Windows\System\EhSdBCb.exe
  C:\Windows\System\EhSdBCb.exe
  2⤵
  PID:6808
- C:\Windows\System\jAzTRrx.exe
  C:\Windows\System\jAzTRrx.exe
  2⤵
  PID:7296
- C:\Windows\System\XaRyZfw.exe
  C:\Windows\System\XaRyZfw.exe
  2⤵
  PID:7248
- C:\Windows\System\lzBAueT.exe
  C:\Windows\System\lzBAueT.exe
  2⤵
  PID:7276
- C:\Windows\System\xQwQxCS.exe
  C:\Windows\System\xQwQxCS.exe
  2⤵
  PID:7340
- C:\Windows\System\nyNsbik.exe
  C:\Windows\System\nyNsbik.exe
  2⤵
  PID:7500
- C:\Windows\System\aWLbTtw.exe
  C:\Windows\System\aWLbTtw.exe
  2⤵
  PID:7620
- C:\Windows\System\JKkoXsM.exe
  C:\Windows\System\JKkoXsM.exe
  2⤵
  PID:7720
- C:\Windows\System\ULAHBQD.exe
  C:\Windows\System\ULAHBQD.exe
  2⤵
  PID:7436
- C:\Windows\System\aPOsDKc.exe
  C:\Windows\System\aPOsDKc.exe
  2⤵
  PID:7652
- C:\Windows\System\lXoWBoe.exe
  C:\Windows\System\lXoWBoe.exe
  2⤵
  PID:7752
- C:\Windows\System\KCFLSbk.exe
  C:\Windows\System\KCFLSbk.exe
  2⤵
  PID:7980
- C:\Windows\System\Fblymhi.exe
  C:\Windows\System\Fblymhi.exe
  2⤵
  PID:7916
- C:\Windows\System\kCHYrEl.exe
  C:\Windows\System\kCHYrEl.exe
  2⤵
  PID:7864
- C:\Windows\System\tjfmoBc.exe
  C:\Windows\System\tjfmoBc.exe
  2⤵
  PID:8040
- C:\Windows\System\WXHwdWH.exe
  C:\Windows\System\WXHwdWH.exe
  2⤵
  PID:8124
- C:\Windows\System\dgBXCbW.exe
  C:\Windows\System\dgBXCbW.exe
  2⤵
  PID:8064
- C:\Windows\System\biUUctr.exe
  C:\Windows\System\biUUctr.exe
  2⤵
  PID:6344
- C:\Windows\System\HZVaUYi.exe
  C:\Windows\System\HZVaUYi.exe
  2⤵
  PID:8188
- C:\Windows\System\JyVCGQn.exe
  C:\Windows\System\JyVCGQn.exe
  2⤵
  PID:6316
- C:\Windows\System\cwdfIql.exe
  C:\Windows\System\cwdfIql.exe
  2⤵
  PID:7616
- C:\Windows\System\KZDJnEP.exe
  C:\Windows\System\KZDJnEP.exe
  2⤵
  PID:7668
- C:\Windows\System\EAmeyiu.exe
  C:\Windows\System\EAmeyiu.exe
  2⤵
  PID:6760
- C:\Windows\System\QJpAzsQ.exe
  C:\Windows\System\QJpAzsQ.exe
  2⤵
  PID:7324
- C:\Windows\System\LQInlIY.exe
  C:\Windows\System\LQInlIY.exe
  2⤵
  PID:7536
- C:\Windows\System\otsqwVu.exe
  C:\Windows\System\otsqwVu.exe
  2⤵
  PID:8156
- C:\Windows\System\RgyQDUy.exe
  C:\Windows\System\RgyQDUy.exe
  2⤵
  PID:7884
- C:\Windows\System\JkKyZgx.exe
  C:\Windows\System\JkKyZgx.exe
  2⤵
  PID:8028
- C:\Windows\System\jaGZDjQ.exe
  C:\Windows\System\jaGZDjQ.exe
  2⤵
  PID:7548
- C:\Windows\System\QBwaWBE.exe
  C:\Windows\System\QBwaWBE.exe
  2⤵
  PID:7832
- C:\Windows\System\lXLgzQQ.exe
  C:\Windows\System\lXLgzQQ.exe
  2⤵
  PID:7212
- C:\Windows\System\aMRPQXw.exe
  C:\Windows\System\aMRPQXw.exe
  2⤵
  PID:7952
- C:\Windows\System\ckONcpL.exe
  C:\Windows\System\ckONcpL.exe
  2⤵
  PID:7376
- C:\Windows\System\FfPRHog.exe
  C:\Windows\System\FfPRHog.exe
  2⤵
  PID:8164
- C:\Windows\System\OjFUpyZ.exe
  C:\Windows\System\OjFUpyZ.exe
  2⤵
  PID:8168
- C:\Windows\System\XChUCEa.exe
  C:\Windows\System\XChUCEa.exe
  2⤵
  PID:8196
- C:\Windows\System\SPfBdfn.exe
  C:\Windows\System\SPfBdfn.exe
  2⤵
  PID:8212
- C:\Windows\System\rBRkCRC.exe
  C:\Windows\System\rBRkCRC.exe
  2⤵
  PID:8228
- C:\Windows\System\aiLMTwp.exe
  C:\Windows\System\aiLMTwp.exe
  2⤵
  PID:8244
- C:\Windows\System\SidYxJh.exe
  C:\Windows\System\SidYxJh.exe
  2⤵
  PID:8260
- C:\Windows\System\WzWAdVk.exe
  C:\Windows\System\WzWAdVk.exe
  2⤵
  PID:8276
- C:\Windows\System\eDMTMae.exe
  C:\Windows\System\eDMTMae.exe
  2⤵
  PID:8292
- C:\Windows\System\BzrRRUV.exe
  C:\Windows\System\BzrRRUV.exe
  2⤵
  PID:8308
- C:\Windows\System\QBDwyGX.exe
  C:\Windows\System\QBDwyGX.exe
  2⤵
  PID:8324
- C:\Windows\System\fTOlwPL.exe
  C:\Windows\System\fTOlwPL.exe
  2⤵
  PID:8340
- C:\Windows\System\jIlwTPN.exe
  C:\Windows\System\jIlwTPN.exe
  2⤵
  PID:8360
- C:\Windows\System\DvmZezr.exe
  C:\Windows\System\DvmZezr.exe
  2⤵
  PID:8376
- C:\Windows\System\vOayxId.exe
  C:\Windows\System\vOayxId.exe
  2⤵
  PID:8392
- C:\Windows\System\qgAkDHi.exe
  C:\Windows\System\qgAkDHi.exe
  2⤵
  PID:8408
- C:\Windows\System\zNTPZfu.exe
  C:\Windows\System\zNTPZfu.exe
  2⤵
  PID:8424
- C:\Windows\System\QaimLfm.exe
  C:\Windows\System\QaimLfm.exe
  2⤵
  PID:8440
- C:\Windows\System\GXDvpFH.exe
  C:\Windows\System\GXDvpFH.exe
  2⤵
  PID:8460
- C:\Windows\System\oaKIkhP.exe
  C:\Windows\System\oaKIkhP.exe
  2⤵
  PID:8476
- C:\Windows\System\RgPwxJH.exe
  C:\Windows\System\RgPwxJH.exe
  2⤵
  PID:8492
- C:\Windows\System\TRAQOAS.exe
  C:\Windows\System\TRAQOAS.exe
  2⤵
  PID:8508
- C:\Windows\System\yWdRyKC.exe
  C:\Windows\System\yWdRyKC.exe
  2⤵
  PID:8524
- C:\Windows\System\EhawQaH.exe
  C:\Windows\System\EhawQaH.exe
  2⤵
  PID:8540
- C:\Windows\System\xaeDyEf.exe
  C:\Windows\System\xaeDyEf.exe
  2⤵
  PID:8556
- C:\Windows\System\wCGoiOw.exe
  C:\Windows\System\wCGoiOw.exe
  2⤵
  PID:8572
- C:\Windows\System\zBXZIki.exe
  C:\Windows\System\zBXZIki.exe
  2⤵
  PID:8588
- C:\Windows\System\bDBuHgF.exe
  C:\Windows\System\bDBuHgF.exe
  2⤵
  PID:8604
- C:\Windows\System\CYaShZp.exe
  C:\Windows\System\CYaShZp.exe
  2⤵
  PID:8620
- C:\Windows\System\XwSsafW.exe
  C:\Windows\System\XwSsafW.exe
  2⤵
  PID:8636
- C:\Windows\System\CttHImV.exe
  C:\Windows\System\CttHImV.exe
  2⤵
  PID:8652
- C:\Windows\System\oSuVNiz.exe
  C:\Windows\System\oSuVNiz.exe
  2⤵
  PID:8668
- C:\Windows\System\aaqVRBT.exe
  C:\Windows\System\aaqVRBT.exe
  2⤵
  PID:8684
- C:\Windows\System\SxPZcpk.exe
  C:\Windows\System\SxPZcpk.exe
  2⤵
  PID:8700
- C:\Windows\System\pTDuNZM.exe
  C:\Windows\System\pTDuNZM.exe
  2⤵
  PID:8716
- C:\Windows\System\MEmxfwq.exe
  C:\Windows\System\MEmxfwq.exe
  2⤵
  PID:8732
- C:\Windows\System\EvfpGso.exe
  C:\Windows\System\EvfpGso.exe
  2⤵
  PID:8748
- C:\Windows\System\kEpsSzf.exe
  C:\Windows\System\kEpsSzf.exe
  2⤵
  PID:8764
- C:\Windows\System\RREOqZw.exe
  C:\Windows\System\RREOqZw.exe
  2⤵
  PID:8780
- C:\Windows\System\IYzZWLQ.exe
  C:\Windows\System\IYzZWLQ.exe
  2⤵
  PID:8796
- C:\Windows\System\GoFoZHD.exe
  C:\Windows\System\GoFoZHD.exe
  2⤵
  PID:8812
- C:\Windows\System\tBagNAc.exe
  C:\Windows\System\tBagNAc.exe
  2⤵
  PID:8828
- C:\Windows\System\yIhDSrh.exe
  C:\Windows\System\yIhDSrh.exe
  2⤵
  PID:8844
- C:\Windows\System\BHZXiPk.exe
  C:\Windows\System\BHZXiPk.exe
  2⤵
  PID:8860
- C:\Windows\System\yUWHALT.exe
  C:\Windows\System\yUWHALT.exe
  2⤵
  PID:8876
- C:\Windows\System\vbDpYUl.exe
  C:\Windows\System\vbDpYUl.exe
  2⤵
  PID:8892
- C:\Windows\System\MypsBRm.exe
  C:\Windows\System\MypsBRm.exe
  2⤵
  PID:8908
- C:\Windows\System\tKMEufk.exe
  C:\Windows\System\tKMEufk.exe
  2⤵
  PID:8924
- C:\Windows\System\xvGXENT.exe
  C:\Windows\System\xvGXENT.exe
  2⤵
  PID:8940
- C:\Windows\System\KayovfZ.exe
  C:\Windows\System\KayovfZ.exe
  2⤵
  PID:8956
- C:\Windows\System\tGifJxE.exe
  C:\Windows\System\tGifJxE.exe
  2⤵
  PID:8972
- C:\Windows\System\PEGnbDJ.exe
  C:\Windows\System\PEGnbDJ.exe
  2⤵
  PID:8992
- C:\Windows\System\aokWmmV.exe
  C:\Windows\System\aokWmmV.exe
  2⤵
  PID:9008
- C:\Windows\System\yJyghJa.exe
  C:\Windows\System\yJyghJa.exe
  2⤵
  PID:9024
- C:\Windows\System\kacjtZf.exe
  C:\Windows\System\kacjtZf.exe
  2⤵
  PID:9040
- C:\Windows\System\OyZAVij.exe
  C:\Windows\System\OyZAVij.exe
  2⤵
  PID:9056
- C:\Windows\System\PxgDZLg.exe
  C:\Windows\System\PxgDZLg.exe
  2⤵
  PID:9072
- C:\Windows\System\lIsLMuU.exe
  C:\Windows\System\lIsLMuU.exe
  2⤵
  PID:9088
- C:\Windows\System\OTuNagM.exe
  C:\Windows\System\OTuNagM.exe
  2⤵
  PID:9104
- C:\Windows\System\mTEnOak.exe
  C:\Windows\System\mTEnOak.exe
  2⤵
  PID:9120
- C:\Windows\System\gcYspnE.exe
  C:\Windows\System\gcYspnE.exe
  2⤵
  PID:9136
- C:\Windows\System\KrxkPWF.exe
  C:\Windows\System\KrxkPWF.exe
  2⤵
  PID:9152
- C:\Windows\System\wauUxsT.exe
  C:\Windows\System\wauUxsT.exe
  2⤵
  PID:9168
- C:\Windows\System\EDpfGjS.exe
  C:\Windows\System\EDpfGjS.exe
  2⤵
  PID:9184
- C:\Windows\System\cWNQAkC.exe
  C:\Windows\System\cWNQAkC.exe
  2⤵
  PID:9200
- C:\Windows\System\WbaNTLl.exe
  C:\Windows\System\WbaNTLl.exe
  2⤵
  PID:8204
- C:\Windows\System\hETiMXE.exe
  C:\Windows\System\hETiMXE.exe
  2⤵
  PID:8268
- C:\Windows\System\qeYxuhB.exe
  C:\Windows\System\qeYxuhB.exe
  2⤵
  PID:8080
- C:\Windows\System\VUCDztp.exe
  C:\Windows\System\VUCDztp.exe
  2⤵
  PID:8220
- C:\Windows\System\AoEqADy.exe
  C:\Windows\System\AoEqADy.exe
  2⤵
  PID:8300
- C:\Windows\System\LWVgJUN.exe
  C:\Windows\System\LWVgJUN.exe
  2⤵
  PID:8372
- C:\Windows\System\dEjSKJj.exe
  C:\Windows\System\dEjSKJj.exe
  2⤵
  PID:8432
- C:\Windows\System\hbzipib.exe
  C:\Windows\System\hbzipib.exe
  2⤵
  PID:8288
- C:\Windows\System\UAXHNUG.exe
  C:\Windows\System\UAXHNUG.exe
  2⤵
  PID:8316
- C:\Windows\System\NvlMPrk.exe
  C:\Windows\System\NvlMPrk.exe
  2⤵
  PID:8352
- C:\Windows\System\nscbYWY.exe
  C:\Windows\System\nscbYWY.exe
  2⤵
  PID:8416
- C:\Windows\System\gWKLUOp.exe
  C:\Windows\System\gWKLUOp.exe
  2⤵
  PID:8532
- C:\Windows\System\GuaKQeV.exe
  C:\Windows\System\GuaKQeV.exe
  2⤵
  PID:8516
- C:\Windows\System\DgdVtUD.exe
  C:\Windows\System\DgdVtUD.exe
  2⤵
  PID:8564
- C:\Windows\System\KBSChyU.exe
  C:\Windows\System\KBSChyU.exe
  2⤵
  PID:8628
- C:\Windows\System\ZbecJcC.exe
  C:\Windows\System\ZbecJcC.exe
  2⤵
  PID:8644
- C:\Windows\System\sEOjMQd.exe
  C:\Windows\System\sEOjMQd.exe
  2⤵
  PID:8692
- C:\Windows\System\ESdvDud.exe
  C:\Windows\System\ESdvDud.exe
  2⤵
  PID:8724
- C:\Windows\System\IOrThCF.exe
  C:\Windows\System\IOrThCF.exe
  2⤵
  PID:8708
- C:\Windows\System\WtPvWmW.exe
  C:\Windows\System\WtPvWmW.exe
  2⤵
  PID:8760
- C:\Windows\System\YybjKhi.exe
  C:\Windows\System\YybjKhi.exe
  2⤵
  PID:8820
- C:\Windows\System\qBbNeph.exe
  C:\Windows\System\qBbNeph.exe
  2⤵
  PID:8888
- C:\Windows\System\dHhxnRQ.exe
  C:\Windows\System\dHhxnRQ.exe
  2⤵
  PID:8948
- C:\Windows\System\dkWuZhp.exe
  C:\Windows\System\dkWuZhp.exe
  2⤵
  PID:8872
- C:\Windows\System\jmeULsg.exe
  C:\Windows\System\jmeULsg.exe
  2⤵
  PID:8804
- C:\Windows\System\AQyteVD.exe
  C:\Windows\System\AQyteVD.exe
  2⤵
  PID:9064
- C:\Windows\System\SQpVvxV.exe
  C:\Windows\System\SQpVvxV.exe
  2⤵
  PID:9112
- C:\Windows\System\tjrAAbI.exe
  C:\Windows\System\tjrAAbI.exe
  2⤵
  PID:7292
- C:\Windows\System\LHhsJRc.exe
  C:\Windows\System\LHhsJRc.exe
  2⤵
  PID:9160
- C:\Windows\System\PCHnMEu.exe
  C:\Windows\System\PCHnMEu.exe
  2⤵
  PID:7764
- C:\Windows\System\tCBSZvu.exe
  C:\Windows\System\tCBSZvu.exe
  2⤵
  PID:8404
- C:\Windows\System\ZZelnDM.exe
  C:\Windows\System\ZZelnDM.exe
  2⤵
  PID:8388
- C:\Windows\System\DnUfbNU.exe
  C:\Windows\System\DnUfbNU.exe
  2⤵
  PID:8488
- C:\Windows\System\AMteCzc.exe
  C:\Windows\System\AMteCzc.exe
  2⤵
  PID:8336
- C:\Windows\System\GKnBHlx.exe
  C:\Windows\System\GKnBHlx.exe
  2⤵
  PID:8504
- C:\Windows\System\eDsCtcw.exe
  C:\Windows\System\eDsCtcw.exe
  2⤵
  PID:8284
- C:\Windows\System\WKkTTTz.exe
  C:\Windows\System\WKkTTTz.exe
  2⤵
  PID:8552
- C:\Windows\System\HYnFACQ.exe
  C:\Windows\System\HYnFACQ.exe
  2⤵
  PID:8584
- C:\Windows\System\hcBzOPF.exe
  C:\Windows\System\hcBzOPF.exe
  2⤵
  PID:8680
- C:\Windows\System\zaQVBKa.exe
  C:\Windows\System\zaQVBKa.exe
  2⤵
  PID:8916
- C:\Windows\System\KJjGRhK.exe
  C:\Windows\System\KJjGRhK.exe
  2⤵
  PID:8740
- C:\Windows\System\rbJYsGF.exe
  C:\Windows\System\rbJYsGF.exe
  2⤵
  PID:8884
- C:\Windows\System\hdJabAM.exe
  C:\Windows\System\hdJabAM.exe
  2⤵
  PID:9000
- C:\Windows\System\FCIjAKG.exe
  C:\Windows\System\FCIjAKG.exe
  2⤵
  PID:8936
- C:\Windows\System\wkfVYOV.exe
  C:\Windows\System\wkfVYOV.exe
  2⤵
  PID:8836
- C:\Windows\System\DQlPVGe.exe
  C:\Windows\System\DQlPVGe.exe
  2⤵
  PID:9084
- C:\Windows\System\uYFYawb.exe
  C:\Windows\System\uYFYawb.exe
  2⤵
  PID:9128
- C:\Windows\System\XKYIRpf.exe
  C:\Windows\System\XKYIRpf.exe
  2⤵
  PID:8400
- C:\Windows\System\WOCHSiE.exe
  C:\Windows\System\WOCHSiE.exe
  2⤵
  PID:8596
- C:\Windows\System\YDrCKyL.exe
  C:\Windows\System\YDrCKyL.exe
  2⤵
  PID:8756
- C:\Windows\System\duKRvzv.exe
  C:\Windows\System\duKRvzv.exe
  2⤵
  PID:8484
- C:\Windows\System\gSIThRY.exe
  C:\Windows\System\gSIThRY.exe
  2⤵
  PID:8332
- C:\Windows\System\fTIRqYm.exe
  C:\Windows\System\fTIRqYm.exe
  2⤵
  PID:8384
- C:\Windows\System\BuiNzzD.exe
  C:\Windows\System\BuiNzzD.exe
  2⤵
  PID:8616
- C:\Windows\System\FrlRwKz.exe
  C:\Windows\System\FrlRwKz.exe
  2⤵
  PID:8856
- C:\Windows\System\ddERrjY.exe
  C:\Windows\System\ddERrjY.exe
  2⤵
  PID:9052
- C:\Windows\System\DLwiYYy.exe
  C:\Windows\System\DLwiYYy.exe
  2⤵
  PID:8256
- C:\Windows\System\joTyJTB.exe
  C:\Windows\System\joTyJTB.exe
  2⤵
  PID:9036
- C:\Windows\System\gYTMjNb.exe
  C:\Windows\System\gYTMjNb.exe
  2⤵
  PID:8536
- C:\Windows\System\CGPiomN.exe
  C:\Windows\System\CGPiomN.exe
  2⤵
  PID:9212
- C:\Windows\System\MggUwnc.exe
  C:\Windows\System\MggUwnc.exe
  2⤵
  PID:8580
- C:\Windows\System\HiCwmib.exe
  C:\Windows\System\HiCwmib.exe
  2⤵
  PID:8980
- C:\Windows\System\XYryMTK.exe
  C:\Windows\System\XYryMTK.exe
  2⤵
  PID:9100
- C:\Windows\System\GprUTky.exe
  C:\Windows\System\GprUTky.exe
  2⤵
  PID:9208
- C:\Windows\System\LvGRTJp.exe
  C:\Windows\System\LvGRTJp.exe
  2⤵
  PID:8964
- C:\Windows\System\KgGxDgJ.exe
  C:\Windows\System\KgGxDgJ.exe
  2⤵
  PID:8868
- C:\Windows\System\aeachxB.exe
  C:\Windows\System\aeachxB.exe
  2⤵
  PID:9232
- C:\Windows\System\oZOWozC.exe
  C:\Windows\System\oZOWozC.exe
  2⤵
  PID:9248
- C:\Windows\System\uneCiBC.exe
  C:\Windows\System\uneCiBC.exe
  2⤵
  PID:9264
- C:\Windows\System\lyLNVIF.exe
  C:\Windows\System\lyLNVIF.exe
  2⤵
  PID:9280
- C:\Windows\System\NLmEdij.exe
  C:\Windows\System\NLmEdij.exe
  2⤵
  PID:9296
- C:\Windows\System\HErHsRz.exe
  C:\Windows\System\HErHsRz.exe
  2⤵
  PID:9312
- C:\Windows\System\UIZhIWe.exe
  C:\Windows\System\UIZhIWe.exe
  2⤵
  PID:9332
- C:\Windows\System\RTkqpEL.exe
  C:\Windows\System\RTkqpEL.exe
  2⤵
  PID:9348
- C:\Windows\System\eTaTzsv.exe
  C:\Windows\System\eTaTzsv.exe
  2⤵
  PID:9368
- C:\Windows\System\efIWvuq.exe
  C:\Windows\System\efIWvuq.exe
  2⤵
  PID:9384
- C:\Windows\System\RNSOAAT.exe
  C:\Windows\System\RNSOAAT.exe
  2⤵
  PID:9400
- C:\Windows\System\dBLVINJ.exe
  C:\Windows\System\dBLVINJ.exe
  2⤵
  PID:9416
- C:\Windows\System\MEapOZE.exe
  C:\Windows\System\MEapOZE.exe
  2⤵
  PID:9432
- C:\Windows\System\aynOrBN.exe
  C:\Windows\System\aynOrBN.exe
  2⤵
  PID:9448
- C:\Windows\System\pGFjpCk.exe
  C:\Windows\System\pGFjpCk.exe
  2⤵
  PID:9464
- C:\Windows\System\BOihzCN.exe
  C:\Windows\System\BOihzCN.exe
  2⤵
  PID:9480
- C:\Windows\System\EOEsQVQ.exe
  C:\Windows\System\EOEsQVQ.exe
  2⤵
  PID:9496
- C:\Windows\System\QwiivwZ.exe
  C:\Windows\System\QwiivwZ.exe
  2⤵
  PID:9512
- C:\Windows\System\ZMnJXdJ.exe
  C:\Windows\System\ZMnJXdJ.exe
  2⤵
  PID:9528
- C:\Windows\System\YmwaBaV.exe
  C:\Windows\System\YmwaBaV.exe
  2⤵
  PID:9544
- C:\Windows\System\oviWqpu.exe
  C:\Windows\System\oviWqpu.exe
  2⤵
  PID:9560
- C:\Windows\System\iXHoahb.exe
  C:\Windows\System\iXHoahb.exe
  2⤵
  PID:9604
- C:\Windows\System\oxbTDbl.exe
  C:\Windows\System\oxbTDbl.exe
  2⤵
  PID:9620
- C:\Windows\System\NpRLOVH.exe
  C:\Windows\System\NpRLOVH.exe
  2⤵
  PID:9636
- C:\Windows\System\UCGrtxn.exe
  C:\Windows\System\UCGrtxn.exe
  2⤵
  PID:9656
- C:\Windows\System\ZhoGnzj.exe
  C:\Windows\System\ZhoGnzj.exe
  2⤵
  PID:9672
- C:\Windows\System\RaQipZZ.exe
  C:\Windows\System\RaQipZZ.exe
  2⤵
  PID:9688
- C:\Windows\System\xaQztGU.exe
  C:\Windows\System\xaQztGU.exe
  2⤵
  PID:9704
- C:\Windows\System\MRuTcVD.exe
  C:\Windows\System\MRuTcVD.exe
  2⤵
  PID:9720
- C:\Windows\System\jeLnLjD.exe
  C:\Windows\System\jeLnLjD.exe
  2⤵
  PID:9736
- C:\Windows\System\OILCShZ.exe
  C:\Windows\System\OILCShZ.exe
  2⤵
  PID:9752
- C:\Windows\System\HKYFoAa.exe
  C:\Windows\System\HKYFoAa.exe
  2⤵
  PID:9768
- C:\Windows\System\gkBWYeW.exe
  C:\Windows\System\gkBWYeW.exe
  2⤵
  PID:9784
- C:\Windows\System\miEjMcg.exe
  C:\Windows\System\miEjMcg.exe
  2⤵
  PID:9800
- C:\Windows\System\EWIVybn.exe
  C:\Windows\System\EWIVybn.exe
  2⤵
  PID:9816
- C:\Windows\System\upZflBd.exe
  C:\Windows\System\upZflBd.exe
  2⤵
  PID:9832
- C:\Windows\System\AkihJpo.exe
  C:\Windows\System\AkihJpo.exe
  2⤵
  PID:9848
- C:\Windows\System\vdQFKxD.exe
  C:\Windows\System\vdQFKxD.exe
  2⤵
  PID:9952
- C:\Windows\System\JxeAoMe.exe
  C:\Windows\System\JxeAoMe.exe
  2⤵
  PID:9968
- C:\Windows\System\CrjzDUs.exe
  C:\Windows\System\CrjzDUs.exe
  2⤵
  PID:9992
- C:\Windows\System\EprDKsK.exe
  C:\Windows\System\EprDKsK.exe
  2⤵
  PID:10012
- C:\Windows\System\yiEaXPl.exe
  C:\Windows\System\yiEaXPl.exe
  2⤵
  PID:10028
- C:\Windows\System\hOzMfTH.exe
  C:\Windows\System\hOzMfTH.exe
  2⤵
  PID:10044
- C:\Windows\System\ItjiwsO.exe
  C:\Windows\System\ItjiwsO.exe
  2⤵
  PID:10064
- C:\Windows\System\wFpRVyu.exe
  C:\Windows\System\wFpRVyu.exe
  2⤵
  PID:10080
- C:\Windows\System\oZzogPV.exe
  C:\Windows\System\oZzogPV.exe
  2⤵
  PID:10096
- C:\Windows\System\MRPdlbw.exe
  C:\Windows\System\MRPdlbw.exe
  2⤵
  PID:10112
- C:\Windows\System\Tyqjlup.exe
  C:\Windows\System\Tyqjlup.exe
  2⤵
  PID:10128
- C:\Windows\System\TRcdhaI.exe
  C:\Windows\System\TRcdhaI.exe
  2⤵
  PID:10236
- C:\Windows\System\jvWEXeo.exe
  C:\Windows\System\jvWEXeo.exe
  2⤵
  PID:9256
- C:\Windows\System\DuaoodA.exe
  C:\Windows\System\DuaoodA.exe
  2⤵
  PID:9276
- C:\Windows\System\wtmcRyr.exe
  C:\Windows\System\wtmcRyr.exe
  2⤵
  PID:9308
- C:\Windows\System\XfviuLv.exe
  C:\Windows\System\XfviuLv.exe
  2⤵
  PID:9320
- C:\Windows\System\XCFSvvG.exe
  C:\Windows\System\XCFSvvG.exe
  2⤵
  PID:9392
- C:\Windows\System\KqbCNMG.exe
  C:\Windows\System\KqbCNMG.exe
  2⤵
  PID:9412
- C:\Windows\System\INsNShE.exe
  C:\Windows\System\INsNShE.exe
  2⤵
  PID:9444
- C:\Windows\System\COKTtXo.exe
  C:\Windows\System\COKTtXo.exe
  2⤵
  PID:9540
- C:\Windows\System\mbVRTai.exe
  C:\Windows\System\mbVRTai.exe
  2⤵
  PID:9424
- C:\Windows\System\MysVPHm.exe
  C:\Windows\System\MysVPHm.exe
  2⤵
  PID:9488
- C:\Windows\System\ZKQsatn.exe
  C:\Windows\System\ZKQsatn.exe
  2⤵
  PID:9552
- C:\Windows\System\XVgJxUb.exe
  C:\Windows\System\XVgJxUb.exe
  2⤵
  PID:9580
- C:\Windows\System\ECqzLGl.exe
  C:\Windows\System\ECqzLGl.exe
  2⤵
  PID:9596
- C:\Windows\System\rlVWIhW.exe
  C:\Windows\System\rlVWIhW.exe
  2⤵
  PID:9844
- C:\Windows\System\DwpacJJ.exe
  C:\Windows\System\DwpacJJ.exe
  2⤵
  PID:9868
- C:\Windows\System\iMJxlRY.exe
  C:\Windows\System\iMJxlRY.exe
  2⤵
  PID:9884
- C:\Windows\System\BWFNIen.exe
  C:\Windows\System\BWFNIen.exe
  2⤵
  PID:9900
- C:\Windows\System\jDoIhuN.exe
  C:\Windows\System\jDoIhuN.exe
  2⤵
  PID:9940
- C:\Windows\System\SJAdMCj.exe
  C:\Windows\System\SJAdMCj.exe
  2⤵
  PID:9976
- C:\Windows\System\XKIeZMD.exe
  C:\Windows\System\XKIeZMD.exe
  2⤵
  PID:10024
- C:\Windows\System\lFXOwXB.exe
  C:\Windows\System\lFXOwXB.exe
  2⤵
  PID:10092
- C:\Windows\System\BbCAMtk.exe
  C:\Windows\System\BbCAMtk.exe
  2⤵
  PID:10136
- C:\Windows\System\IsEbdUl.exe
  C:\Windows\System\IsEbdUl.exe
  2⤵
  PID:10076
- C:\Windows\System\drSJiKF.exe
  C:\Windows\System\drSJiKF.exe
  2⤵
  PID:10036
- C:\Windows\System\GHyavEw.exe
  C:\Windows\System\GHyavEw.exe
  2⤵
  PID:10144
- C:\Windows\System\IWrAJZm.exe
  C:\Windows\System\IWrAJZm.exe
  2⤵
  PID:10156
- C:\Windows\System\BWrEjjL.exe
  C:\Windows\System\BWrEjjL.exe
  2⤵
  PID:10180
- C:\Windows\System\LuJtPmH.exe
  C:\Windows\System\LuJtPmH.exe
  2⤵
  PID:10192
- C:\Windows\System\kPErHtS.exe
  C:\Windows\System\kPErHtS.exe
  2⤵
  PID:10216
- C:\Windows\System\IOyQleB.exe
  C:\Windows\System\IOyQleB.exe
  2⤵
  PID:10232
- C:\Windows\System\CvJhMSt.exe
  C:\Windows\System\CvJhMSt.exe
  2⤵
  PID:9344
- C:\Windows\System\MMWEJQD.exe
  C:\Windows\System\MMWEJQD.exe
  2⤵
  PID:9508
- C:\Windows\System\pLvFDLR.exe
  C:\Windows\System\pLvFDLR.exe
  2⤵
  PID:9524
- C:\Windows\System\hrvheQy.exe
  C:\Windows\System\hrvheQy.exe
  2⤵
  PID:9224
- C:\Windows\System\UfLbNrZ.exe
  C:\Windows\System\UfLbNrZ.exe
  2⤵
  PID:9520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Adiqcbt.exe

Filesize
1.4MB

MD5
2fd553d6ad12922674377a506e079521

SHA1
15867e519390c426c997c11808bf00594beef232

SHA256
140b36beea4e2432fcc3b347b7b0a1fdc5a4088ab729dce9fb158cb54a235f16

SHA512
b21abec07c77d18f0392c22c22958e0ad244e08aa3feba38ee365e206d705db2ec5532d5b82e8b9935adc907de8a5dc0066212f8199ecf8d79de89b4943f1362

Download Submit
C:\Windows\system\CEYeXvq.exe

Filesize
1.4MB

MD5
4715e452e288c8ee919e78cb9eab9713

SHA1
2d6040344b0c778a9455fc7323c1fb5ff0720a22

SHA256
4581a59b160598ca761b92c1cf2ad038f1ffa2826e9aec81868596c4e1284078

SHA512
54d466d684bd3c94d1f6e3805606cde19275d12f8cf87f60ae5515bd1d398d3a65baa7242f3a184cf85adcd677e5fcb04e664f2daac7ec715d22229d5e2b8b0e

Download Submit
C:\Windows\system\HfJFrhN.exe

Filesize
1.4MB

MD5
4b75c9b8d611592a294721e5dda2d573

SHA1
cab681a5e9a9733ba6a2818ee80ecd2bf914a533

SHA256
74a10ed96805709f2806f245b750d4e784d8e642df7fb4b25abf189e024d4a09

SHA512
e76893be6662d0c4a7e25b409aaa2673a1e8cc26b2bbc92dda38c95da6275f1dfbb3d84163c674c81050f385be2cb272a424b0b5a0d0b5284639313cadf9ba2e

Download Submit
C:\Windows\system\IHwJQQT.exe

Filesize
1.4MB

MD5
301e87021f59ba21431aee8952b4be06

SHA1
5df8ffc73f3985153856aa06bd85fbf30cb693ed

SHA256
d1e71dd69d6f2a9966eb4125cec50038efad32c96f28c058f607c87c40f6559e

SHA512
de519c9aa89d5c889af2b3efed6f3d3000ba0fc40b7b90516422b1caef8318e1b52fd61e071a6424182af941e1c2f19bc5a939cc93a929bebab7ae5134406331

Download Submit
C:\Windows\system\NmEayrG.exe

Filesize
1.4MB

MD5
47af0319e58097907b6c1f4deec227f3

SHA1
efccfec64e5ff8d8eb2027f9c20c209457db004b

SHA256
0a0148bc879e2fa673897fdcc3a6cedef1e6a81888a8e55e1d67c77cfb4d7729

SHA512
6fde44db5349ebb88a40feb71ab26ce546d2171327056b1811084543115dfd329674955c4043e4a58d34f1538b6b299eea2943e4629b7911426a32b83a054dda

Download Submit
C:\Windows\system\OiIFvZw.exe

Filesize
1.4MB

MD5
36c7d98724d0bb14c9f17faf2d50bf59

SHA1
bd43ef55d8f55d16ca129c05a2523c85c5ed9fd7

SHA256
70dceafa662be9276a511052236664d196a00f4916d1705cb02b616d6181c675

SHA512
4453a8092bf5f62c1a79086e9c39fecc1b63b5989bdece9e6fcf01ac23e79e87607ae4a9417c9d69257f9e6682143a3848a514986cf4ddc67e9476ceaf896157

Download Submit
C:\Windows\system\PUwHwja.exe

Filesize
1.4MB

MD5
85f0bf00ddd99f6d948451fd2470e803

SHA1
3d4a82a8f58bd576afd0ddb53b2b4991c0eee25f

SHA256
386ac4c40d2a354d21fb0974d664d235309ac44086cf263d9c58271e11b0f845

SHA512
cf0caa6b10b0aac1d8a484ba8c11813a6aee3fbf5b63d5b759bf058f6f47794f01487dc3ea2f0424fcbafc8527e1000cda31af0fb106a0fb1c3fac815ea2f33a

Download Submit
C:\Windows\system\QOtOpsg.exe

Filesize
1.4MB

MD5
76f8c173caf209aac5afbcddc7064839

SHA1
a0deb0c2759f6543ec628d072bafe1cf845db9c1

SHA256
3157e87cb87d16a5072b3db93804aa9d1c8b4e369e813678110e44f5c1f352bf

SHA512
f1f8ee6c785679539fbfea5019035475d175528cc75742fedab79e36ed536c25bd9c5e1d485d44630a15b033846a8fed489eb5b05cee5693ebf7a1da03910533

Download Submit
C:\Windows\system\UHFEjVY.exe

Filesize
1.4MB

MD5
85ee8349326786c0c20d05cfd14291d4

SHA1
2dc65e87b171d3718290def12417305a54284b34

SHA256
4ad0a20ccdaa49985d19bb9620d79c1168a16d8b1b1ec74ba3f346786a6a0ec5

SHA512
a17037cd3108940423ca6a7b827ef4c9f1987a1daf814a259536049edb1c65686295be9040de1626115e6f8ed91e6bd1939f3e365ec3a87dc997ba54ccbf8d4f

Download Submit
C:\Windows\system\YsNRqLZ.exe

Filesize
1.4MB

MD5
02e221dd8d7118357331de67ecd9a019

SHA1
d68b947999d8e0f010429880835ebef191d55a02

SHA256
b778633b80b57a173a8284cf33118ad049c4a27be86c214ee52202202d3fdab5

SHA512
f98fe3cbe08581f6483e0aa04b0867d5735e4275fff8f23a5d9cc109066156d652edeb53df12fa7c54c264f610e3b8912654bfee9c59dd34fd297b14f0478772

Download Submit
C:\Windows\system\ZTHoHpJ.exe

Filesize
1.4MB

MD5
492b7c1d45c29c5cc3ae1a1004e5417e

SHA1
e0714e4166e4a27c3cc6a863e95c8a70cae56eef

SHA256
542f940ab3fc0b510b655b06205244f28a1fc69eb7879aafcbe7610076e785a6

SHA512
fca980c3d7547812076016806b5c6156fa8db43c1c5db1538688f139d0dc45ee98f69042c08484d2aa78f170a4eb7349e86eb1a472f8384899729fe9e922e71d

Download Submit
C:\Windows\system\dJQLeqR.exe

Filesize
1.4MB

MD5
1b0a9c7460810dbd61f70b18281a062c

SHA1
a314253a51dd30dd9b5bd0a2e9580b65ef6eb250

SHA256
2559b5a38b12ff45d33c5c71553284a2cfcee186516796c9172a1b8379a0bd37

SHA512
cc6123c2343c3a69cbfd9220b08eddbbfabdaf70a1742e63ec66d7575247f47e8f8dce88ee1598eaa4d5796541db6d97c627e62cedea578758545f675fe2d1b8

Download Submit
C:\Windows\system\eNadYlt.exe

Filesize
1.4MB

MD5
9d562b09f390aef90f62195602c7e01b

SHA1
33cd17fd1a0d6f1d37c55b425dcee9b0d4dfc343

SHA256
e24972b25e393b25f256b92a8bd3ebc939ffc6d946dd69dd4eb1d915661982f3

SHA512
2867f95670fb0df4ac0d12674602dc3234a004b3e945ce0c2bdf94cf0c6dd1d2a2f4e403bf0a0b3bccbc58624192c2ce6916de9d671ff153cd89e3841fc1546a

Download Submit
C:\Windows\system\jUJEpWi.exe

Filesize
1.4MB

MD5
d29e15633a1cada7045c43091fd0b3b0

SHA1
cf9af9f4c4c3af567608ce4d0ff6a17d4c88261e

SHA256
faa190c187524e571577bdbdac53bf4642c214e2397a1264224a50239ad156d4

SHA512
2b112049ad0b77bc19a70b3c496dfe726b67bc69aae6ef1842702633715eee9af490d48754b8c3a87938685964ef333ed126d8665df514e0f98d3d93db07006a

Download Submit
C:\Windows\system\lELHPFQ.exe

Filesize
1.4MB

MD5
4af9745c9bf594b459b3425198204ee5

SHA1
f435ab36b0569c125335c8c3f233537fb2672c1c

SHA256
b7a40de1f08dc9fe189e01b7b843b5a7a196324fb64449ad5e73369a6a4995cf

SHA512
8163568c086c7f4c3cd4b2c6c87d2ba90c5346b50f03f30e414828d7818feb0db8cbcf2d305d5c65f9e5ea52ca6f539f0715abd9d4debce5d57ec489b096d0fd

Download Submit
C:\Windows\system\mHmOCeF.exe

Filesize
1.4MB

MD5
94139e7d8e48cd7929795ff9a5043d92

SHA1
2355827e1ca89a4e2a607212a3d6c6eca3391265

SHA256
3a381a20e1de0e593a88a12edcd848068b7c439de3ed7ffef14aee3c51aa0419

SHA512
a9103867fd396bf3fbfc98e0d8f5139ca77ad003d3095ead501508749033d02b4decea16df5953ebd9f18d3911f2fdf0381e6da8644160bddfee98ddc2e960e2

Download Submit
C:\Windows\system\moEIuwD.exe

Filesize
1.4MB

MD5
20f8eb44496c7613a5aae0431ccacd18

SHA1
cf7e31c83a5c7c4df89561822ddacb74fab20338

SHA256
6a1d97bddf4cb2633ac9e22222de53f1baa103c51085cd9f43ff652946f8628b

SHA512
4f89cd441e3818c2b6d489368d69096708a274842312ae0d06825bbbef9d33a6598d5194b08c12f75856b39f72fedc9a14d6eb861b98cfcda2a19fdbd6240761

Download Submit
C:\Windows\system\nHfUsGY.exe

Filesize
1.4MB

MD5
b77bab5e0d7ebff16249944a7213b73c

SHA1
cefbc8d753ba7427ef8072f7251f11a6ebd7f167

SHA256
bc1ee12a387177761c3a48781044e3f942b92c21aab7cee31bbb835837b68289

SHA512
760869271290efb078bb7a591f89597adc2a49faaed2326432e9834ce67399f061666f63fd3b039f752e09a079eda059c93aba4be0edbb0248a73e5567625f5b

Download Submit
C:\Windows\system\sJhUyBD.exe

Filesize
1.4MB

MD5
d11f45bea9fd4d9cc1057883e3facc3e

SHA1
0f7a33b58529ffa2be997aa49df578a7692a35ce

SHA256
c49b29cee8498036c5e2a4f2bf046f34894bddb7931f01620ccba0404ce00933

SHA512
5d4485e6617cc6bc1eae8d28f67fece11dfd7bc33b4ef10f661bae1087b358d2dd17436253b5ac3d5e99eab8efcbfafebfac768f8ae48ed2618f294215a242f0

Download Submit
C:\Windows\system\sSkpZri.exe

Filesize
1.4MB

MD5
5148ecea2c2b79c55da358b87791f22a

SHA1
a00a695930e05a94ade073792e636a9922a491a3

SHA256
572576dc5b9e1e997341e2462abcf1b8d9c4d4a8e057538c9ed031c447a08586

SHA512
f8018dc1ff6976002ec0cae4c3d8d95a5ccdbf189a488f07461dcab1c9a41f1d082a8b502994bf0a0d0dcd19dd03a08ec2f138569d757e4e187566eb18321558

Download Submit
C:\Windows\system\sUPcgNC.exe

Filesize
1.4MB

MD5
26adf5414f00fa515da60c38e5b294a2

SHA1
7c36a52dec4a17c59eb7b575757b66f168bc6c00

SHA256
f91e74227d0ac6c976f16a89f9f423ecf7664a12ffc6a8f5b2706c46f89e5c38

SHA512
364f6c9c4035b56eb62e6f1b780a8546445cb9b3c99222675729e8185d91285b66091edd568f306391b6f3ac644a9f20d60d95dae1f90cb503516ff3512b697c

Download Submit
C:\Windows\system\uRpWqxp.exe

Filesize
1.4MB

MD5
00b4a6310d19ff9737be7116778f157e

SHA1
17d35bd789298ca803ed853c8edfd425d1ddc1e1

SHA256
da6c85730fb41c5ac919688315a29b053786be225e1a28d52c754fb588ca7c9f

SHA512
7ebb5098cfc3ac9897dd50451d4247f163f6f047547396f6600954c247c43511576044bace6c4bbfbb8254604ec4d6b261fbf2bf83ee819f96c4659f6326db1d

Download Submit
\Windows\system\ObrTZjs.exe

Filesize
1.4MB

MD5
15c7daa25ee76fcc88b97aabe1953e23

SHA1
b50ba94f5b810141da26a09f94f2a9ba59e4ca5d

SHA256
6e66d62f596e4df9ddf9b72d5e740831fca82ad0352f4ab4381ce77ae1401084

SHA512
0564ac7e3d47c66938b65e94bed5262dd1ff0c61f130da6c0fc2eea2913694d8bcea01c4d5ec63bcfc4a9badfa01dbb075bccdc1ac085c905f3fb7141053de15

Download Submit
\Windows\system\VchHyMs.exe

Filesize
1.4MB

MD5
d9a94868e17f15874680df0d3c371835

SHA1
4237ff7d9d78c8aacbc192445b614edb2876432f

SHA256
39a989ce181fc656969c637dc0bd4cda7f073ad3f912de5f7e6dd9780e601b08

SHA512
5e74f696f6dc07277b0d45028e829ade7d2304244e13abcd931b4801956d6548d6237c8639b90a08988f8bd097764de6f62f0232d14c1677e33b91a67a4f6395

Download Submit
\Windows\system\WaIBSFe.exe

Filesize
1.4MB

MD5
db33b1a61125a8f7919df183ebbc804d

SHA1
f12ebe7c4bf0415dff09bd8e02eb3688834e8b2e

SHA256
7e4f4ef5c6382734cf1487ba8611237ffa841f30c498f518d31669cf9d094857

SHA512
b4d97ba4f0e02f754ad1723a8aa69025ffb5fb3d442d60625100dbc113f27ab6dc98265b3d5d8930aaf52a1f617f2d00ebadc193c70bb51fbdd2bd4e952aba51

Download Submit
\Windows\system\YLJNXhv.exe

Filesize
1.4MB

MD5
9321f86bd5a0d122bc0459433092f858

SHA1
897ec51c79ea9a2b102e166abc0e15923861b923

SHA256
89226f1ed44927dd37fa03ee7af894518920ff7c4fac7126e800dc374ae98179

SHA512
c28e36e66feef456778e65965507631ecf9f00af8dbb8970b9bc9b3203c380daae4f141aace8714316e5fc4944f3a81fa22c8eb173f699a21a7cf75ded328b2c

Download Submit
\Windows\system\afnfZwY.exe

Filesize
1.4MB

MD5
feb3fe0cd626916dcf5fa2972d00d75f

SHA1
e09b259e8cb2428751402c91ce3953873bb09f3e

SHA256
005341a238efa7b4005fb3d167825599c92a1d9810eba006fe855a8fc2cc991c

SHA512
302883a23f5f819e1f6f03aba70c62c8d2f839882e7b1a8edd8bef78036b44e1e1a821f27efc9d56cfa30bb2f37f9393e0ea1fe5a1dfe41963c68a42bb5c6692

Download Submit
\Windows\system\bMxUXLf.exe

Filesize
1.4MB

MD5
051032056a1d28689ebb4da3d4b56476

SHA1
7444aeb2d3618536b4ccd5389c194b509b6aad19

SHA256
59eafe83c49076cd9ab1f298d5a481f8d1ac542854b1256e3c1f6d513d0385a2

SHA512
19106cfb0144dbcf939b38af61ef0ac5a72923c3a8bf418cfb0f99fedbfd5e57cef503a3f2b4813d10e55a4516e48edbe4aeabd702e4b31f46e3196c163169bc

Download Submit
\Windows\system\eeGbjwf.exe

Filesize
1.4MB

MD5
8d3c53b0f32bb840814a900abe5d27c6

SHA1
5d7198bfdcf67fd277d217afa6283cb1fef7f9d7

SHA256
b568c8b3f53da26127681cb1ce2332b35415e42ed682eccdcc518a5f65f70ac3

SHA512
2a3ab98a83049a33e6f6f2d30853ffbc8e5a16860752cedc784a4daaf7badb41b4779af2fc9ba595ff1f7ea31bb8d1dedd0c4d96396f328640ba9527f5c7bc8d

Download Submit
\Windows\system\kgTtCds.exe

Filesize
1.4MB

MD5
c35681189541677dad80d3c30bd2843c

SHA1
3b68b47cd51359add4a09634e0c5f51d66eaba86

SHA256
12374a7118bd80d4402165b419c5ccf207055d68fae6dc7586cd8f717ad28850

SHA512
c3ca9f6285c72140de9293d017630948430d75469579ac9ec490aeef5c3ee50b970f70de35fde7db3f8b55029872121589df67392f34da2d2c8c2d710faceaf5

Download Submit
\Windows\system\oxbyqRx.exe

Filesize
1.4MB

MD5
09e79510143bd4760bf5f42ce77a1148

SHA1
69edecaec78779b3bd8f88dffb5b9924ccea2f22

SHA256
625d920ee89687adb100e632538049daf5e116dffb19a28ddfc9f62244bc7f15

SHA512
6807bb9cd4d8bd8505bebf097a37f36303cec90ec66d9465e66d96db2f9e5bea6d6389f3177cf98be2cd5ff76d929b9b839646191313a0d982ee8d8d5b0ac17e

Download Submit
\Windows\system\scfVyfl.exe

Filesize
1.4MB

MD5
0cb529219d40e8986c8cfa808c8b1566

SHA1
666ce7edf19a055cbaed56d651f96217b336b9e8

SHA256
5cd82f2058140ef7e3a973cbab108ac1062100d65d92f82b69dd0f274a814def

SHA512
1f50106ffdf02f6408d8e2b8d4036483dd00a59ec9ac7b122a7bda5a82b14e59a94783af7ab6e860d09ea387e87cd840e981060b6384dd7a65580f43d6d50ae8

Download Submit
\Windows\system\unFhyzP.exe

Filesize
1.4MB

MD5
ac2ddf34db949717e06284de3692bb93

SHA1
fa47d824d9b3a091d8604a5264d68a02a1280e2d

SHA256
9eacfcea2bcf7e1d63eaf93e38287eaa100af5247426c078268a43ada74dc2cf

SHA512
11c6fa6fac246b8cfdf2f327dec3237a2da4e3e3bcd64a2ebe187ab44f09bcf00f62384b555b7b02c27ac7da5f7d2247f2d415bcbcb5c32d47a58f7d88a81802

Download Submit
\Windows\system\xzrUoUY.exe

Filesize
1.4MB

MD5
7b2f8621bbd596c3ce654d1f157c930f

SHA1
e46b1f124575f37f9660d852cc18581441eb26fa

SHA256
92a5f5a8ff2bef547ad6043d4f0e678483ef65ddaf481176331cac8388d35ecc

SHA512
48f0ddc2f7ab03d141cc2154beeac0322da4bf90ee78d99d58b3ee0ada59838e61804c1e10b58eacc548e0fda3a56a0f89541e62091d89f1e8bf20d77ed58658

Download Submit
\Windows\system\ybAtCnc.exe

Filesize
1.4MB

MD5
d4d2b1c1e8caaaf549d18114dda48748

SHA1
55dbc30e383cef4df57a4d3dcf4779b2237f2aae

SHA256
d97626f94a7688f6e1deba34393d72bbe512c4f985e1253aa10ce7b2a2ae07bf

SHA512
962b6e23b1174665b9ea8e2909a4ee07fa25167fe84f84f841a4041cc6ff4cb9627830c36abb23ad3674d2325c1679c2c903489681f0faab74e184663fb9269b

Download Submit
memory/332-67-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1684-78-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2172-57-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-39-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2172-15-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

Filesize
4KB

Download
memory/2172-99-0x0000000002050000-0x00000000020D0000-memory.dmp

Filesize
512KB

Download
memory/2172-14-0x0000000002050000-0x00000000020D0000-memory.dmp

Filesize
512KB

Download
memory/2172-118-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-48-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/2172-41-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-102-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2368-13-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2440-51-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2496-94-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2496-85-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2496-66-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2496-50-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2496-75-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2496-52-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2496-2-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2496-8-0x0000000002EA0000-0x0000000003292000-memory.dmp

Filesize
3.9MB

Download
memory/2496-42-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2496-45-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2496-60-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-47-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-98-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2496-97-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2576-49-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-53-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2644-86-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-80-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-46-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2848-44-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2916-61-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download