xmrig | b401487bc8b5b87f28f3a42a7b76d250d26aa68169d0b65ff64ad2c15b580b78

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
Size

2.8MB
MD5

1586689957b6eabd23350e2f28a9cc3c
SHA1

d0690cba5911cdefb023415e542eb16d58e5db30
SHA256

b401487bc8b5b87f28f3a42a7b76d250d26aa68169d0b65ff64ad2c15b580b78
SHA512

b41361b7b5f1aa6d12f1cbabba45df6298902a949f21e9ad407899c8b3b818ab27f9d29f37e860efe703221adb8de884677f039e152f359345394e76d231e3e2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/8:NABh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2868-20-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2436-63-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2596-60-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2692-58-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2628-55-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2616-21-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2240-1154-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2692-1630-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2596-1633-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2628-1631-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/576-1635-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2436-1724-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2616-1730-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2868-1731-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2396-1733-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2800-1717-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/568-1715-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2420-1745-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2984	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2800	nIEHXIv.exe
2868	QhpSORQ.exe
2616	NBljmUQ.exe
2628	OVQzjcc.exe
2692	xtLjfeP.exe
2596	jWFFukn.exe
2436	PLZDaOX.exe
2420	eZjHYTL.exe
2396	MEqxvtl.exe
568	JxUVJvS.exe
576	tapvdvD.exe
1852	hjSgXLB.exe
1788	OBsNZws.exe
2188	iPWKXGW.exe
2316	rkOxDJA.exe
1996	XwgQWEv.exe
1956	nAZfoij.exe
2172	AhJqYhl.exe
2380	VEgpcDq.exe
2668	idCSspI.exe
1988	gmBVczU.exe
1976	kvIAjLc.exe
2328	JDdbXgo.exe
1660	chlrMPm.exe
308	ryzFakJ.exe
240	EyVWmQm.exe
2080	QKVXgsV.exe
3016	XdVYOIP.exe
2748	byolWyA.exe
2960	bhktfyB.exe
2932	vNjrErk.exe
2124	MEOzVsr.exe
1704	GCFMMVT.exe
2068	vtNGSqD.exe
3060	SDQmEkY.exe
1628	VwLWqMN.exe
1084	KozVOSx.exe
1016	laenXLN.exe
1320	vkQXACq.exe
816	tDtVMPH.exe
828	BwHHqgV.exe
1244	vZmPGsM.exe
1200	xTdmKPQ.exe
1252	dwytWHk.exe
320	NiYmSzx.exe
3028	tOaayTp.exe
300	RGhMLGT.exe
1152	WMhAxVn.exe
2088	LgZRUsw.exe
1720	AZGhOMG.exe
2900	tLEIddp.exe
1340	tzUZLwl.exe
892	QWolatp.exe
752	BsFrxxs.exe
756	EmLULQL.exe
1592	AhGtTfj.exe
1716	KWvLRrF.exe
2488	GxVPBzV.exe
2116	xFkIrtG.exe
1992	TyMZCEu.exe
2704	vqqCyPY.exe
2532	HrLveGg.exe
2608	JMWUnxj.exe
2592	eUTtMLN.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/files/0x0009000000015c5d-3.dat	upx
behavioral1/memory/2868-20-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0027000000015d88-11.dat	upx
behavioral1/memory/2436-63-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x0007000000015e6f-34.dat	upx
behavioral1/files/0x0005000000019377-124.dat	upx
behavioral1/files/0x00050000000192c9-97.dat	upx
behavioral1/files/0x0005000000019368-135.dat	upx
behavioral1/files/0x0005000000019410-147.dat	upx
behavioral1/files/0x00040000000194d6-176.dat	upx
behavioral1/files/0x00040000000194dc-183.dat	upx
behavioral1/files/0x00050000000194e8-187.dat	upx
behavioral1/files/0x0005000000019485-167.dat	upx
behavioral1/files/0x00040000000194d8-180.dat	upx
behavioral1/files/0x00050000000194a4-170.dat	upx
behavioral1/files/0x000500000001946f-156.dat	upx
behavioral1/files/0x0005000000019473-160.dat	upx
behavioral1/files/0x000500000001946b-150.dat	upx
behavioral1/files/0x00050000000193b0-141.dat	upx
behavioral1/files/0x000500000001939b-137.dat	upx
behavioral1/files/0x000500000001931b-109.dat	upx
behavioral1/files/0x0006000000018ba2-88.dat	upx
behavioral1/files/0x0007000000018b6a-80.dat	upx
behavioral1/files/0x0005000000019333-114.dat	upx
behavioral1/files/0x00050000000192f4-105.dat	upx
behavioral1/memory/2396-69-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-66.dat	upx
behavioral1/files/0x0006000000018d06-94.dat	upx
behavioral1/files/0x0006000000018b96-85.dat	upx
behavioral1/memory/576-78-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/568-77-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0016000000015db4-74.dat	upx
behavioral1/files/0x0006000000018b4a-45.dat	upx
behavioral1/memory/2420-64-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2596-60-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2692-58-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x0009000000015ec0-32.dat	upx
behavioral1/memory/2628-55-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x0006000000018b73-52.dat	upx
behavioral1/files/0x0007000000016c23-39.dat	upx
behavioral1/files/0x0007000000015e7c-30.dat	upx
behavioral1/memory/2616-21-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x0008000000015e5b-17.dat	upx
behavioral1/memory/2800-16-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2240-1154-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2692-1630-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2596-1633-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2628-1631-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/576-1635-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2436-1724-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/2616-1730-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2868-1731-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2396-1733-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2800-1717-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/568-1715-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2420-1745-0x000000013F580000-0x000000013F972000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bIImDYg.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\KozVOSx.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\zrJRlKY.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\hHOoqMf.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ZwcGqsL.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\iwRjuMK.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\tWXquhr.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\xAKNRCZ.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\xiIVjmV.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\NDVOyHk.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\BQjrxlf.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\jVznzje.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\QZlhsWe.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\WksnNzd.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ndVeOdM.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\IRBvovh.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\UXBoqFc.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\awpjImg.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\uViWecE.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\DQHRlRm.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\EPMIewp.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\JyYdTeY.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\KWrQeLN.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\GySKfDA.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ViwPsee.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\rCBIStO.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\chlrMPm.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\mPbdrHy.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\sJnVEyW.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\EtusIut.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\iDuGMCD.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\vgHJfol.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\CYmZiBd.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\TGzdpEG.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\StutFQj.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\LODosIn.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\MaKIkNA.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\HFJdjoq.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\tMxshfR.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\wvIQJnV.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\VEgpcDq.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ryzFakJ.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\YtcUkLz.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\zcsYjXp.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\NmqBJpL.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\POWtiKN.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\IhrEMKq.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\RNVJcjZ.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\ZiVHVpC.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\QauIOyZ.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\MuyjoeK.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\dAdUhLk.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\HKkUgSn.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\bvQgVqU.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\aRNkeku.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\MNUrktB.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\YpQpKpv.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\vEZtMYm.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\gqzdjhP.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\AYyMLuB.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\XgtyGTK.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\SkdEExp.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\udnjrzd.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
File created	C:\Windows\System\uNSWXcd.exe	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeLockMemoryPrivilege	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2984	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2984	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2984	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	29
PID 2240 wrote to memory of 2800	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2800	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2800	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2868	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2868	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2868	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2616	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2616	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2616	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2692	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2692	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2692	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2628	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2628	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2628	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2420	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2420	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2420	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2596	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2596	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2596	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2396	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2396	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2396	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2436	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	38
PID 2240 wrote to memory of 2436	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	38
PID 2240 wrote to memory of 2436	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	38
PID 2240 wrote to memory of 576	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	39
PID 2240 wrote to memory of 576	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	39
PID 2240 wrote to memory of 576	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	39
PID 2240 wrote to memory of 568	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	40
PID 2240 wrote to memory of 568	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	40
PID 2240 wrote to memory of 568	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	40
PID 2240 wrote to memory of 2316	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2316	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2316	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	41
PID 2240 wrote to memory of 1852	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	42
PID 2240 wrote to memory of 1852	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	42
PID 2240 wrote to memory of 1852	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	42
PID 2240 wrote to memory of 1956	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	43
PID 2240 wrote to memory of 1956	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	43
PID 2240 wrote to memory of 1956	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	43
PID 2240 wrote to memory of 1788	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1788	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1788	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	44
PID 2240 wrote to memory of 2380	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	45
PID 2240 wrote to memory of 2380	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	45
PID 2240 wrote to memory of 2380	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	45
PID 2240 wrote to memory of 2188	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	46
PID 2240 wrote to memory of 2188	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	46
PID 2240 wrote to memory of 2188	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	46
PID 2240 wrote to memory of 2668	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	47
PID 2240 wrote to memory of 2668	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	47
PID 2240 wrote to memory of 2668	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	47
PID 2240 wrote to memory of 1996	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	48
PID 2240 wrote to memory of 1996	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	48
PID 2240 wrote to memory of 1996	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	48
PID 2240 wrote to memory of 1988	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	49
PID 2240 wrote to memory of 1988	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	49
PID 2240 wrote to memory of 1988	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	49
PID 2240 wrote to memory of 2172	2240	1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1586689957b6eabd23350e2f28a9cc3c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\System\nIEHXIv.exe
  C:\Windows\System\nIEHXIv.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\QhpSORQ.exe
  C:\Windows\System\QhpSORQ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\NBljmUQ.exe
  C:\Windows\System\NBljmUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\xtLjfeP.exe
  C:\Windows\System\xtLjfeP.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\OVQzjcc.exe
  C:\Windows\System\OVQzjcc.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\eZjHYTL.exe
  C:\Windows\System\eZjHYTL.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\jWFFukn.exe
  C:\Windows\System\jWFFukn.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\MEqxvtl.exe
  C:\Windows\System\MEqxvtl.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\PLZDaOX.exe
  C:\Windows\System\PLZDaOX.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\tapvdvD.exe
  C:\Windows\System\tapvdvD.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\JxUVJvS.exe
  C:\Windows\System\JxUVJvS.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\rkOxDJA.exe
  C:\Windows\System\rkOxDJA.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\hjSgXLB.exe
  C:\Windows\System\hjSgXLB.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\nAZfoij.exe
  C:\Windows\System\nAZfoij.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\OBsNZws.exe
  C:\Windows\System\OBsNZws.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\VEgpcDq.exe
  C:\Windows\System\VEgpcDq.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\iPWKXGW.exe
  C:\Windows\System\iPWKXGW.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\idCSspI.exe
  C:\Windows\System\idCSspI.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\XwgQWEv.exe
  C:\Windows\System\XwgQWEv.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\gmBVczU.exe
  C:\Windows\System\gmBVczU.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\AhJqYhl.exe
  C:\Windows\System\AhJqYhl.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\kvIAjLc.exe
  C:\Windows\System\kvIAjLc.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\JDdbXgo.exe
  C:\Windows\System\JDdbXgo.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\chlrMPm.exe
  C:\Windows\System\chlrMPm.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ryzFakJ.exe
  C:\Windows\System\ryzFakJ.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\EyVWmQm.exe
  C:\Windows\System\EyVWmQm.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\QKVXgsV.exe
  C:\Windows\System\QKVXgsV.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\XdVYOIP.exe
  C:\Windows\System\XdVYOIP.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\byolWyA.exe
  C:\Windows\System\byolWyA.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\bhktfyB.exe
  C:\Windows\System\bhktfyB.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\vNjrErk.exe
  C:\Windows\System\vNjrErk.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\GCFMMVT.exe
  C:\Windows\System\GCFMMVT.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\MEOzVsr.exe
  C:\Windows\System\MEOzVsr.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\vtNGSqD.exe
  C:\Windows\System\vtNGSqD.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\SDQmEkY.exe
  C:\Windows\System\SDQmEkY.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\VwLWqMN.exe
  C:\Windows\System\VwLWqMN.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\KozVOSx.exe
  C:\Windows\System\KozVOSx.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\laenXLN.exe
  C:\Windows\System\laenXLN.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\vkQXACq.exe
  C:\Windows\System\vkQXACq.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\tDtVMPH.exe
  C:\Windows\System\tDtVMPH.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\BwHHqgV.exe
  C:\Windows\System\BwHHqgV.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\vZmPGsM.exe
  C:\Windows\System\vZmPGsM.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\xTdmKPQ.exe
  C:\Windows\System\xTdmKPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\dwytWHk.exe
  C:\Windows\System\dwytWHk.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\NiYmSzx.exe
  C:\Windows\System\NiYmSzx.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\tOaayTp.exe
  C:\Windows\System\tOaayTp.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\RGhMLGT.exe
  C:\Windows\System\RGhMLGT.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\WMhAxVn.exe
  C:\Windows\System\WMhAxVn.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\LgZRUsw.exe
  C:\Windows\System\LgZRUsw.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\tLEIddp.exe
  C:\Windows\System\tLEIddp.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\AZGhOMG.exe
  C:\Windows\System\AZGhOMG.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\tzUZLwl.exe
  C:\Windows\System\tzUZLwl.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\QWolatp.exe
  C:\Windows\System\QWolatp.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\BsFrxxs.exe
  C:\Windows\System\BsFrxxs.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\EmLULQL.exe
  C:\Windows\System\EmLULQL.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\AhGtTfj.exe
  C:\Windows\System\AhGtTfj.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\KWvLRrF.exe
  C:\Windows\System\KWvLRrF.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\GxVPBzV.exe
  C:\Windows\System\GxVPBzV.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\xFkIrtG.exe
  C:\Windows\System\xFkIrtG.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\eUTtMLN.exe
  C:\Windows\System\eUTtMLN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\TyMZCEu.exe
  C:\Windows\System\TyMZCEu.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\JMWUnxj.exe
  C:\Windows\System\JMWUnxj.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\vqqCyPY.exe
  C:\Windows\System\vqqCyPY.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\xAKNRCZ.exe
  C:\Windows\System\xAKNRCZ.exe
  2⤵
  PID:1612
- C:\Windows\System\HrLveGg.exe
  C:\Windows\System\HrLveGg.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\vbdDSij.exe
  C:\Windows\System\vbdDSij.exe
  2⤵
  PID:2016
- C:\Windows\System\itfuqPJ.exe
  C:\Windows\System\itfuqPJ.exe
  2⤵
  PID:2036
- C:\Windows\System\PWgMgng.exe
  C:\Windows\System\PWgMgng.exe
  2⤵
  PID:1816
- C:\Windows\System\IsjasOO.exe
  C:\Windows\System\IsjasOO.exe
  2⤵
  PID:2672
- C:\Windows\System\AhpOJMo.exe
  C:\Windows\System\AhpOJMo.exe
  2⤵
  PID:1948
- C:\Windows\System\djenJcg.exe
  C:\Windows\System\djenJcg.exe
  2⤵
  PID:2196
- C:\Windows\System\EtusIut.exe
  C:\Windows\System\EtusIut.exe
  2⤵
  PID:2788
- C:\Windows\System\uNSWXcd.exe
  C:\Windows\System\uNSWXcd.exe
  2⤵
  PID:1048
- C:\Windows\System\yZaSgqE.exe
  C:\Windows\System\yZaSgqE.exe
  2⤵
  PID:2360
- C:\Windows\System\VFZWFoX.exe
  C:\Windows\System\VFZWFoX.exe
  2⤵
  PID:2280
- C:\Windows\System\NBFOzWo.exe
  C:\Windows\System\NBFOzWo.exe
  2⤵
  PID:1804
- C:\Windows\System\hNnJYVO.exe
  C:\Windows\System\hNnJYVO.exe
  2⤵
  PID:884
- C:\Windows\System\gywFpms.exe
  C:\Windows\System\gywFpms.exe
  2⤵
  PID:976
- C:\Windows\System\MPMFbWc.exe
  C:\Windows\System\MPMFbWc.exe
  2⤵
  PID:792
- C:\Windows\System\pCdoXvr.exe
  C:\Windows\System\pCdoXvr.exe
  2⤵
  PID:2972
- C:\Windows\System\aFCVXCd.exe
  C:\Windows\System\aFCVXCd.exe
  2⤵
  PID:1236
- C:\Windows\System\aBwBpbJ.exe
  C:\Windows\System\aBwBpbJ.exe
  2⤵
  PID:804
- C:\Windows\System\DkuWwmg.exe
  C:\Windows\System\DkuWwmg.exe
  2⤵
  PID:1568
- C:\Windows\System\wZlRQkx.exe
  C:\Windows\System\wZlRQkx.exe
  2⤵
  PID:1608
- C:\Windows\System\VkpPxqo.exe
  C:\Windows\System\VkpPxqo.exe
  2⤵
  PID:2400
- C:\Windows\System\HOwWUyf.exe
  C:\Windows\System\HOwWUyf.exe
  2⤵
  PID:2472
- C:\Windows\System\wcEGUuA.exe
  C:\Windows\System\wcEGUuA.exe
  2⤵
  PID:1308
- C:\Windows\System\YXLsCEU.exe
  C:\Windows\System\YXLsCEU.exe
  2⤵
  PID:2568
- C:\Windows\System\UgWikWi.exe
  C:\Windows\System\UgWikWi.exe
  2⤵
  PID:1164
- C:\Windows\System\GsRBzka.exe
  C:\Windows\System\GsRBzka.exe
  2⤵
  PID:2504
- C:\Windows\System\CFlLPLp.exe
  C:\Windows\System\CFlLPLp.exe
  2⤵
  PID:1020
- C:\Windows\System\aCviPHC.exe
  C:\Windows\System\aCviPHC.exe
  2⤵
  PID:2848
- C:\Windows\System\LODosIn.exe
  C:\Windows\System\LODosIn.exe
  2⤵
  PID:788
- C:\Windows\System\xUGsmgV.exe
  C:\Windows\System\xUGsmgV.exe
  2⤵
  PID:2352
- C:\Windows\System\JKpbbPa.exe
  C:\Windows\System\JKpbbPa.exe
  2⤵
  PID:2140
- C:\Windows\System\ylzVsNC.exe
  C:\Windows\System\ylzVsNC.exe
  2⤵
  PID:2496
- C:\Windows\System\vEZtMYm.exe
  C:\Windows\System\vEZtMYm.exe
  2⤵
  PID:1784
- C:\Windows\System\ORuFeqg.exe
  C:\Windows\System\ORuFeqg.exe
  2⤵
  PID:2536
- C:\Windows\System\DpfrHaE.exe
  C:\Windows\System\DpfrHaE.exe
  2⤵
  PID:2324
- C:\Windows\System\lzxlaOY.exe
  C:\Windows\System\lzxlaOY.exe
  2⤵
  PID:2904
- C:\Windows\System\BfGktIs.exe
  C:\Windows\System\BfGktIs.exe
  2⤵
  PID:2024
- C:\Windows\System\eOSnPxo.exe
  C:\Windows\System\eOSnPxo.exe
  2⤵
  PID:956
- C:\Windows\System\wLgpVRu.exe
  C:\Windows\System\wLgpVRu.exe
  2⤵
  PID:2428
- C:\Windows\System\gWXfKCS.exe
  C:\Windows\System\gWXfKCS.exe
  2⤵
  PID:860
- C:\Windows\System\sdmZMfb.exe
  C:\Windows\System\sdmZMfb.exe
  2⤵
  PID:432
- C:\Windows\System\dnQbzIK.exe
  C:\Windows\System\dnQbzIK.exe
  2⤵
  PID:1344
- C:\Windows\System\boCXQEq.exe
  C:\Windows\System\boCXQEq.exe
  2⤵
  PID:2236
- C:\Windows\System\vYwdjws.exe
  C:\Windows\System\vYwdjws.exe
  2⤵
  PID:2292
- C:\Windows\System\EiXtXII.exe
  C:\Windows\System\EiXtXII.exe
  2⤵
  PID:2676
- C:\Windows\System\GbMLBDO.exe
  C:\Windows\System\GbMLBDO.exe
  2⤵
  PID:2052
- C:\Windows\System\VlWqdKB.exe
  C:\Windows\System\VlWqdKB.exe
  2⤵
  PID:1640
- C:\Windows\System\wXrXfCl.exe
  C:\Windows\System\wXrXfCl.exe
  2⤵
  PID:2816
- C:\Windows\System\DjamHet.exe
  C:\Windows\System\DjamHet.exe
  2⤵
  PID:1336
- C:\Windows\System\kpDOimY.exe
  C:\Windows\System\kpDOimY.exe
  2⤵
  PID:1808
- C:\Windows\System\zDNXlZC.exe
  C:\Windows\System\zDNXlZC.exe
  2⤵
  PID:1500
- C:\Windows\System\QThlmWz.exe
  C:\Windows\System\QThlmWz.exe
  2⤵
  PID:2460
- C:\Windows\System\XRgKxHV.exe
  C:\Windows\System\XRgKxHV.exe
  2⤵
  PID:2012
- C:\Windows\System\mMizqlh.exe
  C:\Windows\System\mMizqlh.exe
  2⤵
  PID:2680
- C:\Windows\System\nCVriiS.exe
  C:\Windows\System\nCVriiS.exe
  2⤵
  PID:2552
- C:\Windows\System\kqqROUQ.exe
  C:\Windows\System\kqqROUQ.exe
  2⤵
  PID:2176
- C:\Windows\System\jINyJJi.exe
  C:\Windows\System\jINyJJi.exe
  2⤵
  PID:2944
- C:\Windows\System\xPRnZYS.exe
  C:\Windows\System\xPRnZYS.exe
  2⤵
  PID:1564
- C:\Windows\System\IkAZLJq.exe
  C:\Windows\System\IkAZLJq.exe
  2⤵
  PID:2660
- C:\Windows\System\aQcODOc.exe
  C:\Windows\System\aQcODOc.exe
  2⤵
  PID:2372
- C:\Windows\System\awpjImg.exe
  C:\Windows\System\awpjImg.exe
  2⤵
  PID:1224
- C:\Windows\System\vNilXco.exe
  C:\Windows\System\vNilXco.exe
  2⤵
  PID:2620
- C:\Windows\System\LFoXIph.exe
  C:\Windows\System\LFoXIph.exe
  2⤵
  PID:1304
- C:\Windows\System\SDkqnjE.exe
  C:\Windows\System\SDkqnjE.exe
  2⤵
  PID:628
- C:\Windows\System\xzAFxgM.exe
  C:\Windows\System\xzAFxgM.exe
  2⤵
  PID:2336
- C:\Windows\System\tFMUKuj.exe
  C:\Windows\System\tFMUKuj.exe
  2⤵
  PID:1812
- C:\Windows\System\GWBxhZM.exe
  C:\Windows\System\GWBxhZM.exe
  2⤵
  PID:2308
- C:\Windows\System\WKeRgPR.exe
  C:\Windows\System\WKeRgPR.exe
  2⤵
  PID:3008
- C:\Windows\System\ZiVHVpC.exe
  C:\Windows\System\ZiVHVpC.exe
  2⤵
  PID:2908
- C:\Windows\System\AKWbdgJ.exe
  C:\Windows\System\AKWbdgJ.exe
  2⤵
  PID:1644
- C:\Windows\System\zlUZnTI.exe
  C:\Windows\System\zlUZnTI.exe
  2⤵
  PID:2924
- C:\Windows\System\SZSomNC.exe
  C:\Windows\System\SZSomNC.exe
  2⤵
  PID:2044
- C:\Windows\System\ixYlabj.exe
  C:\Windows\System\ixYlabj.exe
  2⤵
  PID:1680
- C:\Windows\System\tMbXHzG.exe
  C:\Windows\System\tMbXHzG.exe
  2⤵
  PID:856
- C:\Windows\System\nWCMKrV.exe
  C:\Windows\System\nWCMKrV.exe
  2⤵
  PID:2948
- C:\Windows\System\sgzaBaA.exe
  C:\Windows\System\sgzaBaA.exe
  2⤵
  PID:1732
- C:\Windows\System\zfgbCiP.exe
  C:\Windows\System\zfgbCiP.exe
  2⤵
  PID:1952
- C:\Windows\System\JHZNBaO.exe
  C:\Windows\System\JHZNBaO.exe
  2⤵
  PID:2648
- C:\Windows\System\THyMwVJ.exe
  C:\Windows\System\THyMwVJ.exe
  2⤵
  PID:1972
- C:\Windows\System\gRmdgZW.exe
  C:\Windows\System\gRmdgZW.exe
  2⤵
  PID:1724
- C:\Windows\System\QhIMGaz.exe
  C:\Windows\System\QhIMGaz.exe
  2⤵
  PID:3012
- C:\Windows\System\FNphyKz.exe
  C:\Windows\System\FNphyKz.exe
  2⤵
  PID:1752
- C:\Windows\System\hgDmvJT.exe
  C:\Windows\System\hgDmvJT.exe
  2⤵
  PID:2404
- C:\Windows\System\pSHbiAB.exe
  C:\Windows\System\pSHbiAB.exe
  2⤵
  PID:2844
- C:\Windows\System\ukkUvFR.exe
  C:\Windows\System\ukkUvFR.exe
  2⤵
  PID:2640
- C:\Windows\System\HfOMlcJ.exe
  C:\Windows\System\HfOMlcJ.exe
  2⤵
  PID:2376
- C:\Windows\System\fDkEkhD.exe
  C:\Windows\System\fDkEkhD.exe
  2⤵
  PID:2548
- C:\Windows\System\PWhCJjw.exe
  C:\Windows\System\PWhCJjw.exe
  2⤵
  PID:2248
- C:\Windows\System\lZqRNUP.exe
  C:\Windows\System\lZqRNUP.exe
  2⤵
  PID:2856
- C:\Windows\System\KatBhzL.exe
  C:\Windows\System\KatBhzL.exe
  2⤵
  PID:3080
- C:\Windows\System\SdNhlbu.exe
  C:\Windows\System\SdNhlbu.exe
  2⤵
  PID:3180
- C:\Windows\System\GySKfDA.exe
  C:\Windows\System\GySKfDA.exe
  2⤵
  PID:3196
- C:\Windows\System\KFmozBk.exe
  C:\Windows\System\KFmozBk.exe
  2⤵
  PID:3212
- C:\Windows\System\TFeFDIe.exe
  C:\Windows\System\TFeFDIe.exe
  2⤵
  PID:3228
- C:\Windows\System\gaYuMTs.exe
  C:\Windows\System\gaYuMTs.exe
  2⤵
  PID:3244
- C:\Windows\System\VVJfRfO.exe
  C:\Windows\System\VVJfRfO.exe
  2⤵
  PID:3260
- C:\Windows\System\qGHNFsg.exe
  C:\Windows\System\qGHNFsg.exe
  2⤵
  PID:3276
- C:\Windows\System\TaPxOEg.exe
  C:\Windows\System\TaPxOEg.exe
  2⤵
  PID:3292
- C:\Windows\System\ivfdDfp.exe
  C:\Windows\System\ivfdDfp.exe
  2⤵
  PID:3308
- C:\Windows\System\mYojRRq.exe
  C:\Windows\System\mYojRRq.exe
  2⤵
  PID:3328
- C:\Windows\System\TCtxpxM.exe
  C:\Windows\System\TCtxpxM.exe
  2⤵
  PID:3344
- C:\Windows\System\QJvPWsn.exe
  C:\Windows\System\QJvPWsn.exe
  2⤵
  PID:3364
- C:\Windows\System\rppKklK.exe
  C:\Windows\System\rppKklK.exe
  2⤵
  PID:3388
- C:\Windows\System\eYhJEMe.exe
  C:\Windows\System\eYhJEMe.exe
  2⤵
  PID:3404
- C:\Windows\System\NMXHEWp.exe
  C:\Windows\System\NMXHEWp.exe
  2⤵
  PID:3428
- C:\Windows\System\NWURZSN.exe
  C:\Windows\System\NWURZSN.exe
  2⤵
  PID:3444
- C:\Windows\System\PIjaTAA.exe
  C:\Windows\System\PIjaTAA.exe
  2⤵
  PID:3460
- C:\Windows\System\PFYUKAo.exe
  C:\Windows\System\PFYUKAo.exe
  2⤵
  PID:3476
- C:\Windows\System\tSWxNbZ.exe
  C:\Windows\System\tSWxNbZ.exe
  2⤵
  PID:3492
- C:\Windows\System\IGAvurj.exe
  C:\Windows\System\IGAvurj.exe
  2⤵
  PID:3512
- C:\Windows\System\KuFnxmz.exe
  C:\Windows\System\KuFnxmz.exe
  2⤵
  PID:3528
- C:\Windows\System\EKjEOJN.exe
  C:\Windows\System\EKjEOJN.exe
  2⤵
  PID:3592
- C:\Windows\System\SYpaFIB.exe
  C:\Windows\System\SYpaFIB.exe
  2⤵
  PID:3608
- C:\Windows\System\qoeAwwa.exe
  C:\Windows\System\qoeAwwa.exe
  2⤵
  PID:3636
- C:\Windows\System\NxxxosA.exe
  C:\Windows\System\NxxxosA.exe
  2⤵
  PID:3652
- C:\Windows\System\HybhwNq.exe
  C:\Windows\System\HybhwNq.exe
  2⤵
  PID:3676
- C:\Windows\System\dRvUJbv.exe
  C:\Windows\System\dRvUJbv.exe
  2⤵
  PID:3692
- C:\Windows\System\cmNCBmR.exe
  C:\Windows\System\cmNCBmR.exe
  2⤵
  PID:3708
- C:\Windows\System\egVJKli.exe
  C:\Windows\System\egVJKli.exe
  2⤵
  PID:3724
- C:\Windows\System\mrVJRSW.exe
  C:\Windows\System\mrVJRSW.exe
  2⤵
  PID:3744
- C:\Windows\System\JUEBnTD.exe
  C:\Windows\System\JUEBnTD.exe
  2⤵
  PID:3764
- C:\Windows\System\TNMLVkd.exe
  C:\Windows\System\TNMLVkd.exe
  2⤵
  PID:3780
- C:\Windows\System\JgczwWJ.exe
  C:\Windows\System\JgczwWJ.exe
  2⤵
  PID:3796
- C:\Windows\System\iDuGMCD.exe
  C:\Windows\System\iDuGMCD.exe
  2⤵
  PID:3812
- C:\Windows\System\oCCpTyH.exe
  C:\Windows\System\oCCpTyH.exe
  2⤵
  PID:3868
- C:\Windows\System\GVQmyvw.exe
  C:\Windows\System\GVQmyvw.exe
  2⤵
  PID:3884
- C:\Windows\System\pKkgBDQ.exe
  C:\Windows\System\pKkgBDQ.exe
  2⤵
  PID:3904
- C:\Windows\System\GfCsKdB.exe
  C:\Windows\System\GfCsKdB.exe
  2⤵
  PID:3920
- C:\Windows\System\LSaTxWA.exe
  C:\Windows\System\LSaTxWA.exe
  2⤵
  PID:3944
- C:\Windows\System\dPbvSnN.exe
  C:\Windows\System\dPbvSnN.exe
  2⤵
  PID:3960
- C:\Windows\System\pieqOwQ.exe
  C:\Windows\System\pieqOwQ.exe
  2⤵
  PID:3976
- C:\Windows\System\xMCJafR.exe
  C:\Windows\System\xMCJafR.exe
  2⤵
  PID:3992
- C:\Windows\System\YtcUkLz.exe
  C:\Windows\System\YtcUkLz.exe
  2⤵
  PID:4012
- C:\Windows\System\LOwQPQp.exe
  C:\Windows\System\LOwQPQp.exe
  2⤵
  PID:4032
- C:\Windows\System\dGgWbPs.exe
  C:\Windows\System\dGgWbPs.exe
  2⤵
  PID:4048
- C:\Windows\System\XiiRghp.exe
  C:\Windows\System\XiiRghp.exe
  2⤵
  PID:4064
- C:\Windows\System\HvDyYSA.exe
  C:\Windows\System\HvDyYSA.exe
  2⤵
  PID:4084
- C:\Windows\System\OLUBnyG.exe
  C:\Windows\System\OLUBnyG.exe
  2⤵
  PID:2168
- C:\Windows\System\NfPjTYo.exe
  C:\Windows\System\NfPjTYo.exe
  2⤵
  PID:1504
- C:\Windows\System\rdOkefz.exe
  C:\Windows\System\rdOkefz.exe
  2⤵
  PID:880
- C:\Windows\System\EhxlYAv.exe
  C:\Windows\System\EhxlYAv.exe
  2⤵
  PID:2056
- C:\Windows\System\iFwhnWP.exe
  C:\Windows\System\iFwhnWP.exe
  2⤵
  PID:1604
- C:\Windows\System\vaSaXrk.exe
  C:\Windows\System\vaSaXrk.exe
  2⤵
  PID:684
- C:\Windows\System\lIzKhiC.exe
  C:\Windows\System\lIzKhiC.exe
  2⤵
  PID:2920
- C:\Windows\System\Oowdvyt.exe
  C:\Windows\System\Oowdvyt.exe
  2⤵
  PID:760
- C:\Windows\System\utGfsMA.exe
  C:\Windows\System\utGfsMA.exe
  2⤵
  PID:2916
- C:\Windows\System\DdZnfHw.exe
  C:\Windows\System\DdZnfHw.exe
  2⤵
  PID:3144
- C:\Windows\System\uaKIzUF.exe
  C:\Windows\System\uaKIzUF.exe
  2⤵
  PID:2512
- C:\Windows\System\FccPRKQ.exe
  C:\Windows\System\FccPRKQ.exe
  2⤵
  PID:2964
- C:\Windows\System\XGyRECA.exe
  C:\Windows\System\XGyRECA.exe
  2⤵
  PID:3104
- C:\Windows\System\CFveiru.exe
  C:\Windows\System\CFveiru.exe
  2⤵
  PID:3092
- C:\Windows\System\VkCKIQB.exe
  C:\Windows\System\VkCKIQB.exe
  2⤵
  PID:3152
- C:\Windows\System\bkkvQWf.exe
  C:\Windows\System\bkkvQWf.exe
  2⤵
  PID:3272
- C:\Windows\System\mYYmLMf.exe
  C:\Windows\System\mYYmLMf.exe
  2⤵
  PID:3336
- C:\Windows\System\pphPhdl.exe
  C:\Windows\System\pphPhdl.exe
  2⤵
  PID:3256
- C:\Windows\System\rvgOiXr.exe
  C:\Windows\System\rvgOiXr.exe
  2⤵
  PID:3440
- C:\Windows\System\ctkdaom.exe
  C:\Windows\System\ctkdaom.exe
  2⤵
  PID:3316
- C:\Windows\System\mPbdrHy.exe
  C:\Windows\System\mPbdrHy.exe
  2⤵
  PID:3356
- C:\Windows\System\kwpcgwu.exe
  C:\Windows\System\kwpcgwu.exe
  2⤵
  PID:3400
- C:\Windows\System\udWhGnI.exe
  C:\Windows\System\udWhGnI.exe
  2⤵
  PID:3504
- C:\Windows\System\KFyslFZ.exe
  C:\Windows\System\KFyslFZ.exe
  2⤵
  PID:3556
- C:\Windows\System\ryobzlI.exe
  C:\Windows\System\ryobzlI.exe
  2⤵
  PID:3572
- C:\Windows\System\MaKIkNA.exe
  C:\Windows\System\MaKIkNA.exe
  2⤵
  PID:3376
- C:\Windows\System\fjRpPbk.exe
  C:\Windows\System\fjRpPbk.exe
  2⤵
  PID:3424
- C:\Windows\System\XIzPyge.exe
  C:\Windows\System\XIzPyge.exe
  2⤵
  PID:3584
- C:\Windows\System\OiCxAeN.exe
  C:\Windows\System\OiCxAeN.exe
  2⤵
  PID:3624
- C:\Windows\System\CdDHBEy.exe
  C:\Windows\System\CdDHBEy.exe
  2⤵
  PID:3668
- C:\Windows\System\CDKJeYf.exe
  C:\Windows\System\CDKJeYf.exe
  2⤵
  PID:3836
- C:\Windows\System\ieNZApG.exe
  C:\Windows\System\ieNZApG.exe
  2⤵
  PID:3604
- C:\Windows\System\IpFLHCV.exe
  C:\Windows\System\IpFLHCV.exe
  2⤵
  PID:3792
- C:\Windows\System\NVTVCiF.exe
  C:\Windows\System\NVTVCiF.exe
  2⤵
  PID:3840
- C:\Windows\System\qlOzVlf.exe
  C:\Windows\System\qlOzVlf.exe
  2⤵
  PID:3824
- C:\Windows\System\pykfvMX.exe
  C:\Windows\System\pykfvMX.exe
  2⤵
  PID:3916
- C:\Windows\System\azlGObA.exe
  C:\Windows\System\azlGObA.exe
  2⤵
  PID:4056
- C:\Windows\System\gGVHgbE.exe
  C:\Windows\System\gGVHgbE.exe
  2⤵
  PID:2200
- C:\Windows\System\XNQWJrW.exe
  C:\Windows\System\XNQWJrW.exe
  2⤵
  PID:2600
- C:\Windows\System\rcZJyzg.exe
  C:\Windows\System\rcZJyzg.exe
  2⤵
  PID:2652
- C:\Windows\System\faAEKBJ.exe
  C:\Windows\System\faAEKBJ.exe
  2⤵
  PID:3968
- C:\Windows\System\eUgZsJH.exe
  C:\Windows\System\eUgZsJH.exe
  2⤵
  PID:1656
- C:\Windows\System\bePQcXc.exe
  C:\Windows\System\bePQcXc.exe
  2⤵
  PID:1204
- C:\Windows\System\tdKQGWT.exe
  C:\Windows\System\tdKQGWT.exe
  2⤵
  PID:3120
- C:\Windows\System\mHlAESZ.exe
  C:\Windows\System\mHlAESZ.exe
  2⤵
  PID:4004
- C:\Windows\System\uViWecE.exe
  C:\Windows\System\uViWecE.exe
  2⤵
  PID:2508
- C:\Windows\System\XrIXoqq.exe
  C:\Windows\System\XrIXoqq.exe
  2⤵
  PID:1620
- C:\Windows\System\ztBbkZb.exe
  C:\Windows\System\ztBbkZb.exe
  2⤵
  PID:1028
- C:\Windows\System\vjAlVaJ.exe
  C:\Windows\System\vjAlVaJ.exe
  2⤵
  PID:3156
- C:\Windows\System\ebPKuhZ.exe
  C:\Windows\System\ebPKuhZ.exe
  2⤵
  PID:3304
- C:\Windows\System\vTClkCF.exe
  C:\Windows\System\vTClkCF.exe
  2⤵
  PID:3252
- C:\Windows\System\RICpLog.exe
  C:\Windows\System\RICpLog.exe
  2⤵
  PID:3472
- C:\Windows\System\tbUqDKj.exe
  C:\Windows\System\tbUqDKj.exe
  2⤵
  PID:3704
- C:\Windows\System\ytWbctI.exe
  C:\Windows\System\ytWbctI.exe
  2⤵
  PID:3488
- C:\Windows\System\UHLTduj.exe
  C:\Windows\System\UHLTduj.exe
  2⤵
  PID:3412
- C:\Windows\System\lTKIdMA.exe
  C:\Windows\System\lTKIdMA.exe
  2⤵
  PID:3580
- C:\Windows\System\kyyTUiV.exe
  C:\Windows\System\kyyTUiV.exe
  2⤵
  PID:3164
- C:\Windows\System\imTQjOm.exe
  C:\Windows\System\imTQjOm.exe
  2⤵
  PID:3520
- C:\Windows\System\RMXjLgZ.exe
  C:\Windows\System\RMXjLgZ.exe
  2⤵
  PID:3848
- C:\Windows\System\uQmHLnu.exe
  C:\Windows\System\uQmHLnu.exe
  2⤵
  PID:3548
- C:\Windows\System\IssRshV.exe
  C:\Windows\System\IssRshV.exe
  2⤵
  PID:3632
- C:\Windows\System\wpSZCuc.exe
  C:\Windows\System\wpSZCuc.exe
  2⤵
  PID:3956
- C:\Windows\System\zLlvbYx.exe
  C:\Windows\System\zLlvbYx.exe
  2⤵
  PID:3828
- C:\Windows\System\dMRHwVC.exe
  C:\Windows\System\dMRHwVC.exe
  2⤵
  PID:2468
- C:\Windows\System\SeEIMDv.exe
  C:\Windows\System\SeEIMDv.exe
  2⤵
  PID:2252
- C:\Windows\System\AfbrNjW.exe
  C:\Windows\System\AfbrNjW.exe
  2⤵
  PID:3168
- C:\Windows\System\QsGiKMe.exe
  C:\Windows\System\QsGiKMe.exe
  2⤵
  PID:3088
- C:\Windows\System\znhFWcI.exe
  C:\Windows\System\znhFWcI.exe
  2⤵
  PID:4040
- C:\Windows\System\VNQohCP.exe
  C:\Windows\System\VNQohCP.exe
  2⤵
  PID:3096
- C:\Windows\System\jKLEZVk.exe
  C:\Windows\System\jKLEZVk.exe
  2⤵
  PID:3384
- C:\Windows\System\xDzlrEY.exe
  C:\Windows\System\xDzlrEY.exe
  2⤵
  PID:3468
- C:\Windows\System\VUZmDqK.exe
  C:\Windows\System\VUZmDqK.exe
  2⤵
  PID:3240
- C:\Windows\System\JiCRPoK.exe
  C:\Windows\System\JiCRPoK.exe
  2⤵
  PID:3644
- C:\Windows\System\HFJdjoq.exe
  C:\Windows\System\HFJdjoq.exe
  2⤵
  PID:3804
- C:\Windows\System\kzrNvVJ.exe
  C:\Windows\System\kzrNvVJ.exe
  2⤵
  PID:2528
- C:\Windows\System\yYSfwao.exe
  C:\Windows\System\yYSfwao.exe
  2⤵
  PID:1128
- C:\Windows\System\DQHRlRm.exe
  C:\Windows\System\DQHRlRm.exe
  2⤵
  PID:3484
- C:\Windows\System\vYHeKWd.exe
  C:\Windows\System\vYHeKWd.exe
  2⤵
  PID:3500
- C:\Windows\System\dnjGwck.exe
  C:\Windows\System\dnjGwck.exe
  2⤵
  PID:4060
- C:\Windows\System\JBQtacD.exe
  C:\Windows\System\JBQtacD.exe
  2⤵
  PID:3940
- C:\Windows\System\nCbceTT.exe
  C:\Windows\System\nCbceTT.exe
  2⤵
  PID:112
- C:\Windows\System\vIMGtOS.exe
  C:\Windows\System\vIMGtOS.exe
  2⤵
  PID:3284
- C:\Windows\System\sXvJbLx.exe
  C:\Windows\System\sXvJbLx.exe
  2⤵
  PID:3124
- C:\Windows\System\YWCHaJp.exe
  C:\Windows\System\YWCHaJp.exe
  2⤵
  PID:3700
- C:\Windows\System\uQFhuWl.exe
  C:\Windows\System\uQFhuWl.exe
  2⤵
  PID:3288
- C:\Windows\System\gwjBrID.exe
  C:\Windows\System\gwjBrID.exe
  2⤵
  PID:3988
- C:\Windows\System\ORkJMBv.exe
  C:\Windows\System\ORkJMBv.exe
  2⤵
  PID:4080
- C:\Windows\System\HLynEhv.exe
  C:\Windows\System\HLynEhv.exe
  2⤵
  PID:2952
- C:\Windows\System\FaIhNLr.exe
  C:\Windows\System\FaIhNLr.exe
  2⤵
  PID:1984
- C:\Windows\System\dEFltON.exe
  C:\Windows\System\dEFltON.exe
  2⤵
  PID:3736
- C:\Windows\System\WAnlbym.exe
  C:\Windows\System\WAnlbym.exe
  2⤵
  PID:3756
- C:\Windows\System\XndCjdq.exe
  C:\Windows\System\XndCjdq.exe
  2⤵
  PID:2812
- C:\Windows\System\RdmrEFb.exe
  C:\Windows\System\RdmrEFb.exe
  2⤵
  PID:3220
- C:\Windows\System\xDMqxgy.exe
  C:\Windows\System\xDMqxgy.exe
  2⤵
  PID:3972
- C:\Windows\System\devpNuT.exe
  C:\Windows\System\devpNuT.exe
  2⤵
  PID:4000
- C:\Windows\System\rNpFJYT.exe
  C:\Windows\System\rNpFJYT.exe
  2⤵
  PID:3112
- C:\Windows\System\xwxyqhc.exe
  C:\Windows\System\xwxyqhc.exe
  2⤵
  PID:4112
- C:\Windows\System\earqLOb.exe
  C:\Windows\System\earqLOb.exe
  2⤵
  PID:4132
- C:\Windows\System\zHWEFqe.exe
  C:\Windows\System\zHWEFqe.exe
  2⤵
  PID:4148
- C:\Windows\System\cWKhiYj.exe
  C:\Windows\System\cWKhiYj.exe
  2⤵
  PID:4220
- C:\Windows\System\wnAdIcd.exe
  C:\Windows\System\wnAdIcd.exe
  2⤵
  PID:4236
- C:\Windows\System\uvfSdTK.exe
  C:\Windows\System\uvfSdTK.exe
  2⤵
  PID:4252
- C:\Windows\System\VYgyFil.exe
  C:\Windows\System\VYgyFil.exe
  2⤵
  PID:4276
- C:\Windows\System\QlAAmlr.exe
  C:\Windows\System\QlAAmlr.exe
  2⤵
  PID:4292
- C:\Windows\System\OIjtZQS.exe
  C:\Windows\System\OIjtZQS.exe
  2⤵
  PID:4312
- C:\Windows\System\tuqtQwk.exe
  C:\Windows\System\tuqtQwk.exe
  2⤵
  PID:4356
- C:\Windows\System\ntFTzeh.exe
  C:\Windows\System\ntFTzeh.exe
  2⤵
  PID:4420
- C:\Windows\System\ItFgnaI.exe
  C:\Windows\System\ItFgnaI.exe
  2⤵
  PID:4440
- C:\Windows\System\ltHmFbh.exe
  C:\Windows\System\ltHmFbh.exe
  2⤵
  PID:4456
- C:\Windows\System\vrpKvCj.exe
  C:\Windows\System\vrpKvCj.exe
  2⤵
  PID:4472
- C:\Windows\System\nAXSFNc.exe
  C:\Windows\System\nAXSFNc.exe
  2⤵
  PID:4492
- C:\Windows\System\utnMnDb.exe
  C:\Windows\System\utnMnDb.exe
  2⤵
  PID:4508
- C:\Windows\System\ilrPGKO.exe
  C:\Windows\System\ilrPGKO.exe
  2⤵
  PID:4524
- C:\Windows\System\BzSScrO.exe
  C:\Windows\System\BzSScrO.exe
  2⤵
  PID:4556
- C:\Windows\System\RWAMjGj.exe
  C:\Windows\System\RWAMjGj.exe
  2⤵
  PID:4572
- C:\Windows\System\lqShXAC.exe
  C:\Windows\System\lqShXAC.exe
  2⤵
  PID:4588
- C:\Windows\System\prSKPGH.exe
  C:\Windows\System\prSKPGH.exe
  2⤵
  PID:4604
- C:\Windows\System\tqxiawr.exe
  C:\Windows\System\tqxiawr.exe
  2⤵
  PID:4620
- C:\Windows\System\CgUgyyo.exe
  C:\Windows\System\CgUgyyo.exe
  2⤵
  PID:4636
- C:\Windows\System\IOLojbT.exe
  C:\Windows\System\IOLojbT.exe
  2⤵
  PID:4652
- C:\Windows\System\SwEFigu.exe
  C:\Windows\System\SwEFigu.exe
  2⤵
  PID:4668
- C:\Windows\System\WXrzMNt.exe
  C:\Windows\System\WXrzMNt.exe
  2⤵
  PID:4728
- C:\Windows\System\pObhPtQ.exe
  C:\Windows\System\pObhPtQ.exe
  2⤵
  PID:4752
- C:\Windows\System\mHPeuZi.exe
  C:\Windows\System\mHPeuZi.exe
  2⤵
  PID:4780
- C:\Windows\System\RoVAoFN.exe
  C:\Windows\System\RoVAoFN.exe
  2⤵
  PID:4796
- C:\Windows\System\MCZoUKT.exe
  C:\Windows\System\MCZoUKT.exe
  2⤵
  PID:4816
- C:\Windows\System\NcozKps.exe
  C:\Windows\System\NcozKps.exe
  2⤵
  PID:4836
- C:\Windows\System\DKEPPVO.exe
  C:\Windows\System\DKEPPVO.exe
  2⤵
  PID:4876
- C:\Windows\System\ZlsYBXW.exe
  C:\Windows\System\ZlsYBXW.exe
  2⤵
  PID:4896
- C:\Windows\System\vgHJfol.exe
  C:\Windows\System\vgHJfol.exe
  2⤵
  PID:4912
- C:\Windows\System\MNUrktB.exe
  C:\Windows\System\MNUrktB.exe
  2⤵
  PID:4928
- C:\Windows\System\BlZeuvf.exe
  C:\Windows\System\BlZeuvf.exe
  2⤵
  PID:4944
- C:\Windows\System\IIyqIPM.exe
  C:\Windows\System\IIyqIPM.exe
  2⤵
  PID:4960
- C:\Windows\System\npdcioz.exe
  C:\Windows\System\npdcioz.exe
  2⤵
  PID:4976
- C:\Windows\System\EGLldRw.exe
  C:\Windows\System\EGLldRw.exe
  2⤵
  PID:5004
- C:\Windows\System\kvwmaTD.exe
  C:\Windows\System\kvwmaTD.exe
  2⤵
  PID:5024
- C:\Windows\System\QauIOyZ.exe
  C:\Windows\System\QauIOyZ.exe
  2⤵
  PID:5052
- C:\Windows\System\tmuRviq.exe
  C:\Windows\System\tmuRviq.exe
  2⤵
  PID:5072
- C:\Windows\System\zrJRlKY.exe
  C:\Windows\System\zrJRlKY.exe
  2⤵
  PID:5088
- C:\Windows\System\yEdIQre.exe
  C:\Windows\System\yEdIQre.exe
  2⤵
  PID:5108
- C:\Windows\System\hHOoqMf.exe
  C:\Windows\System\hHOoqMf.exe
  2⤵
  PID:3716
- C:\Windows\System\sOACJdP.exe
  C:\Windows\System\sOACJdP.exe
  2⤵
  PID:3116
- C:\Windows\System\YOcQpVF.exe
  C:\Windows\System\YOcQpVF.exe
  2⤵
  PID:4128
- C:\Windows\System\AYFZnWP.exe
  C:\Windows\System\AYFZnWP.exe
  2⤵
  PID:3896
- C:\Windows\System\kkqTywG.exe
  C:\Windows\System\kkqTywG.exe
  2⤵
  PID:3856
- C:\Windows\System\DUiTxBI.exe
  C:\Windows\System\DUiTxBI.exe
  2⤵
  PID:4184
- C:\Windows\System\CAzLvfe.exe
  C:\Windows\System\CAzLvfe.exe
  2⤵
  PID:4200
- C:\Windows\System\rOYvWQn.exe
  C:\Windows\System\rOYvWQn.exe
  2⤵
  PID:4232
- C:\Windows\System\WPhAPVs.exe
  C:\Windows\System\WPhAPVs.exe
  2⤵
  PID:4308
- C:\Windows\System\VKvmElM.exe
  C:\Windows\System\VKvmElM.exe
  2⤵
  PID:4248
- C:\Windows\System\wCoCuVc.exe
  C:\Windows\System\wCoCuVc.exe
  2⤵
  PID:4288
- C:\Windows\System\ZvBJhWw.exe
  C:\Windows\System\ZvBJhWw.exe
  2⤵
  PID:4324
- C:\Windows\System\STgFfom.exe
  C:\Windows\System\STgFfom.exe
  2⤵
  PID:4504
- C:\Windows\System\UTvCzcf.exe
  C:\Windows\System\UTvCzcf.exe
  2⤵
  PID:4500
- C:\Windows\System\cnXRioD.exe
  C:\Windows\System\cnXRioD.exe
  2⤵
  PID:4396
- C:\Windows\System\IuOnpUP.exe
  C:\Windows\System\IuOnpUP.exe
  2⤵
  PID:4416
- C:\Windows\System\UOhIjjY.exe
  C:\Windows\System\UOhIjjY.exe
  2⤵
  PID:4480
- C:\Windows\System\BTaRQQV.exe
  C:\Windows\System\BTaRQQV.exe
  2⤵
  PID:4488
- C:\Windows\System\ftPXViM.exe
  C:\Windows\System\ftPXViM.exe
  2⤵
  PID:4664
- C:\Windows\System\CnbECzU.exe
  C:\Windows\System\CnbECzU.exe
  2⤵
  PID:4544
- C:\Windows\System\JgcnmpA.exe
  C:\Windows\System\JgcnmpA.exe
  2⤵
  PID:4696
- C:\Windows\System\ynqADVz.exe
  C:\Windows\System\ynqADVz.exe
  2⤵
  PID:4744
- C:\Windows\System\AwSZJro.exe
  C:\Windows\System\AwSZJro.exe
  2⤵
  PID:4700
- C:\Windows\System\CqANWdZ.exe
  C:\Windows\System\CqANWdZ.exe
  2⤵
  PID:4676
- C:\Windows\System\kEZipQR.exe
  C:\Windows\System\kEZipQR.exe
  2⤵
  PID:4680
- C:\Windows\System\RbGwVAi.exe
  C:\Windows\System\RbGwVAi.exe
  2⤵
  PID:4776
- C:\Windows\System\dPQuaEx.exe
  C:\Windows\System\dPQuaEx.exe
  2⤵
  PID:4764
- C:\Windows\System\NNTJAIa.exe
  C:\Windows\System\NNTJAIa.exe
  2⤵
  PID:4804
- C:\Windows\System\LnhHoxI.exe
  C:\Windows\System\LnhHoxI.exe
  2⤵
  PID:4848
- C:\Windows\System\nRAnFlj.exe
  C:\Windows\System\nRAnFlj.exe
  2⤵
  PID:4884
- C:\Windows\System\wtwkNdr.exe
  C:\Windows\System\wtwkNdr.exe
  2⤵
  PID:4888
- C:\Windows\System\dNvShBG.exe
  C:\Windows\System\dNvShBG.exe
  2⤵
  PID:4968
- C:\Windows\System\ZSnqUbY.exe
  C:\Windows\System\ZSnqUbY.exe
  2⤵
  PID:3052
- C:\Windows\System\goNWwxV.exe
  C:\Windows\System\goNWwxV.exe
  2⤵
  PID:5036
- C:\Windows\System\VJevWiH.exe
  C:\Windows\System\VJevWiH.exe
  2⤵
  PID:5068
- C:\Windows\System\NkbImBv.exe
  C:\Windows\System\NkbImBv.exe
  2⤵
  PID:5084
- C:\Windows\System\sYdfsUu.exe
  C:\Windows\System\sYdfsUu.exe
  2⤵
  PID:3176
- C:\Windows\System\WHMvbvt.exe
  C:\Windows\System\WHMvbvt.exe
  2⤵
  PID:3324
- C:\Windows\System\jGsxISs.exe
  C:\Windows\System\jGsxISs.exe
  2⤵
  PID:4180
- C:\Windows\System\jMhjoSa.exe
  C:\Windows\System\jMhjoSa.exe
  2⤵
  PID:4172
- C:\Windows\System\hxBkidK.exe
  C:\Windows\System\hxBkidK.exe
  2⤵
  PID:4272
- C:\Windows\System\ctqoPmi.exe
  C:\Windows\System\ctqoPmi.exe
  2⤵
  PID:4228
- C:\Windows\System\hURlufG.exe
  C:\Windows\System\hURlufG.exe
  2⤵
  PID:4196
- C:\Windows\System\kbiMrpp.exe
  C:\Windows\System\kbiMrpp.exe
  2⤵
  PID:4348
- C:\Windows\System\uryXUXV.exe
  C:\Windows\System\uryXUXV.exe
  2⤵
  PID:4464
- C:\Windows\System\pcofiPC.exe
  C:\Windows\System\pcofiPC.exe
  2⤵
  PID:4388
- C:\Windows\System\emPylhX.exe
  C:\Windows\System\emPylhX.exe
  2⤵
  PID:4628
- C:\Windows\System\VCJPSBk.exe
  C:\Windows\System\VCJPSBk.exe
  2⤵
  PID:4584
- C:\Windows\System\DqkiSGE.exe
  C:\Windows\System\DqkiSGE.exe
  2⤵
  PID:4540
- C:\Windows\System\MuyjoeK.exe
  C:\Windows\System\MuyjoeK.exe
  2⤵
  PID:4792
- C:\Windows\System\aRKvGtD.exe
  C:\Windows\System\aRKvGtD.exe
  2⤵
  PID:4692
- C:\Windows\System\xfMCdkP.exe
  C:\Windows\System\xfMCdkP.exe
  2⤵
  PID:4760
- C:\Windows\System\SkzZfsL.exe
  C:\Windows\System\SkzZfsL.exe
  2⤵
  PID:4708
- C:\Windows\System\wNGjmbZ.exe
  C:\Windows\System\wNGjmbZ.exe
  2⤵
  PID:4716
- C:\Windows\System\iIIINWn.exe
  C:\Windows\System\iIIINWn.exe
  2⤵
  PID:4852
- C:\Windows\System\mgAtWAE.exe
  C:\Windows\System\mgAtWAE.exe
  2⤵
  PID:4908
- C:\Windows\System\nwZTHXA.exe
  C:\Windows\System\nwZTHXA.exe
  2⤵
  PID:4996
- C:\Windows\System\smpcBKp.exe
  C:\Windows\System\smpcBKp.exe
  2⤵
  PID:5060
- C:\Windows\System\WWfRgDx.exe
  C:\Windows\System\WWfRgDx.exe
  2⤵
  PID:5080
- C:\Windows\System\gnBBvrg.exe
  C:\Windows\System\gnBBvrg.exe
  2⤵
  PID:4212
- C:\Windows\System\dzaJReC.exe
  C:\Windows\System\dzaJReC.exe
  2⤵
  PID:5020
- C:\Windows\System\rjSllWP.exe
  C:\Windows\System\rjSllWP.exe
  2⤵
  PID:4484
- C:\Windows\System\aFSMiyY.exe
  C:\Windows\System\aFSMiyY.exe
  2⤵
  PID:4140
- C:\Windows\System\xIzeoHd.exe
  C:\Windows\System\xIzeoHd.exe
  2⤵
  PID:4328
- C:\Windows\System\jtSCVSI.exe
  C:\Windows\System\jtSCVSI.exe
  2⤵
  PID:4516
- C:\Windows\System\RyrBTwl.exe
  C:\Windows\System\RyrBTwl.exe
  2⤵
  PID:4520
- C:\Windows\System\hVoHGBH.exe
  C:\Windows\System\hVoHGBH.exe
  2⤵
  PID:4436
- C:\Windows\System\QpMFPES.exe
  C:\Windows\System\QpMFPES.exe
  2⤵
  PID:4812
- C:\Windows\System\fTMMuvy.exe
  C:\Windows\System\fTMMuvy.exe
  2⤵
  PID:4076
- C:\Windows\System\SEIBGiM.exe
  C:\Windows\System\SEIBGiM.exe
  2⤵
  PID:4748
- C:\Windows\System\dAdUhLk.exe
  C:\Windows\System\dAdUhLk.exe
  2⤵
  PID:5048
- C:\Windows\System\IaprzhN.exe
  C:\Windows\System\IaprzhN.exe
  2⤵
  PID:4376
- C:\Windows\System\vZrqvlL.exe
  C:\Windows\System\vZrqvlL.exe
  2⤵
  PID:4864
- C:\Windows\System\GqFhMdM.exe
  C:\Windows\System\GqFhMdM.exe
  2⤵
  PID:4688
- C:\Windows\System\RqNUtDv.exe
  C:\Windows\System\RqNUtDv.exe
  2⤵
  PID:4648
- C:\Windows\System\TKtalGk.exe
  C:\Windows\System\TKtalGk.exe
  2⤵
  PID:4336
- C:\Windows\System\mDcuySI.exe
  C:\Windows\System\mDcuySI.exe
  2⤵
  PID:4616
- C:\Windows\System\SaRluZf.exe
  C:\Windows\System\SaRluZf.exe
  2⤵
  PID:4860
- C:\Windows\System\csIHwfM.exe
  C:\Windows\System\csIHwfM.exe
  2⤵
  PID:4940
- C:\Windows\System\lJrkLJO.exe
  C:\Windows\System\lJrkLJO.exe
  2⤵
  PID:4844
- C:\Windows\System\RVUoVSl.exe
  C:\Windows\System\RVUoVSl.exe
  2⤵
  PID:4124
- C:\Windows\System\SxJSCEv.exe
  C:\Windows\System\SxJSCEv.exe
  2⤵
  PID:5064
- C:\Windows\System\fIDKJxK.exe
  C:\Windows\System\fIDKJxK.exe
  2⤵
  PID:4344
- C:\Windows\System\hmXDdbg.exe
  C:\Windows\System\hmXDdbg.exe
  2⤵
  PID:5032
- C:\Windows\System\UbYNOMx.exe
  C:\Windows\System\UbYNOMx.exe
  2⤵
  PID:4832
- C:\Windows\System\FUdTJlg.exe
  C:\Windows\System\FUdTJlg.exe
  2⤵
  PID:4952
- C:\Windows\System\qCxYLkS.exe
  C:\Windows\System\qCxYLkS.exe
  2⤵
  PID:5144
- C:\Windows\System\mCpqCVM.exe
  C:\Windows\System\mCpqCVM.exe
  2⤵
  PID:5168
- C:\Windows\System\DEXDJBI.exe
  C:\Windows\System\DEXDJBI.exe
  2⤵
  PID:5184
- C:\Windows\System\RVnBHID.exe
  C:\Windows\System\RVnBHID.exe
  2⤵
  PID:5200
- C:\Windows\System\veTTXgb.exe
  C:\Windows\System\veTTXgb.exe
  2⤵
  PID:5216
- C:\Windows\System\IzoqMyl.exe
  C:\Windows\System\IzoqMyl.exe
  2⤵
  PID:5236
- C:\Windows\System\cRmuZII.exe
  C:\Windows\System\cRmuZII.exe
  2⤵
  PID:5252
- C:\Windows\System\ssGePhz.exe
  C:\Windows\System\ssGePhz.exe
  2⤵
  PID:5276
- C:\Windows\System\xMdwJvn.exe
  C:\Windows\System\xMdwJvn.exe
  2⤵
  PID:5292
- C:\Windows\System\ZNtcsSe.exe
  C:\Windows\System\ZNtcsSe.exe
  2⤵
  PID:5308
- C:\Windows\System\FpgKbgv.exe
  C:\Windows\System\FpgKbgv.exe
  2⤵
  PID:5324
- C:\Windows\System\yfDIfwy.exe
  C:\Windows\System\yfDIfwy.exe
  2⤵
  PID:5340
- C:\Windows\System\dSksrAY.exe
  C:\Windows\System\dSksrAY.exe
  2⤵
  PID:5364
- C:\Windows\System\pcFnOwm.exe
  C:\Windows\System\pcFnOwm.exe
  2⤵
  PID:5388
- C:\Windows\System\MijQDQf.exe
  C:\Windows\System\MijQDQf.exe
  2⤵
  PID:5404
- C:\Windows\System\KIulzZC.exe
  C:\Windows\System\KIulzZC.exe
  2⤵
  PID:5420
- C:\Windows\System\SRZmAON.exe
  C:\Windows\System\SRZmAON.exe
  2⤵
  PID:5440
- C:\Windows\System\bzweBaE.exe
  C:\Windows\System\bzweBaE.exe
  2⤵
  PID:5456
- C:\Windows\System\eKVxjto.exe
  C:\Windows\System\eKVxjto.exe
  2⤵
  PID:5472
- C:\Windows\System\oakxSxQ.exe
  C:\Windows\System\oakxSxQ.exe
  2⤵
  PID:5488
- C:\Windows\System\kMFYEit.exe
  C:\Windows\System\kMFYEit.exe
  2⤵
  PID:5504
- C:\Windows\System\RDPqDUM.exe
  C:\Windows\System\RDPqDUM.exe
  2⤵
  PID:5528
- C:\Windows\System\VNHaAxV.exe
  C:\Windows\System\VNHaAxV.exe
  2⤵
  PID:5544
- C:\Windows\System\WdPYZDJ.exe
  C:\Windows\System\WdPYZDJ.exe
  2⤵
  PID:5564
- C:\Windows\System\sFOzaSu.exe
  C:\Windows\System\sFOzaSu.exe
  2⤵
  PID:5584
- C:\Windows\System\jdORHQA.exe
  C:\Windows\System\jdORHQA.exe
  2⤵
  PID:5604
- C:\Windows\System\dOpUjrr.exe
  C:\Windows\System\dOpUjrr.exe
  2⤵
  PID:5620
- C:\Windows\System\SDcIryt.exe
  C:\Windows\System\SDcIryt.exe
  2⤵
  PID:5636
- C:\Windows\System\xiIVjmV.exe
  C:\Windows\System\xiIVjmV.exe
  2⤵
  PID:5652
- C:\Windows\System\AOOIVjL.exe
  C:\Windows\System\AOOIVjL.exe
  2⤵
  PID:5668
- C:\Windows\System\SMGvOkt.exe
  C:\Windows\System\SMGvOkt.exe
  2⤵
  PID:5688
- C:\Windows\System\YnNXytj.exe
  C:\Windows\System\YnNXytj.exe
  2⤵
  PID:5704
- C:\Windows\System\IRBvovh.exe
  C:\Windows\System\IRBvovh.exe
  2⤵
  PID:5724
- C:\Windows\System\ZCnsmOm.exe
  C:\Windows\System\ZCnsmOm.exe
  2⤵
  PID:5740
- C:\Windows\System\AfSLwMj.exe
  C:\Windows\System\AfSLwMj.exe
  2⤵
  PID:5756
- C:\Windows\System\WYnfnFj.exe
  C:\Windows\System\WYnfnFj.exe
  2⤵
  PID:5772
- C:\Windows\System\qtCnHcU.exe
  C:\Windows\System\qtCnHcU.exe
  2⤵
  PID:5792
- C:\Windows\System\EKfXPUA.exe
  C:\Windows\System\EKfXPUA.exe
  2⤵
  PID:5808
- C:\Windows\System\wvJXasR.exe
  C:\Windows\System\wvJXasR.exe
  2⤵
  PID:5824
- C:\Windows\System\aQWqrZW.exe
  C:\Windows\System\aQWqrZW.exe
  2⤵
  PID:5840
- C:\Windows\System\yIUahny.exe
  C:\Windows\System\yIUahny.exe
  2⤵
  PID:5860
- C:\Windows\System\iYxNtxS.exe
  C:\Windows\System\iYxNtxS.exe
  2⤵
  PID:5880
- C:\Windows\System\pNUXaBh.exe
  C:\Windows\System\pNUXaBh.exe
  2⤵
  PID:5904
- C:\Windows\System\njgnYve.exe
  C:\Windows\System\njgnYve.exe
  2⤵
  PID:5924
- C:\Windows\System\tBsDAfn.exe
  C:\Windows\System\tBsDAfn.exe
  2⤵
  PID:5940
- C:\Windows\System\tMxshfR.exe
  C:\Windows\System\tMxshfR.exe
  2⤵
  PID:5956
- C:\Windows\System\FVGxnYQ.exe
  C:\Windows\System\FVGxnYQ.exe
  2⤵
  PID:5976
- C:\Windows\System\HdmgoRy.exe
  C:\Windows\System\HdmgoRy.exe
  2⤵
  PID:6000
- C:\Windows\System\ImRcuHd.exe
  C:\Windows\System\ImRcuHd.exe
  2⤵
  PID:6032
- C:\Windows\System\kbaBVoy.exe
  C:\Windows\System\kbaBVoy.exe
  2⤵
  PID:6048
- C:\Windows\System\wgbLCRx.exe
  C:\Windows\System\wgbLCRx.exe
  2⤵
  PID:6064
- C:\Windows\System\QVsULON.exe
  C:\Windows\System\QVsULON.exe
  2⤵
  PID:6080
- C:\Windows\System\pSNgJcf.exe
  C:\Windows\System\pSNgJcf.exe
  2⤵
  PID:6100
- C:\Windows\System\GSySkrE.exe
  C:\Windows\System\GSySkrE.exe
  2⤵
  PID:6132
- C:\Windows\System\MgvAmvn.exe
  C:\Windows\System\MgvAmvn.exe
  2⤵
  PID:5140
- C:\Windows\System\CFbhpEt.exe
  C:\Windows\System\CFbhpEt.exe
  2⤵
  PID:4772
- C:\Windows\System\MIElkWt.exe
  C:\Windows\System\MIElkWt.exe
  2⤵
  PID:5160
- C:\Windows\System\cNczWUK.exe
  C:\Windows\System\cNczWUK.exe
  2⤵
  PID:5244
- C:\Windows\System\tyKjptK.exe
  C:\Windows\System\tyKjptK.exe
  2⤵
  PID:5284
- C:\Windows\System\LiTDOMG.exe
  C:\Windows\System\LiTDOMG.exe
  2⤵
  PID:5348
- C:\Windows\System\NrbPqlH.exe
  C:\Windows\System\NrbPqlH.exe
  2⤵
  PID:5232
- C:\Windows\System\gMXgCec.exe
  C:\Windows\System\gMXgCec.exe
  2⤵
  PID:5428
- C:\Windows\System\pTHUrdQ.exe
  C:\Windows\System\pTHUrdQ.exe
  2⤵
  PID:5468
- C:\Windows\System\iJkznbr.exe
  C:\Windows\System\iJkznbr.exe
  2⤵
  PID:5540
- C:\Windows\System\MONjIZs.exe
  C:\Windows\System\MONjIZs.exe
  2⤵
  PID:5452
- C:\Windows\System\YfWYDbJ.exe
  C:\Windows\System\YfWYDbJ.exe
  2⤵
  PID:5272
- C:\Windows\System\QabrLBw.exe
  C:\Windows\System\QabrLBw.exe
  2⤵
  PID:5372
- C:\Windows\System\lNGGFJf.exe
  C:\Windows\System\lNGGFJf.exe
  2⤵
  PID:5560
- C:\Windows\System\tSyaJif.exe
  C:\Windows\System\tSyaJif.exe
  2⤵
  PID:5576
- C:\Windows\System\KiLizZL.exe
  C:\Windows\System\KiLizZL.exe
  2⤵
  PID:5676
- C:\Windows\System\HkvqVCa.exe
  C:\Windows\System\HkvqVCa.exe
  2⤵
  PID:5480
- C:\Windows\System\fLYKhCR.exe
  C:\Windows\System\fLYKhCR.exe
  2⤵
  PID:5748
- C:\Windows\System\sBwUcGo.exe
  C:\Windows\System\sBwUcGo.exe
  2⤵
  PID:5788
- C:\Windows\System\cNDwbdA.exe
  C:\Windows\System\cNDwbdA.exe
  2⤵
  PID:5628
- C:\Windows\System\eRbxnBJ.exe
  C:\Windows\System\eRbxnBJ.exe
  2⤵
  PID:5592
- C:\Windows\System\pobOBnE.exe
  C:\Windows\System\pobOBnE.exe
  2⤵
  PID:5816
- C:\Windows\System\ZUlKNZz.exe
  C:\Windows\System\ZUlKNZz.exe
  2⤵
  PID:5856
- C:\Windows\System\aGQuOKh.exe
  C:\Windows\System\aGQuOKh.exe
  2⤵
  PID:5804
- C:\Windows\System\nJlzuSN.exe
  C:\Windows\System\nJlzuSN.exe
  2⤵
  PID:5876
- C:\Windows\System\VEAJTFE.exe
  C:\Windows\System\VEAJTFE.exe
  2⤵
  PID:5988
- C:\Windows\System\Sineiym.exe
  C:\Windows\System\Sineiym.exe
  2⤵
  PID:6016
- C:\Windows\System\zqzjzsP.exe
  C:\Windows\System\zqzjzsP.exe
  2⤵
  PID:6056
- C:\Windows\System\cgMOTtj.exe
  C:\Windows\System\cgMOTtj.exe
  2⤵
  PID:6096
- C:\Windows\System\gKQBEcq.exe
  C:\Windows\System\gKQBEcq.exe
  2⤵
  PID:4368
- C:\Windows\System\tFFcGQG.exe
  C:\Windows\System\tFFcGQG.exe
  2⤵
  PID:6120
- C:\Windows\System\qAFEYjG.exe
  C:\Windows\System\qAFEYjG.exe
  2⤵
  PID:5016
- C:\Windows\System\jQUfMdH.exe
  C:\Windows\System\jQUfMdH.exe
  2⤵
  PID:6128
- C:\Windows\System\WKLyFNW.exe
  C:\Windows\System\WKLyFNW.exe
  2⤵
  PID:5208
- C:\Windows\System\fBOOWzZ.exe
  C:\Windows\System\fBOOWzZ.exe
  2⤵
  PID:5224
- C:\Windows\System\rUGMgwl.exe
  C:\Windows\System\rUGMgwl.exe
  2⤵
  PID:5136
- C:\Windows\System\ItXdCEx.exe
  C:\Windows\System\ItXdCEx.exe
  2⤵
  PID:5536
- C:\Windows\System\HKkUgSn.exe
  C:\Windows\System\HKkUgSn.exe
  2⤵
  PID:5384
- C:\Windows\System\fDxsMKc.exe
  C:\Windows\System\fDxsMKc.exe
  2⤵
  PID:5716
- C:\Windows\System\IyKFQXL.exe
  C:\Windows\System\IyKFQXL.exe
  2⤵
  PID:5736
- C:\Windows\System\tQNuJSh.exe
  C:\Windows\System\tQNuJSh.exe
  2⤵
  PID:5612
- C:\Windows\System\KITMWIr.exe
  C:\Windows\System\KITMWIr.exe
  2⤵
  PID:5660
- C:\Windows\System\StsWKcT.exe
  C:\Windows\System\StsWKcT.exe
  2⤵
  PID:5768
- C:\Windows\System\fhCMDLJ.exe
  C:\Windows\System\fhCMDLJ.exe
  2⤵
  PID:5932
- C:\Windows\System\Vclertm.exe
  C:\Windows\System\Vclertm.exe
  2⤵
  PID:5968
- C:\Windows\System\BdrVEUt.exe
  C:\Windows\System\BdrVEUt.exe
  2⤵
  PID:6008
- C:\Windows\System\IdMrrzc.exe
  C:\Windows\System\IdMrrzc.exe
  2⤵
  PID:6108
- C:\Windows\System\ajKtxhQ.exe
  C:\Windows\System\ajKtxhQ.exe
  2⤵
  PID:6020
- C:\Windows\System\OgIprJK.exe
  C:\Windows\System\OgIprJK.exe
  2⤵
  PID:4392
- C:\Windows\System\JZdpuRf.exe
  C:\Windows\System\JZdpuRf.exe
  2⤵
  PID:4468
- C:\Windows\System\urfjkQl.exe
  C:\Windows\System\urfjkQl.exe
  2⤵
  PID:4380
- C:\Windows\System\CYmZiBd.exe
  C:\Windows\System\CYmZiBd.exe
  2⤵
  PID:5320
- C:\Windows\System\EPMIewp.exe
  C:\Windows\System\EPMIewp.exe
  2⤵
  PID:5400
- C:\Windows\System\OjbUvqb.exe
  C:\Windows\System\OjbUvqb.exe
  2⤵
  PID:5552
- C:\Windows\System\IgjIDfg.exe
  C:\Windows\System\IgjIDfg.exe
  2⤵
  PID:5396
- C:\Windows\System\uejexpU.exe
  C:\Windows\System\uejexpU.exe
  2⤵
  PID:5852
- C:\Windows\System\FUUYQLH.exe
  C:\Windows\System\FUUYQLH.exe
  2⤵
  PID:5512
- C:\Windows\System\LBYMHap.exe
  C:\Windows\System\LBYMHap.exe
  2⤵
  PID:5332
- C:\Windows\System\oOvTWbt.exe
  C:\Windows\System\oOvTWbt.exe
  2⤵
  PID:5900
- C:\Windows\System\XTTIICI.exe
  C:\Windows\System\XTTIICI.exe
  2⤵
  PID:5152
- C:\Windows\System\etkXbpX.exe
  C:\Windows\System\etkXbpX.exe
  2⤵
  PID:6088
- C:\Windows\System\DhhesXo.exe
  C:\Windows\System\DhhesXo.exe
  2⤵
  PID:6072
- C:\Windows\System\TblAJid.exe
  C:\Windows\System\TblAJid.exe
  2⤵
  PID:5264
- C:\Windows\System\pwBpFwA.exe
  C:\Windows\System\pwBpFwA.exe
  2⤵
  PID:5524
- C:\Windows\System\lZyLiag.exe
  C:\Windows\System\lZyLiag.exe
  2⤵
  PID:5336
- C:\Windows\System\hwkFxZg.exe
  C:\Windows\System\hwkFxZg.exe
  2⤵
  PID:6044
- C:\Windows\System\MtlerdF.exe
  C:\Windows\System\MtlerdF.exe
  2⤵
  PID:5832
- C:\Windows\System\aUImWiE.exe
  C:\Windows\System\aUImWiE.exe
  2⤵
  PID:6160
- C:\Windows\System\PStZYsS.exe
  C:\Windows\System\PStZYsS.exe
  2⤵
  PID:6184
- C:\Windows\System\NUZnZow.exe
  C:\Windows\System\NUZnZow.exe
  2⤵
  PID:6200
- C:\Windows\System\LrHQEsw.exe
  C:\Windows\System\LrHQEsw.exe
  2⤵
  PID:6216
- C:\Windows\System\IYKNHCj.exe
  C:\Windows\System\IYKNHCj.exe
  2⤵
  PID:6232
- C:\Windows\System\xeZIJMp.exe
  C:\Windows\System\xeZIJMp.exe
  2⤵
  PID:6252
- C:\Windows\System\JzPAtgo.exe
  C:\Windows\System\JzPAtgo.exe
  2⤵
  PID:6268
- C:\Windows\System\XZLNDrS.exe
  C:\Windows\System\XZLNDrS.exe
  2⤵
  PID:6284
- C:\Windows\System\KMTHcPH.exe
  C:\Windows\System\KMTHcPH.exe
  2⤵
  PID:6540
- C:\Windows\System\NKdSYGP.exe
  C:\Windows\System\NKdSYGP.exe
  2⤵
  PID:6556
- C:\Windows\System\ePSNpmT.exe
  C:\Windows\System\ePSNpmT.exe
  2⤵
  PID:6572
- C:\Windows\System\BNBGzGo.exe
  C:\Windows\System\BNBGzGo.exe
  2⤵
  PID:6588
- C:\Windows\System\yAYoZMs.exe
  C:\Windows\System\yAYoZMs.exe
  2⤵
  PID:6604
- C:\Windows\System\wLAczVF.exe
  C:\Windows\System\wLAczVF.exe
  2⤵
  PID:6624
- C:\Windows\System\RSFbwiJ.exe
  C:\Windows\System\RSFbwiJ.exe
  2⤵
  PID:6640
- C:\Windows\System\WMUjFOA.exe
  C:\Windows\System\WMUjFOA.exe
  2⤵
  PID:6660
- C:\Windows\System\JyYdTeY.exe
  C:\Windows\System\JyYdTeY.exe
  2⤵
  PID:6676
- C:\Windows\System\ckbfbCU.exe
  C:\Windows\System\ckbfbCU.exe
  2⤵
  PID:6808
- C:\Windows\System\cfgmBWM.exe
  C:\Windows\System\cfgmBWM.exe
  2⤵
  PID:6828
- C:\Windows\System\LpfWcgP.exe
  C:\Windows\System\LpfWcgP.exe
  2⤵
  PID:6844
- C:\Windows\System\bjdbjNf.exe
  C:\Windows\System\bjdbjNf.exe
  2⤵
  PID:6860
- C:\Windows\System\RTXCRTR.exe
  C:\Windows\System\RTXCRTR.exe
  2⤵
  PID:6880
- C:\Windows\System\qIltkPo.exe
  C:\Windows\System\qIltkPo.exe
  2⤵
  PID:6896
- C:\Windows\System\iZLsviq.exe
  C:\Windows\System\iZLsviq.exe
  2⤵
  PID:6916
- C:\Windows\System\oEeIixs.exe
  C:\Windows\System\oEeIixs.exe
  2⤵
  PID:6936
- C:\Windows\System\KIQtapY.exe
  C:\Windows\System\KIQtapY.exe
  2⤵
  PID:6952
- C:\Windows\System\VHmtYDc.exe
  C:\Windows\System\VHmtYDc.exe
  2⤵
  PID:6968
- C:\Windows\System\UtAlInZ.exe
  C:\Windows\System\UtAlInZ.exe
  2⤵
  PID:6988
- C:\Windows\System\DHRIliz.exe
  C:\Windows\System\DHRIliz.exe
  2⤵
  PID:7004
- C:\Windows\System\njpUQzL.exe
  C:\Windows\System\njpUQzL.exe
  2⤵
  PID:7020
- C:\Windows\System\YXCCVhb.exe
  C:\Windows\System\YXCCVhb.exe
  2⤵
  PID:7036
- C:\Windows\System\OUcIUor.exe
  C:\Windows\System\OUcIUor.exe
  2⤵
  PID:7052
- C:\Windows\System\GoeQySQ.exe
  C:\Windows\System\GoeQySQ.exe
  2⤵
  PID:7124
- C:\Windows\System\YpncMFv.exe
  C:\Windows\System\YpncMFv.exe
  2⤵
  PID:7148
- C:\Windows\System\JACAYGd.exe
  C:\Windows\System\JACAYGd.exe
  2⤵
  PID:5964
- C:\Windows\System\IZTDGzB.exe
  C:\Windows\System\IZTDGzB.exe
  2⤵
  PID:6040
- C:\Windows\System\FdDJSLi.exe
  C:\Windows\System\FdDJSLi.exe
  2⤵
  PID:6148
- C:\Windows\System\yjrnJqr.exe
  C:\Windows\System\yjrnJqr.exe
  2⤵
  PID:6228
- C:\Windows\System\TZGtHWd.exe
  C:\Windows\System\TZGtHWd.exe
  2⤵
  PID:6300
- C:\Windows\System\yKBrnlE.exe
  C:\Windows\System\yKBrnlE.exe
  2⤵
  PID:6384
- C:\Windows\System\EAYKBWb.exe
  C:\Windows\System\EAYKBWb.exe
  2⤵
  PID:5248
- C:\Windows\System\WLuBxqx.exe
  C:\Windows\System\WLuBxqx.exe
  2⤵
  PID:6156
- C:\Windows\System\MhMijbP.exe
  C:\Windows\System\MhMijbP.exe
  2⤵
  PID:6404
- C:\Windows\System\yoDboYL.exe
  C:\Windows\System\yoDboYL.exe
  2⤵
  PID:6420
- C:\Windows\System\LOYxbeQ.exe
  C:\Windows\System\LOYxbeQ.exe
  2⤵
  PID:6440
- C:\Windows\System\XteFJLw.exe
  C:\Windows\System\XteFJLw.exe
  2⤵
  PID:6464
- C:\Windows\System\SKQpxAy.exe
  C:\Windows\System\SKQpxAy.exe
  2⤵
  PID:6480
- C:\Windows\System\nfMrwaG.exe
  C:\Windows\System\nfMrwaG.exe
  2⤵
  PID:6496
- C:\Windows\System\hRXbgfV.exe
  C:\Windows\System\hRXbgfV.exe
  2⤵
  PID:6512
- C:\Windows\System\sLlDhIB.exe
  C:\Windows\System\sLlDhIB.exe
  2⤵
  PID:6528
- C:\Windows\System\ymbENZA.exe
  C:\Windows\System\ymbENZA.exe
  2⤵
  PID:6532
- C:\Windows\System\tvrmyFQ.exe
  C:\Windows\System\tvrmyFQ.exe
  2⤵
  PID:6584
- C:\Windows\System\vtnPcgS.exe
  C:\Windows\System\vtnPcgS.exe
  2⤵
  PID:6648
- C:\Windows\System\UXBoqFc.exe
  C:\Windows\System\UXBoqFc.exe
  2⤵
  PID:6708
- C:\Windows\System\ilRJGFG.exe
  C:\Windows\System\ilRJGFG.exe
  2⤵
  PID:6728
- C:\Windows\System\gQGtIQd.exe
  C:\Windows\System\gQGtIQd.exe
  2⤵
  PID:6744
- C:\Windows\System\MAPzuBU.exe
  C:\Windows\System\MAPzuBU.exe
  2⤵
  PID:6760
- C:\Windows\System\BZnWjtN.exe
  C:\Windows\System\BZnWjtN.exe
  2⤵
  PID:6596
- C:\Windows\System\mwoPoMU.exe
  C:\Windows\System\mwoPoMU.exe
  2⤵
  PID:6768
- C:\Windows\System\IIcaqHJ.exe
  C:\Windows\System\IIcaqHJ.exe
  2⤵
  PID:6792
- C:\Windows\System\ZNyfRBE.exe
  C:\Windows\System\ZNyfRBE.exe
  2⤵
  PID:7044
- C:\Windows\System\AGMzjLX.exe
  C:\Windows\System\AGMzjLX.exe
  2⤵
  PID:7108
- C:\Windows\System\fbJjdRJ.exe
  C:\Windows\System\fbJjdRJ.exe
  2⤵
  PID:7144
- C:\Windows\System\SNryQlp.exe
  C:\Windows\System\SNryQlp.exe
  2⤵
  PID:7092
- C:\Windows\System\qwgvGWk.exe
  C:\Windows\System\qwgvGWk.exe
  2⤵
  PID:7076
- C:\Windows\System\RHyGpPa.exe
  C:\Windows\System\RHyGpPa.exe
  2⤵
  PID:6928
- C:\Windows\System\YxmKawR.exe
  C:\Windows\System\YxmKawR.exe
  2⤵
  PID:6412
- C:\Windows\System\vaiSGkU.exe
  C:\Windows\System\vaiSGkU.exe
  2⤵
  PID:6212
- C:\Windows\System\BWaNeGG.exe
  C:\Windows\System\BWaNeGG.exe
  2⤵
  PID:6276
- C:\Windows\System\gqzdjhP.exe
  C:\Windows\System\gqzdjhP.exe
  2⤵
  PID:6176
- C:\Windows\System\ogZPhvS.exe
  C:\Windows\System\ogZPhvS.exe
  2⤵
  PID:5896
- C:\Windows\System\vWSThoP.exe
  C:\Windows\System\vWSThoP.exe
  2⤵
  PID:6636
- C:\Windows\System\iEDzaxQ.exe
  C:\Windows\System\iEDzaxQ.exe
  2⤵
  PID:6908
- C:\Windows\System\zcsYjXp.exe
  C:\Windows\System\zcsYjXp.exe
  2⤵
  PID:1940
- C:\Windows\System\XHwUjfW.exe
  C:\Windows\System\XHwUjfW.exe
  2⤵
  PID:6492
- C:\Windows\System\jtPGOMz.exe
  C:\Windows\System\jtPGOMz.exe
  2⤵
  PID:6428
- C:\Windows\System\GYyiuTm.exe
  C:\Windows\System\GYyiuTm.exe
  2⤵
  PID:6656
- C:\Windows\System\cuQSVzG.exe
  C:\Windows\System\cuQSVzG.exe
  2⤵
  PID:6508
- C:\Windows\System\RheCwfK.exe
  C:\Windows\System\RheCwfK.exe
  2⤵
  PID:6732
- C:\Windows\System\uqiwNxs.exe
  C:\Windows\System\uqiwNxs.exe
  2⤵
  PID:6612
- C:\Windows\System\xWFzPZR.exe
  C:\Windows\System\xWFzPZR.exe
  2⤵
  PID:6264
- C:\Windows\System\iOFQpMV.exe
  C:\Windows\System\iOFQpMV.exe
  2⤵
  PID:6776
- C:\Windows\System\EILukit.exe
  C:\Windows\System\EILukit.exe
  2⤵
  PID:952
- C:\Windows\System\gHALUOR.exe
  C:\Windows\System\gHALUOR.exe
  2⤵
  PID:6840
- C:\Windows\System\pdYUYMB.exe
  C:\Windows\System\pdYUYMB.exe
  2⤵
  PID:7096
- C:\Windows\System\FuwaWRL.exe
  C:\Windows\System\FuwaWRL.exe
  2⤵
  PID:6984
- C:\Windows\System\ahejpTq.exe
  C:\Windows\System\ahejpTq.exe
  2⤵
  PID:7140
- C:\Windows\System\vOhezrG.exe
  C:\Windows\System\vOhezrG.exe
  2⤵
  PID:7028
- C:\Windows\System\dfESlAD.exe
  C:\Windows\System\dfESlAD.exe
  2⤵
  PID:7112
- C:\Windows\System\JzBsDxi.exe
  C:\Windows\System\JzBsDxi.exe
  2⤵
  PID:6944
- C:\Windows\System\vfJfvOB.exe
  C:\Windows\System\vfJfvOB.exe
  2⤵
  PID:6172
- C:\Windows\System\nCHTglp.exe
  C:\Windows\System\nCHTglp.exe
  2⤵
  PID:6392
- C:\Windows\System\qJDYAFN.exe
  C:\Windows\System\qJDYAFN.exe
  2⤵
  PID:6208
- C:\Windows\System\FKxrtXk.exe
  C:\Windows\System\FKxrtXk.exe
  2⤵
  PID:6400
- C:\Windows\System\ZwcGqsL.exe
  C:\Windows\System\ZwcGqsL.exe
  2⤵
  PID:5952
- C:\Windows\System\NkbypeM.exe
  C:\Windows\System\NkbypeM.exe
  2⤵
  PID:6396
- C:\Windows\System\oviORnc.exe
  C:\Windows\System\oviORnc.exe
  2⤵
  PID:6168
- C:\Windows\System\gcBjFTB.exe
  C:\Windows\System\gcBjFTB.exe
  2⤵
  PID:2828
- C:\Windows\System\gAduPTa.exe
  C:\Windows\System\gAduPTa.exe
  2⤵
  PID:6548
- C:\Windows\System\jqIcBnz.exe
  C:\Windows\System\jqIcBnz.exe
  2⤵
  PID:6432
- C:\Windows\System\aDSsWnt.exe
  C:\Windows\System\aDSsWnt.exe
  2⤵
  PID:7084
- C:\Windows\System\urdlVMi.exe
  C:\Windows\System\urdlVMi.exe
  2⤵
  PID:6620
- C:\Windows\System\bvQgVqU.exe
  C:\Windows\System\bvQgVqU.exe
  2⤵
  PID:6296
- C:\Windows\System\KWrQeLN.exe
  C:\Windows\System\KWrQeLN.exe
  2⤵
  PID:6244
- C:\Windows\System\jOiNQnq.exe
  C:\Windows\System\jOiNQnq.exe
  2⤵
  PID:6868
- C:\Windows\System\YgcaWnn.exe
  C:\Windows\System\YgcaWnn.exe
  2⤵
  PID:6564
- C:\Windows\System\AyLORuI.exe
  C:\Windows\System\AyLORuI.exe
  2⤵
  PID:6240
- C:\Windows\System\BYhUyEO.exe
  C:\Windows\System\BYhUyEO.exe
  2⤵
  PID:6964
- C:\Windows\System\ejjdazj.exe
  C:\Windows\System\ejjdazj.exe
  2⤵
  PID:6948
- C:\Windows\System\HOVOXQv.exe
  C:\Windows\System\HOVOXQv.exe
  2⤵
  PID:6912
- C:\Windows\System\yUimJpG.exe
  C:\Windows\System\yUimJpG.exe
  2⤵
  PID:7176
- C:\Windows\System\BhbScDc.exe
  C:\Windows\System\BhbScDc.exe
  2⤵
  PID:7192
- C:\Windows\System\qaQZHPP.exe
  C:\Windows\System\qaQZHPP.exe
  2⤵
  PID:7208
- C:\Windows\System\BFUOGzp.exe
  C:\Windows\System\BFUOGzp.exe
  2⤵
  PID:7244
- C:\Windows\System\yqQIZAQ.exe
  C:\Windows\System\yqQIZAQ.exe
  2⤵
  PID:7268
- C:\Windows\System\FPhViWM.exe
  C:\Windows\System\FPhViWM.exe
  2⤵
  PID:7284
- C:\Windows\System\yXcjSXI.exe
  C:\Windows\System\yXcjSXI.exe
  2⤵
  PID:7300
- C:\Windows\System\NmqBJpL.exe
  C:\Windows\System\NmqBJpL.exe
  2⤵
  PID:7328
- C:\Windows\System\DSGHhap.exe
  C:\Windows\System\DSGHhap.exe
  2⤵
  PID:7344
- C:\Windows\System\lEyXRYN.exe
  C:\Windows\System\lEyXRYN.exe
  2⤵
  PID:7360
- C:\Windows\System\IRzwSnl.exe
  C:\Windows\System\IRzwSnl.exe
  2⤵
  PID:7376
- C:\Windows\System\gbDsltC.exe
  C:\Windows\System\gbDsltC.exe
  2⤵
  PID:7392
- C:\Windows\System\ylMDSRX.exe
  C:\Windows\System\ylMDSRX.exe
  2⤵
  PID:7408
- C:\Windows\System\IhrEMKq.exe
  C:\Windows\System\IhrEMKq.exe
  2⤵
  PID:7424
- C:\Windows\System\tccMzir.exe
  C:\Windows\System\tccMzir.exe
  2⤵
  PID:7440
- C:\Windows\System\qniJcKr.exe
  C:\Windows\System\qniJcKr.exe
  2⤵
  PID:7456
- C:\Windows\System\nPlXmSv.exe
  C:\Windows\System\nPlXmSv.exe
  2⤵
  PID:7476
- C:\Windows\System\gDDxoIk.exe
  C:\Windows\System\gDDxoIk.exe
  2⤵
  PID:7496
- C:\Windows\System\FPQJHzV.exe
  C:\Windows\System\FPQJHzV.exe
  2⤵
  PID:7516
- C:\Windows\System\DrQjFPF.exe
  C:\Windows\System\DrQjFPF.exe
  2⤵
  PID:7536
- C:\Windows\System\fIcgiBz.exe
  C:\Windows\System\fIcgiBz.exe
  2⤵
  PID:7560
- C:\Windows\System\BaYuRHl.exe
  C:\Windows\System\BaYuRHl.exe
  2⤵
  PID:7624
- C:\Windows\System\PLowviJ.exe
  C:\Windows\System\PLowviJ.exe
  2⤵
  PID:7640
- C:\Windows\System\JyVbpIL.exe
  C:\Windows\System\JyVbpIL.exe
  2⤵
  PID:7656
- C:\Windows\System\xeSewge.exe
  C:\Windows\System\xeSewge.exe
  2⤵
  PID:7672
- C:\Windows\System\LgMzuaL.exe
  C:\Windows\System\LgMzuaL.exe
  2⤵
  PID:7688
- C:\Windows\System\chnoplN.exe
  C:\Windows\System\chnoplN.exe
  2⤵
  PID:7704
- C:\Windows\System\BINRVcr.exe
  C:\Windows\System\BINRVcr.exe
  2⤵
  PID:7720
- C:\Windows\System\VpACAMt.exe
  C:\Windows\System\VpACAMt.exe
  2⤵
  PID:7748
- C:\Windows\System\EtZwOoI.exe
  C:\Windows\System\EtZwOoI.exe
  2⤵
  PID:7768
- C:\Windows\System\zXmERGn.exe
  C:\Windows\System\zXmERGn.exe
  2⤵
  PID:7784
- C:\Windows\System\ntcyDaI.exe
  C:\Windows\System\ntcyDaI.exe
  2⤵
  PID:7800
- C:\Windows\System\Yxqlwjt.exe
  C:\Windows\System\Yxqlwjt.exe
  2⤵
  PID:7816
- C:\Windows\System\OdKJUoL.exe
  C:\Windows\System\OdKJUoL.exe
  2⤵
  PID:7836
- C:\Windows\System\gvViEuI.exe
  C:\Windows\System\gvViEuI.exe
  2⤵
  PID:7852
- C:\Windows\System\NJtNapD.exe
  C:\Windows\System\NJtNapD.exe
  2⤵
  PID:7868
- C:\Windows\System\cLzZeJJ.exe
  C:\Windows\System\cLzZeJJ.exe
  2⤵
  PID:7884
- C:\Windows\System\TgglUpZ.exe
  C:\Windows\System\TgglUpZ.exe
  2⤵
  PID:7900
- C:\Windows\System\UuQQTTb.exe
  C:\Windows\System\UuQQTTb.exe
  2⤵
  PID:7916
- C:\Windows\System\AJYwzKL.exe
  C:\Windows\System\AJYwzKL.exe
  2⤵
  PID:7932
- C:\Windows\System\FhnGjip.exe
  C:\Windows\System\FhnGjip.exe
  2⤵
  PID:7948
- C:\Windows\System\sWBzdsi.exe
  C:\Windows\System\sWBzdsi.exe
  2⤵
  PID:7964
- C:\Windows\System\sGJKNEj.exe
  C:\Windows\System\sGJKNEj.exe
  2⤵
  PID:7984
- C:\Windows\System\BYoSrRb.exe
  C:\Windows\System\BYoSrRb.exe
  2⤵
  PID:8000
- C:\Windows\System\NduBxhq.exe
  C:\Windows\System\NduBxhq.exe
  2⤵
  PID:8016
- C:\Windows\System\XDqqcVf.exe
  C:\Windows\System\XDqqcVf.exe
  2⤵
  PID:8032
- C:\Windows\System\ktOjWAR.exe
  C:\Windows\System\ktOjWAR.exe
  2⤵
  PID:8048
- C:\Windows\System\TJxbbNX.exe
  C:\Windows\System\TJxbbNX.exe
  2⤵
  PID:8064
- C:\Windows\System\dWHoDwM.exe
  C:\Windows\System\dWHoDwM.exe
  2⤵
  PID:8080
- C:\Windows\System\RrcjQHO.exe
  C:\Windows\System\RrcjQHO.exe
  2⤵
  PID:8096
- C:\Windows\System\wLFEweH.exe
  C:\Windows\System\wLFEweH.exe
  2⤵
  PID:8116
- C:\Windows\System\NhAVVsm.exe
  C:\Windows\System\NhAVVsm.exe
  2⤵
  PID:8136
- C:\Windows\System\ciugMDz.exe
  C:\Windows\System\ciugMDz.exe
  2⤵
  PID:8152
- C:\Windows\System\hAIzAxv.exe
  C:\Windows\System\hAIzAxv.exe
  2⤵
  PID:8168
- C:\Windows\System\kGLHNHP.exe
  C:\Windows\System\kGLHNHP.exe
  2⤵
  PID:8184
- C:\Windows\System\VzvcXUz.exe
  C:\Windows\System\VzvcXUz.exe
  2⤵
  PID:940
- C:\Windows\System\dtFdfgY.exe
  C:\Windows\System\dtFdfgY.exe
  2⤵
  PID:7224
- C:\Windows\System\KcfkUlG.exe
  C:\Windows\System\KcfkUlG.exe
  2⤵
  PID:6568
- C:\Windows\System\ZxAkXTK.exe
  C:\Windows\System\ZxAkXTK.exe
  2⤵
  PID:6892
- C:\Windows\System\jIrbCEh.exe
  C:\Windows\System\jIrbCEh.exe
  2⤵
  PID:6856
- C:\Windows\System\gdrettF.exe
  C:\Windows\System\gdrettF.exe
  2⤵
  PID:6788
- C:\Windows\System\YwfPUlQ.exe
  C:\Windows\System\YwfPUlQ.exe
  2⤵
  PID:6380
- C:\Windows\System\lzDLtMx.exe
  C:\Windows\System\lzDLtMx.exe
  2⤵
  PID:2700
- C:\Windows\System\lcmRuCh.exe
  C:\Windows\System\lcmRuCh.exe
  2⤵
  PID:6292
- C:\Windows\System\EhsEJYL.exe
  C:\Windows\System\EhsEJYL.exe
  2⤵
  PID:7240
- C:\Windows\System\YRXJeMJ.exe
  C:\Windows\System\YRXJeMJ.exe
  2⤵
  PID:6904
- C:\Windows\System\SyIZftL.exe
  C:\Windows\System\SyIZftL.exe
  2⤵
  PID:7308
- C:\Windows\System\mxhYOGI.exe
  C:\Windows\System\mxhYOGI.exe
  2⤵
  PID:7324
- C:\Windows\System\CQoqsQg.exe
  C:\Windows\System\CQoqsQg.exe
  2⤵
  PID:6476
- C:\Windows\System\AzYRmIn.exe
  C:\Windows\System\AzYRmIn.exe
  2⤵
  PID:6824
- C:\Windows\System\IbjWXCF.exe
  C:\Windows\System\IbjWXCF.exe
  2⤵
  PID:7252
- C:\Windows\System\RROHAiD.exe
  C:\Windows\System\RROHAiD.exe
  2⤵
  PID:7296
- C:\Windows\System\DDKDaOJ.exe
  C:\Windows\System\DDKDaOJ.exe
  2⤵
  PID:7420
- C:\Windows\System\nzpQxpQ.exe
  C:\Windows\System\nzpQxpQ.exe
  2⤵
  PID:7452
- C:\Windows\System\ayOmqLI.exe
  C:\Windows\System\ayOmqLI.exe
  2⤵
  PID:7436
- C:\Windows\System\wORerJD.exe
  C:\Windows\System\wORerJD.exe
  2⤵
  PID:1648
- C:\Windows\System\rIJmwSZ.exe
  C:\Windows\System\rIJmwSZ.exe
  2⤵
  PID:7524
- C:\Windows\System\madcqSh.exe
  C:\Windows\System\madcqSh.exe
  2⤵
  PID:7472
- C:\Windows\System\zpYJcrp.exe
  C:\Windows\System\zpYJcrp.exe
  2⤵
  PID:7504
- C:\Windows\System\jxwjufA.exe
  C:\Windows\System\jxwjufA.exe
  2⤵
  PID:7236
- C:\Windows\System\OaZbEGj.exe
  C:\Windows\System\OaZbEGj.exe
  2⤵
  PID:7584
- C:\Windows\System\WqpXPzA.exe
  C:\Windows\System\WqpXPzA.exe
  2⤵
  PID:7600
- C:\Windows\System\STDYgTY.exe
  C:\Windows\System\STDYgTY.exe
  2⤵
  PID:7616
- C:\Windows\System\iZIrYOI.exe
  C:\Windows\System\iZIrYOI.exe
  2⤵
  PID:7680
- C:\Windows\System\DVElJJr.exe
  C:\Windows\System\DVElJJr.exe
  2⤵
  PID:7756
- C:\Windows\System\rtPqhco.exe
  C:\Windows\System\rtPqhco.exe
  2⤵
  PID:7796
- C:\Windows\System\RZQGrOb.exe
  C:\Windows\System\RZQGrOb.exe
  2⤵
  PID:7636
- C:\Windows\System\FemaZZB.exe
  C:\Windows\System\FemaZZB.exe
  2⤵
  PID:7696
- C:\Windows\System\YfgjNnT.exe
  C:\Windows\System\YfgjNnT.exe
  2⤵
  PID:7776
- C:\Windows\System\odWyxEU.exe
  C:\Windows\System\odWyxEU.exe
  2⤵
  PID:7812
- C:\Windows\System\NKyuIkh.exe
  C:\Windows\System\NKyuIkh.exe
  2⤵
  PID:7844
- C:\Windows\System\QDfVqSh.exe
  C:\Windows\System\QDfVqSh.exe
  2⤵
  PID:7896
- C:\Windows\System\kiNbgSP.exe
  C:\Windows\System\kiNbgSP.exe
  2⤵
  PID:7912
- C:\Windows\System\YhOXGjy.exe
  C:\Windows\System\YhOXGjy.exe
  2⤵
  PID:7944
- C:\Windows\System\ADrYfSn.exe
  C:\Windows\System\ADrYfSn.exe
  2⤵
  PID:7996
- C:\Windows\System\AZsPvYw.exe
  C:\Windows\System\AZsPvYw.exe
  2⤵
  PID:8008
- C:\Windows\System\CUSiVhN.exe
  C:\Windows\System\CUSiVhN.exe
  2⤵
  PID:8056
- C:\Windows\System\TGzdpEG.exe
  C:\Windows\System\TGzdpEG.exe
  2⤵
  PID:8076
- C:\Windows\System\hgRyGdw.exe
  C:\Windows\System\hgRyGdw.exe
  2⤵
  PID:8104
- C:\Windows\System\AeHQZLo.exe
  C:\Windows\System\AeHQZLo.exe
  2⤵
  PID:8164
- C:\Windows\System\RFinORV.exe
  C:\Windows\System\RFinORV.exe
  2⤵
  PID:8108
- C:\Windows\System\ViwPsee.exe
  C:\Windows\System\ViwPsee.exe
  2⤵
  PID:8148
- C:\Windows\System\rtarhaE.exe
  C:\Windows\System\rtarhaE.exe
  2⤵
  PID:7216
- C:\Windows\System\KIJCcdc.exe
  C:\Windows\System\KIJCcdc.exe
  2⤵
  PID:6872
- C:\Windows\System\CiPyCCW.exe
  C:\Windows\System\CiPyCCW.exe
  2⤵
  PID:7068
- C:\Windows\System\uDSYaAF.exe
  C:\Windows\System\uDSYaAF.exe
  2⤵
  PID:7000
- C:\Windows\System\uNnaWPh.exe
  C:\Windows\System\uNnaWPh.exe
  2⤵
  PID:7280
- C:\Windows\System\trxLRBc.exe
  C:\Windows\System\trxLRBc.exe
  2⤵
  PID:7416
- C:\Windows\System\EBxRiVG.exe
  C:\Windows\System\EBxRiVG.exe
  2⤵
  PID:7356
- C:\Windows\System\DMNWwTL.exe
  C:\Windows\System\DMNWwTL.exe
  2⤵
  PID:7200
- C:\Windows\System\ofTJyHy.exe
  C:\Windows\System\ofTJyHy.exe
  2⤵
  PID:7404
- C:\Windows\System\HFoQtVb.exe
  C:\Windows\System\HFoQtVb.exe
  2⤵
  PID:7572
- C:\Windows\System\nzwDFXj.exe
  C:\Windows\System\nzwDFXj.exe
  2⤵
  PID:7548
- C:\Windows\System\icaHOJG.exe
  C:\Windows\System\icaHOJG.exe
  2⤵
  PID:7612
- C:\Windows\System\PXAsUrW.exe
  C:\Windows\System\PXAsUrW.exe
  2⤵
  PID:7764
- C:\Windows\System\vYtSbqD.exe
  C:\Windows\System\vYtSbqD.exe
  2⤵
  PID:7632
- C:\Windows\System\wiBlwME.exe
  C:\Windows\System\wiBlwME.exe
  2⤵
  PID:7808
- C:\Windows\System\eqEyABk.exe
  C:\Windows\System\eqEyABk.exe
  2⤵
  PID:7860
- C:\Windows\System\GvtJijC.exe
  C:\Windows\System\GvtJijC.exe
  2⤵
  PID:7980
- C:\Windows\System\WzETETt.exe
  C:\Windows\System\WzETETt.exe
  2⤵
  PID:8132
- C:\Windows\System\mOmSeET.exe
  C:\Windows\System\mOmSeET.exe
  2⤵
  PID:2604
- C:\Windows\System\PQlzFTW.exe
  C:\Windows\System\PQlzFTW.exe
  2⤵
  PID:8180
- C:\Windows\System\JIBhCUV.exe
  C:\Windows\System\JIBhCUV.exe
  2⤵
  PID:7188
- C:\Windows\System\GdYroFX.exe
  C:\Windows\System\GdYroFX.exe
  2⤵
  PID:6248
- C:\Windows\System\BDJwopt.exe
  C:\Windows\System\BDJwopt.exe
  2⤵
  PID:7448
- C:\Windows\System\tgIOGtr.exe
  C:\Windows\System\tgIOGtr.exe
  2⤵
  PID:7388
- C:\Windows\System\dkeBuqo.exe
  C:\Windows\System\dkeBuqo.exe
  2⤵
  PID:6320
- C:\Windows\System\uJMEVTA.exe
  C:\Windows\System\uJMEVTA.exe
  2⤵
  PID:964
- C:\Windows\System\hbKrWNn.exe
  C:\Windows\System\hbKrWNn.exe
  2⤵
  PID:7468
- C:\Windows\System\XsBTGay.exe
  C:\Windows\System\XsBTGay.exe
  2⤵
  PID:7336
- C:\Windows\System\FnsCXyY.exe
  C:\Windows\System\FnsCXyY.exe
  2⤵
  PID:7164
- C:\Windows\System\nQrRlyP.exe
  C:\Windows\System\nQrRlyP.exe
  2⤵
  PID:2720
- C:\Windows\System\wBNISEM.exe
  C:\Windows\System\wBNISEM.exe
  2⤵
  PID:7828
- C:\Windows\System\xSWzLgL.exe
  C:\Windows\System\xSWzLgL.exe
  2⤵
  PID:6820
- C:\Windows\System\YpQpKpv.exe
  C:\Windows\System\YpQpKpv.exe
  2⤵
  PID:6316
- C:\Windows\System\oQvWEKh.exe
  C:\Windows\System\oQvWEKh.exe
  2⤵
  PID:7940
- C:\Windows\System\OYSbXTG.exe
  C:\Windows\System\OYSbXTG.exe
  2⤵
  PID:8072
- C:\Windows\System\ZfQzzqP.exe
  C:\Windows\System\ZfQzzqP.exe
  2⤵
  PID:8088
- C:\Windows\System\HbKiXVl.exe
  C:\Windows\System\HbKiXVl.exe
  2⤵
  PID:2824
- C:\Windows\System\AAZCClU.exe
  C:\Windows\System\AAZCClU.exe
  2⤵
  PID:2100
- C:\Windows\System\ohhgrog.exe
  C:\Windows\System\ohhgrog.exe
  2⤵
  PID:664
- C:\Windows\System\HzodpdF.exe
  C:\Windows\System\HzodpdF.exe
  2⤵
  PID:7608
- C:\Windows\System\wnyswxI.exe
  C:\Windows\System\wnyswxI.exe
  2⤵
  PID:7716
- C:\Windows\System\iSZHJng.exe
  C:\Windows\System\iSZHJng.exe
  2⤵
  PID:7728
- C:\Windows\System\ASFwizV.exe
  C:\Windows\System\ASFwizV.exe
  2⤵
  PID:8124
- C:\Windows\System\xtElwbi.exe
  C:\Windows\System\xtElwbi.exe
  2⤵
  PID:7972
- C:\Windows\System\rPCIjtl.exe
  C:\Windows\System\rPCIjtl.exe
  2⤵
  PID:6716
- C:\Windows\System\KZCltez.exe
  C:\Windows\System\KZCltez.exe
  2⤵
  PID:8160
- C:\Windows\System\XIRKaiE.exe
  C:\Windows\System\XIRKaiE.exe
  2⤵
  PID:7512
- C:\Windows\System\XxFARHc.exe
  C:\Windows\System\XxFARHc.exe
  2⤵
  PID:7544
- C:\Windows\System\jtdziiN.exe
  C:\Windows\System\jtdziiN.exe
  2⤵
  PID:8060
- C:\Windows\System\fCXTJwE.exe
  C:\Windows\System\fCXTJwE.exe
  2⤵
  PID:6456
- C:\Windows\System\fZIFiIz.exe
  C:\Windows\System\fZIFiIz.exe
  2⤵
  PID:7592
- C:\Windows\System\FYPBnBM.exe
  C:\Windows\System\FYPBnBM.exe
  2⤵
  PID:7668
- C:\Windows\System\doNOMYG.exe
  C:\Windows\System\doNOMYG.exe
  2⤵
  PID:3100
- C:\Windows\System\MnfoOHX.exe
  C:\Windows\System\MnfoOHX.exe
  2⤵
  PID:8196
- C:\Windows\System\vIAzmHZ.exe
  C:\Windows\System\vIAzmHZ.exe
  2⤵
  PID:8212
- C:\Windows\System\jVznzje.exe
  C:\Windows\System\jVznzje.exe
  2⤵
  PID:8228
- C:\Windows\System\GumrfxH.exe
  C:\Windows\System\GumrfxH.exe
  2⤵
  PID:8244
- C:\Windows\System\gwnZqMC.exe
  C:\Windows\System\gwnZqMC.exe
  2⤵
  PID:8260
- C:\Windows\System\eYqPalb.exe
  C:\Windows\System\eYqPalb.exe
  2⤵
  PID:8276
- C:\Windows\System\suWxhfF.exe
  C:\Windows\System\suWxhfF.exe
  2⤵
  PID:8292
- C:\Windows\System\lJNUozW.exe
  C:\Windows\System\lJNUozW.exe
  2⤵
  PID:8308
- C:\Windows\System\EeaWjIQ.exe
  C:\Windows\System\EeaWjIQ.exe
  2⤵
  PID:8324
- C:\Windows\System\fIdEJoY.exe
  C:\Windows\System\fIdEJoY.exe
  2⤵
  PID:8340
- C:\Windows\System\BQMQSCp.exe
  C:\Windows\System\BQMQSCp.exe
  2⤵
  PID:8356
- C:\Windows\System\rqyRNlN.exe
  C:\Windows\System\rqyRNlN.exe
  2⤵
  PID:8372
- C:\Windows\System\iLAmqyK.exe
  C:\Windows\System\iLAmqyK.exe
  2⤵
  PID:8388
- C:\Windows\System\qzLLVpl.exe
  C:\Windows\System\qzLLVpl.exe
  2⤵
  PID:8404
- C:\Windows\System\lHFTxNw.exe
  C:\Windows\System\lHFTxNw.exe
  2⤵
  PID:8420
- C:\Windows\System\GgTEDMQ.exe
  C:\Windows\System\GgTEDMQ.exe
  2⤵
  PID:8436
- C:\Windows\System\OEgLups.exe
  C:\Windows\System\OEgLups.exe
  2⤵
  PID:8452
- C:\Windows\System\DnpplgC.exe
  C:\Windows\System\DnpplgC.exe
  2⤵
  PID:8468
- C:\Windows\System\BtjUhjU.exe
  C:\Windows\System\BtjUhjU.exe
  2⤵
  PID:8488
- C:\Windows\System\ordSpva.exe
  C:\Windows\System\ordSpva.exe
  2⤵
  PID:8504
- C:\Windows\System\mIbOUAh.exe
  C:\Windows\System\mIbOUAh.exe
  2⤵
  PID:8520
- C:\Windows\System\khSXcLQ.exe
  C:\Windows\System\khSXcLQ.exe
  2⤵
  PID:8536
- C:\Windows\System\MrbaqOz.exe
  C:\Windows\System\MrbaqOz.exe
  2⤵
  PID:8552
- C:\Windows\System\pbXscig.exe
  C:\Windows\System\pbXscig.exe
  2⤵
  PID:8568
- C:\Windows\System\BhDvDzA.exe
  C:\Windows\System\BhDvDzA.exe
  2⤵
  PID:8584
- C:\Windows\System\lshZvYk.exe
  C:\Windows\System\lshZvYk.exe
  2⤵
  PID:8600
- C:\Windows\System\lkEucPn.exe
  C:\Windows\System\lkEucPn.exe
  2⤵
  PID:8616
- C:\Windows\System\tbFiyXH.exe
  C:\Windows\System\tbFiyXH.exe
  2⤵
  PID:8632
- C:\Windows\System\ebNgvTC.exe
  C:\Windows\System\ebNgvTC.exe
  2⤵
  PID:8652
- C:\Windows\System\qUjsBWn.exe
  C:\Windows\System\qUjsBWn.exe
  2⤵
  PID:8668
- C:\Windows\System\VeolgcZ.exe
  C:\Windows\System\VeolgcZ.exe
  2⤵
  PID:8684
- C:\Windows\System\IouvHkA.exe
  C:\Windows\System\IouvHkA.exe
  2⤵
  PID:8700
- C:\Windows\System\iBzSUHo.exe
  C:\Windows\System\iBzSUHo.exe
  2⤵
  PID:8716
- C:\Windows\System\DutuOQN.exe
  C:\Windows\System\DutuOQN.exe
  2⤵
  PID:8732
- C:\Windows\System\NcVLaWP.exe
  C:\Windows\System\NcVLaWP.exe
  2⤵
  PID:8748
- C:\Windows\System\JghSeDO.exe
  C:\Windows\System\JghSeDO.exe
  2⤵
  PID:8764
- C:\Windows\System\ladgOiA.exe
  C:\Windows\System\ladgOiA.exe
  2⤵
  PID:8788
- C:\Windows\System\NcQToUL.exe
  C:\Windows\System\NcQToUL.exe
  2⤵
  PID:8804
- C:\Windows\System\iwRjuMK.exe
  C:\Windows\System\iwRjuMK.exe
  2⤵
  PID:8820
- C:\Windows\System\eksMTAb.exe
  C:\Windows\System\eksMTAb.exe
  2⤵
  PID:8836
- C:\Windows\System\qMbRKhF.exe
  C:\Windows\System\qMbRKhF.exe
  2⤵
  PID:8852
- C:\Windows\System\KTPJCrr.exe
  C:\Windows\System\KTPJCrr.exe
  2⤵
  PID:8868
- C:\Windows\System\RSfBJHc.exe
  C:\Windows\System\RSfBJHc.exe
  2⤵
  PID:8884
- C:\Windows\System\oBOWotv.exe
  C:\Windows\System\oBOWotv.exe
  2⤵
  PID:8900
- C:\Windows\System\uLKukcU.exe
  C:\Windows\System\uLKukcU.exe
  2⤵
  PID:8916
- C:\Windows\System\zRyNwPW.exe
  C:\Windows\System\zRyNwPW.exe
  2⤵
  PID:8932
- C:\Windows\System\kiqewza.exe
  C:\Windows\System\kiqewza.exe
  2⤵
  PID:8948
- C:\Windows\System\HYQihJH.exe
  C:\Windows\System\HYQihJH.exe
  2⤵
  PID:8964
- C:\Windows\System\OxmuFyM.exe
  C:\Windows\System\OxmuFyM.exe
  2⤵
  PID:8984
- C:\Windows\System\mgGRONl.exe
  C:\Windows\System\mgGRONl.exe
  2⤵
  PID:9008
- C:\Windows\System\SIuvILj.exe
  C:\Windows\System\SIuvILj.exe
  2⤵
  PID:9024
- C:\Windows\System\rhZPaqJ.exe
  C:\Windows\System\rhZPaqJ.exe
  2⤵
  PID:9040
- C:\Windows\System\YHebkkl.exe
  C:\Windows\System\YHebkkl.exe
  2⤵
  PID:9056
- C:\Windows\System\glMnxXw.exe
  C:\Windows\System\glMnxXw.exe
  2⤵
  PID:9076
- C:\Windows\System\RNVJcjZ.exe
  C:\Windows\System\RNVJcjZ.exe
  2⤵
  PID:9092
- C:\Windows\System\OfktJJf.exe
  C:\Windows\System\OfktJJf.exe
  2⤵
  PID:9108
- C:\Windows\System\bjtbFWN.exe
  C:\Windows\System\bjtbFWN.exe
  2⤵
  PID:9124
- C:\Windows\System\BVIZmLc.exe
  C:\Windows\System\BVIZmLc.exe
  2⤵
  PID:9140
- C:\Windows\System\BZSTyQS.exe
  C:\Windows\System\BZSTyQS.exe
  2⤵
  PID:9160
- C:\Windows\System\rwXUbWr.exe
  C:\Windows\System\rwXUbWr.exe
  2⤵
  PID:9188
- C:\Windows\System\szcIaOl.exe
  C:\Windows\System\szcIaOl.exe
  2⤵
  PID:9208
- C:\Windows\System\DvVEIXP.exe
  C:\Windows\System\DvVEIXP.exe
  2⤵
  PID:8220
- C:\Windows\System\vaBzMPf.exe
  C:\Windows\System\vaBzMPf.exe
  2⤵
  PID:8236
- C:\Windows\System\HJwGVPx.exe
  C:\Windows\System\HJwGVPx.exe
  2⤵
  PID:8268
- C:\Windows\System\ECpjwYQ.exe
  C:\Windows\System\ECpjwYQ.exe
  2⤵
  PID:8316
- C:\Windows\System\PhgKvxv.exe
  C:\Windows\System\PhgKvxv.exe
  2⤵
  PID:8348
- C:\Windows\System\kOMJpGP.exe
  C:\Windows\System\kOMJpGP.exe
  2⤵
  PID:8368
- C:\Windows\System\tWXquhr.exe
  C:\Windows\System\tWXquhr.exe
  2⤵
  PID:8416
- C:\Windows\System\nYycnKB.exe
  C:\Windows\System\nYycnKB.exe
  2⤵
  PID:8448
- C:\Windows\System\xwNyUgn.exe
  C:\Windows\System\xwNyUgn.exe
  2⤵
  PID:8484
- C:\Windows\System\egOzsvL.exe
  C:\Windows\System\egOzsvL.exe
  2⤵
  PID:8516
- C:\Windows\System\wiUqbXO.exe
  C:\Windows\System\wiUqbXO.exe
  2⤵
  PID:8528
- C:\Windows\System\VnqAXCB.exe
  C:\Windows\System\VnqAXCB.exe
  2⤵
  PID:8608
- C:\Windows\System\VKPZngP.exe
  C:\Windows\System\VKPZngP.exe
  2⤵
  PID:8644
- C:\Windows\System\oioRoMd.exe
  C:\Windows\System\oioRoMd.exe
  2⤵
  PID:8676
- C:\Windows\System\zNrKMUx.exe
  C:\Windows\System\zNrKMUx.exe
  2⤵
  PID:8660
- C:\Windows\System\sLgzJxH.exe
  C:\Windows\System\sLgzJxH.exe
  2⤵
  PID:8712
- C:\Windows\System\tsOdROB.exe
  C:\Windows\System\tsOdROB.exe
  2⤵
  PID:8724
- C:\Windows\System\QZlhsWe.exe
  C:\Windows\System\QZlhsWe.exe
  2⤵
  PID:8780
- C:\Windows\System\WksnNzd.exe
  C:\Windows\System\WksnNzd.exe
  2⤵
  PID:7736
- C:\Windows\System\DDszCiQ.exe
  C:\Windows\System\DDszCiQ.exe
  2⤵
  PID:8800
- C:\Windows\System\rTjMWoa.exe
  C:\Windows\System\rTjMWoa.exe
  2⤵
  PID:8832
- C:\Windows\System\KPYeXFn.exe
  C:\Windows\System\KPYeXFn.exe
  2⤵
  PID:8912
- C:\Windows\System\ZhtHLvW.exe
  C:\Windows\System\ZhtHLvW.exe
  2⤵
  PID:8972
- C:\Windows\System\HouCUEd.exe
  C:\Windows\System\HouCUEd.exe
  2⤵
  PID:8956
- C:\Windows\System\IvTwHeK.exe
  C:\Windows\System\IvTwHeK.exe
  2⤵
  PID:8992
- C:\Windows\System\SBUIKkr.exe
  C:\Windows\System\SBUIKkr.exe
  2⤵
  PID:9048
- C:\Windows\System\BTNmynH.exe
  C:\Windows\System\BTNmynH.exe
  2⤵
  PID:8664
- C:\Windows\System\IInWOVU.exe
  C:\Windows\System\IInWOVU.exe
  2⤵
  PID:8760
- C:\Windows\System\ucvMEVo.exe
  C:\Windows\System\ucvMEVo.exe
  2⤵
  PID:8892
- C:\Windows\System\bOvwBnY.exe
  C:\Windows\System\bOvwBnY.exe
  2⤵
  PID:8908
- C:\Windows\System\JxvdFPh.exe
  C:\Windows\System\JxvdFPh.exe
  2⤵
  PID:9072
- C:\Windows\System\YwZTGWD.exe
  C:\Windows\System\YwZTGWD.exe
  2⤵
  PID:9064
- C:\Windows\System\kurkJKs.exe
  C:\Windows\System\kurkJKs.exe
  2⤵
  PID:9152
- C:\Windows\System\gyFWuel.exe
  C:\Windows\System\gyFWuel.exe
  2⤵
  PID:9200
- C:\Windows\System\CfufEpG.exe
  C:\Windows\System\CfufEpG.exe
  2⤵
  PID:9136
- C:\Windows\System\buwgIUJ.exe
  C:\Windows\System\buwgIUJ.exe
  2⤵
  PID:8944
- C:\Windows\System\ZEiPikl.exe
  C:\Windows\System\ZEiPikl.exe
  2⤵
  PID:9296
- C:\Windows\System\rtRtamK.exe
  C:\Windows\System\rtRtamK.exe
  2⤵
  PID:9396
- C:\Windows\System\GxjWcBs.exe
  C:\Windows\System\GxjWcBs.exe
  2⤵
  PID:9464
- C:\Windows\System\XsROmXe.exe
  C:\Windows\System\XsROmXe.exe
  2⤵
  PID:9484
- C:\Windows\System\rCBIStO.exe
  C:\Windows\System\rCBIStO.exe
  2⤵
  PID:9504
- C:\Windows\System\GnafkdO.exe
  C:\Windows\System\GnafkdO.exe
  2⤵
  PID:9520
- C:\Windows\System\OZDPhJf.exe
  C:\Windows\System\OZDPhJf.exe
  2⤵
  PID:9536
- C:\Windows\System\ZvYwKZX.exe
  C:\Windows\System\ZvYwKZX.exe
  2⤵
  PID:9556
- C:\Windows\System\MgIsZDW.exe
  C:\Windows\System\MgIsZDW.exe
  2⤵
  PID:9600
- C:\Windows\System\IDFFbkn.exe
  C:\Windows\System\IDFFbkn.exe
  2⤵
  PID:9616
- C:\Windows\System\ZLSXYgg.exe
  C:\Windows\System\ZLSXYgg.exe
  2⤵
  PID:9632
- C:\Windows\System\auSgRwl.exe
  C:\Windows\System\auSgRwl.exe
  2⤵
  PID:9648
- C:\Windows\System\bCJfXpn.exe
  C:\Windows\System\bCJfXpn.exe
  2⤵
  PID:9664
- C:\Windows\System\gXRAkko.exe
  C:\Windows\System\gXRAkko.exe
  2⤵
  PID:9680
- C:\Windows\System\OOvIHLT.exe
  C:\Windows\System\OOvIHLT.exe
  2⤵
  PID:9700
- C:\Windows\System\fTBJCec.exe
  C:\Windows\System\fTBJCec.exe
  2⤵
  PID:9716
- C:\Windows\System\sVhqGnD.exe
  C:\Windows\System\sVhqGnD.exe
  2⤵
  PID:9732
- C:\Windows\System\MNrixKv.exe
  C:\Windows\System\MNrixKv.exe
  2⤵
  PID:9748
- C:\Windows\System\WkKxrcz.exe
  C:\Windows\System\WkKxrcz.exe
  2⤵
  PID:9764
- C:\Windows\System\tFjxosX.exe
  C:\Windows\System\tFjxosX.exe
  2⤵
  PID:9780
- C:\Windows\System\rtLPdpt.exe
  C:\Windows\System\rtLPdpt.exe
  2⤵
  PID:9796
- C:\Windows\System\BzghzPK.exe
  C:\Windows\System\BzghzPK.exe
  2⤵
  PID:9812
- C:\Windows\System\rPqjBHn.exe
  C:\Windows\System\rPqjBHn.exe
  2⤵
  PID:9828
- C:\Windows\System\kvCAIVr.exe
  C:\Windows\System\kvCAIVr.exe
  2⤵
  PID:9868
- C:\Windows\System\usVMtkE.exe
  C:\Windows\System\usVMtkE.exe
  2⤵
  PID:9888
- C:\Windows\System\apjXPrG.exe
  C:\Windows\System\apjXPrG.exe
  2⤵
  PID:9904
- C:\Windows\System\LFMzkzU.exe
  C:\Windows\System\LFMzkzU.exe
  2⤵
  PID:9928
- C:\Windows\System\gbIbnOk.exe
  C:\Windows\System\gbIbnOk.exe
  2⤵
  PID:9944
- C:\Windows\System\jlFEacW.exe
  C:\Windows\System\jlFEacW.exe
  2⤵
  PID:9960
- C:\Windows\System\qlcLDWm.exe
  C:\Windows\System\qlcLDWm.exe
  2⤵
  PID:9976
- C:\Windows\System\kGmgKYd.exe
  C:\Windows\System\kGmgKYd.exe
  2⤵
  PID:10008
- C:\Windows\System\VCcgkWA.exe
  C:\Windows\System\VCcgkWA.exe
  2⤵
  PID:10024
- C:\Windows\System\AYyMLuB.exe
  C:\Windows\System\AYyMLuB.exe
  2⤵
  PID:10040
- C:\Windows\System\POpDzfm.exe
  C:\Windows\System\POpDzfm.exe
  2⤵
  PID:10056
- C:\Windows\System\gxRDHAr.exe
  C:\Windows\System\gxRDHAr.exe
  2⤵
  PID:10076
- C:\Windows\System\kfkcYKC.exe
  C:\Windows\System\kfkcYKC.exe
  2⤵
  PID:10092
- C:\Windows\System\bIImDYg.exe
  C:\Windows\System\bIImDYg.exe
  2⤵
  PID:10108
- C:\Windows\System\sTcUhfh.exe
  C:\Windows\System\sTcUhfh.exe
  2⤵
  PID:10124
- C:\Windows\System\dbDWTMj.exe
  C:\Windows\System\dbDWTMj.exe
  2⤵
  PID:10140
- C:\Windows\System\OHUJXIJ.exe
  C:\Windows\System\OHUJXIJ.exe
  2⤵
  PID:10176
- C:\Windows\System\oiuEvIq.exe
  C:\Windows\System\oiuEvIq.exe
  2⤵
  PID:10192
- C:\Windows\System\ugnjeUr.exe
  C:\Windows\System\ugnjeUr.exe
  2⤵
  PID:10216
- C:\Windows\System\gCpSuQK.exe
  C:\Windows\System\gCpSuQK.exe
  2⤵
  PID:10232
- C:\Windows\System\iyrNtiJ.exe
  C:\Windows\System\iyrNtiJ.exe
  2⤵
  PID:9176
- C:\Windows\System\KpJoBpj.exe
  C:\Windows\System\KpJoBpj.exe
  2⤵
  PID:8960
- C:\Windows\System\IAvTEXg.exe
  C:\Windows\System\IAvTEXg.exe
  2⤵
  PID:9052
- C:\Windows\System\HfEjPtU.exe
  C:\Windows\System\HfEjPtU.exe
  2⤵
  PID:8756
- C:\Windows\System\RceBwyo.exe
  C:\Windows\System\RceBwyo.exe
  2⤵
  PID:8304
- C:\Windows\System\genqaTd.exe
  C:\Windows\System\genqaTd.exe
  2⤵
  PID:8460
- C:\Windows\System\FIGuxtj.exe
  C:\Windows\System\FIGuxtj.exe
  2⤵
  PID:8464
- C:\Windows\System\GJzmPaB.exe
  C:\Windows\System\GJzmPaB.exe
  2⤵
  PID:8532
- C:\Windows\System\bfgesvj.exe
  C:\Windows\System\bfgesvj.exe
  2⤵
  PID:8624
- C:\Windows\System\edEODHS.exe
  C:\Windows\System\edEODHS.exe
  2⤵
  PID:1596
- C:\Windows\System\owspQuX.exe
  C:\Windows\System\owspQuX.exe
  2⤵
  PID:4548
- C:\Windows\System\cXXRTqn.exe
  C:\Windows\System\cXXRTqn.exe
  2⤵
  PID:8252
- C:\Windows\System\PNpxYPw.exe
  C:\Windows\System\PNpxYPw.exe
  2⤵
  PID:8272
- C:\Windows\System\guSucuD.exe
  C:\Windows\System\guSucuD.exe
  2⤵
  PID:8428
- C:\Windows\System\HkSGLVr.exe
  C:\Windows\System\HkSGLVr.exe
  2⤵
  PID:9100
- C:\Windows\System\BEiYrIC.exe
  C:\Windows\System\BEiYrIC.exe
  2⤵
  PID:8320
- C:\Windows\System\VEheFaT.exe
  C:\Windows\System\VEheFaT.exe
  2⤵
  PID:9104
- C:\Windows\System\tovIedU.exe
  C:\Windows\System\tovIedU.exe
  2⤵
  PID:9240
- C:\Windows\System\HtDqmNI.exe
  C:\Windows\System\HtDqmNI.exe
  2⤵
  PID:9256
- C:\Windows\System\GbyLpVZ.exe
  C:\Windows\System\GbyLpVZ.exe
  2⤵
  PID:9284
- C:\Windows\System\wOihiai.exe
  C:\Windows\System\wOihiai.exe
  2⤵
  PID:9272
- C:\Windows\System\AUJWRcU.exe
  C:\Windows\System\AUJWRcU.exe
  2⤵
  PID:9424
- C:\Windows\System\MdGgKMN.exe
  C:\Windows\System\MdGgKMN.exe
  2⤵
  PID:9460
- C:\Windows\System\LJuRtDV.exe
  C:\Windows\System\LJuRtDV.exe
  2⤵
  PID:9576
- C:\Windows\System\HGqtwDe.exe
  C:\Windows\System\HGqtwDe.exe
  2⤵
  PID:9436
- C:\Windows\System\sIxTJtG.exe
  C:\Windows\System\sIxTJtG.exe
  2⤵
  PID:9532
- C:\Windows\System\XodusPW.exe
  C:\Windows\System\XodusPW.exe
  2⤵
  PID:9624
- C:\Windows\System\grezywF.exe
  C:\Windows\System\grezywF.exe
  2⤵
  PID:9688
- C:\Windows\System\AAnSJNx.exe
  C:\Windows\System\AAnSJNx.exe
  2⤵
  PID:9548
- C:\Windows\System\kztbOLk.exe
  C:\Windows\System\kztbOLk.exe
  2⤵
  PID:9308
- C:\Windows\System\NDVOyHk.exe
  C:\Windows\System\NDVOyHk.exe
  2⤵
  PID:9324
- C:\Windows\System\Wjkvfvk.exe
  C:\Windows\System\Wjkvfvk.exe
  2⤵
  PID:9340
- C:\Windows\System\YidSHXw.exe
  C:\Windows\System\YidSHXw.exe
  2⤵
  PID:9356
- C:\Windows\System\tzEDxxd.exe
  C:\Windows\System\tzEDxxd.exe
  2⤵
  PID:9376
- C:\Windows\System\ouKRiNa.exe
  C:\Windows\System\ouKRiNa.exe
  2⤵
  PID:9392
- C:\Windows\System\TDJqxEg.exe
  C:\Windows\System\TDJqxEg.exe
  2⤵
  PID:9512
- C:\Windows\System\OrNXNbv.exe
  C:\Windows\System\OrNXNbv.exe
  2⤵
  PID:9612
- C:\Windows\System\ndVeOdM.exe
  C:\Windows\System\ndVeOdM.exe
  2⤵
  PID:9740
- C:\Windows\System\dLsWtHA.exe
  C:\Windows\System\dLsWtHA.exe
  2⤵
  PID:9896
- C:\Windows\System\WpZaDiQ.exe
  C:\Windows\System\WpZaDiQ.exe
  2⤵
  PID:9880
- C:\Windows\System\EHjAdmn.exe
  C:\Windows\System\EHjAdmn.exe
  2⤵
  PID:9912
- C:\Windows\System\BRebphg.exe
  C:\Windows\System\BRebphg.exe
  2⤵
  PID:9972
- C:\Windows\System\XPoksHU.exe
  C:\Windows\System\XPoksHU.exe
  2⤵
  PID:692
- C:\Windows\System\vfwvlYo.exe
  C:\Windows\System\vfwvlYo.exe
  2⤵
  PID:10048
- C:\Windows\System\yGQURld.exe
  C:\Windows\System\yGQURld.exe
  2⤵
  PID:9992
- C:\Windows\System\RynaapT.exe
  C:\Windows\System\RynaapT.exe
  2⤵
  PID:10120
- C:\Windows\System\aSQAFxD.exe
  C:\Windows\System\aSQAFxD.exe
  2⤵
  PID:10036
- C:\Windows\System\fgeKKPl.exe
  C:\Windows\System\fgeKKPl.exe
  2⤵
  PID:10104
- C:\Windows\System\KgsPFPQ.exe
  C:\Windows\System\KgsPFPQ.exe
  2⤵
  PID:9996
- C:\Windows\System\tMRFtkq.exe
  C:\Windows\System\tMRFtkq.exe
  2⤵
  PID:10164
- C:\Windows\System\VOtHwsN.exe
  C:\Windows\System\VOtHwsN.exe
  2⤵
  PID:10184
- C:\Windows\System\AgYHoeH.exe
  C:\Windows\System\AgYHoeH.exe
  2⤵
  PID:10188
- C:\Windows\System\DZVxYYZ.exe
  C:\Windows\System\DZVxYYZ.exe
  2⤵
  PID:9032
- C:\Windows\System\NVeZBwG.exe
  C:\Windows\System\NVeZBwG.exe
  2⤵
  PID:8288
- C:\Windows\System\qSBPeVH.exe
  C:\Windows\System\qSBPeVH.exe
  2⤵
  PID:8480
- C:\Windows\System\sGJokgq.exe
  C:\Windows\System\sGJokgq.exe
  2⤵
  PID:8412
- C:\Windows\System\IbqpOkR.exe
  C:\Windows\System\IbqpOkR.exe
  2⤵
  PID:2184
- C:\Windows\System\HkWTKnL.exe
  C:\Windows\System\HkWTKnL.exe
  2⤵
  PID:9148
- C:\Windows\System\zRwdNLu.exe
  C:\Windows\System\zRwdNLu.exe
  2⤵
  PID:9116
- C:\Windows\System\gUePTkS.exe
  C:\Windows\System\gUePTkS.exe
  2⤵
  PID:8876
- C:\Windows\System\Yxwxtqo.exe
  C:\Windows\System\Yxwxtqo.exe
  2⤵
  PID:8384
- C:\Windows\System\HEWjGUg.exe
  C:\Windows\System\HEWjGUg.exe
  2⤵
  PID:9000
- C:\Windows\System\jiJyRFr.exe
  C:\Windows\System\jiJyRFr.exe
  2⤵
  PID:8208
- C:\Windows\System\qOqBGzp.exe
  C:\Windows\System\qOqBGzp.exe
  2⤵
  PID:9288
- C:\Windows\System\mGOINdw.exe
  C:\Windows\System\mGOINdw.exe
  2⤵
  PID:9420
- C:\Windows\System\xacJvSO.exe
  C:\Windows\System\xacJvSO.exe
  2⤵
  PID:9452
- C:\Windows\System\sOuQMBy.exe
  C:\Windows\System\sOuQMBy.exe
  2⤵
  PID:9404
- C:\Windows\System\gbwcKgM.exe
  C:\Windows\System\gbwcKgM.exe
  2⤵
  PID:9588
- C:\Windows\System\EIlmZbD.exe
  C:\Windows\System\EIlmZbD.exe
  2⤵
  PID:9500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AhJqYhl.exe

Filesize
2.8MB

MD5
bd3ae78de97d5b17e975097ef0a1fc5d

SHA1
0c41b24e58fd45760b54dadaa02485fd2843a6e3

SHA256
c08fb96130e06564aa01d2d17328440fa09a6d6df0e340513d364c255d9f9558

SHA512
1e2659d35615eeed7d74990a2e6630c7d70c88d7d6d8f79b6b00cb3aa0d928f4f95ffebd6470ab637fe4382dd062c3cc832f90023461dbcb83eff450290ddb57

Download Submit
C:\Windows\system\EyVWmQm.exe

Filesize
2.8MB

MD5
9bafc2f7f642524c858637c8e6da7b1c

SHA1
f8d1c48dc06ef1f7bdfbcb6150ddcafd0e3e8ebf

SHA256
8620aa5fe3ef9172e972a1cf4b504de47e8e8cb7f15f17969caf0f9a0c97de4d

SHA512
a895042cff57bd7310a635585fe8651fb249d0dedbc316ff5f138350ba7e556918e3a3205b3c76a17ee209875b1ad8e22abdaf3c66510768a8fbab5ce8898e42

Download Submit
C:\Windows\system\JDdbXgo.exe

Filesize
2.8MB

MD5
b0ab0e9e66e3753a350ba1ed5546a9ff

SHA1
0c28be9923ca6a1ecbfa8d1c25c9b07c081895fa

SHA256
955bdda612122c5b240d9b96e220955bbf1e93183405e2fcbf89d1d18ad862c6

SHA512
64ba68b6ea99a3fd8362327b57f12324d5a7a2a30d4d24374fdb77d4ec1ca4fe54b31ddb8d70e2042b5b66caf4eec8481dface5cb18aea8aae799f795baf002e

Download Submit
C:\Windows\system\JxUVJvS.exe

Filesize
2.8MB

MD5
c270234af641c610bea96cd7c7d3a7fe

SHA1
8f7986a8832cee50245189f395b7015126584971

SHA256
294d8d42d8e83536afe6b509e1c99113fb10ebaf6c0a2722828009e987572f66

SHA512
34990ab78e24badb419abd90f17d7e6031e6bcffbde546dd42a44251ce5b36c5cf3361978346f2e1eea9f6e315bb6f3a5f2cc0cd27a7c600e6076cc62d14ef45

Download Submit
C:\Windows\system\NBljmUQ.exe

Filesize
2.8MB

MD5
faa4b54b3425c1e2f3c55d43e16f894d

SHA1
03b7a6c18488142a4081346e13455f997740cb7f

SHA256
ff028c542d12a84b9ebd34ef73746e376b8e27896b85069d7d838ac38feac930

SHA512
ea64f034c71df9dcbd09bb60cdb2365be38981f54b05e8020d834905a30521cd4d2a3f3d127a88b5223720f8bc79cf5adf7e6b486f3d471c3d3f676bed16e634

Download Submit
C:\Windows\system\OBsNZws.exe

Filesize
2.8MB

MD5
7167986eebeeb31f51dadf4bc0484d8b

SHA1
527d932757b9830a9138de02714a3da6557c9b63

SHA256
c6b78ba30e6cb1029855cc463221d994667adf7d0e1aa9517bc5b7b24651f155

SHA512
96092b8ee2e6bef7d41755308a84f070b5d13898566c4f38b0924f0e584d3ed7aaa503767e001da31df6a7e46502d1c3c5c90383f24120e646b53814366db5ec

Download Submit
C:\Windows\system\OVQzjcc.exe

Filesize
2.8MB

MD5
f6e173f5f1b9018a3e6c4f2403b6ae86

SHA1
4f243ccd31c885719f4821285a6ff509f8fa0692

SHA256
a9944010332d4ee29282ba518c08c24ba5b1eb8a23798037f3488249938c79bf

SHA512
cccad6a41d1d3f5536fcfdd97264ad36fe995f1fadf0a5d3eae1f84feae58b168d2b23a8821e688a64e86d7ef8a4e6825c8088d954dd8ec46295197be5d4ba7a

Download Submit
C:\Windows\system\PLZDaOX.exe

Filesize
2.8MB

MD5
28b1c06767e34efb26a02638ec77f46d

SHA1
198edb26897e1ae5cf728fbc78746dc72d5d9007

SHA256
6d6422818fc9fb3dfd4ce2bf2991a662b77753686d5e1836c7c383b967c9811f

SHA512
e043b8303c080f8f83c4e6badc7c0cbe2392c24845f889e1743b75080f49974694b28e3ea7d61d7a27d2a356344f5267c74a6cb26371aaf2de6fd83ccd63d235

Download Submit
C:\Windows\system\QKVXgsV.exe

Filesize
2.8MB

MD5
09b8c2cef38d9c2869284aa19e8fbdb0

SHA1
e7065c254ff55329d3d3a9e045efc4c96de59d16

SHA256
58ac12fe443eaf14dbcc630766c3c0f7ed1e0ce605f4c5c03d87859f7e553f58

SHA512
1740f63aa0fda053ee7b5a8a3b2c1819ef3b8e19fd45a757511c9b4861f8f8b80734a8b2517536240efbf47bc80ed51a895f8368a08caae62782c6738d83e864

Download Submit
C:\Windows\system\QhpSORQ.exe

Filesize
2.8MB

MD5
d91e99f0d6028a6608aa3c6534f43d62

SHA1
4f656dbcef1a11388f0f026ceb668c72445c1911

SHA256
0411150eca0bb8fc8e318f2642e7fc228ad824bffa623f3b21d3b49462a959a3

SHA512
5a77bb3db5b611bedca8e71257bd30314dfdf2552d0486a8f07b506a40b3352b0c064619e311a5a9509f60e6782d3bd49f7ea208bf094f86ae81a5922a69f9f7

Download Submit
C:\Windows\system\XdVYOIP.exe

Filesize
2.8MB

MD5
8c1cff052a73804c34beba98fc16ab41

SHA1
c118c468782c43e103178c98bd937c7253c40f47

SHA256
9156936298914524eee32293f1dd82b9e6a84331294fef291f38d104e7039aa2

SHA512
ddc5fb8ae9d3e58c973c0297d0d813232e17928f742643d8c536fc076ef750348dfe1db15a9dd2adc92d1d242f995526e3998ed7bf6a7f16823619acbece2a16

Download Submit
C:\Windows\system\XwgQWEv.exe

Filesize
2.8MB

MD5
6b38f9d3d6663d7e1a829599d94dc123

SHA1
230e1f6c1a4c94e01a70be63c27c25e9ed376b52

SHA256
2a8f2e6b6070cfc9195b581fb4e5a15e9a1b63bd70e1009628bd5d241e3be7b3

SHA512
ac6dbc4f7aecf1d2a36bbbe9eaf6ef2ab57e0665b7f8b96a8ef2b74a5043788ae213daa6f51607896b8d63488d8f1a3503f1225d841b423358910e9b3821cb61

Download Submit
C:\Windows\system\bhktfyB.exe

Filesize
2.8MB

MD5
200d6674526ec68576174187fb2efe5b

SHA1
810246845a8fcaeeb807656d068e1b39a53fcc0e

SHA256
05db5c51c72e7763992d99d998470064fe39d04deefc007cbcbc728d794bc53a

SHA512
5c0d07a2d4cc96184cf2b6f465d39371d41138ecd6ef2e55220008cb07cb4252b8eaef1290e6b171fab63797669f45070fcbe7320c47c298e1e330b6e915d7e7

Download Submit
C:\Windows\system\byolWyA.exe

Filesize
2.8MB

MD5
72b47792be72adcf3a0f366041b7de01

SHA1
0c0ad52d9ef65241360d4469a5acaf814e56795c

SHA256
9351cdf9cc0c75720709ca54f4f7251f7703f220e61a8881c0d2aa3e5c6d88dc

SHA512
c73ed9c9ecf6c2b78dfab21837b34f1adb7695fa6d487ca212601ddd70a2d878b4b54b2c042801942aaafd17c10c085680db7c10eb76d2ae14b27f7f6578a12a

Download Submit
C:\Windows\system\chlrMPm.exe

Filesize
2.8MB

MD5
085d65e3c10cfccd0d4c4fb04ddf9355

SHA1
d78fdc06f661dd937b2fee71f84f69df79b7146e

SHA256
691bebe3170810e584df05e67389b82acbffb357787a1f54ae277471cdfd920e

SHA512
e1c01ccc0b7a046bbbe2fad1304527c0970dfa18daea17a5b67a60d70e9ddfb20689ed906f532d73a7f33aa964ea1126f5a3bae4497179fc789c259e5ce6405b

Download Submit
C:\Windows\system\gmBVczU.exe

Filesize
2.8MB

MD5
fe3b6fc57786675d110a4c623434a414

SHA1
1d7bd27477db7e673f64c81d2e646c42bb766145

SHA256
58648dda3e3040b9e1c0f68f5e4c1c0ed103e80b47f9433066fd4f6d3b5c28ff

SHA512
84cdcfb531007c619c6d3011b020a6e476aa80cea19d1131a0aad4f747dca8bab0f1dd3b82aceaedaa523a690a8f3eec38aa291ca74ef60ec52b3cc381ac259e

Download Submit
C:\Windows\system\hjSgXLB.exe

Filesize
2.8MB

MD5
6350cbd8f8404d4e4f6a0f96dd07a960

SHA1
9ea5f9e7eb36f3b17648e7cc8683ab85a8942fc3

SHA256
d35206cf9efd16a56c8cf521be83c3b423351fbbdf4e93f961af86e4634c28e3

SHA512
a9492d0f9ff5e73ec36ed1ccb859f93631b4f6b870fd611397af8467b867ae6165b3cbbcd8101832f8ef29d443b287ffb52ed5c6c0071c727e4ff21c64ce1706

Download Submit
C:\Windows\system\iPWKXGW.exe

Filesize
2.8MB

MD5
b4dc66bd36665f2440dad09b1eb33946

SHA1
fa128a9957d7fa09e302425cbba718234fc6aaf2

SHA256
ef43510557599ef0e45ae2e70ef4b76dfed74f3b606265986186c3ce0d8fb08e

SHA512
b0c7129fb4d84bba292a931dd48bbfd200d4c231dfa822291edb92aa06558244af316c2150cb695799e6950d31d24a5ebe51231a89d43d534688d98de4fb16a6

Download Submit
C:\Windows\system\jWFFukn.exe

Filesize
2.8MB

MD5
3f50023caac1558e41aa4efe0cba1a5c

SHA1
bacec1d31b1efd0c6456ef6da075cd0942394dec

SHA256
e5881284e861345ec6acb6b5aaa69bc701ee48b3e53b2614bc82121477dfe034

SHA512
ea7fbdd6c855a547f2b8d0f6ae200effb16eb278b77b09cb18ba143cbb699084d3d992a632da2f42a13c93ee9b7db2635e524fcf5cb072fc60b5a0d8674f3704

Download Submit
C:\Windows\system\kvIAjLc.exe

Filesize
2.8MB

MD5
c65326c95d41201c9a93ebebf3195b45

SHA1
2b8c407738f4ea3dea54aa6e5964e4a8b52fd9d9

SHA256
5329b14c2b385edcb6fda207b997814474ce5c6b7bb8a9239ff284d6cbd272c1

SHA512
16b90329a27fb143e0dd9533695635152712005629903ee5e17d5066972d105b497f9d39801e0133732610c8432fa3cec76919be7f26c7f0f6249ad094d3a127

Download Submit
C:\Windows\system\ryzFakJ.exe

Filesize
2.8MB

MD5
9216d2cbc9fea5cd7c8a0fff9a945043

SHA1
0d240a472ebf2965189924408db104b969393e1e

SHA256
5acce044c3e406ff830ad624ff95c80516c7fdd2c9c4599d0f016af9dc96472f

SHA512
6dcf8b186a8777819ff829699d98e5d3460a2bb35bcffc1cdb221b3f4fd9637de329035fc39b7e7dcebd5de9b2e1a8436e840ac209896f6d5dc198746978a973

Download Submit
C:\Windows\system\vNjrErk.exe

Filesize
2.8MB

MD5
cac6c68f05127003525c22d49887f10c

SHA1
11a16910865b03861926658f994255916508550e

SHA256
bca7f23080a9cccd8de4aa87fcedc579d30506fbc6cc4a2138207591d47e74cb

SHA512
7bbd510b32c6fe985afa2b1ae4498eaaa6d5d9efeab0493914444931201bb90329fb1a80dae2fdac88115b280730f80ff825c39c32411b71c0df66ee3afaf211

Download Submit
C:\Windows\system\xtLjfeP.exe

Filesize
2.8MB

MD5
70f75e8c4f1fe67ce8793fd711da166d

SHA1
26f7356361d7c2b4aeb311b6d18215b0be54f7cc

SHA256
25b4ea8fbd6acfe76b20a22bf583f28b9631e15eb7e1d5c032b7dfd6f427da8d

SHA512
a9f51b99df370d4756249af132099e0a4887e458d93b243ecc1120e1672f2b1fd84d8a587ee898ba822eee8bbe6e52a15911a93decaddf18cd65af1d5ebaf36b

Download Submit
\Windows\system\GCFMMVT.exe

Filesize
2.8MB

MD5
309a42526ffa63bfa1efc459604ee260

SHA1
9261de914294f6ec3cabeb569d3c029b0b322014

SHA256
bb94319812ed1aa1ad6262afbaf39c815fa479522b837943d7c6bd12ac80164a

SHA512
00ae7ca5d3388f828a8a2f5413ce9e1511cd3985923a5013942a8d9969f5344da050c77237d0318c7676b187fe6d6de1e8d444c6b30b3d90321e677158a43bb1

Download Submit
\Windows\system\MEOzVsr.exe

Filesize
2.8MB

MD5
f1ecf41e412e4beb0e9fd58c6b8567c7

SHA1
46d9d3b177361b318f81366190155564ba8ca2f1

SHA256
b8200be069f61c3dcf3c328122dd960fa900768bc2c25a0b13c934f7eea17c01

SHA512
419be1f50be35d809d42e531bbf64c934f95401d8256bc204f53d2934a1191a76e2a15881975c085dbdc66c5f2b169a14fa76c7916d3af8c375dcf072f310ae8

Download Submit
\Windows\system\MEqxvtl.exe

Filesize
2.8MB

MD5
cd88d56efdcf2b13c8bc22a994e8dd05

SHA1
3b161f2d54774938db2bfafc962b805c355c0514

SHA256
0fc753e976d50c9b5dcfff032c4d1b48dda1eb8e7b5c20bef7d710819c57687d

SHA512
34b285bf662de8803e78f223fc5f10276be19f8e12212e4d0d183d25936778cf7e9540c89a519975895dd849b2134e62848b144d21aa498d3dbd3616d1ee7b43

Download Submit
\Windows\system\VEgpcDq.exe

Filesize
2.8MB

MD5
c31bf0adcccd6b362334e88e66fe22ec

SHA1
6553fb378a70c2a38eee78a6751e0339fffd7997

SHA256
83f679b0e8ff1292451d1ffc18aa5723653a052a46954ca97b34da7f3404cf44

SHA512
7a94e8a6b098c49a051a8f9027e6004e891cdde6e965e362a8abd093891b531b2c423e5bd06cc378ab5d31393c2e05b7f6fd8be51014f525bdc1ce60e2d34793

Download Submit
\Windows\system\eZjHYTL.exe

Filesize
2.8MB

MD5
2a1c73f0f42ff94929ce2df194883ce2

SHA1
b270cb164e3bbb10a416587ec8a550cf76eb142f

SHA256
e9775b41c0199318a08064cbf0605f8b9a1e0fb40e83323aa7a2502dcabca5cd

SHA512
79af9447450579f117a1099262f49008fb5ec554e03625016d8c537ce34c0fbc7cf3db36375404b5e8274e2c1c3f674212b7078c5e2df18e36be61d6ae7fac64

Download Submit
\Windows\system\idCSspI.exe

Filesize
2.8MB

MD5
676554f721bee4ef57a3a9f03d0cf394

SHA1
7d3eb7179f824d931d62fc0b5676141233d73521

SHA256
3c5dd3472b83a49917e103dc81c3e814d9b24a9691a0b3937267f78932a63126

SHA512
07c5705cb173ca14752eb0a1413d8b6f5e6f82b16f27ad1f56746f9cdfd5c1b5ce23a3c842ada0c1f221470e7da0a0b38b74b30a6c22b0a52915618a1e4fdce5

Download Submit
\Windows\system\nAZfoij.exe

Filesize
2.8MB

MD5
73b91a7a0155a650eadddb92fcc74398

SHA1
1d5b53a525f98d9064a499779dfd855fde77a145

SHA256
4a22474504c078d96a0d9d9331c58a97cc19b090f4cb31b33ddcb567c117db56

SHA512
49aae8b126c1aa2cda2a1dd6f207468fdf41ca8c6ce77760f47c6dc8ce9096d8e1da0745c66abef1d51cc2baa797f9a7c4d9c2333f8a0b6aadc1147def7d3df0

Download Submit
\Windows\system\nIEHXIv.exe

Filesize
2.8MB

MD5
69931981324be9029b1609e6bfc1881f

SHA1
4c292c03c70dbb091ae1c32b472146456ddff269

SHA256
bd7adfc179010865161e1425a593a9ce5faa3dfc8f810d4e7515e8e763a7c036

SHA512
0d1092eb303d6776916d9bc70877ff1de5bf17cc59c15fcc2b2232081bbfa7b06d87dba7a49819b44c07097455d94e65755cba3e8cf77c7e9f2ad42f15db804a

Download Submit
\Windows\system\rkOxDJA.exe

Filesize
2.8MB

MD5
9e273e73218ac5bf4bf72bded9fe2bd8

SHA1
71cd9ee3ce267102a7106e19d21f4bde469598e5

SHA256
f2c516c8c2d53c11db1169da2e57dda29202281f891c7c07b3d4f4666e4b0579

SHA512
5366e6f7c0d1a68ea60b0ba60335c042de8d0c2994c155562d4e6436eb3e5b7d4ad139b7d454cb673b25a224f34a2b50676860c221201a41f1e3cf48ecdc2df6

Download Submit
\Windows\system\tapvdvD.exe

Filesize
2.8MB

MD5
ac2ceeca3fb8eac8b2c1740bc21b1868

SHA1
50ff55ff50215946506ce5c670867cdcbc5f7ba7

SHA256
57c55b57eadb17102c9838709f98a6acf9eda06a6ade61d43df8681283831857

SHA512
ca4670cde676d038714d6faaaf69c554da42392a3df69178db9153ebb5ad16caf17d08deed541c2ff4142dd1175653d90c833e1e25ac8f41d34d138f7a784b4c

Download Submit
memory/568-1715-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/568-77-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/576-1635-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/576-78-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2240-61-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2240-56-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2240-76-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2240-1154-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2240-26-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-62-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-0-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2240-9-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-59-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2240-19-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2240-102-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-70-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-54-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2396-1733-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2396-69-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2420-1745-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2420-64-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2436-1724-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2436-63-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2596-1633-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2596-60-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2616-1730-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2616-21-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2628-1631-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-55-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-1630-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-58-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-16-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-1717-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-20-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2868-1731-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2984-243-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2984-240-0x000000001B250000-0x000000001B532000-memory.dmp

Filesize
2.9MB

Download