xmrig | 82719fa60e4c1d31b972752a66827c75c4816d0f213dc98bf797b938159f34aa

Analysis

max time kernel
132s
max time network
141s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16191925ab36e522162e351c3995f944_JaffaCakes118.exe
Size

2.2MB
MD5

16191925ab36e522162e351c3995f944
SHA1

a0bd3290935380f04017316d747b5068c9023dfe
SHA256

82719fa60e4c1d31b972752a66827c75c4816d0f213dc98bf797b938159f34aa
SHA512

8582d3375ab921857b4988d336493e00e4a11bd5514dd604e2be244ae4c1aaf44e3a48fdb4ad2cf078c60ec5bfb29b954a3b9f788bb0621f067f9c05535ba6f3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfz:NABi

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2592-21-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/1504-10-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2596-26-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2180-67-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2164-77-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/1772-82-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/1516-109-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2468-108-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2728-81-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/1412-76-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2404-73-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2432-71-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3048	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1504	BImCbqC.exe
2592	ijgnhkj.exe
2596	WXmkzPQ.exe
2180	MoaiUPY.exe
2432	qPfBHiH.exe
2404	ettxJkM.exe
1412	Xyirrcc.exe
2164	XOrWeAb.exe
2728	LtYEPuT.exe
1772	wKYwXFb.exe
2468	waGRyDw.exe
1788	iFpcmWj.exe
2460	DRdbcOe.exe
1852	fvKSZEB.exe
1712	SSzdluN.exe
1880	AhQDdus.exe
1580	WpFtcyZ.exe
2724	tBmuVtW.exe
1680	NJMOrgv.exe
2080	zrlBtAu.exe
2944	WqbAfwj.exe
2076	YCfRxxl.exe
1448	LAuRiCj.exe
2024	dzLOjus.exe
1648	oIHbrCT.exe
776	lJPOuJZ.exe
2068	PQQkJjm.exe
1668	NxbtPIs.exe
2316	qjIwoOe.exe
2364	ZTyFUxx.exe
1292	fAqrJpk.exe
1464	hZlSFHo.exe
1544	wFnDDzb.exe
1900	tWRNemj.exe
2060	QhveOPA.exe
896	nrkJNjw.exe
2052	hqTzFFk.exe
2136	EOogSFf.exe
3008	WMZePBj.exe
2152	BTWbVhU.exe
832	nYiusti.exe
1176	QcSBHks.exe
2348	yJENUQn.exe
1028	nCwFZlI.exe
1420	jaDxqbu.exe
884	pbDMVSU.exe
2040	CnZOSgw.exe
2276	uIOoWdt.exe
1496	gWRAKuh.exe
1532	usGSKEk.exe
2492	qjtEjni.exe
2832	AyfeUQl.exe
2504	CgOjirX.exe
2520	SwXFpAr.exe
2968	PxrYQlk.exe
2012	EIdRPPB.exe
2556	OiGmAmK.exe
2772	BQJrDHt.exe
1604	yJWcOlm.exe
2756	zlwrAOj.exe
2120	RmuDZuN.exe
2616	kummeba.exe
788	lpCrnPK.exe
1000	JHjBlhA.exe

Loads dropped DLL 64 IoCs

pid	Process
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1516-0-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x000b000000014502-3.dat	upx
behavioral1/files/0x0008000000014dae-13.dat	upx
behavioral1/memory/2592-21-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x00330000000149e1-11.dat	upx
behavioral1/memory/1504-10-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x0007000000014eb9-30.dat	upx
behavioral1/memory/2596-26-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x0008000000015cd9-51.dat	upx
behavioral1/files/0x00070000000153d9-43.dat	upx
behavioral1/files/0x001800000000558a-46.dat	upx
behavioral1/files/0x0006000000015cf5-64.dat	upx
behavioral1/memory/2180-67-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2164-77-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/1772-82-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0006000000015d44-96.dat	upx
behavioral1/files/0x0006000000015e09-110.dat	upx
behavioral1/files/0x0006000000015d0c-95.dat	upx
behavioral1/files/0x000600000001654a-155.dat	upx
behavioral1/files/0x0006000000016c42-185.dat	upx
behavioral1/files/0x0006000000016c8c-190.dat	upx
behavioral1/files/0x0006000000016cb2-195.dat	upx
behavioral1/files/0x0006000000016c3a-180.dat	upx
behavioral1/files/0x0006000000016a6f-170.dat	upx
behavioral1/files/0x0006000000016c1d-175.dat	upx
behavioral1/files/0x00060000000165f0-161.dat	upx
behavioral1/files/0x0006000000016476-151.dat	upx
behavioral1/files/0x0006000000016813-165.dat	upx
behavioral1/files/0x00060000000161b3-140.dat	upx
behavioral1/files/0x0006000000015fa7-130.dat	upx
behavioral1/files/0x00060000000162c9-144.dat	upx
behavioral1/files/0x00060000000160cc-135.dat	upx
behavioral1/files/0x0006000000015d4c-118.dat	upx
behavioral1/files/0x0006000000015e6d-115.dat	upx
behavioral1/files/0x0033000000014b10-101.dat	upx
behavioral1/files/0x0006000000015d24-91.dat	upx
behavioral1/files/0x0006000000015f3c-122.dat	upx
behavioral1/memory/1516-109-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2468-108-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2728-81-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/1412-76-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2404-73-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2432-71-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-70.dat	upx
behavioral1/files/0x00080000000153c7-41.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MEVOoPI.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\ocMjQmk.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\SzlPzmm.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\qDfJgYw.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\teqXllG.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\KOdIZzM.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\JQObXNz.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\sHcFJyT.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\SASpWFl.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\EQMgMqP.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\hZlSFHo.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\GzWAEFQ.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\sWoZMaH.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\uChMTSa.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\AgaBwdH.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\NtbmIbi.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\WyRfHpZ.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\IVDYsGH.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\FVdBTWC.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\lFVXMmR.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\dGztesc.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\FuCFCVE.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\JXACaGW.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\dUVBLsq.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\kYWWUZr.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\fYBfpyA.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\tLyxxuv.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\zVWvXnt.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\qUKNfNM.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\VqQRLSl.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\hLVbqEs.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\KLTVqJu.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\jnPOSOo.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\QHAEMzo.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\SXsYfVx.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\NANdboM.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\Moviypb.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\AyfeUQl.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\cwYzOCr.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\hlwqVED.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\QxZNHYi.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\FDMBxkQ.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\iSnQsuT.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\GEnaBbO.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\EeeZnGJ.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\BfJueEJ.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\xzQNGtW.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\kWEWWqD.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\fBgILTY.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\kPhDxNM.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\FYOCHLd.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\CMncSYA.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\JBwLUfp.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\flgjxpq.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\rRgMoEL.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\CJlLCOV.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\RKYpRLC.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\hTatteI.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\ZHpcnxo.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\JHLxEGv.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\SLhyIat.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\DPXRFkU.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\hOfhzyk.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
File created	C:\Windows\System\hiUHDay.exe	16191925ab36e522162e351c3995f944_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3048	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe
Token: SeDebugPrivilege	3048	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 3048	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	29
PID 1516 wrote to memory of 3048	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	29
PID 1516 wrote to memory of 3048	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	29
PID 1516 wrote to memory of 1504	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	30
PID 1516 wrote to memory of 1504	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	30
PID 1516 wrote to memory of 1504	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	30
PID 1516 wrote to memory of 2596	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2596	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2596	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2592	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	32
PID 1516 wrote to memory of 2592	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	32
PID 1516 wrote to memory of 2592	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	32
PID 1516 wrote to memory of 2180	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	33
PID 1516 wrote to memory of 2180	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	33
PID 1516 wrote to memory of 2180	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	33
PID 1516 wrote to memory of 2404	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	34
PID 1516 wrote to memory of 2404	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	34
PID 1516 wrote to memory of 2404	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	34
PID 1516 wrote to memory of 2432	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	35
PID 1516 wrote to memory of 2432	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	35
PID 1516 wrote to memory of 2432	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	35
PID 1516 wrote to memory of 2164	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	36
PID 1516 wrote to memory of 2164	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	36
PID 1516 wrote to memory of 2164	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	36
PID 1516 wrote to memory of 1412	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	37
PID 1516 wrote to memory of 1412	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	37
PID 1516 wrote to memory of 1412	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	37
PID 1516 wrote to memory of 1772	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	38
PID 1516 wrote to memory of 1772	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	38
PID 1516 wrote to memory of 1772	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	38
PID 1516 wrote to memory of 2728	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	39
PID 1516 wrote to memory of 2728	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	39
PID 1516 wrote to memory of 2728	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	39
PID 1516 wrote to memory of 2468	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	40
PID 1516 wrote to memory of 2468	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	40
PID 1516 wrote to memory of 2468	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	40
PID 1516 wrote to memory of 1788	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	41
PID 1516 wrote to memory of 1788	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	41
PID 1516 wrote to memory of 1788	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	41
PID 1516 wrote to memory of 1712	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	42
PID 1516 wrote to memory of 1712	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	42
PID 1516 wrote to memory of 1712	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	42
PID 1516 wrote to memory of 2460	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	43
PID 1516 wrote to memory of 2460	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	43
PID 1516 wrote to memory of 2460	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	43
PID 1516 wrote to memory of 1880	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	44
PID 1516 wrote to memory of 1880	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	44
PID 1516 wrote to memory of 1880	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	44
PID 1516 wrote to memory of 1852	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	45
PID 1516 wrote to memory of 1852	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	45
PID 1516 wrote to memory of 1852	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	45
PID 1516 wrote to memory of 2724	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	46
PID 1516 wrote to memory of 2724	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	46
PID 1516 wrote to memory of 2724	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	46
PID 1516 wrote to memory of 1580	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	47
PID 1516 wrote to memory of 1580	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	47
PID 1516 wrote to memory of 1580	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	47
PID 1516 wrote to memory of 1680	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	48
PID 1516 wrote to memory of 1680	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	48
PID 1516 wrote to memory of 1680	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	48
PID 1516 wrote to memory of 2080	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	49
PID 1516 wrote to memory of 2080	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	49
PID 1516 wrote to memory of 2080	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	49
PID 1516 wrote to memory of 2944	1516	16191925ab36e522162e351c3995f944_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\16191925ab36e522162e351c3995f944_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16191925ab36e522162e351c3995f944_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System\BImCbqC.exe
  C:\Windows\System\BImCbqC.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\WXmkzPQ.exe
  C:\Windows\System\WXmkzPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\ijgnhkj.exe
  C:\Windows\System\ijgnhkj.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\MoaiUPY.exe
  C:\Windows\System\MoaiUPY.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\ettxJkM.exe
  C:\Windows\System\ettxJkM.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\qPfBHiH.exe
  C:\Windows\System\qPfBHiH.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\XOrWeAb.exe
  C:\Windows\System\XOrWeAb.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\Xyirrcc.exe
  C:\Windows\System\Xyirrcc.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\wKYwXFb.exe
  C:\Windows\System\wKYwXFb.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\LtYEPuT.exe
  C:\Windows\System\LtYEPuT.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\waGRyDw.exe
  C:\Windows\System\waGRyDw.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\iFpcmWj.exe
  C:\Windows\System\iFpcmWj.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\SSzdluN.exe
  C:\Windows\System\SSzdluN.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\DRdbcOe.exe
  C:\Windows\System\DRdbcOe.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\AhQDdus.exe
  C:\Windows\System\AhQDdus.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\fvKSZEB.exe
  C:\Windows\System\fvKSZEB.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\tBmuVtW.exe
  C:\Windows\System\tBmuVtW.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\WpFtcyZ.exe
  C:\Windows\System\WpFtcyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\NJMOrgv.exe
  C:\Windows\System\NJMOrgv.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\zrlBtAu.exe
  C:\Windows\System\zrlBtAu.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\WqbAfwj.exe
  C:\Windows\System\WqbAfwj.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\YCfRxxl.exe
  C:\Windows\System\YCfRxxl.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\LAuRiCj.exe
  C:\Windows\System\LAuRiCj.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\dzLOjus.exe
  C:\Windows\System\dzLOjus.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\oIHbrCT.exe
  C:\Windows\System\oIHbrCT.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\lJPOuJZ.exe
  C:\Windows\System\lJPOuJZ.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\PQQkJjm.exe
  C:\Windows\System\PQQkJjm.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\NxbtPIs.exe
  C:\Windows\System\NxbtPIs.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\qjIwoOe.exe
  C:\Windows\System\qjIwoOe.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\ZTyFUxx.exe
  C:\Windows\System\ZTyFUxx.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\fAqrJpk.exe
  C:\Windows\System\fAqrJpk.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\hZlSFHo.exe
  C:\Windows\System\hZlSFHo.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\wFnDDzb.exe
  C:\Windows\System\wFnDDzb.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\tWRNemj.exe
  C:\Windows\System\tWRNemj.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\QhveOPA.exe
  C:\Windows\System\QhveOPA.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\nrkJNjw.exe
  C:\Windows\System\nrkJNjw.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\hqTzFFk.exe
  C:\Windows\System\hqTzFFk.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\EOogSFf.exe
  C:\Windows\System\EOogSFf.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\WMZePBj.exe
  C:\Windows\System\WMZePBj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\BTWbVhU.exe
  C:\Windows\System\BTWbVhU.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\nYiusti.exe
  C:\Windows\System\nYiusti.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\QcSBHks.exe
  C:\Windows\System\QcSBHks.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\nCwFZlI.exe
  C:\Windows\System\nCwFZlI.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\yJENUQn.exe
  C:\Windows\System\yJENUQn.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\jaDxqbu.exe
  C:\Windows\System\jaDxqbu.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\pbDMVSU.exe
  C:\Windows\System\pbDMVSU.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\CnZOSgw.exe
  C:\Windows\System\CnZOSgw.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\uIOoWdt.exe
  C:\Windows\System\uIOoWdt.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\gWRAKuh.exe
  C:\Windows\System\gWRAKuh.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\usGSKEk.exe
  C:\Windows\System\usGSKEk.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\qjtEjni.exe
  C:\Windows\System\qjtEjni.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\AyfeUQl.exe
  C:\Windows\System\AyfeUQl.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\CgOjirX.exe
  C:\Windows\System\CgOjirX.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\SwXFpAr.exe
  C:\Windows\System\SwXFpAr.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\PxrYQlk.exe
  C:\Windows\System\PxrYQlk.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\EIdRPPB.exe
  C:\Windows\System\EIdRPPB.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\OiGmAmK.exe
  C:\Windows\System\OiGmAmK.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\BQJrDHt.exe
  C:\Windows\System\BQJrDHt.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\yJWcOlm.exe
  C:\Windows\System\yJWcOlm.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\zlwrAOj.exe
  C:\Windows\System\zlwrAOj.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\RmuDZuN.exe
  C:\Windows\System\RmuDZuN.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\kummeba.exe
  C:\Windows\System\kummeba.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\lpCrnPK.exe
  C:\Windows\System\lpCrnPK.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\JHjBlhA.exe
  C:\Windows\System\JHjBlhA.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\AKOqHYY.exe
  C:\Windows\System\AKOqHYY.exe
  2⤵
  PID:2032
- C:\Windows\System\UaAWcNg.exe
  C:\Windows\System\UaAWcNg.exe
  2⤵
  PID:276
- C:\Windows\System\uOBEQCI.exe
  C:\Windows\System\uOBEQCI.exe
  2⤵
  PID:2976
- C:\Windows\System\RqcymGB.exe
  C:\Windows\System\RqcymGB.exe
  2⤵
  PID:1564
- C:\Windows\System\nJwIbaC.exe
  C:\Windows\System\nJwIbaC.exe
  2⤵
  PID:840
- C:\Windows\System\fwTSZQH.exe
  C:\Windows\System\fwTSZQH.exe
  2⤵
  PID:672
- C:\Windows\System\qakPPxJ.exe
  C:\Windows\System\qakPPxJ.exe
  2⤵
  PID:636
- C:\Windows\System\VKVknth.exe
  C:\Windows\System\VKVknth.exe
  2⤵
  PID:444
- C:\Windows\System\GrDbbvH.exe
  C:\Windows\System\GrDbbvH.exe
  2⤵
  PID:3036
- C:\Windows\System\aLtbyzA.exe
  C:\Windows\System\aLtbyzA.exe
  2⤵
  PID:1100
- C:\Windows\System\wtdsuyn.exe
  C:\Windows\System\wtdsuyn.exe
  2⤵
  PID:1908
- C:\Windows\System\KzZQQmO.exe
  C:\Windows\System\KzZQQmO.exe
  2⤵
  PID:1904
- C:\Windows\System\ByLRqkP.exe
  C:\Windows\System\ByLRqkP.exe
  2⤵
  PID:1896
- C:\Windows\System\mMfVqjY.exe
  C:\Windows\System\mMfVqjY.exe
  2⤵
  PID:2680
- C:\Windows\System\bmqxosL.exe
  C:\Windows\System\bmqxosL.exe
  2⤵
  PID:1636
- C:\Windows\System\GxoTUzJ.exe
  C:\Windows\System\GxoTUzJ.exe
  2⤵
  PID:2308
- C:\Windows\System\HwsuycS.exe
  C:\Windows\System\HwsuycS.exe
  2⤵
  PID:1592
- C:\Windows\System\dpdUZVA.exe
  C:\Windows\System\dpdUZVA.exe
  2⤵
  PID:864
- C:\Windows\System\oXAUoNS.exe
  C:\Windows\System\oXAUoNS.exe
  2⤵
  PID:1200
- C:\Windows\System\pDEbGeC.exe
  C:\Windows\System\pDEbGeC.exe
  2⤵
  PID:3068
- C:\Windows\System\PPGWzHA.exe
  C:\Windows\System\PPGWzHA.exe
  2⤵
  PID:2436
- C:\Windows\System\cLWVAkT.exe
  C:\Windows\System\cLWVAkT.exe
  2⤵
  PID:2456
- C:\Windows\System\diOroAr.exe
  C:\Windows\System\diOroAr.exe
  2⤵
  PID:2956
- C:\Windows\System\wxLrPhZ.exe
  C:\Windows\System\wxLrPhZ.exe
  2⤵
  PID:2704
- C:\Windows\System\teqXllG.exe
  C:\Windows\System\teqXllG.exe
  2⤵
  PID:2500
- C:\Windows\System\lZGGVgr.exe
  C:\Windows\System\lZGGVgr.exe
  2⤵
  PID:2400
- C:\Windows\System\RmNUCty.exe
  C:\Windows\System\RmNUCty.exe
  2⤵
  PID:2544
- C:\Windows\System\URbaLml.exe
  C:\Windows\System\URbaLml.exe
  2⤵
  PID:2984
- C:\Windows\System\mUFPtxw.exe
  C:\Windows\System\mUFPtxw.exe
  2⤵
  PID:1924
- C:\Windows\System\kHsEXQB.exe
  C:\Windows\System\kHsEXQB.exe
  2⤵
  PID:828
- C:\Windows\System\AxXpxMU.exe
  C:\Windows\System\AxXpxMU.exe
  2⤵
  PID:1888
- C:\Windows\System\QMEizXO.exe
  C:\Windows\System\QMEizXO.exe
  2⤵
  PID:2524
- C:\Windows\System\iCmgDVO.exe
  C:\Windows\System\iCmgDVO.exe
  2⤵
  PID:1652
- C:\Windows\System\IJkGVoA.exe
  C:\Windows\System\IJkGVoA.exe
  2⤵
  PID:1208
- C:\Windows\System\sHcFJyT.exe
  C:\Windows\System\sHcFJyT.exe
  2⤵
  PID:272
- C:\Windows\System\YYZfrCJ.exe
  C:\Windows\System\YYZfrCJ.exe
  2⤵
  PID:2928
- C:\Windows\System\MMQKeWm.exe
  C:\Windows\System\MMQKeWm.exe
  2⤵
  PID:3060
- C:\Windows\System\waMuwgo.exe
  C:\Windows\System\waMuwgo.exe
  2⤵
  PID:2380
- C:\Windows\System\NpjGGjj.exe
  C:\Windows\System\NpjGGjj.exe
  2⤵
  PID:1872
- C:\Windows\System\HHavOLS.exe
  C:\Windows\System\HHavOLS.exe
  2⤵
  PID:3004
- C:\Windows\System\qWqYnhO.exe
  C:\Windows\System\qWqYnhO.exe
  2⤵
  PID:2268
- C:\Windows\System\sINQtcd.exe
  C:\Windows\System\sINQtcd.exe
  2⤵
  PID:2912
- C:\Windows\System\gvFccLn.exe
  C:\Windows\System\gvFccLn.exe
  2⤵
  PID:1192
- C:\Windows\System\mkilkvc.exe
  C:\Windows\System\mkilkvc.exe
  2⤵
  PID:1600
- C:\Windows\System\baXnpOq.exe
  C:\Windows\System\baXnpOq.exe
  2⤵
  PID:1252
- C:\Windows\System\uqPVkBw.exe
  C:\Windows\System\uqPVkBw.exe
  2⤵
  PID:3020
- C:\Windows\System\gqmBpqn.exe
  C:\Windows\System\gqmBpqn.exe
  2⤵
  PID:2868
- C:\Windows\System\MAgqFMZ.exe
  C:\Windows\System\MAgqFMZ.exe
  2⤵
  PID:2408
- C:\Windows\System\dnrBXtp.exe
  C:\Windows\System\dnrBXtp.exe
  2⤵
  PID:2860
- C:\Windows\System\ZsKugsd.exe
  C:\Windows\System\ZsKugsd.exe
  2⤵
  PID:2100
- C:\Windows\System\hMtqZev.exe
  C:\Windows\System\hMtqZev.exe
  2⤵
  PID:2760
- C:\Windows\System\FGNqpjK.exe
  C:\Windows\System\FGNqpjK.exe
  2⤵
  PID:2420
- C:\Windows\System\RmwhhQw.exe
  C:\Windows\System\RmwhhQw.exe
  2⤵
  PID:1848
- C:\Windows\System\CIaShbR.exe
  C:\Windows\System\CIaShbR.exe
  2⤵
  PID:760
- C:\Windows\System\JjkBZFL.exe
  C:\Windows\System\JjkBZFL.exe
  2⤵
  PID:2028
- C:\Windows\System\PBeNQiX.exe
  C:\Windows\System\PBeNQiX.exe
  2⤵
  PID:1840
- C:\Windows\System\lhSFZHQ.exe
  C:\Windows\System\lhSFZHQ.exe
  2⤵
  PID:2224
- C:\Windows\System\QFiHNNm.exe
  C:\Windows\System\QFiHNNm.exe
  2⤵
  PID:2600
- C:\Windows\System\NINddyp.exe
  C:\Windows\System\NINddyp.exe
  2⤵
  PID:400
- C:\Windows\System\UWxMuan.exe
  C:\Windows\System\UWxMuan.exe
  2⤵
  PID:1964
- C:\Windows\System\FvLtnzs.exe
  C:\Windows\System\FvLtnzs.exe
  2⤵
  PID:2948
- C:\Windows\System\sPuYEzA.exe
  C:\Windows\System\sPuYEzA.exe
  2⤵
  PID:2252
- C:\Windows\System\ZxiyfxG.exe
  C:\Windows\System\ZxiyfxG.exe
  2⤵
  PID:1696
- C:\Windows\System\TvJaeUy.exe
  C:\Windows\System\TvJaeUy.exe
  2⤵
  PID:2220
- C:\Windows\System\tVwVXiE.exe
  C:\Windows\System\tVwVXiE.exe
  2⤵
  PID:1984
- C:\Windows\System\rRgMoEL.exe
  C:\Windows\System\rRgMoEL.exe
  2⤵
  PID:328
- C:\Windows\System\SgLhJeN.exe
  C:\Windows\System\SgLhJeN.exe
  2⤵
  PID:2648
- C:\Windows\System\ICJugKj.exe
  C:\Windows\System\ICJugKj.exe
  2⤵
  PID:1240
- C:\Windows\System\oWMbSSX.exe
  C:\Windows\System\oWMbSSX.exe
  2⤵
  PID:1868
- C:\Windows\System\TfrBIKp.exe
  C:\Windows\System\TfrBIKp.exe
  2⤵
  PID:1624
- C:\Windows\System\mjfbwlE.exe
  C:\Windows\System\mjfbwlE.exe
  2⤵
  PID:2572
- C:\Windows\System\DaFuCDx.exe
  C:\Windows\System\DaFuCDx.exe
  2⤵
  PID:2960
- C:\Windows\System\uhFccDR.exe
  C:\Windows\System\uhFccDR.exe
  2⤵
  PID:1796
- C:\Windows\System\kpzqPJB.exe
  C:\Windows\System\kpzqPJB.exe
  2⤵
  PID:1932
- C:\Windows\System\cQYzUPk.exe
  C:\Windows\System\cQYzUPk.exe
  2⤵
  PID:2664
- C:\Windows\System\bbsIeCC.exe
  C:\Windows\System\bbsIeCC.exe
  2⤵
  PID:2992
- C:\Windows\System\dGztesc.exe
  C:\Windows\System\dGztesc.exe
  2⤵
  PID:1308
- C:\Windows\System\cthVUfu.exe
  C:\Windows\System\cthVUfu.exe
  2⤵
  PID:2988
- C:\Windows\System\ZIyufyW.exe
  C:\Windows\System\ZIyufyW.exe
  2⤵
  PID:1584
- C:\Windows\System\KwcFxZg.exe
  C:\Windows\System\KwcFxZg.exe
  2⤵
  PID:2124
- C:\Windows\System\GjeczTz.exe
  C:\Windows\System\GjeczTz.exe
  2⤵
  PID:2608
- C:\Windows\System\cxRGQxX.exe
  C:\Windows\System\cxRGQxX.exe
  2⤵
  PID:2424
- C:\Windows\System\LsdMilR.exe
  C:\Windows\System\LsdMilR.exe
  2⤵
  PID:1348
- C:\Windows\System\plhEjlY.exe
  C:\Windows\System\plhEjlY.exe
  2⤵
  PID:492
- C:\Windows\System\EjKIFjk.exe
  C:\Windows\System\EjKIFjk.exe
  2⤵
  PID:1400
- C:\Windows\System\OGNEbHF.exe
  C:\Windows\System\OGNEbHF.exe
  2⤵
  PID:2676
- C:\Windows\System\JhVLrPQ.exe
  C:\Windows\System\JhVLrPQ.exe
  2⤵
  PID:1736
- C:\Windows\System\zxMlANY.exe
  C:\Windows\System\zxMlANY.exe
  2⤵
  PID:2644
- C:\Windows\System\lGjdgca.exe
  C:\Windows\System\lGjdgca.exe
  2⤵
  PID:756
- C:\Windows\System\yhqTXZE.exe
  C:\Windows\System\yhqTXZE.exe
  2⤵
  PID:2016
- C:\Windows\System\DeDRwMY.exe
  C:\Windows\System\DeDRwMY.exe
  2⤵
  PID:2812
- C:\Windows\System\KTeyPvj.exe
  C:\Windows\System\KTeyPvj.exe
  2⤵
  PID:1928
- C:\Windows\System\DlfMEix.exe
  C:\Windows\System\DlfMEix.exe
  2⤵
  PID:1004
- C:\Windows\System\FVdBTWC.exe
  C:\Windows\System\FVdBTWC.exe
  2⤵
  PID:2488
- C:\Windows\System\YIilxzp.exe
  C:\Windows\System\YIilxzp.exe
  2⤵
  PID:1136
- C:\Windows\System\QuwcPNU.exe
  C:\Windows\System\QuwcPNU.exe
  2⤵
  PID:3032
- C:\Windows\System\SskNzHO.exe
  C:\Windows\System\SskNzHO.exe
  2⤵
  PID:3080
- C:\Windows\System\OYEjxUg.exe
  C:\Windows\System\OYEjxUg.exe
  2⤵
  PID:3096
- C:\Windows\System\IBaMjna.exe
  C:\Windows\System\IBaMjna.exe
  2⤵
  PID:3112
- C:\Windows\System\SqSfppI.exe
  C:\Windows\System\SqSfppI.exe
  2⤵
  PID:3128
- C:\Windows\System\PqLBUBn.exe
  C:\Windows\System\PqLBUBn.exe
  2⤵
  PID:3144
- C:\Windows\System\XXbmDZm.exe
  C:\Windows\System\XXbmDZm.exe
  2⤵
  PID:3164
- C:\Windows\System\nAoGgqF.exe
  C:\Windows\System\nAoGgqF.exe
  2⤵
  PID:3180
- C:\Windows\System\hLuPySs.exe
  C:\Windows\System\hLuPySs.exe
  2⤵
  PID:3196
- C:\Windows\System\clCUKrm.exe
  C:\Windows\System\clCUKrm.exe
  2⤵
  PID:3212
- C:\Windows\System\Vzasppd.exe
  C:\Windows\System\Vzasppd.exe
  2⤵
  PID:3228
- C:\Windows\System\moHsVXo.exe
  C:\Windows\System\moHsVXo.exe
  2⤵
  PID:3244
- C:\Windows\System\thPIUUS.exe
  C:\Windows\System\thPIUUS.exe
  2⤵
  PID:3264
- C:\Windows\System\yGMWlaB.exe
  C:\Windows\System\yGMWlaB.exe
  2⤵
  PID:3280
- C:\Windows\System\pQSxcXG.exe
  C:\Windows\System\pQSxcXG.exe
  2⤵
  PID:3296
- C:\Windows\System\BgifPLj.exe
  C:\Windows\System\BgifPLj.exe
  2⤵
  PID:3312
- C:\Windows\System\pZiRRkL.exe
  C:\Windows\System\pZiRRkL.exe
  2⤵
  PID:3328
- C:\Windows\System\cFEgVLi.exe
  C:\Windows\System\cFEgVLi.exe
  2⤵
  PID:3348
- C:\Windows\System\xwncIZx.exe
  C:\Windows\System\xwncIZx.exe
  2⤵
  PID:3364
- C:\Windows\System\sZfHUaT.exe
  C:\Windows\System\sZfHUaT.exe
  2⤵
  PID:3380
- C:\Windows\System\YKqYWck.exe
  C:\Windows\System\YKqYWck.exe
  2⤵
  PID:3396
- C:\Windows\System\scyLSXz.exe
  C:\Windows\System\scyLSXz.exe
  2⤵
  PID:3412
- C:\Windows\System\XOIWUOM.exe
  C:\Windows\System\XOIWUOM.exe
  2⤵
  PID:3428
- C:\Windows\System\mbBRSFX.exe
  C:\Windows\System\mbBRSFX.exe
  2⤵
  PID:3536
- C:\Windows\System\KOrljbo.exe
  C:\Windows\System\KOrljbo.exe
  2⤵
  PID:3564
- C:\Windows\System\qJRGCwu.exe
  C:\Windows\System\qJRGCwu.exe
  2⤵
  PID:3580
- C:\Windows\System\fLpQmwf.exe
  C:\Windows\System\fLpQmwf.exe
  2⤵
  PID:3596
- C:\Windows\System\taKWjwH.exe
  C:\Windows\System\taKWjwH.exe
  2⤵
  PID:3612
- C:\Windows\System\qUCDcWg.exe
  C:\Windows\System\qUCDcWg.exe
  2⤵
  PID:3628
- C:\Windows\System\CAOAjJH.exe
  C:\Windows\System\CAOAjJH.exe
  2⤵
  PID:3644
- C:\Windows\System\KOdIZzM.exe
  C:\Windows\System\KOdIZzM.exe
  2⤵
  PID:3660
- C:\Windows\System\gTZPLkH.exe
  C:\Windows\System\gTZPLkH.exe
  2⤵
  PID:3680
- C:\Windows\System\wADIZpj.exe
  C:\Windows\System\wADIZpj.exe
  2⤵
  PID:3700
- C:\Windows\System\QGqHYLE.exe
  C:\Windows\System\QGqHYLE.exe
  2⤵
  PID:3720
- C:\Windows\System\ZLoQmYx.exe
  C:\Windows\System\ZLoQmYx.exe
  2⤵
  PID:3796
- C:\Windows\System\aCOrMwN.exe
  C:\Windows\System\aCOrMwN.exe
  2⤵
  PID:3812
- C:\Windows\System\azdfiMu.exe
  C:\Windows\System\azdfiMu.exe
  2⤵
  PID:3828
- C:\Windows\System\RZRCUjg.exe
  C:\Windows\System\RZRCUjg.exe
  2⤵
  PID:3844
- C:\Windows\System\NvpmKkn.exe
  C:\Windows\System\NvpmKkn.exe
  2⤵
  PID:3860
- C:\Windows\System\kPaakZI.exe
  C:\Windows\System\kPaakZI.exe
  2⤵
  PID:3876
- C:\Windows\System\BlyQuzU.exe
  C:\Windows\System\BlyQuzU.exe
  2⤵
  PID:3892
- C:\Windows\System\gVCogIQ.exe
  C:\Windows\System\gVCogIQ.exe
  2⤵
  PID:3908
- C:\Windows\System\jeOympc.exe
  C:\Windows\System\jeOympc.exe
  2⤵
  PID:3924
- C:\Windows\System\MrRTkyZ.exe
  C:\Windows\System\MrRTkyZ.exe
  2⤵
  PID:3940
- C:\Windows\System\LRjKEFb.exe
  C:\Windows\System\LRjKEFb.exe
  2⤵
  PID:3956
- C:\Windows\System\YqtqHBV.exe
  C:\Windows\System\YqtqHBV.exe
  2⤵
  PID:3972
- C:\Windows\System\wHikRvm.exe
  C:\Windows\System\wHikRvm.exe
  2⤵
  PID:3988
- C:\Windows\System\QRWVSrz.exe
  C:\Windows\System\QRWVSrz.exe
  2⤵
  PID:4004
- C:\Windows\System\WupUgoy.exe
  C:\Windows\System\WupUgoy.exe
  2⤵
  PID:4020
- C:\Windows\System\opSZcBA.exe
  C:\Windows\System\opSZcBA.exe
  2⤵
  PID:4040
- C:\Windows\System\PMHqpPE.exe
  C:\Windows\System\PMHqpPE.exe
  2⤵
  PID:4056
- C:\Windows\System\PZrozei.exe
  C:\Windows\System\PZrozei.exe
  2⤵
  PID:4072
- C:\Windows\System\vtWMAey.exe
  C:\Windows\System\vtWMAey.exe
  2⤵
  PID:4088
- C:\Windows\System\hSsHCdH.exe
  C:\Windows\System\hSsHCdH.exe
  2⤵
  PID:2008
- C:\Windows\System\TbmVzCl.exe
  C:\Windows\System\TbmVzCl.exe
  2⤵
  PID:2444
- C:\Windows\System\SKkLWJf.exe
  C:\Windows\System\SKkLWJf.exe
  2⤵
  PID:3088
- C:\Windows\System\KGXIQij.exe
  C:\Windows\System\KGXIQij.exe
  2⤵
  PID:1972
- C:\Windows\System\XDsNaWf.exe
  C:\Windows\System\XDsNaWf.exe
  2⤵
  PID:3176
- C:\Windows\System\LgEcPTg.exe
  C:\Windows\System\LgEcPTg.exe
  2⤵
  PID:2428
- C:\Windows\System\lneOdVu.exe
  C:\Windows\System\lneOdVu.exe
  2⤵
  PID:2376
- C:\Windows\System\hupsbtG.exe
  C:\Windows\System\hupsbtG.exe
  2⤵
  PID:2904
- C:\Windows\System\jRexqBx.exe
  C:\Windows\System\jRexqBx.exe
  2⤵
  PID:3140
- C:\Windows\System\kxWVPYs.exe
  C:\Windows\System\kxWVPYs.exe
  2⤵
  PID:3420
- C:\Windows\System\SZdQdJu.exe
  C:\Windows\System\SZdQdJu.exe
  2⤵
  PID:3340
- C:\Windows\System\UsFmltp.exe
  C:\Windows\System\UsFmltp.exe
  2⤵
  PID:3516
- C:\Windows\System\MUpHYQn.exe
  C:\Windows\System\MUpHYQn.exe
  2⤵
  PID:3500
- C:\Windows\System\MmtMgpw.exe
  C:\Windows\System\MmtMgpw.exe
  2⤵
  PID:3484
- C:\Windows\System\pDCwvpj.exe
  C:\Windows\System\pDCwvpj.exe
  2⤵
  PID:3468
- C:\Windows\System\nGJKDII.exe
  C:\Windows\System\nGJKDII.exe
  2⤵
  PID:3452
- C:\Windows\System\WcmFVhP.exe
  C:\Windows\System\WcmFVhP.exe
  2⤵
  PID:3408
- C:\Windows\System\YiNJBHB.exe
  C:\Windows\System\YiNJBHB.exe
  2⤵
  PID:3308
- C:\Windows\System\yIkEnwn.exe
  C:\Windows\System\yIkEnwn.exe
  2⤵
  PID:3240
- C:\Windows\System\XeEHnjc.exe
  C:\Windows\System\XeEHnjc.exe
  2⤵
  PID:3440
- C:\Windows\System\XeEQseL.exe
  C:\Windows\System\XeEQseL.exe
  2⤵
  PID:3604
- C:\Windows\System\ynLUPso.exe
  C:\Windows\System\ynLUPso.exe
  2⤵
  PID:3668
- C:\Windows\System\IcDdIgU.exe
  C:\Windows\System\IcDdIgU.exe
  2⤵
  PID:3696
- C:\Windows\System\KvfBAVq.exe
  C:\Windows\System\KvfBAVq.exe
  2⤵
  PID:3652
- C:\Windows\System\OSjxclb.exe
  C:\Windows\System\OSjxclb.exe
  2⤵
  PID:3588
- C:\Windows\System\WXUbkdc.exe
  C:\Windows\System\WXUbkdc.exe
  2⤵
  PID:3548
- C:\Windows\System\nvOzHpQ.exe
  C:\Windows\System\nvOzHpQ.exe
  2⤵
  PID:3744
- C:\Windows\System\PJKwQuV.exe
  C:\Windows\System\PJKwQuV.exe
  2⤵
  PID:3712
- C:\Windows\System\sFQPexp.exe
  C:\Windows\System\sFQPexp.exe
  2⤵
  PID:3740
- C:\Windows\System\MTexLEs.exe
  C:\Windows\System\MTexLEs.exe
  2⤵
  PID:3760
- C:\Windows\System\LyFGCAG.exe
  C:\Windows\System\LyFGCAG.exe
  2⤵
  PID:3792
- C:\Windows\System\VJiIUyD.exe
  C:\Windows\System\VJiIUyD.exe
  2⤵
  PID:3952
- C:\Windows\System\DayyBAm.exe
  C:\Windows\System\DayyBAm.exe
  2⤵
  PID:3852
- C:\Windows\System\ypJQAsg.exe
  C:\Windows\System\ypJQAsg.exe
  2⤵
  PID:2700
- C:\Windows\System\JNRwTFU.exe
  C:\Windows\System\JNRwTFU.exe
  2⤵
  PID:3188
- C:\Windows\System\NmCaEuB.exe
  C:\Windows\System\NmCaEuB.exe
  2⤵
  PID:3256
- C:\Windows\System\ATHiacy.exe
  C:\Windows\System\ATHiacy.exe
  2⤵
  PID:1568
- C:\Windows\System\hgxORpH.exe
  C:\Windows\System\hgxORpH.exe
  2⤵
  PID:3424
- C:\Windows\System\JxDrysQ.exe
  C:\Windows\System\JxDrysQ.exe
  2⤵
  PID:3152
- C:\Windows\System\fsOVSBO.exe
  C:\Windows\System\fsOVSBO.exe
  2⤵
  PID:3320
- C:\Windows\System\DAhDFIl.exe
  C:\Windows\System\DAhDFIl.exe
  2⤵
  PID:3460
- C:\Windows\System\beTcXfo.exe
  C:\Windows\System\beTcXfo.exe
  2⤵
  PID:3208
- C:\Windows\System\RyjznKe.exe
  C:\Windows\System\RyjznKe.exe
  2⤵
  PID:3688
- C:\Windows\System\uAbievM.exe
  C:\Windows\System\uAbievM.exe
  2⤵
  PID:3772
- C:\Windows\System\VlfzMom.exe
  C:\Windows\System\VlfzMom.exe
  2⤵
  PID:3124
- C:\Windows\System\AdGENiu.exe
  C:\Windows\System\AdGENiu.exe
  2⤵
  PID:1956
- C:\Windows\System\PgalhfA.exe
  C:\Windows\System\PgalhfA.exe
  2⤵
  PID:3108
- C:\Windows\System\tSskFza.exe
  C:\Windows\System\tSskFza.exe
  2⤵
  PID:3220
- C:\Windows\System\ypLWYen.exe
  C:\Windows\System\ypLWYen.exe
  2⤵
  PID:2780
- C:\Windows\System\MpzrlSP.exe
  C:\Windows\System\MpzrlSP.exe
  2⤵
  PID:3552
- C:\Windows\System\tXQzNdK.exe
  C:\Windows\System\tXQzNdK.exe
  2⤵
  PID:3808
- C:\Windows\System\vlAPtRq.exe
  C:\Windows\System\vlAPtRq.exe
  2⤵
  PID:3508
- C:\Windows\System\IjSzlUA.exe
  C:\Windows\System\IjSzlUA.exe
  2⤵
  PID:3444
- C:\Windows\System\KcqjMTH.exe
  C:\Windows\System\KcqjMTH.exe
  2⤵
  PID:3572
- C:\Windows\System\MJzwWaJ.exe
  C:\Windows\System\MJzwWaJ.exe
  2⤵
  PID:3620
- C:\Windows\System\xwVmOUp.exe
  C:\Windows\System\xwVmOUp.exe
  2⤵
  PID:3784
- C:\Windows\System\kZgzTwQ.exe
  C:\Windows\System\kZgzTwQ.exe
  2⤵
  PID:4012
- C:\Windows\System\mTiSfvT.exe
  C:\Windows\System\mTiSfvT.exe
  2⤵
  PID:3804
- C:\Windows\System\GKVPBog.exe
  C:\Windows\System\GKVPBog.exe
  2⤵
  PID:3872
- C:\Windows\System\usXXWNv.exe
  C:\Windows\System\usXXWNv.exe
  2⤵
  PID:3948
- C:\Windows\System\cESdCzP.exe
  C:\Windows\System\cESdCzP.exe
  2⤵
  PID:3964
- C:\Windows\System\XXjyJPJ.exe
  C:\Windows\System\XXjyJPJ.exe
  2⤵
  PID:4000
- C:\Windows\System\iZisZcX.exe
  C:\Windows\System\iZisZcX.exe
  2⤵
  PID:4064
- C:\Windows\System\zGuaBAy.exe
  C:\Windows\System\zGuaBAy.exe
  2⤵
  PID:3120
- C:\Windows\System\SOuiAcp.exe
  C:\Windows\System\SOuiAcp.exe
  2⤵
  PID:3292
- C:\Windows\System\JBnlnQe.exe
  C:\Windows\System\JBnlnQe.exe
  2⤵
  PID:3524
- C:\Windows\System\rohdVrC.exe
  C:\Windows\System\rohdVrC.exe
  2⤵
  PID:3752
- C:\Windows\System\dWCfSxl.exe
  C:\Windows\System\dWCfSxl.exe
  2⤵
  PID:1664
- C:\Windows\System\bWMEpBR.exe
  C:\Windows\System\bWMEpBR.exe
  2⤵
  PID:4080
- C:\Windows\System\LjaitDw.exe
  C:\Windows\System\LjaitDw.exe
  2⤵
  PID:3372
- C:\Windows\System\rPekDgL.exe
  C:\Windows\System\rPekDgL.exe
  2⤵
  PID:3476
- C:\Windows\System\LuCFrGP.exe
  C:\Windows\System\LuCFrGP.exe
  2⤵
  PID:3544
- C:\Windows\System\ENLfpyl.exe
  C:\Windows\System\ENLfpyl.exe
  2⤵
  PID:3788
- C:\Windows\System\aOiojNH.exe
  C:\Windows\System\aOiojNH.exe
  2⤵
  PID:3556
- C:\Windows\System\ePuBWrt.exe
  C:\Windows\System\ePuBWrt.exe
  2⤵
  PID:2792
- C:\Windows\System\IyMUxqV.exe
  C:\Windows\System\IyMUxqV.exe
  2⤵
  PID:3160
- C:\Windows\System\YBaBIgF.exe
  C:\Windows\System\YBaBIgF.exe
  2⤵
  PID:2184
- C:\Windows\System\DkwiNYr.exe
  C:\Windows\System\DkwiNYr.exe
  2⤵
  PID:3888
- C:\Windows\System\toSlRlH.exe
  C:\Windows\System\toSlRlH.exe
  2⤵
  PID:3996
- C:\Windows\System\doMYSuR.exe
  C:\Windows\System\doMYSuR.exe
  2⤵
  PID:1116
- C:\Windows\System\NtbmIbi.exe
  C:\Windows\System\NtbmIbi.exe
  2⤵
  PID:4084
- C:\Windows\System\rrizcMp.exe
  C:\Windows\System\rrizcMp.exe
  2⤵
  PID:3272
- C:\Windows\System\sdAkaVz.exe
  C:\Windows\System\sdAkaVz.exe
  2⤵
  PID:3392
- C:\Windows\System\BdORzeQ.exe
  C:\Windows\System\BdORzeQ.exe
  2⤵
  PID:4112
- C:\Windows\System\AYyVLYm.exe
  C:\Windows\System\AYyVLYm.exe
  2⤵
  PID:4128
- C:\Windows\System\HdKdkUa.exe
  C:\Windows\System\HdKdkUa.exe
  2⤵
  PID:4144
- C:\Windows\System\ykbKBvY.exe
  C:\Windows\System\ykbKBvY.exe
  2⤵
  PID:4168
- C:\Windows\System\JHLxEGv.exe
  C:\Windows\System\JHLxEGv.exe
  2⤵
  PID:4184
- C:\Windows\System\axCBZEo.exe
  C:\Windows\System\axCBZEo.exe
  2⤵
  PID:4200
- C:\Windows\System\UICZgWY.exe
  C:\Windows\System\UICZgWY.exe
  2⤵
  PID:4216
- C:\Windows\System\EPkfmZe.exe
  C:\Windows\System\EPkfmZe.exe
  2⤵
  PID:4232
- C:\Windows\System\dAGXApq.exe
  C:\Windows\System\dAGXApq.exe
  2⤵
  PID:4248
- C:\Windows\System\LzXYAfk.exe
  C:\Windows\System\LzXYAfk.exe
  2⤵
  PID:4264
- C:\Windows\System\kVqcrID.exe
  C:\Windows\System\kVqcrID.exe
  2⤵
  PID:4280
- C:\Windows\System\HqZMZzU.exe
  C:\Windows\System\HqZMZzU.exe
  2⤵
  PID:4296
- C:\Windows\System\YhtktPz.exe
  C:\Windows\System\YhtktPz.exe
  2⤵
  PID:4312
- C:\Windows\System\WnDymOk.exe
  C:\Windows\System\WnDymOk.exe
  2⤵
  PID:4332
- C:\Windows\System\cmhawKK.exe
  C:\Windows\System\cmhawKK.exe
  2⤵
  PID:4348
- C:\Windows\System\qQYhwRa.exe
  C:\Windows\System\qQYhwRa.exe
  2⤵
  PID:4364
- C:\Windows\System\gqqvfKw.exe
  C:\Windows\System\gqqvfKw.exe
  2⤵
  PID:4380
- C:\Windows\System\NrVETAb.exe
  C:\Windows\System\NrVETAb.exe
  2⤵
  PID:4396
- C:\Windows\System\khWgKcu.exe
  C:\Windows\System\khWgKcu.exe
  2⤵
  PID:4412
- C:\Windows\System\CmSKkNp.exe
  C:\Windows\System\CmSKkNp.exe
  2⤵
  PID:4428
- C:\Windows\System\hxlRgcB.exe
  C:\Windows\System\hxlRgcB.exe
  2⤵
  PID:4444
- C:\Windows\System\gwWDKNy.exe
  C:\Windows\System\gwWDKNy.exe
  2⤵
  PID:4460
- C:\Windows\System\NgVhJum.exe
  C:\Windows\System\NgVhJum.exe
  2⤵
  PID:4476
- C:\Windows\System\oTcqYYl.exe
  C:\Windows\System\oTcqYYl.exe
  2⤵
  PID:4492
- C:\Windows\System\gzYoFjD.exe
  C:\Windows\System\gzYoFjD.exe
  2⤵
  PID:4508
- C:\Windows\System\dNvthpF.exe
  C:\Windows\System\dNvthpF.exe
  2⤵
  PID:4524
- C:\Windows\System\uChMTSa.exe
  C:\Windows\System\uChMTSa.exe
  2⤵
  PID:4540
- C:\Windows\System\LpPssgm.exe
  C:\Windows\System\LpPssgm.exe
  2⤵
  PID:4556
- C:\Windows\System\nWKHbpA.exe
  C:\Windows\System\nWKHbpA.exe
  2⤵
  PID:4572
- C:\Windows\System\TkGXyfe.exe
  C:\Windows\System\TkGXyfe.exe
  2⤵
  PID:4588
- C:\Windows\System\OckaAKr.exe
  C:\Windows\System\OckaAKr.exe
  2⤵
  PID:4604
- C:\Windows\System\HScDWMA.exe
  C:\Windows\System\HScDWMA.exe
  2⤵
  PID:4620
- C:\Windows\System\RvjLJtH.exe
  C:\Windows\System\RvjLJtH.exe
  2⤵
  PID:4636
- C:\Windows\System\XGBkqwh.exe
  C:\Windows\System\XGBkqwh.exe
  2⤵
  PID:4652
- C:\Windows\System\dQbgzKJ.exe
  C:\Windows\System\dQbgzKJ.exe
  2⤵
  PID:4672
- C:\Windows\System\wDiyecM.exe
  C:\Windows\System\wDiyecM.exe
  2⤵
  PID:4688
- C:\Windows\System\GtZBsXE.exe
  C:\Windows\System\GtZBsXE.exe
  2⤵
  PID:4704
- C:\Windows\System\YEwGVtL.exe
  C:\Windows\System\YEwGVtL.exe
  2⤵
  PID:4720
- C:\Windows\System\CJlLCOV.exe
  C:\Windows\System\CJlLCOV.exe
  2⤵
  PID:4736
- C:\Windows\System\xCHDBFf.exe
  C:\Windows\System\xCHDBFf.exe
  2⤵
  PID:4752
- C:\Windows\System\CZKving.exe
  C:\Windows\System\CZKving.exe
  2⤵
  PID:4768
- C:\Windows\System\uEkXUdL.exe
  C:\Windows\System\uEkXUdL.exe
  2⤵
  PID:4784
- C:\Windows\System\rNrHOQZ.exe
  C:\Windows\System\rNrHOQZ.exe
  2⤵
  PID:4800
- C:\Windows\System\GZnmONH.exe
  C:\Windows\System\GZnmONH.exe
  2⤵
  PID:4816
- C:\Windows\System\hhlunMG.exe
  C:\Windows\System\hhlunMG.exe
  2⤵
  PID:4832
- C:\Windows\System\ndGewVW.exe
  C:\Windows\System\ndGewVW.exe
  2⤵
  PID:4940
- C:\Windows\System\CNmnLmc.exe
  C:\Windows\System\CNmnLmc.exe
  2⤵
  PID:4960
- C:\Windows\System\wVvDPiy.exe
  C:\Windows\System\wVvDPiy.exe
  2⤵
  PID:4980
- C:\Windows\System\pHGCgio.exe
  C:\Windows\System\pHGCgio.exe
  2⤵
  PID:4996
- C:\Windows\System\UqGEllq.exe
  C:\Windows\System\UqGEllq.exe
  2⤵
  PID:5072
- C:\Windows\System\lDzTEIi.exe
  C:\Windows\System\lDzTEIi.exe
  2⤵
  PID:5092
- C:\Windows\System\eZXNfeM.exe
  C:\Windows\System\eZXNfeM.exe
  2⤵
  PID:5112
- C:\Windows\System\lxEBHIL.exe
  C:\Windows\System\lxEBHIL.exe
  2⤵
  PID:3984
- C:\Windows\System\VBINfqc.exe
  C:\Windows\System\VBINfqc.exe
  2⤵
  PID:3856
- C:\Windows\System\IPjFqYh.exe
  C:\Windows\System\IPjFqYh.exe
  2⤵
  PID:4196
- C:\Windows\System\cLrDTRo.exe
  C:\Windows\System\cLrDTRo.exe
  2⤵
  PID:280
- C:\Windows\System\PUZUNBw.exe
  C:\Windows\System\PUZUNBw.exe
  2⤵
  PID:4548
- C:\Windows\System\KpbFIhQ.exe
  C:\Windows\System\KpbFIhQ.exe
  2⤵
  PID:4552
- C:\Windows\System\BpoaeTr.exe
  C:\Windows\System\BpoaeTr.exe
  2⤵
  PID:4644
- C:\Windows\System\inWQMsj.exe
  C:\Windows\System\inWQMsj.exe
  2⤵
  PID:4684
- C:\Windows\System\MmEPJKM.exe
  C:\Windows\System\MmEPJKM.exe
  2⤵
  PID:4792
- C:\Windows\System\IhHrLdC.exe
  C:\Windows\System\IhHrLdC.exe
  2⤵
  PID:4716
- C:\Windows\System\MNKflCU.exe
  C:\Windows\System\MNKflCU.exe
  2⤵
  PID:4808
- C:\Windows\System\jXiCheb.exe
  C:\Windows\System\jXiCheb.exe
  2⤵
  PID:4856
- C:\Windows\System\gkqWShF.exe
  C:\Windows\System\gkqWShF.exe
  2⤵
  PID:4868
- C:\Windows\System\skCrWKX.exe
  C:\Windows\System\skCrWKX.exe
  2⤵
  PID:4892
- C:\Windows\System\lAJYlEC.exe
  C:\Windows\System\lAJYlEC.exe
  2⤵
  PID:4908
- C:\Windows\System\DJFzsXx.exe
  C:\Windows\System\DJFzsXx.exe
  2⤵
  PID:4932
- C:\Windows\System\mHHtQKZ.exe
  C:\Windows\System\mHHtQKZ.exe
  2⤵
  PID:4952
- C:\Windows\System\eWuYIzE.exe
  C:\Windows\System\eWuYIzE.exe
  2⤵
  PID:4972
- C:\Windows\System\nOeENqu.exe
  C:\Windows\System\nOeENqu.exe
  2⤵
  PID:5008
- C:\Windows\System\zEwHXHd.exe
  C:\Windows\System\zEwHXHd.exe
  2⤵
  PID:5028
- C:\Windows\System\wzeLtoN.exe
  C:\Windows\System\wzeLtoN.exe
  2⤵
  PID:5044
- C:\Windows\System\gTyjCKQ.exe
  C:\Windows\System\gTyjCKQ.exe
  2⤵
  PID:5064
- C:\Windows\System\ymmMzQu.exe
  C:\Windows\System\ymmMzQu.exe
  2⤵
  PID:5088
- C:\Windows\System\RzMOLgk.exe
  C:\Windows\System\RzMOLgk.exe
  2⤵
  PID:5100
- C:\Windows\System\VkZiOqZ.exe
  C:\Windows\System\VkZiOqZ.exe
  2⤵
  PID:3260
- C:\Windows\System\zJESIMo.exe
  C:\Windows\System\zJESIMo.exe
  2⤵
  PID:4152
- C:\Windows\System\aYmdNsd.exe
  C:\Windows\System\aYmdNsd.exe
  2⤵
  PID:4192
- C:\Windows\System\AFTZJDi.exe
  C:\Windows\System\AFTZJDi.exe
  2⤵
  PID:4104
- C:\Windows\System\sEduYzN.exe
  C:\Windows\System\sEduYzN.exe
  2⤵
  PID:4208
- C:\Windows\System\PhxjhpA.exe
  C:\Windows\System\PhxjhpA.exe
  2⤵
  PID:4260
- C:\Windows\System\mQaJcwk.exe
  C:\Windows\System\mQaJcwk.exe
  2⤵
  PID:4324
- C:\Windows\System\WczUPWt.exe
  C:\Windows\System\WczUPWt.exe
  2⤵
  PID:4244
- C:\Windows\System\RTwcgwK.exe
  C:\Windows\System\RTwcgwK.exe
  2⤵
  PID:4308
- C:\Windows\System\GAJuEZx.exe
  C:\Windows\System\GAJuEZx.exe
  2⤵
  PID:4404
- C:\Windows\System\OmsXEJi.exe
  C:\Windows\System\OmsXEJi.exe
  2⤵
  PID:4468
- C:\Windows\System\qKucfFG.exe
  C:\Windows\System\qKucfFG.exe
  2⤵
  PID:4664
- C:\Windows\System\TLymVpw.exe
  C:\Windows\System\TLymVpw.exe
  2⤵
  PID:4564
- C:\Windows\System\tnlhTXh.exe
  C:\Windows\System\tnlhTXh.exe
  2⤵
  PID:4424
- C:\Windows\System\kRlsySv.exe
  C:\Windows\System\kRlsySv.exe
  2⤵
  PID:4852
- C:\Windows\System\bcPEeWC.exe
  C:\Windows\System\bcPEeWC.exe
  2⤵
  PID:4760
- C:\Windows\System\gbmFWFs.exe
  C:\Windows\System\gbmFWFs.exe
  2⤵
  PID:4924
- C:\Windows\System\GycDXjl.exe
  C:\Windows\System\GycDXjl.exe
  2⤵
  PID:5040
- C:\Windows\System\gyUJnjH.exe
  C:\Windows\System\gyUJnjH.exe
  2⤵
  PID:5108
- C:\Windows\System\nGsPgKf.exe
  C:\Windows\System\nGsPgKf.exe
  2⤵
  PID:4344
- C:\Windows\System\HCTgbXb.exe
  C:\Windows\System\HCTgbXb.exe
  2⤵
  PID:4176
- C:\Windows\System\QdmKVji.exe
  C:\Windows\System\QdmKVji.exe
  2⤵
  PID:3836
- C:\Windows\System\QoiwdPS.exe
  C:\Windows\System\QoiwdPS.exe
  2⤵
  PID:4764
- C:\Windows\System\EgFrzKZ.exe
  C:\Windows\System\EgFrzKZ.exe
  2⤵
  PID:3776
- C:\Windows\System\kqygxnF.exe
  C:\Windows\System\kqygxnF.exe
  2⤵
  PID:5004
- C:\Windows\System\gkXaAtY.exe
  C:\Windows\System\gkXaAtY.exe
  2⤵
  PID:4884
- C:\Windows\System\zToSgxP.exe
  C:\Windows\System\zToSgxP.exe
  2⤵
  PID:4976
- C:\Windows\System\SfjwIXf.exe
  C:\Windows\System\SfjwIXf.exe
  2⤵
  PID:5048
- C:\Windows\System\yOOIxWI.exe
  C:\Windows\System\yOOIxWI.exe
  2⤵
  PID:4796
- C:\Windows\System\HPgUyvY.exe
  C:\Windows\System\HPgUyvY.exe
  2⤵
  PID:4812
- C:\Windows\System\NRsUBul.exe
  C:\Windows\System\NRsUBul.exe
  2⤵
  PID:4376
- C:\Windows\System\NpDmxts.exe
  C:\Windows\System\NpDmxts.exe
  2⤵
  PID:4436
- C:\Windows\System\wDCjfcT.exe
  C:\Windows\System\wDCjfcT.exe
  2⤵
  PID:4488
- C:\Windows\System\wrRcbDX.exe
  C:\Windows\System\wrRcbDX.exe
  2⤵
  PID:3840
- C:\Windows\System\lxOMHZF.exe
  C:\Windows\System\lxOMHZF.exe
  2⤵
  PID:4016
- C:\Windows\System\XlEnFhe.exe
  C:\Windows\System\XlEnFhe.exe
  2⤵
  PID:4372
- C:\Windows\System\dhgXvod.exe
  C:\Windows\System\dhgXvod.exe
  2⤵
  PID:4956
- C:\Windows\System\dgfMTUc.exe
  C:\Windows\System\dgfMTUc.exe
  2⤵
  PID:5084
- C:\Windows\System\caaOjGt.exe
  C:\Windows\System\caaOjGt.exe
  2⤵
  PID:4136
- C:\Windows\System\cpfHYnL.exe
  C:\Windows\System\cpfHYnL.exe
  2⤵
  PID:4276
- C:\Windows\System\KQmQOzN.exe
  C:\Windows\System\KQmQOzN.exe
  2⤵
  PID:4668
- C:\Windows\System\nxyprzh.exe
  C:\Windows\System\nxyprzh.exe
  2⤵
  PID:4828
- C:\Windows\System\psfkGpO.exe
  C:\Windows\System\psfkGpO.exe
  2⤵
  PID:4904
- C:\Windows\System\kUMjkNi.exe
  C:\Windows\System\kUMjkNi.exe
  2⤵
  PID:4516
- C:\Windows\System\sZEvqxR.exe
  C:\Windows\System\sZEvqxR.exe
  2⤵
  PID:4124
- C:\Windows\System\lOANpfF.exe
  C:\Windows\System\lOANpfF.exe
  2⤵
  PID:4484
- C:\Windows\System\CijNkSB.exe
  C:\Windows\System\CijNkSB.exe
  2⤵
  PID:4628
- C:\Windows\System\xEiPPVC.exe
  C:\Windows\System\xEiPPVC.exe
  2⤵
  PID:3388
- C:\Windows\System\TSnlkbZ.exe
  C:\Windows\System\TSnlkbZ.exe
  2⤵
  PID:2300
- C:\Windows\System\fRSaahU.exe
  C:\Windows\System\fRSaahU.exe
  2⤵
  PID:4420
- C:\Windows\System\RKYpRLC.exe
  C:\Windows\System\RKYpRLC.exe
  2⤵
  PID:4036
- C:\Windows\System\KafFskQ.exe
  C:\Windows\System\KafFskQ.exe
  2⤵
  PID:4320
- C:\Windows\System\dJqJlaK.exe
  C:\Windows\System\dJqJlaK.exe
  2⤵
  PID:4696
- C:\Windows\System\hOfhzyk.exe
  C:\Windows\System\hOfhzyk.exe
  2⤵
  PID:5024
- C:\Windows\System\jnPOSOo.exe
  C:\Windows\System\jnPOSOo.exe
  2⤵
  PID:5128
- C:\Windows\System\GMecBXo.exe
  C:\Windows\System\GMecBXo.exe
  2⤵
  PID:5148
- C:\Windows\System\utpzhlM.exe
  C:\Windows\System\utpzhlM.exe
  2⤵
  PID:5164
- C:\Windows\System\BeKbFzW.exe
  C:\Windows\System\BeKbFzW.exe
  2⤵
  PID:5180
- C:\Windows\System\PGzlpem.exe
  C:\Windows\System\PGzlpem.exe
  2⤵
  PID:5196
- C:\Windows\System\OCjwgpI.exe
  C:\Windows\System\OCjwgpI.exe
  2⤵
  PID:5212
- C:\Windows\System\LMnqvFS.exe
  C:\Windows\System\LMnqvFS.exe
  2⤵
  PID:5236
- C:\Windows\System\UJImGeZ.exe
  C:\Windows\System\UJImGeZ.exe
  2⤵
  PID:5252
- C:\Windows\System\mdcQLDe.exe
  C:\Windows\System\mdcQLDe.exe
  2⤵
  PID:5272
- C:\Windows\System\NOhWwwe.exe
  C:\Windows\System\NOhWwwe.exe
  2⤵
  PID:5292
- C:\Windows\System\AMUXkAZ.exe
  C:\Windows\System\AMUXkAZ.exe
  2⤵
  PID:5308
- C:\Windows\System\JqSAYNU.exe
  C:\Windows\System\JqSAYNU.exe
  2⤵
  PID:5324
- C:\Windows\System\XDEjSnZ.exe
  C:\Windows\System\XDEjSnZ.exe
  2⤵
  PID:5340
- C:\Windows\System\LwKQIXk.exe
  C:\Windows\System\LwKQIXk.exe
  2⤵
  PID:5364
- C:\Windows\System\ebVRFzA.exe
  C:\Windows\System\ebVRFzA.exe
  2⤵
  PID:5380
- C:\Windows\System\OFsCmfi.exe
  C:\Windows\System\OFsCmfi.exe
  2⤵
  PID:5396
- C:\Windows\System\mhvsyVH.exe
  C:\Windows\System\mhvsyVH.exe
  2⤵
  PID:5412
- C:\Windows\System\ltluZAq.exe
  C:\Windows\System\ltluZAq.exe
  2⤵
  PID:5428
- C:\Windows\System\aXLxxNh.exe
  C:\Windows\System\aXLxxNh.exe
  2⤵
  PID:5444
- C:\Windows\System\AZctePx.exe
  C:\Windows\System\AZctePx.exe
  2⤵
  PID:5460
- C:\Windows\System\dSkbxuX.exe
  C:\Windows\System\dSkbxuX.exe
  2⤵
  PID:5476
- C:\Windows\System\sRlYWsU.exe
  C:\Windows\System\sRlYWsU.exe
  2⤵
  PID:5492
- C:\Windows\System\SGcOGJR.exe
  C:\Windows\System\SGcOGJR.exe
  2⤵
  PID:5508
- C:\Windows\System\EUzHJSU.exe
  C:\Windows\System\EUzHJSU.exe
  2⤵
  PID:5524
- C:\Windows\System\kONoRiT.exe
  C:\Windows\System\kONoRiT.exe
  2⤵
  PID:5540
- C:\Windows\System\ZEHJcwS.exe
  C:\Windows\System\ZEHJcwS.exe
  2⤵
  PID:5556
- C:\Windows\System\xdADEdU.exe
  C:\Windows\System\xdADEdU.exe
  2⤵
  PID:5572
- C:\Windows\System\RAXPGrs.exe
  C:\Windows\System\RAXPGrs.exe
  2⤵
  PID:5588
- C:\Windows\System\zYAOdWo.exe
  C:\Windows\System\zYAOdWo.exe
  2⤵
  PID:5604
- C:\Windows\System\acFkNcy.exe
  C:\Windows\System\acFkNcy.exe
  2⤵
  PID:5620
- C:\Windows\System\KhMucKv.exe
  C:\Windows\System\KhMucKv.exe
  2⤵
  PID:5636
- C:\Windows\System\jpyhoie.exe
  C:\Windows\System\jpyhoie.exe
  2⤵
  PID:5652
- C:\Windows\System\NtIqFMo.exe
  C:\Windows\System\NtIqFMo.exe
  2⤵
  PID:5668
- C:\Windows\System\oAUHBwu.exe
  C:\Windows\System\oAUHBwu.exe
  2⤵
  PID:5684
- C:\Windows\System\AEMkcTC.exe
  C:\Windows\System\AEMkcTC.exe
  2⤵
  PID:5700
- C:\Windows\System\IMknWbZ.exe
  C:\Windows\System\IMknWbZ.exe
  2⤵
  PID:5720
- C:\Windows\System\fWJUAZk.exe
  C:\Windows\System\fWJUAZk.exe
  2⤵
  PID:5736
- C:\Windows\System\WnUtgNK.exe
  C:\Windows\System\WnUtgNK.exe
  2⤵
  PID:5752
- C:\Windows\System\MynYLKj.exe
  C:\Windows\System\MynYLKj.exe
  2⤵
  PID:5768
- C:\Windows\System\TFnOrPS.exe
  C:\Windows\System\TFnOrPS.exe
  2⤵
  PID:5784
- C:\Windows\System\BgPmeqX.exe
  C:\Windows\System\BgPmeqX.exe
  2⤵
  PID:5804
- C:\Windows\System\gMYwWhb.exe
  C:\Windows\System\gMYwWhb.exe
  2⤵
  PID:5820
- C:\Windows\System\VWYUEoT.exe
  C:\Windows\System\VWYUEoT.exe
  2⤵
  PID:5836
- C:\Windows\System\xensjgn.exe
  C:\Windows\System\xensjgn.exe
  2⤵
  PID:5852
- C:\Windows\System\XRROiJj.exe
  C:\Windows\System\XRROiJj.exe
  2⤵
  PID:5868
- C:\Windows\System\jEHgyJp.exe
  C:\Windows\System\jEHgyJp.exe
  2⤵
  PID:5884
- C:\Windows\System\bwmCSZW.exe
  C:\Windows\System\bwmCSZW.exe
  2⤵
  PID:5900
- C:\Windows\System\nytXrpl.exe
  C:\Windows\System\nytXrpl.exe
  2⤵
  PID:5916
- C:\Windows\System\ShZmEZA.exe
  C:\Windows\System\ShZmEZA.exe
  2⤵
  PID:5932
- C:\Windows\System\QqxwwPz.exe
  C:\Windows\System\QqxwwPz.exe
  2⤵
  PID:5948
- C:\Windows\System\rHyvIoS.exe
  C:\Windows\System\rHyvIoS.exe
  2⤵
  PID:5964
- C:\Windows\System\SsnbcHc.exe
  C:\Windows\System\SsnbcHc.exe
  2⤵
  PID:5980
- C:\Windows\System\TEytzSB.exe
  C:\Windows\System\TEytzSB.exe
  2⤵
  PID:5996
- C:\Windows\System\MViLqnP.exe
  C:\Windows\System\MViLqnP.exe
  2⤵
  PID:6012
- C:\Windows\System\mjqAPxK.exe
  C:\Windows\System\mjqAPxK.exe
  2⤵
  PID:6028
- C:\Windows\System\sOepMPx.exe
  C:\Windows\System\sOepMPx.exe
  2⤵
  PID:6044
- C:\Windows\System\HaXrNDP.exe
  C:\Windows\System\HaXrNDP.exe
  2⤵
  PID:6060
- C:\Windows\System\qbeFGSG.exe
  C:\Windows\System\qbeFGSG.exe
  2⤵
  PID:6076
- C:\Windows\System\zHvPxyK.exe
  C:\Windows\System\zHvPxyK.exe
  2⤵
  PID:6092
- C:\Windows\System\kPhDxNM.exe
  C:\Windows\System\kPhDxNM.exe
  2⤵
  PID:6108
- C:\Windows\System\FUMlocJ.exe
  C:\Windows\System\FUMlocJ.exe
  2⤵
  PID:6124
- C:\Windows\System\UnpgaTJ.exe
  C:\Windows\System\UnpgaTJ.exe
  2⤵
  PID:6140
- C:\Windows\System\pthrMzc.exe
  C:\Windows\System\pthrMzc.exe
  2⤵
  PID:4532
- C:\Windows\System\CwNQuHr.exe
  C:\Windows\System\CwNQuHr.exe
  2⤵
  PID:4880
- C:\Windows\System\KWfJGyR.exe
  C:\Windows\System\KWfJGyR.exe
  2⤵
  PID:4840
- C:\Windows\System\XFzIJrM.exe
  C:\Windows\System\XFzIJrM.exe
  2⤵
  PID:4292
- C:\Windows\System\ePosMxz.exe
  C:\Windows\System\ePosMxz.exe
  2⤵
  PID:5140
- C:\Windows\System\inpIJoh.exe
  C:\Windows\System\inpIJoh.exe
  2⤵
  PID:5172
- C:\Windows\System\GzWAEFQ.exe
  C:\Windows\System\GzWAEFQ.exe
  2⤵
  PID:5424
- C:\Windows\System\YxLqDGX.exe
  C:\Windows\System\YxLqDGX.exe
  2⤵
  PID:5376
- C:\Windows\System\FmYKJqd.exe
  C:\Windows\System\FmYKJqd.exe
  2⤵
  PID:5456
- C:\Windows\System\EjTrdXp.exe
  C:\Windows\System\EjTrdXp.exe
  2⤵
  PID:5436
- C:\Windows\System\uVcBRnO.exe
  C:\Windows\System\uVcBRnO.exe
  2⤵
  PID:4584
- C:\Windows\System\CHmKCwu.exe
  C:\Windows\System\CHmKCwu.exe
  2⤵
  PID:5548
- C:\Windows\System\kMttfbA.exe
  C:\Windows\System\kMttfbA.exe
  2⤵
  PID:5612
- C:\Windows\System\tswtgmx.exe
  C:\Windows\System\tswtgmx.exe
  2⤵
  PID:5676
- C:\Windows\System\GbUgLhr.exe
  C:\Windows\System\GbUgLhr.exe
  2⤵
  PID:5876
- C:\Windows\System\HLZrCzt.exe
  C:\Windows\System\HLZrCzt.exe
  2⤵
  PID:5844
- C:\Windows\System\NgDcTFY.exe
  C:\Windows\System\NgDcTFY.exe
  2⤵
  PID:5924
- C:\Windows\System\ypoudWC.exe
  C:\Windows\System\ypoudWC.exe
  2⤵
  PID:6056
- C:\Windows\System\PipgGPI.exe
  C:\Windows\System\PipgGPI.exe
  2⤵
  PID:5928
- C:\Windows\System\SLhyIat.exe
  C:\Windows\System\SLhyIat.exe
  2⤵
  PID:6120
- C:\Windows\System\PRPnAXH.exe
  C:\Windows\System\PRPnAXH.exe
  2⤵
  PID:4680
- C:\Windows\System\lkjHMiS.exe
  C:\Windows\System\lkjHMiS.exe
  2⤵
  PID:5160
- C:\Windows\System\fceeNyy.exe
  C:\Windows\System\fceeNyy.exe
  2⤵
  PID:6004
- C:\Windows\System\HbhpsVp.exe
  C:\Windows\System\HbhpsVp.exe
  2⤵
  PID:6068
- C:\Windows\System\sDdBbEv.exe
  C:\Windows\System\sDdBbEv.exe
  2⤵
  PID:6136
- C:\Windows\System\rUtOubh.exe
  C:\Windows\System\rUtOubh.exe
  2⤵
  PID:6072
- C:\Windows\System\tKdVbgS.exe
  C:\Windows\System\tKdVbgS.exe
  2⤵
  PID:5244
- C:\Windows\System\VZHfLpu.exe
  C:\Windows\System\VZHfLpu.exe
  2⤵
  PID:5288
- C:\Windows\System\fXeWIPc.exe
  C:\Windows\System\fXeWIPc.exe
  2⤵
  PID:5188
- C:\Windows\System\VRxKZXQ.exe
  C:\Windows\System\VRxKZXQ.exe
  2⤵
  PID:5304
- C:\Windows\System\oTGaOgi.exe
  C:\Windows\System\oTGaOgi.exe
  2⤵
  PID:5336
- C:\Windows\System\cdsNAZR.exe
  C:\Windows\System\cdsNAZR.exe
  2⤵
  PID:5392
- C:\Windows\System\zNRzSZv.exe
  C:\Windows\System\zNRzSZv.exe
  2⤵
  PID:5440
- C:\Windows\System\qQqQOCJ.exe
  C:\Windows\System\qQqQOCJ.exe
  2⤵
  PID:5708
- C:\Windows\System\iaKGMPM.exe
  C:\Windows\System\iaKGMPM.exe
  2⤵
  PID:5488
- C:\Windows\System\fWTiAZF.exe
  C:\Windows\System\fWTiAZF.exe
  2⤵
  PID:5520
- C:\Windows\System\YuoAsEm.exe
  C:\Windows\System\YuoAsEm.exe
  2⤵
  PID:5568
- C:\Windows\System\CzsYRZq.exe
  C:\Windows\System\CzsYRZq.exe
  2⤵
  PID:5632
- C:\Windows\System\JWMYTky.exe
  C:\Windows\System\JWMYTky.exe
  2⤵
  PID:5696
- C:\Windows\System\XMrTmoz.exe
  C:\Windows\System\XMrTmoz.exe
  2⤵
  PID:5776
- C:\Windows\System\FUHGNLi.exe
  C:\Windows\System\FUHGNLi.exe
  2⤵
  PID:5908
- C:\Windows\System\HqOcTtU.exe
  C:\Windows\System\HqOcTtU.exe
  2⤵
  PID:5992
- C:\Windows\System\NvPJVLw.exe
  C:\Windows\System\NvPJVLw.exe
  2⤵
  PID:4228
- C:\Windows\System\oLgcctD.exe
  C:\Windows\System\oLgcctD.exe
  2⤵
  PID:4360
- C:\Windows\System\zUferGF.exe
  C:\Windows\System\zUferGF.exe
  2⤵
  PID:5812
- C:\Windows\System\kHMDvBU.exe
  C:\Windows\System\kHMDvBU.exe
  2⤵
  PID:5792
- C:\Windows\System\UlzKqhD.exe
  C:\Windows\System\UlzKqhD.exe
  2⤵
  PID:5976
- C:\Windows\System\XWzaUvn.exe
  C:\Windows\System\XWzaUvn.exe
  2⤵
  PID:5320
- C:\Windows\System\bGmwupt.exe
  C:\Windows\System\bGmwupt.exe
  2⤵
  PID:5348
- C:\Windows\System\UXEAtjJ.exe
  C:\Windows\System\UXEAtjJ.exe
  2⤵
  PID:5372
- C:\Windows\System\FYOCHLd.exe
  C:\Windows\System\FYOCHLd.exe
  2⤵
  PID:6164
- C:\Windows\System\SpHMRGQ.exe
  C:\Windows\System\SpHMRGQ.exe
  2⤵
  PID:6180
- C:\Windows\System\hOrcEzy.exe
  C:\Windows\System\hOrcEzy.exe
  2⤵
  PID:6200
- C:\Windows\System\QHAEMzo.exe
  C:\Windows\System\QHAEMzo.exe
  2⤵
  PID:6216
- C:\Windows\System\EAkhsiA.exe
  C:\Windows\System\EAkhsiA.exe
  2⤵
  PID:6232
- C:\Windows\System\JJMUzPI.exe
  C:\Windows\System\JJMUzPI.exe
  2⤵
  PID:6248
- C:\Windows\System\rvLoQUt.exe
  C:\Windows\System\rvLoQUt.exe
  2⤵
  PID:6264
- C:\Windows\System\PDRNukQ.exe
  C:\Windows\System\PDRNukQ.exe
  2⤵
  PID:6280
- C:\Windows\System\smUCLyc.exe
  C:\Windows\System\smUCLyc.exe
  2⤵
  PID:6296
- C:\Windows\System\BrxRpzf.exe
  C:\Windows\System\BrxRpzf.exe
  2⤵
  PID:6312
- C:\Windows\System\CSVeRyZ.exe
  C:\Windows\System\CSVeRyZ.exe
  2⤵
  PID:6328
- C:\Windows\System\keXHpRZ.exe
  C:\Windows\System\keXHpRZ.exe
  2⤵
  PID:6344
- C:\Windows\System\TNggnop.exe
  C:\Windows\System\TNggnop.exe
  2⤵
  PID:6360
- C:\Windows\System\XNRsPUN.exe
  C:\Windows\System\XNRsPUN.exe
  2⤵
  PID:6376
- C:\Windows\System\XlPPwEb.exe
  C:\Windows\System\XlPPwEb.exe
  2⤵
  PID:6392
- C:\Windows\System\vpZASGe.exe
  C:\Windows\System\vpZASGe.exe
  2⤵
  PID:6408
- C:\Windows\System\AtAEDjN.exe
  C:\Windows\System\AtAEDjN.exe
  2⤵
  PID:6424
- C:\Windows\System\LgrWuGJ.exe
  C:\Windows\System\LgrWuGJ.exe
  2⤵
  PID:6440
- C:\Windows\System\XVwvWcQ.exe
  C:\Windows\System\XVwvWcQ.exe
  2⤵
  PID:6456
- C:\Windows\System\RHbLGDR.exe
  C:\Windows\System\RHbLGDR.exe
  2⤵
  PID:6472
- C:\Windows\System\zuhtIFC.exe
  C:\Windows\System\zuhtIFC.exe
  2⤵
  PID:6492
- C:\Windows\System\qLgQYYs.exe
  C:\Windows\System\qLgQYYs.exe
  2⤵
  PID:6508
- C:\Windows\System\YeXOLyp.exe
  C:\Windows\System\YeXOLyp.exe
  2⤵
  PID:6524
- C:\Windows\System\cwYzOCr.exe
  C:\Windows\System\cwYzOCr.exe
  2⤵
  PID:6544
- C:\Windows\System\uLQWxBE.exe
  C:\Windows\System\uLQWxBE.exe
  2⤵
  PID:6560
- C:\Windows\System\SNyrYkj.exe
  C:\Windows\System\SNyrYkj.exe
  2⤵
  PID:6576
- C:\Windows\System\HkeDZzO.exe
  C:\Windows\System\HkeDZzO.exe
  2⤵
  PID:6596
- C:\Windows\System\TLMpQOL.exe
  C:\Windows\System\TLMpQOL.exe
  2⤵
  PID:6612
- C:\Windows\System\csEEpPd.exe
  C:\Windows\System\csEEpPd.exe
  2⤵
  PID:6628
- C:\Windows\System\HROflWh.exe
  C:\Windows\System\HROflWh.exe
  2⤵
  PID:6644
- C:\Windows\System\qSBlkEu.exe
  C:\Windows\System\qSBlkEu.exe
  2⤵
  PID:6660
- C:\Windows\System\FAeLzUp.exe
  C:\Windows\System\FAeLzUp.exe
  2⤵
  PID:6676
- C:\Windows\System\gaAFMbZ.exe
  C:\Windows\System\gaAFMbZ.exe
  2⤵
  PID:6696
- C:\Windows\System\FfwVzjU.exe
  C:\Windows\System\FfwVzjU.exe
  2⤵
  PID:6712
- C:\Windows\System\kwFSJKx.exe
  C:\Windows\System\kwFSJKx.exe
  2⤵
  PID:6728
- C:\Windows\System\wFBrXHo.exe
  C:\Windows\System\wFBrXHo.exe
  2⤵
  PID:6744
- C:\Windows\System\KQcDOqK.exe
  C:\Windows\System\KQcDOqK.exe
  2⤵
  PID:6760
- C:\Windows\System\lNzavkt.exe
  C:\Windows\System\lNzavkt.exe
  2⤵
  PID:6776
- C:\Windows\System\wiKOAbH.exe
  C:\Windows\System\wiKOAbH.exe
  2⤵
  PID:6792
- C:\Windows\System\CYgdIZG.exe
  C:\Windows\System\CYgdIZG.exe
  2⤵
  PID:6808
- C:\Windows\System\yxnTaEh.exe
  C:\Windows\System\yxnTaEh.exe
  2⤵
  PID:6828
- C:\Windows\System\XUGpOhw.exe
  C:\Windows\System\XUGpOhw.exe
  2⤵
  PID:6848
- C:\Windows\System\RdGJnKA.exe
  C:\Windows\System\RdGJnKA.exe
  2⤵
  PID:6904
- C:\Windows\System\AfebMWp.exe
  C:\Windows\System\AfebMWp.exe
  2⤵
  PID:6920
- C:\Windows\System\nUjYIyl.exe
  C:\Windows\System\nUjYIyl.exe
  2⤵
  PID:6936
- C:\Windows\System\vCUEZzz.exe
  C:\Windows\System\vCUEZzz.exe
  2⤵
  PID:6952
- C:\Windows\System\qbgrPXB.exe
  C:\Windows\System\qbgrPXB.exe
  2⤵
  PID:6968
- C:\Windows\System\eTEIazn.exe
  C:\Windows\System\eTEIazn.exe
  2⤵
  PID:6984
- C:\Windows\System\WmmhgfY.exe
  C:\Windows\System\WmmhgfY.exe
  2⤵
  PID:7000
- C:\Windows\System\IhAsrGt.exe
  C:\Windows\System\IhAsrGt.exe
  2⤵
  PID:7020
- C:\Windows\System\NbgJOvh.exe
  C:\Windows\System\NbgJOvh.exe
  2⤵
  PID:7036
- C:\Windows\System\vnUPTXR.exe
  C:\Windows\System\vnUPTXR.exe
  2⤵
  PID:7052
- C:\Windows\System\dIvjjHl.exe
  C:\Windows\System\dIvjjHl.exe
  2⤵
  PID:7068
- C:\Windows\System\TjKlKdY.exe
  C:\Windows\System\TjKlKdY.exe
  2⤵
  PID:7084
- C:\Windows\System\HXrbMPC.exe
  C:\Windows\System\HXrbMPC.exe
  2⤵
  PID:7100
- C:\Windows\System\bzbYpNk.exe
  C:\Windows\System\bzbYpNk.exe
  2⤵
  PID:7116
- C:\Windows\System\hRLxqyB.exe
  C:\Windows\System\hRLxqyB.exe
  2⤵
  PID:7132
- C:\Windows\System\vBwHyUk.exe
  C:\Windows\System\vBwHyUk.exe
  2⤵
  PID:7148
- C:\Windows\System\dJnYQCL.exe
  C:\Windows\System\dJnYQCL.exe
  2⤵
  PID:7164
- C:\Windows\System\JRworWf.exe
  C:\Windows\System\JRworWf.exe
  2⤵
  PID:4616
- C:\Windows\System\zAEFhVt.exe
  C:\Windows\System\zAEFhVt.exe
  2⤵
  PID:5220
- C:\Windows\System\yYswNuV.exe
  C:\Windows\System\yYswNuV.exe
  2⤵
  PID:5504
- C:\Windows\System\GpFgBpR.exe
  C:\Windows\System\GpFgBpR.exe
  2⤵
  PID:5600
- C:\Windows\System\VQwxyQY.exe
  C:\Windows\System\VQwxyQY.exe
  2⤵
  PID:5832
- C:\Windows\System\giQwkxB.exe
  C:\Windows\System\giQwkxB.exe
  2⤵
  PID:5828
- C:\Windows\System\XCYyutq.exe
  C:\Windows\System\XCYyutq.exe
  2⤵
  PID:5208
- C:\Windows\System\ekxdacZ.exe
  C:\Windows\System\ekxdacZ.exe
  2⤵
  PID:5664
- C:\Windows\System\MRXQtuQ.exe
  C:\Windows\System\MRXQtuQ.exe
  2⤵
  PID:6240
- C:\Windows\System\mveoEqV.exe
  C:\Windows\System\mveoEqV.exe
  2⤵
  PID:1860
- C:\Windows\System\xtEWNEH.exe
  C:\Windows\System\xtEWNEH.exe
  2⤵
  PID:5452
- C:\Windows\System\mIHWlnx.exe
  C:\Windows\System\mIHWlnx.exe
  2⤵
  PID:5816
- C:\Windows\System\uONvdXe.exe
  C:\Windows\System\uONvdXe.exe
  2⤵
  PID:5896
- C:\Windows\System\RJKKwOM.exe
  C:\Windows\System\RJKKwOM.exe
  2⤵
  PID:6368
- C:\Windows\System\qtEIgbC.exe
  C:\Windows\System\qtEIgbC.exe
  2⤵
  PID:6160
- C:\Windows\System\WCfiWoI.exe
  C:\Windows\System\WCfiWoI.exe
  2⤵
  PID:6404
- C:\Windows\System\dHsqQgW.exe
  C:\Windows\System\dHsqQgW.exe
  2⤵
  PID:6228
- C:\Windows\System\sWbqTkv.exe
  C:\Windows\System\sWbqTkv.exe
  2⤵
  PID:6292
- C:\Windows\System\aqtctjJ.exe
  C:\Windows\System\aqtctjJ.exe
  2⤵
  PID:6468
- C:\Windows\System\HQQabQj.exe
  C:\Windows\System\HQQabQj.exe
  2⤵
  PID:6568
- C:\Windows\System\JKNkdKQ.exe
  C:\Windows\System\JKNkdKQ.exe
  2⤵
  PID:6608
- C:\Windows\System\LjqxXLA.exe
  C:\Windows\System\LjqxXLA.exe
  2⤵
  PID:6416
- C:\Windows\System\JQObXNz.exe
  C:\Windows\System\JQObXNz.exe
  2⤵
  PID:6356
- C:\Windows\System\DiVWZUJ.exe
  C:\Windows\System\DiVWZUJ.exe
  2⤵
  PID:6736
- C:\Windows\System\PbkqGLW.exe
  C:\Windows\System\PbkqGLW.exe
  2⤵
  PID:6772
- C:\Windows\System\nzndUEu.exe
  C:\Windows\System\nzndUEu.exe
  2⤵
  PID:6720
- C:\Windows\System\lhWLTUg.exe
  C:\Windows\System\lhWLTUg.exe
  2⤵
  PID:6480
- C:\Windows\System\KESYiuG.exe
  C:\Windows\System\KESYiuG.exe
  2⤵
  PID:6588
- C:\Windows\System\oIZBhSi.exe
  C:\Windows\System\oIZBhSi.exe
  2⤵
  PID:6624
- C:\Windows\System\yyFZsFC.exe
  C:\Windows\System\yyFZsFC.exe
  2⤵
  PID:6688
- C:\Windows\System\stxAKTA.exe
  C:\Windows\System\stxAKTA.exe
  2⤵
  PID:6788
- C:\Windows\System\LDRuxuY.exe
  C:\Windows\System\LDRuxuY.exe
  2⤵
  PID:6856
- C:\Windows\System\bscrxnm.exe
  C:\Windows\System\bscrxnm.exe
  2⤵
  PID:6916
- C:\Windows\System\MUHabRl.exe
  C:\Windows\System\MUHabRl.exe
  2⤵
  PID:6976
- C:\Windows\System\uzfArCM.exe
  C:\Windows\System\uzfArCM.exe
  2⤵
  PID:7012
- C:\Windows\System\aqGdBig.exe
  C:\Windows\System\aqGdBig.exe
  2⤵
  PID:6880
- C:\Windows\System\hbZAqPE.exe
  C:\Windows\System\hbZAqPE.exe
  2⤵
  PID:6892
- C:\Windows\System\UqliMdx.exe
  C:\Windows\System\UqliMdx.exe
  2⤵
  PID:6960
- C:\Windows\System\SFLXVkF.exe
  C:\Windows\System\SFLXVkF.exe
  2⤵
  PID:6992
- C:\Windows\System\uKzhckV.exe
  C:\Windows\System\uKzhckV.exe
  2⤵
  PID:7076
- C:\Windows\System\tzqCqxI.exe
  C:\Windows\System\tzqCqxI.exe
  2⤵
  PID:7096
- C:\Windows\System\whdDzqX.exe
  C:\Windows\System\whdDzqX.exe
  2⤵
  PID:5284
- C:\Windows\System\kXdgdgc.exe
  C:\Windows\System\kXdgdgc.exe
  2⤵
  PID:6040
- C:\Windows\System\mmRieWf.exe
  C:\Windows\System\mmRieWf.exe
  2⤵
  PID:7108
- C:\Windows\System\qwRUtNS.exe
  C:\Windows\System\qwRUtNS.exe
  2⤵
  PID:4992
- C:\Windows\System\LlVNEQK.exe
  C:\Windows\System\LlVNEQK.exe
  2⤵
  PID:6172
- C:\Windows\System\LBHdRxH.exe
  C:\Windows\System\LBHdRxH.exe
  2⤵
  PID:6176
- C:\Windows\System\COzRfam.exe
  C:\Windows\System\COzRfam.exe
  2⤵
  PID:6208
- C:\Windows\System\EyjrQOI.exe
  C:\Windows\System\EyjrQOI.exe
  2⤵
  PID:6088
- C:\Windows\System\FDMBxkQ.exe
  C:\Windows\System\FDMBxkQ.exe
  2⤵
  PID:6504
- C:\Windows\System\mfpeRKz.exe
  C:\Windows\System\mfpeRKz.exe
  2⤵
  PID:6224
- C:\Windows\System\DmbZsJj.exe
  C:\Windows\System\DmbZsJj.exe
  2⤵
  PID:6604
- C:\Windows\System\ByzUsrJ.exe
  C:\Windows\System\ByzUsrJ.exe
  2⤵
  PID:6768
- C:\Windows\System\jWeWnFz.exe
  C:\Windows\System\jWeWnFz.exe
  2⤵
  PID:6620
- C:\Windows\System\jqsQSzZ.exe
  C:\Windows\System\jqsQSzZ.exe
  2⤵
  PID:6864
- C:\Windows\System\FoqavAY.exe
  C:\Windows\System\FoqavAY.exe
  2⤵
  PID:6276
- C:\Windows\System\CMncSYA.exe
  C:\Windows\System\CMncSYA.exe
  2⤵
  PID:6352
- C:\Windows\System\okMsvat.exe
  C:\Windows\System\okMsvat.exe
  2⤵
  PID:6656
- C:\Windows\System\cHrQMQE.exe
  C:\Windows\System\cHrQMQE.exe
  2⤵
  PID:6340
- C:\Windows\System\gHJKCSE.exe
  C:\Windows\System\gHJKCSE.exe
  2⤵
  PID:6400
- C:\Windows\System\fYBfpyA.exe
  C:\Windows\System\fYBfpyA.exe
  2⤵
  PID:6540
- C:\Windows\System\ZQOpCqE.exe
  C:\Windows\System\ZQOpCqE.exe
  2⤵
  PID:6520
- C:\Windows\System\EkuVAAL.exe
  C:\Windows\System\EkuVAAL.exe
  2⤵
  PID:6868
- C:\Windows\System\uaQUzXM.exe
  C:\Windows\System\uaQUzXM.exe
  2⤵
  PID:7032
- C:\Windows\System\oJrLQxn.exe
  C:\Windows\System\oJrLQxn.exe
  2⤵
  PID:5360
- C:\Windows\System\UIYrJJv.exe
  C:\Windows\System\UIYrJJv.exe
  2⤵
  PID:5408
- C:\Windows\System\quSjwbV.exe
  C:\Windows\System\quSjwbV.exe
  2⤵
  PID:6244
- C:\Windows\System\yGsjNFy.exe
  C:\Windows\System\yGsjNFy.exe
  2⤵
  PID:5764
- C:\Windows\System\DJZCQVS.exe
  C:\Windows\System\DJZCQVS.exe
  2⤵
  PID:7140
- C:\Windows\System\eMjRcKl.exe
  C:\Windows\System\eMjRcKl.exe
  2⤵
  PID:5500
- C:\Windows\System\BkNTWUx.exe
  C:\Windows\System\BkNTWUx.exe
  2⤵
  PID:6152
- C:\Windows\System\kWEWWqD.exe
  C:\Windows\System\kWEWWqD.exe
  2⤵
  PID:6592
- C:\Windows\System\HsZqeGK.exe
  C:\Windows\System\HsZqeGK.exe
  2⤵
  PID:6784
- C:\Windows\System\PLGxxui.exe
  C:\Windows\System\PLGxxui.exe
  2⤵
  PID:6256
- C:\Windows\System\GICYeTW.exe
  C:\Windows\System\GICYeTW.exe
  2⤵
  PID:6156
- C:\Windows\System\rzqzWlu.exe
  C:\Windows\System\rzqzWlu.exe
  2⤵
  PID:6288
- C:\Windows\System\FCuNHUI.exe
  C:\Windows\System\FCuNHUI.exe
  2⤵
  PID:4596
- C:\Windows\System\mwNDrsn.exe
  C:\Windows\System\mwNDrsn.exe
  2⤵
  PID:7060
- C:\Windows\System\acNxbDh.exe
  C:\Windows\System\acNxbDh.exe
  2⤵
  PID:5136
- C:\Windows\System\yxCqSoC.exe
  C:\Windows\System\yxCqSoC.exe
  2⤵
  PID:6724
- C:\Windows\System\JBwLUfp.exe
  C:\Windows\System\JBwLUfp.exe
  2⤵
  PID:6816
- C:\Windows\System\OipiLfx.exe
  C:\Windows\System\OipiLfx.exe
  2⤵
  PID:6672
- C:\Windows\System\NDuBpwH.exe
  C:\Windows\System\NDuBpwH.exe
  2⤵
  PID:7048
- C:\Windows\System\tUNsvoN.exe
  C:\Windows\System\tUNsvoN.exe
  2⤵
  PID:6948
- C:\Windows\System\HzzNbZR.exe
  C:\Windows\System\HzzNbZR.exe
  2⤵
  PID:6384
- C:\Windows\System\SFliZXn.exe
  C:\Windows\System\SFliZXn.exe
  2⤵
  PID:6556
- C:\Windows\System\BqsSUMT.exe
  C:\Windows\System\BqsSUMT.exe
  2⤵
  PID:6944
- C:\Windows\System\ozflvtV.exe
  C:\Windows\System\ozflvtV.exe
  2⤵
  PID:7028
- C:\Windows\System\faMXzSI.exe
  C:\Windows\System\faMXzSI.exe
  2⤵
  PID:6928
- C:\Windows\System\wyNckCn.exe
  C:\Windows\System\wyNckCn.exe
  2⤵
  PID:7172
- C:\Windows\System\oOOiJlM.exe
  C:\Windows\System\oOOiJlM.exe
  2⤵
  PID:7188
- C:\Windows\System\JMYtsVQ.exe
  C:\Windows\System\JMYtsVQ.exe
  2⤵
  PID:7204
- C:\Windows\System\cRfjaRf.exe
  C:\Windows\System\cRfjaRf.exe
  2⤵
  PID:7224
- C:\Windows\System\asYLEev.exe
  C:\Windows\System\asYLEev.exe
  2⤵
  PID:7240
- C:\Windows\System\sXznBqj.exe
  C:\Windows\System\sXznBqj.exe
  2⤵
  PID:7256
- C:\Windows\System\vGglIGQ.exe
  C:\Windows\System\vGglIGQ.exe
  2⤵
  PID:7272
- C:\Windows\System\FzDkNeK.exe
  C:\Windows\System\FzDkNeK.exe
  2⤵
  PID:7288
- C:\Windows\System\aplXUSC.exe
  C:\Windows\System\aplXUSC.exe
  2⤵
  PID:7304
- C:\Windows\System\aJSZjYG.exe
  C:\Windows\System\aJSZjYG.exe
  2⤵
  PID:7320
- C:\Windows\System\EwavLzw.exe
  C:\Windows\System\EwavLzw.exe
  2⤵
  PID:7336
- C:\Windows\System\wKVWcLO.exe
  C:\Windows\System\wKVWcLO.exe
  2⤵
  PID:7352
- C:\Windows\System\xOioHQI.exe
  C:\Windows\System\xOioHQI.exe
  2⤵
  PID:7368
- C:\Windows\System\uYRXIxb.exe
  C:\Windows\System\uYRXIxb.exe
  2⤵
  PID:7384
- C:\Windows\System\knnwhLh.exe
  C:\Windows\System\knnwhLh.exe
  2⤵
  PID:7400
- C:\Windows\System\IjyvBSs.exe
  C:\Windows\System\IjyvBSs.exe
  2⤵
  PID:7416
- C:\Windows\System\MMVmEmp.exe
  C:\Windows\System\MMVmEmp.exe
  2⤵
  PID:7432
- C:\Windows\System\zINmdtu.exe
  C:\Windows\System\zINmdtu.exe
  2⤵
  PID:7448
- C:\Windows\System\CUIEfcY.exe
  C:\Windows\System\CUIEfcY.exe
  2⤵
  PID:7464
- C:\Windows\System\xzHtXDx.exe
  C:\Windows\System\xzHtXDx.exe
  2⤵
  PID:7480
- C:\Windows\System\tINMsTX.exe
  C:\Windows\System\tINMsTX.exe
  2⤵
  PID:7496
- C:\Windows\System\mPowxxo.exe
  C:\Windows\System\mPowxxo.exe
  2⤵
  PID:7512
- C:\Windows\System\UfZqaxz.exe
  C:\Windows\System\UfZqaxz.exe
  2⤵
  PID:7528
- C:\Windows\System\vQjmPsz.exe
  C:\Windows\System\vQjmPsz.exe
  2⤵
  PID:7544
- C:\Windows\System\QnXxzhC.exe
  C:\Windows\System\QnXxzhC.exe
  2⤵
  PID:7560
- C:\Windows\System\lcLiqDb.exe
  C:\Windows\System\lcLiqDb.exe
  2⤵
  PID:7576
- C:\Windows\System\CXdqqHD.exe
  C:\Windows\System\CXdqqHD.exe
  2⤵
  PID:7592
- C:\Windows\System\pJvhcUx.exe
  C:\Windows\System\pJvhcUx.exe
  2⤵
  PID:7608
- C:\Windows\System\UqIzchU.exe
  C:\Windows\System\UqIzchU.exe
  2⤵
  PID:7624
- C:\Windows\System\QJoPRMo.exe
  C:\Windows\System\QJoPRMo.exe
  2⤵
  PID:7640
- C:\Windows\System\ClFkGih.exe
  C:\Windows\System\ClFkGih.exe
  2⤵
  PID:7656
- C:\Windows\System\iQshdxZ.exe
  C:\Windows\System\iQshdxZ.exe
  2⤵
  PID:7672
- C:\Windows\System\spNpfYz.exe
  C:\Windows\System\spNpfYz.exe
  2⤵
  PID:7692
- C:\Windows\System\ZehUNIj.exe
  C:\Windows\System\ZehUNIj.exe
  2⤵
  PID:7708
- C:\Windows\System\iSnQsuT.exe
  C:\Windows\System\iSnQsuT.exe
  2⤵
  PID:7724
- C:\Windows\System\UQIoLJa.exe
  C:\Windows\System\UQIoLJa.exe
  2⤵
  PID:7740
- C:\Windows\System\VpFqfwD.exe
  C:\Windows\System\VpFqfwD.exe
  2⤵
  PID:7756
- C:\Windows\System\HcoxnOa.exe
  C:\Windows\System\HcoxnOa.exe
  2⤵
  PID:7772
- C:\Windows\System\wTqfIOg.exe
  C:\Windows\System\wTqfIOg.exe
  2⤵
  PID:7788
- C:\Windows\System\NTemdhr.exe
  C:\Windows\System\NTemdhr.exe
  2⤵
  PID:7804
- C:\Windows\System\qSgPxIe.exe
  C:\Windows\System\qSgPxIe.exe
  2⤵
  PID:7820
- C:\Windows\System\KHeuphV.exe
  C:\Windows\System\KHeuphV.exe
  2⤵
  PID:7836
- C:\Windows\System\JIhkotE.exe
  C:\Windows\System\JIhkotE.exe
  2⤵
  PID:7852
- C:\Windows\System\tGLNpNr.exe
  C:\Windows\System\tGLNpNr.exe
  2⤵
  PID:7868
- C:\Windows\System\ZVHANoP.exe
  C:\Windows\System\ZVHANoP.exe
  2⤵
  PID:7884
- C:\Windows\System\dtgPLeJ.exe
  C:\Windows\System\dtgPLeJ.exe
  2⤵
  PID:7900
- C:\Windows\System\hLcIYCw.exe
  C:\Windows\System\hLcIYCw.exe
  2⤵
  PID:7916
- C:\Windows\System\DcLzDkC.exe
  C:\Windows\System\DcLzDkC.exe
  2⤵
  PID:7932
- C:\Windows\System\SASpWFl.exe
  C:\Windows\System\SASpWFl.exe
  2⤵
  PID:7948
- C:\Windows\System\zbsLlro.exe
  C:\Windows\System\zbsLlro.exe
  2⤵
  PID:7964
- C:\Windows\System\fQgXArA.exe
  C:\Windows\System\fQgXArA.exe
  2⤵
  PID:7980
- C:\Windows\System\ltQbSqA.exe
  C:\Windows\System\ltQbSqA.exe
  2⤵
  PID:7996
- C:\Windows\System\zrugsvh.exe
  C:\Windows\System\zrugsvh.exe
  2⤵
  PID:8012
- C:\Windows\System\Hpipinq.exe
  C:\Windows\System\Hpipinq.exe
  2⤵
  PID:8028
- C:\Windows\System\CPjvspe.exe
  C:\Windows\System\CPjvspe.exe
  2⤵
  PID:8044
- C:\Windows\System\nBjPDtR.exe
  C:\Windows\System\nBjPDtR.exe
  2⤵
  PID:8060
- C:\Windows\System\rzWJHyB.exe
  C:\Windows\System\rzWJHyB.exe
  2⤵
  PID:8076
- C:\Windows\System\cnFjIqx.exe
  C:\Windows\System\cnFjIqx.exe
  2⤵
  PID:8092
- C:\Windows\System\xGYQSfP.exe
  C:\Windows\System\xGYQSfP.exe
  2⤵
  PID:8108
- C:\Windows\System\YXVaOEh.exe
  C:\Windows\System\YXVaOEh.exe
  2⤵
  PID:8124
- C:\Windows\System\VWyrRuc.exe
  C:\Windows\System\VWyrRuc.exe
  2⤵
  PID:8140
- C:\Windows\System\TWNZdmj.exe
  C:\Windows\System\TWNZdmj.exe
  2⤵
  PID:8156
- C:\Windows\System\sfzubkw.exe
  C:\Windows\System\sfzubkw.exe
  2⤵
  PID:8172
- C:\Windows\System\FuvCUZU.exe
  C:\Windows\System\FuvCUZU.exe
  2⤵
  PID:8188
- C:\Windows\System\IaBSMER.exe
  C:\Windows\System\IaBSMER.exe
  2⤵
  PID:7212
- C:\Windows\System\ubiSEwe.exe
  C:\Windows\System\ubiSEwe.exe
  2⤵
  PID:7248
- C:\Windows\System\jNxkGgI.exe
  C:\Windows\System\jNxkGgI.exe
  2⤵
  PID:7232
- C:\Windows\System\ZZzmlYX.exe
  C:\Windows\System\ZZzmlYX.exe
  2⤵
  PID:7236
- C:\Windows\System\KpUPbdH.exe
  C:\Windows\System\KpUPbdH.exe
  2⤵
  PID:7348
- C:\Windows\System\CHNpXEX.exe
  C:\Windows\System\CHNpXEX.exe
  2⤵
  PID:7300
- C:\Windows\System\fNFJcTk.exe
  C:\Windows\System\fNFJcTk.exe
  2⤵
  PID:7360
- C:\Windows\System\lEZAyan.exe
  C:\Windows\System\lEZAyan.exe
  2⤵
  PID:7412
- C:\Windows\System\avVDabg.exe
  C:\Windows\System\avVDabg.exe
  2⤵
  PID:7424
- C:\Windows\System\KSGnlfD.exe
  C:\Windows\System\KSGnlfD.exe
  2⤵
  PID:7476
- C:\Windows\System\fbBUBxs.exe
  C:\Windows\System\fbBUBxs.exe
  2⤵
  PID:7444
- C:\Windows\System\AgaBwdH.exe
  C:\Windows\System\AgaBwdH.exe
  2⤵
  PID:7568
- C:\Windows\System\eRhDnpW.exe
  C:\Windows\System\eRhDnpW.exe
  2⤵
  PID:7552
- C:\Windows\System\vdWWchB.exe
  C:\Windows\System\vdWWchB.exe
  2⤵
  PID:7632
- C:\Windows\System\hVnpMjA.exe
  C:\Windows\System\hVnpMjA.exe
  2⤵
  PID:7620
- C:\Windows\System\qIhMgau.exe
  C:\Windows\System\qIhMgau.exe
  2⤵
  PID:7664
- C:\Windows\System\egIPhZB.exe
  C:\Windows\System\egIPhZB.exe
  2⤵
  PID:7704
- C:\Windows\System\SNehjJc.exe
  C:\Windows\System\SNehjJc.exe
  2⤵
  PID:7716
- C:\Windows\System\tLyxxuv.exe
  C:\Windows\System\tLyxxuv.exe
  2⤵
  PID:7768
- C:\Windows\System\IyeJMuD.exe
  C:\Windows\System\IyeJMuD.exe
  2⤵
  PID:7800
- C:\Windows\System\KWavCLH.exe
  C:\Windows\System\KWavCLH.exe
  2⤵
  PID:7860
- C:\Windows\System\WbwZUsB.exe
  C:\Windows\System\WbwZUsB.exe
  2⤵
  PID:7896
- C:\Windows\System\GjsDTJo.exe
  C:\Windows\System\GjsDTJo.exe
  2⤵
  PID:7880
- C:\Windows\System\UPRfDTo.exe
  C:\Windows\System\UPRfDTo.exe
  2⤵
  PID:7956
- C:\Windows\System\SliXpms.exe
  C:\Windows\System\SliXpms.exe
  2⤵
  PID:8020
- C:\Windows\System\UEWaWSC.exe
  C:\Windows\System\UEWaWSC.exe
  2⤵
  PID:8052
- C:\Windows\System\bVyqYYI.exe
  C:\Windows\System\bVyqYYI.exe
  2⤵
  PID:7976
- C:\Windows\System\dzJjfyl.exe
  C:\Windows\System\dzJjfyl.exe
  2⤵
  PID:8040
- C:\Windows\System\dNTBval.exe
  C:\Windows\System\dNTBval.exe
  2⤵
  PID:8072
- C:\Windows\System\HhHIQwb.exe
  C:\Windows\System\HhHIQwb.exe
  2⤵
  PID:8100
- C:\Windows\System\blBizyG.exe
  C:\Windows\System\blBizyG.exe
  2⤵
  PID:8164
- C:\Windows\System\lgxTkhj.exe
  C:\Windows\System\lgxTkhj.exe
  2⤵
  PID:6192
- C:\Windows\System\HwFXjOl.exe
  C:\Windows\System\HwFXjOl.exe
  2⤵
  PID:8180
- C:\Windows\System\RxYoXel.exe
  C:\Windows\System\RxYoXel.exe
  2⤵
  PID:7252
- C:\Windows\System\LqXRHdj.exe
  C:\Windows\System\LqXRHdj.exe
  2⤵
  PID:7316
- C:\Windows\System\cMMdMOc.exe
  C:\Windows\System\cMMdMOc.exe
  2⤵
  PID:7408
- C:\Windows\System\RnpgDYw.exe
  C:\Windows\System\RnpgDYw.exe
  2⤵
  PID:7540
- C:\Windows\System\AGZERxD.exe
  C:\Windows\System\AGZERxD.exe
  2⤵
  PID:7652
- C:\Windows\System\yLiwraY.exe
  C:\Windows\System\yLiwraY.exe
  2⤵
  PID:7396
- C:\Windows\System\pmLbZYJ.exe
  C:\Windows\System\pmLbZYJ.exe
  2⤵
  PID:7472
- C:\Windows\System\LNGCtmb.exe
  C:\Windows\System\LNGCtmb.exe
  2⤵
  PID:7688
- C:\Windows\System\LkqXMOE.exe
  C:\Windows\System\LkqXMOE.exe
  2⤵
  PID:7700
- C:\Windows\System\OAaBEIc.exe
  C:\Windows\System\OAaBEIc.exe
  2⤵
  PID:7764
- C:\Windows\System\rGbPwqY.exe
  C:\Windows\System\rGbPwqY.exe
  2⤵
  PID:7816
- C:\Windows\System\pCAfFbd.exe
  C:\Windows\System\pCAfFbd.exe
  2⤵
  PID:8024
- C:\Windows\System\MWOdpUr.exe
  C:\Windows\System\MWOdpUr.exe
  2⤵
  PID:7972
- C:\Windows\System\PIFHJjw.exe
  C:\Windows\System\PIFHJjw.exe
  2⤵
  PID:8116
- C:\Windows\System\pfnGEfu.exe
  C:\Windows\System\pfnGEfu.exe
  2⤵
  PID:8184
- C:\Windows\System\XoEbUEN.exe
  C:\Windows\System\XoEbUEN.exe
  2⤵
  PID:7200
- C:\Windows\System\wuvuOSJ.exe
  C:\Windows\System\wuvuOSJ.exe
  2⤵
  PID:7328
- C:\Windows\System\MeZNlVP.exe
  C:\Windows\System\MeZNlVP.exe
  2⤵
  PID:7584
- C:\Windows\System\wMrbsWQ.exe
  C:\Windows\System\wMrbsWQ.exe
  2⤵
  PID:7636
- C:\Windows\System\BhTSjQD.exe
  C:\Windows\System\BhTSjQD.exe
  2⤵
  PID:7796
- C:\Windows\System\vQdkaOY.exe
  C:\Windows\System\vQdkaOY.exe
  2⤵
  PID:7940
- C:\Windows\System\iaABUsK.exe
  C:\Windows\System\iaABUsK.exe
  2⤵
  PID:7784
- C:\Windows\System\Xfpmzwy.exe
  C:\Windows\System\Xfpmzwy.exe
  2⤵
  PID:7876
- C:\Windows\System\BifzLwS.exe
  C:\Windows\System\BifzLwS.exe
  2⤵
  PID:6872
- C:\Windows\System\nHpdghZ.exe
  C:\Windows\System\nHpdghZ.exe
  2⤵
  PID:8148
- C:\Windows\System\EJLDein.exe
  C:\Windows\System\EJLDein.exe
  2⤵
  PID:7556
- C:\Windows\System\OzdQXqo.exe
  C:\Windows\System\OzdQXqo.exe
  2⤵
  PID:7268
- C:\Windows\System\cDzxPeZ.exe
  C:\Windows\System\cDzxPeZ.exe
  2⤵
  PID:8200
- C:\Windows\System\vjlVKcB.exe
  C:\Windows\System\vjlVKcB.exe
  2⤵
  PID:8216
- C:\Windows\System\ZLXaRBO.exe
  C:\Windows\System\ZLXaRBO.exe
  2⤵
  PID:8232
- C:\Windows\System\QEeAlnE.exe
  C:\Windows\System\QEeAlnE.exe
  2⤵
  PID:8248
- C:\Windows\System\lHZqcuY.exe
  C:\Windows\System\lHZqcuY.exe
  2⤵
  PID:8264
- C:\Windows\System\BcwLCZs.exe
  C:\Windows\System\BcwLCZs.exe
  2⤵
  PID:8280
- C:\Windows\System\XwxSdrE.exe
  C:\Windows\System\XwxSdrE.exe
  2⤵
  PID:8296
- C:\Windows\System\pEchveK.exe
  C:\Windows\System\pEchveK.exe
  2⤵
  PID:8312
- C:\Windows\System\jClezBm.exe
  C:\Windows\System\jClezBm.exe
  2⤵
  PID:8328
- C:\Windows\System\OAdpFjo.exe
  C:\Windows\System\OAdpFjo.exe
  2⤵
  PID:8344
- C:\Windows\System\rjrGyLT.exe
  C:\Windows\System\rjrGyLT.exe
  2⤵
  PID:8360
- C:\Windows\System\EmOOnRt.exe
  C:\Windows\System\EmOOnRt.exe
  2⤵
  PID:8376
- C:\Windows\System\wXCVgHj.exe
  C:\Windows\System\wXCVgHj.exe
  2⤵
  PID:8392
- C:\Windows\System\DPXRFkU.exe
  C:\Windows\System\DPXRFkU.exe
  2⤵
  PID:8408
- C:\Windows\System\VPUfPea.exe
  C:\Windows\System\VPUfPea.exe
  2⤵
  PID:8424
- C:\Windows\System\kSsQtVz.exe
  C:\Windows\System\kSsQtVz.exe
  2⤵
  PID:8440
- C:\Windows\System\MUAWenY.exe
  C:\Windows\System\MUAWenY.exe
  2⤵
  PID:8456
- C:\Windows\System\foaTnpd.exe
  C:\Windows\System\foaTnpd.exe
  2⤵
  PID:8472
- C:\Windows\System\fSZOOJq.exe
  C:\Windows\System\fSZOOJq.exe
  2⤵
  PID:8488
- C:\Windows\System\tXbqDON.exe
  C:\Windows\System\tXbqDON.exe
  2⤵
  PID:8504
- C:\Windows\System\CauOGPp.exe
  C:\Windows\System\CauOGPp.exe
  2⤵
  PID:8520
- C:\Windows\System\dWcJbqk.exe
  C:\Windows\System\dWcJbqk.exe
  2⤵
  PID:8536
- C:\Windows\System\pVnpicL.exe
  C:\Windows\System\pVnpicL.exe
  2⤵
  PID:8552
- C:\Windows\System\wZmPfbE.exe
  C:\Windows\System\wZmPfbE.exe
  2⤵
  PID:8568
- C:\Windows\System\DgEzDVe.exe
  C:\Windows\System\DgEzDVe.exe
  2⤵
  PID:8584
- C:\Windows\System\dcsRvAj.exe
  C:\Windows\System\dcsRvAj.exe
  2⤵
  PID:8600
- C:\Windows\System\UHExayH.exe
  C:\Windows\System\UHExayH.exe
  2⤵
  PID:8616
- C:\Windows\System\bXvfzEl.exe
  C:\Windows\System\bXvfzEl.exe
  2⤵
  PID:8632
- C:\Windows\System\ZJQAHab.exe
  C:\Windows\System\ZJQAHab.exe
  2⤵
  PID:8648
- C:\Windows\System\PYWmHnV.exe
  C:\Windows\System\PYWmHnV.exe
  2⤵
  PID:8664
- C:\Windows\System\jxGgedy.exe
  C:\Windows\System\jxGgedy.exe
  2⤵
  PID:8680
- C:\Windows\System\tsXGHzI.exe
  C:\Windows\System\tsXGHzI.exe
  2⤵
  PID:8696
- C:\Windows\System\ikTDVdS.exe
  C:\Windows\System\ikTDVdS.exe
  2⤵
  PID:8712
- C:\Windows\System\ITYwnsT.exe
  C:\Windows\System\ITYwnsT.exe
  2⤵
  PID:8728
- C:\Windows\System\UhSuGIa.exe
  C:\Windows\System\UhSuGIa.exe
  2⤵
  PID:8744
- C:\Windows\System\KXlBrqq.exe
  C:\Windows\System\KXlBrqq.exe
  2⤵
  PID:8760
- C:\Windows\System\XkwJHYN.exe
  C:\Windows\System\XkwJHYN.exe
  2⤵
  PID:8776
- C:\Windows\System\aPMRoRn.exe
  C:\Windows\System\aPMRoRn.exe
  2⤵
  PID:8792
- C:\Windows\System\GjbsdfY.exe
  C:\Windows\System\GjbsdfY.exe
  2⤵
  PID:8808
- C:\Windows\System\tHGXeMp.exe
  C:\Windows\System\tHGXeMp.exe
  2⤵
  PID:8824
- C:\Windows\System\yIqqsNN.exe
  C:\Windows\System\yIqqsNN.exe
  2⤵
  PID:8840
- C:\Windows\System\TSNKcCY.exe
  C:\Windows\System\TSNKcCY.exe
  2⤵
  PID:8856
- C:\Windows\System\ZbSVJkC.exe
  C:\Windows\System\ZbSVJkC.exe
  2⤵
  PID:8876
- C:\Windows\System\ejAWyHU.exe
  C:\Windows\System\ejAWyHU.exe
  2⤵
  PID:8892
- C:\Windows\System\fOUjNJs.exe
  C:\Windows\System\fOUjNJs.exe
  2⤵
  PID:8908
- C:\Windows\System\DhIvRIu.exe
  C:\Windows\System\DhIvRIu.exe
  2⤵
  PID:8924
- C:\Windows\System\JZykEmQ.exe
  C:\Windows\System\JZykEmQ.exe
  2⤵
  PID:8940
- C:\Windows\System\NNEjZQI.exe
  C:\Windows\System\NNEjZQI.exe
  2⤵
  PID:8956
- C:\Windows\System\sviSnIi.exe
  C:\Windows\System\sviSnIi.exe
  2⤵
  PID:8972
- C:\Windows\System\ZWUquit.exe
  C:\Windows\System\ZWUquit.exe
  2⤵
  PID:8988
- C:\Windows\System\BhgybuI.exe
  C:\Windows\System\BhgybuI.exe
  2⤵
  PID:9004
- C:\Windows\System\SrXgVtH.exe
  C:\Windows\System\SrXgVtH.exe
  2⤵
  PID:9020
- C:\Windows\System\qFGoBvi.exe
  C:\Windows\System\qFGoBvi.exe
  2⤵
  PID:9036
- C:\Windows\System\pYIGmhN.exe
  C:\Windows\System\pYIGmhN.exe
  2⤵
  PID:9052
- C:\Windows\System\DKqaHfn.exe
  C:\Windows\System\DKqaHfn.exe
  2⤵
  PID:9068
- C:\Windows\System\QqIOIMH.exe
  C:\Windows\System\QqIOIMH.exe
  2⤵
  PID:9084
- C:\Windows\System\afiUsbr.exe
  C:\Windows\System\afiUsbr.exe
  2⤵
  PID:9100
- C:\Windows\System\cgsZtdr.exe
  C:\Windows\System\cgsZtdr.exe
  2⤵
  PID:9116
- C:\Windows\System\mUbneka.exe
  C:\Windows\System\mUbneka.exe
  2⤵
  PID:9132
- C:\Windows\System\NTDPHto.exe
  C:\Windows\System\NTDPHto.exe
  2⤵
  PID:9148
- C:\Windows\System\GuCLTrQ.exe
  C:\Windows\System\GuCLTrQ.exe
  2⤵
  PID:9164
- C:\Windows\System\euCAHKF.exe
  C:\Windows\System\euCAHKF.exe
  2⤵
  PID:9180
- C:\Windows\System\cScdmlT.exe
  C:\Windows\System\cScdmlT.exe
  2⤵
  PID:9196
- C:\Windows\System\sXGnnRT.exe
  C:\Windows\System\sXGnnRT.exe
  2⤵
  PID:9212
- C:\Windows\System\csagITc.exe
  C:\Windows\System\csagITc.exe
  2⤵
  PID:7944
- C:\Windows\System\pJoJHGY.exe
  C:\Windows\System\pJoJHGY.exe
  2⤵
  PID:7456
- C:\Windows\System\SjJoRPU.exe
  C:\Windows\System\SjJoRPU.exe
  2⤵
  PID:8244
- C:\Windows\System\TXnpuBe.exe
  C:\Windows\System\TXnpuBe.exe
  2⤵
  PID:8308
- C:\Windows\System\BXPAVbo.exe
  C:\Windows\System\BXPAVbo.exe
  2⤵
  PID:8228
- C:\Windows\System\YYOkOXx.exe
  C:\Windows\System\YYOkOXx.exe
  2⤵
  PID:8372
- C:\Windows\System\lEgzQtu.exe
  C:\Windows\System\lEgzQtu.exe
  2⤵
  PID:8356
- C:\Windows\System\SUulyRl.exe
  C:\Windows\System\SUulyRl.exe
  2⤵
  PID:8464
- C:\Windows\System\DDjfqDo.exe
  C:\Windows\System\DDjfqDo.exe
  2⤵
  PID:8292
- C:\Windows\System\wyMwMUH.exe
  C:\Windows\System\wyMwMUH.exe
  2⤵
  PID:8320
- C:\Windows\System\zVWvXnt.exe
  C:\Windows\System\zVWvXnt.exe
  2⤵
  PID:8560
- C:\Windows\System\UemHMvR.exe
  C:\Windows\System\UemHMvR.exe
  2⤵
  PID:8384
- C:\Windows\System\UFFieLv.exe
  C:\Windows\System\UFFieLv.exe
  2⤵
  PID:8388
- C:\Windows\System\HLpkzfj.exe
  C:\Windows\System\HLpkzfj.exe
  2⤵
  PID:8548
- C:\Windows\System\VmNpZuh.exe
  C:\Windows\System\VmNpZuh.exe
  2⤵
  PID:8628
- C:\Windows\System\objANrK.exe
  C:\Windows\System\objANrK.exe
  2⤵
  PID:8688
- C:\Windows\System\FvRuLnA.exe
  C:\Windows\System\FvRuLnA.exe
  2⤵
  PID:8752
- C:\Windows\System\JsNLqET.exe
  C:\Windows\System\JsNLqET.exe
  2⤵
  PID:8816
- C:\Windows\System\hGIjpVX.exe
  C:\Windows\System\hGIjpVX.exe
  2⤵
  PID:8676
- C:\Windows\System\XcMQqad.exe
  C:\Windows\System\XcMQqad.exe
  2⤵
  PID:8612
- C:\Windows\System\sWoZMaH.exe
  C:\Windows\System\sWoZMaH.exe
  2⤵
  PID:8708
- C:\Windows\System\MOvOVkM.exe
  C:\Windows\System\MOvOVkM.exe
  2⤵
  PID:8772
- C:\Windows\System\MzTvYNE.exe
  C:\Windows\System\MzTvYNE.exe
  2⤵
  PID:8852
- C:\Windows\System\AjDNohw.exe
  C:\Windows\System\AjDNohw.exe
  2⤵
  PID:8888
- C:\Windows\System\dukwJxA.exe
  C:\Windows\System\dukwJxA.exe
  2⤵
  PID:8872
- C:\Windows\System\mHOcbuH.exe
  C:\Windows\System\mHOcbuH.exe
  2⤵
  PID:8952
- C:\Windows\System\rDGjbqq.exe
  C:\Windows\System\rDGjbqq.exe
  2⤵
  PID:9016
- C:\Windows\System\AJMqTSM.exe
  C:\Windows\System\AJMqTSM.exe
  2⤵
  PID:8936
- C:\Windows\System\PKJjhms.exe
  C:\Windows\System\PKJjhms.exe
  2⤵
  PID:9028
- C:\Windows\System\zbrTPxS.exe
  C:\Windows\System\zbrTPxS.exe
  2⤵
  PID:9080
- C:\Windows\System\EnxJsBK.exe
  C:\Windows\System\EnxJsBK.exe
  2⤵
  PID:9064
- C:\Windows\System\BiGVqcG.exe
  C:\Windows\System\BiGVqcG.exe
  2⤵
  PID:9144
- C:\Windows\System\gScaAFR.exe
  C:\Windows\System\gScaAFR.exe
  2⤵
  PID:9156
- C:\Windows\System\zKtfCrA.exe
  C:\Windows\System\zKtfCrA.exe
  2⤵
  PID:9176
- C:\Windows\System\hgQtXvU.exe
  C:\Windows\System\hgQtXvU.exe
  2⤵
  PID:7380
- C:\Windows\System\xzQNGtW.exe
  C:\Windows\System\xzQNGtW.exe
  2⤵
  PID:8212
- C:\Windows\System\KeqhsFK.exe
  C:\Windows\System\KeqhsFK.exe
  2⤵
  PID:1492
- C:\Windows\System\cCaHPiv.exe
  C:\Windows\System\cCaHPiv.exe
  2⤵
  PID:8500
- C:\Windows\System\XzuOgZC.exe
  C:\Windows\System\XzuOgZC.exe
  2⤵
  PID:8452
- C:\Windows\System\qWAdLsp.exe
  C:\Windows\System\qWAdLsp.exe
  2⤵
  PID:8660
- C:\Windows\System\jgJtIgp.exe
  C:\Windows\System\jgJtIgp.exe
  2⤵
  PID:8224
- C:\Windows\System\dksSaUL.exe
  C:\Windows\System\dksSaUL.exe
  2⤵
  PID:8596
- C:\Windows\System\vjkCAYP.exe
  C:\Windows\System\vjkCAYP.exe
  2⤵
  PID:8404
- C:\Windows\System\mmoMjKk.exe
  C:\Windows\System\mmoMjKk.exe
  2⤵
  PID:8720
- C:\Windows\System\YwxvpLj.exe
  C:\Windows\System\YwxvpLj.exe
  2⤵
  PID:8644
- C:\Windows\System\LJPpQvD.exe
  C:\Windows\System\LJPpQvD.exe
  2⤵
  PID:8864
- C:\Windows\System\OIlFwhF.exe
  C:\Windows\System\OIlFwhF.exe
  2⤵
  PID:8932
- C:\Windows\System\vMBjohu.exe
  C:\Windows\System\vMBjohu.exe
  2⤵
  PID:9112
- C:\Windows\System\nrKyDje.exe
  C:\Windows\System\nrKyDje.exe
  2⤵
  PID:8900
- C:\Windows\System\ACZhDfZ.exe
  C:\Windows\System\ACZhDfZ.exe
  2⤵
  PID:9000
- C:\Windows\System\LZbqcXH.exe
  C:\Windows\System\LZbqcXH.exe
  2⤵
  PID:9124
- C:\Windows\System\EMuRWPa.exe
  C:\Windows\System\EMuRWPa.exe
  2⤵
  PID:9208
- C:\Windows\System\MzbQjBE.exe
  C:\Windows\System\MzbQjBE.exe
  2⤵
  PID:8436
- C:\Windows\System\qaZfbTc.exe
  C:\Windows\System\qaZfbTc.exe
  2⤵
  PID:8544
- C:\Windows\System\lMSONoM.exe
  C:\Windows\System\lMSONoM.exe
  2⤵
  PID:8740
- C:\Windows\System\cgKfiXo.exe
  C:\Windows\System\cgKfiXo.exe
  2⤵
  PID:8836
- C:\Windows\System\ARiXkTT.exe
  C:\Windows\System\ARiXkTT.exe
  2⤵
  PID:8528
- C:\Windows\System\oaapNvj.exe
  C:\Windows\System\oaapNvj.exe
  2⤵
  PID:8340
- C:\Windows\System\iFnqeyU.exe
  C:\Windows\System\iFnqeyU.exe
  2⤵
  PID:8512
- C:\Windows\System\VoLbfng.exe
  C:\Windows\System\VoLbfng.exe
  2⤵
  PID:8580
- C:\Windows\System\NgJZXYL.exe
  C:\Windows\System\NgJZXYL.exe
  2⤵
  PID:9092
- C:\Windows\System\GmIcYVs.exe
  C:\Windows\System\GmIcYVs.exe
  2⤵
  PID:9076
- C:\Windows\System\fNllCTN.exe
  C:\Windows\System\fNllCTN.exe
  2⤵
  PID:8804
- C:\Windows\System\SSsiseU.exe
  C:\Windows\System\SSsiseU.exe
  2⤵
  PID:8196
- C:\Windows\System\PkuziCH.exe
  C:\Windows\System\PkuziCH.exe
  2⤵
  PID:9220
- C:\Windows\System\OejLJHE.exe
  C:\Windows\System\OejLJHE.exe
  2⤵
  PID:9240
- C:\Windows\System\neoKDXY.exe
  C:\Windows\System\neoKDXY.exe
  2⤵
  PID:9256
- C:\Windows\System\LUEwnzE.exe
  C:\Windows\System\LUEwnzE.exe
  2⤵
  PID:9272
- C:\Windows\System\zgRyNxe.exe
  C:\Windows\System\zgRyNxe.exe
  2⤵
  PID:9288
- C:\Windows\System\kouKbTd.exe
  C:\Windows\System\kouKbTd.exe
  2⤵
  PID:9304
- C:\Windows\System\hyjmPPk.exe
  C:\Windows\System\hyjmPPk.exe
  2⤵
  PID:9324
- C:\Windows\System\rKtOslW.exe
  C:\Windows\System\rKtOslW.exe
  2⤵
  PID:9340
- C:\Windows\System\YgugnLm.exe
  C:\Windows\System\YgugnLm.exe
  2⤵
  PID:9356
- C:\Windows\System\tvjqPSy.exe
  C:\Windows\System\tvjqPSy.exe
  2⤵
  PID:9372
- C:\Windows\System\QuaJqia.exe
  C:\Windows\System\QuaJqia.exe
  2⤵
  PID:9388
- C:\Windows\System\Pvxidii.exe
  C:\Windows\System\Pvxidii.exe
  2⤵
  PID:9404
- C:\Windows\System\CEHdhnY.exe
  C:\Windows\System\CEHdhnY.exe
  2⤵
  PID:9424
- C:\Windows\System\DjcsMPq.exe
  C:\Windows\System\DjcsMPq.exe
  2⤵
  PID:9440
- C:\Windows\System\oGCarCt.exe
  C:\Windows\System\oGCarCt.exe
  2⤵
  PID:9456
- C:\Windows\System\AkzQgOs.exe
  C:\Windows\System\AkzQgOs.exe
  2⤵
  PID:9472
- C:\Windows\System\uhLvCdk.exe
  C:\Windows\System\uhLvCdk.exe
  2⤵
  PID:9488
- C:\Windows\System\RGTuyfR.exe
  C:\Windows\System\RGTuyfR.exe
  2⤵
  PID:9504
- C:\Windows\System\XmYCPKD.exe
  C:\Windows\System\XmYCPKD.exe
  2⤵
  PID:9524
- C:\Windows\System\TzlUpum.exe
  C:\Windows\System\TzlUpum.exe
  2⤵
  PID:9540
- C:\Windows\System\BXgmBkJ.exe
  C:\Windows\System\BXgmBkJ.exe
  2⤵
  PID:9556
- C:\Windows\System\bWjbyZS.exe
  C:\Windows\System\bWjbyZS.exe
  2⤵
  PID:9572
- C:\Windows\System\owygySa.exe
  C:\Windows\System\owygySa.exe
  2⤵
  PID:9596
- C:\Windows\System\QRNcnlo.exe
  C:\Windows\System\QRNcnlo.exe
  2⤵
  PID:9616
- C:\Windows\System\frkWduZ.exe
  C:\Windows\System\frkWduZ.exe
  2⤵
  PID:9632
- C:\Windows\System\BwzxPYr.exe
  C:\Windows\System\BwzxPYr.exe
  2⤵
  PID:9648
- C:\Windows\System\dywmWvU.exe
  C:\Windows\System\dywmWvU.exe
  2⤵
  PID:9664
- C:\Windows\System\fBIbTHI.exe
  C:\Windows\System\fBIbTHI.exe
  2⤵
  PID:9680
- C:\Windows\System\rdxxsal.exe
  C:\Windows\System\rdxxsal.exe
  2⤵
  PID:9696
- C:\Windows\System\ieKhdEG.exe
  C:\Windows\System\ieKhdEG.exe
  2⤵
  PID:9712
- C:\Windows\System\YmUcuBa.exe
  C:\Windows\System\YmUcuBa.exe
  2⤵
  PID:9728
- C:\Windows\System\Rjjsiov.exe
  C:\Windows\System\Rjjsiov.exe
  2⤵
  PID:9744
- C:\Windows\System\RkGmlTr.exe
  C:\Windows\System\RkGmlTr.exe
  2⤵
  PID:9760
- C:\Windows\System\ZndoaGX.exe
  C:\Windows\System\ZndoaGX.exe
  2⤵
  PID:9776
- C:\Windows\System\OPTumMq.exe
  C:\Windows\System\OPTumMq.exe
  2⤵
  PID:9792
- C:\Windows\System\fpDsmhc.exe
  C:\Windows\System\fpDsmhc.exe
  2⤵
  PID:9808
- C:\Windows\System\rmrHcGA.exe
  C:\Windows\System\rmrHcGA.exe
  2⤵
  PID:9824
- C:\Windows\System\pHkZgNf.exe
  C:\Windows\System\pHkZgNf.exe
  2⤵
  PID:9840
- C:\Windows\System\XfYGrDl.exe
  C:\Windows\System\XfYGrDl.exe
  2⤵
  PID:9856
- C:\Windows\System\nljUZFs.exe
  C:\Windows\System\nljUZFs.exe
  2⤵
  PID:9872
- C:\Windows\System\nlxNSpA.exe
  C:\Windows\System\nlxNSpA.exe
  2⤵
  PID:9888
- C:\Windows\System\MrCVlhX.exe
  C:\Windows\System\MrCVlhX.exe
  2⤵
  PID:9904
- C:\Windows\System\FuCFCVE.exe
  C:\Windows\System\FuCFCVE.exe
  2⤵
  PID:9920
- C:\Windows\System\cOTpMQZ.exe
  C:\Windows\System\cOTpMQZ.exe
  2⤵
  PID:9936
- C:\Windows\System\fpRmVwT.exe
  C:\Windows\System\fpRmVwT.exe
  2⤵
  PID:9952
- C:\Windows\System\wRyvqwf.exe
  C:\Windows\System\wRyvqwf.exe
  2⤵
  PID:9968
- C:\Windows\System\lxHxMbg.exe
  C:\Windows\System\lxHxMbg.exe
  2⤵
  PID:9984
- C:\Windows\System\trMwJSk.exe
  C:\Windows\System\trMwJSk.exe
  2⤵
  PID:10008
- C:\Windows\System\jPWLZsF.exe
  C:\Windows\System\jPWLZsF.exe
  2⤵
  PID:10024
- C:\Windows\System\xNNfpAS.exe
  C:\Windows\System\xNNfpAS.exe
  2⤵
  PID:10040
- C:\Windows\System\NlcDWVY.exe
  C:\Windows\System\NlcDWVY.exe
  2⤵
  PID:10056
- C:\Windows\System\pTsQbIx.exe
  C:\Windows\System\pTsQbIx.exe
  2⤵
  PID:10080
- C:\Windows\System\TDTeAnH.exe
  C:\Windows\System\TDTeAnH.exe
  2⤵
  PID:10104
- C:\Windows\System\jIccyuL.exe
  C:\Windows\System\jIccyuL.exe
  2⤵
  PID:10124
- C:\Windows\System\JPkMPcn.exe
  C:\Windows\System\JPkMPcn.exe
  2⤵
  PID:10140
- C:\Windows\System\EBdMTMd.exe
  C:\Windows\System\EBdMTMd.exe
  2⤵
  PID:10156
- C:\Windows\System\ySLTZRG.exe
  C:\Windows\System\ySLTZRG.exe
  2⤵
  PID:10172
- C:\Windows\System\SpvcJRg.exe
  C:\Windows\System\SpvcJRg.exe
  2⤵
  PID:10188
- C:\Windows\System\rOsdsSJ.exe
  C:\Windows\System\rOsdsSJ.exe
  2⤵
  PID:10208
- C:\Windows\System\TGLBPcY.exe
  C:\Windows\System\TGLBPcY.exe
  2⤵
  PID:10224
- C:\Windows\System\OgDDjmT.exe
  C:\Windows\System\OgDDjmT.exe
  2⤵
  PID:9228
- C:\Windows\System\tEDEzae.exe
  C:\Windows\System\tEDEzae.exe
  2⤵
  PID:9204
- C:\Windows\System\UNhnjRk.exe
  C:\Windows\System\UNhnjRk.exe
  2⤵
  PID:9264
- C:\Windows\System\dFvGood.exe
  C:\Windows\System\dFvGood.exe
  2⤵
  PID:9188
- C:\Windows\System\SgmTafZ.exe
  C:\Windows\System\SgmTafZ.exe
  2⤵
  PID:9296
- C:\Windows\System\gMJHyUh.exe
  C:\Windows\System\gMJHyUh.exe
  2⤵
  PID:9300
- C:\Windows\System\EVENLVs.exe
  C:\Windows\System\EVENLVs.exe
  2⤵
  PID:9368
- C:\Windows\System\dykOBIU.exe
  C:\Windows\System\dykOBIU.exe
  2⤵
  PID:9436
- C:\Windows\System\vCKWqZE.exe
  C:\Windows\System\vCKWqZE.exe
  2⤵
  PID:9500
- C:\Windows\System\HjbEXwI.exe
  C:\Windows\System\HjbEXwI.exe
  2⤵
  PID:9568
- C:\Windows\System\PiwkSNk.exe
  C:\Windows\System\PiwkSNk.exe
  2⤵
  PID:9640
- C:\Windows\System\sZlXLIz.exe
  C:\Windows\System\sZlXLIz.exe
  2⤵
  PID:9704
- C:\Windows\System\FICGCce.exe
  C:\Windows\System\FICGCce.exe
  2⤵
  PID:9320
- C:\Windows\System\zRtSRXW.exe
  C:\Windows\System\zRtSRXW.exe
  2⤵
  PID:9624
- C:\Windows\System\snUUmii.exe
  C:\Windows\System\snUUmii.exe
  2⤵
  PID:9380
- C:\Windows\System\YCAIOMD.exe
  C:\Windows\System\YCAIOMD.exe
  2⤵
  PID:9452
- C:\Windows\System\fpRrjez.exe
  C:\Windows\System\fpRrjez.exe
  2⤵
  PID:9592
- C:\Windows\System\ojBQyVb.exe
  C:\Windows\System\ojBQyVb.exe
  2⤵
  PID:9768
- C:\Windows\System\EzFepGq.exe
  C:\Windows\System\EzFepGq.exe
  2⤵
  PID:9548
- C:\Windows\System\wBRiUHG.exe
  C:\Windows\System\wBRiUHG.exe
  2⤵
  PID:9800
- C:\Windows\System\gvKgXcu.exe
  C:\Windows\System\gvKgXcu.exe
  2⤵
  PID:9688
- C:\Windows\System\HhVfBiU.exe
  C:\Windows\System\HhVfBiU.exe
  2⤵
  PID:9784
- C:\Windows\System\OapNTCu.exe
  C:\Windows\System\OapNTCu.exe
  2⤵
  PID:9864
- C:\Windows\System\IOAKNxA.exe
  C:\Windows\System\IOAKNxA.exe
  2⤵
  PID:9896
- C:\Windows\System\LiEZzZd.exe
  C:\Windows\System\LiEZzZd.exe
  2⤵
  PID:9960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AhQDdus.exe

Filesize
2.2MB

MD5
cf76a05f6ca4851911b4d2946d73a0fb

SHA1
1ba7bc6536f832f6eda352903d0c833e649c25d2

SHA256
8185ddbffd4c8e27ae8dd146a5aeafbdf6e54c5b3f295e38141dc186c12b8f6d

SHA512
5f218c049807e37aff3481a82af38ef37e730d122a3e4ad993dc2981111eedd750db146cb124595afa505fef3d5a2d91435a655ab1dca08e128eeacd3ad0cc17

Download Submit
C:\Windows\system\LAuRiCj.exe

Filesize
2.2MB

MD5
744b9c9e9afe2d48155f3d17eccc6104

SHA1
2fd1fb92f645849d040c12b5432d2bb68237de07

SHA256
ba52e0561c1b219947dd9b7a014179f575fbcf8835a6f8d13fd261e21ad53d93

SHA512
038d29e71372a62d9b4cfae237b8422ef0e50166e0f12f5e8af0c84c4b880f3de936cfda5ee92188976633de18b7f4df86b56ea10542e9c83210870d844ff021

Download Submit
C:\Windows\system\LtYEPuT.exe

Filesize
2.2MB

MD5
f34b0bba8fed2d9c3890fc974948a531

SHA1
cdf35fba926eb00b06767c7ff3729e7585f268a4

SHA256
d09bb6a631c0c07f2ea9c38c871b6df85c4e3911430f88d1396fb12bbd81a2b5

SHA512
ecad31c36f614bc7e91926d0dbf8bf235dfabd6292904f2a2a10e7afc9e75e30661468f11cd58267ad73bd83073b791c82c2d8eeda9d27c529cd3567cf14e425

Download Submit
C:\Windows\system\NJMOrgv.exe

Filesize
2.2MB

MD5
60fd96a8894045dc00f38a5e4e439158

SHA1
8213923edcd727a62b86b951a72b4868daec634a

SHA256
5c4078faab49056d4a6c968b702f41f18e0321b0c36189ffc5204e11dccf6080

SHA512
9cc644051f70ff0571e1f8b55cb1ee2ab0c2c259b2652b7290b1f61cd3eb44fcde29ef568c15592aec91a31d74b9cce1ce5abe84697b2e528dccd952014a1453

Download Submit
C:\Windows\system\NxbtPIs.exe

Filesize
2.2MB

MD5
b8da63d9e5c14d7fc533981d8a7433a9

SHA1
ff0707075afdbb151c6b5f00336cb18c412856fb

SHA256
05bf431668b7bce2004da234a4137cd9bae68c26e0bb8bc1b05168372cbe7b60

SHA512
42ea35cf6490fdef67a82cb30c9782e008321033e8d17ea91f4e66a799c641df3b5e169a1666ef2362a71f07166b47bd2f60e5429ebfd0bc9a0f9a86af137f25

Download Submit
C:\Windows\system\PQQkJjm.exe

Filesize
2.2MB

MD5
81ab7c44f94f57a45ecb3e1be0589104

SHA1
905f3f5ab5e23521f5197b777d6afc783b93969f

SHA256
75160516b265a04658cdeaaf03b5a7a023b7adf50306979f90c5a7d64684d3a4

SHA512
e74efeea73c46b6ef0e40b5418639fbcf25c0a914f3fd93406ba1efc33c03e5ec82572643025913d9d8d8a0dd0032179dbd7a56d20a886c134cdf7eba3a1d0c6

Download Submit
C:\Windows\system\WXmkzPQ.exe

Filesize
2.2MB

MD5
791dad8d14dc7dd9bd4d47806a2c369e

SHA1
73ae036c7855d52a5e06571c91eee761cd57382e

SHA256
71f0a49f6334933c5ffb2b57e3c51642067cd9eee37ebc40eb90c065ec02aa33

SHA512
f85ed5ee2b0af64737bdcbef210a8b937646f2389bb38be6c5e36ac07a8b37155aadd57cd8827d1e8272094fde41387ed41434936eb5116057f9bf0bc7b6539e

Download Submit
C:\Windows\system\WpFtcyZ.exe

Filesize
2.2MB

MD5
1b497b01b62aa599603faefec643fcc2

SHA1
cc72c190c9ba9c0f55d5a3fc6fce583d2bd6e7c2

SHA256
35da6f04c015e733c699ec50ee0bd78dcf97d90df4614ffef97670c01cf6228f

SHA512
4e0bb13be88afe58b686d5cf41e4cdfa490f1f32259e8eb201dd9eadf2607f0096c8f5c00c8f86ddd56fa19aad0996420d32c801de66cd3c0ce6330ac4a56a64

Download Submit
C:\Windows\system\WqbAfwj.exe

Filesize
2.2MB

MD5
6ecb431409829798e97d1aa57d2efdf0

SHA1
72595cc0ccdb3285ead00cc8cfaacdef788c8f17

SHA256
7d38ce2a70e75877bd1b5b774b7077194b683ba07e65f7a6b355bf178b16948a

SHA512
058d6dfdcd0d5d3cc8d567afa2fdd6c57524ecfe03e82fbb8a5530902bf5d9e7b723924ff53155aff48ea5d8fa8fcf728364a9676dcf2308e6fcb05c60dde8c5

Download Submit
C:\Windows\system\Xyirrcc.exe

Filesize
2.2MB

MD5
d940a0fa7573f66ca0095f84c0f5cea2

SHA1
2c20e554a4cb306ebb773768ffcb76da1ae62ebb

SHA256
d157b46d803ace9506096cbdbba7eea0a3e6a6c62fd823b35e64b1d5f7ae6245

SHA512
7ec5143e7188bd01a5a16109a1577963791c9120cadf973b5b2c25eef9914a2bf388145f8dfeb7b09c819acb86a3997088a9e71edd371c4cc8af955747517587

Download Submit
C:\Windows\system\YCfRxxl.exe

Filesize
2.2MB

MD5
9623765d5a3239e8f52ae8667a1bb0fc

SHA1
62e416eddf7c2c4b83a589a72899f71c4d422403

SHA256
98094fcc9a573df4b6b04e45ede0c7bb778609c32fae6d2748858f083e8870d4

SHA512
2a1bfaa4289c7694bbd8db65a8d53ae70e2f7da98c968019e13577d8f785f6dd67c434398ab146f8939c104009d189eaa23d8925c45ee541f8cdbf0dda019273

Download Submit
C:\Windows\system\ZTyFUxx.exe

Filesize
2.2MB

MD5
8f62229c2c259e76ed56c9163832a22b

SHA1
6778116a52c3f7c7ef41452ed15fc46d8e4556f3

SHA256
e57838ab67239a238aee8eb70bb08599921517023197da7226b8aaa2b2ab5178

SHA512
5f6fc4825b965cfd01c5d025864686c8d1f97093698601635785e27afe55973034c770ffc79701a7b2f912d3ce457cad2a5dfd7bb61edf4b738c067168c4f76a

Download Submit
C:\Windows\system\dzLOjus.exe

Filesize
2.2MB

MD5
4854bb3ef77f08b61c4e06dde796b760

SHA1
b19749a5991ee4db1e882ceb1350bbfadd679698

SHA256
b1486fcbbb28c8516a9e86c2be8ca0183d6348810c79a5d788065df60a595829

SHA512
8c4034428b979f5b681412a4d74b385796e4bfe8e8928f2172f37cdfd1fd6b955819d99b359e919b346bb702cda4d0702b1c10a07f4ed4c5674b7cb6b8ebae86

Download Submit
C:\Windows\system\ettxJkM.exe

Filesize
2.2MB

MD5
58881804ad694c84f74daa08bd3b4d4e

SHA1
e8b02cc3c1004177bd8c950f5b413dd869e18aee

SHA256
8b2317dd1308339ee83e0c38a607685f088fb17eb8e9e6349e7e17c34e018e08

SHA512
771491f295fb12239f585486b81f12d024093f1b70ecdf6cee9d365eecdbd747672ac39d6fdf8bcb3a9274984ced81b30161087aafdb385c4c1aa757882e443a

Download Submit
C:\Windows\system\fAqrJpk.exe

Filesize
2.2MB

MD5
9be3f0c76e846c04591f8cc2bb27b925

SHA1
38e630bba595d214cb78681028651a7ad37e83f9

SHA256
4a7b0e44d0ab6c50c9ec71274917c3937e3dcc71f4748115c381cf4abb76a686

SHA512
d2a5b09255d020b1fcb4eb366bf4971544991287f904470f79d6f579a0d349be80acbab42ef520799877b96f936a76e800223a874913fb1a923955d71d01e4cb

Download Submit
C:\Windows\system\fvKSZEB.exe

Filesize
2.2MB

MD5
3a2aff3cd957760c2248f7b6dd712efd

SHA1
8e035fcb81f867e93f74ce9e7731f04717e8103a

SHA256
230e1b95e72cfe132d8479f69bcf7e3902dd02419b49133816c11626f9b6a6f8

SHA512
a67053f648981ea6812f231fd8d01a05e065a937918cdbb32a97e24f65476bddac1f38c661bf2ec5d6c478a23f939bfcbe14655e0ddc9f3599c866c466fc5711

Download Submit
C:\Windows\system\hZlSFHo.exe

Filesize
2.2MB

MD5
8feaa20df606c0f7f00f0d41207cc6dc

SHA1
6d19079bb66277a07d1220463a4ea045b230689c

SHA256
2caf421989298554b53e6cc9d9953101042a418decc691cbfd2fd6c1e585cce7

SHA512
74834a1a72340b43774ba238a8d28f2038110d4b80bfe7af78759323ddd113efa09894d221404606b9ff120181090ef8fcfcebd01f124f489bf01b767db5cece

Download Submit
C:\Windows\system\iFpcmWj.exe

Filesize
2.2MB

MD5
395042654b167197b8cecac074b48d90

SHA1
09ad918728ecfdcd795894f19b4f669afaab3819

SHA256
22196be9f62e6479c28c8d6b63ad5969572fe532d46dcec89abce1f6edbcf65f

SHA512
a2e028ade2381a2def4b24d387d61277ec293bf0d7b99d3355bda291e2a7c962f91956fc008e0912e43589299f7e1ac03af89cacd427ded1c617bbcf422c283b

Download Submit
C:\Windows\system\lJPOuJZ.exe

Filesize
2.2MB

MD5
332cec7a606f269f5b0a86ccf1a9cb72

SHA1
9c0775360efcc2dbd5e9b2cb2ed6914ca542c2ca

SHA256
a8c57c269496970ac30f3d4fd670c39f5897d6120f49d40bced058ee8f9a6a9e

SHA512
b6f2d8e9f786a3adada2f4befabb828616424666b4b03313898ea8c716dca9873a4599e46d3abafb7f0ea5792020a6fbcbeaf15d1845d4303c386ea81dee8de4

Download Submit
C:\Windows\system\oIHbrCT.exe

Filesize
2.2MB

MD5
27e4c55b87729abc210a982ede32f94c

SHA1
a78ec5719fec4d3f0ebe338c2ba65a1a828cb165

SHA256
b0b3f6953bd0adecd7ad51a1a365a7717b27fce860ddeb9eca03ce96b8ce8b52

SHA512
6619ca71c9e6e76354d18243d2ba82797f944f051395e4772b11de18ba1c1819835e7fa6f36f96d8089f1b089d8aa5b7db1af58cb62f59efba647bac5ec147e2

Download Submit
C:\Windows\system\qPfBHiH.exe

Filesize
2.2MB

MD5
29ed73685dc23cdf4b5ea189ef3d9f24

SHA1
79802af5b7da3292f9902a92b709b788027df9c7

SHA256
0bb4d5723856942d993a6970beb40ec5c09d0384115af9e721982bf1374f719d

SHA512
14856dbd5deea7501dbbdc252db2e913d4ef4e7934a29c7473591abb2b7b6ad7ad1649070a31f0d2242f60ca1f24bf9b99f7d02e051be34d0f616a9e574c9de7

Download Submit
C:\Windows\system\qjIwoOe.exe

Filesize
2.2MB

MD5
29a6ab9c171be88ab1684fa24f7c297b

SHA1
8ca64ba8d13c482c1de4678ecdb35d62d5011459

SHA256
85196fce2c8c085f705c01636e95f4402d18374ea7da23a1ed7ae8b1328e3652

SHA512
cdd898e1e73a35ac2e5132c81ef32fceab261eea5e02da729997d7bb4783b505946adf64b74bbc8f8551d16421bf126177e40acb631a18b1a33749cdf947142b

Download Submit
C:\Windows\system\wKYwXFb.exe

Filesize
2.2MB

MD5
e9b5bf2cee4eeaf6eea5c3f21b6ce769

SHA1
fdccd150eb7ad183755baa6d8fd8e911f8830d82

SHA256
cb48a411d93772c3e369f8ccb2780d707a85018411ccfb89e86be06a31b3d61a

SHA512
fbb3b5cff782dd721c89a4b7d6aa7834c9dec58dedd82614332535eef72cc0486407107718fc801e5ed7edce67e9527764fae14f9eeb93ead549c3507eb4eb24

Download Submit
C:\Windows\system\waGRyDw.exe

Filesize
2.2MB

MD5
a67b955077488ef1d411380a66a9ad1e

SHA1
fe1fa2ba7202ab723c4699c547688709abe91be3

SHA256
1adc46b5acdb2000e783f8186d13133301e6fd5e8c67677186f3236a13740acf

SHA512
5772ea4cde8fe51b43bcf50f612755c9ed527c590b0af6de35cf2aaeb2c85cf662d3a01ec186dcc71f6f7b0b84def1ca9410b7f83d7a23e9183e6358a515eb35

Download Submit
C:\Windows\system\zrlBtAu.exe

Filesize
2.2MB

MD5
647bac8158fbda44790d6036283e60e2

SHA1
5ae4e2759d9d879e4333cb37cf38ced717fdf04e

SHA256
a4b7fcbf9c3383657c6f3b222fc96c2367824236a403c57fa2eba74cccd9560e

SHA512
bc5c96d509459ca351e1039a72e118883568376064d89bba35016b66833781d2092d4d91a1ca8dcf84898ec3fba192ef76d207b73445951dfb9d1b6cc119755e

Download Submit
\Windows\system\BImCbqC.exe

Filesize
2.2MB

MD5
7bebc7399b8d085cdde42d5ad3162b12

SHA1
1247fd907c1be2f8ed46ab01747f19614ad3d016

SHA256
4f69281c86f04ba45a9d4494c675f2a430059f1117566bc6db1622caf4345bdc

SHA512
bedf51223e14867e0786749efcffe3349f9271de40d05f8d3bd69ff5369afb483f8cb291dec5b665009d60fe702666910ad5d8285fe04510f85153f2a36959eb

Download Submit
\Windows\system\DRdbcOe.exe

Filesize
2.2MB

MD5
ca5a9cf975247d13b8ae447ef1c67d01

SHA1
dd7ddbb3dc966a4ccdda233d3614fae6eb48d005

SHA256
330ef9b1c7a3b984f29cb657a265f032cc9782ac52be5acb68f3e62b25d000e6

SHA512
88dc6fe1e6cc1a30715ad77054143cccfd1f26e6f94330e2dcb46023b22410f7da0c3c01ccd6fd9b5907750203e5adeedb856f48b2162c3c36a3075598e30214

Download Submit
\Windows\system\MoaiUPY.exe

Filesize
2.2MB

MD5
93e0ebae66e898c54eb34eb4ed5f17be

SHA1
530262ef66f91d71b7729956c0f519f631f6fe3c

SHA256
04733072b7dd085cbae74b21e7fac31858e48fdad56b8f852ddeeae4f844eb4e

SHA512
f215176d9acd3e78d48b646d5551ceb3adb294566cb2c1283f61fc2a62546b52a3c2c7a6043eaadc34313cd850b1f2d56c5dc3ef43b4471a5db6822f52d2e15a

Download Submit
\Windows\system\SSzdluN.exe

Filesize
2.2MB

MD5
47dbab7e72eb23e007b44780f792b34d

SHA1
4b02c338826d9ea980cd89e89b9a4e0a513005fa

SHA256
6703b78e5c1d02294ee3b0d0096ffed5ca1c531cee31b404e8a4265e6227a658

SHA512
78e54f2126a648aae11a94fceebc3565a6512d100dbad277bba2b0f1691f985bb7876a69ffbba97a1d8c882f09faf96983203d9c53520b82766f7ef6c42c9121

Download Submit
\Windows\system\XOrWeAb.exe

Filesize
2.2MB

MD5
98d38840c8fc9bc59a8d5d1c84a39175

SHA1
8cce613ff205ebe571cb03f6e62f4f7c2eb9dbbe

SHA256
1d89e99f23264fb8e7e2721f6a3a5ba60443b2fca266a8bbbdf6a595153aa3b5

SHA512
bb8621aa39532ef33257b69defca62b19944dcbfda6c383dc739ab3c3379ec51e0df1cbdb76a57932d55fbd7f9d9b2f345228c857afdacd94dcdc8fce86f321e

Download Submit
\Windows\system\ijgnhkj.exe

Filesize
2.2MB

MD5
c5d00b27170c2eb4e700f706f836f68d

SHA1
b40b2308bc2ffb1d2b4651b21b951074c7ab295d

SHA256
8577283115d60bbaa4a7967e21e0e9212b7ac0040774566f86c74a882bac3526

SHA512
d0c617d588dbeb99e053304e42b7ca185816f989cabcaf0042bb7f09db36d7daf76e1d8623f735701a0f29bd6af0125f1d7733e746e94d523018edb3a02b551a

Download Submit
\Windows\system\tBmuVtW.exe

Filesize
2.2MB

MD5
a37abc5c42fe57af539e1ba8e166d9a2

SHA1
b4239c0f3b95a1e2b8962da527138ae9c3524935

SHA256
55a78fb1ce00a538ada49b8eade125f797fb39ea94951674dc2f2a307b660864

SHA512
bc22c4955b8d87a6114f2c36c6914358a42a6f0b5212cf2554cb69dbbd03412c47b34fd19a47ed611806adf8014ff0cbe91aa7ef7cdd54c24c192d72d414fc7f

Download Submit
memory/1412-76-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-10-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1516-80-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-109-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/1516-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1516-68-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1516-69-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-20-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/1516-8-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1516-75-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-27-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-78-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/1516-79-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-72-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-104-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-344-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1516-92-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-0-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/1516-84-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-82-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2164-77-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-67-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-73-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2432-71-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-108-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-21-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-26-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2728-81-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-28-0x0000000002E90000-0x0000000002F10000-memory.dmp

Filesize
512KB

Download
memory/3048-85-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/3048-29-0x000007FEF5F9E000-0x000007FEF5F9F000-memory.dmp

Filesize
4KB

Download
memory/3048-32-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/3048-31-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/3048-65-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/3048-60-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download