xmrig | 33a2dd41e13f06b54579974742fb5dd9b2387591fe7731d0e45b9fcd0e1ca31d

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
Size

2.1MB
MD5

1fd3cffbe69e2292b6300680de38a990
SHA1

f99a680e26b78a8c5aba1f873e0e60e727069a14
SHA256

33a2dd41e13f06b54579974742fb5dd9b2387591fe7731d0e45b9fcd0e1ca31d
SHA512

8ce5e85445c868c3303355b90eb4a804ddbc14f7b18ae18e376749c317b65f5c8d79f612521d9e8d3aa882b49960a88524c2f6be530f72844fab5a9383cf93f5
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafM4R:NABo

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2900-9-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2648-51-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2744-53-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2472-49-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/3024-105-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2512-85-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2852-103-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/3012-102-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1284-47-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/844-2124-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2852-5623-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2648-5683-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2900-5681-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2060-5682-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2512-5686-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/3012-5687-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1284-5685-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/3024-5684-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2472-5688-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2744-5692-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2900	AKOgZqt.exe
2060	MadfRUi.exe
1284	fuXYqUv.exe
2472	SXmbbZn.exe
2648	tHZVdux.exe
2744	xywQqBl.exe
2512	ULHdyXg.exe
3012	wmjgyaP.exe
2852	NcqRpjg.exe
3024	OQBlVRW.exe
3036	rODsdGo.exe
304	GKdwfdp.exe
2824	XnZWKZz.exe
2992	ppURuxT.exe
2704	geMssxf.exe
500	XoXYMcW.exe
2252	NhXXJdV.exe
1544	yhJONGA.exe
2524	eYWkXKn.exe
2804	eweIwZC.exe
1804	dQrcKJm.exe
1768	gYhnUGj.exe
1944	syeKuAw.exe
2932	RQGVjNV.exe
2248	EtgbYtO.exe
608	BYYJzHJ.exe
828	VbFvekq.exe
1384	fMjRenB.exe
1860	EuZrKZW.exe
1572	hLJpsEg.exe
1048	mpbkCbM.exe
1820	upLPxCE.exe
344	RsoMZmA.exe
2124	YYyYrRl.exe
1344	UyNZPin.exe
1556	WJqqzqD.exe
1364	Lebtlfh.exe
1868	AXlURNM.exe
1660	GxDYaYR.exe
2372	wAKgiOe.exe
1036	ilrFmEq.exe
2216	aZehuKe.exe
1816	CnPSUXk.exe
1696	NMXFGVi.exe
3064	TeUtTFe.exe
2336	ATAXgAE.exe
768	DgqBENH.exe
1524	saRRnlg.exe
2272	nlOIMkI.exe
1956	KkWetmg.exe
2360	UaZvhTy.exe
1720	abZfodT.exe
2976	ampPyEO.exe
2636	LrYkmxw.exe
2572	ixMpXNz.exe
2492	IUPRSRR.exe
1960	AKKTKdm.exe
1748	VoUIFSe.exe
2776	qdnBThl.exe
2988	QuVpjFu.exe
1532	rhOqkcN.exe
2188	cvpkFYr.exe
2244	jyXJLEo.exe
112	JtcgEPp.exe

Loads dropped DLL 64 IoCs

pid	Process
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/844-2-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x000c0000000155f6-5.dat	upx
behavioral1/memory/2900-9-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0030000000015c6f-13.dat	upx
behavioral1/files/0x0007000000015cb0-23.dat	upx
behavioral1/memory/2060-19-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x001800000000558a-28.dat	upx
behavioral1/files/0x0008000000015cce-35.dat	upx
behavioral1/files/0x0007000000015cd9-39.dat	upx
behavioral1/memory/2648-51-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2744-53-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2472-49-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0006000000016813-65.dat	upx
behavioral1/memory/3024-105-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0006000000016cfd-115.dat	upx
behavioral1/files/0x0006000000016ce4-109.dat	upx
behavioral1/files/0x0006000000016d0e-133.dat	upx
behavioral1/files/0x0006000000016cf5-138.dat	upx
behavioral1/files/0x002e000000015c85-145.dat	upx
behavioral1/files/0x0006000000016d3a-169.dat	upx
behavioral1/files/0x0006000000016e78-187.dat	upx
behavioral1/files/0x0006000000016fe8-188.dat	upx
behavioral1/files/0x0006000000016db3-180.dat	upx
behavioral1/files/0x0006000000016d9f-174.dat	upx
behavioral1/files/0x0006000000016d36-164.dat	upx
behavioral1/files/0x000600000001739d-195.dat	upx
behavioral1/files/0x0006000000016da4-178.dat	upx
behavioral1/files/0x0006000000016d1f-154.dat	upx
behavioral1/files/0x0006000000016d32-159.dat	upx
behavioral1/files/0x0006000000016d16-149.dat	upx
behavioral1/files/0x0006000000016c42-128.dat	upx
behavioral1/files/0x0006000000016d05-118.dat	upx
behavioral1/files/0x0006000000016cb2-106.dat	upx
behavioral1/memory/2512-85-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x0006000000016c3a-84.dat	upx
behavioral1/files/0x0006000000016a6f-82.dat	upx
behavioral1/files/0x00060000000165f0-81.dat	upx
behavioral1/memory/2852-103-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/3012-102-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000016c1d-73.dat	upx
behavioral1/files/0x0006000000016c8c-97.dat	upx
behavioral1/files/0x000700000001654a-89.dat	upx
behavioral1/files/0x0008000000015cf5-58.dat	upx
behavioral1/memory/1284-47-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/844-2124-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2852-5623-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2648-5683-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2900-5681-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2060-5682-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2512-5686-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/3012-5687-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/1284-5685-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/3024-5684-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2472-5688-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2744-5692-0x000000013F660000-0x000000013FA52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DVjEHaa.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\uRPkrYX.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\lzONmNI.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ourxMWg.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\RQGRLie.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ONyuDfG.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\gupZnSi.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\vflKMNX.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\RiIDBxU.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\GwyUqMT.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\oUUCeCv.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\nuGgnyQ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\KLiMcLw.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\rtCbWvB.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\QceahlP.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\mWUCIDL.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\KhkfTsa.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\BiHuUth.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\aWvYBlf.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ScjOmcr.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\UlkbqwE.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\GdcknHQ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\VHWgouF.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\JLozOJg.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\mlZYbid.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\gDXtcfS.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\JWUZDCB.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\AhcbTWG.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ZJgKnWo.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\EIuptmK.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ampPyEO.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\QfVYNiR.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\LzDkseo.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\mmMQaBW.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\UwFKoua.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\pqQioed.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\HCviOna.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\dosPAMQ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\CTQCITH.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\EtmtBUU.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\qklkaII.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\OElDpdD.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\XVmcedZ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\jpiGGAM.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\buCUtev.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ZopzOYJ.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\rFZvFld.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\SwEXECp.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\rjIaNBm.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\sokcMjs.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\QuwdvyY.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\LhkcGiF.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\CYtowFE.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\CofPBcc.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\elGvVYt.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\yNadYDl.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\QPBIMIN.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\GGIIzgT.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\sClRRub.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\mnKsKjB.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\qHLhGNb.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\naJZIKI.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\iAcpefU.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
File created	C:\Windows\System\ixSEjdc.exe	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
Token: SeDebugPrivilege	3056	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3056	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	29
PID 844 wrote to memory of 3056	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	29
PID 844 wrote to memory of 3056	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	29
PID 844 wrote to memory of 2900	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	30
PID 844 wrote to memory of 2900	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	30
PID 844 wrote to memory of 2900	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	30
PID 844 wrote to memory of 2060	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	31
PID 844 wrote to memory of 2060	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	31
PID 844 wrote to memory of 2060	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	31
PID 844 wrote to memory of 1284	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	32
PID 844 wrote to memory of 1284	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	32
PID 844 wrote to memory of 1284	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	32
PID 844 wrote to memory of 2472	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	33
PID 844 wrote to memory of 2472	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	33
PID 844 wrote to memory of 2472	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	33
PID 844 wrote to memory of 2648	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	34
PID 844 wrote to memory of 2648	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	34
PID 844 wrote to memory of 2648	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	34
PID 844 wrote to memory of 2744	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	35
PID 844 wrote to memory of 2744	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	35
PID 844 wrote to memory of 2744	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	35
PID 844 wrote to memory of 2512	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	36
PID 844 wrote to memory of 2512	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	36
PID 844 wrote to memory of 2512	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	36
PID 844 wrote to memory of 3036	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	37
PID 844 wrote to memory of 3036	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	37
PID 844 wrote to memory of 3036	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	37
PID 844 wrote to memory of 3012	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	38
PID 844 wrote to memory of 3012	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	38
PID 844 wrote to memory of 3012	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	38
PID 844 wrote to memory of 304	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	39
PID 844 wrote to memory of 304	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	39
PID 844 wrote to memory of 304	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	39
PID 844 wrote to memory of 2852	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	40
PID 844 wrote to memory of 2852	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	40
PID 844 wrote to memory of 2852	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	40
PID 844 wrote to memory of 2992	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	41
PID 844 wrote to memory of 2992	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	41
PID 844 wrote to memory of 2992	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	41
PID 844 wrote to memory of 3024	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	42
PID 844 wrote to memory of 3024	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	42
PID 844 wrote to memory of 3024	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	42
PID 844 wrote to memory of 2252	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	43
PID 844 wrote to memory of 2252	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	43
PID 844 wrote to memory of 2252	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	43
PID 844 wrote to memory of 2824	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	44
PID 844 wrote to memory of 2824	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	44
PID 844 wrote to memory of 2824	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	44
PID 844 wrote to memory of 2524	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	45
PID 844 wrote to memory of 2524	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	45
PID 844 wrote to memory of 2524	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	45
PID 844 wrote to memory of 2704	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	46
PID 844 wrote to memory of 2704	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	46
PID 844 wrote to memory of 2704	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	46
PID 844 wrote to memory of 2804	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	47
PID 844 wrote to memory of 2804	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	47
PID 844 wrote to memory of 2804	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	47
PID 844 wrote to memory of 500	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	48
PID 844 wrote to memory of 500	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	48
PID 844 wrote to memory of 500	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	48
PID 844 wrote to memory of 1804	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	49
PID 844 wrote to memory of 1804	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	49
PID 844 wrote to memory of 1804	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	49
PID 844 wrote to memory of 1544	844	1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fd3cffbe69e2292b6300680de38a990_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\System\AKOgZqt.exe
  C:\Windows\System\AKOgZqt.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\MadfRUi.exe
  C:\Windows\System\MadfRUi.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\fuXYqUv.exe
  C:\Windows\System\fuXYqUv.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\SXmbbZn.exe
  C:\Windows\System\SXmbbZn.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\tHZVdux.exe
  C:\Windows\System\tHZVdux.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\xywQqBl.exe
  C:\Windows\System\xywQqBl.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ULHdyXg.exe
  C:\Windows\System\ULHdyXg.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\rODsdGo.exe
  C:\Windows\System\rODsdGo.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\wmjgyaP.exe
  C:\Windows\System\wmjgyaP.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\GKdwfdp.exe
  C:\Windows\System\GKdwfdp.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\NcqRpjg.exe
  C:\Windows\System\NcqRpjg.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ppURuxT.exe
  C:\Windows\System\ppURuxT.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\OQBlVRW.exe
  C:\Windows\System\OQBlVRW.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\NhXXJdV.exe
  C:\Windows\System\NhXXJdV.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\XnZWKZz.exe
  C:\Windows\System\XnZWKZz.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\eYWkXKn.exe
  C:\Windows\System\eYWkXKn.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\geMssxf.exe
  C:\Windows\System\geMssxf.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\eweIwZC.exe
  C:\Windows\System\eweIwZC.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\XoXYMcW.exe
  C:\Windows\System\XoXYMcW.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\dQrcKJm.exe
  C:\Windows\System\dQrcKJm.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\yhJONGA.exe
  C:\Windows\System\yhJONGA.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\gYhnUGj.exe
  C:\Windows\System\gYhnUGj.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\syeKuAw.exe
  C:\Windows\System\syeKuAw.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\RQGVjNV.exe
  C:\Windows\System\RQGVjNV.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\EtgbYtO.exe
  C:\Windows\System\EtgbYtO.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\BYYJzHJ.exe
  C:\Windows\System\BYYJzHJ.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\VbFvekq.exe
  C:\Windows\System\VbFvekq.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\fMjRenB.exe
  C:\Windows\System\fMjRenB.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\EuZrKZW.exe
  C:\Windows\System\EuZrKZW.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\upLPxCE.exe
  C:\Windows\System\upLPxCE.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\hLJpsEg.exe
  C:\Windows\System\hLJpsEg.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\RsoMZmA.exe
  C:\Windows\System\RsoMZmA.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\mpbkCbM.exe
  C:\Windows\System\mpbkCbM.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\YYyYrRl.exe
  C:\Windows\System\YYyYrRl.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\UyNZPin.exe
  C:\Windows\System\UyNZPin.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\WJqqzqD.exe
  C:\Windows\System\WJqqzqD.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\Lebtlfh.exe
  C:\Windows\System\Lebtlfh.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\AXlURNM.exe
  C:\Windows\System\AXlURNM.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\GxDYaYR.exe
  C:\Windows\System\GxDYaYR.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\wAKgiOe.exe
  C:\Windows\System\wAKgiOe.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ilrFmEq.exe
  C:\Windows\System\ilrFmEq.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\aZehuKe.exe
  C:\Windows\System\aZehuKe.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\CnPSUXk.exe
  C:\Windows\System\CnPSUXk.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\NMXFGVi.exe
  C:\Windows\System\NMXFGVi.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\TeUtTFe.exe
  C:\Windows\System\TeUtTFe.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ATAXgAE.exe
  C:\Windows\System\ATAXgAE.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\DgqBENH.exe
  C:\Windows\System\DgqBENH.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\saRRnlg.exe
  C:\Windows\System\saRRnlg.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\nlOIMkI.exe
  C:\Windows\System\nlOIMkI.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\KkWetmg.exe
  C:\Windows\System\KkWetmg.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\UaZvhTy.exe
  C:\Windows\System\UaZvhTy.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\ampPyEO.exe
  C:\Windows\System\ampPyEO.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\abZfodT.exe
  C:\Windows\System\abZfodT.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\DdDofMp.exe
  C:\Windows\System\DdDofMp.exe
  2⤵
  PID:764
- C:\Windows\System\LrYkmxw.exe
  C:\Windows\System\LrYkmxw.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\aMwyLtz.exe
  C:\Windows\System\aMwyLtz.exe
  2⤵
  PID:2600
- C:\Windows\System\ixMpXNz.exe
  C:\Windows\System\ixMpXNz.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\eJCiIAE.exe
  C:\Windows\System\eJCiIAE.exe
  2⤵
  PID:2464
- C:\Windows\System\IUPRSRR.exe
  C:\Windows\System\IUPRSRR.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\iMxaQlt.exe
  C:\Windows\System\iMxaQlt.exe
  2⤵
  PID:2864
- C:\Windows\System\AKKTKdm.exe
  C:\Windows\System\AKKTKdm.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\CaFeMiG.exe
  C:\Windows\System\CaFeMiG.exe
  2⤵
  PID:2892
- C:\Windows\System\VoUIFSe.exe
  C:\Windows\System\VoUIFSe.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\iGdTMuQ.exe
  C:\Windows\System\iGdTMuQ.exe
  2⤵
  PID:1688
- C:\Windows\System\qdnBThl.exe
  C:\Windows\System\qdnBThl.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\QnJPDns.exe
  C:\Windows\System\QnJPDns.exe
  2⤵
  PID:2264
- C:\Windows\System\QuVpjFu.exe
  C:\Windows\System\QuVpjFu.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\eLuGzXB.exe
  C:\Windows\System\eLuGzXB.exe
  2⤵
  PID:2160
- C:\Windows\System\rhOqkcN.exe
  C:\Windows\System\rhOqkcN.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\cUurpCJ.exe
  C:\Windows\System\cUurpCJ.exe
  2⤵
  PID:2836
- C:\Windows\System\cvpkFYr.exe
  C:\Windows\System\cvpkFYr.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\HJlhQFf.exe
  C:\Windows\System\HJlhQFf.exe
  2⤵
  PID:1744
- C:\Windows\System\jyXJLEo.exe
  C:\Windows\System\jyXJLEo.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\SWbgtBZ.exe
  C:\Windows\System\SWbgtBZ.exe
  2⤵
  PID:2928
- C:\Windows\System\JtcgEPp.exe
  C:\Windows\System\JtcgEPp.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\ujfNVwu.exe
  C:\Windows\System\ujfNVwu.exe
  2⤵
  PID:2132
- C:\Windows\System\flhbGFT.exe
  C:\Windows\System\flhbGFT.exe
  2⤵
  PID:948
- C:\Windows\System\tfMNDUK.exe
  C:\Windows\System\tfMNDUK.exe
  2⤵
  PID:916
- C:\Windows\System\DjhXjMO.exe
  C:\Windows\System\DjhXjMO.exe
  2⤵
  PID:856
- C:\Windows\System\vSzxjmy.exe
  C:\Windows\System\vSzxjmy.exe
  2⤵
  PID:1680
- C:\Windows\System\hyhQCyK.exe
  C:\Windows\System\hyhQCyK.exe
  2⤵
  PID:1336
- C:\Windows\System\bHlfSqc.exe
  C:\Windows\System\bHlfSqc.exe
  2⤵
  PID:780
- C:\Windows\System\qXWOKZE.exe
  C:\Windows\System\qXWOKZE.exe
  2⤵
  PID:1044
- C:\Windows\System\eLFmASt.exe
  C:\Windows\System\eLFmASt.exe
  2⤵
  PID:2916
- C:\Windows\System\XLkkKVE.exe
  C:\Windows\System\XLkkKVE.exe
  2⤵
  PID:2108
- C:\Windows\System\OvDEwpn.exe
  C:\Windows\System\OvDEwpn.exe
  2⤵
  PID:1932
- C:\Windows\System\EFORjUv.exe
  C:\Windows\System\EFORjUv.exe
  2⤵
  PID:996
- C:\Windows\System\KFQNWqF.exe
  C:\Windows\System\KFQNWqF.exe
  2⤵
  PID:1972
- C:\Windows\System\nfisEeM.exe
  C:\Windows\System\nfisEeM.exe
  2⤵
  PID:1104
- C:\Windows\System\vTthtaD.exe
  C:\Windows\System\vTthtaD.exe
  2⤵
  PID:1616
- C:\Windows\System\zngCCfy.exe
  C:\Windows\System\zngCCfy.exe
  2⤵
  PID:2660
- C:\Windows\System\XZwdvIs.exe
  C:\Windows\System\XZwdvIs.exe
  2⤵
  PID:2888
- C:\Windows\System\WhIPmTI.exe
  C:\Windows\System\WhIPmTI.exe
  2⤵
  PID:2856
- C:\Windows\System\tSdspFV.exe
  C:\Windows\System\tSdspFV.exe
  2⤵
  PID:352
- C:\Windows\System\uICxKBl.exe
  C:\Windows\System\uICxKBl.exe
  2⤵
  PID:632
- C:\Windows\System\CTQCITH.exe
  C:\Windows\System\CTQCITH.exe
  2⤵
  PID:2576
- C:\Windows\System\nIGbTTk.exe
  C:\Windows\System\nIGbTTk.exe
  2⤵
  PID:548
- C:\Windows\System\sSTsKpL.exe
  C:\Windows\System\sSTsKpL.exe
  2⤵
  PID:2812
- C:\Windows\System\FnHPlxn.exe
  C:\Windows\System\FnHPlxn.exe
  2⤵
  PID:2420
- C:\Windows\System\BRZvqBR.exe
  C:\Windows\System\BRZvqBR.exe
  2⤵
  PID:2404
- C:\Windows\System\WbmDnxo.exe
  C:\Windows\System\WbmDnxo.exe
  2⤵
  PID:2004
- C:\Windows\System\CVWWsHo.exe
  C:\Windows\System\CVWWsHo.exe
  2⤵
  PID:2552
- C:\Windows\System\jEqEWZu.exe
  C:\Windows\System\jEqEWZu.exe
  2⤵
  PID:1060
- C:\Windows\System\HwJeyLa.exe
  C:\Windows\System\HwJeyLa.exe
  2⤵
  PID:2232
- C:\Windows\System\iIYjFCu.exe
  C:\Windows\System\iIYjFCu.exe
  2⤵
  PID:2608
- C:\Windows\System\wtGjLmB.exe
  C:\Windows\System\wtGjLmB.exe
  2⤵
  PID:296
- C:\Windows\System\sfbbafw.exe
  C:\Windows\System\sfbbafw.exe
  2⤵
  PID:1952
- C:\Windows\System\blLePfv.exe
  C:\Windows\System\blLePfv.exe
  2⤵
  PID:412
- C:\Windows\System\vFRekLU.exe
  C:\Windows\System\vFRekLU.exe
  2⤵
  PID:2088
- C:\Windows\System\pHGJsDn.exe
  C:\Windows\System\pHGJsDn.exe
  2⤵
  PID:2688
- C:\Windows\System\JYeFFyZ.exe
  C:\Windows\System\JYeFFyZ.exe
  2⤵
  PID:2820
- C:\Windows\System\bwkMGFN.exe
  C:\Windows\System\bwkMGFN.exe
  2⤵
  PID:2788
- C:\Windows\System\etevCaX.exe
  C:\Windows\System\etevCaX.exe
  2⤵
  PID:1416
- C:\Windows\System\qQNBTgE.exe
  C:\Windows\System\qQNBTgE.exe
  2⤵
  PID:1672
- C:\Windows\System\HavhDqJ.exe
  C:\Windows\System\HavhDqJ.exe
  2⤵
  PID:2664
- C:\Windows\System\VJqtIXp.exe
  C:\Windows\System\VJqtIXp.exe
  2⤵
  PID:1264
- C:\Windows\System\lQuQUwf.exe
  C:\Windows\System\lQuQUwf.exe
  2⤵
  PID:2140
- C:\Windows\System\IIxQqkp.exe
  C:\Windows\System\IIxQqkp.exe
  2⤵
  PID:3000
- C:\Windows\System\HYFnAVO.exe
  C:\Windows\System\HYFnAVO.exe
  2⤵
  PID:2476
- C:\Windows\System\haWGHIc.exe
  C:\Windows\System\haWGHIc.exe
  2⤵
  PID:2408
- C:\Windows\System\JJnmPSK.exe
  C:\Windows\System\JJnmPSK.exe
  2⤵
  PID:2960
- C:\Windows\System\eoSJksW.exe
  C:\Windows\System\eoSJksW.exe
  2⤵
  PID:2340
- C:\Windows\System\HfTiJMQ.exe
  C:\Windows\System\HfTiJMQ.exe
  2⤵
  PID:452
- C:\Windows\System\bfXOPeu.exe
  C:\Windows\System\bfXOPeu.exe
  2⤵
  PID:488
- C:\Windows\System\lGOvrFJ.exe
  C:\Windows\System\lGOvrFJ.exe
  2⤵
  PID:1648
- C:\Windows\System\lNUoFrZ.exe
  C:\Windows\System\lNUoFrZ.exe
  2⤵
  PID:2712
- C:\Windows\System\VlAiekn.exe
  C:\Windows\System\VlAiekn.exe
  2⤵
  PID:2640
- C:\Windows\System\VcHzpca.exe
  C:\Windows\System\VcHzpca.exe
  2⤵
  PID:2844
- C:\Windows\System\WgRQryB.exe
  C:\Windows\System\WgRQryB.exe
  2⤵
  PID:1808
- C:\Windows\System\LOejbtP.exe
  C:\Windows\System\LOejbtP.exe
  2⤵
  PID:896
- C:\Windows\System\RwvmJyQ.exe
  C:\Windows\System\RwvmJyQ.exe
  2⤵
  PID:1992
- C:\Windows\System\kYQiqfL.exe
  C:\Windows\System\kYQiqfL.exe
  2⤵
  PID:560
- C:\Windows\System\EBPaMeT.exe
  C:\Windows\System\EBPaMeT.exe
  2⤵
  PID:2668
- C:\Windows\System\ZPSPCBq.exe
  C:\Windows\System\ZPSPCBq.exe
  2⤵
  PID:2696
- C:\Windows\System\mhaprpP.exe
  C:\Windows\System\mhaprpP.exe
  2⤵
  PID:2632
- C:\Windows\System\eGEeFtw.exe
  C:\Windows\System\eGEeFtw.exe
  2⤵
  PID:1684
- C:\Windows\System\gvKoEpq.exe
  C:\Windows\System\gvKoEpq.exe
  2⤵
  PID:1452
- C:\Windows\System\qqZccNS.exe
  C:\Windows\System\qqZccNS.exe
  2⤵
  PID:1208
- C:\Windows\System\VMLGxkY.exe
  C:\Windows\System\VMLGxkY.exe
  2⤵
  PID:1076
- C:\Windows\System\MLtXwSB.exe
  C:\Windows\System\MLtXwSB.exe
  2⤵
  PID:2920
- C:\Windows\System\ulePMSq.exe
  C:\Windows\System\ulePMSq.exe
  2⤵
  PID:2768
- C:\Windows\System\ClkkRfT.exe
  C:\Windows\System\ClkkRfT.exe
  2⤵
  PID:1948
- C:\Windows\System\PTceAid.exe
  C:\Windows\System\PTceAid.exe
  2⤵
  PID:760
- C:\Windows\System\obFJNTb.exe
  C:\Windows\System\obFJNTb.exe
  2⤵
  PID:1464
- C:\Windows\System\rrEZjFx.exe
  C:\Windows\System\rrEZjFx.exe
  2⤵
  PID:2068
- C:\Windows\System\fwpqZil.exe
  C:\Windows\System\fwpqZil.exe
  2⤵
  PID:1668
- C:\Windows\System\dVdotqB.exe
  C:\Windows\System\dVdotqB.exe
  2⤵
  PID:860
- C:\Windows\System\MWVTezg.exe
  C:\Windows\System\MWVTezg.exe
  2⤵
  PID:888
- C:\Windows\System\AMrydYX.exe
  C:\Windows\System\AMrydYX.exe
  2⤵
  PID:1996
- C:\Windows\System\JbknjCH.exe
  C:\Windows\System\JbknjCH.exe
  2⤵
  PID:2144
- C:\Windows\System\tFwdDTz.exe
  C:\Windows\System\tFwdDTz.exe
  2⤵
  PID:2544
- C:\Windows\System\lEaZisj.exe
  C:\Windows\System\lEaZisj.exe
  2⤵
  PID:1548
- C:\Windows\System\fKiOmFJ.exe
  C:\Windows\System\fKiOmFJ.exe
  2⤵
  PID:2656
- C:\Windows\System\QNTVZOs.exe
  C:\Windows\System\QNTVZOs.exe
  2⤵
  PID:3084
- C:\Windows\System\xFexDXI.exe
  C:\Windows\System\xFexDXI.exe
  2⤵
  PID:3100
- C:\Windows\System\Rejajpf.exe
  C:\Windows\System\Rejajpf.exe
  2⤵
  PID:3116
- C:\Windows\System\auQbcKR.exe
  C:\Windows\System\auQbcKR.exe
  2⤵
  PID:3132
- C:\Windows\System\mHarYpm.exe
  C:\Windows\System\mHarYpm.exe
  2⤵
  PID:3148
- C:\Windows\System\NeKqfUz.exe
  C:\Windows\System\NeKqfUz.exe
  2⤵
  PID:3164
- C:\Windows\System\yMvFfhY.exe
  C:\Windows\System\yMvFfhY.exe
  2⤵
  PID:3180
- C:\Windows\System\WgwxrSE.exe
  C:\Windows\System\WgwxrSE.exe
  2⤵
  PID:3196
- C:\Windows\System\OnHgGOL.exe
  C:\Windows\System\OnHgGOL.exe
  2⤵
  PID:3216
- C:\Windows\System\EaRLTAd.exe
  C:\Windows\System\EaRLTAd.exe
  2⤵
  PID:3232
- C:\Windows\System\NGCCxeP.exe
  C:\Windows\System\NGCCxeP.exe
  2⤵
  PID:3248
- C:\Windows\System\wChVGXR.exe
  C:\Windows\System\wChVGXR.exe
  2⤵
  PID:3264
- C:\Windows\System\qUmJlcF.exe
  C:\Windows\System\qUmJlcF.exe
  2⤵
  PID:3280
- C:\Windows\System\RgcqyUU.exe
  C:\Windows\System\RgcqyUU.exe
  2⤵
  PID:3296
- C:\Windows\System\CLkKAVQ.exe
  C:\Windows\System\CLkKAVQ.exe
  2⤵
  PID:3312
- C:\Windows\System\TrcHfyt.exe
  C:\Windows\System\TrcHfyt.exe
  2⤵
  PID:3328
- C:\Windows\System\VQKlcPe.exe
  C:\Windows\System\VQKlcPe.exe
  2⤵
  PID:3344
- C:\Windows\System\hZErhUn.exe
  C:\Windows\System\hZErhUn.exe
  2⤵
  PID:3360
- C:\Windows\System\FjNAsQM.exe
  C:\Windows\System\FjNAsQM.exe
  2⤵
  PID:3380
- C:\Windows\System\CCVbveQ.exe
  C:\Windows\System\CCVbveQ.exe
  2⤵
  PID:3400
- C:\Windows\System\mEaRCsC.exe
  C:\Windows\System\mEaRCsC.exe
  2⤵
  PID:3416
- C:\Windows\System\Ntbywdg.exe
  C:\Windows\System\Ntbywdg.exe
  2⤵
  PID:3432
- C:\Windows\System\VAkqCzB.exe
  C:\Windows\System\VAkqCzB.exe
  2⤵
  PID:3448
- C:\Windows\System\fWQCWWH.exe
  C:\Windows\System\fWQCWWH.exe
  2⤵
  PID:3596
- C:\Windows\System\qftQnQh.exe
  C:\Windows\System\qftQnQh.exe
  2⤵
  PID:3680
- C:\Windows\System\luOeHBv.exe
  C:\Windows\System\luOeHBv.exe
  2⤵
  PID:3700
- C:\Windows\System\eBCQitA.exe
  C:\Windows\System\eBCQitA.exe
  2⤵
  PID:3716
- C:\Windows\System\TYjfhDE.exe
  C:\Windows\System\TYjfhDE.exe
  2⤵
  PID:3732
- C:\Windows\System\KktKtjE.exe
  C:\Windows\System\KktKtjE.exe
  2⤵
  PID:3748
- C:\Windows\System\xOsxqfP.exe
  C:\Windows\System\xOsxqfP.exe
  2⤵
  PID:3764
- C:\Windows\System\QLIqzIb.exe
  C:\Windows\System\QLIqzIb.exe
  2⤵
  PID:3780
- C:\Windows\System\pCgtfBK.exe
  C:\Windows\System\pCgtfBK.exe
  2⤵
  PID:3796
- C:\Windows\System\ZduOioB.exe
  C:\Windows\System\ZduOioB.exe
  2⤵
  PID:3812
- C:\Windows\System\ngEKUcR.exe
  C:\Windows\System\ngEKUcR.exe
  2⤵
  PID:3860
- C:\Windows\System\dnXIxZj.exe
  C:\Windows\System\dnXIxZj.exe
  2⤵
  PID:3880
- C:\Windows\System\FZJnVGj.exe
  C:\Windows\System\FZJnVGj.exe
  2⤵
  PID:3896
- C:\Windows\System\iAOzKXQ.exe
  C:\Windows\System\iAOzKXQ.exe
  2⤵
  PID:3912
- C:\Windows\System\TjKGrxl.exe
  C:\Windows\System\TjKGrxl.exe
  2⤵
  PID:3928
- C:\Windows\System\moZQrzS.exe
  C:\Windows\System\moZQrzS.exe
  2⤵
  PID:3944
- C:\Windows\System\LYuwKKx.exe
  C:\Windows\System\LYuwKKx.exe
  2⤵
  PID:3960
- C:\Windows\System\BNLTjRU.exe
  C:\Windows\System\BNLTjRU.exe
  2⤵
  PID:3976
- C:\Windows\System\MNBXArz.exe
  C:\Windows\System\MNBXArz.exe
  2⤵
  PID:3992
- C:\Windows\System\ThokcGx.exe
  C:\Windows\System\ThokcGx.exe
  2⤵
  PID:4008
- C:\Windows\System\wTopBpT.exe
  C:\Windows\System\wTopBpT.exe
  2⤵
  PID:4024
- C:\Windows\System\sCtRYPj.exe
  C:\Windows\System\sCtRYPj.exe
  2⤵
  PID:4040
- C:\Windows\System\FLdUcMK.exe
  C:\Windows\System\FLdUcMK.exe
  2⤵
  PID:4056
- C:\Windows\System\PCfHnZH.exe
  C:\Windows\System\PCfHnZH.exe
  2⤵
  PID:4072
- C:\Windows\System\ZsncbcY.exe
  C:\Windows\System\ZsncbcY.exe
  2⤵
  PID:4088
- C:\Windows\System\kQiEoPq.exe
  C:\Windows\System\kQiEoPq.exe
  2⤵
  PID:1632
- C:\Windows\System\geahzBt.exe
  C:\Windows\System\geahzBt.exe
  2⤵
  PID:2980
- C:\Windows\System\zzYyuSU.exe
  C:\Windows\System\zzYyuSU.exe
  2⤵
  PID:2228
- C:\Windows\System\VETIjjT.exe
  C:\Windows\System\VETIjjT.exe
  2⤵
  PID:2416
- C:\Windows\System\QhtJBXQ.exe
  C:\Windows\System\QhtJBXQ.exe
  2⤵
  PID:3092
- C:\Windows\System\dRwqXbn.exe
  C:\Windows\System\dRwqXbn.exe
  2⤵
  PID:3156
- C:\Windows\System\TiOqrAB.exe
  C:\Windows\System\TiOqrAB.exe
  2⤵
  PID:3228
- C:\Windows\System\OoqQrjp.exe
  C:\Windows\System\OoqQrjp.exe
  2⤵
  PID:3288
- C:\Windows\System\WoNFlsg.exe
  C:\Windows\System\WoNFlsg.exe
  2⤵
  PID:3352
- C:\Windows\System\nxctpQA.exe
  C:\Windows\System\nxctpQA.exe
  2⤵
  PID:2236
- C:\Windows\System\zvsBHlH.exe
  C:\Windows\System\zvsBHlH.exe
  2⤵
  PID:1792
- C:\Windows\System\EzaAkQA.exe
  C:\Windows\System\EzaAkQA.exe
  2⤵
  PID:3424
- C:\Windows\System\aHvkgeS.exe
  C:\Windows\System\aHvkgeS.exe
  2⤵
  PID:3464
- C:\Windows\System\PdUvCpG.exe
  C:\Windows\System\PdUvCpG.exe
  2⤵
  PID:3112
- C:\Windows\System\oysUHmY.exe
  C:\Windows\System\oysUHmY.exe
  2⤵
  PID:3176
- C:\Windows\System\wiUhLIL.exe
  C:\Windows\System\wiUhLIL.exe
  2⤵
  PID:3244
- C:\Windows\System\QJJBRWm.exe
  C:\Windows\System\QJJBRWm.exe
  2⤵
  PID:3336
- C:\Windows\System\FphTxjn.exe
  C:\Windows\System\FphTxjn.exe
  2⤵
  PID:3376
- C:\Windows\System\vUAUzLu.exe
  C:\Windows\System\vUAUzLu.exe
  2⤵
  PID:3444
- C:\Windows\System\NTPzmlX.exe
  C:\Windows\System\NTPzmlX.exe
  2⤵
  PID:3612
- C:\Windows\System\vEhcqhH.exe
  C:\Windows\System\vEhcqhH.exe
  2⤵
  PID:3476
- C:\Windows\System\VNPFbqN.exe
  C:\Windows\System\VNPFbqN.exe
  2⤵
  PID:3488
- C:\Windows\System\pMPLMMY.exe
  C:\Windows\System\pMPLMMY.exe
  2⤵
  PID:3504
- C:\Windows\System\NMAcaTB.exe
  C:\Windows\System\NMAcaTB.exe
  2⤵
  PID:3520
- C:\Windows\System\ULckLIq.exe
  C:\Windows\System\ULckLIq.exe
  2⤵
  PID:3536
- C:\Windows\System\zUjgCUZ.exe
  C:\Windows\System\zUjgCUZ.exe
  2⤵
  PID:3552
- C:\Windows\System\GApnrnt.exe
  C:\Windows\System\GApnrnt.exe
  2⤵
  PID:3572
- C:\Windows\System\OoMvhqU.exe
  C:\Windows\System\OoMvhqU.exe
  2⤵
  PID:3584
- C:\Windows\System\HnXCuLW.exe
  C:\Windows\System\HnXCuLW.exe
  2⤵
  PID:2936
- C:\Windows\System\ZkARxHV.exe
  C:\Windows\System\ZkARxHV.exe
  2⤵
  PID:1412
- C:\Windows\System\LsLnagI.exe
  C:\Windows\System\LsLnagI.exe
  2⤵
  PID:3708
- C:\Windows\System\GOKEcFx.exe
  C:\Windows\System\GOKEcFx.exe
  2⤵
  PID:3772
- C:\Windows\System\xNmbfwd.exe
  C:\Windows\System\xNmbfwd.exe
  2⤵
  PID:3728
- C:\Windows\System\uLFXyJX.exe
  C:\Windows\System\uLFXyJX.exe
  2⤵
  PID:3792
- C:\Windows\System\FFuUDLp.exe
  C:\Windows\System\FFuUDLp.exe
  2⤵
  PID:3724
- C:\Windows\System\AiCLuhn.exe
  C:\Windows\System\AiCLuhn.exe
  2⤵
  PID:3844
- C:\Windows\System\BOBPgoR.exe
  C:\Windows\System\BOBPgoR.exe
  2⤵
  PID:2056
- C:\Windows\System\ZrzlHXL.exe
  C:\Windows\System\ZrzlHXL.exe
  2⤵
  PID:2816
- C:\Windows\System\WGoIskr.exe
  C:\Windows\System\WGoIskr.exe
  2⤵
  PID:3936
- C:\Windows\System\JkpEulm.exe
  C:\Windows\System\JkpEulm.exe
  2⤵
  PID:3904
- C:\Windows\System\goNCbzV.exe
  C:\Windows\System\goNCbzV.exe
  2⤵
  PID:4000
- C:\Windows\System\TTScXav.exe
  C:\Windows\System\TTScXav.exe
  2⤵
  PID:4064
- C:\Windows\System\XavFOVT.exe
  C:\Windows\System\XavFOVT.exe
  2⤵
  PID:1176
- C:\Windows\System\ZjkbLPY.exe
  C:\Windows\System\ZjkbLPY.exe
  2⤵
  PID:3372
- C:\Windows\System\RofVygQ.exe
  C:\Windows\System\RofVygQ.exe
  2⤵
  PID:3512
- C:\Windows\System\nJhLOwt.exe
  C:\Windows\System\nJhLOwt.exe
  2⤵
  PID:3672
- C:\Windows\System\jyqZFpl.exe
  C:\Windows\System\jyqZFpl.exe
  2⤵
  PID:1752
- C:\Windows\System\fQDqGye.exe
  C:\Windows\System\fQDqGye.exe
  2⤵
  PID:4036
- C:\Windows\System\zBKMNsb.exe
  C:\Windows\System\zBKMNsb.exe
  2⤵
  PID:3324
- C:\Windows\System\NURGVZc.exe
  C:\Windows\System\NURGVZc.exe
  2⤵
  PID:3824
- C:\Windows\System\MvZjCvs.exe
  C:\Windows\System\MvZjCvs.exe
  2⤵
  PID:3460
- C:\Windows\System\UPlionj.exe
  C:\Windows\System\UPlionj.exe
  2⤵
  PID:3304
- C:\Windows\System\UYWNZab.exe
  C:\Windows\System\UYWNZab.exe
  2⤵
  PID:3468
- C:\Windows\System\FirICYL.exe
  C:\Windows\System\FirICYL.exe
  2⤵
  PID:3560
- C:\Windows\System\vYDMvht.exe
  C:\Windows\System\vYDMvht.exe
  2⤵
  PID:3696
- C:\Windows\System\JBtuhtW.exe
  C:\Windows\System\JBtuhtW.exe
  2⤵
  PID:3868
- C:\Windows\System\bWreFhc.exe
  C:\Windows\System\bWreFhc.exe
  2⤵
  PID:1212
- C:\Windows\System\qoTjseU.exe
  C:\Windows\System\qoTjseU.exe
  2⤵
  PID:1604
- C:\Windows\System\XTOzVAo.exe
  C:\Windows\System\XTOzVAo.exe
  2⤵
  PID:2156
- C:\Windows\System\nIhNbgZ.exe
  C:\Windows\System\nIhNbgZ.exe
  2⤵
  PID:3988
- C:\Windows\System\vxhlIEw.exe
  C:\Windows\System\vxhlIEw.exe
  2⤵
  PID:3108
- C:\Windows\System\pVZsEFW.exe
  C:\Windows\System\pVZsEFW.exe
  2⤵
  PID:1520
- C:\Windows\System\clmbdGk.exe
  C:\Windows\System\clmbdGk.exe
  2⤵
  PID:4048
- C:\Windows\System\kKKWCnd.exe
  C:\Windows\System\kKKWCnd.exe
  2⤵
  PID:1608
- C:\Windows\System\aMAchMc.exe
  C:\Windows\System\aMAchMc.exe
  2⤵
  PID:3124
- C:\Windows\System\CTtKSmo.exe
  C:\Windows\System\CTtKSmo.exe
  2⤵
  PID:2732
- C:\Windows\System\nnaHvhj.exe
  C:\Windows\System\nnaHvhj.exe
  2⤵
  PID:3260
- C:\Windows\System\rxjQgFS.exe
  C:\Windows\System\rxjQgFS.exe
  2⤵
  PID:1512
- C:\Windows\System\LNhMIDV.exe
  C:\Windows\System\LNhMIDV.exe
  2⤵
  PID:3576
- C:\Windows\System\cnrAxqa.exe
  C:\Windows\System\cnrAxqa.exe
  2⤵
  PID:2692
- C:\Windows\System\CcwhLHf.exe
  C:\Windows\System\CcwhLHf.exe
  2⤵
  PID:3840
- C:\Windows\System\aNpEfnE.exe
  C:\Windows\System\aNpEfnE.exe
  2⤵
  PID:3876
- C:\Windows\System\syIbCeR.exe
  C:\Windows\System\syIbCeR.exe
  2⤵
  PID:2440
- C:\Windows\System\IwjOKyp.exe
  C:\Windows\System\IwjOKyp.exe
  2⤵
  PID:2468
- C:\Windows\System\jQMRvDj.exe
  C:\Windows\System\jQMRvDj.exe
  2⤵
  PID:2020
- C:\Windows\System\DRhJFBK.exe
  C:\Windows\System\DRhJFBK.exe
  2⤵
  PID:2488
- C:\Windows\System\rMsSFpi.exe
  C:\Windows\System\rMsSFpi.exe
  2⤵
  PID:2316
- C:\Windows\System\uCLKElK.exe
  C:\Windows\System\uCLKElK.exe
  2⤵
  PID:3528
- C:\Windows\System\NOCvdxG.exe
  C:\Windows\System\NOCvdxG.exe
  2⤵
  PID:1796
- C:\Windows\System\mqlnQVZ.exe
  C:\Windows\System\mqlnQVZ.exe
  2⤵
  PID:3892
- C:\Windows\System\coPwvHn.exe
  C:\Windows\System\coPwvHn.exe
  2⤵
  PID:3272
- C:\Windows\System\FgcBgYl.exe
  C:\Windows\System\FgcBgYl.exe
  2⤵
  PID:2984
- C:\Windows\System\XvDNCFB.exe
  C:\Windows\System\XvDNCFB.exe
  2⤵
  PID:3128
- C:\Windows\System\MOvVdxE.exe
  C:\Windows\System\MOvVdxE.exe
  2⤵
  PID:2028
- C:\Windows\System\BKGqrrw.exe
  C:\Windows\System\BKGqrrw.exe
  2⤵
  PID:3540
- C:\Windows\System\jcupujn.exe
  C:\Windows\System\jcupujn.exe
  2⤵
  PID:3836
- C:\Windows\System\IjrxKTN.exe
  C:\Windows\System\IjrxKTN.exe
  2⤵
  PID:4016
- C:\Windows\System\yNadYDl.exe
  C:\Windows\System\yNadYDl.exe
  2⤵
  PID:3308
- C:\Windows\System\pNtDyOG.exe
  C:\Windows\System\pNtDyOG.exe
  2⤵
  PID:1812
- C:\Windows\System\xFRsvFs.exe
  C:\Windows\System\xFRsvFs.exe
  2⤵
  PID:3428
- C:\Windows\System\BCqhgmE.exe
  C:\Windows\System\BCqhgmE.exe
  2⤵
  PID:2032
- C:\Windows\System\LkTsmiu.exe
  C:\Windows\System\LkTsmiu.exe
  2⤵
  PID:4080
- C:\Windows\System\AvLlCuj.exe
  C:\Windows\System\AvLlCuj.exe
  2⤵
  PID:4084
- C:\Windows\System\hlimLzb.exe
  C:\Windows\System\hlimLzb.exe
  2⤵
  PID:3744
- C:\Windows\System\LpmPpre.exe
  C:\Windows\System\LpmPpre.exe
  2⤵
  PID:3532
- C:\Windows\System\dqyaxyZ.exe
  C:\Windows\System\dqyaxyZ.exe
  2⤵
  PID:2452
- C:\Windows\System\olWwWvK.exe
  C:\Windows\System\olWwWvK.exe
  2⤵
  PID:3440
- C:\Windows\System\VumzHDZ.exe
  C:\Windows\System\VumzHDZ.exe
  2⤵
  PID:2480
- C:\Windows\System\uAEitpq.exe
  C:\Windows\System\uAEitpq.exe
  2⤵
  PID:3972
- C:\Windows\System\VBDDvxD.exe
  C:\Windows\System\VBDDvxD.exe
  2⤵
  PID:1248
- C:\Windows\System\cMNfdfU.exe
  C:\Windows\System\cMNfdfU.exe
  2⤵
  PID:2580
- C:\Windows\System\mFxyVwq.exe
  C:\Windows\System\mFxyVwq.exe
  2⤵
  PID:3920
- C:\Windows\System\efEmOjX.exe
  C:\Windows\System\efEmOjX.exe
  2⤵
  PID:2684
- C:\Windows\System\Tebzxrq.exe
  C:\Windows\System\Tebzxrq.exe
  2⤵
  PID:4020
- C:\Windows\System\iUMwhgf.exe
  C:\Windows\System\iUMwhgf.exe
  2⤵
  PID:3392
- C:\Windows\System\UERxtSV.exe
  C:\Windows\System\UERxtSV.exe
  2⤵
  PID:2880
- C:\Windows\System\CrrUaXm.exe
  C:\Windows\System\CrrUaXm.exe
  2⤵
  PID:3208
- C:\Windows\System\xQxauQK.exe
  C:\Windows\System\xQxauQK.exe
  2⤵
  PID:4100
- C:\Windows\System\RlPKjoI.exe
  C:\Windows\System\RlPKjoI.exe
  2⤵
  PID:4120
- C:\Windows\System\TQQPKcT.exe
  C:\Windows\System\TQQPKcT.exe
  2⤵
  PID:4140
- C:\Windows\System\UnEMsaI.exe
  C:\Windows\System\UnEMsaI.exe
  2⤵
  PID:4156
- C:\Windows\System\aSxMYSt.exe
  C:\Windows\System\aSxMYSt.exe
  2⤵
  PID:4180
- C:\Windows\System\YEWtZSq.exe
  C:\Windows\System\YEWtZSq.exe
  2⤵
  PID:4200
- C:\Windows\System\KyuiHOM.exe
  C:\Windows\System\KyuiHOM.exe
  2⤵
  PID:4224
- C:\Windows\System\sAtwygh.exe
  C:\Windows\System\sAtwygh.exe
  2⤵
  PID:4276
- C:\Windows\System\ebxlcSR.exe
  C:\Windows\System\ebxlcSR.exe
  2⤵
  PID:4292
- C:\Windows\System\noJcYfG.exe
  C:\Windows\System\noJcYfG.exe
  2⤵
  PID:4308
- C:\Windows\System\FdxbVHN.exe
  C:\Windows\System\FdxbVHN.exe
  2⤵
  PID:4324
- C:\Windows\System\vVAjnlS.exe
  C:\Windows\System\vVAjnlS.exe
  2⤵
  PID:4340
- C:\Windows\System\kqydHOH.exe
  C:\Windows\System\kqydHOH.exe
  2⤵
  PID:4364
- C:\Windows\System\UhkFktd.exe
  C:\Windows\System\UhkFktd.exe
  2⤵
  PID:4388
- C:\Windows\System\gOpGJBI.exe
  C:\Windows\System\gOpGJBI.exe
  2⤵
  PID:4464
- C:\Windows\System\glGAakq.exe
  C:\Windows\System\glGAakq.exe
  2⤵
  PID:4480
- C:\Windows\System\VwiMPga.exe
  C:\Windows\System\VwiMPga.exe
  2⤵
  PID:4496
- C:\Windows\System\jOImvcF.exe
  C:\Windows\System\jOImvcF.exe
  2⤵
  PID:4512
- C:\Windows\System\eEwVYNi.exe
  C:\Windows\System\eEwVYNi.exe
  2⤵
  PID:4528
- C:\Windows\System\IzSXFfr.exe
  C:\Windows\System\IzSXFfr.exe
  2⤵
  PID:4560
- C:\Windows\System\kALZgMv.exe
  C:\Windows\System\kALZgMv.exe
  2⤵
  PID:4576
- C:\Windows\System\LvLrDHd.exe
  C:\Windows\System\LvLrDHd.exe
  2⤵
  PID:4592
- C:\Windows\System\zCoQGtK.exe
  C:\Windows\System\zCoQGtK.exe
  2⤵
  PID:4608
- C:\Windows\System\tFFxfqq.exe
  C:\Windows\System\tFFxfqq.exe
  2⤵
  PID:4628
- C:\Windows\System\MtwYFjE.exe
  C:\Windows\System\MtwYFjE.exe
  2⤵
  PID:4644
- C:\Windows\System\YBjMXFq.exe
  C:\Windows\System\YBjMXFq.exe
  2⤵
  PID:4660
- C:\Windows\System\wxgkXIa.exe
  C:\Windows\System\wxgkXIa.exe
  2⤵
  PID:4676
- C:\Windows\System\PYWtYVq.exe
  C:\Windows\System\PYWtYVq.exe
  2⤵
  PID:4692
- C:\Windows\System\IkiitGg.exe
  C:\Windows\System\IkiitGg.exe
  2⤵
  PID:4708
- C:\Windows\System\GsoVIRU.exe
  C:\Windows\System\GsoVIRU.exe
  2⤵
  PID:4724
- C:\Windows\System\pSOHtWg.exe
  C:\Windows\System\pSOHtWg.exe
  2⤵
  PID:4744
- C:\Windows\System\pBbjyXS.exe
  C:\Windows\System\pBbjyXS.exe
  2⤵
  PID:4804
- C:\Windows\System\VBIujKT.exe
  C:\Windows\System\VBIujKT.exe
  2⤵
  PID:4820
- C:\Windows\System\yBjCuSa.exe
  C:\Windows\System\yBjCuSa.exe
  2⤵
  PID:4836
- C:\Windows\System\bHzPpcy.exe
  C:\Windows\System\bHzPpcy.exe
  2⤵
  PID:4852
- C:\Windows\System\mpYycxj.exe
  C:\Windows\System\mpYycxj.exe
  2⤵
  PID:4868
- C:\Windows\System\mWnaQQD.exe
  C:\Windows\System\mWnaQQD.exe
  2⤵
  PID:4884
- C:\Windows\System\ailjJNB.exe
  C:\Windows\System\ailjJNB.exe
  2⤵
  PID:4900
- C:\Windows\System\cyTKsqB.exe
  C:\Windows\System\cyTKsqB.exe
  2⤵
  PID:4916
- C:\Windows\System\HPQmnRY.exe
  C:\Windows\System\HPQmnRY.exe
  2⤵
  PID:4932
- C:\Windows\System\BnLMSlH.exe
  C:\Windows\System\BnLMSlH.exe
  2⤵
  PID:4952
- C:\Windows\System\BdCKYUq.exe
  C:\Windows\System\BdCKYUq.exe
  2⤵
  PID:4968
- C:\Windows\System\ZvEPofV.exe
  C:\Windows\System\ZvEPofV.exe
  2⤵
  PID:4984
- C:\Windows\System\VMfumjJ.exe
  C:\Windows\System\VMfumjJ.exe
  2⤵
  PID:5000
- C:\Windows\System\nTaLpqS.exe
  C:\Windows\System\nTaLpqS.exe
  2⤵
  PID:5016
- C:\Windows\System\miWhlVB.exe
  C:\Windows\System\miWhlVB.exe
  2⤵
  PID:5032
- C:\Windows\System\CYDDJyc.exe
  C:\Windows\System\CYDDJyc.exe
  2⤵
  PID:5048
- C:\Windows\System\whNVXEi.exe
  C:\Windows\System\whNVXEi.exe
  2⤵
  PID:4108
- C:\Windows\System\OLmBwul.exe
  C:\Windows\System\OLmBwul.exe
  2⤵
  PID:3480
- C:\Windows\System\LYIVsGQ.exe
  C:\Windows\System\LYIVsGQ.exe
  2⤵
  PID:4148
- C:\Windows\System\rzudEfV.exe
  C:\Windows\System\rzudEfV.exe
  2⤵
  PID:4168
- C:\Windows\System\bDViifm.exe
  C:\Windows\System\bDViifm.exe
  2⤵
  PID:4232
- C:\Windows\System\eLIrwmp.exe
  C:\Windows\System\eLIrwmp.exe
  2⤵
  PID:4236
- C:\Windows\System\aryNLFd.exe
  C:\Windows\System\aryNLFd.exe
  2⤵
  PID:4288
- C:\Windows\System\IRnGOGa.exe
  C:\Windows\System\IRnGOGa.exe
  2⤵
  PID:4336
- C:\Windows\System\sAJVXaX.exe
  C:\Windows\System\sAJVXaX.exe
  2⤵
  PID:4360
- C:\Windows\System\SGkudOa.exe
  C:\Windows\System\SGkudOa.exe
  2⤵
  PID:4376
- C:\Windows\System\VnkItMT.exe
  C:\Windows\System\VnkItMT.exe
  2⤵
  PID:4380
- C:\Windows\System\BUJRKLd.exe
  C:\Windows\System\BUJRKLd.exe
  2⤵
  PID:4412
- C:\Windows\System\JfETSSa.exe
  C:\Windows\System\JfETSSa.exe
  2⤵
  PID:4436
- C:\Windows\System\zYkIvnm.exe
  C:\Windows\System\zYkIvnm.exe
  2⤵
  PID:4440
- C:\Windows\System\zKYlchE.exe
  C:\Windows\System\zKYlchE.exe
  2⤵
  PID:4472
- C:\Windows\System\XvEVwwp.exe
  C:\Windows\System\XvEVwwp.exe
  2⤵
  PID:4524
- C:\Windows\System\SJxMZtm.exe
  C:\Windows\System\SJxMZtm.exe
  2⤵
  PID:4616
- C:\Windows\System\RQGRLie.exe
  C:\Windows\System\RQGRLie.exe
  2⤵
  PID:4656
- C:\Windows\System\OPRFyed.exe
  C:\Windows\System\OPRFyed.exe
  2⤵
  PID:4736
- C:\Windows\System\sPWtZaE.exe
  C:\Windows\System\sPWtZaE.exe
  2⤵
  PID:4732
- C:\Windows\System\QQaOvIa.exe
  C:\Windows\System\QQaOvIa.exe
  2⤵
  PID:4668
- C:\Windows\System\OtYUOpV.exe
  C:\Windows\System\OtYUOpV.exe
  2⤵
  PID:4768
- C:\Windows\System\EJmqaAY.exe
  C:\Windows\System\EJmqaAY.exe
  2⤵
  PID:4784
- C:\Windows\System\rQPZCAU.exe
  C:\Windows\System\rQPZCAU.exe
  2⤵
  PID:2096
- C:\Windows\System\NmkTRza.exe
  C:\Windows\System\NmkTRza.exe
  2⤵
  PID:4816
- C:\Windows\System\nypXNox.exe
  C:\Windows\System\nypXNox.exe
  2⤵
  PID:4908
- C:\Windows\System\DhpUmIS.exe
  C:\Windows\System\DhpUmIS.exe
  2⤵
  PID:4848
- C:\Windows\System\GdKkbzL.exe
  C:\Windows\System\GdKkbzL.exe
  2⤵
  PID:5008
- C:\Windows\System\qujTFNo.exe
  C:\Windows\System\qujTFNo.exe
  2⤵
  PID:5056
- C:\Windows\System\AbZfcej.exe
  C:\Windows\System\AbZfcej.exe
  2⤵
  PID:4924
- C:\Windows\System\zbRzgfF.exe
  C:\Windows\System\zbRzgfF.exe
  2⤵
  PID:4996
- C:\Windows\System\cjkePkR.exe
  C:\Windows\System\cjkePkR.exe
  2⤵
  PID:5060
- C:\Windows\System\GcAHtHh.exe
  C:\Windows\System\GcAHtHh.exe
  2⤵
  PID:5080
- C:\Windows\System\GufeXBJ.exe
  C:\Windows\System\GufeXBJ.exe
  2⤵
  PID:5092
- C:\Windows\System\xqNtiuO.exe
  C:\Windows\System\xqNtiuO.exe
  2⤵
  PID:5112
- C:\Windows\System\skZROsy.exe
  C:\Windows\System\skZROsy.exe
  2⤵
  PID:3808
- C:\Windows\System\TTlmrBA.exe
  C:\Windows\System\TTlmrBA.exe
  2⤵
  PID:4164
- C:\Windows\System\VHWPNrB.exe
  C:\Windows\System\VHWPNrB.exe
  2⤵
  PID:4208
- C:\Windows\System\LRNxDqX.exe
  C:\Windows\System\LRNxDqX.exe
  2⤵
  PID:4256
- C:\Windows\System\fwHtvUy.exe
  C:\Windows\System\fwHtvUy.exe
  2⤵
  PID:4240
- C:\Windows\System\HjLZWqt.exe
  C:\Windows\System\HjLZWqt.exe
  2⤵
  PID:4284
- C:\Windows\System\InRnsKk.exe
  C:\Windows\System\InRnsKk.exe
  2⤵
  PID:4372
- C:\Windows\System\hvCGgKU.exe
  C:\Windows\System\hvCGgKU.exe
  2⤵
  PID:4504
- C:\Windows\System\BATVYEN.exe
  C:\Windows\System\BATVYEN.exe
  2⤵
  PID:4320
- C:\Windows\System\IAkEKxH.exe
  C:\Windows\System\IAkEKxH.exe
  2⤵
  PID:4460
- C:\Windows\System\GHyyffg.exe
  C:\Windows\System\GHyyffg.exe
  2⤵
  PID:4536
- C:\Windows\System\qTgaYAa.exe
  C:\Windows\System\qTgaYAa.exe
  2⤵
  PID:4552
- C:\Windows\System\ImWzgZJ.exe
  C:\Windows\System\ImWzgZJ.exe
  2⤵
  PID:4568
- C:\Windows\System\HUEyNFy.exe
  C:\Windows\System\HUEyNFy.exe
  2⤵
  PID:4740
- C:\Windows\System\ScjOmcr.exe
  C:\Windows\System\ScjOmcr.exe
  2⤵
  PID:4720
- C:\Windows\System\OzhDBBf.exe
  C:\Windows\System\OzhDBBf.exe
  2⤵
  PID:4684
- C:\Windows\System\YxmedCe.exe
  C:\Windows\System\YxmedCe.exe
  2⤵
  PID:4844
- C:\Windows\System\GjzFppi.exe
  C:\Windows\System\GjzFppi.exe
  2⤵
  PID:4832
- C:\Windows\System\mIMWyih.exe
  C:\Windows\System\mIMWyih.exe
  2⤵
  PID:4896
- C:\Windows\System\YPUGlnK.exe
  C:\Windows\System\YPUGlnK.exe
  2⤵
  PID:5100
- C:\Windows\System\GHqHisj.exe
  C:\Windows\System\GHqHisj.exe
  2⤵
  PID:5068
- C:\Windows\System\FfXGwYD.exe
  C:\Windows\System\FfXGwYD.exe
  2⤵
  PID:4216
- C:\Windows\System\KbzGArB.exe
  C:\Windows\System\KbzGArB.exe
  2⤵
  PID:4416
- C:\Windows\System\WkfbfLz.exe
  C:\Windows\System\WkfbfLz.exe
  2⤵
  PID:4600
- C:\Windows\System\gojHmxD.exe
  C:\Windows\System\gojHmxD.exe
  2⤵
  PID:4776
- C:\Windows\System\CczUiQD.exe
  C:\Windows\System\CczUiQD.exe
  2⤵
  PID:4980
- C:\Windows\System\KlkzyPH.exe
  C:\Windows\System\KlkzyPH.exe
  2⤵
  PID:4260
- C:\Windows\System\VxzAWNy.exe
  C:\Windows\System\VxzAWNy.exe
  2⤵
  PID:4396
- C:\Windows\System\KKaSgUr.exe
  C:\Windows\System\KKaSgUr.exe
  2⤵
  PID:4588
- C:\Windows\System\xIneTMR.exe
  C:\Windows\System\xIneTMR.exe
  2⤵
  PID:4548
- C:\Windows\System\hVBZInj.exe
  C:\Windows\System\hVBZInj.exe
  2⤵
  PID:4944
- C:\Windows\System\MxAjbam.exe
  C:\Windows\System\MxAjbam.exe
  2⤵
  PID:5028
- C:\Windows\System\SNodYFT.exe
  C:\Windows\System\SNodYFT.exe
  2⤵
  PID:4964
- C:\Windows\System\iNFCgjs.exe
  C:\Windows\System\iNFCgjs.exe
  2⤵
  PID:4132
- C:\Windows\System\zFkZTNp.exe
  C:\Windows\System\zFkZTNp.exe
  2⤵
  PID:4540
- C:\Windows\System\IYbJpBS.exe
  C:\Windows\System\IYbJpBS.exe
  2⤵
  PID:4780
- C:\Windows\System\CicRiVl.exe
  C:\Windows\System\CicRiVl.exe
  2⤵
  PID:4172
- C:\Windows\System\nsUiMmY.exe
  C:\Windows\System\nsUiMmY.exe
  2⤵
  PID:4812
- C:\Windows\System\FaJuoDG.exe
  C:\Windows\System\FaJuoDG.exe
  2⤵
  PID:4624
- C:\Windows\System\HLlbIIj.exe
  C:\Windows\System\HLlbIIj.exe
  2⤵
  PID:5124
- C:\Windows\System\FrXFHIY.exe
  C:\Windows\System\FrXFHIY.exe
  2⤵
  PID:5140
- C:\Windows\System\MKggaOe.exe
  C:\Windows\System\MKggaOe.exe
  2⤵
  PID:5156
- C:\Windows\System\onKSQWK.exe
  C:\Windows\System\onKSQWK.exe
  2⤵
  PID:5172
- C:\Windows\System\vnlbErq.exe
  C:\Windows\System\vnlbErq.exe
  2⤵
  PID:5188
- C:\Windows\System\iJoxwSv.exe
  C:\Windows\System\iJoxwSv.exe
  2⤵
  PID:5208
- C:\Windows\System\TsYempW.exe
  C:\Windows\System\TsYempW.exe
  2⤵
  PID:5224
- C:\Windows\System\TqoLoow.exe
  C:\Windows\System\TqoLoow.exe
  2⤵
  PID:5240
- C:\Windows\System\VBqRBHN.exe
  C:\Windows\System\VBqRBHN.exe
  2⤵
  PID:5256
- C:\Windows\System\eImZTHT.exe
  C:\Windows\System\eImZTHT.exe
  2⤵
  PID:5272
- C:\Windows\System\kLZRkjK.exe
  C:\Windows\System\kLZRkjK.exe
  2⤵
  PID:5288
- C:\Windows\System\bBKlaDW.exe
  C:\Windows\System\bBKlaDW.exe
  2⤵
  PID:5304
- C:\Windows\System\rgCuxWA.exe
  C:\Windows\System\rgCuxWA.exe
  2⤵
  PID:5320
- C:\Windows\System\WzEcqeR.exe
  C:\Windows\System\WzEcqeR.exe
  2⤵
  PID:5336
- C:\Windows\System\gFMjMdU.exe
  C:\Windows\System\gFMjMdU.exe
  2⤵
  PID:5352
- C:\Windows\System\fLtlbAb.exe
  C:\Windows\System\fLtlbAb.exe
  2⤵
  PID:5368
- C:\Windows\System\wDrareN.exe
  C:\Windows\System\wDrareN.exe
  2⤵
  PID:5384
- C:\Windows\System\MGUHkXt.exe
  C:\Windows\System\MGUHkXt.exe
  2⤵
  PID:5400
- C:\Windows\System\IZJxMuR.exe
  C:\Windows\System\IZJxMuR.exe
  2⤵
  PID:5416
- C:\Windows\System\aaqNcso.exe
  C:\Windows\System\aaqNcso.exe
  2⤵
  PID:5432
- C:\Windows\System\ygmOesX.exe
  C:\Windows\System\ygmOesX.exe
  2⤵
  PID:5452
- C:\Windows\System\UWSVeRR.exe
  C:\Windows\System\UWSVeRR.exe
  2⤵
  PID:5468
- C:\Windows\System\hUxnQtD.exe
  C:\Windows\System\hUxnQtD.exe
  2⤵
  PID:5484
- C:\Windows\System\XTxhNGN.exe
  C:\Windows\System\XTxhNGN.exe
  2⤵
  PID:5500
- C:\Windows\System\okQGnjn.exe
  C:\Windows\System\okQGnjn.exe
  2⤵
  PID:5516
- C:\Windows\System\zxdagyS.exe
  C:\Windows\System\zxdagyS.exe
  2⤵
  PID:5648
- C:\Windows\System\eJkdhAr.exe
  C:\Windows\System\eJkdhAr.exe
  2⤵
  PID:5664
- C:\Windows\System\YDbZpRc.exe
  C:\Windows\System\YDbZpRc.exe
  2⤵
  PID:5680
- C:\Windows\System\GBfArGz.exe
  C:\Windows\System\GBfArGz.exe
  2⤵
  PID:5696
- C:\Windows\System\zQSCtPT.exe
  C:\Windows\System\zQSCtPT.exe
  2⤵
  PID:5712
- C:\Windows\System\fRbTclR.exe
  C:\Windows\System\fRbTclR.exe
  2⤵
  PID:5728
- C:\Windows\System\LpPaPZJ.exe
  C:\Windows\System\LpPaPZJ.exe
  2⤵
  PID:5744
- C:\Windows\System\MkoOJRR.exe
  C:\Windows\System\MkoOJRR.exe
  2⤵
  PID:5760
- C:\Windows\System\noEkrDE.exe
  C:\Windows\System\noEkrDE.exe
  2⤵
  PID:5804
- C:\Windows\System\cJrLJRC.exe
  C:\Windows\System\cJrLJRC.exe
  2⤵
  PID:5820
- C:\Windows\System\KmYXUEM.exe
  C:\Windows\System\KmYXUEM.exe
  2⤵
  PID:5836
- C:\Windows\System\ymtrUMN.exe
  C:\Windows\System\ymtrUMN.exe
  2⤵
  PID:5852
- C:\Windows\System\CpJzlSg.exe
  C:\Windows\System\CpJzlSg.exe
  2⤵
  PID:5872
- C:\Windows\System\eqrqqPa.exe
  C:\Windows\System\eqrqqPa.exe
  2⤵
  PID:5888
- C:\Windows\System\mCjjuec.exe
  C:\Windows\System\mCjjuec.exe
  2⤵
  PID:5904
- C:\Windows\System\HCAuvUH.exe
  C:\Windows\System\HCAuvUH.exe
  2⤵
  PID:5920
- C:\Windows\System\LnOmpmu.exe
  C:\Windows\System\LnOmpmu.exe
  2⤵
  PID:5936
- C:\Windows\System\pXhPmWf.exe
  C:\Windows\System\pXhPmWf.exe
  2⤵
  PID:5952
- C:\Windows\System\HaPwQbz.exe
  C:\Windows\System\HaPwQbz.exe
  2⤵
  PID:5972
- C:\Windows\System\JyCgGKB.exe
  C:\Windows\System\JyCgGKB.exe
  2⤵
  PID:5988
- C:\Windows\System\vSlQMPI.exe
  C:\Windows\System\vSlQMPI.exe
  2⤵
  PID:6004
- C:\Windows\System\UvNrQRX.exe
  C:\Windows\System\UvNrQRX.exe
  2⤵
  PID:6020
- C:\Windows\System\uyrETkg.exe
  C:\Windows\System\uyrETkg.exe
  2⤵
  PID:6036
- C:\Windows\System\DMaahRx.exe
  C:\Windows\System\DMaahRx.exe
  2⤵
  PID:6056
- C:\Windows\System\hFVcmdW.exe
  C:\Windows\System\hFVcmdW.exe
  2⤵
  PID:6072
- C:\Windows\System\FKfoDZv.exe
  C:\Windows\System\FKfoDZv.exe
  2⤵
  PID:6088
- C:\Windows\System\SXAdlTo.exe
  C:\Windows\System\SXAdlTo.exe
  2⤵
  PID:4876
- C:\Windows\System\HngtcVt.exe
  C:\Windows\System\HngtcVt.exe
  2⤵
  PID:4196
- C:\Windows\System\lrQdknU.exe
  C:\Windows\System\lrQdknU.exe
  2⤵
  PID:4764
- C:\Windows\System\XEOpBbc.exe
  C:\Windows\System\XEOpBbc.exe
  2⤵
  PID:4052
- C:\Windows\System\rxxhwpT.exe
  C:\Windows\System\rxxhwpT.exe
  2⤵
  PID:5196
- C:\Windows\System\VriWgIP.exe
  C:\Windows\System\VriWgIP.exe
  2⤵
  PID:5236
- C:\Windows\System\qcgrPqd.exe
  C:\Windows\System\qcgrPqd.exe
  2⤵
  PID:5296
- C:\Windows\System\XJwleEp.exe
  C:\Windows\System\XJwleEp.exe
  2⤵
  PID:5364
- C:\Windows\System\KHegEnR.exe
  C:\Windows\System\KHegEnR.exe
  2⤵
  PID:5428
- C:\Windows\System\EgjtVdm.exe
  C:\Windows\System\EgjtVdm.exe
  2⤵
  PID:5496
- C:\Windows\System\vuZPydq.exe
  C:\Windows\System\vuZPydq.exe
  2⤵
  PID:4128
- C:\Windows\System\jpRZcce.exe
  C:\Windows\System\jpRZcce.exe
  2⤵
  PID:5440
- C:\Windows\System\gUewlBl.exe
  C:\Windows\System\gUewlBl.exe
  2⤵
  PID:5076
- C:\Windows\System\mncPjHD.exe
  C:\Windows\System\mncPjHD.exe
  2⤵
  PID:5312
- C:\Windows\System\dPnmGtE.exe
  C:\Windows\System\dPnmGtE.exe
  2⤵
  PID:5380
- C:\Windows\System\lPspoyk.exe
  C:\Windows\System\lPspoyk.exe
  2⤵
  PID:5508
- C:\Windows\System\bnLvtwi.exe
  C:\Windows\System\bnLvtwi.exe
  2⤵
  PID:5216
- C:\Windows\System\zjRnRxO.exe
  C:\Windows\System\zjRnRxO.exe
  2⤵
  PID:5148
- C:\Windows\System\YZbBKRD.exe
  C:\Windows\System\YZbBKRD.exe
  2⤵
  PID:5656
- C:\Windows\System\pXWOfzO.exe
  C:\Windows\System\pXWOfzO.exe
  2⤵
  PID:5568
- C:\Windows\System\ZLddraF.exe
  C:\Windows\System\ZLddraF.exe
  2⤵
  PID:5584
- C:\Windows\System\skArffF.exe
  C:\Windows\System\skArffF.exe
  2⤵
  PID:5600
- C:\Windows\System\NRTicCN.exe
  C:\Windows\System\NRTicCN.exe
  2⤵
  PID:5616
- C:\Windows\System\SxbSnqs.exe
  C:\Windows\System\SxbSnqs.exe
  2⤵
  PID:5672
- C:\Windows\System\lFuMpbS.exe
  C:\Windows\System\lFuMpbS.exe
  2⤵
  PID:5688
- C:\Windows\System\FnfWcdm.exe
  C:\Windows\System\FnfWcdm.exe
  2⤵
  PID:5752
- C:\Windows\System\lqWSTho.exe
  C:\Windows\System\lqWSTho.exe
  2⤵
  PID:5780
- C:\Windows\System\vTOpGaN.exe
  C:\Windows\System\vTOpGaN.exe
  2⤵
  PID:5740
- C:\Windows\System\DzqjfsD.exe
  C:\Windows\System\DzqjfsD.exe
  2⤵
  PID:5796
- C:\Windows\System\HxEOzHt.exe
  C:\Windows\System\HxEOzHt.exe
  2⤵
  PID:5860
- C:\Windows\System\rnhPQVU.exe
  C:\Windows\System\rnhPQVU.exe
  2⤵
  PID:5932
- C:\Windows\System\tTDocwk.exe
  C:\Windows\System\tTDocwk.exe
  2⤵
  PID:5996
- C:\Windows\System\UZNqjCd.exe
  C:\Windows\System\UZNqjCd.exe
  2⤵
  PID:5864
- C:\Windows\System\YDUHgXz.exe
  C:\Windows\System\YDUHgXz.exe
  2⤵
  PID:6124
- C:\Windows\System\jIVwzOH.exe
  C:\Windows\System\jIVwzOH.exe
  2⤵
  PID:6108
- C:\Windows\System\OkPBuNK.exe
  C:\Windows\System\OkPBuNK.exe
  2⤵
  PID:5944
- C:\Windows\System\PTOHsoM.exe
  C:\Windows\System\PTOHsoM.exe
  2⤵
  PID:6044
- C:\Windows\System\bepwwiN.exe
  C:\Windows\System\bepwwiN.exe
  2⤵
  PID:6052
- C:\Windows\System\sqSsdCq.exe
  C:\Windows\System\sqSsdCq.exe
  2⤵
  PID:6100
- C:\Windows\System\jvAckDp.exe
  C:\Windows\System\jvAckDp.exe
  2⤵
  PID:5164
- C:\Windows\System\Xwquoiq.exe
  C:\Windows\System\Xwquoiq.exe
  2⤵
  PID:4304
- C:\Windows\System\EICSROe.exe
  C:\Windows\System\EICSROe.exe
  2⤵
  PID:5328
- C:\Windows\System\tTGeVPL.exe
  C:\Windows\System\tTGeVPL.exe
  2⤵
  PID:5848
- C:\Windows\System\UkxfGKc.exe
  C:\Windows\System\UkxfGKc.exe
  2⤵
  PID:5948
- C:\Windows\System\pokhQGV.exe
  C:\Windows\System\pokhQGV.exe
  2⤵
  PID:4112
- C:\Windows\System\XLsPhjz.exe
  C:\Windows\System\XLsPhjz.exe
  2⤵
  PID:5612
- C:\Windows\System\LAQYehQ.exe
  C:\Windows\System\LAQYehQ.exe
  2⤵
  PID:5580
- C:\Windows\System\XSlZuds.exe
  C:\Windows\System\XSlZuds.exe
  2⤵
  PID:4800
- C:\Windows\System\rbcykik.exe
  C:\Windows\System\rbcykik.exe
  2⤵
  PID:5376
- C:\Windows\System\xfxAaZy.exe
  C:\Windows\System\xfxAaZy.exe
  2⤵
  PID:5132
- C:\Windows\System\ovVTDjV.exe
  C:\Windows\System\ovVTDjV.exe
  2⤵
  PID:5360
- C:\Windows\System\jGsxXql.exe
  C:\Windows\System\jGsxXql.exe
  2⤵
  PID:5284
- C:\Windows\System\ZWeqzpr.exe
  C:\Windows\System\ZWeqzpr.exe
  2⤵
  PID:5152
- C:\Windows\System\tJGLVto.exe
  C:\Windows\System\tJGLVto.exe
  2⤵
  PID:5596
- C:\Windows\System\qTNAPgq.exe
  C:\Windows\System\qTNAPgq.exe
  2⤵
  PID:5640
- C:\Windows\System\vKAkRHu.exe
  C:\Windows\System\vKAkRHu.exe
  2⤵
  PID:5644
- C:\Windows\System\akAYhOy.exe
  C:\Windows\System\akAYhOy.exe
  2⤵
  PID:5768
- C:\Windows\System\RrFukFu.exe
  C:\Windows\System\RrFukFu.exe
  2⤵
  PID:6028
- C:\Windows\System\TfVgkyK.exe
  C:\Windows\System\TfVgkyK.exe
  2⤵
  PID:6112
- C:\Windows\System\YhwWbFz.exe
  C:\Windows\System\YhwWbFz.exe
  2⤵
  PID:4792
- C:\Windows\System\RLMWTDl.exe
  C:\Windows\System\RLMWTDl.exe
  2⤵
  PID:5844
- C:\Windows\System\GlgTXSb.exe
  C:\Windows\System\GlgTXSb.exe
  2⤵
  PID:5528
- C:\Windows\System\CyBDOtM.exe
  C:\Windows\System\CyBDOtM.exe
  2⤵
  PID:5628
- C:\Windows\System\wvkZizd.exe
  C:\Windows\System\wvkZizd.exe
  2⤵
  PID:5632
- C:\Windows\System\PbyIsZR.exe
  C:\Windows\System\PbyIsZR.exe
  2⤵
  PID:6116
- C:\Windows\System\ZIBTmyy.exe
  C:\Windows\System\ZIBTmyy.exe
  2⤵
  PID:5232
- C:\Windows\System\AuLgpeL.exe
  C:\Windows\System\AuLgpeL.exe
  2⤵
  PID:6152
- C:\Windows\System\ilQKGsr.exe
  C:\Windows\System\ilQKGsr.exe
  2⤵
  PID:6168
- C:\Windows\System\BsdRlPF.exe
  C:\Windows\System\BsdRlPF.exe
  2⤵
  PID:6184
- C:\Windows\System\PJXnMZQ.exe
  C:\Windows\System\PJXnMZQ.exe
  2⤵
  PID:6200
- C:\Windows\System\PXGOFdL.exe
  C:\Windows\System\PXGOFdL.exe
  2⤵
  PID:6216
- C:\Windows\System\QPYnqag.exe
  C:\Windows\System\QPYnqag.exe
  2⤵
  PID:6232
- C:\Windows\System\etnqhri.exe
  C:\Windows\System\etnqhri.exe
  2⤵
  PID:6252
- C:\Windows\System\MqUdRJz.exe
  C:\Windows\System\MqUdRJz.exe
  2⤵
  PID:6272
- C:\Windows\System\zQXKIaY.exe
  C:\Windows\System\zQXKIaY.exe
  2⤵
  PID:6288
- C:\Windows\System\MbohLwc.exe
  C:\Windows\System\MbohLwc.exe
  2⤵
  PID:6304
- C:\Windows\System\mxAreDS.exe
  C:\Windows\System\mxAreDS.exe
  2⤵
  PID:6320
- C:\Windows\System\TwRlYQq.exe
  C:\Windows\System\TwRlYQq.exe
  2⤵
  PID:6336
- C:\Windows\System\rgCWtAr.exe
  C:\Windows\System\rgCWtAr.exe
  2⤵
  PID:6352
- C:\Windows\System\SuZBPnZ.exe
  C:\Windows\System\SuZBPnZ.exe
  2⤵
  PID:6368
- C:\Windows\System\ioaAwoq.exe
  C:\Windows\System\ioaAwoq.exe
  2⤵
  PID:6384
- C:\Windows\System\VltcvAV.exe
  C:\Windows\System\VltcvAV.exe
  2⤵
  PID:6400
- C:\Windows\System\CYPQwkm.exe
  C:\Windows\System\CYPQwkm.exe
  2⤵
  PID:6416
- C:\Windows\System\QDXrQER.exe
  C:\Windows\System\QDXrQER.exe
  2⤵
  PID:6432
- C:\Windows\System\OXfbaWL.exe
  C:\Windows\System\OXfbaWL.exe
  2⤵
  PID:6448
- C:\Windows\System\ZchqYlS.exe
  C:\Windows\System\ZchqYlS.exe
  2⤵
  PID:6464
- C:\Windows\System\SSDhIEb.exe
  C:\Windows\System\SSDhIEb.exe
  2⤵
  PID:6480
- C:\Windows\System\EteAqOw.exe
  C:\Windows\System\EteAqOw.exe
  2⤵
  PID:6496
- C:\Windows\System\YuUJAuy.exe
  C:\Windows\System\YuUJAuy.exe
  2⤵
  PID:6512
- C:\Windows\System\TsvyJdG.exe
  C:\Windows\System\TsvyJdG.exe
  2⤵
  PID:6532
- C:\Windows\System\DLvVRxe.exe
  C:\Windows\System\DLvVRxe.exe
  2⤵
  PID:6548
- C:\Windows\System\sTrRexL.exe
  C:\Windows\System\sTrRexL.exe
  2⤵
  PID:6564
- C:\Windows\System\haKEflO.exe
  C:\Windows\System\haKEflO.exe
  2⤵
  PID:6580
- C:\Windows\System\SQbEaHt.exe
  C:\Windows\System\SQbEaHt.exe
  2⤵
  PID:6596
- C:\Windows\System\nFkAwNG.exe
  C:\Windows\System\nFkAwNG.exe
  2⤵
  PID:6612
- C:\Windows\System\KviOJmd.exe
  C:\Windows\System\KviOJmd.exe
  2⤵
  PID:6628
- C:\Windows\System\YVnIZFf.exe
  C:\Windows\System\YVnIZFf.exe
  2⤵
  PID:6644
- C:\Windows\System\mllRDWx.exe
  C:\Windows\System\mllRDWx.exe
  2⤵
  PID:6660
- C:\Windows\System\pJoipfv.exe
  C:\Windows\System\pJoipfv.exe
  2⤵
  PID:6676
- C:\Windows\System\DFMpuYt.exe
  C:\Windows\System\DFMpuYt.exe
  2⤵
  PID:6692
- C:\Windows\System\JFosIKl.exe
  C:\Windows\System\JFosIKl.exe
  2⤵
  PID:6708
- C:\Windows\System\wFAsQsq.exe
  C:\Windows\System\wFAsQsq.exe
  2⤵
  PID:6724
- C:\Windows\System\mbJQxlO.exe
  C:\Windows\System\mbJQxlO.exe
  2⤵
  PID:6740
- C:\Windows\System\EnYuxnJ.exe
  C:\Windows\System\EnYuxnJ.exe
  2⤵
  PID:6756
- C:\Windows\System\chcYDlI.exe
  C:\Windows\System\chcYDlI.exe
  2⤵
  PID:6772
- C:\Windows\System\hGgDsHe.exe
  C:\Windows\System\hGgDsHe.exe
  2⤵
  PID:6788
- C:\Windows\System\HxdKVwd.exe
  C:\Windows\System\HxdKVwd.exe
  2⤵
  PID:6804
- C:\Windows\System\uclUGGU.exe
  C:\Windows\System\uclUGGU.exe
  2⤵
  PID:6820
- C:\Windows\System\SbhTKaT.exe
  C:\Windows\System\SbhTKaT.exe
  2⤵
  PID:6836
- C:\Windows\System\kGLOEfZ.exe
  C:\Windows\System\kGLOEfZ.exe
  2⤵
  PID:6852
- C:\Windows\System\XVFHopz.exe
  C:\Windows\System\XVFHopz.exe
  2⤵
  PID:6868
- C:\Windows\System\ZRQvvnk.exe
  C:\Windows\System\ZRQvvnk.exe
  2⤵
  PID:6884
- C:\Windows\System\pLKeHQA.exe
  C:\Windows\System\pLKeHQA.exe
  2⤵
  PID:6904
- C:\Windows\System\jrhkQuu.exe
  C:\Windows\System\jrhkQuu.exe
  2⤵
  PID:6920
- C:\Windows\System\dXxqiQB.exe
  C:\Windows\System\dXxqiQB.exe
  2⤵
  PID:6936
- C:\Windows\System\NafVWtB.exe
  C:\Windows\System\NafVWtB.exe
  2⤵
  PID:6952
- C:\Windows\System\oJmyxRV.exe
  C:\Windows\System\oJmyxRV.exe
  2⤵
  PID:6968
- C:\Windows\System\YhKJxtY.exe
  C:\Windows\System\YhKJxtY.exe
  2⤵
  PID:6984
- C:\Windows\System\jDGgVGr.exe
  C:\Windows\System\jDGgVGr.exe
  2⤵
  PID:7000
- C:\Windows\System\BwqxBRv.exe
  C:\Windows\System\BwqxBRv.exe
  2⤵
  PID:7016
- C:\Windows\System\SLTKFwc.exe
  C:\Windows\System\SLTKFwc.exe
  2⤵
  PID:7032
- C:\Windows\System\YMLzrBh.exe
  C:\Windows\System\YMLzrBh.exe
  2⤵
  PID:7056
- C:\Windows\System\TsgEBWL.exe
  C:\Windows\System\TsgEBWL.exe
  2⤵
  PID:7072
- C:\Windows\System\NnqGCLy.exe
  C:\Windows\System\NnqGCLy.exe
  2⤵
  PID:7088
- C:\Windows\System\TXoLUyN.exe
  C:\Windows\System\TXoLUyN.exe
  2⤵
  PID:7104
- C:\Windows\System\CesRspw.exe
  C:\Windows\System\CesRspw.exe
  2⤵
  PID:7120
- C:\Windows\System\tUHXhjb.exe
  C:\Windows\System\tUHXhjb.exe
  2⤵
  PID:7140
- C:\Windows\System\OnkACxV.exe
  C:\Windows\System\OnkACxV.exe
  2⤵
  PID:7156
- C:\Windows\System\FHLFaea.exe
  C:\Windows\System\FHLFaea.exe
  2⤵
  PID:6148
- C:\Windows\System\ifvEyrx.exe
  C:\Windows\System\ifvEyrx.exe
  2⤵
  PID:6208
- C:\Windows\System\pgKKzyo.exe
  C:\Windows\System\pgKKzyo.exe
  2⤵
  PID:5788
- C:\Windows\System\aqbQbYS.exe
  C:\Windows\System\aqbQbYS.exe
  2⤵
  PID:5412
- C:\Windows\System\FmMkEGZ.exe
  C:\Windows\System\FmMkEGZ.exe
  2⤵
  PID:6096
- C:\Windows\System\vIBePQa.exe
  C:\Windows\System\vIBePQa.exe
  2⤵
  PID:4796
- C:\Windows\System\ZrbbnbO.exe
  C:\Windows\System\ZrbbnbO.exe
  2⤵
  PID:5916
- C:\Windows\System\NoMFnkk.exe
  C:\Windows\System\NoMFnkk.exe
  2⤵
  PID:4688
- C:\Windows\System\bRtwdJy.exe
  C:\Windows\System\bRtwdJy.exe
  2⤵
  PID:5560
- C:\Windows\System\fnsMWTD.exe
  C:\Windows\System\fnsMWTD.exe
  2⤵
  PID:5900
- C:\Windows\System\CpkDAjS.exe
  C:\Windows\System\CpkDAjS.exe
  2⤵
  PID:4948
- C:\Windows\System\TBtHNvt.exe
  C:\Windows\System\TBtHNvt.exe
  2⤵
  PID:5832
- C:\Windows\System\TtJxErp.exe
  C:\Windows\System\TtJxErp.exe
  2⤵
  PID:6164
- C:\Windows\System\YdFNUga.exe
  C:\Windows\System\YdFNUga.exe
  2⤵
  PID:6228
- C:\Windows\System\WBKHmJv.exe
  C:\Windows\System\WBKHmJv.exe
  2⤵
  PID:6268
- C:\Windows\System\GNJdXpw.exe
  C:\Windows\System\GNJdXpw.exe
  2⤵
  PID:6296
- C:\Windows\System\idngDjG.exe
  C:\Windows\System\idngDjG.exe
  2⤵
  PID:6328
- C:\Windows\System\biSAqgO.exe
  C:\Windows\System\biSAqgO.exe
  2⤵
  PID:6376
- C:\Windows\System\OFXHwQz.exe
  C:\Windows\System\OFXHwQz.exe
  2⤵
  PID:6412
- C:\Windows\System\ZDZCboi.exe
  C:\Windows\System\ZDZCboi.exe
  2⤵
  PID:6476
- C:\Windows\System\qpNMDGA.exe
  C:\Windows\System\qpNMDGA.exe
  2⤵
  PID:6540
- C:\Windows\System\LAgDYSe.exe
  C:\Windows\System\LAgDYSe.exe
  2⤵
  PID:6604
- C:\Windows\System\HclhjtZ.exe
  C:\Windows\System\HclhjtZ.exe
  2⤵
  PID:6640
- C:\Windows\System\lEttWWW.exe
  C:\Windows\System\lEttWWW.exe
  2⤵
  PID:6520
- C:\Windows\System\ogkHOHX.exe
  C:\Windows\System\ogkHOHX.exe
  2⤵
  PID:6428
- C:\Windows\System\gvspmuE.exe
  C:\Windows\System\gvspmuE.exe
  2⤵
  PID:6656
- C:\Windows\System\oaRKcFJ.exe
  C:\Windows\System\oaRKcFJ.exe
  2⤵
  PID:6556
- C:\Windows\System\FHaOyrp.exe
  C:\Windows\System\FHaOyrp.exe
  2⤵
  PID:6460
- C:\Windows\System\rTLlhSy.exe
  C:\Windows\System\rTLlhSy.exe
  2⤵
  PID:6588
- C:\Windows\System\zEHPcaJ.exe
  C:\Windows\System\zEHPcaJ.exe
  2⤵
  PID:6720
- C:\Windows\System\QUVgSZJ.exe
  C:\Windows\System\QUVgSZJ.exe
  2⤵
  PID:6780
- C:\Windows\System\luIkTxh.exe
  C:\Windows\System\luIkTxh.exe
  2⤵
  PID:6812
- C:\Windows\System\oZHgKgs.exe
  C:\Windows\System\oZHgKgs.exe
  2⤵
  PID:6876
- C:\Windows\System\qyyegWJ.exe
  C:\Windows\System\qyyegWJ.exe
  2⤵
  PID:6944
- C:\Windows\System\SgiYbdF.exe
  C:\Windows\System\SgiYbdF.exe
  2⤵
  PID:6828
- C:\Windows\System\GbjGGGk.exe
  C:\Windows\System\GbjGGGk.exe
  2⤵
  PID:6892
- C:\Windows\System\nCuRtBk.exe
  C:\Windows\System\nCuRtBk.exe
  2⤵
  PID:6932
- C:\Windows\System\GwBCTUM.exe
  C:\Windows\System\GwBCTUM.exe
  2⤵
  PID:7024
- C:\Windows\System\MWvSgGL.exe
  C:\Windows\System\MWvSgGL.exe
  2⤵
  PID:6960
- C:\Windows\System\LhQsKcG.exe
  C:\Windows\System\LhQsKcG.exe
  2⤵
  PID:7008
- C:\Windows\System\Bmznsbb.exe
  C:\Windows\System\Bmznsbb.exe
  2⤵
  PID:7052
- C:\Windows\System\WWvMowB.exe
  C:\Windows\System\WWvMowB.exe
  2⤵
  PID:6240
- C:\Windows\System\ItJinuF.exe
  C:\Windows\System\ItJinuF.exe
  2⤵
  PID:5968
- C:\Windows\System\pwgaewE.exe
  C:\Windows\System\pwgaewE.exe
  2⤵
  PID:1848
- C:\Windows\System\HgnNJAf.exe
  C:\Windows\System\HgnNJAf.exe
  2⤵
  PID:4880
- C:\Windows\System\yuPqqfD.exe
  C:\Windows\System\yuPqqfD.exe
  2⤵
  PID:7084
- C:\Windows\System\hnpmuov.exe
  C:\Windows\System\hnpmuov.exe
  2⤵
  PID:6300
- C:\Windows\System\TKuJGpl.exe
  C:\Windows\System\TKuJGpl.exe
  2⤵
  PID:6508
- C:\Windows\System\MZyEBoE.exe
  C:\Windows\System\MZyEBoE.exe
  2⤵
  PID:6704
- C:\Windows\System\AxKMIoU.exe
  C:\Windows\System\AxKMIoU.exe
  2⤵
  PID:6528
- C:\Windows\System\haNduzz.exe
  C:\Windows\System\haNduzz.exe
  2⤵
  PID:7152
- C:\Windows\System\crQqduu.exe
  C:\Windows\System\crQqduu.exe
  2⤵
  PID:6084
- C:\Windows\System\ueWRBdE.exe
  C:\Windows\System\ueWRBdE.exe
  2⤵
  PID:5708
- C:\Windows\System\ApsZtbZ.exe
  C:\Windows\System\ApsZtbZ.exe
  2⤵
  PID:6196
- C:\Windows\System\RPNxmSf.exe
  C:\Windows\System\RPNxmSf.exe
  2⤵
  PID:6284
- C:\Windows\System\xYZyeMe.exe
  C:\Windows\System\xYZyeMe.exe
  2⤵
  PID:6576
- C:\Windows\System\fDQRVhf.exe
  C:\Windows\System\fDQRVhf.exe
  2⤵
  PID:6652
- C:\Windows\System\CzmQPSP.exe
  C:\Windows\System\CzmQPSP.exe
  2⤵
  PID:6716
- C:\Windows\System\FDYffCd.exe
  C:\Windows\System\FDYffCd.exe
  2⤵
  PID:6848
- C:\Windows\System\UlykPpa.exe
  C:\Windows\System\UlykPpa.exe
  2⤵
  PID:7068
- C:\Windows\System\NmZUKti.exe
  C:\Windows\System\NmZUKti.exe
  2⤵
  PID:7048
- C:\Windows\System\owKhoHq.exe
  C:\Windows\System\owKhoHq.exe
  2⤵
  PID:6796
- C:\Windows\System\dzHyLnG.exe
  C:\Windows\System\dzHyLnG.exe
  2⤵
  PID:6912
- C:\Windows\System\zBVkeoI.exe
  C:\Windows\System\zBVkeoI.exe
  2⤵
  PID:6392
- C:\Windows\System\VrqkzWw.exe
  C:\Windows\System\VrqkzWw.exe
  2⤵
  PID:6160
- C:\Windows\System\OtkFsZq.exe
  C:\Windows\System\OtkFsZq.exe
  2⤵
  PID:5268
- C:\Windows\System\mFloOGj.exe
  C:\Windows\System\mFloOGj.exe
  2⤵
  PID:7136
- C:\Windows\System\LoNwWvR.exe
  C:\Windows\System\LoNwWvR.exe
  2⤵
  PID:5536
- C:\Windows\System\ECMbIhb.exe
  C:\Windows\System\ECMbIhb.exe
  2⤵
  PID:6844
- C:\Windows\System\jkZiyeM.exe
  C:\Windows\System\jkZiyeM.exe
  2⤵
  PID:6864
- C:\Windows\System\wIGSbMs.exe
  C:\Windows\System\wIGSbMs.exe
  2⤵
  PID:6688
- C:\Windows\System\kIwXiPP.exe
  C:\Windows\System\kIwXiPP.exe
  2⤵
  PID:7176
- C:\Windows\System\VNetUbD.exe
  C:\Windows\System\VNetUbD.exe
  2⤵
  PID:7200
- C:\Windows\System\ljFrFMt.exe
  C:\Windows\System\ljFrFMt.exe
  2⤵
  PID:7216
- C:\Windows\System\EtCFIVl.exe
  C:\Windows\System\EtCFIVl.exe
  2⤵
  PID:7232
- C:\Windows\System\TfVKixv.exe
  C:\Windows\System\TfVKixv.exe
  2⤵
  PID:7252
- C:\Windows\System\vLDGsqS.exe
  C:\Windows\System\vLDGsqS.exe
  2⤵
  PID:7268
- C:\Windows\System\WfeioPK.exe
  C:\Windows\System\WfeioPK.exe
  2⤵
  PID:7284
- C:\Windows\System\bjFtLGb.exe
  C:\Windows\System\bjFtLGb.exe
  2⤵
  PID:7300
- C:\Windows\System\EWigkPt.exe
  C:\Windows\System\EWigkPt.exe
  2⤵
  PID:7316
- C:\Windows\System\kDeAZwy.exe
  C:\Windows\System\kDeAZwy.exe
  2⤵
  PID:7336
- C:\Windows\System\PyCoHgd.exe
  C:\Windows\System\PyCoHgd.exe
  2⤵
  PID:7352
- C:\Windows\System\xeTuQdJ.exe
  C:\Windows\System\xeTuQdJ.exe
  2⤵
  PID:7372
- C:\Windows\System\iQBKxfG.exe
  C:\Windows\System\iQBKxfG.exe
  2⤵
  PID:7388
- C:\Windows\System\OieZZuH.exe
  C:\Windows\System\OieZZuH.exe
  2⤵
  PID:7404
- C:\Windows\System\hRNKsOr.exe
  C:\Windows\System\hRNKsOr.exe
  2⤵
  PID:7420
- C:\Windows\System\ezafuwU.exe
  C:\Windows\System\ezafuwU.exe
  2⤵
  PID:7436
- C:\Windows\System\dBIKMnb.exe
  C:\Windows\System\dBIKMnb.exe
  2⤵
  PID:7452
- C:\Windows\System\yyaXXfL.exe
  C:\Windows\System\yyaXXfL.exe
  2⤵
  PID:7468
- C:\Windows\System\LhdsJzk.exe
  C:\Windows\System\LhdsJzk.exe
  2⤵
  PID:7484
- C:\Windows\System\ABCEFWb.exe
  C:\Windows\System\ABCEFWb.exe
  2⤵
  PID:7500
- C:\Windows\System\wEzllMf.exe
  C:\Windows\System\wEzllMf.exe
  2⤵
  PID:7516
- C:\Windows\System\IXzykEd.exe
  C:\Windows\System\IXzykEd.exe
  2⤵
  PID:7536
- C:\Windows\System\RwermvF.exe
  C:\Windows\System\RwermvF.exe
  2⤵
  PID:7552
- C:\Windows\System\HvIxoHs.exe
  C:\Windows\System\HvIxoHs.exe
  2⤵
  PID:7568
- C:\Windows\System\sQPFrAO.exe
  C:\Windows\System\sQPFrAO.exe
  2⤵
  PID:7584
- C:\Windows\System\yWQlTBV.exe
  C:\Windows\System\yWQlTBV.exe
  2⤵
  PID:7600
- C:\Windows\System\dZkeSKs.exe
  C:\Windows\System\dZkeSKs.exe
  2⤵
  PID:7616
- C:\Windows\System\KipdHMp.exe
  C:\Windows\System\KipdHMp.exe
  2⤵
  PID:7632
- C:\Windows\System\RRHouib.exe
  C:\Windows\System\RRHouib.exe
  2⤵
  PID:7648
- C:\Windows\System\EKQWnFZ.exe
  C:\Windows\System\EKQWnFZ.exe
  2⤵
  PID:7664
- C:\Windows\System\lcpBJsC.exe
  C:\Windows\System\lcpBJsC.exe
  2⤵
  PID:7680
- C:\Windows\System\YNfeSmX.exe
  C:\Windows\System\YNfeSmX.exe
  2⤵
  PID:7700
- C:\Windows\System\SeEOFNi.exe
  C:\Windows\System\SeEOFNi.exe
  2⤵
  PID:7716
- C:\Windows\System\woxldoC.exe
  C:\Windows\System\woxldoC.exe
  2⤵
  PID:7736
- C:\Windows\System\theRJnS.exe
  C:\Windows\System\theRJnS.exe
  2⤵
  PID:7752
- C:\Windows\System\rAkROUk.exe
  C:\Windows\System\rAkROUk.exe
  2⤵
  PID:7772
- C:\Windows\System\plkGBWI.exe
  C:\Windows\System\plkGBWI.exe
  2⤵
  PID:7792
- C:\Windows\System\znpGdGa.exe
  C:\Windows\System\znpGdGa.exe
  2⤵
  PID:7824
- C:\Windows\System\FCpczkR.exe
  C:\Windows\System\FCpczkR.exe
  2⤵
  PID:7856
- C:\Windows\System\wFDweWT.exe
  C:\Windows\System\wFDweWT.exe
  2⤵
  PID:7876
- C:\Windows\System\jXVuFTp.exe
  C:\Windows\System\jXVuFTp.exe
  2⤵
  PID:7896
- C:\Windows\System\QzcIanR.exe
  C:\Windows\System\QzcIanR.exe
  2⤵
  PID:7920
- C:\Windows\System\oSzHRHI.exe
  C:\Windows\System\oSzHRHI.exe
  2⤵
  PID:7940
- C:\Windows\System\IQFzjua.exe
  C:\Windows\System\IQFzjua.exe
  2⤵
  PID:7972
- C:\Windows\System\MostHqi.exe
  C:\Windows\System\MostHqi.exe
  2⤵
  PID:7992
- C:\Windows\System\anavhOW.exe
  C:\Windows\System\anavhOW.exe
  2⤵
  PID:8108
- C:\Windows\System\WPTzMEW.exe
  C:\Windows\System\WPTzMEW.exe
  2⤵
  PID:8124
- C:\Windows\System\MwuoSEc.exe
  C:\Windows\System\MwuoSEc.exe
  2⤵
  PID:8140
- C:\Windows\System\xvgPIsQ.exe
  C:\Windows\System\xvgPIsQ.exe
  2⤵
  PID:8156
- C:\Windows\System\Zzjpbsx.exe
  C:\Windows\System\Zzjpbsx.exe
  2⤵
  PID:8172
- C:\Windows\System\DwpplzG.exe
  C:\Windows\System\DwpplzG.exe
  2⤵
  PID:8188
- C:\Windows\System\LkIfSUO.exe
  C:\Windows\System\LkIfSUO.exe
  2⤵
  PID:6996
- C:\Windows\System\PsUsYJm.exe
  C:\Windows\System\PsUsYJm.exe
  2⤵
  PID:5828
- C:\Windows\System\hjqYCZe.exe
  C:\Windows\System\hjqYCZe.exe
  2⤵
  PID:6620
- C:\Windows\System\iDaSrnI.exe
  C:\Windows\System\iDaSrnI.exe
  2⤵
  PID:6132
- C:\Windows\System\uXNJUro.exe
  C:\Windows\System\uXNJUro.exe
  2⤵
  PID:7172
- C:\Windows\System\zmOHocI.exe
  C:\Windows\System\zmOHocI.exe
  2⤵
  PID:6980
- C:\Windows\System\xZKsfsp.exe
  C:\Windows\System\xZKsfsp.exe
  2⤵
  PID:6992
- C:\Windows\System\tOCdCcm.exe
  C:\Windows\System\tOCdCcm.exe
  2⤵
  PID:5424
- C:\Windows\System\KccBjrI.exe
  C:\Windows\System\KccBjrI.exe
  2⤵
  PID:7224
- C:\Windows\System\NqlSVJo.exe
  C:\Windows\System\NqlSVJo.exe
  2⤵
  PID:7292
- C:\Windows\System\fRYeART.exe
  C:\Windows\System\fRYeART.exe
  2⤵
  PID:7332
- C:\Windows\System\FpQowWq.exe
  C:\Windows\System\FpQowWq.exe
  2⤵
  PID:7400
- C:\Windows\System\EpuuvbL.exe
  C:\Windows\System\EpuuvbL.exe
  2⤵
  PID:7364
- C:\Windows\System\ibgohaI.exe
  C:\Windows\System\ibgohaI.exe
  2⤵
  PID:7492
- C:\Windows\System\tFNfKzX.exe
  C:\Windows\System\tFNfKzX.exe
  2⤵
  PID:7240
- C:\Windows\System\axqCwHF.exe
  C:\Windows\System\axqCwHF.exe
  2⤵
  PID:7280
- C:\Windows\System\ibUKBHy.exe
  C:\Windows\System\ibUKBHy.exe
  2⤵
  PID:7380
- C:\Windows\System\rDSvqOt.exe
  C:\Windows\System\rDSvqOt.exe
  2⤵
  PID:7444
- C:\Windows\System\GgFUlPq.exe
  C:\Windows\System\GgFUlPq.exe
  2⤵
  PID:7596
- C:\Windows\System\SCmdnUK.exe
  C:\Windows\System\SCmdnUK.exe
  2⤵
  PID:7528
- C:\Windows\System\MSOanxn.exe
  C:\Windows\System\MSOanxn.exe
  2⤵
  PID:7696
- C:\Windows\System\OVXfqKI.exe
  C:\Windows\System\OVXfqKI.exe
  2⤵
  PID:7476
- C:\Windows\System\LFUnNIT.exe
  C:\Windows\System\LFUnNIT.exe
  2⤵
  PID:7544
- C:\Windows\System\rMnzgJG.exe
  C:\Windows\System\rMnzgJG.exe
  2⤵
  PID:7608
- C:\Windows\System\wADcqqu.exe
  C:\Windows\System\wADcqqu.exe
  2⤵
  PID:7676
- C:\Windows\System\FygkbkW.exe
  C:\Windows\System\FygkbkW.exe
  2⤵
  PID:7748
- C:\Windows\System\cVcJcsP.exe
  C:\Windows\System\cVcJcsP.exe
  2⤵
  PID:7780
- C:\Windows\System\JSkzKkY.exe
  C:\Windows\System\JSkzKkY.exe
  2⤵
  PID:7788
- C:\Windows\System\JGEfzez.exe
  C:\Windows\System\JGEfzez.exe
  2⤵
  PID:7864
- C:\Windows\System\QNbaWVJ.exe
  C:\Windows\System\QNbaWVJ.exe
  2⤵
  PID:7848
- C:\Windows\System\AojILJI.exe
  C:\Windows\System\AojILJI.exe
  2⤵
  PID:7888
- C:\Windows\System\yuyPJsr.exe
  C:\Windows\System\yuyPJsr.exe
  2⤵
  PID:7912
- C:\Windows\System\ruYwXMb.exe
  C:\Windows\System\ruYwXMb.exe
  2⤵
  PID:7868
- C:\Windows\System\ACeNzbJ.exe
  C:\Windows\System\ACeNzbJ.exe
  2⤵
  PID:7960
- C:\Windows\System\YGsicOe.exe
  C:\Windows\System\YGsicOe.exe
  2⤵
  PID:8004
- C:\Windows\System\sJPiGXJ.exe
  C:\Windows\System\sJPiGXJ.exe
  2⤵
  PID:8036
- C:\Windows\System\zmujwTb.exe
  C:\Windows\System\zmujwTb.exe
  2⤵
  PID:8052
- C:\Windows\System\WseaXIm.exe
  C:\Windows\System\WseaXIm.exe
  2⤵
  PID:8068
- C:\Windows\System\pbAMmMz.exe
  C:\Windows\System\pbAMmMz.exe
  2⤵
  PID:8088
- C:\Windows\System\kbeqAvc.exe
  C:\Windows\System\kbeqAvc.exe
  2⤵
  PID:8104
- C:\Windows\System\lOJiEbM.exe
  C:\Windows\System\lOJiEbM.exe
  2⤵
  PID:8168
- C:\Windows\System\ScmZYYj.exe
  C:\Windows\System\ScmZYYj.exe
  2⤵
  PID:7984
- C:\Windows\System\YESGTqN.exe
  C:\Windows\System\YESGTqN.exe
  2⤵
  PID:8116
- C:\Windows\System\itWSiSY.exe
  C:\Windows\System\itWSiSY.exe
  2⤵
  PID:8180
- C:\Windows\System\pssPfVE.exe
  C:\Windows\System\pssPfVE.exe
  2⤵
  PID:7196
- C:\Windows\System\gWQXJfw.exe
  C:\Windows\System\gWQXJfw.exe
  2⤵
  PID:6444
- C:\Windows\System\cnlYdvY.exe
  C:\Windows\System\cnlYdvY.exe
  2⤵
  PID:6860
- C:\Windows\System\UjNeDqJ.exe
  C:\Windows\System\UjNeDqJ.exe
  2⤵
  PID:8080
- C:\Windows\System\SmUcmjQ.exe
  C:\Windows\System\SmUcmjQ.exe
  2⤵
  PID:7208
- C:\Windows\System\yfHgHhU.exe
  C:\Windows\System\yfHgHhU.exe
  2⤵
  PID:7396
- C:\Windows\System\FBKPOhm.exe
  C:\Windows\System\FBKPOhm.exe
  2⤵
  PID:7264
- C:\Windows\System\BnGwUhH.exe
  C:\Windows\System\BnGwUhH.exe
  2⤵
  PID:7312
- C:\Windows\System\fEyfVaf.exe
  C:\Windows\System\fEyfVaf.exe
  2⤵
  PID:7276
- C:\Windows\System\jtszeCn.exe
  C:\Windows\System\jtszeCn.exe
  2⤵
  PID:7508
- C:\Windows\System\ROtJewp.exe
  C:\Windows\System\ROtJewp.exe
  2⤵
  PID:7416
- C:\Windows\System\XlHevGa.exe
  C:\Windows\System\XlHevGa.exe
  2⤵
  PID:7732
- C:\Windows\System\qodtJlo.exe
  C:\Windows\System\qodtJlo.exe
  2⤵
  PID:7580
- C:\Windows\System\FyNqYsa.exe
  C:\Windows\System\FyNqYsa.exe
  2⤵
  PID:7764
- C:\Windows\System\ONyuDfG.exe
  C:\Windows\System\ONyuDfG.exe
  2⤵
  PID:7012
- C:\Windows\System\UwKuWTf.exe
  C:\Windows\System\UwKuWTf.exe
  2⤵
  PID:7932
- C:\Windows\System\dWKshSw.exe
  C:\Windows\System\dWKshSw.exe
  2⤵
  PID:7916
- C:\Windows\System\jczXTIj.exe
  C:\Windows\System\jczXTIj.exe
  2⤵
  PID:7980
- C:\Windows\System\wVxYBqs.exe
  C:\Windows\System\wVxYBqs.exe
  2⤵
  PID:8048
- C:\Windows\System\MoYhfJL.exe
  C:\Windows\System\MoYhfJL.exe
  2⤵
  PID:8164
- C:\Windows\System\kYkxeap.exe
  C:\Windows\System\kYkxeap.exe
  2⤵
  PID:6624
- C:\Windows\System\IcIFbne.exe
  C:\Windows\System\IcIFbne.exe
  2⤵
  PID:8148
- C:\Windows\System\JPWYCKQ.exe
  C:\Windows\System\JPWYCKQ.exe
  2⤵
  PID:8060
- C:\Windows\System\NmsNVqb.exe
  C:\Windows\System\NmsNVqb.exe
  2⤵
  PID:6316
- C:\Windows\System\ETqDAQz.exe
  C:\Windows\System\ETqDAQz.exe
  2⤵
  PID:7460
- C:\Windows\System\rFfOAMj.exe
  C:\Windows\System\rFfOAMj.exe
  2⤵
  PID:6636
- C:\Windows\System\TaZKSlf.exe
  C:\Windows\System\TaZKSlf.exe
  2⤵
  PID:7624
- C:\Windows\System\zFsNpXn.exe
  C:\Windows\System\zFsNpXn.exe
  2⤵
  PID:7248
- C:\Windows\System\NeLywBg.exe
  C:\Windows\System\NeLywBg.exe
  2⤵
  PID:7844
- C:\Windows\System\dOvxTlg.exe
  C:\Windows\System\dOvxTlg.exe
  2⤵
  PID:4992
- C:\Windows\System\YisUiaC.exe
  C:\Windows\System\YisUiaC.exe
  2⤵
  PID:7192
- C:\Windows\System\ctQEgJE.exe
  C:\Windows\System\ctQEgJE.exe
  2⤵
  PID:7728
- C:\Windows\System\OnxoGpe.exe
  C:\Windows\System\OnxoGpe.exe
  2⤵
  PID:8096
- C:\Windows\System\gscVhmb.exe
  C:\Windows\System\gscVhmb.exe
  2⤵
  PID:7644
- C:\Windows\System\NWSnMRQ.exe
  C:\Windows\System\NWSnMRQ.exe
  2⤵
  PID:7412
- C:\Windows\System\Oqfgpuf.exe
  C:\Windows\System\Oqfgpuf.exe
  2⤵
  PID:7952
- C:\Windows\System\iIGDwCa.exe
  C:\Windows\System\iIGDwCa.exe
  2⤵
  PID:6916
- C:\Windows\System\pfCGexM.exe
  C:\Windows\System\pfCGexM.exe
  2⤵
  PID:8044
- C:\Windows\System\MouZGAP.exe
  C:\Windows\System\MouZGAP.exe
  2⤵
  PID:7628
- C:\Windows\System\DZDGNrL.exe
  C:\Windows\System\DZDGNrL.exe
  2⤵
  PID:7692
- C:\Windows\System\adRjOKf.exe
  C:\Windows\System\adRjOKf.exe
  2⤵
  PID:8032
- C:\Windows\System\XnYqxRp.exe
  C:\Windows\System\XnYqxRp.exe
  2⤵
  PID:8136
- C:\Windows\System\vUfDRXU.exe
  C:\Windows\System\vUfDRXU.exe
  2⤵
  PID:8208
- C:\Windows\System\mhcGPGV.exe
  C:\Windows\System\mhcGPGV.exe
  2⤵
  PID:8224
- C:\Windows\System\mWzKJgd.exe
  C:\Windows\System\mWzKJgd.exe
  2⤵
  PID:8240
- C:\Windows\System\BgUgfTS.exe
  C:\Windows\System\BgUgfTS.exe
  2⤵
  PID:8256
- C:\Windows\System\hLDBoJu.exe
  C:\Windows\System\hLDBoJu.exe
  2⤵
  PID:8272
- C:\Windows\System\bRttsVN.exe
  C:\Windows\System\bRttsVN.exe
  2⤵
  PID:8288
- C:\Windows\System\SmsUkLt.exe
  C:\Windows\System\SmsUkLt.exe
  2⤵
  PID:8308
- C:\Windows\System\yIWqSnO.exe
  C:\Windows\System\yIWqSnO.exe
  2⤵
  PID:8324
- C:\Windows\System\wUlTGzt.exe
  C:\Windows\System\wUlTGzt.exe
  2⤵
  PID:8340
- C:\Windows\System\saztOTQ.exe
  C:\Windows\System\saztOTQ.exe
  2⤵
  PID:8356
- C:\Windows\System\BFuptiB.exe
  C:\Windows\System\BFuptiB.exe
  2⤵
  PID:8372
- C:\Windows\System\dYjwotz.exe
  C:\Windows\System\dYjwotz.exe
  2⤵
  PID:8388
- C:\Windows\System\HrhqBtV.exe
  C:\Windows\System\HrhqBtV.exe
  2⤵
  PID:8404
- C:\Windows\System\YazqWph.exe
  C:\Windows\System\YazqWph.exe
  2⤵
  PID:8420
- C:\Windows\System\bnVcgOO.exe
  C:\Windows\System\bnVcgOO.exe
  2⤵
  PID:8436
- C:\Windows\System\iPNvxhT.exe
  C:\Windows\System\iPNvxhT.exe
  2⤵
  PID:8452
- C:\Windows\System\dOixVDg.exe
  C:\Windows\System\dOixVDg.exe
  2⤵
  PID:8468
- C:\Windows\System\FgwiQRL.exe
  C:\Windows\System\FgwiQRL.exe
  2⤵
  PID:8484
- C:\Windows\System\cSMbLDE.exe
  C:\Windows\System\cSMbLDE.exe
  2⤵
  PID:8500
- C:\Windows\System\oHsftGa.exe
  C:\Windows\System\oHsftGa.exe
  2⤵
  PID:8516
- C:\Windows\System\HJcCHvi.exe
  C:\Windows\System\HJcCHvi.exe
  2⤵
  PID:8536
- C:\Windows\System\HaakqGW.exe
  C:\Windows\System\HaakqGW.exe
  2⤵
  PID:8552
- C:\Windows\System\vscxoel.exe
  C:\Windows\System\vscxoel.exe
  2⤵
  PID:8568
- C:\Windows\System\xwocuBg.exe
  C:\Windows\System\xwocuBg.exe
  2⤵
  PID:8584
- C:\Windows\System\dHnsftr.exe
  C:\Windows\System\dHnsftr.exe
  2⤵
  PID:8600
- C:\Windows\System\uvMOXJm.exe
  C:\Windows\System\uvMOXJm.exe
  2⤵
  PID:8616
- C:\Windows\System\xmoafqn.exe
  C:\Windows\System\xmoafqn.exe
  2⤵
  PID:8632
- C:\Windows\System\ktHogsg.exe
  C:\Windows\System\ktHogsg.exe
  2⤵
  PID:8648
- C:\Windows\System\LCgcRkN.exe
  C:\Windows\System\LCgcRkN.exe
  2⤵
  PID:8664
- C:\Windows\System\bFdFngJ.exe
  C:\Windows\System\bFdFngJ.exe
  2⤵
  PID:8680
- C:\Windows\System\woATcBj.exe
  C:\Windows\System\woATcBj.exe
  2⤵
  PID:8696
- C:\Windows\System\hnjcsmI.exe
  C:\Windows\System\hnjcsmI.exe
  2⤵
  PID:8712
- C:\Windows\System\zRvwOQm.exe
  C:\Windows\System\zRvwOQm.exe
  2⤵
  PID:8728
- C:\Windows\System\iAsZrOm.exe
  C:\Windows\System\iAsZrOm.exe
  2⤵
  PID:8744
- C:\Windows\System\raJfFVw.exe
  C:\Windows\System\raJfFVw.exe
  2⤵
  PID:8760
- C:\Windows\System\btNdUdb.exe
  C:\Windows\System\btNdUdb.exe
  2⤵
  PID:8776
- C:\Windows\System\FXaAlGU.exe
  C:\Windows\System\FXaAlGU.exe
  2⤵
  PID:8792
- C:\Windows\System\gvKDzZU.exe
  C:\Windows\System\gvKDzZU.exe
  2⤵
  PID:8808
- C:\Windows\System\SIHPPep.exe
  C:\Windows\System\SIHPPep.exe
  2⤵
  PID:8824
- C:\Windows\System\xUTnvEh.exe
  C:\Windows\System\xUTnvEh.exe
  2⤵
  PID:8840
- C:\Windows\System\kagAdfP.exe
  C:\Windows\System\kagAdfP.exe
  2⤵
  PID:8856
- C:\Windows\System\HLrRnsb.exe
  C:\Windows\System\HLrRnsb.exe
  2⤵
  PID:8872
- C:\Windows\System\wjEEIYm.exe
  C:\Windows\System\wjEEIYm.exe
  2⤵
  PID:8888
- C:\Windows\System\NByoisv.exe
  C:\Windows\System\NByoisv.exe
  2⤵
  PID:8904
- C:\Windows\System\TybjogI.exe
  C:\Windows\System\TybjogI.exe
  2⤵
  PID:8920
- C:\Windows\System\mxcWCcZ.exe
  C:\Windows\System\mxcWCcZ.exe
  2⤵
  PID:8936
- C:\Windows\System\czYKEpO.exe
  C:\Windows\System\czYKEpO.exe
  2⤵
  PID:8952
- C:\Windows\System\pgkIMdv.exe
  C:\Windows\System\pgkIMdv.exe
  2⤵
  PID:8968
- C:\Windows\System\xViJEJk.exe
  C:\Windows\System\xViJEJk.exe
  2⤵
  PID:8988
- C:\Windows\System\wraBmTj.exe
  C:\Windows\System\wraBmTj.exe
  2⤵
  PID:9004
- C:\Windows\System\TWGyrPJ.exe
  C:\Windows\System\TWGyrPJ.exe
  2⤵
  PID:9020
- C:\Windows\System\dVDycHr.exe
  C:\Windows\System\dVDycHr.exe
  2⤵
  PID:9036
- C:\Windows\System\JTISJLa.exe
  C:\Windows\System\JTISJLa.exe
  2⤵
  PID:9052
- C:\Windows\System\MrnRIjm.exe
  C:\Windows\System\MrnRIjm.exe
  2⤵
  PID:9068
- C:\Windows\System\dduzUux.exe
  C:\Windows\System\dduzUux.exe
  2⤵
  PID:9084
- C:\Windows\System\EsEGbHk.exe
  C:\Windows\System\EsEGbHk.exe
  2⤵
  PID:9100
- C:\Windows\System\DoFwUSB.exe
  C:\Windows\System\DoFwUSB.exe
  2⤵
  PID:9116
- C:\Windows\System\eRMODir.exe
  C:\Windows\System\eRMODir.exe
  2⤵
  PID:9136
- C:\Windows\System\yzwXHGr.exe
  C:\Windows\System\yzwXHGr.exe
  2⤵
  PID:9160
- C:\Windows\System\knHaQje.exe
  C:\Windows\System\knHaQje.exe
  2⤵
  PID:9176
- C:\Windows\System\muoBJpz.exe
  C:\Windows\System\muoBJpz.exe
  2⤵
  PID:9192
- C:\Windows\System\thzoqWP.exe
  C:\Windows\System\thzoqWP.exe
  2⤵
  PID:9208
- C:\Windows\System\WVezAmf.exe
  C:\Windows\System\WVezAmf.exe
  2⤵
  PID:7688
- C:\Windows\System\IkVUuNI.exe
  C:\Windows\System\IkVUuNI.exe
  2⤵
  PID:8236
- C:\Windows\System\vERFoAA.exe
  C:\Windows\System\vERFoAA.exe
  2⤵
  PID:7164
- C:\Windows\System\sRFcbQC.exe
  C:\Windows\System\sRFcbQC.exe
  2⤵
  PID:8268
- C:\Windows\System\GSfsduK.exe
  C:\Windows\System\GSfsduK.exe
  2⤵
  PID:8332
- C:\Windows\System\ZvvNPeP.exe
  C:\Windows\System\ZvvNPeP.exe
  2⤵
  PID:8280
- C:\Windows\System\KoBVGwP.exe
  C:\Windows\System\KoBVGwP.exe
  2⤵
  PID:8248
- C:\Windows\System\xnUIsYS.exe
  C:\Windows\System\xnUIsYS.exe
  2⤵
  PID:8320
- C:\Windows\System\MbznjyQ.exe
  C:\Windows\System\MbznjyQ.exe
  2⤵
  PID:8400
- C:\Windows\System\wuhVveY.exe
  C:\Windows\System\wuhVveY.exe
  2⤵
  PID:8492
- C:\Windows\System\NUCMsSe.exe
  C:\Windows\System\NUCMsSe.exe
  2⤵
  PID:8560
- C:\Windows\System\dsAfwZW.exe
  C:\Windows\System\dsAfwZW.exe
  2⤵
  PID:8624
- C:\Windows\System\fTQtRld.exe
  C:\Windows\System\fTQtRld.exe
  2⤵
  PID:8448
- C:\Windows\System\cjWDxNN.exe
  C:\Windows\System\cjWDxNN.exe
  2⤵
  PID:8688
- C:\Windows\System\JvKBfJy.exe
  C:\Windows\System\JvKBfJy.exe
  2⤵
  PID:8644
- C:\Windows\System\NEsnJGq.exe
  C:\Windows\System\NEsnJGq.exe
  2⤵
  PID:8548
- C:\Windows\System\JsXKTkl.exe
  C:\Windows\System\JsXKTkl.exe
  2⤵
  PID:8544
- C:\Windows\System\WEcfwWH.exe
  C:\Windows\System\WEcfwWH.exe
  2⤵
  PID:8704
- C:\Windows\System\vUqDPAm.exe
  C:\Windows\System\vUqDPAm.exe
  2⤵
  PID:8756
- C:\Windows\System\yjKWaPE.exe
  C:\Windows\System\yjKWaPE.exe
  2⤵
  PID:8820
- C:\Windows\System\FjnAWYT.exe
  C:\Windows\System\FjnAWYT.exe
  2⤵
  PID:9044
- C:\Windows\System\LfvnWWS.exe
  C:\Windows\System\LfvnWWS.exe
  2⤵
  PID:8900
- C:\Windows\System\youGRMm.exe
  C:\Windows\System\youGRMm.exe
  2⤵
  PID:8772
- C:\Windows\System\mMgIKBg.exe
  C:\Windows\System\mMgIKBg.exe
  2⤵
  PID:9032
- C:\Windows\System\GFCmLSa.exe
  C:\Windows\System\GFCmLSa.exe
  2⤵
  PID:7956
- C:\Windows\System\RekoYkX.exe
  C:\Windows\System\RekoYkX.exe
  2⤵
  PID:9108
- C:\Windows\System\bbvqxde.exe
  C:\Windows\System\bbvqxde.exe
  2⤵
  PID:9128
- C:\Windows\System\zNgJLRV.exe
  C:\Windows\System\zNgJLRV.exe
  2⤵
  PID:9156
- C:\Windows\System\qEAcNCv.exe
  C:\Windows\System\qEAcNCv.exe
  2⤵
  PID:9168
- C:\Windows\System\wYetkJA.exe
  C:\Windows\System\wYetkJA.exe
  2⤵
  PID:8216
- C:\Windows\System\wiSEYId.exe
  C:\Windows\System\wiSEYId.exe
  2⤵
  PID:9200
- C:\Windows\System\xLWUqJE.exe
  C:\Windows\System\xLWUqJE.exe
  2⤵
  PID:7808
- C:\Windows\System\HIAmeOf.exe
  C:\Windows\System\HIAmeOf.exe
  2⤵
  PID:8316
- C:\Windows\System\jrCMPWi.exe
  C:\Windows\System\jrCMPWi.exe
  2⤵
  PID:8724
- C:\Windows\System\XhIVViX.exe
  C:\Windows\System\XhIVViX.exe
  2⤵
  PID:8660
- C:\Windows\System\nMtzDeo.exe
  C:\Windows\System\nMtzDeo.exe
  2⤵
  PID:8580
- C:\Windows\System\TgpgRKm.exe
  C:\Windows\System\TgpgRKm.exe
  2⤵
  PID:8788
- C:\Windows\System\PsXpLNj.exe
  C:\Windows\System\PsXpLNj.exe
  2⤵
  PID:8912
- C:\Windows\System\fbzJNsY.exe
  C:\Windows\System\fbzJNsY.exe
  2⤵
  PID:8976
- C:\Windows\System\NWcVLqd.exe
  C:\Windows\System\NWcVLqd.exe
  2⤵
  PID:8928
- C:\Windows\System\lfbShgS.exe
  C:\Windows\System\lfbShgS.exe
  2⤵
  PID:8964
- C:\Windows\System\OLKaFxp.exe
  C:\Windows\System\OLKaFxp.exe
  2⤵
  PID:8868
- C:\Windows\System\mYKBduK.exe
  C:\Windows\System\mYKBduK.exe
  2⤵
  PID:9132
- C:\Windows\System\ygnxnnl.exe
  C:\Windows\System\ygnxnnl.exe
  2⤵
  PID:8204
- C:\Windows\System\bBEGiTR.exe
  C:\Windows\System\bBEGiTR.exe
  2⤵
  PID:9028
- C:\Windows\System\oyXRcwP.exe
  C:\Windows\System\oyXRcwP.exe
  2⤵
  PID:9184
- C:\Windows\System\dXwnvWG.exe
  C:\Windows\System\dXwnvWG.exe
  2⤵
  PID:8284
- C:\Windows\System\cSWQnoE.exe
  C:\Windows\System\cSWQnoE.exe
  2⤵
  PID:8380
- C:\Windows\System\EppvScC.exe
  C:\Windows\System\EppvScC.exe
  2⤵
  PID:8464
- C:\Windows\System\PMdjVnq.exe
  C:\Windows\System\PMdjVnq.exe
  2⤵
  PID:8444
- C:\Windows\System\RMhmary.exe
  C:\Windows\System\RMhmary.exe
  2⤵
  PID:8512
- C:\Windows\System\AIsojoJ.exe
  C:\Windows\System\AIsojoJ.exe
  2⤵
  PID:8816
- C:\Windows\System\MVODnWt.exe
  C:\Windows\System\MVODnWt.exe
  2⤵
  PID:8676
- C:\Windows\System\nmCdAln.exe
  C:\Windows\System\nmCdAln.exe
  2⤵
  PID:8832
- C:\Windows\System\xVJvyNZ.exe
  C:\Windows\System\xVJvyNZ.exe
  2⤵
  PID:8996
- C:\Windows\System\BFMkfME.exe
  C:\Windows\System\BFMkfME.exe
  2⤵
  PID:8960
- C:\Windows\System\YwlkVVA.exe
  C:\Windows\System\YwlkVVA.exe
  2⤵
  PID:9092
- C:\Windows\System\UeAqKlg.exe
  C:\Windows\System\UeAqKlg.exe
  2⤵
  PID:8348
- C:\Windows\System\BrabwOW.exe
  C:\Windows\System\BrabwOW.exe
  2⤵
  PID:8232
- C:\Windows\System\YXGIiqN.exe
  C:\Windows\System\YXGIiqN.exe
  2⤵
  PID:8640
- C:\Windows\System\ddODwSX.exe
  C:\Windows\System\ddODwSX.exe
  2⤵
  PID:9060
- C:\Windows\System\cErAOPE.exe
  C:\Windows\System\cErAOPE.exe
  2⤵
  PID:8720
- C:\Windows\System\SfDVZwI.exe
  C:\Windows\System\SfDVZwI.exe
  2⤵
  PID:8884
- C:\Windows\System\EqFUivw.exe
  C:\Windows\System\EqFUivw.exe
  2⤵
  PID:8932
- C:\Windows\System\bpVoZxr.exe
  C:\Windows\System\bpVoZxr.exe
  2⤵
  PID:8656
- C:\Windows\System\PECOPmx.exe
  C:\Windows\System\PECOPmx.exe
  2⤵
  PID:8980
- C:\Windows\System\yEkcTkB.exe
  C:\Windows\System\yEkcTkB.exe
  2⤵
  PID:9228
- C:\Windows\System\dXGDMPN.exe
  C:\Windows\System\dXGDMPN.exe
  2⤵
  PID:9244
- C:\Windows\System\GYANqlJ.exe
  C:\Windows\System\GYANqlJ.exe
  2⤵
  PID:9260
- C:\Windows\System\PbIISTk.exe
  C:\Windows\System\PbIISTk.exe
  2⤵
  PID:9276
- C:\Windows\System\uXfwonn.exe
  C:\Windows\System\uXfwonn.exe
  2⤵
  PID:9292
- C:\Windows\System\YfOJIKQ.exe
  C:\Windows\System\YfOJIKQ.exe
  2⤵
  PID:9308
- C:\Windows\System\PcHAegT.exe
  C:\Windows\System\PcHAegT.exe
  2⤵
  PID:9324
- C:\Windows\System\IWRwFuZ.exe
  C:\Windows\System\IWRwFuZ.exe
  2⤵
  PID:9340
- C:\Windows\System\jsszhZn.exe
  C:\Windows\System\jsszhZn.exe
  2⤵
  PID:9356
- C:\Windows\System\mRuwgFP.exe
  C:\Windows\System\mRuwgFP.exe
  2⤵
  PID:9372
- C:\Windows\System\DkrdmMf.exe
  C:\Windows\System\DkrdmMf.exe
  2⤵
  PID:9388
- C:\Windows\System\HmMRQQA.exe
  C:\Windows\System\HmMRQQA.exe
  2⤵
  PID:9404
- C:\Windows\System\TdTwjuh.exe
  C:\Windows\System\TdTwjuh.exe
  2⤵
  PID:9420
- C:\Windows\System\vHLWrGa.exe
  C:\Windows\System\vHLWrGa.exe
  2⤵
  PID:9436
- C:\Windows\System\EtmtBUU.exe
  C:\Windows\System\EtmtBUU.exe
  2⤵
  PID:9452
- C:\Windows\System\ioTjgcF.exe
  C:\Windows\System\ioTjgcF.exe
  2⤵
  PID:9468
- C:\Windows\System\xAgHIvE.exe
  C:\Windows\System\xAgHIvE.exe
  2⤵
  PID:9484
- C:\Windows\System\GpQJQOy.exe
  C:\Windows\System\GpQJQOy.exe
  2⤵
  PID:9500
- C:\Windows\System\SszMSZs.exe
  C:\Windows\System\SszMSZs.exe
  2⤵
  PID:9516
- C:\Windows\System\ssIEpkG.exe
  C:\Windows\System\ssIEpkG.exe
  2⤵
  PID:9532
- C:\Windows\System\jOoVMaA.exe
  C:\Windows\System\jOoVMaA.exe
  2⤵
  PID:9548
- C:\Windows\System\dvUycHW.exe
  C:\Windows\System\dvUycHW.exe
  2⤵
  PID:9564
- C:\Windows\System\nnzQyQT.exe
  C:\Windows\System\nnzQyQT.exe
  2⤵
  PID:9580
- C:\Windows\System\ctBMEIv.exe
  C:\Windows\System\ctBMEIv.exe
  2⤵
  PID:9596
- C:\Windows\System\WIhqTUF.exe
  C:\Windows\System\WIhqTUF.exe
  2⤵
  PID:9612
- C:\Windows\System\DjvJtSD.exe
  C:\Windows\System\DjvJtSD.exe
  2⤵
  PID:9628
- C:\Windows\System\ySNWwGS.exe
  C:\Windows\System\ySNWwGS.exe
  2⤵
  PID:9644
- C:\Windows\System\tITYnpF.exe
  C:\Windows\System\tITYnpF.exe
  2⤵
  PID:9660
- C:\Windows\System\wMVANpY.exe
  C:\Windows\System\wMVANpY.exe
  2⤵
  PID:9676
- C:\Windows\System\tChpLyG.exe
  C:\Windows\System\tChpLyG.exe
  2⤵
  PID:9692
- C:\Windows\System\uJLOzyL.exe
  C:\Windows\System\uJLOzyL.exe
  2⤵
  PID:9708
- C:\Windows\System\wqxonki.exe
  C:\Windows\System\wqxonki.exe
  2⤵
  PID:9724
- C:\Windows\System\MOGzioY.exe
  C:\Windows\System\MOGzioY.exe
  2⤵
  PID:9740
- C:\Windows\System\AkGuAXB.exe
  C:\Windows\System\AkGuAXB.exe
  2⤵
  PID:9756
- C:\Windows\System\XUmJLHP.exe
  C:\Windows\System\XUmJLHP.exe
  2⤵
  PID:9772
- C:\Windows\System\XQbCiDo.exe
  C:\Windows\System\XQbCiDo.exe
  2⤵
  PID:9788
- C:\Windows\System\denqqsf.exe
  C:\Windows\System\denqqsf.exe
  2⤵
  PID:9804
- C:\Windows\System\LipRfNW.exe
  C:\Windows\System\LipRfNW.exe
  2⤵
  PID:9820
- C:\Windows\System\YrNkxpL.exe
  C:\Windows\System\YrNkxpL.exe
  2⤵
  PID:9836
- C:\Windows\System\Oxqpfnn.exe
  C:\Windows\System\Oxqpfnn.exe
  2⤵
  PID:9852
- C:\Windows\System\QPBIMIN.exe
  C:\Windows\System\QPBIMIN.exe
  2⤵
  PID:9868
- C:\Windows\System\UMugZjh.exe
  C:\Windows\System\UMugZjh.exe
  2⤵
  PID:9884
- C:\Windows\System\pBgXmrr.exe
  C:\Windows\System\pBgXmrr.exe
  2⤵
  PID:9900
- C:\Windows\System\UrFrBmP.exe
  C:\Windows\System\UrFrBmP.exe
  2⤵
  PID:9916
- C:\Windows\System\OvueTRT.exe
  C:\Windows\System\OvueTRT.exe
  2⤵
  PID:9932
- C:\Windows\System\PnfUGPy.exe
  C:\Windows\System\PnfUGPy.exe
  2⤵
  PID:9948
- C:\Windows\System\RivhgqN.exe
  C:\Windows\System\RivhgqN.exe
  2⤵
  PID:9964
- C:\Windows\System\ncKojpP.exe
  C:\Windows\System\ncKojpP.exe
  2⤵
  PID:9980
- C:\Windows\System\SUzxWwQ.exe
  C:\Windows\System\SUzxWwQ.exe
  2⤵
  PID:9996
- C:\Windows\System\QTCnCZF.exe
  C:\Windows\System\QTCnCZF.exe
  2⤵
  PID:10012
- C:\Windows\System\wPFGUmP.exe
  C:\Windows\System\wPFGUmP.exe
  2⤵
  PID:10028
- C:\Windows\System\WXedbhK.exe
  C:\Windows\System\WXedbhK.exe
  2⤵
  PID:10044
- C:\Windows\System\UvBMvES.exe
  C:\Windows\System\UvBMvES.exe
  2⤵
  PID:10060
- C:\Windows\System\ToXIRDO.exe
  C:\Windows\System\ToXIRDO.exe
  2⤵
  PID:10076
- C:\Windows\System\VwrDJDj.exe
  C:\Windows\System\VwrDJDj.exe
  2⤵
  PID:10092
- C:\Windows\System\nbFKCjl.exe
  C:\Windows\System\nbFKCjl.exe
  2⤵
  PID:10108
- C:\Windows\System\pShwGxY.exe
  C:\Windows\System\pShwGxY.exe
  2⤵
  PID:10124
- C:\Windows\System\WEXpeby.exe
  C:\Windows\System\WEXpeby.exe
  2⤵
  PID:10140
- C:\Windows\System\CGQCufx.exe
  C:\Windows\System\CGQCufx.exe
  2⤵
  PID:10156
- C:\Windows\System\BKhoreb.exe
  C:\Windows\System\BKhoreb.exe
  2⤵
  PID:10172
- C:\Windows\System\WmtRrzs.exe
  C:\Windows\System\WmtRrzs.exe
  2⤵
  PID:10188
- C:\Windows\System\oTdNxeo.exe
  C:\Windows\System\oTdNxeo.exe
  2⤵
  PID:10204
- C:\Windows\System\gimfCSX.exe
  C:\Windows\System\gimfCSX.exe
  2⤵
  PID:10220
- C:\Windows\System\yuXUyDN.exe
  C:\Windows\System\yuXUyDN.exe
  2⤵
  PID:10236
- C:\Windows\System\lRqpUSG.exe
  C:\Windows\System\lRqpUSG.exe
  2⤵
  PID:9252
- C:\Windows\System\ZknceeP.exe
  C:\Windows\System\ZknceeP.exe
  2⤵
  PID:9284
- C:\Windows\System\NKsFAJP.exe
  C:\Windows\System\NKsFAJP.exe
  2⤵
  PID:9348
- C:\Windows\System\LzDkseo.exe
  C:\Windows\System\LzDkseo.exe
  2⤵
  PID:9268
- C:\Windows\System\RVmvMnI.exe
  C:\Windows\System\RVmvMnI.exe
  2⤵
  PID:9304
- C:\Windows\System\JTdwvTB.exe
  C:\Windows\System\JTdwvTB.exe
  2⤵
  PID:9368
- C:\Windows\System\QKumsQa.exe
  C:\Windows\System\QKumsQa.exe
  2⤵
  PID:9380
- C:\Windows\System\gsEXkKc.exe
  C:\Windows\System\gsEXkKc.exe
  2⤵
  PID:9464
- C:\Windows\System\uStrmiZ.exe
  C:\Windows\System\uStrmiZ.exe
  2⤵
  PID:9492
- C:\Windows\System\pIfVUlq.exe
  C:\Windows\System\pIfVUlq.exe
  2⤵
  PID:9444
- C:\Windows\System\DfRpMMo.exe
  C:\Windows\System\DfRpMMo.exe
  2⤵
  PID:9592
- C:\Windows\System\ICnAfOG.exe
  C:\Windows\System\ICnAfOG.exe
  2⤵
  PID:9512
- C:\Windows\System\bucvjnL.exe
  C:\Windows\System\bucvjnL.exe
  2⤵
  PID:9544
- C:\Windows\System\OiFzkwz.exe
  C:\Windows\System\OiFzkwz.exe
  2⤵
  PID:9684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKOgZqt.exe

Filesize
2.1MB

MD5
d1619c8cc5b67bf972b732c7c8eafdf8

SHA1
c13848391b0884e50f02ce6ddea466162d1e91ab

SHA256
ba7f78309719e11946477715567304bb259e597f798cf07f23692e6f9ae9c462

SHA512
ff192b0bf74657d74789a86baedc1d11f73fe2b6ffa58f21b531095e06271b632e4d447cf0da8f99dc54e12095e212dcf60f04b50ecddf14db9d80ff156a0211

Download Submit
C:\Windows\system\BYYJzHJ.exe

Filesize
2.1MB

MD5
b2700a8090770f5680b1c0a41a0eae67

SHA1
f37e687522582b8cc0e0fa22e5bb7358a33a471a

SHA256
34a1c7b1aacf6bf895531e5015ba8cfd97f7dc180e7b5ab41617695234f47d9f

SHA512
3a236504b61399deb84171588463fa70cd82e7ca2b4e6d32a83057a7d840fe0b797fd451dee195c989e875cb98ed69f037f10ac85911af75b9f7b4813076d55b

Download Submit
C:\Windows\system\EtgbYtO.exe

Filesize
2.1MB

MD5
fc22515dbb49120c5cffec1685121694

SHA1
5e97e66f53d467c743299bb6ae5242433322dcd0

SHA256
d8eb03c8fb25ee5e36d74e4e425d70a1779123f7d0ba0beeb3ade1d9bfee3f1e

SHA512
cb838857fb814e07acb8b6376e9a20ae6b3daf5522003fca946181a6b02bacf674e39772ebfd01011d54c77b875ad353cb49d7f2769e6b7498144c78c0afd78b

Download Submit
C:\Windows\system\EuZrKZW.exe

Filesize
2.1MB

MD5
8352b0976bbcf8d9bd0c42e23a721aa9

SHA1
895fa03eab95b11fa75a2c30bed02f6567e1e1f2

SHA256
f77a10f703d5c1cf326404df1f4e3ec7b47d01639f07cf00a7aa3895a5c30658

SHA512
4bc12f2d78b73f7e6a0a4aeb808aab7c43e066a194c90308a6bcb3ce181a3bdb1cdcb169e92e54e3603be2a02e7b53391d785a898e14f6affcce076569ddf4f4

Download Submit
C:\Windows\system\MadfRUi.exe

Filesize
2.1MB

MD5
f5c86dad1134865e6bed02633dc20854

SHA1
220c7839e1471e502dbfac41773dd904c8828b21

SHA256
06720a08da306e251820550958d6a679a3483ce6b2ee87e4e468e36bdf881948

SHA512
0a0a58d37cbadc30704eaf8c575b8595759b65f6172a3cd6a4089716844b8029beaab17fb3df1084c61959c657bc838279887214fe4e0f38a013883f61d4ba9a

Download Submit
C:\Windows\system\NAkfbvr.exe

Filesize
8B

MD5
6e243c8b38e3d92f12c1f3eed40a3381

SHA1
9cddf51e5ed1489561f7f07e24dbb0373375660c

SHA256
3b6442d24e80d27600c9f4b799385788d98c70d600c89b99f83b72de8a2d37b2

SHA512
1198fd093d8b9db02c218d5c2855535582ecbe96e17ed1d7c0e3e5f22338aecda2fcb8f90f131612a5aa5269b550a96f2f4d4d31468134ed76bcb198b6885ad2

Download Submit
C:\Windows\system\NcqRpjg.exe

Filesize
2.1MB

MD5
99222c19f3a7c9598102cde019ca2f29

SHA1
2bacf34bb4f650e9e09131b88a0e809e0e31671e

SHA256
50cd802dc00c3f7375664ee31fa7ffee6a939dc08e7d69be9c4776456e1d7c72

SHA512
03b174358837ce7cc916ac4bc1756b81215c30b696d2c397caf9a1a8ef599203d6ac27e9d8fbd0b242dfc635cf912fe09ddbbca39db3f90fd26ff3dc0b876887

Download Submit
C:\Windows\system\NhXXJdV.exe

Filesize
2.1MB

MD5
6dc79ff26cc281a2498b1411fd8c3deb

SHA1
09c110ce19caa0eef5bb9f8677d4c1d3c0a3736d

SHA256
50f599e4888c08db0e47bf84d33dcbe250b14ac1b9de73afa418e2e01f8a18e5

SHA512
702aed971d2e5c5ac45a14bc72752e2dc6e3ff4136fc96aacd75c9e3bad97bebdbd7136bdc1cf8b67f4c5d31b98c02985655b2a3771a8a579e94c4ef030f75c3

Download Submit
C:\Windows\system\OQBlVRW.exe

Filesize
2.1MB

MD5
535c510a1b1fd5eca5a7e5c24e65793a

SHA1
54b096c288fe07d3fe5830626e07c8f97f1aa2e4

SHA256
0e97348da81b80300e5b1dd62cbe9f186725d924e50ed60b40f13e8d0142510f

SHA512
4d91b53542df96675c88c26d494f0bb20a1349cd9f4e49ec30c00c284d03b25c9957a16306db7f0c9bb2a93fc975a0d58364b4adc4b18cc229fe573f12d945b2

Download Submit
C:\Windows\system\RQGVjNV.exe

Filesize
2.1MB

MD5
070c923e7c7493423675c89e03a0633b

SHA1
19f2db75580f77a43c324f74b728a6c0a0b9ab49

SHA256
cf0b1696a0c3fa00dc4da515494178132605011f673702c519b44a0b1f0f292d

SHA512
2cdc65a44dbeceda882a8e278ad8364dcbdfabd4923c99b24f7aef5824c1802b5bb6a405ab7dbfa26b1f7ec6c7955b0a48d2f8c1f04de37c4add60bd0b10d268

Download Submit
C:\Windows\system\ULHdyXg.exe

Filesize
2.1MB

MD5
7458f5f6a37085372ca55cd6738499ea

SHA1
52ee8a252e6ecf6ac1a68b70e002c690565ee937

SHA256
147ca39e038d1c5c4667626299212a4871f801ea9b41d8f723027b2c2c955170

SHA512
2a03c707a69416e8c3fc8ad6f95cfd68e5693093017e96848a3d3e8dfc603686defb5990c2d8cb69245b32678885fc63b804173805de7af9b6d7bc1bafa5ad1f

Download Submit
C:\Windows\system\VbFvekq.exe

Filesize
2.1MB

MD5
40bfd658a6bd97179bacfbaf2e1b13db

SHA1
f46733c92014409453f36d72fedd364d3a34e513

SHA256
3ee78959be00de44d2c7bf4dc14e099e6274ada978631bc89599a5cebad50022

SHA512
e2dd6d6bca3fee9031d23eb6cccd73716fc2cf10065c320482a40fd7905f142550b810613ce2355d395691bfa85096d61b7987c4609c7cecef225806b258a371

Download Submit
C:\Windows\system\XnZWKZz.exe

Filesize
2.1MB

MD5
505f5cd90aad6da4d49014f2db4d47cf

SHA1
f7612e13f29dc86b54b2c3154562f4ba10d47988

SHA256
fac02b78d44a55f568ea1064a8ecdf0fb908c8de87ffb69fc77942919506ec93

SHA512
5739c1a0407e65faf48b696dd991a256cae174dc59bfded492621dc4c0c3c5436bfee7d4a47e9cdb7fd7016897bab0c165d23f1c04865accc6564e9ee9bcdd8a

Download Submit
C:\Windows\system\eweIwZC.exe

Filesize
2.1MB

MD5
663bf54873ace99a4341ee90b23f990b

SHA1
6dbff4a10bf16de5ca22425a6a4d90e19e249b00

SHA256
8f793a38808e5483e4f0228976d051f05c57032ea7151877e7496a088e7189f7

SHA512
1205418af8bd69ae751d1a0e95a1dd3ca1905ec326bf2a38dea4cf84c1d9e5d8d0a783734959114ad382fb650db232d2d10b70e0dcc4160d16445ea150d43c02

Download Submit
C:\Windows\system\fMjRenB.exe

Filesize
2.1MB

MD5
ce34e7ce10b3357d4cf02465f2ea8799

SHA1
e533397379dc75180103e798314d3b37afa9f90a

SHA256
0e7eab81a74ad603fa84b1978edf1887a3447774cbcb901e2788ae80db809d96

SHA512
6e7edb0b226599b2a720a33745d39312235bace4ad7c09243d1ddf0a670c40f77d37628229f4208292e4d694aaec3ba75813740b0186fa9482075cceb589450b

Download Submit
C:\Windows\system\gYhnUGj.exe

Filesize
2.1MB

MD5
d8b1782bc8535abfaf4c48e982af4131

SHA1
e5d6cc637c1a394882686bede3e50ceace30fa00

SHA256
75ae0516ef341cafa7af4e328d9774de439327f0fd4584f1df982baaa1473840

SHA512
36646478ea2a9ec1e923407f8b8f7471be9a422ab578090fbf8b1a7cdd2b4f90e4876ad7f3c633807d756635574791afa0a9e2c2733ede3158beb8decfc7a5eb

Download Submit
C:\Windows\system\hLJpsEg.exe

Filesize
2.1MB

MD5
25c7e7164814659422903ddaccf00784

SHA1
0634fbf57235ac904f2bff846423657762d9ced2

SHA256
90617c14088150709f3099ee3bc0b4d73b67ab52acd511c374ad02144b78d8b5

SHA512
c8b8fb3539bd56e01b4d0992ba55dd342a95b64a5db1fa8123707b011dd40797ce50b6d96783416a6664801ff768e378b189add2ce7102dcbffcfa2f537c678a

Download Submit
C:\Windows\system\mpbkCbM.exe

Filesize
2.1MB

MD5
898f754ad001dcb6e55f031bab8adacc

SHA1
055789d6246444c5010b907df875fac58349f6f3

SHA256
e50808cf1911e22b7f128d2b1f53a1d2fc8fd0c466c8568cc99189e58d7144e3

SHA512
7b215ee98baaf81f4173ac340d97aa4c0fb861b2a996afbf3dae4f91d4d2ae797a2cc1dfbfc4c17d70f9bd58268aacaf98cb5f004c917b2abc0cec7f17f09499

Download Submit
C:\Windows\system\rODsdGo.exe

Filesize
2.1MB

MD5
1895741137032e09eb78dccd9d6b92bb

SHA1
a58ca10d3bfec6f36c9d33838cfab500196ac4de

SHA256
80e6f426993bc691eff00ea74ea0f36d311bdd4f26d8215b5e7b183c1ca5986b

SHA512
7f45c1034752da46874c3478c7d8c2bae6ce2ceb0e1783da089b96ff63f87cab9599b130c2bea4293d74bfc6220eeab4eae147a456d1f7b37cb3c351886d8654

Download Submit
C:\Windows\system\syeKuAw.exe

Filesize
2.1MB

MD5
74d56535082f04b8ff6324d443c891f9

SHA1
4043f8bd5cd56597e050ada3687b0900e8a18250

SHA256
e26798ffbec9e46b627a1bf322f8b9d37b5fa5ff4ad1b2d7dd981b74d0c4e22a

SHA512
36b3dfc23d727e5f3f57fb2eb7f67e9de7f4a8f74d1ead8758f35c03949a36c03da3a0788b0e59049aeb9aed127693d5233e1b262fb2f5822111a1442371da60

Download Submit
C:\Windows\system\wmjgyaP.exe

Filesize
2.1MB

MD5
7c9f133b49a24b7ee31abbe445f9a3cf

SHA1
bb842e3f41105282338eb4d2944c33b746f5c053

SHA256
57316f1cc4858b80f94edd55e2da454d0af6327c06d62b09c42082b8fdbc992b

SHA512
8d018a26344f177c6fc27f27fd71264c04125f19390fa7f1a25c7cf9dce6aaa8b56a8e05e557d1720536f3f8bd8426917bbc096c0afcc7a279f49d1dc478147e

Download Submit
C:\Windows\system\yhJONGA.exe

Filesize
2.1MB

MD5
b8020644069d341821137f6c8c67ddb3

SHA1
bd7df9954ea23ad79493ca2b3e2e852144bc2618

SHA256
ba777324405e6c33d6c2496673da4d012b6caf394596c2e73df9d8e48cdcdbe6

SHA512
d396322fad7c3553af2e9bf17fbf01c8a1e28f66f96e241021741936eeda9faf150691bcdf71d3c8a2e44b01e86d0a8ab7d0a8f61740e4c7ca3363b2394fd35f

Download Submit
\Windows\system\GKdwfdp.exe

Filesize
2.1MB

MD5
95e39d8c8ab469b6fdc0f3745fcc300e

SHA1
8d0715ccdfe72f62995c007dd5636e3e5ad648cd

SHA256
c5f2a55c8fd3536f6637b62872f70946b91ebd744e9a63f3ddef03c49e60a9e0

SHA512
717bdbbee07c741a0cfb9105a4964b3d4a77fefa2d10eb9e94433af601f1caa980a1ad5759d449739e0677b29c70f16a1ce850dd020524d2ee3ee7e9f2c87bc3

Download Submit
\Windows\system\RsoMZmA.exe

Filesize
2.1MB

MD5
99eb0864a26ae56c8dac883d0e8c4954

SHA1
5493bf077ff5afcede463c9400c08d10364a57eb

SHA256
a7bd00385e4b55f87a2375d0f32a45e2b5aebed79f7e7c9b50f2b39cfbc23574

SHA512
1a157a4e439176768a6927d4157b60baa85443431d8e16aee5326bb4e2cbcb10f271b4f333732b8704970c78604ee5ca643e4a16869ac08390c654e5de138749

Download Submit
\Windows\system\SXmbbZn.exe

Filesize
2.1MB

MD5
b8c75bf64198f8befe626cc6eb8d9637

SHA1
64d9adf55a23bed8d34738d789a221a51e012ef4

SHA256
d125f6bf80716b7c08d7c98b7c197ce32187e520743d9cde8cee5b56a7bf4eff

SHA512
ea40ff14f134d50a8f3ed9c4a86d9749cad68a0208cbe5d5dfa617c025bf3fc657377aaf082aea98a7c64302c40dc2e7380b51b3a6ed1d773f63f24fd214e0b4

Download Submit
\Windows\system\XoXYMcW.exe

Filesize
2.1MB

MD5
adf4c67e9e114c65989826e7be840b12

SHA1
0f7de0877ec4d20dbfb1189e962bc48fce3ba454

SHA256
9461cff21e8fe863e2e71ae49f0f7e7a69b3e80673bcc3b029c6b1fd2e38920d

SHA512
d584b7edc9c5eae31df090eb7de65bf9d2b8d39d1d9706e5107e0ba3134376a1f2a20f217a29abca703a3bc07a44d31551c5a75172a349e2ce92a4c56561b1da

Download Submit
\Windows\system\dQrcKJm.exe

Filesize
2.1MB

MD5
b7ae552d6e601f912c481cc61ed5ac4b

SHA1
a3cec0179a92ba88d1c4d0734db4f6006a4735ac

SHA256
f9370c008dd395da077cf36a13c3f109e4463058ef20f86658b1025819135de6

SHA512
667a4a6d1cbaab0ce92b82ae0844ca74042be2af61e57d42b642da4da4dac72b9c521a107facda70aa0064ea4a5122c469b5782dbcce1074402cbea9b023d278

Download Submit
\Windows\system\eYWkXKn.exe

Filesize
2.1MB

MD5
4a502681d9894105e3cd602f71ffd08b

SHA1
c27e55fa49f0b4a8720644e159fa11abb78ab13c

SHA256
c80609eb8e217dad4de4b2db6a4a1fd250dfed1d419af64a93fb0b9e22fcabdb

SHA512
74ae93e7f8d76a8577e204d9f0c85d6a164bd2e831a8b92bac4a977e0cb8924a8c7096008603d9faec0207fb83bf87755bdfd70130c8d2a78311eda4160b3d8e

Download Submit
\Windows\system\fuXYqUv.exe

Filesize
2.1MB

MD5
a6d47329afe3af32f8a65f4c750c55a5

SHA1
ef9b0bce8af19d677b650280ecc6fb01933f06c3

SHA256
a0cb61c493de171de2ffd6c83cdc3d36bbd156752a046cb432bbd53231960cf2

SHA512
f8b9b116f0d49cec58c19aad4cf3cb7e911a9a8cdf7b64c4e7b6b120d6e63378c723944ecf995969a5eb68ed8a46e7e475446650d36a7ed1231976b708e7b1f0

Download Submit
\Windows\system\geMssxf.exe

Filesize
2.1MB

MD5
ed7977bfad609ac5c9d43905bdacfefe

SHA1
d9727ca29d46bf12aaabd7d53ededffea4dd87ed

SHA256
58d2a143754aad39a933118659c555afb777e8bf81aaa4d82304f7c91111336e

SHA512
3ad3b1e5a8258ea57dfe16a351f2d8f8d822028c083d10887adc0b002587071496872cbb11ec88d6abfbe667ee72efc80e5c83e3d7cf63e82a88e321e1ce629f

Download Submit
\Windows\system\ppURuxT.exe

Filesize
2.1MB

MD5
bb3d9e70ed86035b83e61f150e441cc2

SHA1
0104c4596d1b656a2b40928930bbf904093611cf

SHA256
7781250878a565aaac620a208c9050643f487c3f0682a3aa9be897fe6a7e0dbb

SHA512
7c5221570efb1a2d2564ae6499cbc73995b9f1f6374442ca704b77abc9d8bc4f0d4eb593c2a3db0c550497ed7cb45e44cce74c7c2384b56e2ae35cb1a20f1954

Download Submit
\Windows\system\tHZVdux.exe

Filesize
2.1MB

MD5
c9ef65574180a0f1593e8ba9d2c925c7

SHA1
b66455574d5997fa716462a0ae11dcc03f7f66c2

SHA256
72e64c5a1ea6710b3d9da4de0a2f16bb38f4ccf5dfdbcbf71e783da72d15d3bd

SHA512
c8a3c2518c69df15721e823b6d749efa53771bd240c19d89bd97846e01fffe7f7f6b7a606144ca28ad56aa2be4935836265f2e1698288f25540d685daa9fa80c

Download Submit
\Windows\system\upLPxCE.exe

Filesize
2.1MB

MD5
2af85ac144c627078fe5b6a4ea1c185d

SHA1
7499a8cd1f17b7d0aa920479554cecff2b077c6d

SHA256
0deb271703b17a17c8dd9b33ec13ca8283ea290d42df48c9596a45a5977fd3a8

SHA512
b9a2a5fe9430464401ef9ad8f6c7a73c584af4cee976f8af625c73470e3dfdf656193033cf1afc5759492a322c4d696b79f3ffcf41deea0da72cab6411ff6626

Download Submit
\Windows\system\xywQqBl.exe

Filesize
2.1MB

MD5
66d9fef6e133d8894597a812fb1f7ec2

SHA1
a2c6d07c69ac3fa449478449808aeb0da6c64509

SHA256
24f86c2c4f6ccdfefbbc423ef853a384e95a48f143353f8ace24984d8c1e773a

SHA512
240a43b2b63db91de830065e675392c6418e5c0bf1121c3055606fc1d24d8e1ea893b1a2e7dfc913810314fe01b3fe7c2d6a1f55b7f5c63935cf945c23afa8dd

Download Submit
memory/844-2-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/844-50-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/844-7746-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/844-52-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/844-18-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/844-2124-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/844-48-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/844-8-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/844-72-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/844-126-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/844-101-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/844-121-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/844-98-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/844-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/844-46-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/844-95-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/844-123-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/1284-5685-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/1284-47-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2060-5682-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-19-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-49-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2472-5688-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2512-85-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-5686-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-51-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5683-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-5692-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2744-53-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2852-103-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5623-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2900-9-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2900-5681-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/3012-5687-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-102-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-105-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5684-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/3056-30-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/3056-54-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/3056-44-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/3056-21-0x000007FEF5FBE000-0x000007FEF5FBF000-memory.dmp

Filesize
4KB

Download
memory/3056-104-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/3056-22-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/3056-20-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download