xmrig | ce9ba08c3aa4f837c92d54bd3c791a0fc7a452a38ebbfebe8bcfb19e4c05f912

Analysis

max time kernel
146s
max time network
145s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
Size

2.0MB
MD5

23a6177a91a52011c04e7fc2225da063
SHA1

4ce2605cef1b63d9cbfa6a9c16f17808e1644653
SHA256

ce9ba08c3aa4f837c92d54bd3c791a0fc7a452a38ebbfebe8bcfb19e4c05f912
SHA512

57da395eedf6fa6ca6054849e9fe6bdbaa4dc75578ce8f778f2e5b7a011874ff25b9393a09bc8ddf9f32b298e6c65f8a778b8b23420f6172d400808e121e9268
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafG:NABx

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2652-92-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2292-90-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2592-89-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2768-88-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2560-85-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2092-74-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2676-65-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2212-12-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/1656-32-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2212-3864-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2092-3862-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/1656-3861-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2768-3860-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2292-3859-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2652-3865-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2560-3858-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2592-3857-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2676-3856-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2484	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2212	AyBnjwL.exe
1656	MYTcUYe.exe
2652	GGMldLe.exe
2676	LHSjzWc.exe
2092	zlLinvG.exe
2560	rDRZKzg.exe
2768	SCAIpuw.exe
2592	wyNARDl.exe
2292	uUxyBVm.exe
2788	kWnmYxl.exe
3048	rOjApde.exe
2964	CmOpxvf.exe
2068	QjFMZmb.exe
2568	SykruaT.exe
2536	pZlPjlk.exe
1192	ZomWUYs.exe
3044	JZLryVZ.exe
1552	OynjFhW.exe
2132	PtnuYta.exe
2276	zuXjamF.exe
1324	roRgdVi.exe
2100	VXbpAyh.exe
2992	zLAUlHh.exe
768	XTlZUXJ.exe
2280	kZYdExh.exe
684	UlTxjSt.exe
1672	WDPTUCm.exe
904	rLTtklW.exe
1084	OdFurFX.exe
840	CZiNWzG.exe
1680	XMMiLLT.exe
1876	sfPIFUV.exe
2300	IJIHPgB.exe
2104	KVBfHEC.exe
1708	dhkkumO.exe
1788	VRWqIwY.exe
1548	DpYATfp.exe
1988	sLoylwX.exe
1592	WRfxPra.exe
1884	TJQRQLk.exe
1956	outvrpz.exe
1824	yHJCtMo.exe
1832	vqHIARK.exe
2472	lNONUOE.exe
856	AYdCaHp.exe
1536	EMyxzee.exe
2600	aBPAxoF.exe
2604	GqYxUNi.exe
980	zMXqzFd.exe
2156	BAkaikK.exe
3024	TKQvXqQ.exe
2400	cgphRpl.exe
1704	naBjXQJ.exe
876	ThFmHyn.exe
1052	gDWOsfu.exe
2188	myVWjtn.exe
2224	jkOkUrw.exe
2812	SDTnUyk.exe
2672	YyBoqPZ.exe
1764	OaCtgeP.exe
2516	ZheegNb.exe
3064	UoCjpJT.exe
2916	SodGWgH.exe
1572	ptCBBSw.exe

Loads dropped DLL 64 IoCs

pid	Process
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012263-6.dat	upx
behavioral1/memory/2208-2-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x0007000000016020-26.dat	upx
behavioral1/files/0x0006000000016d5f-79.dat	upx
behavioral1/files/0x0006000000016d4f-58.dat	upx
behavioral1/files/0x0006000000016d3e-50.dat	upx
behavioral1/files/0x0006000000016d2d-43.dat	upx
behavioral1/files/0x0007000000016126-38.dat	upx
behavioral1/files/0x0007000000015fbb-37.dat	upx
behavioral1/files/0x0006000000016d79-119.dat	upx
behavioral1/files/0x0032000000015d02-125.dat	upx
behavioral1/files/0x0007000000016fa9-131.dat	upx
behavioral1/files/0x00130000000054a8-123.dat	upx
behavioral1/files/0x0008000000016d01-34.dat	upx
behavioral1/files/0x0031000000015cf5-29.dat	upx
behavioral1/files/0x000600000001708c-136.dat	upx
behavioral1/files/0x0008000000015d28-20.dat	upx
behavioral1/memory/2652-92-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2292-90-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2592-89-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2768-88-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x0006000000016d73-87.dat	upx
behavioral1/memory/2560-85-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x0008000000015d99-75.dat	upx
behavioral1/memory/2092-74-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2676-65-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x0006000000016d57-70.dat	upx
behavioral1/files/0x0006000000016d46-69.dat	upx
behavioral1/files/0x0006000000016d36-67.dat	upx
behavioral1/files/0x0006000000016d21-66.dat	upx
behavioral1/memory/2212-12-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/1656-32-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x00060000000171ad-143.dat	upx
behavioral1/files/0x0006000000017603-176.dat	upx
behavioral1/files/0x000600000001738f-154.dat	upx
behavioral1/files/0x00060000000173e2-186.dat	upx
behavioral1/files/0x00060000000175f7-184.dat	upx
behavioral1/files/0x00060000000174ef-183.dat	upx
behavioral1/files/0x00060000000173e5-182.dat	upx
behavioral1/files/0x000d000000018689-179.dat	upx
behavioral1/files/0x00060000000175fd-173.dat	upx
behavioral1/files/0x000600000001738e-168.dat	upx
behavioral1/files/0x0006000000017577-164.dat	upx
behavioral1/files/0x0006000000017436-158.dat	upx
behavioral1/memory/2212-3864-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2092-3862-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/1656-3861-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2768-3860-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2292-3859-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2652-3865-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2560-3858-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2592-3857-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2676-3856-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AFHikwc.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\QPRRZyX.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\UrXCPWe.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\aaofAJT.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\vfLzMZc.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\OGeTOGH.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\naOYhCC.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\sQhIbba.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\TAGZomU.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\fQxKKsO.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\teymCrp.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\vdihRsq.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\DkXOBsc.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\tUvBbjJ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\mwaKzEF.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\ihNiHsP.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\wYquljT.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\vqkRzzo.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\yZojGcu.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\KXFJdaq.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\GgBOoZp.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\aeXZTFp.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\XjatxiR.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\NeqywLA.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\QZaGcEu.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\WppHHEQ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\EBiuMqo.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\RMHDzOQ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\oTMhQOZ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\MOMajpU.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\uLBRyHZ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\tceCAur.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\QrhsQQW.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\maFVBzW.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\WHMtVMX.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\AyBnjwL.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\cNCVPOm.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\DzvztNG.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\NxpgwEf.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\VUVkPlu.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\tCIdXKs.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\tFYOUiE.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\QKmQZLv.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\JSlgVEl.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\wUKXqvk.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\ApXmhbS.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\zSQFAaM.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\YKFpEqi.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\LIVguSj.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\YWVITTK.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\USyHaoM.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\xuIzbxf.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\pkuTlxK.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\VxducgE.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\ZPZVOku.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\CcIJFow.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\WyxWWnm.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\XSVkqId.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\fWfwctU.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\FyUzguJ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\WjMHmpT.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\lJNDQHG.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\gIPOCsQ.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
File created	C:\Windows\System\CeWHGQC.exe	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2484	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
Token: SeDebugPrivilege	2484	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2484	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	29
PID 2208 wrote to memory of 2484	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	29
PID 2208 wrote to memory of 2484	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	29
PID 2208 wrote to memory of 2212	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2212	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2212	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2652	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	31
PID 2208 wrote to memory of 2652	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	31
PID 2208 wrote to memory of 2652	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	31
PID 2208 wrote to memory of 1656	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	32
PID 2208 wrote to memory of 1656	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	32
PID 2208 wrote to memory of 1656	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	32
PID 2208 wrote to memory of 2788	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	33
PID 2208 wrote to memory of 2788	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	33
PID 2208 wrote to memory of 2788	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	33
PID 2208 wrote to memory of 2676	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	34
PID 2208 wrote to memory of 2676	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	34
PID 2208 wrote to memory of 2676	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	34
PID 2208 wrote to memory of 2964	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	35
PID 2208 wrote to memory of 2964	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	35
PID 2208 wrote to memory of 2964	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	35
PID 2208 wrote to memory of 2092	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	36
PID 2208 wrote to memory of 2092	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	36
PID 2208 wrote to memory of 2092	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	36
PID 2208 wrote to memory of 2068	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	37
PID 2208 wrote to memory of 2068	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	37
PID 2208 wrote to memory of 2068	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	37
PID 2208 wrote to memory of 2560	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	38
PID 2208 wrote to memory of 2560	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	38
PID 2208 wrote to memory of 2560	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	38
PID 2208 wrote to memory of 2568	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	39
PID 2208 wrote to memory of 2568	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	39
PID 2208 wrote to memory of 2568	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	39
PID 2208 wrote to memory of 2768	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	40
PID 2208 wrote to memory of 2768	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	40
PID 2208 wrote to memory of 2768	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	40
PID 2208 wrote to memory of 2536	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	41
PID 2208 wrote to memory of 2536	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	41
PID 2208 wrote to memory of 2536	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	41
PID 2208 wrote to memory of 2592	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	42
PID 2208 wrote to memory of 2592	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	42
PID 2208 wrote to memory of 2592	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	42
PID 2208 wrote to memory of 1192	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	43
PID 2208 wrote to memory of 1192	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	43
PID 2208 wrote to memory of 1192	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	43
PID 2208 wrote to memory of 2292	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	44
PID 2208 wrote to memory of 2292	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	44
PID 2208 wrote to memory of 2292	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	44
PID 2208 wrote to memory of 3044	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	45
PID 2208 wrote to memory of 3044	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	45
PID 2208 wrote to memory of 3044	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	45
PID 2208 wrote to memory of 3048	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	46
PID 2208 wrote to memory of 3048	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	46
PID 2208 wrote to memory of 3048	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	46
PID 2208 wrote to memory of 1552	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	47
PID 2208 wrote to memory of 1552	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	47
PID 2208 wrote to memory of 1552	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	47
PID 2208 wrote to memory of 2132	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	48
PID 2208 wrote to memory of 2132	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	48
PID 2208 wrote to memory of 2132	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	48
PID 2208 wrote to memory of 1324	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	49
PID 2208 wrote to memory of 1324	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	49
PID 2208 wrote to memory of 1324	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	49
PID 2208 wrote to memory of 2276	2208	23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\23a6177a91a52011c04e7fc2225da063_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Windows\System\AyBnjwL.exe
  C:\Windows\System\AyBnjwL.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\GGMldLe.exe
  C:\Windows\System\GGMldLe.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\MYTcUYe.exe
  C:\Windows\System\MYTcUYe.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\kWnmYxl.exe
  C:\Windows\System\kWnmYxl.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\LHSjzWc.exe
  C:\Windows\System\LHSjzWc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\CmOpxvf.exe
  C:\Windows\System\CmOpxvf.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\zlLinvG.exe
  C:\Windows\System\zlLinvG.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\QjFMZmb.exe
  C:\Windows\System\QjFMZmb.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\rDRZKzg.exe
  C:\Windows\System\rDRZKzg.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\SykruaT.exe
  C:\Windows\System\SykruaT.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\SCAIpuw.exe
  C:\Windows\System\SCAIpuw.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\pZlPjlk.exe
  C:\Windows\System\pZlPjlk.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\wyNARDl.exe
  C:\Windows\System\wyNARDl.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ZomWUYs.exe
  C:\Windows\System\ZomWUYs.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\uUxyBVm.exe
  C:\Windows\System\uUxyBVm.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\JZLryVZ.exe
  C:\Windows\System\JZLryVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\rOjApde.exe
  C:\Windows\System\rOjApde.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\OynjFhW.exe
  C:\Windows\System\OynjFhW.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\PtnuYta.exe
  C:\Windows\System\PtnuYta.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\roRgdVi.exe
  C:\Windows\System\roRgdVi.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\zuXjamF.exe
  C:\Windows\System\zuXjamF.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\VXbpAyh.exe
  C:\Windows\System\VXbpAyh.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\zLAUlHh.exe
  C:\Windows\System\zLAUlHh.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\kZYdExh.exe
  C:\Windows\System\kZYdExh.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\XTlZUXJ.exe
  C:\Windows\System\XTlZUXJ.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\CZiNWzG.exe
  C:\Windows\System\CZiNWzG.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\UlTxjSt.exe
  C:\Windows\System\UlTxjSt.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\XMMiLLT.exe
  C:\Windows\System\XMMiLLT.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\WDPTUCm.exe
  C:\Windows\System\WDPTUCm.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\sfPIFUV.exe
  C:\Windows\System\sfPIFUV.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\rLTtklW.exe
  C:\Windows\System\rLTtklW.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\IJIHPgB.exe
  C:\Windows\System\IJIHPgB.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\OdFurFX.exe
  C:\Windows\System\OdFurFX.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\KVBfHEC.exe
  C:\Windows\System\KVBfHEC.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\dhkkumO.exe
  C:\Windows\System\dhkkumO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\VRWqIwY.exe
  C:\Windows\System\VRWqIwY.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\DpYATfp.exe
  C:\Windows\System\DpYATfp.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\sLoylwX.exe
  C:\Windows\System\sLoylwX.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\WRfxPra.exe
  C:\Windows\System\WRfxPra.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\TJQRQLk.exe
  C:\Windows\System\TJQRQLk.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\outvrpz.exe
  C:\Windows\System\outvrpz.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\yHJCtMo.exe
  C:\Windows\System\yHJCtMo.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\vqHIARK.exe
  C:\Windows\System\vqHIARK.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\lNONUOE.exe
  C:\Windows\System\lNONUOE.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\AYdCaHp.exe
  C:\Windows\System\AYdCaHp.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\EMyxzee.exe
  C:\Windows\System\EMyxzee.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\aBPAxoF.exe
  C:\Windows\System\aBPAxoF.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\GqYxUNi.exe
  C:\Windows\System\GqYxUNi.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\zMXqzFd.exe
  C:\Windows\System\zMXqzFd.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\BAkaikK.exe
  C:\Windows\System\BAkaikK.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\TKQvXqQ.exe
  C:\Windows\System\TKQvXqQ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\cgphRpl.exe
  C:\Windows\System\cgphRpl.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\naBjXQJ.exe
  C:\Windows\System\naBjXQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\ThFmHyn.exe
  C:\Windows\System\ThFmHyn.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\gDWOsfu.exe
  C:\Windows\System\gDWOsfu.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\myVWjtn.exe
  C:\Windows\System\myVWjtn.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\jkOkUrw.exe
  C:\Windows\System\jkOkUrw.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\SDTnUyk.exe
  C:\Windows\System\SDTnUyk.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\YyBoqPZ.exe
  C:\Windows\System\YyBoqPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OaCtgeP.exe
  C:\Windows\System\OaCtgeP.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\ZheegNb.exe
  C:\Windows\System\ZheegNb.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\UoCjpJT.exe
  C:\Windows\System\UoCjpJT.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\SodGWgH.exe
  C:\Windows\System\SodGWgH.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ptCBBSw.exe
  C:\Windows\System\ptCBBSw.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\WsmFFdO.exe
  C:\Windows\System\WsmFFdO.exe
  2⤵
  PID:2432
- C:\Windows\System\MzxLISp.exe
  C:\Windows\System\MzxLISp.exe
  2⤵
  PID:1968
- C:\Windows\System\ElXCNtZ.exe
  C:\Windows\System\ElXCNtZ.exe
  2⤵
  PID:2832
- C:\Windows\System\BFDyrXZ.exe
  C:\Windows\System\BFDyrXZ.exe
  2⤵
  PID:2864
- C:\Windows\System\Etjxpwl.exe
  C:\Windows\System\Etjxpwl.exe
  2⤵
  PID:2572
- C:\Windows\System\FCrbZQK.exe
  C:\Windows\System\FCrbZQK.exe
  2⤵
  PID:1160
- C:\Windows\System\jQrhGJM.exe
  C:\Windows\System\jQrhGJM.exe
  2⤵
  PID:544
- C:\Windows\System\wEXetIp.exe
  C:\Windows\System\wEXetIp.exe
  2⤵
  PID:1316
- C:\Windows\System\MGMorAm.exe
  C:\Windows\System\MGMorAm.exe
  2⤵
  PID:1960
- C:\Windows\System\WXKIghI.exe
  C:\Windows\System\WXKIghI.exe
  2⤵
  PID:2844
- C:\Windows\System\SjbcOqu.exe
  C:\Windows\System\SjbcOqu.exe
  2⤵
  PID:2628
- C:\Windows\System\SAwNvai.exe
  C:\Windows\System\SAwNvai.exe
  2⤵
  PID:2564
- C:\Windows\System\wOXOCuQ.exe
  C:\Windows\System\wOXOCuQ.exe
  2⤵
  PID:2928
- C:\Windows\System\uLlpZEW.exe
  C:\Windows\System\uLlpZEW.exe
  2⤵
  PID:1964
- C:\Windows\System\ftxcNFT.exe
  C:\Windows\System\ftxcNFT.exe
  2⤵
  PID:2040
- C:\Windows\System\CvVFBci.exe
  C:\Windows\System\CvVFBci.exe
  2⤵
  PID:2684
- C:\Windows\System\IdPmbHo.exe
  C:\Windows\System\IdPmbHo.exe
  2⤵
  PID:2948
- C:\Windows\System\UfAkgDk.exe
  C:\Windows\System\UfAkgDk.exe
  2⤵
  PID:2144
- C:\Windows\System\wVhMQTK.exe
  C:\Windows\System\wVhMQTK.exe
  2⤵
  PID:2000
- C:\Windows\System\CfZvaFT.exe
  C:\Windows\System\CfZvaFT.exe
  2⤵
  PID:1752
- C:\Windows\System\nbmWASR.exe
  C:\Windows\System\nbmWASR.exe
  2⤵
  PID:1760
- C:\Windows\System\BVrDTby.exe
  C:\Windows\System\BVrDTby.exe
  2⤵
  PID:2028
- C:\Windows\System\oAjneLU.exe
  C:\Windows\System\oAjneLU.exe
  2⤵
  PID:2272
- C:\Windows\System\zPFJhCj.exe
  C:\Windows\System\zPFJhCj.exe
  2⤵
  PID:2940
- C:\Windows\System\owgVyZo.exe
  C:\Windows\System\owgVyZo.exe
  2⤵
  PID:2900
- C:\Windows\System\nXcCBiM.exe
  C:\Windows\System\nXcCBiM.exe
  2⤵
  PID:308
- C:\Windows\System\hYyhKWg.exe
  C:\Windows\System\hYyhKWg.exe
  2⤵
  PID:1660
- C:\Windows\System\MySNwlK.exe
  C:\Windows\System\MySNwlK.exe
  2⤵
  PID:2140
- C:\Windows\System\uoIdGgV.exe
  C:\Windows\System\uoIdGgV.exe
  2⤵
  PID:2548
- C:\Windows\System\CBFMjFf.exe
  C:\Windows\System\CBFMjFf.exe
  2⤵
  PID:2552
- C:\Windows\System\EuFTEaC.exe
  C:\Windows\System\EuFTEaC.exe
  2⤵
  PID:884
- C:\Windows\System\NPQflks.exe
  C:\Windows\System\NPQflks.exe
  2⤵
  PID:1740
- C:\Windows\System\VYpufVq.exe
  C:\Windows\System\VYpufVq.exe
  2⤵
  PID:1972
- C:\Windows\System\aBXNYPu.exe
  C:\Windows\System\aBXNYPu.exe
  2⤵
  PID:468
- C:\Windows\System\iFpNqjO.exe
  C:\Windows\System\iFpNqjO.exe
  2⤵
  PID:2268
- C:\Windows\System\QuVJJhU.exe
  C:\Windows\System\QuVJJhU.exe
  2⤵
  PID:1872
- C:\Windows\System\wfQiaLp.exe
  C:\Windows\System\wfQiaLp.exe
  2⤵
  PID:2476
- C:\Windows\System\hVFOvPa.exe
  C:\Windows\System\hVFOvPa.exe
  2⤵
  PID:1040
- C:\Windows\System\mbzHauf.exe
  C:\Windows\System\mbzHauf.exe
  2⤵
  PID:1668
- C:\Windows\System\lIuSIhw.exe
  C:\Windows\System\lIuSIhw.exe
  2⤵
  PID:1816
- C:\Windows\System\nMRKIfV.exe
  C:\Windows\System\nMRKIfV.exe
  2⤵
  PID:1400
- C:\Windows\System\jgthDRU.exe
  C:\Windows\System\jgthDRU.exe
  2⤵
  PID:1648
- C:\Windows\System\rLAJqTg.exe
  C:\Windows\System\rLAJqTg.exe
  2⤵
  PID:1388
- C:\Windows\System\dULrvcI.exe
  C:\Windows\System\dULrvcI.exe
  2⤵
  PID:1796
- C:\Windows\System\mXLQyPm.exe
  C:\Windows\System\mXLQyPm.exe
  2⤵
  PID:948
- C:\Windows\System\MUqEsWK.exe
  C:\Windows\System\MUqEsWK.exe
  2⤵
  PID:2468
- C:\Windows\System\UYCRKLO.exe
  C:\Windows\System\UYCRKLO.exe
  2⤵
  PID:2952
- C:\Windows\System\jdgQfhW.exe
  C:\Windows\System\jdgQfhW.exe
  2⤵
  PID:2152
- C:\Windows\System\ChGqgBD.exe
  C:\Windows\System\ChGqgBD.exe
  2⤵
  PID:1632
- C:\Windows\System\QUleEeO.exe
  C:\Windows\System\QUleEeO.exe
  2⤵
  PID:1700
- C:\Windows\System\OFiFWYJ.exe
  C:\Windows\System\OFiFWYJ.exe
  2⤵
  PID:2352
- C:\Windows\System\gNNGUvy.exe
  C:\Windows\System\gNNGUvy.exe
  2⤵
  PID:2240
- C:\Windows\System\vsjvNSk.exe
  C:\Windows\System\vsjvNSk.exe
  2⤵
  PID:872
- C:\Windows\System\vkZqcqK.exe
  C:\Windows\System\vkZqcqK.exe
  2⤵
  PID:2524
- C:\Windows\System\wELJgfY.exe
  C:\Windows\System\wELJgfY.exe
  2⤵
  PID:2856
- C:\Windows\System\DizJiiO.exe
  C:\Windows\System\DizJiiO.exe
  2⤵
  PID:1584
- C:\Windows\System\zFKMeOS.exe
  C:\Windows\System\zFKMeOS.exe
  2⤵
  PID:2528
- C:\Windows\System\bSPFICB.exe
  C:\Windows\System\bSPFICB.exe
  2⤵
  PID:1636
- C:\Windows\System\tWuoWgX.exe
  C:\Windows\System\tWuoWgX.exe
  2⤵
  PID:2608
- C:\Windows\System\icCUgtb.exe
  C:\Windows\System\icCUgtb.exe
  2⤵
  PID:1532
- C:\Windows\System\fkLPBzk.exe
  C:\Windows\System\fkLPBzk.exe
  2⤵
  PID:2520
- C:\Windows\System\peRPzrc.exe
  C:\Windows\System\peRPzrc.exe
  2⤵
  PID:812
- C:\Windows\System\YRLXYLr.exe
  C:\Windows\System\YRLXYLr.exe
  2⤵
  PID:1932
- C:\Windows\System\KHwZAUu.exe
  C:\Windows\System\KHwZAUu.exe
  2⤵
  PID:2588
- C:\Windows\System\udKmLQF.exe
  C:\Windows\System\udKmLQF.exe
  2⤵
  PID:2728
- C:\Windows\System\GdoYwhy.exe
  C:\Windows\System\GdoYwhy.exe
  2⤵
  PID:1628
- C:\Windows\System\vQNuHeJ.exe
  C:\Windows\System\vQNuHeJ.exe
  2⤵
  PID:2184
- C:\Windows\System\ovBXGGO.exe
  C:\Windows\System\ovBXGGO.exe
  2⤵
  PID:960
- C:\Windows\System\NwFQFSU.exe
  C:\Windows\System\NwFQFSU.exe
  2⤵
  PID:1996
- C:\Windows\System\jloFYeJ.exe
  C:\Windows\System\jloFYeJ.exe
  2⤵
  PID:1268
- C:\Windows\System\eZZrBdw.exe
  C:\Windows\System\eZZrBdw.exe
  2⤵
  PID:1688
- C:\Windows\System\TqWNjmX.exe
  C:\Windows\System\TqWNjmX.exe
  2⤵
  PID:2056
- C:\Windows\System\GbpswCC.exe
  C:\Windows\System\GbpswCC.exe
  2⤵
  PID:2504
- C:\Windows\System\fFUzDfM.exe
  C:\Windows\System\fFUzDfM.exe
  2⤵
  PID:2960
- C:\Windows\System\RWGTBlf.exe
  C:\Windows\System\RWGTBlf.exe
  2⤵
  PID:1556
- C:\Windows\System\dfafesY.exe
  C:\Windows\System\dfafesY.exe
  2⤵
  PID:1828
- C:\Windows\System\EcxYmZz.exe
  C:\Windows\System\EcxYmZz.exe
  2⤵
  PID:1136
- C:\Windows\System\lyvsaBx.exe
  C:\Windows\System\lyvsaBx.exe
  2⤵
  PID:1792
- C:\Windows\System\KlfCJDJ.exe
  C:\Windows\System\KlfCJDJ.exe
  2⤵
  PID:2336
- C:\Windows\System\IvHVqGt.exe
  C:\Windows\System\IvHVqGt.exe
  2⤵
  PID:2080
- C:\Windows\System\fkRDdFy.exe
  C:\Windows\System\fkRDdFy.exe
  2⤵
  PID:2508
- C:\Windows\System\WSCTFtJ.exe
  C:\Windows\System\WSCTFtJ.exe
  2⤵
  PID:2820
- C:\Windows\System\dmTJpgY.exe
  C:\Windows\System\dmTJpgY.exe
  2⤵
  PID:3196
- C:\Windows\System\SJEKqfN.exe
  C:\Windows\System\SJEKqfN.exe
  2⤵
  PID:3220
- C:\Windows\System\qBKXLFO.exe
  C:\Windows\System\qBKXLFO.exe
  2⤵
  PID:3240
- C:\Windows\System\mGeJqqd.exe
  C:\Windows\System\mGeJqqd.exe
  2⤵
  PID:3256
- C:\Windows\System\LBtnVob.exe
  C:\Windows\System\LBtnVob.exe
  2⤵
  PID:3272
- C:\Windows\System\WprHzvs.exe
  C:\Windows\System\WprHzvs.exe
  2⤵
  PID:3288
- C:\Windows\System\zpVxclg.exe
  C:\Windows\System\zpVxclg.exe
  2⤵
  PID:3316
- C:\Windows\System\ZLjlmzw.exe
  C:\Windows\System\ZLjlmzw.exe
  2⤵
  PID:3344
- C:\Windows\System\NklHWNx.exe
  C:\Windows\System\NklHWNx.exe
  2⤵
  PID:3376
- C:\Windows\System\MgoMMxU.exe
  C:\Windows\System\MgoMMxU.exe
  2⤵
  PID:3400
- C:\Windows\System\ddOxleb.exe
  C:\Windows\System\ddOxleb.exe
  2⤵
  PID:3428
- C:\Windows\System\pGigRLu.exe
  C:\Windows\System\pGigRLu.exe
  2⤵
  PID:3452
- C:\Windows\System\GMaBfIX.exe
  C:\Windows\System\GMaBfIX.exe
  2⤵
  PID:3500
- C:\Windows\System\RedFBkm.exe
  C:\Windows\System\RedFBkm.exe
  2⤵
  PID:3528
- C:\Windows\System\ZnUljam.exe
  C:\Windows\System\ZnUljam.exe
  2⤵
  PID:3548
- C:\Windows\System\xymMERU.exe
  C:\Windows\System\xymMERU.exe
  2⤵
  PID:3564
- C:\Windows\System\TjXEUPc.exe
  C:\Windows\System\TjXEUPc.exe
  2⤵
  PID:3584
- C:\Windows\System\bGbUKeN.exe
  C:\Windows\System\bGbUKeN.exe
  2⤵
  PID:3604
- C:\Windows\System\IPzTrNQ.exe
  C:\Windows\System\IPzTrNQ.exe
  2⤵
  PID:3620
- C:\Windows\System\jlNGMEe.exe
  C:\Windows\System\jlNGMEe.exe
  2⤵
  PID:3636
- C:\Windows\System\PYnGxuh.exe
  C:\Windows\System\PYnGxuh.exe
  2⤵
  PID:3652
- C:\Windows\System\SBdlday.exe
  C:\Windows\System\SBdlday.exe
  2⤵
  PID:3668
- C:\Windows\System\wFAFsOS.exe
  C:\Windows\System\wFAFsOS.exe
  2⤵
  PID:3692
- C:\Windows\System\nHupTIH.exe
  C:\Windows\System\nHupTIH.exe
  2⤵
  PID:3708
- C:\Windows\System\eGBJOow.exe
  C:\Windows\System\eGBJOow.exe
  2⤵
  PID:3732
- C:\Windows\System\jWSGSTJ.exe
  C:\Windows\System\jWSGSTJ.exe
  2⤵
  PID:3748
- C:\Windows\System\sfOEIxi.exe
  C:\Windows\System\sfOEIxi.exe
  2⤵
  PID:3764
- C:\Windows\System\emlnpMz.exe
  C:\Windows\System\emlnpMz.exe
  2⤵
  PID:3780
- C:\Windows\System\YCrVMHA.exe
  C:\Windows\System\YCrVMHA.exe
  2⤵
  PID:3796
- C:\Windows\System\AxRpttE.exe
  C:\Windows\System\AxRpttE.exe
  2⤵
  PID:3812
- C:\Windows\System\aJzFvHa.exe
  C:\Windows\System\aJzFvHa.exe
  2⤵
  PID:3828
- C:\Windows\System\strkvvs.exe
  C:\Windows\System\strkvvs.exe
  2⤵
  PID:3844
- C:\Windows\System\JtJAqFB.exe
  C:\Windows\System\JtJAqFB.exe
  2⤵
  PID:3860
- C:\Windows\System\hQPvKzs.exe
  C:\Windows\System\hQPvKzs.exe
  2⤵
  PID:3876
- C:\Windows\System\eXlGRqV.exe
  C:\Windows\System\eXlGRqV.exe
  2⤵
  PID:3892
- C:\Windows\System\VSjGljA.exe
  C:\Windows\System\VSjGljA.exe
  2⤵
  PID:3908
- C:\Windows\System\BwuBvNa.exe
  C:\Windows\System\BwuBvNa.exe
  2⤵
  PID:3928
- C:\Windows\System\sENLzlN.exe
  C:\Windows\System\sENLzlN.exe
  2⤵
  PID:3944
- C:\Windows\System\ottQoeU.exe
  C:\Windows\System\ottQoeU.exe
  2⤵
  PID:3960
- C:\Windows\System\ECEdOKA.exe
  C:\Windows\System\ECEdOKA.exe
  2⤵
  PID:3976
- C:\Windows\System\VuAsrlg.exe
  C:\Windows\System\VuAsrlg.exe
  2⤵
  PID:3996
- C:\Windows\System\hlJsYlc.exe
  C:\Windows\System\hlJsYlc.exe
  2⤵
  PID:4012
- C:\Windows\System\IshSfUD.exe
  C:\Windows\System\IshSfUD.exe
  2⤵
  PID:4028
- C:\Windows\System\fPgTNal.exe
  C:\Windows\System\fPgTNal.exe
  2⤵
  PID:4044
- C:\Windows\System\PETPlkF.exe
  C:\Windows\System\PETPlkF.exe
  2⤵
  PID:4060
- C:\Windows\System\yTDAktw.exe
  C:\Windows\System\yTDAktw.exe
  2⤵
  PID:4076
- C:\Windows\System\bxkoREN.exe
  C:\Windows\System\bxkoREN.exe
  2⤵
  PID:4092
- C:\Windows\System\rhTymLC.exe
  C:\Windows\System\rhTymLC.exe
  2⤵
  PID:1064
- C:\Windows\System\WRfwIOB.exe
  C:\Windows\System\WRfwIOB.exe
  2⤵
  PID:2480
- C:\Windows\System\hduklWD.exe
  C:\Windows\System\hduklWD.exe
  2⤵
  PID:2500
- C:\Windows\System\loPCLqm.exe
  C:\Windows\System\loPCLqm.exe
  2⤵
  PID:1676
- C:\Windows\System\evHHXFR.exe
  C:\Windows\System\evHHXFR.exe
  2⤵
  PID:1736
- C:\Windows\System\amZeLGI.exe
  C:\Windows\System\amZeLGI.exe
  2⤵
  PID:1720
- C:\Windows\System\diBLvyb.exe
  C:\Windows\System\diBLvyb.exe
  2⤵
  PID:1980
- C:\Windows\System\GIWLMKq.exe
  C:\Windows\System\GIWLMKq.exe
  2⤵
  PID:2824
- C:\Windows\System\vxINQoe.exe
  C:\Windows\System\vxINQoe.exe
  2⤵
  PID:1772
- C:\Windows\System\ApavmPy.exe
  C:\Windows\System\ApavmPy.exe
  2⤵
  PID:2828
- C:\Windows\System\isCehMD.exe
  C:\Windows\System\isCehMD.exe
  2⤵
  PID:2776
- C:\Windows\System\nGETbbf.exe
  C:\Windows\System\nGETbbf.exe
  2⤵
  PID:1944
- C:\Windows\System\OEfzDHA.exe
  C:\Windows\System\OEfzDHA.exe
  2⤵
  PID:604
- C:\Windows\System\ilXhshM.exe
  C:\Windows\System\ilXhshM.exe
  2⤵
  PID:320
- C:\Windows\System\BEyogPf.exe
  C:\Windows\System\BEyogPf.exe
  2⤵
  PID:572
- C:\Windows\System\kaWxrZN.exe
  C:\Windows\System\kaWxrZN.exe
  2⤵
  PID:2772
- C:\Windows\System\LqkkblE.exe
  C:\Windows\System\LqkkblE.exe
  2⤵
  PID:2128
- C:\Windows\System\WRrLMhm.exe
  C:\Windows\System\WRrLMhm.exe
  2⤵
  PID:2020
- C:\Windows\System\UGFRDNo.exe
  C:\Windows\System\UGFRDNo.exe
  2⤵
  PID:316
- C:\Windows\System\WQbHMXr.exe
  C:\Windows\System\WQbHMXr.exe
  2⤵
  PID:3112
- C:\Windows\System\gOYMRZQ.exe
  C:\Windows\System\gOYMRZQ.exe
  2⤵
  PID:3124
- C:\Windows\System\jcFrpWT.exe
  C:\Windows\System\jcFrpWT.exe
  2⤵
  PID:3140
- C:\Windows\System\tFVwzuA.exe
  C:\Windows\System\tFVwzuA.exe
  2⤵
  PID:3164
- C:\Windows\System\vsJuhNE.exe
  C:\Windows\System\vsJuhNE.exe
  2⤵
  PID:3176
- C:\Windows\System\iMjWEwr.exe
  C:\Windows\System\iMjWEwr.exe
  2⤵
  PID:3204
- C:\Windows\System\loWrsbG.exe
  C:\Windows\System\loWrsbG.exe
  2⤵
  PID:3212
- C:\Windows\System\VQYLLOA.exe
  C:\Windows\System\VQYLLOA.exe
  2⤵
  PID:3236
- C:\Windows\System\gsgKTXw.exe
  C:\Windows\System\gsgKTXw.exe
  2⤵
  PID:3264
- C:\Windows\System\qbqknqh.exe
  C:\Windows\System\qbqknqh.exe
  2⤵
  PID:3300
- C:\Windows\System\eFNsHrJ.exe
  C:\Windows\System\eFNsHrJ.exe
  2⤵
  PID:3332
- C:\Windows\System\BqGVGXT.exe
  C:\Windows\System\BqGVGXT.exe
  2⤵
  PID:3352
- C:\Windows\System\cgyxGAe.exe
  C:\Windows\System\cgyxGAe.exe
  2⤵
  PID:3372
- C:\Windows\System\MwdOIDl.exe
  C:\Windows\System\MwdOIDl.exe
  2⤵
  PID:3356
- C:\Windows\System\sapJnyI.exe
  C:\Windows\System\sapJnyI.exe
  2⤵
  PID:3460
- C:\Windows\System\ppfXalL.exe
  C:\Windows\System\ppfXalL.exe
  2⤵
  PID:3480
- C:\Windows\System\IfkSxXR.exe
  C:\Windows\System\IfkSxXR.exe
  2⤵
  PID:3496
- C:\Windows\System\ntfncqS.exe
  C:\Windows\System\ntfncqS.exe
  2⤵
  PID:3524
- C:\Windows\System\qwtIXXw.exe
  C:\Windows\System\qwtIXXw.exe
  2⤵
  PID:3592
- C:\Windows\System\Svtivib.exe
  C:\Windows\System\Svtivib.exe
  2⤵
  PID:3612
- C:\Windows\System\jdmtcyN.exe
  C:\Windows\System\jdmtcyN.exe
  2⤵
  PID:3580
- C:\Windows\System\jrAsJDR.exe
  C:\Windows\System\jrAsJDR.exe
  2⤵
  PID:3660
- C:\Windows\System\dWICwQv.exe
  C:\Windows\System\dWICwQv.exe
  2⤵
  PID:3648
- C:\Windows\System\ejHcBzX.exe
  C:\Windows\System\ejHcBzX.exe
  2⤵
  PID:3704
- C:\Windows\System\BkRXQGw.exe
  C:\Windows\System\BkRXQGw.exe
  2⤵
  PID:3772
- C:\Windows\System\NzTeRus.exe
  C:\Windows\System\NzTeRus.exe
  2⤵
  PID:3836
- C:\Windows\System\RmDBNVn.exe
  C:\Windows\System\RmDBNVn.exe
  2⤵
  PID:3900
- C:\Windows\System\dveVHsi.exe
  C:\Windows\System\dveVHsi.exe
  2⤵
  PID:3972
- C:\Windows\System\fZINfNF.exe
  C:\Windows\System\fZINfNF.exe
  2⤵
  PID:3916
- C:\Windows\System\nzJAsvx.exe
  C:\Windows\System\nzJAsvx.exe
  2⤵
  PID:3724
- C:\Windows\System\oOVSzNX.exe
  C:\Windows\System\oOVSzNX.exe
  2⤵
  PID:4040
- C:\Windows\System\oLAgMMP.exe
  C:\Windows\System\oLAgMMP.exe
  2⤵
  PID:3988
- C:\Windows\System\NbIyDWd.exe
  C:\Windows\System\NbIyDWd.exe
  2⤵
  PID:3788
- C:\Windows\System\cUsuSlU.exe
  C:\Windows\System\cUsuSlU.exe
  2⤵
  PID:3852
- C:\Windows\System\ZnjNavo.exe
  C:\Windows\System\ZnjNavo.exe
  2⤵
  PID:4052
- C:\Windows\System\xqrCKoF.exe
  C:\Windows\System\xqrCKoF.exe
  2⤵
  PID:2408
- C:\Windows\System\joiVdza.exe
  C:\Windows\System\joiVdza.exe
  2⤵
  PID:808
- C:\Windows\System\tXGTtEj.exe
  C:\Windows\System\tXGTtEj.exe
  2⤵
  PID:2260
- C:\Windows\System\dDKdisb.exe
  C:\Windows\System\dDKdisb.exe
  2⤵
  PID:852
- C:\Windows\System\gleDXnO.exe
  C:\Windows\System\gleDXnO.exe
  2⤵
  PID:3016
- C:\Windows\System\JlcanBp.exe
  C:\Windows\System\JlcanBp.exe
  2⤵
  PID:2880
- C:\Windows\System\TzZPKan.exe
  C:\Windows\System\TzZPKan.exe
  2⤵
  PID:584
- C:\Windows\System\jXRPuZz.exe
  C:\Windows\System\jXRPuZz.exe
  2⤵
  PID:2576
- C:\Windows\System\pEmtDSL.exe
  C:\Windows\System\pEmtDSL.exe
  2⤵
  PID:2796
- C:\Windows\System\WABZOgN.exe
  C:\Windows\System\WABZOgN.exe
  2⤵
  PID:3148
- C:\Windows\System\USyHaoM.exe
  C:\Windows\System\USyHaoM.exe
  2⤵
  PID:3188
- C:\Windows\System\oaiQaAP.exe
  C:\Windows\System\oaiQaAP.exe
  2⤵
  PID:3340
- C:\Windows\System\XmdtzPt.exe
  C:\Windows\System\XmdtzPt.exe
  2⤵
  PID:2664
- C:\Windows\System\pBKuaxy.exe
  C:\Windows\System\pBKuaxy.exe
  2⤵
  PID:3104
- C:\Windows\System\jcpxxFl.exe
  C:\Windows\System\jcpxxFl.exe
  2⤵
  PID:3172
- C:\Windows\System\HqdVZsc.exe
  C:\Windows\System\HqdVZsc.exe
  2⤵
  PID:3280
- C:\Windows\System\MOJnAaZ.exe
  C:\Windows\System\MOJnAaZ.exe
  2⤵
  PID:3368
- C:\Windows\System\bEpbEib.exe
  C:\Windows\System\bEpbEib.exe
  2⤵
  PID:3448
- C:\Windows\System\jZAhCoL.exe
  C:\Windows\System\jZAhCoL.exe
  2⤵
  PID:3420
- C:\Windows\System\rWraURF.exe
  C:\Windows\System\rWraURF.exe
  2⤵
  PID:3516
- C:\Windows\System\EFBAngr.exe
  C:\Windows\System\EFBAngr.exe
  2⤵
  PID:3544
- C:\Windows\System\OeIAtYb.exe
  C:\Windows\System\OeIAtYb.exe
  2⤵
  PID:3804
- C:\Windows\System\kcKSnms.exe
  C:\Windows\System\kcKSnms.exe
  2⤵
  PID:3968
- C:\Windows\System\MTbjzJr.exe
  C:\Windows\System\MTbjzJr.exe
  2⤵
  PID:3956
- C:\Windows\System\BSSInbk.exe
  C:\Windows\System\BSSInbk.exe
  2⤵
  PID:4084
- C:\Windows\System\DjBTEml.exe
  C:\Windows\System\DjBTEml.exe
  2⤵
  PID:2988
- C:\Windows\System\MHrzztK.exe
  C:\Windows\System\MHrzztK.exe
  2⤵
  PID:1420
- C:\Windows\System\iUDEENZ.exe
  C:\Windows\System\iUDEENZ.exe
  2⤵
  PID:3492
- C:\Windows\System\sTukHAb.exe
  C:\Windows\System\sTukHAb.exe
  2⤵
  PID:3632
- C:\Windows\System\wxQAuQW.exe
  C:\Windows\System\wxQAuQW.exe
  2⤵
  PID:3744
- C:\Windows\System\INUmnCo.exe
  C:\Windows\System\INUmnCo.exe
  2⤵
  PID:4036
- C:\Windows\System\dnIOUxY.exe
  C:\Windows\System\dnIOUxY.exe
  2⤵
  PID:3884
- C:\Windows\System\zuoydAa.exe
  C:\Windows\System\zuoydAa.exe
  2⤵
  PID:2136
- C:\Windows\System\ZDAKmHB.exe
  C:\Windows\System\ZDAKmHB.exe
  2⤵
  PID:2160
- C:\Windows\System\aJzhcUM.exe
  C:\Windows\System\aJzhcUM.exe
  2⤵
  PID:832
- C:\Windows\System\syqFUkw.exe
  C:\Windows\System\syqFUkw.exe
  2⤵
  PID:3184
- C:\Windows\System\PwfXCEg.exe
  C:\Windows\System\PwfXCEg.exe
  2⤵
  PID:3324
- C:\Windows\System\jwnKiSb.exe
  C:\Windows\System\jwnKiSb.exe
  2⤵
  PID:3444
- C:\Windows\System\hftMQHt.exe
  C:\Windows\System\hftMQHt.exe
  2⤵
  PID:3416
- C:\Windows\System\DFfShHb.exe
  C:\Windows\System\DFfShHb.exe
  2⤵
  PID:3680
- C:\Windows\System\oHYrpBq.exe
  C:\Windows\System\oHYrpBq.exe
  2⤵
  PID:3824
- C:\Windows\System\XdaJNbb.exe
  C:\Windows\System\XdaJNbb.exe
  2⤵
  PID:3628
- C:\Windows\System\bjJBCzl.exe
  C:\Windows\System\bjJBCzl.exe
  2⤵
  PID:1976
- C:\Windows\System\kxktAps.exe
  C:\Windows\System\kxktAps.exe
  2⤵
  PID:4020
- C:\Windows\System\YbGqGgN.exe
  C:\Windows\System\YbGqGgN.exe
  2⤵
  PID:3040
- C:\Windows\System\QpFbVoF.exe
  C:\Windows\System\QpFbVoF.exe
  2⤵
  PID:4008
- C:\Windows\System\ZcgLxBv.exe
  C:\Windows\System\ZcgLxBv.exe
  2⤵
  PID:2052
- C:\Windows\System\qjNbdKb.exe
  C:\Windows\System\qjNbdKb.exe
  2⤵
  PID:3308
- C:\Windows\System\mutlvBj.exe
  C:\Windows\System\mutlvBj.exe
  2⤵
  PID:3572
- C:\Windows\System\DBSQUrE.exe
  C:\Windows\System\DBSQUrE.exe
  2⤵
  PID:3232
- C:\Windows\System\OgiUoFZ.exe
  C:\Windows\System\OgiUoFZ.exe
  2⤵
  PID:3304
- C:\Windows\System\PgHyjLg.exe
  C:\Windows\System\PgHyjLg.exe
  2⤵
  PID:3720
- C:\Windows\System\rnUafgN.exe
  C:\Windows\System\rnUafgN.exe
  2⤵
  PID:3440
- C:\Windows\System\eqFzNvZ.exe
  C:\Windows\System\eqFzNvZ.exe
  2⤵
  PID:2804
- C:\Windows\System\GsbtJGb.exe
  C:\Windows\System\GsbtJGb.exe
  2⤵
  PID:3740
- C:\Windows\System\QCaayrS.exe
  C:\Windows\System\QCaayrS.exe
  2⤵
  PID:3644
- C:\Windows\System\FpwqECh.exe
  C:\Windows\System\FpwqECh.exe
  2⤵
  PID:3100
- C:\Windows\System\jHndKBN.exe
  C:\Windows\System\jHndKBN.exe
  2⤵
  PID:3168
- C:\Windows\System\FTYGbTk.exe
  C:\Windows\System\FTYGbTk.exe
  2⤵
  PID:4100
- C:\Windows\System\iYtyGYY.exe
  C:\Windows\System\iYtyGYY.exe
  2⤵
  PID:4116
- C:\Windows\System\cpLpKev.exe
  C:\Windows\System\cpLpKev.exe
  2⤵
  PID:4148
- C:\Windows\System\LMjcWof.exe
  C:\Windows\System\LMjcWof.exe
  2⤵
  PID:4164
- C:\Windows\System\BkEvWEM.exe
  C:\Windows\System\BkEvWEM.exe
  2⤵
  PID:4180
- C:\Windows\System\JRXcBvX.exe
  C:\Windows\System\JRXcBvX.exe
  2⤵
  PID:4196
- C:\Windows\System\hFLMHeJ.exe
  C:\Windows\System\hFLMHeJ.exe
  2⤵
  PID:4212
- C:\Windows\System\Umymdep.exe
  C:\Windows\System\Umymdep.exe
  2⤵
  PID:4228
- C:\Windows\System\pGxTdxg.exe
  C:\Windows\System\pGxTdxg.exe
  2⤵
  PID:4248
- C:\Windows\System\EmJcXfd.exe
  C:\Windows\System\EmJcXfd.exe
  2⤵
  PID:4264
- C:\Windows\System\Gcubupk.exe
  C:\Windows\System\Gcubupk.exe
  2⤵
  PID:4280
- C:\Windows\System\msHdRoB.exe
  C:\Windows\System\msHdRoB.exe
  2⤵
  PID:4296
- C:\Windows\System\oCxTXHF.exe
  C:\Windows\System\oCxTXHF.exe
  2⤵
  PID:4312
- C:\Windows\System\CobgrER.exe
  C:\Windows\System\CobgrER.exe
  2⤵
  PID:4328
- C:\Windows\System\cNCVPOm.exe
  C:\Windows\System\cNCVPOm.exe
  2⤵
  PID:4344
- C:\Windows\System\jPFrHeO.exe
  C:\Windows\System\jPFrHeO.exe
  2⤵
  PID:4360
- C:\Windows\System\lbzWncR.exe
  C:\Windows\System\lbzWncR.exe
  2⤵
  PID:4376
- C:\Windows\System\aAFbpmQ.exe
  C:\Windows\System\aAFbpmQ.exe
  2⤵
  PID:4392
- C:\Windows\System\rpvLVtQ.exe
  C:\Windows\System\rpvLVtQ.exe
  2⤵
  PID:4408
- C:\Windows\System\MrOoKgR.exe
  C:\Windows\System\MrOoKgR.exe
  2⤵
  PID:4424
- C:\Windows\System\ZdpwTnz.exe
  C:\Windows\System\ZdpwTnz.exe
  2⤵
  PID:4444
- C:\Windows\System\KFykfvi.exe
  C:\Windows\System\KFykfvi.exe
  2⤵
  PID:4464
- C:\Windows\System\CAhSDlK.exe
  C:\Windows\System\CAhSDlK.exe
  2⤵
  PID:4480
- C:\Windows\System\DrSOQcU.exe
  C:\Windows\System\DrSOQcU.exe
  2⤵
  PID:4496
- C:\Windows\System\ybIbuwj.exe
  C:\Windows\System\ybIbuwj.exe
  2⤵
  PID:4516
- C:\Windows\System\BYYTUNl.exe
  C:\Windows\System\BYYTUNl.exe
  2⤵
  PID:4532
- C:\Windows\System\kpbzJSQ.exe
  C:\Windows\System\kpbzJSQ.exe
  2⤵
  PID:4548
- C:\Windows\System\pOdwdsN.exe
  C:\Windows\System\pOdwdsN.exe
  2⤵
  PID:4564
- C:\Windows\System\AFTFLHw.exe
  C:\Windows\System\AFTFLHw.exe
  2⤵
  PID:4580
- C:\Windows\System\gNtOhiC.exe
  C:\Windows\System\gNtOhiC.exe
  2⤵
  PID:4596
- C:\Windows\System\ZlePJjL.exe
  C:\Windows\System\ZlePJjL.exe
  2⤵
  PID:4616
- C:\Windows\System\zvcgRAR.exe
  C:\Windows\System\zvcgRAR.exe
  2⤵
  PID:4632
- C:\Windows\System\IVWBQQe.exe
  C:\Windows\System\IVWBQQe.exe
  2⤵
  PID:4652
- C:\Windows\System\SBfvKDk.exe
  C:\Windows\System\SBfvKDk.exe
  2⤵
  PID:4668
- C:\Windows\System\xuIzbxf.exe
  C:\Windows\System\xuIzbxf.exe
  2⤵
  PID:4684
- C:\Windows\System\urBXKkc.exe
  C:\Windows\System\urBXKkc.exe
  2⤵
  PID:4700
- C:\Windows\System\GTfdFoU.exe
  C:\Windows\System\GTfdFoU.exe
  2⤵
  PID:4716
- C:\Windows\System\hcWaDmG.exe
  C:\Windows\System\hcWaDmG.exe
  2⤵
  PID:4736
- C:\Windows\System\dEgngiy.exe
  C:\Windows\System\dEgngiy.exe
  2⤵
  PID:4752
- C:\Windows\System\JJBTrSP.exe
  C:\Windows\System\JJBTrSP.exe
  2⤵
  PID:4768
- C:\Windows\System\agwOhvQ.exe
  C:\Windows\System\agwOhvQ.exe
  2⤵
  PID:4784
- C:\Windows\System\IlkGmVS.exe
  C:\Windows\System\IlkGmVS.exe
  2⤵
  PID:4800
- C:\Windows\System\UGoudXA.exe
  C:\Windows\System\UGoudXA.exe
  2⤵
  PID:4816
- C:\Windows\System\qlHgilp.exe
  C:\Windows\System\qlHgilp.exe
  2⤵
  PID:4832
- C:\Windows\System\hludcla.exe
  C:\Windows\System\hludcla.exe
  2⤵
  PID:4848
- C:\Windows\System\ukwBskt.exe
  C:\Windows\System\ukwBskt.exe
  2⤵
  PID:4868
- C:\Windows\System\rCWTePk.exe
  C:\Windows\System\rCWTePk.exe
  2⤵
  PID:4888
- C:\Windows\System\lJJpokc.exe
  C:\Windows\System\lJJpokc.exe
  2⤵
  PID:4908
- C:\Windows\System\SbiHyvT.exe
  C:\Windows\System\SbiHyvT.exe
  2⤵
  PID:4924
- C:\Windows\System\EiseyCa.exe
  C:\Windows\System\EiseyCa.exe
  2⤵
  PID:4944
- C:\Windows\System\BgrSGZY.exe
  C:\Windows\System\BgrSGZY.exe
  2⤵
  PID:4960
- C:\Windows\System\fIXiegn.exe
  C:\Windows\System\fIXiegn.exe
  2⤵
  PID:4976
- C:\Windows\System\gCckEto.exe
  C:\Windows\System\gCckEto.exe
  2⤵
  PID:4996
- C:\Windows\System\seYyzqW.exe
  C:\Windows\System\seYyzqW.exe
  2⤵
  PID:5012
- C:\Windows\System\SzWGdou.exe
  C:\Windows\System\SzWGdou.exe
  2⤵
  PID:5032
- C:\Windows\System\FrJcQdk.exe
  C:\Windows\System\FrJcQdk.exe
  2⤵
  PID:5064
- C:\Windows\System\BGBbFJY.exe
  C:\Windows\System\BGBbFJY.exe
  2⤵
  PID:5100
- C:\Windows\System\laewMtk.exe
  C:\Windows\System\laewMtk.exe
  2⤵
  PID:5116
- C:\Windows\System\erPhBKk.exe
  C:\Windows\System\erPhBKk.exe
  2⤵
  PID:4124
- C:\Windows\System\GeaasHw.exe
  C:\Windows\System\GeaasHw.exe
  2⤵
  PID:3792
- C:\Windows\System\RPWBcXt.exe
  C:\Windows\System\RPWBcXt.exe
  2⤵
  PID:3600
- C:\Windows\System\IlTbGTy.exe
  C:\Windows\System\IlTbGTy.exe
  2⤵
  PID:4144
- C:\Windows\System\lFHeubA.exe
  C:\Windows\System\lFHeubA.exe
  2⤵
  PID:4204
- C:\Windows\System\UFEFIxp.exe
  C:\Windows\System\UFEFIxp.exe
  2⤵
  PID:4240
- C:\Windows\System\wIUyzFq.exe
  C:\Windows\System\wIUyzFq.exe
  2⤵
  PID:4272
- C:\Windows\System\MPiQfSc.exe
  C:\Windows\System\MPiQfSc.exe
  2⤵
  PID:4308
- C:\Windows\System\vOZeAxD.exe
  C:\Windows\System\vOZeAxD.exe
  2⤵
  PID:4336
- C:\Windows\System\dqDNfGU.exe
  C:\Windows\System\dqDNfGU.exe
  2⤵
  PID:4372
- C:\Windows\System\UcKPhcs.exe
  C:\Windows\System\UcKPhcs.exe
  2⤵
  PID:4320
- C:\Windows\System\MeWIwcH.exe
  C:\Windows\System\MeWIwcH.exe
  2⤵
  PID:4256
- C:\Windows\System\cGfApjT.exe
  C:\Windows\System\cGfApjT.exe
  2⤵
  PID:4472
- C:\Windows\System\jTpWaNZ.exe
  C:\Windows\System\jTpWaNZ.exe
  2⤵
  PID:4508
- C:\Windows\System\VxoeTmr.exe
  C:\Windows\System\VxoeTmr.exe
  2⤵
  PID:4512
- C:\Windows\System\PthRZty.exe
  C:\Windows\System\PthRZty.exe
  2⤵
  PID:4612
- C:\Windows\System\JudulIb.exe
  C:\Windows\System\JudulIb.exe
  2⤵
  PID:4492
- C:\Windows\System\uHnGJKl.exe
  C:\Windows\System\uHnGJKl.exe
  2⤵
  PID:4676
- C:\Windows\System\DIvYXRQ.exe
  C:\Windows\System\DIvYXRQ.exe
  2⤵
  PID:4708
- C:\Windows\System\dNLhLsw.exe
  C:\Windows\System\dNLhLsw.exe
  2⤵
  PID:4592
- C:\Windows\System\jQXmoAf.exe
  C:\Windows\System\jQXmoAf.exe
  2⤵
  PID:4724
- C:\Windows\System\NQPZcVo.exe
  C:\Windows\System\NQPZcVo.exe
  2⤵
  PID:4764
- C:\Windows\System\RqfPxkM.exe
  C:\Windows\System\RqfPxkM.exe
  2⤵
  PID:4808
- C:\Windows\System\oMhXOHL.exe
  C:\Windows\System\oMhXOHL.exe
  2⤵
  PID:4792
- C:\Windows\System\FQgsqxH.exe
  C:\Windows\System\FQgsqxH.exe
  2⤵
  PID:4856
- C:\Windows\System\HzKYJNj.exe
  C:\Windows\System\HzKYJNj.exe
  2⤵
  PID:4876
- C:\Windows\System\tYcyFJA.exe
  C:\Windows\System\tYcyFJA.exe
  2⤵
  PID:4972
- C:\Windows\System\vzjnBnw.exe
  C:\Windows\System\vzjnBnw.exe
  2⤵
  PID:4956
- C:\Windows\System\PLGOAnm.exe
  C:\Windows\System\PLGOAnm.exe
  2⤵
  PID:4940
- C:\Windows\System\PRfijXq.exe
  C:\Windows\System\PRfijXq.exe
  2⤵
  PID:5020
- C:\Windows\System\pSBSUWp.exe
  C:\Windows\System\pSBSUWp.exe
  2⤵
  PID:5044
- C:\Windows\System\nPGemxp.exe
  C:\Windows\System\nPGemxp.exe
  2⤵
  PID:5052
- C:\Windows\System\uEDJqNh.exe
  C:\Windows\System\uEDJqNh.exe
  2⤵
  PID:5080
- C:\Windows\System\LgBprru.exe
  C:\Windows\System\LgBprru.exe
  2⤵
  PID:5096
- C:\Windows\System\tATImcK.exe
  C:\Windows\System\tATImcK.exe
  2⤵
  PID:4176
- C:\Windows\System\BRRlvsu.exe
  C:\Windows\System\BRRlvsu.exe
  2⤵
  PID:3556
- C:\Windows\System\dFDcoJZ.exe
  C:\Windows\System\dFDcoJZ.exe
  2⤵
  PID:4156
- C:\Windows\System\lmIexIq.exe
  C:\Windows\System\lmIexIq.exe
  2⤵
  PID:4140
- C:\Windows\System\QkukICu.exe
  C:\Windows\System\QkukICu.exe
  2⤵
  PID:4292
- C:\Windows\System\STkAJdl.exe
  C:\Windows\System\STkAJdl.exe
  2⤵
  PID:4276
- C:\Windows\System\QRuymrj.exe
  C:\Windows\System\QRuymrj.exe
  2⤵
  PID:4388
- C:\Windows\System\oJEdgTk.exe
  C:\Windows\System\oJEdgTk.exe
  2⤵
  PID:4452
- C:\Windows\System\FMdzDWl.exe
  C:\Windows\System\FMdzDWl.exe
  2⤵
  PID:4540
- C:\Windows\System\GJKWJPU.exe
  C:\Windows\System\GJKWJPU.exe
  2⤵
  PID:4744
- C:\Windows\System\KvQeVbe.exe
  C:\Windows\System\KvQeVbe.exe
  2⤵
  PID:4776
- C:\Windows\System\ipNEPmZ.exe
  C:\Windows\System\ipNEPmZ.exe
  2⤵
  PID:4936
- C:\Windows\System\mkpWcuT.exe
  C:\Windows\System\mkpWcuT.exe
  2⤵
  PID:5028
- C:\Windows\System\GtSIxIm.exe
  C:\Windows\System\GtSIxIm.exe
  2⤵
  PID:3208
- C:\Windows\System\yoEaUzF.exe
  C:\Windows\System\yoEaUzF.exe
  2⤵
  PID:4604
- C:\Windows\System\ETDIYLt.exe
  C:\Windows\System\ETDIYLt.exe
  2⤵
  PID:4664
- C:\Windows\System\TLJBtjb.exe
  C:\Windows\System\TLJBtjb.exe
  2⤵
  PID:4844
- C:\Windows\System\LPHQGCN.exe
  C:\Windows\System\LPHQGCN.exe
  2⤵
  PID:4904
- C:\Windows\System\mBdJJzc.exe
  C:\Windows\System\mBdJJzc.exe
  2⤵
  PID:4988
- C:\Windows\System\IEfxCFW.exe
  C:\Windows\System\IEfxCFW.exe
  2⤵
  PID:5088
- C:\Windows\System\kJTDoiU.exe
  C:\Windows\System\kJTDoiU.exe
  2⤵
  PID:5112
- C:\Windows\System\PoElWPS.exe
  C:\Windows\System\PoElWPS.exe
  2⤵
  PID:268
- C:\Windows\System\HVzZxng.exe
  C:\Windows\System\HVzZxng.exe
  2⤵
  PID:4432
- C:\Windows\System\KwCTZrY.exe
  C:\Windows\System\KwCTZrY.exe
  2⤵
  PID:4504
- C:\Windows\System\hzikoin.exe
  C:\Windows\System\hzikoin.exe
  2⤵
  PID:4916
- C:\Windows\System\YzOxEqe.exe
  C:\Windows\System\YzOxEqe.exe
  2⤵
  PID:5108
- C:\Windows\System\hobNIRH.exe
  C:\Windows\System\hobNIRH.exe
  2⤵
  PID:4528
- C:\Windows\System\ZFHEbJA.exe
  C:\Windows\System\ZFHEbJA.exe
  2⤵
  PID:4828
- C:\Windows\System\ISVYzZp.exe
  C:\Windows\System\ISVYzZp.exe
  2⤵
  PID:5128
- C:\Windows\System\LJyMuev.exe
  C:\Windows\System\LJyMuev.exe
  2⤵
  PID:5144
- C:\Windows\System\GCcseir.exe
  C:\Windows\System\GCcseir.exe
  2⤵
  PID:5160
- C:\Windows\System\WuHWdli.exe
  C:\Windows\System\WuHWdli.exe
  2⤵
  PID:5176
- C:\Windows\System\lObwABZ.exe
  C:\Windows\System\lObwABZ.exe
  2⤵
  PID:5192
- C:\Windows\System\mAPIyXP.exe
  C:\Windows\System\mAPIyXP.exe
  2⤵
  PID:5240
- C:\Windows\System\NCKciHd.exe
  C:\Windows\System\NCKciHd.exe
  2⤵
  PID:5260
- C:\Windows\System\GSotiTK.exe
  C:\Windows\System\GSotiTK.exe
  2⤵
  PID:5280
- C:\Windows\System\Glgpdrq.exe
  C:\Windows\System\Glgpdrq.exe
  2⤵
  PID:5304
- C:\Windows\System\xcrsNoS.exe
  C:\Windows\System\xcrsNoS.exe
  2⤵
  PID:5320
- C:\Windows\System\qvOUFFf.exe
  C:\Windows\System\qvOUFFf.exe
  2⤵
  PID:5336
- C:\Windows\System\rpoQBvQ.exe
  C:\Windows\System\rpoQBvQ.exe
  2⤵
  PID:5352
- C:\Windows\System\IvPQtCm.exe
  C:\Windows\System\IvPQtCm.exe
  2⤵
  PID:5368
- C:\Windows\System\cmQlqmT.exe
  C:\Windows\System\cmQlqmT.exe
  2⤵
  PID:5392
- C:\Windows\System\gvLepUo.exe
  C:\Windows\System\gvLepUo.exe
  2⤵
  PID:5408
- C:\Windows\System\XPmXGiO.exe
  C:\Windows\System\XPmXGiO.exe
  2⤵
  PID:5424
- C:\Windows\System\ZOzenGR.exe
  C:\Windows\System\ZOzenGR.exe
  2⤵
  PID:5440
- C:\Windows\System\iCFRJyp.exe
  C:\Windows\System\iCFRJyp.exe
  2⤵
  PID:5460
- C:\Windows\System\mQGazdD.exe
  C:\Windows\System\mQGazdD.exe
  2⤵
  PID:5476
- C:\Windows\System\KcLiKwe.exe
  C:\Windows\System\KcLiKwe.exe
  2⤵
  PID:5492
- C:\Windows\System\oigwLYb.exe
  C:\Windows\System\oigwLYb.exe
  2⤵
  PID:5508
- C:\Windows\System\jBBGXBI.exe
  C:\Windows\System\jBBGXBI.exe
  2⤵
  PID:5524
- C:\Windows\System\aMEtjWL.exe
  C:\Windows\System\aMEtjWL.exe
  2⤵
  PID:5540
- C:\Windows\System\lZYLIdi.exe
  C:\Windows\System\lZYLIdi.exe
  2⤵
  PID:5556
- C:\Windows\System\tipSiCX.exe
  C:\Windows\System\tipSiCX.exe
  2⤵
  PID:5576
- C:\Windows\System\ZEGaVgt.exe
  C:\Windows\System\ZEGaVgt.exe
  2⤵
  PID:5592
- C:\Windows\System\wKQVXRn.exe
  C:\Windows\System\wKQVXRn.exe
  2⤵
  PID:5608
- C:\Windows\System\urDmdez.exe
  C:\Windows\System\urDmdez.exe
  2⤵
  PID:5624
- C:\Windows\System\vzqduBH.exe
  C:\Windows\System\vzqduBH.exe
  2⤵
  PID:5640
- C:\Windows\System\qoqmuIm.exe
  C:\Windows\System\qoqmuIm.exe
  2⤵
  PID:5656
- C:\Windows\System\YLAkqss.exe
  C:\Windows\System\YLAkqss.exe
  2⤵
  PID:5672
- C:\Windows\System\uiOuiXZ.exe
  C:\Windows\System\uiOuiXZ.exe
  2⤵
  PID:5688
- C:\Windows\System\farZrEy.exe
  C:\Windows\System\farZrEy.exe
  2⤵
  PID:5704
- C:\Windows\System\ErIzZYf.exe
  C:\Windows\System\ErIzZYf.exe
  2⤵
  PID:5724
- C:\Windows\System\NyKMcRO.exe
  C:\Windows\System\NyKMcRO.exe
  2⤵
  PID:5740
- C:\Windows\System\ZLnJaxu.exe
  C:\Windows\System\ZLnJaxu.exe
  2⤵
  PID:5756
- C:\Windows\System\QKmQZLv.exe
  C:\Windows\System\QKmQZLv.exe
  2⤵
  PID:5772
- C:\Windows\System\cFsktAz.exe
  C:\Windows\System\cFsktAz.exe
  2⤵
  PID:5788
- C:\Windows\System\IDcnUXZ.exe
  C:\Windows\System\IDcnUXZ.exe
  2⤵
  PID:5804
- C:\Windows\System\QUwdVAv.exe
  C:\Windows\System\QUwdVAv.exe
  2⤵
  PID:5820
- C:\Windows\System\EAvmYIs.exe
  C:\Windows\System\EAvmYIs.exe
  2⤵
  PID:5836
- C:\Windows\System\VOGXPWI.exe
  C:\Windows\System\VOGXPWI.exe
  2⤵
  PID:5852
- C:\Windows\System\hjeSBWY.exe
  C:\Windows\System\hjeSBWY.exe
  2⤵
  PID:5868
- C:\Windows\System\CRTdnCj.exe
  C:\Windows\System\CRTdnCj.exe
  2⤵
  PID:5884
- C:\Windows\System\OppaIWv.exe
  C:\Windows\System\OppaIWv.exe
  2⤵
  PID:5904
- C:\Windows\System\hRBLzaW.exe
  C:\Windows\System\hRBLzaW.exe
  2⤵
  PID:5920
- C:\Windows\System\IHJPYjc.exe
  C:\Windows\System\IHJPYjc.exe
  2⤵
  PID:5936
- C:\Windows\System\JNIhCIc.exe
  C:\Windows\System\JNIhCIc.exe
  2⤵
  PID:5952
- C:\Windows\System\KmfvRLF.exe
  C:\Windows\System\KmfvRLF.exe
  2⤵
  PID:5968
- C:\Windows\System\hbURlnB.exe
  C:\Windows\System\hbURlnB.exe
  2⤵
  PID:5984
- C:\Windows\System\NNvWOof.exe
  C:\Windows\System\NNvWOof.exe
  2⤵
  PID:6000
- C:\Windows\System\iaMCwEk.exe
  C:\Windows\System\iaMCwEk.exe
  2⤵
  PID:6016
- C:\Windows\System\CwsuYTl.exe
  C:\Windows\System\CwsuYTl.exe
  2⤵
  PID:6032
- C:\Windows\System\hMhXzul.exe
  C:\Windows\System\hMhXzul.exe
  2⤵
  PID:6048
- C:\Windows\System\QeROtiv.exe
  C:\Windows\System\QeROtiv.exe
  2⤵
  PID:6068
- C:\Windows\System\JejtkwU.exe
  C:\Windows\System\JejtkwU.exe
  2⤵
  PID:6084
- C:\Windows\System\ZbFtLoI.exe
  C:\Windows\System\ZbFtLoI.exe
  2⤵
  PID:6100
- C:\Windows\System\uzhjDeK.exe
  C:\Windows\System\uzhjDeK.exe
  2⤵
  PID:6116
- C:\Windows\System\TAGZomU.exe
  C:\Windows\System\TAGZomU.exe
  2⤵
  PID:6132
- C:\Windows\System\kNlWmZg.exe
  C:\Windows\System\kNlWmZg.exe
  2⤵
  PID:4984
- C:\Windows\System\jPnRLYJ.exe
  C:\Windows\System\jPnRLYJ.exe
  2⤵
  PID:4760
- C:\Windows\System\lULsFUr.exe
  C:\Windows\System\lULsFUr.exe
  2⤵
  PID:4840
- C:\Windows\System\MHpDpOi.exe
  C:\Windows\System\MHpDpOi.exe
  2⤵
  PID:5184
- C:\Windows\System\WdPslRp.exe
  C:\Windows\System\WdPslRp.exe
  2⤵
  PID:4476
- C:\Windows\System\yaxvjdt.exe
  C:\Windows\System\yaxvjdt.exe
  2⤵
  PID:5172
- C:\Windows\System\cWvySSs.exe
  C:\Windows\System\cWvySSs.exe
  2⤵
  PID:4560
- C:\Windows\System\cTtXHuT.exe
  C:\Windows\System\cTtXHuT.exe
  2⤵
  PID:5216
- C:\Windows\System\uEBNHDD.exe
  C:\Windows\System\uEBNHDD.exe
  2⤵
  PID:5288
- C:\Windows\System\rMLwOQp.exe
  C:\Windows\System\rMLwOQp.exe
  2⤵
  PID:5332
- C:\Windows\System\SdaVVZQ.exe
  C:\Windows\System\SdaVVZQ.exe
  2⤵
  PID:5312
- C:\Windows\System\UwqwLqJ.exe
  C:\Windows\System\UwqwLqJ.exe
  2⤵
  PID:5272
- C:\Windows\System\Savhwyw.exe
  C:\Windows\System\Savhwyw.exe
  2⤵
  PID:5404
- C:\Windows\System\LAVORQV.exe
  C:\Windows\System\LAVORQV.exe
  2⤵
  PID:5420
- C:\Windows\System\CZZatED.exe
  C:\Windows\System\CZZatED.exe
  2⤵
  PID:5500
- C:\Windows\System\QuJJRzV.exe
  C:\Windows\System\QuJJRzV.exe
  2⤵
  PID:5564
- C:\Windows\System\dOJoyvq.exe
  C:\Windows\System\dOJoyvq.exe
  2⤵
  PID:5600
- C:\Windows\System\ehvtYMk.exe
  C:\Windows\System\ehvtYMk.exe
  2⤵
  PID:5664
- C:\Windows\System\lystkVg.exe
  C:\Windows\System\lystkVg.exe
  2⤵
  PID:5516
- C:\Windows\System\KKUmCLT.exe
  C:\Windows\System\KKUmCLT.exe
  2⤵
  PID:5584
- C:\Windows\System\MrGgJcH.exe
  C:\Windows\System\MrGgJcH.exe
  2⤵
  PID:5488
- C:\Windows\System\MgUtdZy.exe
  C:\Windows\System\MgUtdZy.exe
  2⤵
  PID:5768
- C:\Windows\System\IIibSWH.exe
  C:\Windows\System\IIibSWH.exe
  2⤵
  PID:5680
- C:\Windows\System\wYquljT.exe
  C:\Windows\System\wYquljT.exe
  2⤵
  PID:5520
- C:\Windows\System\aaofAJT.exe
  C:\Windows\System\aaofAJT.exe
  2⤵
  PID:5748
- C:\Windows\System\yrsVDwI.exe
  C:\Windows\System\yrsVDwI.exe
  2⤵
  PID:5816
- C:\Windows\System\WsWbDfg.exe
  C:\Windows\System\WsWbDfg.exe
  2⤵
  PID:5896
- C:\Windows\System\UiSjQnh.exe
  C:\Windows\System\UiSjQnh.exe
  2⤵
  PID:5900
- C:\Windows\System\zIfeUSJ.exe
  C:\Windows\System\zIfeUSJ.exe
  2⤵
  PID:5928
- C:\Windows\System\cnfzIAT.exe
  C:\Windows\System\cnfzIAT.exe
  2⤵
  PID:5964
- C:\Windows\System\qWfCFDN.exe
  C:\Windows\System\qWfCFDN.exe
  2⤵
  PID:6028
- C:\Windows\System\FjlDDTj.exe
  C:\Windows\System\FjlDDTj.exe
  2⤵
  PID:5976
- C:\Windows\System\QBYmymu.exe
  C:\Windows\System\QBYmymu.exe
  2⤵
  PID:6096
- C:\Windows\System\qUyMzSq.exe
  C:\Windows\System\qUyMzSq.exe
  2⤵
  PID:6044
- C:\Windows\System\GgIdijF.exe
  C:\Windows\System\GgIdijF.exe
  2⤵
  PID:6076
- C:\Windows\System\hMCZKIN.exe
  C:\Windows\System\hMCZKIN.exe
  2⤵
  PID:6108
- C:\Windows\System\avvGMsc.exe
  C:\Windows\System\avvGMsc.exe
  2⤵
  PID:4416
- C:\Windows\System\VDSxgYV.exe
  C:\Windows\System\VDSxgYV.exe
  2⤵
  PID:6140
- C:\Windows\System\uUzeaOn.exe
  C:\Windows\System\uUzeaOn.exe
  2⤵
  PID:5140
- C:\Windows\System\pYMrsGB.exe
  C:\Windows\System\pYMrsGB.exe
  2⤵
  PID:5056
- C:\Windows\System\OnNPHDw.exe
  C:\Windows\System\OnNPHDw.exe
  2⤵
  PID:4900
- C:\Windows\System\tnbUYim.exe
  C:\Windows\System\tnbUYim.exe
  2⤵
  PID:5296
- C:\Windows\System\dQqHPQJ.exe
  C:\Windows\System\dQqHPQJ.exe
  2⤵
  PID:5380
- C:\Windows\System\LRKAngg.exe
  C:\Windows\System\LRKAngg.exe
  2⤵
  PID:5448
- C:\Windows\System\xOyvBNV.exe
  C:\Windows\System\xOyvBNV.exe
  2⤵
  PID:5232
- C:\Windows\System\fBkxPMo.exe
  C:\Windows\System\fBkxPMo.exe
  2⤵
  PID:5712
- C:\Windows\System\MaFIFmO.exe
  C:\Windows\System\MaFIFmO.exe
  2⤵
  PID:5268
- C:\Windows\System\fEEejKG.exe
  C:\Windows\System\fEEejKG.exe
  2⤵
  PID:5700
- C:\Windows\System\XiaSsPx.exe
  C:\Windows\System\XiaSsPx.exe
  2⤵
  PID:5948
- C:\Windows\System\pEIZpXJ.exe
  C:\Windows\System\pEIZpXJ.exe
  2⤵
  PID:5996
- C:\Windows\System\pkuTlxK.exe
  C:\Windows\System\pkuTlxK.exe
  2⤵
  PID:5220
- C:\Windows\System\EBiuMqo.exe
  C:\Windows\System\EBiuMqo.exe
  2⤵
  PID:5636
- C:\Windows\System\RIhOGyr.exe
  C:\Windows\System\RIhOGyr.exe
  2⤵
  PID:5276
- C:\Windows\System\hwhnzoZ.exe
  C:\Windows\System\hwhnzoZ.exe
  2⤵
  PID:5548
- C:\Windows\System\TVITToW.exe
  C:\Windows\System\TVITToW.exe
  2⤵
  PID:5880
- C:\Windows\System\axwGoea.exe
  C:\Windows\System\axwGoea.exe
  2⤵
  PID:2492
- C:\Windows\System\LrNrKBC.exe
  C:\Windows\System\LrNrKBC.exe
  2⤵
  PID:6012
- C:\Windows\System\nxdGQsY.exe
  C:\Windows\System\nxdGQsY.exe
  2⤵
  PID:4696
- C:\Windows\System\lVlalDN.exe
  C:\Windows\System\lVlalDN.exe
  2⤵
  PID:4304
- C:\Windows\System\eMBRqxN.exe
  C:\Windows\System\eMBRqxN.exe
  2⤵
  PID:5364
- C:\Windows\System\DzpdWQk.exe
  C:\Windows\System\DzpdWQk.exe
  2⤵
  PID:5652
- C:\Windows\System\fvnyIJK.exe
  C:\Windows\System\fvnyIJK.exe
  2⤵
  PID:5812
- C:\Windows\System\RwLHbNo.exe
  C:\Windows\System\RwLHbNo.exe
  2⤵
  PID:5844
- C:\Windows\System\RXLYqPR.exe
  C:\Windows\System\RXLYqPR.exe
  2⤵
  PID:5348
- C:\Windows\System\SvczoPi.exe
  C:\Windows\System\SvczoPi.exe
  2⤵
  PID:5568
- C:\Windows\System\LbqCaTd.exe
  C:\Windows\System\LbqCaTd.exe
  2⤵
  PID:5008
- C:\Windows\System\AEegWrh.exe
  C:\Windows\System\AEegWrh.exe
  2⤵
  PID:5156
- C:\Windows\System\basfUKE.exe
  C:\Windows\System\basfUKE.exe
  2⤵
  PID:6064
- C:\Windows\System\FRCEgXe.exe
  C:\Windows\System\FRCEgXe.exe
  2⤵
  PID:5944
- C:\Windows\System\cUiBVHw.exe
  C:\Windows\System\cUiBVHw.exe
  2⤵
  PID:5696
- C:\Windows\System\poNKgGk.exe
  C:\Windows\System\poNKgGk.exe
  2⤵
  PID:5784
- C:\Windows\System\okzJgUQ.exe
  C:\Windows\System\okzJgUQ.exe
  2⤵
  PID:6160
- C:\Windows\System\RmMGrwP.exe
  C:\Windows\System\RmMGrwP.exe
  2⤵
  PID:6176
- C:\Windows\System\StajpVu.exe
  C:\Windows\System\StajpVu.exe
  2⤵
  PID:6192
- C:\Windows\System\IVrOVQW.exe
  C:\Windows\System\IVrOVQW.exe
  2⤵
  PID:6208
- C:\Windows\System\fbuGmEf.exe
  C:\Windows\System\fbuGmEf.exe
  2⤵
  PID:6312
- C:\Windows\System\ElsOCOK.exe
  C:\Windows\System\ElsOCOK.exe
  2⤵
  PID:6336
- C:\Windows\System\AIPUGcr.exe
  C:\Windows\System\AIPUGcr.exe
  2⤵
  PID:6352
- C:\Windows\System\bscGPES.exe
  C:\Windows\System\bscGPES.exe
  2⤵
  PID:6368
- C:\Windows\System\zBHvqlD.exe
  C:\Windows\System\zBHvqlD.exe
  2⤵
  PID:6384
- C:\Windows\System\unjPXWD.exe
  C:\Windows\System\unjPXWD.exe
  2⤵
  PID:6400
- C:\Windows\System\lKhOqkS.exe
  C:\Windows\System\lKhOqkS.exe
  2⤵
  PID:6420
- C:\Windows\System\VEXBtWW.exe
  C:\Windows\System\VEXBtWW.exe
  2⤵
  PID:6436
- C:\Windows\System\BuichCd.exe
  C:\Windows\System\BuichCd.exe
  2⤵
  PID:6452
- C:\Windows\System\YWQdcTk.exe
  C:\Windows\System\YWQdcTk.exe
  2⤵
  PID:6468
- C:\Windows\System\PCJyEnl.exe
  C:\Windows\System\PCJyEnl.exe
  2⤵
  PID:6484
- C:\Windows\System\GTsLFaw.exe
  C:\Windows\System\GTsLFaw.exe
  2⤵
  PID:6500
- C:\Windows\System\YYwCGSM.exe
  C:\Windows\System\YYwCGSM.exe
  2⤵
  PID:6516
- C:\Windows\System\NNCGsMW.exe
  C:\Windows\System\NNCGsMW.exe
  2⤵
  PID:6532
- C:\Windows\System\eeimymJ.exe
  C:\Windows\System\eeimymJ.exe
  2⤵
  PID:6552
- C:\Windows\System\njuEOml.exe
  C:\Windows\System\njuEOml.exe
  2⤵
  PID:6568
- C:\Windows\System\mctrPsC.exe
  C:\Windows\System\mctrPsC.exe
  2⤵
  PID:6584
- C:\Windows\System\SPRIrps.exe
  C:\Windows\System\SPRIrps.exe
  2⤵
  PID:6600
- C:\Windows\System\IKimbsj.exe
  C:\Windows\System\IKimbsj.exe
  2⤵
  PID:6696
- C:\Windows\System\bFhNLRE.exe
  C:\Windows\System\bFhNLRE.exe
  2⤵
  PID:6712
- C:\Windows\System\vkqFUKE.exe
  C:\Windows\System\vkqFUKE.exe
  2⤵
  PID:6728
- C:\Windows\System\mwOFJFs.exe
  C:\Windows\System\mwOFJFs.exe
  2⤵
  PID:6744
- C:\Windows\System\zBZDPcS.exe
  C:\Windows\System\zBZDPcS.exe
  2⤵
  PID:6760
- C:\Windows\System\nPsAbiV.exe
  C:\Windows\System\nPsAbiV.exe
  2⤵
  PID:6788
- C:\Windows\System\KGNYnPZ.exe
  C:\Windows\System\KGNYnPZ.exe
  2⤵
  PID:6804
- C:\Windows\System\EavObOg.exe
  C:\Windows\System\EavObOg.exe
  2⤵
  PID:6820
- C:\Windows\System\bRpzvkj.exe
  C:\Windows\System\bRpzvkj.exe
  2⤵
  PID:6836
- C:\Windows\System\CSjrMTf.exe
  C:\Windows\System\CSjrMTf.exe
  2⤵
  PID:6852
- C:\Windows\System\wMoGVQE.exe
  C:\Windows\System\wMoGVQE.exe
  2⤵
  PID:6868
- C:\Windows\System\XUYTaDM.exe
  C:\Windows\System\XUYTaDM.exe
  2⤵
  PID:6884
- C:\Windows\System\vErnyTh.exe
  C:\Windows\System\vErnyTh.exe
  2⤵
  PID:6900
- C:\Windows\System\rCzawhn.exe
  C:\Windows\System\rCzawhn.exe
  2⤵
  PID:6916
- C:\Windows\System\eJlbOwS.exe
  C:\Windows\System\eJlbOwS.exe
  2⤵
  PID:6932
- C:\Windows\System\QevhIoU.exe
  C:\Windows\System\QevhIoU.exe
  2⤵
  PID:6948
- C:\Windows\System\ikiLXzz.exe
  C:\Windows\System\ikiLXzz.exe
  2⤵
  PID:6964
- C:\Windows\System\WjMHmpT.exe
  C:\Windows\System\WjMHmpT.exe
  2⤵
  PID:6980
- C:\Windows\System\bUlBlnU.exe
  C:\Windows\System\bUlBlnU.exe
  2⤵
  PID:6996
- C:\Windows\System\kICeXcJ.exe
  C:\Windows\System\kICeXcJ.exe
  2⤵
  PID:7012
- C:\Windows\System\FzCAZSM.exe
  C:\Windows\System\FzCAZSM.exe
  2⤵
  PID:7028
- C:\Windows\System\UumzeOK.exe
  C:\Windows\System\UumzeOK.exe
  2⤵
  PID:7044
- C:\Windows\System\ljsTCcY.exe
  C:\Windows\System\ljsTCcY.exe
  2⤵
  PID:7060
- C:\Windows\System\zjFPJen.exe
  C:\Windows\System\zjFPJen.exe
  2⤵
  PID:7076
- C:\Windows\System\DDZNPDL.exe
  C:\Windows\System\DDZNPDL.exe
  2⤵
  PID:7092
- C:\Windows\System\sNfIfpe.exe
  C:\Windows\System\sNfIfpe.exe
  2⤵
  PID:7108
- C:\Windows\System\lUQONmx.exe
  C:\Windows\System\lUQONmx.exe
  2⤵
  PID:7124
- C:\Windows\System\UEXVVgm.exe
  C:\Windows\System\UEXVVgm.exe
  2⤵
  PID:7140
- C:\Windows\System\OIUfXub.exe
  C:\Windows\System\OIUfXub.exe
  2⤵
  PID:7156
- C:\Windows\System\nxopqAj.exe
  C:\Windows\System\nxopqAj.exe
  2⤵
  PID:5632
- C:\Windows\System\XqmRFvd.exe
  C:\Windows\System\XqmRFvd.exe
  2⤵
  PID:6204
- C:\Windows\System\zIbynVH.exe
  C:\Windows\System\zIbynVH.exe
  2⤵
  PID:6112
- C:\Windows\System\vQGQKJv.exe
  C:\Windows\System\vQGQKJv.exe
  2⤵
  PID:6124
- C:\Windows\System\rttVzPs.exe
  C:\Windows\System\rttVzPs.exe
  2⤵
  PID:6152
- C:\Windows\System\AdXskUC.exe
  C:\Windows\System\AdXskUC.exe
  2⤵
  PID:6224
- C:\Windows\System\UvRTsrn.exe
  C:\Windows\System\UvRTsrn.exe
  2⤵
  PID:6240
- C:\Windows\System\FRhTMEx.exe
  C:\Windows\System\FRhTMEx.exe
  2⤵
  PID:6260
- C:\Windows\System\EHXbyDj.exe
  C:\Windows\System\EHXbyDj.exe
  2⤵
  PID:6276
- C:\Windows\System\tPLYgQd.exe
  C:\Windows\System\tPLYgQd.exe
  2⤵
  PID:6300
- C:\Windows\System\asLMFCo.exe
  C:\Windows\System\asLMFCo.exe
  2⤵
  PID:6324
- C:\Windows\System\uqLMEkR.exe
  C:\Windows\System\uqLMEkR.exe
  2⤵
  PID:6380
- C:\Windows\System\VvXpDhv.exe
  C:\Windows\System\VvXpDhv.exe
  2⤵
  PID:6444
- C:\Windows\System\hkVNguF.exe
  C:\Windows\System\hkVNguF.exe
  2⤵
  PID:6508
- C:\Windows\System\guTRIUZ.exe
  C:\Windows\System\guTRIUZ.exe
  2⤵
  PID:6548
- C:\Windows\System\klXPPST.exe
  C:\Windows\System\klXPPST.exe
  2⤵
  PID:6612
- C:\Windows\System\itSrLgY.exe
  C:\Windows\System\itSrLgY.exe
  2⤵
  PID:6528
- C:\Windows\System\ZHXLjeQ.exe
  C:\Windows\System\ZHXLjeQ.exe
  2⤵
  PID:6492
- C:\Windows\System\czYSrrF.exe
  C:\Windows\System\czYSrrF.exe
  2⤵
  PID:6392
- C:\Windows\System\lBZZlTg.exe
  C:\Windows\System\lBZZlTg.exe
  2⤵
  PID:6460
- C:\Windows\System\XrfEGvp.exe
  C:\Windows\System\XrfEGvp.exe
  2⤵
  PID:6564
- C:\Windows\System\XKkdGpB.exe
  C:\Windows\System\XKkdGpB.exe
  2⤵
  PID:6632
- C:\Windows\System\WuVoLFP.exe
  C:\Windows\System\WuVoLFP.exe
  2⤵
  PID:6648
- C:\Windows\System\qiCDJtF.exe
  C:\Windows\System\qiCDJtF.exe
  2⤵
  PID:6660
- C:\Windows\System\CmkySfo.exe
  C:\Windows\System\CmkySfo.exe
  2⤵
  PID:6680
- C:\Windows\System\TbEwWLV.exe
  C:\Windows\System\TbEwWLV.exe
  2⤵
  PID:6704
- C:\Windows\System\lEmGHfn.exe
  C:\Windows\System\lEmGHfn.exe
  2⤵
  PID:6756
- C:\Windows\System\eCyNdwH.exe
  C:\Windows\System\eCyNdwH.exe
  2⤵
  PID:6256
- C:\Windows\System\LbWIWYn.exe
  C:\Windows\System\LbWIWYn.exe
  2⤵
  PID:6784
- C:\Windows\System\FrZKPyJ.exe
  C:\Windows\System\FrZKPyJ.exe
  2⤵
  PID:6832
- C:\Windows\System\whAUeDc.exe
  C:\Windows\System\whAUeDc.exe
  2⤵
  PID:6816
- C:\Windows\System\kRbOpRS.exe
  C:\Windows\System\kRbOpRS.exe
  2⤵
  PID:6928
- C:\Windows\System\dAMBACX.exe
  C:\Windows\System\dAMBACX.exe
  2⤵
  PID:6880
- C:\Windows\System\DbwIbfO.exe
  C:\Windows\System\DbwIbfO.exe
  2⤵
  PID:7020
- C:\Windows\System\TNWDSst.exe
  C:\Windows\System\TNWDSst.exe
  2⤵
  PID:7084
- C:\Windows\System\WVlnpgR.exe
  C:\Windows\System\WVlnpgR.exe
  2⤵
  PID:6908
- C:\Windows\System\HBYWzzu.exe
  C:\Windows\System\HBYWzzu.exe
  2⤵
  PID:5848
- C:\Windows\System\THFTESO.exe
  C:\Windows\System\THFTESO.exe
  2⤵
  PID:6172
- C:\Windows\System\gslxmbk.exe
  C:\Windows\System\gslxmbk.exe
  2⤵
  PID:7004
- C:\Windows\System\RFOSXXC.exe
  C:\Windows\System\RFOSXXC.exe
  2⤵
  PID:6972
- C:\Windows\System\ruLEHPa.exe
  C:\Windows\System\ruLEHPa.exe
  2⤵
  PID:7068
- C:\Windows\System\ahBhyOH.exe
  C:\Windows\System\ahBhyOH.exe
  2⤵
  PID:6252
- C:\Windows\System\DVmCwJY.exe
  C:\Windows\System\DVmCwJY.exe
  2⤵
  PID:5648
- C:\Windows\System\hIgYfHk.exe
  C:\Windows\System\hIgYfHk.exe
  2⤵
  PID:5620
- C:\Windows\System\HpXTdzU.exe
  C:\Windows\System\HpXTdzU.exe
  2⤵
  PID:6232
- C:\Windows\System\UQXhhXr.exe
  C:\Windows\System\UQXhhXr.exe
  2⤵
  PID:6676
- C:\Windows\System\QbkRCzQ.exe
  C:\Windows\System\QbkRCzQ.exe
  2⤵
  PID:6580
- C:\Windows\System\zIVTcRE.exe
  C:\Windows\System\zIVTcRE.exe
  2⤵
  PID:6308
- C:\Windows\System\zzmhcQe.exe
  C:\Windows\System\zzmhcQe.exe
  2⤵
  PID:6628
- C:\Windows\System\gJIlYLi.exe
  C:\Windows\System\gJIlYLi.exe
  2⤵
  PID:6364
- C:\Windows\System\QGqInob.exe
  C:\Windows\System\QGqInob.exe
  2⤵
  PID:6332
- C:\Windows\System\dABXoip.exe
  C:\Windows\System\dABXoip.exe
  2⤵
  PID:6768
- C:\Windows\System\NZHFAYL.exe
  C:\Windows\System\NZHFAYL.exe
  2⤵
  PID:6412
- C:\Windows\System\kfpBTNT.exe
  C:\Windows\System\kfpBTNT.exe
  2⤵
  PID:6896
- C:\Windows\System\AvLJLwY.exe
  C:\Windows\System\AvLJLwY.exe
  2⤵
  PID:6776
- C:\Windows\System\DZyvJVP.exe
  C:\Windows\System\DZyvJVP.exe
  2⤵
  PID:6844
- C:\Windows\System\bcVUTca.exe
  C:\Windows\System\bcVUTca.exe
  2⤵
  PID:6772
- C:\Windows\System\ZLbXhNG.exe
  C:\Windows\System\ZLbXhNG.exe
  2⤵
  PID:6876
- C:\Windows\System\boDoriQ.exe
  C:\Windows\System\boDoriQ.exe
  2⤵
  PID:7148
- C:\Windows\System\yAFBNmt.exe
  C:\Windows\System\yAFBNmt.exe
  2⤵
  PID:7036
- C:\Windows\System\SdwTdtE.exe
  C:\Windows\System\SdwTdtE.exe
  2⤵
  PID:7164
- C:\Windows\System\dbaauyk.exe
  C:\Windows\System\dbaauyk.exe
  2⤵
  PID:4368
- C:\Windows\System\FjiCpeZ.exe
  C:\Windows\System\FjiCpeZ.exe
  2⤵
  PID:6288
- C:\Windows\System\rymUiZG.exe
  C:\Windows\System\rymUiZG.exe
  2⤵
  PID:6348
- C:\Windows\System\OoisujR.exe
  C:\Windows\System\OoisujR.exe
  2⤵
  PID:6416
- C:\Windows\System\lekkGAw.exe
  C:\Windows\System\lekkGAw.exe
  2⤵
  PID:6560
- C:\Windows\System\RLHuILw.exe
  C:\Windows\System\RLHuILw.exe
  2⤵
  PID:6860
- C:\Windows\System\AaqwmRa.exe
  C:\Windows\System\AaqwmRa.exe
  2⤵
  PID:7104
- C:\Windows\System\dUkxyYD.exe
  C:\Windows\System\dUkxyYD.exe
  2⤵
  PID:6236
- C:\Windows\System\hKdQWuk.exe
  C:\Windows\System\hKdQWuk.exe
  2⤵
  PID:6304
- C:\Windows\System\hrusajX.exe
  C:\Windows\System\hrusajX.exe
  2⤵
  PID:6692
- C:\Windows\System\YnlcCVh.exe
  C:\Windows\System\YnlcCVh.exe
  2⤵
  PID:7056
- C:\Windows\System\DxAXiRF.exe
  C:\Windows\System\DxAXiRF.exe
  2⤵
  PID:6184
- C:\Windows\System\HpHYayJ.exe
  C:\Windows\System\HpHYayJ.exe
  2⤵
  PID:6992
- C:\Windows\System\UvPcLar.exe
  C:\Windows\System\UvPcLar.exe
  2⤵
  PID:6708
- C:\Windows\System\vaRSFpB.exe
  C:\Windows\System\vaRSFpB.exe
  2⤵
  PID:6752
- C:\Windows\System\aHRVcmY.exe
  C:\Windows\System\aHRVcmY.exe
  2⤵
  PID:6640
- C:\Windows\System\sLJwImL.exe
  C:\Windows\System\sLJwImL.exe
  2⤵
  PID:7040
- C:\Windows\System\LHXuAEd.exe
  C:\Windows\System\LHXuAEd.exe
  2⤵
  PID:7180
- C:\Windows\System\CgnDksB.exe
  C:\Windows\System\CgnDksB.exe
  2⤵
  PID:7196
- C:\Windows\System\DUxkqtL.exe
  C:\Windows\System\DUxkqtL.exe
  2⤵
  PID:7236
- C:\Windows\System\PEZVprs.exe
  C:\Windows\System\PEZVprs.exe
  2⤵
  PID:7252
- C:\Windows\System\ZQnPsKh.exe
  C:\Windows\System\ZQnPsKh.exe
  2⤵
  PID:7268
- C:\Windows\System\yLwQxdz.exe
  C:\Windows\System\yLwQxdz.exe
  2⤵
  PID:7284
- C:\Windows\System\bwXtDFt.exe
  C:\Windows\System\bwXtDFt.exe
  2⤵
  PID:7300
- C:\Windows\System\eTTXxis.exe
  C:\Windows\System\eTTXxis.exe
  2⤵
  PID:7316
- C:\Windows\System\yuMrcuV.exe
  C:\Windows\System\yuMrcuV.exe
  2⤵
  PID:7332
- C:\Windows\System\hydAmDF.exe
  C:\Windows\System\hydAmDF.exe
  2⤵
  PID:7348
- C:\Windows\System\MjAizGv.exe
  C:\Windows\System\MjAizGv.exe
  2⤵
  PID:7364
- C:\Windows\System\dlPTUYo.exe
  C:\Windows\System\dlPTUYo.exe
  2⤵
  PID:7380
- C:\Windows\System\rwBgmUS.exe
  C:\Windows\System\rwBgmUS.exe
  2⤵
  PID:7396
- C:\Windows\System\MIUmHco.exe
  C:\Windows\System\MIUmHco.exe
  2⤵
  PID:7412
- C:\Windows\System\gUhZEJV.exe
  C:\Windows\System\gUhZEJV.exe
  2⤵
  PID:7428
- C:\Windows\System\JRNCMDD.exe
  C:\Windows\System\JRNCMDD.exe
  2⤵
  PID:7444
- C:\Windows\System\mevUupk.exe
  C:\Windows\System\mevUupk.exe
  2⤵
  PID:7460
- C:\Windows\System\vfLzMZc.exe
  C:\Windows\System\vfLzMZc.exe
  2⤵
  PID:7480
- C:\Windows\System\ZspjbYB.exe
  C:\Windows\System\ZspjbYB.exe
  2⤵
  PID:7496
- C:\Windows\System\sswEsdE.exe
  C:\Windows\System\sswEsdE.exe
  2⤵
  PID:7512
- C:\Windows\System\OiVtZdR.exe
  C:\Windows\System\OiVtZdR.exe
  2⤵
  PID:7528
- C:\Windows\System\dOVTrbq.exe
  C:\Windows\System\dOVTrbq.exe
  2⤵
  PID:7544
- C:\Windows\System\XSzZooL.exe
  C:\Windows\System\XSzZooL.exe
  2⤵
  PID:7560
- C:\Windows\System\ViXJfrJ.exe
  C:\Windows\System\ViXJfrJ.exe
  2⤵
  PID:7576
- C:\Windows\System\BlcYJET.exe
  C:\Windows\System\BlcYJET.exe
  2⤵
  PID:7592
- C:\Windows\System\qtaFvDX.exe
  C:\Windows\System\qtaFvDX.exe
  2⤵
  PID:7608
- C:\Windows\System\EvFQitz.exe
  C:\Windows\System\EvFQitz.exe
  2⤵
  PID:7624
- C:\Windows\System\BixcLbU.exe
  C:\Windows\System\BixcLbU.exe
  2⤵
  PID:7640
- C:\Windows\System\YubLaeh.exe
  C:\Windows\System\YubLaeh.exe
  2⤵
  PID:7656
- C:\Windows\System\mhpClpj.exe
  C:\Windows\System\mhpClpj.exe
  2⤵
  PID:7672
- C:\Windows\System\vKMcemJ.exe
  C:\Windows\System\vKMcemJ.exe
  2⤵
  PID:7688
- C:\Windows\System\RvwMxof.exe
  C:\Windows\System\RvwMxof.exe
  2⤵
  PID:7704
- C:\Windows\System\QGgdAWy.exe
  C:\Windows\System\QGgdAWy.exe
  2⤵
  PID:7724
- C:\Windows\System\Rybvtgp.exe
  C:\Windows\System\Rybvtgp.exe
  2⤵
  PID:7740
- C:\Windows\System\ErEhQoh.exe
  C:\Windows\System\ErEhQoh.exe
  2⤵
  PID:7756
- C:\Windows\System\GXkQbdx.exe
  C:\Windows\System\GXkQbdx.exe
  2⤵
  PID:7772
- C:\Windows\System\WxEyphj.exe
  C:\Windows\System\WxEyphj.exe
  2⤵
  PID:7788
- C:\Windows\System\nwcdsIZ.exe
  C:\Windows\System\nwcdsIZ.exe
  2⤵
  PID:7804
- C:\Windows\System\GBgZHFV.exe
  C:\Windows\System\GBgZHFV.exe
  2⤵
  PID:7820
- C:\Windows\System\bGchMIG.exe
  C:\Windows\System\bGchMIG.exe
  2⤵
  PID:7836
- C:\Windows\System\sgRlpzG.exe
  C:\Windows\System\sgRlpzG.exe
  2⤵
  PID:7852
- C:\Windows\System\TusSFmD.exe
  C:\Windows\System\TusSFmD.exe
  2⤵
  PID:7868
- C:\Windows\System\tcyVzHT.exe
  C:\Windows\System\tcyVzHT.exe
  2⤵
  PID:7904
- C:\Windows\System\IfygOVa.exe
  C:\Windows\System\IfygOVa.exe
  2⤵
  PID:7920
- C:\Windows\System\UhkVeIx.exe
  C:\Windows\System\UhkVeIx.exe
  2⤵
  PID:7936
- C:\Windows\System\AWBXAEx.exe
  C:\Windows\System\AWBXAEx.exe
  2⤵
  PID:7956
- C:\Windows\System\TzxQQgd.exe
  C:\Windows\System\TzxQQgd.exe
  2⤵
  PID:7972
- C:\Windows\System\zcXCrQl.exe
  C:\Windows\System\zcXCrQl.exe
  2⤵
  PID:7988
- C:\Windows\System\dmhhIEf.exe
  C:\Windows\System\dmhhIEf.exe
  2⤵
  PID:8004
- C:\Windows\System\lUDpcKX.exe
  C:\Windows\System\lUDpcKX.exe
  2⤵
  PID:8020
- C:\Windows\System\zqmgKHH.exe
  C:\Windows\System\zqmgKHH.exe
  2⤵
  PID:8036
- C:\Windows\System\tcmpVIW.exe
  C:\Windows\System\tcmpVIW.exe
  2⤵
  PID:8052
- C:\Windows\System\cCxrweZ.exe
  C:\Windows\System\cCxrweZ.exe
  2⤵
  PID:8068
- C:\Windows\System\QVOXETw.exe
  C:\Windows\System\QVOXETw.exe
  2⤵
  PID:8084
- C:\Windows\System\Xjwzall.exe
  C:\Windows\System\Xjwzall.exe
  2⤵
  PID:8100
- C:\Windows\System\PCbwjSb.exe
  C:\Windows\System\PCbwjSb.exe
  2⤵
  PID:8116
- C:\Windows\System\OFXYdOJ.exe
  C:\Windows\System\OFXYdOJ.exe
  2⤵
  PID:8132
- C:\Windows\System\tTlCksP.exe
  C:\Windows\System\tTlCksP.exe
  2⤵
  PID:8148
- C:\Windows\System\aCPPNPR.exe
  C:\Windows\System\aCPPNPR.exe
  2⤵
  PID:8164
- C:\Windows\System\pMDKJEz.exe
  C:\Windows\System\pMDKJEz.exe
  2⤵
  PID:8180
- C:\Windows\System\jouRonD.exe
  C:\Windows\System\jouRonD.exe
  2⤵
  PID:6740
- C:\Windows\System\QDslgQE.exe
  C:\Windows\System\QDslgQE.exe
  2⤵
  PID:7188
- C:\Windows\System\Bopkzrk.exe
  C:\Windows\System\Bopkzrk.exe
  2⤵
  PID:6248
- C:\Windows\System\IikDHDJ.exe
  C:\Windows\System\IikDHDJ.exe
  2⤵
  PID:6724
- C:\Windows\System\JJrZgmR.exe
  C:\Windows\System\JJrZgmR.exe
  2⤵
  PID:7244
- C:\Windows\System\rSRjaEz.exe
  C:\Windows\System\rSRjaEz.exe
  2⤵
  PID:7280
- C:\Windows\System\laSWIzb.exe
  C:\Windows\System\laSWIzb.exe
  2⤵
  PID:7292
- C:\Windows\System\NanRRyO.exe
  C:\Windows\System\NanRRyO.exe
  2⤵
  PID:7324
- C:\Windows\System\ndYbIdp.exe
  C:\Windows\System\ndYbIdp.exe
  2⤵
  PID:7328
- C:\Windows\System\yLbFPWc.exe
  C:\Windows\System\yLbFPWc.exe
  2⤵
  PID:7388
- C:\Windows\System\iyUoFWJ.exe
  C:\Windows\System\iyUoFWJ.exe
  2⤵
  PID:7452
- C:\Windows\System\FHhdtQw.exe
  C:\Windows\System\FHhdtQw.exe
  2⤵
  PID:7520
- C:\Windows\System\mCUFmXW.exe
  C:\Windows\System\mCUFmXW.exe
  2⤵
  PID:7404
- C:\Windows\System\FwHegKt.exe
  C:\Windows\System\FwHegKt.exe
  2⤵
  PID:7524
- C:\Windows\System\AXSTflr.exe
  C:\Windows\System\AXSTflr.exe
  2⤵
  PID:7568
- C:\Windows\System\atHXAci.exe
  C:\Windows\System\atHXAci.exe
  2⤵
  PID:7684
- C:\Windows\System\TBkVICB.exe
  C:\Windows\System\TBkVICB.exe
  2⤵
  PID:7716
- C:\Windows\System\JmLlvMz.exe
  C:\Windows\System\JmLlvMz.exe
  2⤵
  PID:7828
- C:\Windows\System\lfEbQmR.exe
  C:\Windows\System\lfEbQmR.exe
  2⤵
  PID:7784
- C:\Windows\System\RKYipdK.exe
  C:\Windows\System\RKYipdK.exe
  2⤵
  PID:7748
- C:\Windows\System\wwbxbTP.exe
  C:\Windows\System\wwbxbTP.exe
  2⤵
  PID:7844
- C:\Windows\System\AUBtyFb.exe
  C:\Windows\System\AUBtyFb.exe
  2⤵
  PID:7880
- C:\Windows\System\PEVklaY.exe
  C:\Windows\System\PEVklaY.exe
  2⤵
  PID:7896
- C:\Windows\System\VOhGsLx.exe
  C:\Windows\System\VOhGsLx.exe
  2⤵
  PID:7780
- C:\Windows\System\SWbMzeL.exe
  C:\Windows\System\SWbMzeL.exe
  2⤵
  PID:7648
- C:\Windows\System\fjCRcJp.exe
  C:\Windows\System\fjCRcJp.exe
  2⤵
  PID:7584
- C:\Windows\System\iwOSLzW.exe
  C:\Windows\System\iwOSLzW.exe
  2⤵
  PID:7892
- C:\Windows\System\YzInWJc.exe
  C:\Windows\System\YzInWJc.exe
  2⤵
  PID:7260
- C:\Windows\System\JrYZhoZ.exe
  C:\Windows\System\JrYZhoZ.exe
  2⤵
  PID:7436
- C:\Windows\System\HrNVXII.exe
  C:\Windows\System\HrNVXII.exe
  2⤵
  PID:7764
- C:\Windows\System\OMhHpIk.exe
  C:\Windows\System\OMhHpIk.exe
  2⤵
  PID:7864
- C:\Windows\System\NnaVloX.exe
  C:\Windows\System\NnaVloX.exe
  2⤵
  PID:7948
- C:\Windows\System\SfLXXvT.exe
  C:\Windows\System\SfLXXvT.exe
  2⤵
  PID:8012
- C:\Windows\System\KCmTkiF.exe
  C:\Windows\System\KCmTkiF.exe
  2⤵
  PID:8076
- C:\Windows\System\eEiwChw.exe
  C:\Windows\System\eEiwChw.exe
  2⤵
  PID:8108
- C:\Windows\System\JkYQMZU.exe
  C:\Windows\System\JkYQMZU.exe
  2⤵
  PID:8176
- C:\Windows\System\cPYbooW.exe
  C:\Windows\System\cPYbooW.exe
  2⤵
  PID:7964
- C:\Windows\System\AQGLyYB.exe
  C:\Windows\System\AQGLyYB.exe
  2⤵
  PID:8028
- C:\Windows\System\XDcMsxJ.exe
  C:\Windows\System\XDcMsxJ.exe
  2⤵
  PID:8096
- C:\Windows\System\UGJGsiq.exe
  C:\Windows\System\UGJGsiq.exe
  2⤵
  PID:7208
- C:\Windows\System\JjMJIfQ.exe
  C:\Windows\System\JjMJIfQ.exe
  2⤵
  PID:7312
- C:\Windows\System\FOHpIIo.exe
  C:\Windows\System\FOHpIIo.exe
  2⤵
  PID:7504
- C:\Windows\System\AtputCx.exe
  C:\Windows\System\AtputCx.exe
  2⤵
  PID:7204
- C:\Windows\System\onBCBZi.exe
  C:\Windows\System\onBCBZi.exe
  2⤵
  PID:7620
- C:\Windows\System\MBTTgdG.exe
  C:\Windows\System\MBTTgdG.exe
  2⤵
  PID:7700
- C:\Windows\System\syeyQDA.exe
  C:\Windows\System\syeyQDA.exe
  2⤵
  PID:7636
- C:\Windows\System\UfixLMN.exe
  C:\Windows\System\UfixLMN.exe
  2⤵
  PID:7424
- C:\Windows\System\bpeYhNN.exe
  C:\Windows\System\bpeYhNN.exe
  2⤵
  PID:8112
- C:\Windows\System\vEQHoHf.exe
  C:\Windows\System\vEQHoHf.exe
  2⤵
  PID:8092
- C:\Windows\System\REivdhr.exe
  C:\Windows\System\REivdhr.exe
  2⤵
  PID:8208
- C:\Windows\System\jaboJvh.exe
  C:\Windows\System\jaboJvh.exe
  2⤵
  PID:8224
- C:\Windows\System\XNTLXLS.exe
  C:\Windows\System\XNTLXLS.exe
  2⤵
  PID:8240
- C:\Windows\System\RrByPhb.exe
  C:\Windows\System\RrByPhb.exe
  2⤵
  PID:8272
- C:\Windows\System\sdDimXk.exe
  C:\Windows\System\sdDimXk.exe
  2⤵
  PID:8292
- C:\Windows\System\dHdjaoK.exe
  C:\Windows\System\dHdjaoK.exe
  2⤵
  PID:8308
- C:\Windows\System\aOVApbu.exe
  C:\Windows\System\aOVApbu.exe
  2⤵
  PID:8324
- C:\Windows\System\FIvYQuv.exe
  C:\Windows\System\FIvYQuv.exe
  2⤵
  PID:8396
- C:\Windows\System\MdrgXFN.exe
  C:\Windows\System\MdrgXFN.exe
  2⤵
  PID:8412
- C:\Windows\System\YEYXokF.exe
  C:\Windows\System\YEYXokF.exe
  2⤵
  PID:8476
- C:\Windows\System\zZyUEfm.exe
  C:\Windows\System\zZyUEfm.exe
  2⤵
  PID:8492
- C:\Windows\System\fQxKKsO.exe
  C:\Windows\System\fQxKKsO.exe
  2⤵
  PID:8508
- C:\Windows\System\QzrbZAI.exe
  C:\Windows\System\QzrbZAI.exe
  2⤵
  PID:8524
- C:\Windows\System\UWIacjZ.exe
  C:\Windows\System\UWIacjZ.exe
  2⤵
  PID:8540
- C:\Windows\System\OosGWoA.exe
  C:\Windows\System\OosGWoA.exe
  2⤵
  PID:8576
- C:\Windows\System\FwnRdJT.exe
  C:\Windows\System\FwnRdJT.exe
  2⤵
  PID:8592
- C:\Windows\System\dpzDAvF.exe
  C:\Windows\System\dpzDAvF.exe
  2⤵
  PID:8608
- C:\Windows\System\hCgVLbO.exe
  C:\Windows\System\hCgVLbO.exe
  2⤵
  PID:8628
- C:\Windows\System\mbFHaRM.exe
  C:\Windows\System\mbFHaRM.exe
  2⤵
  PID:8644
- C:\Windows\System\XIQPrse.exe
  C:\Windows\System\XIQPrse.exe
  2⤵
  PID:8668
- C:\Windows\System\FUebPJD.exe
  C:\Windows\System\FUebPJD.exe
  2⤵
  PID:8684
- C:\Windows\System\JXxbCvz.exe
  C:\Windows\System\JXxbCvz.exe
  2⤵
  PID:8700
- C:\Windows\System\SemEzND.exe
  C:\Windows\System\SemEzND.exe
  2⤵
  PID:8716
- C:\Windows\System\MMUQEJK.exe
  C:\Windows\System\MMUQEJK.exe
  2⤵
  PID:8732
- C:\Windows\System\drMVPjl.exe
  C:\Windows\System\drMVPjl.exe
  2⤵
  PID:8748
- C:\Windows\System\OtlsqKv.exe
  C:\Windows\System\OtlsqKv.exe
  2⤵
  PID:8764
- C:\Windows\System\ripDXvN.exe
  C:\Windows\System\ripDXvN.exe
  2⤵
  PID:8784
- C:\Windows\System\WpQkfyt.exe
  C:\Windows\System\WpQkfyt.exe
  2⤵
  PID:8800
- C:\Windows\System\zOMfdyO.exe
  C:\Windows\System\zOMfdyO.exe
  2⤵
  PID:8824
- C:\Windows\System\aWsAnaP.exe
  C:\Windows\System\aWsAnaP.exe
  2⤵
  PID:8844
- C:\Windows\System\XFbatXr.exe
  C:\Windows\System\XFbatXr.exe
  2⤵
  PID:8860
- C:\Windows\System\xAJrpex.exe
  C:\Windows\System\xAJrpex.exe
  2⤵
  PID:8876
- C:\Windows\System\XNmyteB.exe
  C:\Windows\System\XNmyteB.exe
  2⤵
  PID:8892
- C:\Windows\System\ZisPCmt.exe
  C:\Windows\System\ZisPCmt.exe
  2⤵
  PID:8912
- C:\Windows\System\cKRXlBB.exe
  C:\Windows\System\cKRXlBB.exe
  2⤵
  PID:8928
- C:\Windows\System\aQrxxPE.exe
  C:\Windows\System\aQrxxPE.exe
  2⤵
  PID:8944
- C:\Windows\System\WJdWcwy.exe
  C:\Windows\System\WJdWcwy.exe
  2⤵
  PID:8964
- C:\Windows\System\OXDCCeb.exe
  C:\Windows\System\OXDCCeb.exe
  2⤵
  PID:8984
- C:\Windows\System\pkaLhDk.exe
  C:\Windows\System\pkaLhDk.exe
  2⤵
  PID:9000
- C:\Windows\System\PSMXtZN.exe
  C:\Windows\System\PSMXtZN.exe
  2⤵
  PID:9016
- C:\Windows\System\MendSuP.exe
  C:\Windows\System\MendSuP.exe
  2⤵
  PID:9032
- C:\Windows\System\NkHeASn.exe
  C:\Windows\System\NkHeASn.exe
  2⤵
  PID:9048
- C:\Windows\System\VQrVpoL.exe
  C:\Windows\System\VQrVpoL.exe
  2⤵
  PID:9064
- C:\Windows\System\qqIAOEt.exe
  C:\Windows\System\qqIAOEt.exe
  2⤵
  PID:9080
- C:\Windows\System\rQKsSbX.exe
  C:\Windows\System\rQKsSbX.exe
  2⤵
  PID:9096
- C:\Windows\System\DIMvMUO.exe
  C:\Windows\System\DIMvMUO.exe
  2⤵
  PID:9112
- C:\Windows\System\gaDEhQN.exe
  C:\Windows\System\gaDEhQN.exe
  2⤵
  PID:9132
- C:\Windows\System\TbuEbuF.exe
  C:\Windows\System\TbuEbuF.exe
  2⤵
  PID:9148
- C:\Windows\System\vdnKdbB.exe
  C:\Windows\System\vdnKdbB.exe
  2⤵
  PID:9164
- C:\Windows\System\ZigSvCi.exe
  C:\Windows\System\ZigSvCi.exe
  2⤵
  PID:9180
- C:\Windows\System\xxbTrAy.exe
  C:\Windows\System\xxbTrAy.exe
  2⤵
  PID:9196
- C:\Windows\System\clWIRph.exe
  C:\Windows\System\clWIRph.exe
  2⤵
  PID:9212
- C:\Windows\System\FNZwvWD.exe
  C:\Windows\System\FNZwvWD.exe
  2⤵
  PID:7752
- C:\Windows\System\kVrIIKK.exe
  C:\Windows\System\kVrIIKK.exe
  2⤵
  PID:7980
- C:\Windows\System\hOaJGHn.exe
  C:\Windows\System\hOaJGHn.exe
  2⤵
  PID:8236
- C:\Windows\System\zwgQlmB.exe
  C:\Windows\System\zwgQlmB.exe
  2⤵
  PID:8320
- C:\Windows\System\vhwszMa.exe
  C:\Windows\System\vhwszMa.exe
  2⤵
  PID:8252
- C:\Windows\System\JvOeoOJ.exe
  C:\Windows\System\JvOeoOJ.exe
  2⤵
  PID:8060
- C:\Windows\System\moNqWCz.exe
  C:\Windows\System\moNqWCz.exe
  2⤵
  PID:7732
- C:\Windows\System\TkdopWd.exe
  C:\Windows\System\TkdopWd.exe
  2⤵
  PID:7232
- C:\Windows\System\LxWJfGp.exe
  C:\Windows\System\LxWJfGp.exe
  2⤵
  PID:8268
- C:\Windows\System\MOMajpU.exe
  C:\Windows\System\MOMajpU.exe
  2⤵
  PID:8336
- C:\Windows\System\OQPKdvn.exe
  C:\Windows\System\OQPKdvn.exe
  2⤵
  PID:8352
- C:\Windows\System\QrihprB.exe
  C:\Windows\System\QrihprB.exe
  2⤵
  PID:8172
- C:\Windows\System\SIUWvRg.exe
  C:\Windows\System\SIUWvRg.exe
  2⤵
  PID:7172
- C:\Windows\System\riJZnwY.exe
  C:\Windows\System\riJZnwY.exe
  2⤵
  PID:7540
- C:\Windows\System\YVxDDbX.exe
  C:\Windows\System\YVxDDbX.exe
  2⤵
  PID:8000
- C:\Windows\System\MhZpxVi.exe
  C:\Windows\System\MhZpxVi.exe
  2⤵
  PID:8200
- C:\Windows\System\VwtTkuu.exe
  C:\Windows\System\VwtTkuu.exe
  2⤵
  PID:8364
- C:\Windows\System\VvDneny.exe
  C:\Windows\System\VvDneny.exe
  2⤵
  PID:8380
- C:\Windows\System\mpwmvtB.exe
  C:\Windows\System\mpwmvtB.exe
  2⤵
  PID:8408
- C:\Windows\System\EcDNMzd.exe
  C:\Windows\System\EcDNMzd.exe
  2⤵
  PID:8448
- C:\Windows\System\DSpzAmM.exe
  C:\Windows\System\DSpzAmM.exe
  2⤵
  PID:8520
- C:\Windows\System\NGoKTrU.exe
  C:\Windows\System\NGoKTrU.exe
  2⤵
  PID:8464
- C:\Windows\System\NERJxlK.exe
  C:\Windows\System\NERJxlK.exe
  2⤵
  PID:8532
- C:\Windows\System\rsMeBlN.exe
  C:\Windows\System\rsMeBlN.exe
  2⤵
  PID:8556
- C:\Windows\System\QGTVmFf.exe
  C:\Windows\System\QGTVmFf.exe
  2⤵
  PID:8560
- C:\Windows\System\zeUqzvh.exe
  C:\Windows\System\zeUqzvh.exe
  2⤵
  PID:8452
- C:\Windows\System\qBmVJjf.exe
  C:\Windows\System\qBmVJjf.exe
  2⤵
  PID:8616
- C:\Windows\System\skXeBUr.exe
  C:\Windows\System\skXeBUr.exe
  2⤵
  PID:8656
- C:\Windows\System\REPDGFt.exe
  C:\Windows\System\REPDGFt.exe
  2⤵
  PID:8680
- C:\Windows\System\QtdYlyD.exe
  C:\Windows\System\QtdYlyD.exe
  2⤵
  PID:8744
- C:\Windows\System\GnVSxVU.exe
  C:\Windows\System\GnVSxVU.exe
  2⤵
  PID:8808
- C:\Windows\System\cYuiasv.exe
  C:\Windows\System\cYuiasv.exe
  2⤵
  PID:8692
- C:\Windows\System\YEOwbDu.exe
  C:\Windows\System\YEOwbDu.exe
  2⤵
  PID:8728
- C:\Windows\System\zvcRPHI.exe
  C:\Windows\System\zvcRPHI.exe
  2⤵
  PID:8836
- C:\Windows\System\nrONezC.exe
  C:\Windows\System\nrONezC.exe
  2⤵
  PID:8872
- C:\Windows\System\KDvhIzo.exe
  C:\Windows\System\KDvhIzo.exe
  2⤵
  PID:8936
- C:\Windows\System\tJoCEaw.exe
  C:\Windows\System\tJoCEaw.exe
  2⤵
  PID:9060
- C:\Windows\System\wdvLPFH.exe
  C:\Windows\System\wdvLPFH.exe
  2⤵
  PID:8980
- C:\Windows\System\ekoSeHy.exe
  C:\Windows\System\ekoSeHy.exe
  2⤵
  PID:9044
- C:\Windows\System\twBGZFk.exe
  C:\Windows\System\twBGZFk.exe
  2⤵
  PID:9128
- C:\Windows\System\ffXBafM.exe
  C:\Windows\System\ffXBafM.exe
  2⤵
  PID:9160
- C:\Windows\System\uoglHsH.exe
  C:\Windows\System\uoglHsH.exe
  2⤵
  PID:9104
- C:\Windows\System\ErMrERe.exe
  C:\Windows\System\ErMrERe.exe
  2⤵
  PID:7492
- C:\Windows\System\cecpXiG.exe
  C:\Windows\System\cecpXiG.exe
  2⤵
  PID:8232
- C:\Windows\System\gmWOoIG.exe
  C:\Windows\System\gmWOoIG.exe
  2⤵
  PID:7344
- C:\Windows\System\tzFpRJG.exe
  C:\Windows\System\tzFpRJG.exe
  2⤵
  PID:8288
- C:\Windows\System\cxkIQBh.exe
  C:\Windows\System\cxkIQBh.exe
  2⤵
  PID:7928
- C:\Windows\System\PMcvWSU.exe
  C:\Windows\System\PMcvWSU.exe
  2⤵
  PID:8348
- C:\Windows\System\ikdfJfu.exe
  C:\Windows\System\ikdfJfu.exe
  2⤵
  PID:7224
- C:\Windows\System\vlAHgHD.exe
  C:\Windows\System\vlAHgHD.exe
  2⤵
  PID:8420
- C:\Windows\System\NYvtzXX.exe
  C:\Windows\System\NYvtzXX.exe
  2⤵
  PID:8600
- C:\Windows\System\TkbGixP.exe
  C:\Windows\System\TkbGixP.exe
  2⤵
  PID:8676
- C:\Windows\System\FqJmGnP.exe
  C:\Windows\System\FqJmGnP.exe
  2⤵
  PID:8724
- C:\Windows\System\YEYPOgY.exe
  C:\Windows\System\YEYPOgY.exe
  2⤵
  PID:8424
- C:\Windows\System\XMUvnID.exe
  C:\Windows\System\XMUvnID.exe
  2⤵
  PID:8636
- C:\Windows\System\KbNdSqg.exe
  C:\Windows\System\KbNdSqg.exe
  2⤵
  PID:7136
- C:\Windows\System\gZyQoTN.exe
  C:\Windows\System\gZyQoTN.exe
  2⤵
  PID:8812
- C:\Windows\System\kHBzLFF.exe
  C:\Windows\System\kHBzLFF.exe
  2⤵
  PID:8792
- C:\Windows\System\iKdZyTO.exe
  C:\Windows\System\iKdZyTO.exe
  2⤵
  PID:8840
- C:\Windows\System\QGLRnSA.exe
  C:\Windows\System\QGLRnSA.exe
  2⤵
  PID:8924
- C:\Windows\System\vMJfoGE.exe
  C:\Windows\System\vMJfoGE.exe
  2⤵
  PID:7944
- C:\Windows\System\sefONnm.exe
  C:\Windows\System\sefONnm.exe
  2⤵
  PID:8344
- C:\Windows\System\AtEbNwU.exe
  C:\Windows\System\AtEbNwU.exe
  2⤵
  PID:8388
- C:\Windows\System\rPQukdP.exe
  C:\Windows\System\rPQukdP.exe
  2⤵
  PID:7616
- C:\Windows\System\bteQLQB.exe
  C:\Windows\System\bteQLQB.exe
  2⤵
  PID:8376
- C:\Windows\System\ybIobOn.exe
  C:\Windows\System\ybIobOn.exe
  2⤵
  PID:8572
- C:\Windows\System\yXQraSp.exe
  C:\Windows\System\yXQraSp.exe
  2⤵
  PID:8604
- C:\Windows\System\NYZzrGv.exe
  C:\Windows\System\NYZzrGv.exe
  2⤵
  PID:8488
- C:\Windows\System\smBsrIi.exe
  C:\Windows\System\smBsrIi.exe
  2⤵
  PID:8820
- C:\Windows\System\VawEkIT.exe
  C:\Windows\System\VawEkIT.exe
  2⤵
  PID:8888
- C:\Windows\System\ybDyCld.exe
  C:\Windows\System\ybDyCld.exe
  2⤵
  PID:8760
- C:\Windows\System\KEVCcnC.exe
  C:\Windows\System\KEVCcnC.exe
  2⤵
  PID:8976
- C:\Windows\System\zbwBWmn.exe
  C:\Windows\System\zbwBWmn.exe
  2⤵
  PID:9144
- C:\Windows\System\OAFvafL.exe
  C:\Windows\System\OAFvafL.exe
  2⤵
  PID:8216
- C:\Windows\System\xoMBbRD.exe
  C:\Windows\System\xoMBbRD.exe
  2⤵
  PID:8384
- C:\Windows\System\aVzSqkw.exe
  C:\Windows\System\aVzSqkw.exe
  2⤵
  PID:7556
- C:\Windows\System\LRmyXgc.exe
  C:\Windows\System\LRmyXgc.exe
  2⤵
  PID:7360
- C:\Windows\System\HTgIDJJ.exe
  C:\Windows\System\HTgIDJJ.exe
  2⤵
  PID:8140
- C:\Windows\System\XoKgqUK.exe
  C:\Windows\System\XoKgqUK.exe
  2⤵
  PID:8640
- C:\Windows\System\vUOekQo.exe
  C:\Windows\System\vUOekQo.exe
  2⤵
  PID:8392
- C:\Windows\System\IfdNlmw.exe
  C:\Windows\System\IfdNlmw.exe
  2⤵
  PID:8952
- C:\Windows\System\fznvtCa.exe
  C:\Windows\System\fznvtCa.exe
  2⤵
  PID:8920
- C:\Windows\System\CWYtamW.exe
  C:\Windows\System\CWYtamW.exe
  2⤵
  PID:9012
- C:\Windows\System\cQxGzWs.exe
  C:\Windows\System\cQxGzWs.exe
  2⤵
  PID:9108
- C:\Windows\System\mVHMjpi.exe
  C:\Windows\System\mVHMjpi.exe
  2⤵
  PID:8220
- C:\Windows\System\aBiaQcm.exe
  C:\Windows\System\aBiaQcm.exe
  2⤵
  PID:9228
- C:\Windows\System\IBKppUn.exe
  C:\Windows\System\IBKppUn.exe
  2⤵
  PID:9244
- C:\Windows\System\DlsgFhL.exe
  C:\Windows\System\DlsgFhL.exe
  2⤵
  PID:9260
- C:\Windows\System\OAnWmTW.exe
  C:\Windows\System\OAnWmTW.exe
  2⤵
  PID:9276
- C:\Windows\System\nUTmJhb.exe
  C:\Windows\System\nUTmJhb.exe
  2⤵
  PID:9292
- C:\Windows\System\bIIRFit.exe
  C:\Windows\System\bIIRFit.exe
  2⤵
  PID:9308
- C:\Windows\System\kmirBYB.exe
  C:\Windows\System\kmirBYB.exe
  2⤵
  PID:9340
- C:\Windows\System\oBjJKOz.exe
  C:\Windows\System\oBjJKOz.exe
  2⤵
  PID:9372
- C:\Windows\System\jWydIln.exe
  C:\Windows\System\jWydIln.exe
  2⤵
  PID:9396
- C:\Windows\System\LnUCINo.exe
  C:\Windows\System\LnUCINo.exe
  2⤵
  PID:9420
- C:\Windows\System\pWMIEoe.exe
  C:\Windows\System\pWMIEoe.exe
  2⤵
  PID:9436
- C:\Windows\System\KAgsTqH.exe
  C:\Windows\System\KAgsTqH.exe
  2⤵
  PID:9456
- C:\Windows\System\KaJHwla.exe
  C:\Windows\System\KaJHwla.exe
  2⤵
  PID:9472
- C:\Windows\System\wUeQnoQ.exe
  C:\Windows\System\wUeQnoQ.exe
  2⤵
  PID:9488
- C:\Windows\System\NVkmXCm.exe
  C:\Windows\System\NVkmXCm.exe
  2⤵
  PID:9524
- C:\Windows\System\kcaSvNF.exe
  C:\Windows\System\kcaSvNF.exe
  2⤵
  PID:9544
- C:\Windows\System\vvysTvr.exe
  C:\Windows\System\vvysTvr.exe
  2⤵
  PID:9560
- C:\Windows\System\fNqkoAr.exe
  C:\Windows\System\fNqkoAr.exe
  2⤵
  PID:9576
- C:\Windows\System\kUnZwvI.exe
  C:\Windows\System\kUnZwvI.exe
  2⤵
  PID:9592
- C:\Windows\System\UaxGuWe.exe
  C:\Windows\System\UaxGuWe.exe
  2⤵
  PID:9612
- C:\Windows\System\rpOCyft.exe
  C:\Windows\System\rpOCyft.exe
  2⤵
  PID:9628
- C:\Windows\System\UlOmZun.exe
  C:\Windows\System\UlOmZun.exe
  2⤵
  PID:9644
- C:\Windows\System\BPuWEQY.exe
  C:\Windows\System\BPuWEQY.exe
  2⤵
  PID:9672
- C:\Windows\System\MDPXJlJ.exe
  C:\Windows\System\MDPXJlJ.exe
  2⤵
  PID:9688
- C:\Windows\System\lkmqiHf.exe
  C:\Windows\System\lkmqiHf.exe
  2⤵
  PID:9704
- C:\Windows\System\mUCIYrV.exe
  C:\Windows\System\mUCIYrV.exe
  2⤵
  PID:9720
- C:\Windows\System\ECFTQxn.exe
  C:\Windows\System\ECFTQxn.exe
  2⤵
  PID:9736
- C:\Windows\System\ACnVXXz.exe
  C:\Windows\System\ACnVXXz.exe
  2⤵
  PID:9752
- C:\Windows\System\SWUBcQU.exe
  C:\Windows\System\SWUBcQU.exe
  2⤵
  PID:9768
- C:\Windows\System\YhGtjWn.exe
  C:\Windows\System\YhGtjWn.exe
  2⤵
  PID:9784
- C:\Windows\System\IyRFPKL.exe
  C:\Windows\System\IyRFPKL.exe
  2⤵
  PID:9800
- C:\Windows\System\CfreziD.exe
  C:\Windows\System\CfreziD.exe
  2⤵
  PID:9840
- C:\Windows\System\OGeTOGH.exe
  C:\Windows\System\OGeTOGH.exe
  2⤵
  PID:9856
- C:\Windows\System\LnVeRWM.exe
  C:\Windows\System\LnVeRWM.exe
  2⤵
  PID:9872
- C:\Windows\System\ZcvAeQR.exe
  C:\Windows\System\ZcvAeQR.exe
  2⤵
  PID:9888
- C:\Windows\System\qUVAvTt.exe
  C:\Windows\System\qUVAvTt.exe
  2⤵
  PID:9908
- C:\Windows\System\sNGXNHh.exe
  C:\Windows\System\sNGXNHh.exe
  2⤵
  PID:9924
- C:\Windows\System\wDYlaFl.exe
  C:\Windows\System\wDYlaFl.exe
  2⤵
  PID:9944
- C:\Windows\System\gEDhTPs.exe
  C:\Windows\System\gEDhTPs.exe
  2⤵
  PID:9980
- C:\Windows\System\ClQOUJe.exe
  C:\Windows\System\ClQOUJe.exe
  2⤵
  PID:10004
- C:\Windows\System\jTCIFnB.exe
  C:\Windows\System\jTCIFnB.exe
  2⤵
  PID:10020
- C:\Windows\System\kdMPwJC.exe
  C:\Windows\System\kdMPwJC.exe
  2⤵
  PID:10036
- C:\Windows\System\eXaTgdw.exe
  C:\Windows\System\eXaTgdw.exe
  2⤵
  PID:10052
- C:\Windows\System\vJBwzYA.exe
  C:\Windows\System\vJBwzYA.exe
  2⤵
  PID:10080
- C:\Windows\System\mMxrqGl.exe
  C:\Windows\System\mMxrqGl.exe
  2⤵
  PID:10096
- C:\Windows\System\aePjgpL.exe
  C:\Windows\System\aePjgpL.exe
  2⤵
  PID:10112
- C:\Windows\System\mQqeIbZ.exe
  C:\Windows\System\mQqeIbZ.exe
  2⤵
  PID:10132
- C:\Windows\System\EnSPZCh.exe
  C:\Windows\System\EnSPZCh.exe
  2⤵
  PID:10148
- C:\Windows\System\VFDwiKL.exe
  C:\Windows\System\VFDwiKL.exe
  2⤵
  PID:10164
- C:\Windows\System\MOEzuRP.exe
  C:\Windows\System\MOEzuRP.exe
  2⤵
  PID:10180
- C:\Windows\System\NltLsye.exe
  C:\Windows\System\NltLsye.exe
  2⤵
  PID:10196
- C:\Windows\System\NMONkDG.exe
  C:\Windows\System\NMONkDG.exe
  2⤵
  PID:10212
- C:\Windows\System\SVVdZfa.exe
  C:\Windows\System\SVVdZfa.exe
  2⤵
  PID:10232
- C:\Windows\System\HlOLzSi.exe
  C:\Windows\System\HlOLzSi.exe
  2⤵
  PID:9028
- C:\Windows\System\aSisjiI.exe
  C:\Windows\System\aSisjiI.exe
  2⤵
  PID:9284
- C:\Windows\System\AcZZJuT.exe
  C:\Windows\System\AcZZJuT.exe
  2⤵
  PID:9328
- C:\Windows\System\yiEatow.exe
  C:\Windows\System\yiEatow.exe
  2⤵
  PID:8908
- C:\Windows\System\cxOxNaA.exe
  C:\Windows\System\cxOxNaA.exe
  2⤵
  PID:9316
- C:\Windows\System\ypkhJSI.exe
  C:\Windows\System\ypkhJSI.exe
  2⤵
  PID:9304
- C:\Windows\System\xpJOGDT.exe
  C:\Windows\System\xpJOGDT.exe
  2⤵
  PID:9360
- C:\Windows\System\axGfjer.exe
  C:\Windows\System\axGfjer.exe
  2⤵
  PID:9412
- C:\Windows\System\RjdSbDW.exe
  C:\Windows\System\RjdSbDW.exe
  2⤵
  PID:9448
- C:\Windows\System\qAmbqGw.exe
  C:\Windows\System\qAmbqGw.exe
  2⤵
  PID:9540
- C:\Windows\System\dsCLPYG.exe
  C:\Windows\System\dsCLPYG.exe
  2⤵
  PID:9572
- C:\Windows\System\qVkdLBy.exe
  C:\Windows\System\qVkdLBy.exe
  2⤵
  PID:9636
- C:\Windows\System\letmVUA.exe
  C:\Windows\System\letmVUA.exe
  2⤵
  PID:9620
- C:\Windows\System\yzkkrgI.exe
  C:\Windows\System\yzkkrgI.exe
  2⤵
  PID:9392
- C:\Windows\System\dphQKyy.exe
  C:\Windows\System\dphQKyy.exe
  2⤵
  PID:9432
- C:\Windows\System\uytXHMA.exe
  C:\Windows\System\uytXHMA.exe
  2⤵
  PID:9504
- C:\Windows\System\bXXEnHy.exe
  C:\Windows\System\bXXEnHy.exe
  2⤵
  PID:9552
- C:\Windows\System\bUTgZuL.exe
  C:\Windows\System\bUTgZuL.exe
  2⤵
  PID:9780
- C:\Windows\System\YmcBDmp.exe
  C:\Windows\System\YmcBDmp.exe
  2⤵
  PID:9660
- C:\Windows\System\FDEUtSt.exe
  C:\Windows\System\FDEUtSt.exe
  2⤵
  PID:9764
- C:\Windows\System\iepGefB.exe
  C:\Windows\System\iepGefB.exe
  2⤵
  PID:9816
- C:\Windows\System\CozQLLE.exe
  C:\Windows\System\CozQLLE.exe
  2⤵
  PID:9864
- C:\Windows\System\kzplHyI.exe
  C:\Windows\System\kzplHyI.exe
  2⤵
  PID:9904
- C:\Windows\System\CcIJFow.exe
  C:\Windows\System\CcIJFow.exe
  2⤵
  PID:9988
- C:\Windows\System\wjzlxZh.exe
  C:\Windows\System\wjzlxZh.exe
  2⤵
  PID:10032
- C:\Windows\System\qioPOqh.exe
  C:\Windows\System\qioPOqh.exe
  2⤵
  PID:10072
- C:\Windows\System\iDIvwnd.exe
  C:\Windows\System\iDIvwnd.exe
  2⤵
  PID:10172
- C:\Windows\System\ZNtgAFB.exe
  C:\Windows\System\ZNtgAFB.exe
  2⤵
  PID:9072
- C:\Windows\System\ZaeDyDy.exe
  C:\Windows\System\ZaeDyDy.exe
  2⤵
  PID:9040
- C:\Windows\System\StFjpkk.exe
  C:\Windows\System\StFjpkk.exe
  2⤵
  PID:10048
- C:\Windows\System\rxKESlF.exe
  C:\Windows\System\rxKESlF.exe
  2⤵
  PID:9288
- C:\Windows\System\JWrvpnz.exe
  C:\Windows\System\JWrvpnz.exe
  2⤵
  PID:8500
- C:\Windows\System\cBkLnPg.exe
  C:\Windows\System\cBkLnPg.exe
  2⤵
  PID:10092
- C:\Windows\System\skLUMDC.exe
  C:\Windows\System\skLUMDC.exe
  2⤵
  PID:10192
- C:\Windows\System\pSYLklO.exe
  C:\Windows\System\pSYLklO.exe
  2⤵
  PID:10220
- C:\Windows\System\oHoNwUy.exe
  C:\Windows\System\oHoNwUy.exe
  2⤵
  PID:8516
- C:\Windows\System\hhbhDuD.exe
  C:\Windows\System\hhbhDuD.exe
  2⤵
  PID:9220
- C:\Windows\System\pxHefTx.exe
  C:\Windows\System\pxHefTx.exe
  2⤵
  PID:9236
- C:\Windows\System\foTqLEM.exe
  C:\Windows\System\foTqLEM.exe
  2⤵
  PID:9452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AyBnjwL.exe

Filesize
2.0MB

MD5
3043c81962ee732a114b5e9fb3b0a527

SHA1
c88e71ff7552e6e526c9dc843446b9e77c152ca7

SHA256
044f2d8b7f6173df6d9ba77d6ed35ee52d6973f8ae865dcffe6342c7977578d3

SHA512
c36c193dddc509147f6e5c5377c359717dd3271dcd91da57a357280bcfce75ced97d2cbfe7aa56397b15470987875730f4c8cda9f8c2b52917b5ac32465b5503

Download Submit
C:\Windows\system\CZiNWzG.exe

Filesize
2.0MB

MD5
dc77621f17b771a279f20d5ed53f4c70

SHA1
93848bb57db171e3370d80bc5fa73a79ada3e217

SHA256
eac2bd7ccdf7f8986c0fe00c43764d841fc75633d94446f3af1272d34dc21bb2

SHA512
90d68be063d4cabc3279fb7ae0f4822dc921408f9aadb5adb78995572f5900842d8a247f55bbc1937c517122d432160d3b4b511855a9379eaa98dbf4618677fe

Download Submit
C:\Windows\system\GGMldLe.exe

Filesize
2.0MB

MD5
27652c41dca901d1510c3846d65cc066

SHA1
a6e131bd203c6f3b4c16c3e77303f300017b29bc

SHA256
3ef7f7a427952420e6ab90cc1da18359197b9e94c67a8b9d85b29ad770372f80

SHA512
a0060e1482aa608f3bfa192c9eae65c134936ce036f5a5676c50625ccf8f2d7026c31f9ff41601dd1f0f0fceb5e162b3b5035c077271429ab28563039b3b5c74

Download Submit
C:\Windows\system\LHSjzWc.exe

Filesize
2.0MB

MD5
0f7f73f857604a8ee235e340f5ba695c

SHA1
d6ba560f86b3d632b696bedb93ad12ca218819a0

SHA256
90f042038ec81d178e48498d30ab59db5719c4eeb0fb8d56445e3b383ae3673d

SHA512
c21de83b3104170cc0d4d2247f6b890b582b48128341f1ae8ad9fb92d2af16cf2a4bd03b82726c5f95b58c804c1b39784d21d1c900ad08d4e2fb166e22ba9acd

Download Submit
C:\Windows\system\MYTcUYe.exe

Filesize
2.0MB

MD5
d2841d07e2172cb34c2c119e94e34b4b

SHA1
850f970f03cf80f3171f17e7cb32109a91d7e156

SHA256
3e28fccc2ee00a771623f936a7e29e28975622282a1e62c8f06e85b8e2740d8b

SHA512
0fe309644dd115317a906dba5cfb8d9b4ce9265e04ed39bfa3ffcd92fe99e2ee3ec20e31062f1576340a948acba0959621e9e8d1bdc92af6ae758358c29f418d

Download Submit
C:\Windows\system\OynjFhW.exe

Filesize
2.0MB

MD5
17615e8a66cd3bc17ca296e7557d4978

SHA1
fcc6036797e1025d281dca70ba754a2650c9c8ca

SHA256
1e2467294ba91153a2c3671126606c479f502b69ef13b86de6f5ba2f33786442

SHA512
34ffb1dbf356bdad770a52972b4fb687286468180d0c9d55478680971939d4e33068e4d2910101d55d6fb8483f0a6b681401762796e10e67256fa9ab1dea4cde

Download Submit
C:\Windows\system\PtnuYta.exe

Filesize
2.0MB

MD5
8550994f16f3b0e5ed07ad1f87c70438

SHA1
39699cc6d9ef9a23fd07359a7fac341cde8f5a1f

SHA256
fe8f9fd53cf387a3b3f7e83f0c6f5b1a3673ce9873111a81415673d3a45343ff

SHA512
a5a1f39cc91a0b74d3070a71fd154b4713eae6edd43ec5c31145cd046d2c76d7a60695e60f2bf9c1b57f42a6524688442b5e1db8f9f6af3635fa2c4a9d65ab78

Download Submit
C:\Windows\system\SCAIpuw.exe

Filesize
2.0MB

MD5
ffe451a384e2f753bb329b23b0cda4fa

SHA1
2280471261cc236048be05bd3559f4427fbc82cc

SHA256
e734c16c024c790ac0b0b2dc0c3d0da78e4cfab85dc7bafcdeb4437f742fbcd2

SHA512
452c66b04988a8b69d147e02b0f4baead4d0428b890eb57ac3af3d843e165b4d34ea367ecf8bcc1e7f2ebbf6a023521d9c29816764cbcf1669331c3d3620933b

Download Submit
C:\Windows\system\UlTxjSt.exe

Filesize
2.0MB

MD5
20ef7c11eaa3d159cea0b4a33952e423

SHA1
151aa0eec1af806ad931ab2ebe93868bed63566b

SHA256
b46c6330ea3284dd781e7ce799171520365b396e8d7b443348ffc8272a6b73ad

SHA512
8c9bd110737e30792e42b5d1a49527de2ffa74e6bc9c46d4913c2584301b794a3c8bf29cdf5f4691302d6d7f854b87593458ab344b5130bd55c4ca888fae2c1d

Download Submit
C:\Windows\system\WDPTUCm.exe

Filesize
2.0MB

MD5
020cd1b14b845e95ee36ee0547fb1763

SHA1
7a67688811328b6744397a84a579986cbdeb38b2

SHA256
626d1bbb080c3681da97d97fc6a06a5c0a552458741c9c668bb5ddeac47af01c

SHA512
edbddf5d50be3b1c8a961d6f5b828e9833a26f801848989c8dc3e57dec335c28cb4ae6aecdd3cd4a49e723cafc754c46b05ea2ff61f7ac8240497a963dbc0fd2

Download Submit
C:\Windows\system\XTlZUXJ.exe

Filesize
2.0MB

MD5
847f084cd5bd47b64522b10c30e0fcbe

SHA1
eb61f881844c007b4f2807fa476c108288d55419

SHA256
974b7edb99cd4c165176b176c359688b1f5d03123f1d0cfaac60286cc6512c3d

SHA512
79baa4874c79b3dfa9d45a4f83e6ee08560498d1f6a24d0dbf3c52e289954a6d157ccd1b256d735e685d3d315272dcc466b3a328681a5d7bf131b0bbb211bac4

Download Submit
C:\Windows\system\kWnmYxl.exe

Filesize
2.0MB

MD5
e14472da65f43bc5658251a0f411d21e

SHA1
b2ac7b6d01a6b49fb96c37a281f1a85178d3693a

SHA256
0a5b5d6423fef822c8fec2ef8e3cf3a4141c381ac61412d68b4db74ce10c0c1e

SHA512
832bd8ba6415c91ee00dc5aee050b8f0c0f7ef66bc0eea54a05756be46485429b47a6a40e910086bdf3fdbc75d0a89a1d6051b3ea9380b2b03cf90865cfaeb1d

Download Submit
C:\Windows\system\kZYdExh.exe

Filesize
2.0MB

MD5
580bf72bd83854583f2f39704ac94e82

SHA1
72755f89d45ed6eb2837258efdf21115d6a70c3a

SHA256
f76023c63a842f8ad3027d9f456cc4dcc347dd1a5b413e5db4765c15b87ce73c

SHA512
27f11a539bd71cfdafe7725f17c02524af607c9c9607fd582c7e9f6a256cecf2a52d21c98583d860f7d90bd6b84f422dd2db93e7ebab1eac84d923960f76335b

Download Submit
C:\Windows\system\rDRZKzg.exe

Filesize
2.0MB

MD5
aacc1bd565dbf8094b10f718199b2f1c

SHA1
8814d749aa65742a222c6f8600985a39bb47d771

SHA256
a43627cab18f8d188c58838bfcf4aa069b56af3856b5381552006d1ed90ebd50

SHA512
add672ea8d29c7498640aa7261eb0bf65fbb53563a9c550e2691cb7ba8b1c4da23426ca83ef26bc60f46b6853100b03ad88450f6d25fd1049b0577fb1fe1dd08

Download Submit
C:\Windows\system\rLTtklW.exe

Filesize
2.0MB

MD5
c488ddc4b89e228a10510cccf95b858f

SHA1
967edb8fd7b1bf89749d7edcff81848a52e1e9dd

SHA256
93a85aa2337894978d088c5e4ac66c720e5944a51e590852d51fddd407b1ff6a

SHA512
dde5f1a01c5c4207b8158872ad9a3bbf309302732ca69af960697caf73370c71e165732c075d6f36e71ac66d9a9ab3719989eeef3b2d4bc18df22cfb43da83d7

Download Submit
C:\Windows\system\rOjApde.exe

Filesize
2.0MB

MD5
ccf1461ed143490fc744deefae4055e5

SHA1
e4fa5994748efde32430ec7f34b864f0cddbb203

SHA256
8247df0f230d8ee2ba36d49755a748e3d30692bc3186eb22e79288a20ab135b4

SHA512
a603b9357725f38f1f02e0c96a0de336d94ef34526f3c8ca8d0c39f02de50a3d49d0755941ef636080895179a6f6015e667f21dc5a1aa921827642b3ac19f74f

Download Submit
C:\Windows\system\uUxyBVm.exe

Filesize
2.0MB

MD5
076995342eb3ed01461090836f3acf79

SHA1
4c96140291fac4722cef3037b5cf8fcc4f672dc9

SHA256
215891a88eb2233e0230f3e65ce4bb54438c0b724bc3aa8c09d63560e20cd45c

SHA512
832d4b7d2f15b78f9c8d5a8f6eb7ccf7970a55a24af6242cbe8c6bb296a63905e2b8975c11afe0f59045482787ac2f0deb4f4a6d65241b8167cb0b4bc2602421

Download Submit
C:\Windows\system\wyNARDl.exe

Filesize
2.0MB

MD5
dcde0c9079931e1d90511696a4e2f32c

SHA1
be36d627b4df616f1c7e75ff16b9faf99dcc46d5

SHA256
1720453ba8da68d1f404d1c20f11f8d22dc98a064706872865acade23e5c0430

SHA512
05db6105ddd606dca446550ece4c079be97d93bed00b18ffe1a3fea44648e11b112ef76976d7b349e084ed2079e4e45ca34d629ec67137852e82c40f7b3d96c5

Download Submit
C:\Windows\system\yZPBDyr.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\zLAUlHh.exe

Filesize
2.0MB

MD5
314d0ff43d6319e2ceb66a942f267fb7

SHA1
1f5d17e3d0a169f6efd606ca4a2afe0ddff27915

SHA256
b0d22cb76d988308f9b26a1f8bf0bc39302cd29544eaa276846a76561a873c31

SHA512
972209f3c219cff57ff63777a060342a1b337e535981c99ac13bd97a777bebd81abf3f7ca7dda96b7a3aee3f959149e38d9ea39eac6c83bf4f2de7a11cc490a6

Download Submit
C:\Windows\system\zlLinvG.exe

Filesize
2.0MB

MD5
ece67c8797e12528eb45ce9ca0732d8b

SHA1
0493b8584b7eea1c37e8299acf94bbd3b4dce657

SHA256
deefd12eab766e28ca7a8f341adb2b5f90d91d7cfadea9fa8e49fba502d99ed6

SHA512
c4b4e800f12bc83c057737f815b61b0ee9f3b89f5bd6ce3d92e1f8b88617f352e6fb01cb64c5577b39fdac585204896e39d1b2fadbe9fb1c7d5246873d500116

Download Submit
C:\Windows\system\zuXjamF.exe

Filesize
2.0MB

MD5
faca1b0fc2083cc9b4aaa6456c979d16

SHA1
054e92d3300aca831d48530bab9d07d723361433

SHA256
41117427756b31c7a438049a33f3218e3e7db9c2b8184eb89966e226825876d4

SHA512
599ec6921956b0bd54ef67ae325e93e100f8ed4a52e1e206b88306173fd69b8a45b428490000a64f72705ad798098309201810250afb1f5849f3a06a13336eb7

Download Submit
\Windows\system\CmOpxvf.exe

Filesize
2.0MB

MD5
8caf419255b7e112a6683fd603532b6b

SHA1
f40e23259e708bd43a5a10f7a19384fe6cebef3e

SHA256
4c9dccfb3aebcffc70315399ffde43091056e9b59fc99e292da604e0319525c3

SHA512
83ab693d62e8268fe28ad21935337f73fb07f1c5f63772630c322d95366017bf476b752001b22836fcdf91093dd2bf123ac5b00ab909d3398092f78c0391b034

Download Submit
\Windows\system\IJIHPgB.exe

Filesize
2.0MB

MD5
180cb8458103ecec0595c01c7296c0cc

SHA1
60da30146f9b2329e0fd067b1496a272a9642db1

SHA256
e7b131609fa883d001281ef7ddce261e231ff70eeff405fa37a82d6bf2e02508

SHA512
763ef7ee46c8e9f67e85b717a7a3d101120743325b4c9f489f50965ff2cd4d1c877a8d98e9132b22ea685dac74dbfd9dc90f254f0c3f7b59670be62e2a7dec53

Download Submit
\Windows\system\JZLryVZ.exe

Filesize
2.0MB

MD5
5b234efcdde2217260e5f54e1392d230

SHA1
eea95e728577e6ace599e5c0ecc746d2d7a32a1e

SHA256
d98db712d65b69563d5079d425790e66546fa5095cb3390e5f069f864074357e

SHA512
0daf1c86c41be914c60c7a038bbe4021a6f75457e73accc592c911687c312c8480b15f67068fbd9d77a5534c270c23a39f3b8f937c99439ab84b87cb981cb1c7

Download Submit
\Windows\system\KVBfHEC.exe

Filesize
2.0MB

MD5
1312ea98035acd461bed506a61dc9d48

SHA1
921956356535a6da661ad347b505372345a6fffd

SHA256
ee8be51285b7c6a8be030d0421dddb2720c53ea5da11f384541af7b70fa64ffa

SHA512
696804d2572e711599bae26b34e7b1a97a48ea491578e6f5be418143e1fe0caf99953b365b491ce8806a4eff7a3495fb6aeb4e90183a88386936ae45ad8ce0be

Download Submit
\Windows\system\OdFurFX.exe

Filesize
2.0MB

MD5
5ab75ce81809bbbdd3180172600862c4

SHA1
7703fbbb2239fc93860c8750c99fd2a1e768b265

SHA256
fccf962c68ad006dc3765402f7f22211de26e5f364cad258e8774c179cf4de2d

SHA512
9f284e3c7a594bab63d7f5c7aa95bd36d5093d410c60baa1eb76fcfece56ef21fed4acaa5da7229733383df5caf8edfaa8adfff4566a1b8cd0a0dfa39884d5ee

Download Submit
\Windows\system\QjFMZmb.exe

Filesize
2.0MB

MD5
674df41ae29b0f0fcdae6745c26fe4e3

SHA1
6214fbdae5d54ec61bf88faf011ed7e312f94c53

SHA256
d5c232c4cef2efefebac6455104ba6a86c84294b41c4adbfc53f928c2bde87a6

SHA512
85741c73880bdbceae2af04cbec5b82ac64ab4ec7925eb26b3479b388f48c5070f4a0d13806b2d180707437d4d68e1e4fbd000b8f7dd6ed4aa1c8134d834690b

Download Submit
\Windows\system\SykruaT.exe

Filesize
2.0MB

MD5
47b51505b22d0c7f52ff9fc5844979fb

SHA1
71eb10f7af863496b2ead91c12c7c278000347a8

SHA256
859a56074c312ed8cbbbe442b349d1d4d32bd444114b4a0b320b1c4f7d6945d9

SHA512
a554f5ea5e56727493b5f8060a71504bb8019de333a94dae3a1491dcd94c2e70b2e9661f34391e5179715dc60dadcb3970af7f28e319a8625b3c0e08c7449aa9

Download Submit
\Windows\system\VXbpAyh.exe

Filesize
2.0MB

MD5
7ae80c7701cb8ee6fe7c3a9f90dc9c3d

SHA1
625ee37fc53bd094e759cc66e24e4e836a87e362

SHA256
db3489fcf9adccbeaad2c0abd1f1997ff232de851e79b48b88e0f2ad0ff843f6

SHA512
e2eefaed13b6bb152dedc200d6aa3297c6ef5d7efa2ddb7ebbdab4ac8367134cb2f4538325d32993ad02eb81bb8f8a6554d9fd5c1bc758fddc79e70561bedc15

Download Submit
\Windows\system\XMMiLLT.exe

Filesize
2.0MB

MD5
1f4f388f25544ce83fef7c91f635fd7e

SHA1
0a06b3b8aae5f28f9cc1d3dbebf3221ee77ab160

SHA256
bacdd0d6bc893bb1681189091536605240b1c51d4aeec7bf42264ab9d6bcc346

SHA512
5c792645db8279fb256aec768c6a2fb374d2c3edc8a4878205250ced0e53d8bc393adb4139a899ada8a2489336c8ecd54f6dce58c07697453fcaf274d832dcab

Download Submit
\Windows\system\ZomWUYs.exe

Filesize
2.0MB

MD5
423246576bf86c6b38f70c7c769bf6fd

SHA1
b95784dd525017d8d6e201b0c556ad5954731727

SHA256
f5efa6950e41339dd7f600e9931d52ea11adfa0494a47b9e790c11131065f632

SHA512
21616d9c3cafe3055052966817d79bdd52551427b1174088c641e77186c2585c56671bdea78f01a4a4ba44cdf2102013345e3384020080b6e496764b604ec2e5

Download Submit
\Windows\system\pZlPjlk.exe

Filesize
2.0MB

MD5
a307c9654c1a3d49e4ff34cf0fa5db0f

SHA1
2b57a63b96e9aeac0cee211a0bf3b908ae67b20c

SHA256
1b433475c6fe5d477a681d497f11a933341a434616592a04ce4f7c2b044f5a86

SHA512
1d1d583ee4bef05fa495c76873c6de46bd23b382c4eb9c8fb98ac989213f615defb011d8e2caec850f3e61b426ffd77ffdfde395a04e0de60206ce3770fe0fa1

Download Submit
\Windows\system\roRgdVi.exe

Filesize
2.0MB

MD5
35122fb4aa434dc505c1f76ea2279780

SHA1
18429c46fa5446b7c84817fdea54d30d66bd94de

SHA256
dd3507991096957c8229da03a6a055cc04827df76c884217c8276aba360abe8f

SHA512
61ef5a27e18cc0161db7d71b2847a62d8ffe2011a8b3415bd2f38e5063ae0655831bbb1de1c740102d62f114f8c3cc78016463a7a660863b694215ab398c1a0f

Download Submit
\Windows\system\sfPIFUV.exe

Filesize
2.0MB

MD5
5a43b1c6550593878907b2fcee584289

SHA1
9f8f06ff4fe593355a9350df0cfcc7785e758a90

SHA256
7cb0e3cae9acb4e0fdef8af3dda49fa06dbbb0414460ee8c7c2cfc53b5d817dd

SHA512
cf66236fa0c3c0b1e5d04a077a37d05938805582f3168b37a304ff2f879c996b3b9aa2c9ecff08795bb42f41afe3f6749386536cabe461e1e8064b38c469fd9d

Download Submit
memory/1656-3861-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1656-32-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2092-3862-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2092-74-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2208-78-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2208-21-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2208-8-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2208-39-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-76-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2208-2-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2208-77-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-16-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2208-91-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2208-83-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-9819-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-59-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-9814-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-95-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-93-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2208-94-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-3864-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2212-12-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2292-90-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-3859-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-115-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/2484-114-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2560-85-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2560-3858-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2592-89-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2592-3857-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2652-92-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2652-3865-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2676-3856-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2676-65-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2768-3860-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2768-88-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download