xmrig | 19850df100c21d0f04e5949156888899b012ff942340916bc5b2618b78ebf8c7

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
Size

1.9MB
MD5

2a59f2d14b19853806e8ae65daf40349
SHA1

65124e3a125b42e7b394e2226e5a6182fd668249
SHA256

19850df100c21d0f04e5949156888899b012ff942340916bc5b2618b78ebf8c7
SHA512

1376b92285ef05c2acdd4857bf37702462c04700acb5159d26f6577e9a62b93f745d8c79e5de17785108c53e3c3fe0e998932e26a1ed3b0e9919d63567a91b39
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafu:NABb

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2600-22-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2140-23-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2652-37-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2644-50-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2588-85-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2588-74-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2588-59-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/1764-15-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/1916-4640-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2040-4641-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2956-4670-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2644-4666-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2600-4654-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2524-4645-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2748-5456-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1764	etVFwJe.exe
2600	hjexwqu.exe
2140	SsnHPlC.exe
2956	KIcEHIX.exe
2652	RSJtmwZ.exe
2748	HNwWqOr.exe
2644	AHnAheX.exe
2524	mTMWHeG.exe
1916	QPoROog.exe
2040	pJjdBqA.exe
2920	pxpmATR.exe
2560	DdRvLoN.exe
2628	uTqUHSA.exe
2096	ooZihWP.exe
2160	eTAgDQz.exe
2844	UIKfyrL.exe
2900	QBTChCK.exe
2396	BgMNisx.exe
1216	pCYQFKx.exe
1796	zunVvoH.exe
3000	KSHjwXh.exe
2756	FKqebyq.exe
904	yIRMWgP.exe
544	QTUnhJy.exe
1688	NGALokm.exe
668	gLAdJJu.exe
884	KFbJYlC.exe
1084	fyIYHuw.exe
1468	vlFaWpf.exe
1000	wbNUGEL.exe
628	KguNMFX.exe
996	HXfgvUD.exe
2180	JVxkwDF.exe
2020	qRNbRqy.exe
1148	czqCTOu.exe
1208	kYJuIrS.exe
772	hbmSUXl.exe
1680	yXLGrMX.exe
1300	dsSOLfH.exe
1944	tQDbNBd.exe
896	YMQUHVu.exe
928	bCfdlUx.exe
2288	CEKCbbC.exe
1836	bRtCMgm.exe
1924	QffqpvV.exe
2976	DoqGHMT.exe
2264	flvExjX.exe
2196	paHTQPk.exe
2072	FEyYyJC.exe
1736	seYVEfZ.exe
1748	dHbWNfG.exe
2728	hpsHxyB.exe
2744	JiIpyId.exe
2804	PNEtvAT.exe
3012	oigLZXK.exe
2200	NfSYCxR.exe
1196	hbHrNiD.exe
1868	NiWyHpp.exe
2800	yRWCsYk.exe
316	aonYxtB.exe
2156	hpqJSyx.exe
572	iGUPQXX.exe
2452	NpMQOuE.exe
2268	gkmtghg.exe

Loads dropped DLL 64 IoCs

pid	Process
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2588-2-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x000d00000001226c-3.dat	upx
behavioral1/files/0x0038000000014b70-9.dat	upx
behavioral1/memory/2600-22-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2140-23-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x0007000000015679-27.dat	upx
behavioral1/memory/2652-37-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0008000000015bc7-47.dat	upx
behavioral1/files/0x0008000000015f54-55.dat	upx
behavioral1/files/0x00060000000160f3-63.dat	upx
behavioral1/files/0x0006000000016572-82.dat	upx
behavioral1/memory/1916-84-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/files/0x000f000000003683-40.dat	upx
behavioral1/files/0x0006000000016133-66.dat	upx
behavioral1/files/0x0006000000016caf-138.dat	upx
behavioral1/files/0x0006000000016cde-145.dat	upx
behavioral1/files/0x0006000000016d1a-154.dat	upx
behavioral1/files/0x0006000000016d3b-174.dat	upx
behavioral1/files/0x0006000000016d4c-184.dat	upx
behavioral1/files/0x0006000000016d44-179.dat	upx
behavioral1/files/0x0006000000016d2b-164.dat	upx
behavioral1/files/0x0006000000016d33-168.dat	upx
behavioral1/files/0x0006000000016d22-159.dat	upx
behavioral1/files/0x0006000000016c67-135.dat	upx
behavioral1/files/0x0038000000014ca5-124.dat	upx
behavioral1/files/0x0006000000016d05-148.dat	upx
behavioral1/files/0x0006000000016c5d-129.dat	upx
behavioral1/files/0x0006000000016a7d-115.dat	upx
behavioral1/files/0x00060000000165d4-113.dat	upx
behavioral1/files/0x0006000000016c4a-120.dat	upx
behavioral1/files/0x0006000000016448-111.dat	upx
behavioral1/files/0x0006000000016824-106.dat	upx
behavioral1/files/0x0006000000015fd4-99.dat	upx
behavioral1/files/0x0009000000015c82-97.dat	upx
behavioral1/memory/2644-50-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2748-43-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x000800000001542b-24.dat	upx
behavioral1/memory/2040-76-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2524-75-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x00060000000162cc-73.dat	upx
behavioral1/memory/2588-59-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2956-35-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x00080000000153fd-18.dat	upx
behavioral1/memory/1764-15-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/1916-4640-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2040-4641-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2956-4670-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2644-4666-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2600-4654-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2524-4645-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2748-5456-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PoFaXJU.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\XkpnMOP.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\JmjElYQ.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\zaWNuNd.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\AeVMKnd.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\KMulfzn.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\OdURjKx.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\PLAeGdQ.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\FVxjTtU.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\uaBRmXQ.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\ylUwOBW.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\fPNHAXA.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\IfSFFIW.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\lLDddci.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\fmuLAbb.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\zVqpsQY.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\KRBHYmw.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\glWCOwf.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\qNBzWAl.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\phoytcg.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\jVHUrYK.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\MaihdjO.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\MVpfZoq.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\aAhVcwV.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\jVmscJr.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\oSURWFN.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\KguNMFX.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\mOZdsGP.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\aXcSDrq.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\WGxqHwX.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\mtuslsQ.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\lAVDBPj.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\nBUeUem.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\pWYZNiv.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\jyOUZWP.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\FrcMvqf.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\czvaTCj.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\uvPldkz.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\mJGdBqu.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\IIYsUuj.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\qAQIlrQ.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\YsQmUJr.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\KmtYIAz.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\bDKgxOG.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\XraWIOX.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\wymIAjU.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\LMXSxOH.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\DLpneTK.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\qZKptcv.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\rvkwcLe.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\vGntCZa.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\SUCMtNU.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\gkmtghg.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\oBgWUWr.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\WgSrOBu.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\PwxFWCQ.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\nwgrNvZ.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\lJSpxqv.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\XwMOQQd.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\Ivhharj.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\pCElfSG.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\nrpOKig.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\MpKDynp.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
File created	C:\Windows\System\XQAWHwm.exe	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeLockMemoryPrivilege	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1744	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	29
PID 2588 wrote to memory of 1744	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	29
PID 2588 wrote to memory of 1744	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	29
PID 2588 wrote to memory of 1764	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	30
PID 2588 wrote to memory of 1764	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	30
PID 2588 wrote to memory of 1764	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	30
PID 2588 wrote to memory of 2600	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	31
PID 2588 wrote to memory of 2600	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	31
PID 2588 wrote to memory of 2600	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	31
PID 2588 wrote to memory of 2140	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	32
PID 2588 wrote to memory of 2140	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	32
PID 2588 wrote to memory of 2140	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	32
PID 2588 wrote to memory of 2956	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	33
PID 2588 wrote to memory of 2956	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	33
PID 2588 wrote to memory of 2956	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	33
PID 2588 wrote to memory of 2652	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	34
PID 2588 wrote to memory of 2652	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	34
PID 2588 wrote to memory of 2652	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	34
PID 2588 wrote to memory of 2748	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	35
PID 2588 wrote to memory of 2748	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	35
PID 2588 wrote to memory of 2748	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	35
PID 2588 wrote to memory of 2644	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	36
PID 2588 wrote to memory of 2644	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	36
PID 2588 wrote to memory of 2644	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	36
PID 2588 wrote to memory of 2560	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	37
PID 2588 wrote to memory of 2560	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	37
PID 2588 wrote to memory of 2560	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	37
PID 2588 wrote to memory of 2524	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	38
PID 2588 wrote to memory of 2524	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	38
PID 2588 wrote to memory of 2524	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	38
PID 2588 wrote to memory of 2628	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	39
PID 2588 wrote to memory of 2628	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	39
PID 2588 wrote to memory of 2628	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	39
PID 2588 wrote to memory of 1916	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	40
PID 2588 wrote to memory of 1916	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	40
PID 2588 wrote to memory of 1916	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	40
PID 2588 wrote to memory of 2096	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	41
PID 2588 wrote to memory of 2096	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	41
PID 2588 wrote to memory of 2096	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	41
PID 2588 wrote to memory of 2040	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	42
PID 2588 wrote to memory of 2040	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	42
PID 2588 wrote to memory of 2040	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	42
PID 2588 wrote to memory of 2844	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	43
PID 2588 wrote to memory of 2844	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	43
PID 2588 wrote to memory of 2844	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	43
PID 2588 wrote to memory of 2920	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	44
PID 2588 wrote to memory of 2920	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	44
PID 2588 wrote to memory of 2920	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	44
PID 2588 wrote to memory of 2900	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	45
PID 2588 wrote to memory of 2900	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	45
PID 2588 wrote to memory of 2900	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	45
PID 2588 wrote to memory of 2160	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	46
PID 2588 wrote to memory of 2160	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	46
PID 2588 wrote to memory of 2160	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	46
PID 2588 wrote to memory of 2396	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	47
PID 2588 wrote to memory of 2396	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	47
PID 2588 wrote to memory of 2396	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	47
PID 2588 wrote to memory of 1216	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	48
PID 2588 wrote to memory of 1216	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	48
PID 2588 wrote to memory of 1216	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	48
PID 2588 wrote to memory of 1796	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	49
PID 2588 wrote to memory of 1796	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	49
PID 2588 wrote to memory of 1796	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	49
PID 2588 wrote to memory of 3000	2588	2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a59f2d14b19853806e8ae65daf40349_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\System\etVFwJe.exe
  C:\Windows\System\etVFwJe.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\hjexwqu.exe
  C:\Windows\System\hjexwqu.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\SsnHPlC.exe
  C:\Windows\System\SsnHPlC.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\KIcEHIX.exe
  C:\Windows\System\KIcEHIX.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\RSJtmwZ.exe
  C:\Windows\System\RSJtmwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\HNwWqOr.exe
  C:\Windows\System\HNwWqOr.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\AHnAheX.exe
  C:\Windows\System\AHnAheX.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\DdRvLoN.exe
  C:\Windows\System\DdRvLoN.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\mTMWHeG.exe
  C:\Windows\System\mTMWHeG.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\uTqUHSA.exe
  C:\Windows\System\uTqUHSA.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\QPoROog.exe
  C:\Windows\System\QPoROog.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\ooZihWP.exe
  C:\Windows\System\ooZihWP.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\pJjdBqA.exe
  C:\Windows\System\pJjdBqA.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\UIKfyrL.exe
  C:\Windows\System\UIKfyrL.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\pxpmATR.exe
  C:\Windows\System\pxpmATR.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\QBTChCK.exe
  C:\Windows\System\QBTChCK.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\eTAgDQz.exe
  C:\Windows\System\eTAgDQz.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\BgMNisx.exe
  C:\Windows\System\BgMNisx.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\pCYQFKx.exe
  C:\Windows\System\pCYQFKx.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\zunVvoH.exe
  C:\Windows\System\zunVvoH.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\KSHjwXh.exe
  C:\Windows\System\KSHjwXh.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\FKqebyq.exe
  C:\Windows\System\FKqebyq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\yIRMWgP.exe
  C:\Windows\System\yIRMWgP.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\QTUnhJy.exe
  C:\Windows\System\QTUnhJy.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\NGALokm.exe
  C:\Windows\System\NGALokm.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\gLAdJJu.exe
  C:\Windows\System\gLAdJJu.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\KFbJYlC.exe
  C:\Windows\System\KFbJYlC.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\fyIYHuw.exe
  C:\Windows\System\fyIYHuw.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\vlFaWpf.exe
  C:\Windows\System\vlFaWpf.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\wbNUGEL.exe
  C:\Windows\System\wbNUGEL.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\KguNMFX.exe
  C:\Windows\System\KguNMFX.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\HXfgvUD.exe
  C:\Windows\System\HXfgvUD.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\JVxkwDF.exe
  C:\Windows\System\JVxkwDF.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\qRNbRqy.exe
  C:\Windows\System\qRNbRqy.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\czqCTOu.exe
  C:\Windows\System\czqCTOu.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\yXLGrMX.exe
  C:\Windows\System\yXLGrMX.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\kYJuIrS.exe
  C:\Windows\System\kYJuIrS.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\dsSOLfH.exe
  C:\Windows\System\dsSOLfH.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\hbmSUXl.exe
  C:\Windows\System\hbmSUXl.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\tQDbNBd.exe
  C:\Windows\System\tQDbNBd.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\YMQUHVu.exe
  C:\Windows\System\YMQUHVu.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\bCfdlUx.exe
  C:\Windows\System\bCfdlUx.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\CEKCbbC.exe
  C:\Windows\System\CEKCbbC.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\bRtCMgm.exe
  C:\Windows\System\bRtCMgm.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\QffqpvV.exe
  C:\Windows\System\QffqpvV.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\DoqGHMT.exe
  C:\Windows\System\DoqGHMT.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\flvExjX.exe
  C:\Windows\System\flvExjX.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\qOxBZfO.exe
  C:\Windows\System\qOxBZfO.exe
  2⤵
  PID:2128
- C:\Windows\System\paHTQPk.exe
  C:\Windows\System\paHTQPk.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\vcCDIRh.exe
  C:\Windows\System\vcCDIRh.exe
  2⤵
  PID:2028
- C:\Windows\System\FEyYyJC.exe
  C:\Windows\System\FEyYyJC.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\xuiopPG.exe
  C:\Windows\System\xuiopPG.exe
  2⤵
  PID:3064
- C:\Windows\System\seYVEfZ.exe
  C:\Windows\System\seYVEfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\AgTaEtB.exe
  C:\Windows\System\AgTaEtB.exe
  2⤵
  PID:1612
- C:\Windows\System\dHbWNfG.exe
  C:\Windows\System\dHbWNfG.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\ewUAEUX.exe
  C:\Windows\System\ewUAEUX.exe
  2⤵
  PID:3016
- C:\Windows\System\hpsHxyB.exe
  C:\Windows\System\hpsHxyB.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\WuMphvr.exe
  C:\Windows\System\WuMphvr.exe
  2⤵
  PID:1224
- C:\Windows\System\JiIpyId.exe
  C:\Windows\System\JiIpyId.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\MhpfsMi.exe
  C:\Windows\System\MhpfsMi.exe
  2⤵
  PID:2568
- C:\Windows\System\PNEtvAT.exe
  C:\Windows\System\PNEtvAT.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\aenfLLP.exe
  C:\Windows\System\aenfLLP.exe
  2⤵
  PID:2660
- C:\Windows\System\oigLZXK.exe
  C:\Windows\System\oigLZXK.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\gxlkqyF.exe
  C:\Windows\System\gxlkqyF.exe
  2⤵
  PID:2516
- C:\Windows\System\NfSYCxR.exe
  C:\Windows\System\NfSYCxR.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\WQazNtk.exe
  C:\Windows\System\WQazNtk.exe
  2⤵
  PID:1120
- C:\Windows\System\hbHrNiD.exe
  C:\Windows\System\hbHrNiD.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\cByNFdJ.exe
  C:\Windows\System\cByNFdJ.exe
  2⤵
  PID:352
- C:\Windows\System\NiWyHpp.exe
  C:\Windows\System\NiWyHpp.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\VeIqagt.exe
  C:\Windows\System\VeIqagt.exe
  2⤵
  PID:1064
- C:\Windows\System\yRWCsYk.exe
  C:\Windows\System\yRWCsYk.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\LpJQcce.exe
  C:\Windows\System\LpJQcce.exe
  2⤵
  PID:1448
- C:\Windows\System\aonYxtB.exe
  C:\Windows\System\aonYxtB.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\TLaKAzc.exe
  C:\Windows\System\TLaKAzc.exe
  2⤵
  PID:1636
- C:\Windows\System\hpqJSyx.exe
  C:\Windows\System\hpqJSyx.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\nQmlJuS.exe
  C:\Windows\System\nQmlJuS.exe
  2⤵
  PID:1308
- C:\Windows\System\iGUPQXX.exe
  C:\Windows\System\iGUPQXX.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\Zfvucfd.exe
  C:\Windows\System\Zfvucfd.exe
  2⤵
  PID:576
- C:\Windows\System\NpMQOuE.exe
  C:\Windows\System\NpMQOuE.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\MtqIKld.exe
  C:\Windows\System\MtqIKld.exe
  2⤵
  PID:1496
- C:\Windows\System\gkmtghg.exe
  C:\Windows\System\gkmtghg.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\JjQTibl.exe
  C:\Windows\System\JjQTibl.exe
  2⤵
  PID:948
- C:\Windows\System\yhAyYZv.exe
  C:\Windows\System\yhAyYZv.exe
  2⤵
  PID:2220
- C:\Windows\System\KRVKTpB.exe
  C:\Windows\System\KRVKTpB.exe
  2⤵
  PID:1964
- C:\Windows\System\VzGfcLX.exe
  C:\Windows\System\VzGfcLX.exe
  2⤵
  PID:1276
- C:\Windows\System\CesdVOz.exe
  C:\Windows\System\CesdVOz.exe
  2⤵
  PID:1960
- C:\Windows\System\IWrdmRL.exe
  C:\Windows\System\IWrdmRL.exe
  2⤵
  PID:648
- C:\Windows\System\ThaIiWS.exe
  C:\Windows\System\ThaIiWS.exe
  2⤵
  PID:780
- C:\Windows\System\ZUtnrVd.exe
  C:\Windows\System\ZUtnrVd.exe
  2⤵
  PID:1776
- C:\Windows\System\pmobfXS.exe
  C:\Windows\System\pmobfXS.exe
  2⤵
  PID:2400
- C:\Windows\System\ERUyQoH.exe
  C:\Windows\System\ERUyQoH.exe
  2⤵
  PID:1572
- C:\Windows\System\LatCUgb.exe
  C:\Windows\System\LatCUgb.exe
  2⤵
  PID:2512
- C:\Windows\System\oESRNTo.exe
  C:\Windows\System\oESRNTo.exe
  2⤵
  PID:2892
- C:\Windows\System\NiJNhzM.exe
  C:\Windows\System\NiJNhzM.exe
  2⤵
  PID:2912
- C:\Windows\System\xzjJlhU.exe
  C:\Windows\System\xzjJlhU.exe
  2⤵
  PID:608
- C:\Windows\System\enwGHns.exe
  C:\Windows\System\enwGHns.exe
  2⤵
  PID:1760
- C:\Windows\System\UTkIGYr.exe
  C:\Windows\System\UTkIGYr.exe
  2⤵
  PID:2696
- C:\Windows\System\wUVKrHE.exe
  C:\Windows\System\wUVKrHE.exe
  2⤵
  PID:1820
- C:\Windows\System\wcNAaBj.exe
  C:\Windows\System\wcNAaBj.exe
  2⤵
  PID:3076
- C:\Windows\System\cVnAmPM.exe
  C:\Windows\System\cVnAmPM.exe
  2⤵
  PID:3092
- C:\Windows\System\fkQjdJt.exe
  C:\Windows\System\fkQjdJt.exe
  2⤵
  PID:3108
- C:\Windows\System\jiHEzqh.exe
  C:\Windows\System\jiHEzqh.exe
  2⤵
  PID:3124
- C:\Windows\System\psOrWkX.exe
  C:\Windows\System\psOrWkX.exe
  2⤵
  PID:3140
- C:\Windows\System\KlKysIb.exe
  C:\Windows\System\KlKysIb.exe
  2⤵
  PID:3156
- C:\Windows\System\mMHtwLi.exe
  C:\Windows\System\mMHtwLi.exe
  2⤵
  PID:3172
- C:\Windows\System\TyNvCJv.exe
  C:\Windows\System\TyNvCJv.exe
  2⤵
  PID:3188
- C:\Windows\System\yxJibSl.exe
  C:\Windows\System\yxJibSl.exe
  2⤵
  PID:3204
- C:\Windows\System\BAnoPzf.exe
  C:\Windows\System\BAnoPzf.exe
  2⤵
  PID:3220
- C:\Windows\System\uCIjVmo.exe
  C:\Windows\System\uCIjVmo.exe
  2⤵
  PID:3236
- C:\Windows\System\iWOXVIm.exe
  C:\Windows\System\iWOXVIm.exe
  2⤵
  PID:3252
- C:\Windows\System\jpJkkXt.exe
  C:\Windows\System\jpJkkXt.exe
  2⤵
  PID:3268
- C:\Windows\System\RNOgGQU.exe
  C:\Windows\System\RNOgGQU.exe
  2⤵
  PID:3284
- C:\Windows\System\XsQltah.exe
  C:\Windows\System\XsQltah.exe
  2⤵
  PID:3300
- C:\Windows\System\khxzSHO.exe
  C:\Windows\System\khxzSHO.exe
  2⤵
  PID:3316
- C:\Windows\System\ShKlrSp.exe
  C:\Windows\System\ShKlrSp.exe
  2⤵
  PID:3332
- C:\Windows\System\kULqZKg.exe
  C:\Windows\System\kULqZKg.exe
  2⤵
  PID:3348
- C:\Windows\System\pXoNAUN.exe
  C:\Windows\System\pXoNAUN.exe
  2⤵
  PID:3364
- C:\Windows\System\tsbeDLu.exe
  C:\Windows\System\tsbeDLu.exe
  2⤵
  PID:3380
- C:\Windows\System\NlOCXUI.exe
  C:\Windows\System\NlOCXUI.exe
  2⤵
  PID:3396
- C:\Windows\System\TWBAvPj.exe
  C:\Windows\System\TWBAvPj.exe
  2⤵
  PID:3412
- C:\Windows\System\GNGCyjV.exe
  C:\Windows\System\GNGCyjV.exe
  2⤵
  PID:3428
- C:\Windows\System\eZCwHtF.exe
  C:\Windows\System\eZCwHtF.exe
  2⤵
  PID:3444
- C:\Windows\System\lGHKCwU.exe
  C:\Windows\System\lGHKCwU.exe
  2⤵
  PID:3460
- C:\Windows\System\VTGHXiz.exe
  C:\Windows\System\VTGHXiz.exe
  2⤵
  PID:3476
- C:\Windows\System\JaLVngV.exe
  C:\Windows\System\JaLVngV.exe
  2⤵
  PID:3492
- C:\Windows\System\dUnjcuS.exe
  C:\Windows\System\dUnjcuS.exe
  2⤵
  PID:3508
- C:\Windows\System\HSgUDxD.exe
  C:\Windows\System\HSgUDxD.exe
  2⤵
  PID:3524
- C:\Windows\System\JBTaixY.exe
  C:\Windows\System\JBTaixY.exe
  2⤵
  PID:3540
- C:\Windows\System\ZivVBoj.exe
  C:\Windows\System\ZivVBoj.exe
  2⤵
  PID:3556
- C:\Windows\System\QpexApu.exe
  C:\Windows\System\QpexApu.exe
  2⤵
  PID:3572
- C:\Windows\System\eSNoSTN.exe
  C:\Windows\System\eSNoSTN.exe
  2⤵
  PID:3588
- C:\Windows\System\KfRchpC.exe
  C:\Windows\System\KfRchpC.exe
  2⤵
  PID:3604
- C:\Windows\System\ryqicPh.exe
  C:\Windows\System\ryqicPh.exe
  2⤵
  PID:3620
- C:\Windows\System\zcAliCm.exe
  C:\Windows\System\zcAliCm.exe
  2⤵
  PID:3636
- C:\Windows\System\kpibNBr.exe
  C:\Windows\System\kpibNBr.exe
  2⤵
  PID:3652
- C:\Windows\System\pXzyxBw.exe
  C:\Windows\System\pXzyxBw.exe
  2⤵
  PID:3668
- C:\Windows\System\lLKPJLC.exe
  C:\Windows\System\lLKPJLC.exe
  2⤵
  PID:3684
- C:\Windows\System\SvmXkUB.exe
  C:\Windows\System\SvmXkUB.exe
  2⤵
  PID:3700
- C:\Windows\System\MWmZVUr.exe
  C:\Windows\System\MWmZVUr.exe
  2⤵
  PID:3716
- C:\Windows\System\XZcjOcA.exe
  C:\Windows\System\XZcjOcA.exe
  2⤵
  PID:3732
- C:\Windows\System\EPBCmZm.exe
  C:\Windows\System\EPBCmZm.exe
  2⤵
  PID:3748
- C:\Windows\System\yXMCQGl.exe
  C:\Windows\System\yXMCQGl.exe
  2⤵
  PID:3764
- C:\Windows\System\FaMpmXK.exe
  C:\Windows\System\FaMpmXK.exe
  2⤵
  PID:3780
- C:\Windows\System\hDcDXmB.exe
  C:\Windows\System\hDcDXmB.exe
  2⤵
  PID:3796
- C:\Windows\System\OzykXGE.exe
  C:\Windows\System\OzykXGE.exe
  2⤵
  PID:3812
- C:\Windows\System\zZyYaDm.exe
  C:\Windows\System\zZyYaDm.exe
  2⤵
  PID:3828
- C:\Windows\System\Ubodjwi.exe
  C:\Windows\System\Ubodjwi.exe
  2⤵
  PID:3844
- C:\Windows\System\FEYVQxu.exe
  C:\Windows\System\FEYVQxu.exe
  2⤵
  PID:3860
- C:\Windows\System\NAsqwVa.exe
  C:\Windows\System\NAsqwVa.exe
  2⤵
  PID:3876
- C:\Windows\System\XraFJGb.exe
  C:\Windows\System\XraFJGb.exe
  2⤵
  PID:3892
- C:\Windows\System\RSzYUcS.exe
  C:\Windows\System\RSzYUcS.exe
  2⤵
  PID:3908
- C:\Windows\System\cBGGfzD.exe
  C:\Windows\System\cBGGfzD.exe
  2⤵
  PID:3924
- C:\Windows\System\wPThrBy.exe
  C:\Windows\System\wPThrBy.exe
  2⤵
  PID:3940
- C:\Windows\System\cUXSUyO.exe
  C:\Windows\System\cUXSUyO.exe
  2⤵
  PID:3956
- C:\Windows\System\XwMOQQd.exe
  C:\Windows\System\XwMOQQd.exe
  2⤵
  PID:3972
- C:\Windows\System\vAGGKRV.exe
  C:\Windows\System\vAGGKRV.exe
  2⤵
  PID:3988
- C:\Windows\System\GjdPmOv.exe
  C:\Windows\System\GjdPmOv.exe
  2⤵
  PID:4004
- C:\Windows\System\qLFMFRg.exe
  C:\Windows\System\qLFMFRg.exe
  2⤵
  PID:4020
- C:\Windows\System\YvFkURw.exe
  C:\Windows\System\YvFkURw.exe
  2⤵
  PID:4036
- C:\Windows\System\amfYnTy.exe
  C:\Windows\System\amfYnTy.exe
  2⤵
  PID:4052
- C:\Windows\System\nHHeyRQ.exe
  C:\Windows\System\nHHeyRQ.exe
  2⤵
  PID:4068
- C:\Windows\System\vfkKdGi.exe
  C:\Windows\System\vfkKdGi.exe
  2⤵
  PID:4088
- C:\Windows\System\yMrbtxR.exe
  C:\Windows\System\yMrbtxR.exe
  2⤵
  PID:1544
- C:\Windows\System\WAYELtk.exe
  C:\Windows\System\WAYELtk.exe
  2⤵
  PID:816
- C:\Windows\System\QLNoxvb.exe
  C:\Windows\System\QLNoxvb.exe
  2⤵
  PID:3084
- C:\Windows\System\JQaEYNV.exe
  C:\Windows\System\JQaEYNV.exe
  2⤵
  PID:3116
- C:\Windows\System\MmiGeRg.exe
  C:\Windows\System\MmiGeRg.exe
  2⤵
  PID:1616
- C:\Windows\System\wJLqyEB.exe
  C:\Windows\System\wJLqyEB.exe
  2⤵
  PID:1756
- C:\Windows\System\nhOrOcx.exe
  C:\Windows\System\nhOrOcx.exe
  2⤵
  PID:2380
- C:\Windows\System\MpdsqUp.exe
  C:\Windows\System\MpdsqUp.exe
  2⤵
  PID:2732
- C:\Windows\System\vKPOmlp.exe
  C:\Windows\System\vKPOmlp.exe
  2⤵
  PID:2724
- C:\Windows\System\aPFdvRC.exe
  C:\Windows\System\aPFdvRC.exe
  2⤵
  PID:2796
- C:\Windows\System\ZVIUVrX.exe
  C:\Windows\System\ZVIUVrX.exe
  2⤵
  PID:2572
- C:\Windows\System\BAcngLT.exe
  C:\Windows\System\BAcngLT.exe
  2⤵
  PID:2852
- C:\Windows\System\TrHqIiu.exe
  C:\Windows\System\TrHqIiu.exe
  2⤵
  PID:2828
- C:\Windows\System\NXVXvld.exe
  C:\Windows\System\NXVXvld.exe
  2⤵
  PID:1480
- C:\Windows\System\dOqtNBQ.exe
  C:\Windows\System\dOqtNBQ.exe
  2⤵
  PID:2408
- C:\Windows\System\ChKTDhT.exe
  C:\Windows\System\ChKTDhT.exe
  2⤵
  PID:2332
- C:\Windows\System\BRVlIwg.exe
  C:\Windows\System\BRVlIwg.exe
  2⤵
  PID:1740
- C:\Windows\System\mlsmPvo.exe
  C:\Windows\System\mlsmPvo.exe
  2⤵
  PID:304
- C:\Windows\System\ASPwASC.exe
  C:\Windows\System\ASPwASC.exe
  2⤵
  PID:2436
- C:\Windows\System\lWcDkHR.exe
  C:\Windows\System\lWcDkHR.exe
  2⤵
  PID:2492
- C:\Windows\System\wzpUQjQ.exe
  C:\Windows\System\wzpUQjQ.exe
  2⤵
  PID:1320
- C:\Windows\System\FUdPGTF.exe
  C:\Windows\System\FUdPGTF.exe
  2⤵
  PID:2740
- C:\Windows\System\rSdXlzn.exe
  C:\Windows\System\rSdXlzn.exe
  2⤵
  PID:2428
- C:\Windows\System\IvGSsxs.exe
  C:\Windows\System\IvGSsxs.exe
  2⤵
  PID:1028
- C:\Windows\System\TxkbuUN.exe
  C:\Windows\System\TxkbuUN.exe
  2⤵
  PID:1156
- C:\Windows\System\DjUycLu.exe
  C:\Windows\System\DjUycLu.exe
  2⤵
  PID:2708
- C:\Windows\System\PiiuTds.exe
  C:\Windows\System\PiiuTds.exe
  2⤵
  PID:2188
- C:\Windows\System\AnMdkjX.exe
  C:\Windows\System\AnMdkjX.exe
  2⤵
  PID:2872
- C:\Windows\System\ynUQHuj.exe
  C:\Windows\System\ynUQHuj.exe
  2⤵
  PID:2052
- C:\Windows\System\YkkISmg.exe
  C:\Windows\System\YkkISmg.exe
  2⤵
  PID:1192
- C:\Windows\System\vKZgqKb.exe
  C:\Windows\System\vKZgqKb.exe
  2⤵
  PID:1692
- C:\Windows\System\glDbwSg.exe
  C:\Windows\System\glDbwSg.exe
  2⤵
  PID:1548
- C:\Windows\System\osrYKmA.exe
  C:\Windows\System\osrYKmA.exe
  2⤵
  PID:2092
- C:\Windows\System\QzJdOtB.exe
  C:\Windows\System\QzJdOtB.exe
  2⤵
  PID:2868
- C:\Windows\System\qcpnYSP.exe
  C:\Windows\System\qcpnYSP.exe
  2⤵
  PID:444
- C:\Windows\System\FjValGS.exe
  C:\Windows\System\FjValGS.exe
  2⤵
  PID:3104
- C:\Windows\System\lJnmAxp.exe
  C:\Windows\System\lJnmAxp.exe
  2⤵
  PID:3168
- C:\Windows\System\cxzPhvW.exe
  C:\Windows\System\cxzPhvW.exe
  2⤵
  PID:3232
- C:\Windows\System\Ivhharj.exe
  C:\Windows\System\Ivhharj.exe
  2⤵
  PID:3296
- C:\Windows\System\qlklMPu.exe
  C:\Windows\System\qlklMPu.exe
  2⤵
  PID:3360
- C:\Windows\System\YStJoxJ.exe
  C:\Windows\System\YStJoxJ.exe
  2⤵
  PID:3452
- C:\Windows\System\SrXKeCh.exe
  C:\Windows\System\SrXKeCh.exe
  2⤵
  PID:3516
- C:\Windows\System\dPMtAxa.exe
  C:\Windows\System\dPMtAxa.exe
  2⤵
  PID:3580
- C:\Windows\System\npdNexc.exe
  C:\Windows\System\npdNexc.exe
  2⤵
  PID:3644
- C:\Windows\System\EwxIjMS.exe
  C:\Windows\System\EwxIjMS.exe
  2⤵
  PID:3708
- C:\Windows\System\ppgygYN.exe
  C:\Windows\System\ppgygYN.exe
  2⤵
  PID:3772
- C:\Windows\System\wiaEjen.exe
  C:\Windows\System\wiaEjen.exe
  2⤵
  PID:3836
- C:\Windows\System\yzGnZgM.exe
  C:\Windows\System\yzGnZgM.exe
  2⤵
  PID:3900
- C:\Windows\System\DZyfKBO.exe
  C:\Windows\System\DZyfKBO.exe
  2⤵
  PID:3964
- C:\Windows\System\npPaXsy.exe
  C:\Windows\System\npPaXsy.exe
  2⤵
  PID:4028
- C:\Windows\System\CTEuHTt.exe
  C:\Windows\System\CTEuHTt.exe
  2⤵
  PID:3152
- C:\Windows\System\EBFUfYG.exe
  C:\Windows\System\EBFUfYG.exe
  2⤵
  PID:3244
- C:\Windows\System\mHGBDjA.exe
  C:\Windows\System\mHGBDjA.exe
  2⤵
  PID:3308
- C:\Windows\System\jcKMPCh.exe
  C:\Windows\System\jcKMPCh.exe
  2⤵
  PID:3372
- C:\Windows\System\DLGFEty.exe
  C:\Windows\System\DLGFEty.exe
  2⤵
  PID:3436
- C:\Windows\System\tpxxyKD.exe
  C:\Windows\System\tpxxyKD.exe
  2⤵
  PID:3500
- C:\Windows\System\LjLrgRP.exe
  C:\Windows\System\LjLrgRP.exe
  2⤵
  PID:3536
- C:\Windows\System\eqQcqSZ.exe
  C:\Windows\System\eqQcqSZ.exe
  2⤵
  PID:3596
- C:\Windows\System\qIXaMaq.exe
  C:\Windows\System\qIXaMaq.exe
  2⤵
  PID:3660
- C:\Windows\System\TMWFnqX.exe
  C:\Windows\System\TMWFnqX.exe
  2⤵
  PID:3724
- C:\Windows\System\KEUxJbT.exe
  C:\Windows\System\KEUxJbT.exe
  2⤵
  PID:3788
- C:\Windows\System\rFJaLkY.exe
  C:\Windows\System\rFJaLkY.exe
  2⤵
  PID:3852
- C:\Windows\System\uIzaYVb.exe
  C:\Windows\System\uIzaYVb.exe
  2⤵
  PID:3916
- C:\Windows\System\fMJWqxt.exe
  C:\Windows\System\fMJWqxt.exe
  2⤵
  PID:3980
- C:\Windows\System\JAQprKE.exe
  C:\Windows\System\JAQprKE.exe
  2⤵
  PID:4044
- C:\Windows\System\bwKTBuT.exe
  C:\Windows\System\bwKTBuT.exe
  2⤵
  PID:2820
- C:\Windows\System\mBRsNXT.exe
  C:\Windows\System\mBRsNXT.exe
  2⤵
  PID:1352
- C:\Windows\System\erBifwk.exe
  C:\Windows\System\erBifwk.exe
  2⤵
  PID:2860
- C:\Windows\System\XyvIAJT.exe
  C:\Windows\System\XyvIAJT.exe
  2⤵
  PID:2984
- C:\Windows\System\NcHSZIE.exe
  C:\Windows\System\NcHSZIE.exe
  2⤵
  PID:2768
- C:\Windows\System\gXeYion.exe
  C:\Windows\System\gXeYion.exe
  2⤵
  PID:2856
- C:\Windows\System\PPxqWzB.exe
  C:\Windows\System\PPxqWzB.exe
  2⤵
  PID:2292
- C:\Windows\System\WdrKYKG.exe
  C:\Windows\System\WdrKYKG.exe
  2⤵
  PID:1500
- C:\Windows\System\LAkraOE.exe
  C:\Windows\System\LAkraOE.exe
  2⤵
  PID:2656
- C:\Windows\System\iuCJZGP.exe
  C:\Windows\System\iuCJZGP.exe
  2⤵
  PID:788
- C:\Windows\System\gAWYgMr.exe
  C:\Windows\System\gAWYgMr.exe
  2⤵
  PID:2352
- C:\Windows\System\WhaOOdZ.exe
  C:\Windows\System\WhaOOdZ.exe
  2⤵
  PID:2780
- C:\Windows\System\HVGKYHQ.exe
  C:\Windows\System\HVGKYHQ.exe
  2⤵
  PID:3036
- C:\Windows\System\nfwDeeC.exe
  C:\Windows\System\nfwDeeC.exe
  2⤵
  PID:2824
- C:\Windows\System\CIyfwFd.exe
  C:\Windows\System\CIyfwFd.exe
  2⤵
  PID:112
- C:\Windows\System\yoKesss.exe
  C:\Windows\System\yoKesss.exe
  2⤵
  PID:3100
- C:\Windows\System\EWywPIL.exe
  C:\Windows\System\EWywPIL.exe
  2⤵
  PID:768
- C:\Windows\System\gVYEvJs.exe
  C:\Windows\System\gVYEvJs.exe
  2⤵
  PID:3328
- C:\Windows\System\KBxDKTS.exe
  C:\Windows\System\KBxDKTS.exe
  2⤵
  PID:2916
- C:\Windows\System\vGGQKSr.exe
  C:\Windows\System\vGGQKSr.exe
  2⤵
  PID:3264
- C:\Windows\System\IdkjsAn.exe
  C:\Windows\System\IdkjsAn.exe
  2⤵
  PID:3616
- C:\Windows\System\gxIndaF.exe
  C:\Windows\System\gxIndaF.exe
  2⤵
  PID:3680
- C:\Windows\System\YsVJVqM.exe
  C:\Windows\System\YsVJVqM.exe
  2⤵
  PID:3868
- C:\Windows\System\HjkouGR.exe
  C:\Windows\System\HjkouGR.exe
  2⤵
  PID:3996
- C:\Windows\System\vsKLHDn.exe
  C:\Windows\System\vsKLHDn.exe
  2⤵
  PID:4064
- C:\Windows\System\QlbLuTM.exe
  C:\Windows\System\QlbLuTM.exe
  2⤵
  PID:3280
- C:\Windows\System\iHBhlYT.exe
  C:\Windows\System\iHBhlYT.exe
  2⤵
  PID:3408
- C:\Windows\System\UstGcuh.exe
  C:\Windows\System\UstGcuh.exe
  2⤵
  PID:3564
- C:\Windows\System\kCvelEd.exe
  C:\Windows\System\kCvelEd.exe
  2⤵
  PID:3692
- C:\Windows\System\yMvtcoO.exe
  C:\Windows\System\yMvtcoO.exe
  2⤵
  PID:3068
- C:\Windows\System\toANvUE.exe
  C:\Windows\System\toANvUE.exe
  2⤵
  PID:3884
- C:\Windows\System\AwuVjib.exe
  C:\Windows\System\AwuVjib.exe
  2⤵
  PID:4012
- C:\Windows\System\drZRpPW.exe
  C:\Windows\System\drZRpPW.exe
  2⤵
  PID:980
- C:\Windows\System\jqCsMio.exe
  C:\Windows\System\jqCsMio.exe
  2⤵
  PID:2776
- C:\Windows\System\WXuyQmc.exe
  C:\Windows\System\WXuyQmc.exe
  2⤵
  PID:824
- C:\Windows\System\enQmxMG.exe
  C:\Windows\System\enQmxMG.exe
  2⤵
  PID:2668
- C:\Windows\System\durRZPZ.exe
  C:\Windows\System\durRZPZ.exe
  2⤵
  PID:3048
- C:\Windows\System\WXJpBjJ.exe
  C:\Windows\System\WXJpBjJ.exe
  2⤵
  PID:2392
- C:\Windows\System\kLETUDX.exe
  C:\Windows\System\kLETUDX.exe
  2⤵
  PID:2688
- C:\Windows\System\iZqdWSM.exe
  C:\Windows\System\iZqdWSM.exe
  2⤵
  PID:1808
- C:\Windows\System\NvGEnzM.exe
  C:\Windows\System\NvGEnzM.exe
  2⤵
  PID:1648
- C:\Windows\System\jyOUZWP.exe
  C:\Windows\System\jyOUZWP.exe
  2⤵
  PID:3200
- C:\Windows\System\njMtKix.exe
  C:\Windows\System\njMtKix.exe
  2⤵
  PID:3228
- C:\Windows\System\jjGyqAs.exe
  C:\Windows\System\jjGyqAs.exe
  2⤵
  PID:1072
- C:\Windows\System\JWLJsTK.exe
  C:\Windows\System\JWLJsTK.exe
  2⤵
  PID:3420
- C:\Windows\System\pTyzBdt.exe
  C:\Windows\System\pTyzBdt.exe
  2⤵
  PID:3676
- C:\Windows\System\noBFALb.exe
  C:\Windows\System\noBFALb.exe
  2⤵
  PID:3024
- C:\Windows\System\VpGWUfK.exe
  C:\Windows\System\VpGWUfK.exe
  2⤵
  PID:3212
- C:\Windows\System\RTYNjfg.exe
  C:\Windows\System\RTYNjfg.exe
  2⤵
  PID:3568
- C:\Windows\System\yWHaOfJ.exe
  C:\Windows\System\yWHaOfJ.exe
  2⤵
  PID:3756
- C:\Windows\System\sANRyFD.exe
  C:\Windows\System\sANRyFD.exe
  2⤵
  PID:692
- C:\Windows\System\DxLUsWo.exe
  C:\Windows\System\DxLUsWo.exe
  2⤵
  PID:3052
- C:\Windows\System\nfXGTir.exe
  C:\Windows\System\nfXGTir.exe
  2⤵
  PID:2340
- C:\Windows\System\eoZIQsc.exe
  C:\Windows\System\eoZIQsc.exe
  2⤵
  PID:1752
- C:\Windows\System\vmBcOTF.exe
  C:\Windows\System\vmBcOTF.exe
  2⤵
  PID:324
- C:\Windows\System\eVIMrMi.exe
  C:\Windows\System\eVIMrMi.exe
  2⤵
  PID:2472
- C:\Windows\System\UaOYrxQ.exe
  C:\Windows\System\UaOYrxQ.exe
  2⤵
  PID:1620
- C:\Windows\System\jdnalye.exe
  C:\Windows\System\jdnalye.exe
  2⤵
  PID:2556
- C:\Windows\System\rPrAPOs.exe
  C:\Windows\System\rPrAPOs.exe
  2⤵
  PID:1504
- C:\Windows\System\IbbvrpE.exe
  C:\Windows\System\IbbvrpE.exe
  2⤵
  PID:1684
- C:\Windows\System\bHNomqX.exe
  C:\Windows\System\bHNomqX.exe
  2⤵
  PID:1828
- C:\Windows\System\wGMhvHV.exe
  C:\Windows\System\wGMhvHV.exe
  2⤵
  PID:760
- C:\Windows\System\GtxbbOt.exe
  C:\Windows\System\GtxbbOt.exe
  2⤵
  PID:2552
- C:\Windows\System\JmjElYQ.exe
  C:\Windows\System\JmjElYQ.exe
  2⤵
  PID:4100
- C:\Windows\System\sNEToGn.exe
  C:\Windows\System\sNEToGn.exe
  2⤵
  PID:4116
- C:\Windows\System\xnwRlwn.exe
  C:\Windows\System\xnwRlwn.exe
  2⤵
  PID:4136
- C:\Windows\System\PchysVa.exe
  C:\Windows\System\PchysVa.exe
  2⤵
  PID:4156
- C:\Windows\System\CWdojjF.exe
  C:\Windows\System\CWdojjF.exe
  2⤵
  PID:4172
- C:\Windows\System\OuSeCfX.exe
  C:\Windows\System\OuSeCfX.exe
  2⤵
  PID:4188
- C:\Windows\System\AbjLgsH.exe
  C:\Windows\System\AbjLgsH.exe
  2⤵
  PID:4204
- C:\Windows\System\Ehuwavh.exe
  C:\Windows\System\Ehuwavh.exe
  2⤵
  PID:4220
- C:\Windows\System\PwWiqUz.exe
  C:\Windows\System\PwWiqUz.exe
  2⤵
  PID:4236
- C:\Windows\System\fGQcJnd.exe
  C:\Windows\System\fGQcJnd.exe
  2⤵
  PID:4252
- C:\Windows\System\VarSYtA.exe
  C:\Windows\System\VarSYtA.exe
  2⤵
  PID:4268
- C:\Windows\System\ylUwOBW.exe
  C:\Windows\System\ylUwOBW.exe
  2⤵
  PID:4284
- C:\Windows\System\RBNsaGX.exe
  C:\Windows\System\RBNsaGX.exe
  2⤵
  PID:4300
- C:\Windows\System\jBeVkDH.exe
  C:\Windows\System\jBeVkDH.exe
  2⤵
  PID:4316
- C:\Windows\System\AMHmojP.exe
  C:\Windows\System\AMHmojP.exe
  2⤵
  PID:4332
- C:\Windows\System\kCErxyY.exe
  C:\Windows\System\kCErxyY.exe
  2⤵
  PID:4348
- C:\Windows\System\gymrwkU.exe
  C:\Windows\System\gymrwkU.exe
  2⤵
  PID:4364
- C:\Windows\System\iQcsMod.exe
  C:\Windows\System\iQcsMod.exe
  2⤵
  PID:4380
- C:\Windows\System\WfRISFu.exe
  C:\Windows\System\WfRISFu.exe
  2⤵
  PID:4416
- C:\Windows\System\KQLpOWn.exe
  C:\Windows\System\KQLpOWn.exe
  2⤵
  PID:4440
- C:\Windows\System\ibWehDI.exe
  C:\Windows\System\ibWehDI.exe
  2⤵
  PID:4456
- C:\Windows\System\phhXmrx.exe
  C:\Windows\System\phhXmrx.exe
  2⤵
  PID:4472
- C:\Windows\System\ssbcrlk.exe
  C:\Windows\System\ssbcrlk.exe
  2⤵
  PID:4488
- C:\Windows\System\FUigSsk.exe
  C:\Windows\System\FUigSsk.exe
  2⤵
  PID:4504
- C:\Windows\System\IxGlhJn.exe
  C:\Windows\System\IxGlhJn.exe
  2⤵
  PID:4520
- C:\Windows\System\sLhiPaH.exe
  C:\Windows\System\sLhiPaH.exe
  2⤵
  PID:4536
- C:\Windows\System\OQTpxjI.exe
  C:\Windows\System\OQTpxjI.exe
  2⤵
  PID:4556
- C:\Windows\System\csGzHTZ.exe
  C:\Windows\System\csGzHTZ.exe
  2⤵
  PID:4572
- C:\Windows\System\OrPJAlh.exe
  C:\Windows\System\OrPJAlh.exe
  2⤵
  PID:4588
- C:\Windows\System\GvJUoaq.exe
  C:\Windows\System\GvJUoaq.exe
  2⤵
  PID:4604
- C:\Windows\System\UuSVgAf.exe
  C:\Windows\System\UuSVgAf.exe
  2⤵
  PID:4636
- C:\Windows\System\EabPKPU.exe
  C:\Windows\System\EabPKPU.exe
  2⤵
  PID:4652
- C:\Windows\System\NoteSPu.exe
  C:\Windows\System\NoteSPu.exe
  2⤵
  PID:4668
- C:\Windows\System\lNtWCNa.exe
  C:\Windows\System\lNtWCNa.exe
  2⤵
  PID:4684
- C:\Windows\System\FLqdAsz.exe
  C:\Windows\System\FLqdAsz.exe
  2⤵
  PID:4700
- C:\Windows\System\vAUbmVZ.exe
  C:\Windows\System\vAUbmVZ.exe
  2⤵
  PID:4720
- C:\Windows\System\bySZvbV.exe
  C:\Windows\System\bySZvbV.exe
  2⤵
  PID:4736
- C:\Windows\System\cSgvhsl.exe
  C:\Windows\System\cSgvhsl.exe
  2⤵
  PID:4752
- C:\Windows\System\Nxazuyr.exe
  C:\Windows\System\Nxazuyr.exe
  2⤵
  PID:4768
- C:\Windows\System\cIHdIQl.exe
  C:\Windows\System\cIHdIQl.exe
  2⤵
  PID:4784
- C:\Windows\System\tXmBkED.exe
  C:\Windows\System\tXmBkED.exe
  2⤵
  PID:4800
- C:\Windows\System\XvezlGy.exe
  C:\Windows\System\XvezlGy.exe
  2⤵
  PID:4820
- C:\Windows\System\qoOLifQ.exe
  C:\Windows\System\qoOLifQ.exe
  2⤵
  PID:4836
- C:\Windows\System\fzHkjuq.exe
  C:\Windows\System\fzHkjuq.exe
  2⤵
  PID:4852
- C:\Windows\System\SLfxjby.exe
  C:\Windows\System\SLfxjby.exe
  2⤵
  PID:4868
- C:\Windows\System\kyYQQbH.exe
  C:\Windows\System\kyYQQbH.exe
  2⤵
  PID:4892
- C:\Windows\System\idHwEXV.exe
  C:\Windows\System\idHwEXV.exe
  2⤵
  PID:4908
- C:\Windows\System\lEfDTCS.exe
  C:\Windows\System\lEfDTCS.exe
  2⤵
  PID:4924
- C:\Windows\System\jBJhlvL.exe
  C:\Windows\System\jBJhlvL.exe
  2⤵
  PID:4940
- C:\Windows\System\jeEShgB.exe
  C:\Windows\System\jeEShgB.exe
  2⤵
  PID:4956
- C:\Windows\System\DjNClfW.exe
  C:\Windows\System\DjNClfW.exe
  2⤵
  PID:4972
- C:\Windows\System\LpFbvqe.exe
  C:\Windows\System\LpFbvqe.exe
  2⤵
  PID:4992
- C:\Windows\System\cgYqWvj.exe
  C:\Windows\System\cgYqWvj.exe
  2⤵
  PID:5008
- C:\Windows\System\lIYUPrZ.exe
  C:\Windows\System\lIYUPrZ.exe
  2⤵
  PID:5024
- C:\Windows\System\UmRstNJ.exe
  C:\Windows\System\UmRstNJ.exe
  2⤵
  PID:5040
- C:\Windows\System\TdgjPmQ.exe
  C:\Windows\System\TdgjPmQ.exe
  2⤵
  PID:5056
- C:\Windows\System\VigGyna.exe
  C:\Windows\System\VigGyna.exe
  2⤵
  PID:5072
- C:\Windows\System\mPReGAl.exe
  C:\Windows\System\mPReGAl.exe
  2⤵
  PID:5088
- C:\Windows\System\mVGROdi.exe
  C:\Windows\System\mVGROdi.exe
  2⤵
  PID:5104
- C:\Windows\System\HnNahtD.exe
  C:\Windows\System\HnNahtD.exe
  2⤵
  PID:2720
- C:\Windows\System\uafUHGo.exe
  C:\Windows\System\uafUHGo.exe
  2⤵
  PID:1252
- C:\Windows\System\LDAyVdv.exe
  C:\Windows\System\LDAyVdv.exe
  2⤵
  PID:4076
- C:\Windows\System\yBRBMte.exe
  C:\Windows\System\yBRBMte.exe
  2⤵
  PID:4152
- C:\Windows\System\qkvzsMh.exe
  C:\Windows\System\qkvzsMh.exe
  2⤵
  PID:1484
- C:\Windows\System\EIFvPsw.exe
  C:\Windows\System\EIFvPsw.exe
  2⤵
  PID:1340
- C:\Windows\System\MDDGKJv.exe
  C:\Windows\System\MDDGKJv.exe
  2⤵
  PID:4124
- C:\Windows\System\LTxCBeX.exe
  C:\Windows\System\LTxCBeX.exe
  2⤵
  PID:2508
- C:\Windows\System\EuZIKxu.exe
  C:\Windows\System\EuZIKxu.exe
  2⤵
  PID:4228
- C:\Windows\System\sLnSQha.exe
  C:\Windows\System\sLnSQha.exe
  2⤵
  PID:4292
- C:\Windows\System\ywXKAev.exe
  C:\Windows\System\ywXKAev.exe
  2⤵
  PID:4000
- C:\Windows\System\gTAEDqu.exe
  C:\Windows\System\gTAEDqu.exe
  2⤵
  PID:3824
- C:\Windows\System\XZbKxJt.exe
  C:\Windows\System\XZbKxJt.exe
  2⤵
  PID:2704
- C:\Windows\System\JZDmoXF.exe
  C:\Windows\System\JZDmoXF.exe
  2⤵
  PID:4388
- C:\Windows\System\jFIyzCM.exe
  C:\Windows\System\jFIyzCM.exe
  2⤵
  PID:4408
- C:\Windows\System\BSXrbJa.exe
  C:\Windows\System\BSXrbJa.exe
  2⤵
  PID:4392
- C:\Windows\System\ovHSWRU.exe
  C:\Windows\System\ovHSWRU.exe
  2⤵
  PID:4216
- C:\Windows\System\TmpQnDY.exe
  C:\Windows\System\TmpQnDY.exe
  2⤵
  PID:4376
- C:\Windows\System\IVBgHPP.exe
  C:\Windows\System\IVBgHPP.exe
  2⤵
  PID:4248
- C:\Windows\System\MSbBhPO.exe
  C:\Windows\System\MSbBhPO.exe
  2⤵
  PID:4424
- C:\Windows\System\nAVcmwT.exe
  C:\Windows\System\nAVcmwT.exe
  2⤵
  PID:4512
- C:\Windows\System\sPsAIKm.exe
  C:\Windows\System\sPsAIKm.exe
  2⤵
  PID:4552
- C:\Windows\System\vAnmOPt.exe
  C:\Windows\System\vAnmOPt.exe
  2⤵
  PID:4428
- C:\Windows\System\SBnooip.exe
  C:\Windows\System\SBnooip.exe
  2⤵
  PID:4464
- C:\Windows\System\BZeNQRK.exe
  C:\Windows\System\BZeNQRK.exe
  2⤵
  PID:4532
- C:\Windows\System\IVgTnIU.exe
  C:\Windows\System\IVgTnIU.exe
  2⤵
  PID:4600
- C:\Windows\System\AElTLKk.exe
  C:\Windows\System\AElTLKk.exe
  2⤵
  PID:4680
- C:\Windows\System\QxYMTKT.exe
  C:\Windows\System\QxYMTKT.exe
  2⤵
  PID:4632
- C:\Windows\System\MjyrOqF.exe
  C:\Windows\System\MjyrOqF.exe
  2⤵
  PID:4692
- C:\Windows\System\qBbGwuF.exe
  C:\Windows\System\qBbGwuF.exe
  2⤵
  PID:4732
- C:\Windows\System\wuMIpUS.exe
  C:\Windows\System\wuMIpUS.exe
  2⤵
  PID:4796
- C:\Windows\System\WFFiQkE.exe
  C:\Windows\System\WFFiQkE.exe
  2⤵
  PID:4860
- C:\Windows\System\CzFoDuW.exe
  C:\Windows\System\CzFoDuW.exe
  2⤵
  PID:4748
- C:\Windows\System\fPNHAXA.exe
  C:\Windows\System\fPNHAXA.exe
  2⤵
  PID:4812
- C:\Windows\System\WvhDPaI.exe
  C:\Windows\System\WvhDPaI.exe
  2⤵
  PID:4884
- C:\Windows\System\JmOqGzr.exe
  C:\Windows\System\JmOqGzr.exe
  2⤵
  PID:4936
- C:\Windows\System\ZbROcjU.exe
  C:\Windows\System\ZbROcjU.exe
  2⤵
  PID:5000
- C:\Windows\System\IMaLaZD.exe
  C:\Windows\System\IMaLaZD.exe
  2⤵
  PID:5032
- C:\Windows\System\NzOGkyJ.exe
  C:\Windows\System\NzOGkyJ.exe
  2⤵
  PID:4920
- C:\Windows\System\ZrlKAee.exe
  C:\Windows\System\ZrlKAee.exe
  2⤵
  PID:5100
- C:\Windows\System\fOHWRPB.exe
  C:\Windows\System\fOHWRPB.exe
  2⤵
  PID:4144
- C:\Windows\System\nyRymUv.exe
  C:\Windows\System\nyRymUv.exe
  2⤵
  PID:2504
- C:\Windows\System\YppBUJd.exe
  C:\Windows\System\YppBUJd.exe
  2⤵
  PID:3424
- C:\Windows\System\aAYTwgj.exe
  C:\Windows\System\aAYTwgj.exe
  2⤵
  PID:5112
- C:\Windows\System\xsxvHms.exe
  C:\Windows\System\xsxvHms.exe
  2⤵
  PID:3760
- C:\Windows\System\OUpFGsH.exe
  C:\Windows\System\OUpFGsH.exe
  2⤵
  PID:4264
- C:\Windows\System\ZFfVVxm.exe
  C:\Windows\System\ZFfVVxm.exe
  2⤵
  PID:4360
- C:\Windows\System\TxVzqqS.exe
  C:\Windows\System\TxVzqqS.exe
  2⤵
  PID:4340
- C:\Windows\System\LjWltuk.exe
  C:\Windows\System\LjWltuk.exe
  2⤵
  PID:4400
- C:\Windows\System\NpCGFBp.exe
  C:\Windows\System\NpCGFBp.exe
  2⤵
  PID:4244
- C:\Windows\System\wJQIfMi.exe
  C:\Windows\System\wJQIfMi.exe
  2⤵
  PID:4564
- C:\Windows\System\LcxjRRT.exe
  C:\Windows\System\LcxjRRT.exe
  2⤵
  PID:4624
- C:\Windows\System\CPftpXt.exe
  C:\Windows\System\CPftpXt.exe
  2⤵
  PID:3532
- C:\Windows\System\kMLIPLY.exe
  C:\Windows\System\kMLIPLY.exe
  2⤵
  PID:4728
- C:\Windows\System\ImitBlZ.exe
  C:\Windows\System\ImitBlZ.exe
  2⤵
  PID:4584
- C:\Windows\System\doZufdr.exe
  C:\Windows\System\doZufdr.exe
  2⤵
  PID:4660
- C:\Windows\System\zyGsWqt.exe
  C:\Windows\System\zyGsWqt.exe
  2⤵
  PID:4764
- C:\Windows\System\MpahmfI.exe
  C:\Windows\System\MpahmfI.exe
  2⤵
  PID:4848
- C:\Windows\System\ZBXCORR.exe
  C:\Windows\System\ZBXCORR.exe
  2⤵
  PID:4876
- C:\Windows\System\FtavDep.exe
  C:\Windows\System\FtavDep.exe
  2⤵
  PID:5132
- C:\Windows\System\dkRiHVn.exe
  C:\Windows\System\dkRiHVn.exe
  2⤵
  PID:5148
- C:\Windows\System\HKWjZoa.exe
  C:\Windows\System\HKWjZoa.exe
  2⤵
  PID:5164
- C:\Windows\System\ANFuLau.exe
  C:\Windows\System\ANFuLau.exe
  2⤵
  PID:5180
- C:\Windows\System\mswgiAv.exe
  C:\Windows\System\mswgiAv.exe
  2⤵
  PID:5196
- C:\Windows\System\mEUpIjy.exe
  C:\Windows\System\mEUpIjy.exe
  2⤵
  PID:5212
- C:\Windows\System\bjYPcyS.exe
  C:\Windows\System\bjYPcyS.exe
  2⤵
  PID:5228
- C:\Windows\System\yLGRDmb.exe
  C:\Windows\System\yLGRDmb.exe
  2⤵
  PID:5244
- C:\Windows\System\DdnUCml.exe
  C:\Windows\System\DdnUCml.exe
  2⤵
  PID:5260
- C:\Windows\System\HvsbkvC.exe
  C:\Windows\System\HvsbkvC.exe
  2⤵
  PID:5276
- C:\Windows\System\QgdOURk.exe
  C:\Windows\System\QgdOURk.exe
  2⤵
  PID:5292
- C:\Windows\System\gWnTZkN.exe
  C:\Windows\System\gWnTZkN.exe
  2⤵
  PID:5308
- C:\Windows\System\SLVvIFp.exe
  C:\Windows\System\SLVvIFp.exe
  2⤵
  PID:5324
- C:\Windows\System\INaRGpt.exe
  C:\Windows\System\INaRGpt.exe
  2⤵
  PID:5340
- C:\Windows\System\SCeiWjh.exe
  C:\Windows\System\SCeiWjh.exe
  2⤵
  PID:5392
- C:\Windows\System\LMXSxOH.exe
  C:\Windows\System\LMXSxOH.exe
  2⤵
  PID:5408
- C:\Windows\System\wtyUgYr.exe
  C:\Windows\System\wtyUgYr.exe
  2⤵
  PID:5424
- C:\Windows\System\fgCUwga.exe
  C:\Windows\System\fgCUwga.exe
  2⤵
  PID:5440
- C:\Windows\System\dmnWOXP.exe
  C:\Windows\System\dmnWOXP.exe
  2⤵
  PID:5456
- C:\Windows\System\jxFvGhd.exe
  C:\Windows\System\jxFvGhd.exe
  2⤵
  PID:5472
- C:\Windows\System\PNZplDo.exe
  C:\Windows\System\PNZplDo.exe
  2⤵
  PID:5492
- C:\Windows\System\tjziQls.exe
  C:\Windows\System\tjziQls.exe
  2⤵
  PID:5508
- C:\Windows\System\uQGTaPH.exe
  C:\Windows\System\uQGTaPH.exe
  2⤵
  PID:5524
- C:\Windows\System\DPiLrRv.exe
  C:\Windows\System\DPiLrRv.exe
  2⤵
  PID:5540
- C:\Windows\System\FWXlrBM.exe
  C:\Windows\System\FWXlrBM.exe
  2⤵
  PID:5556
- C:\Windows\System\EZxQGTw.exe
  C:\Windows\System\EZxQGTw.exe
  2⤵
  PID:5572
- C:\Windows\System\pUuVndz.exe
  C:\Windows\System\pUuVndz.exe
  2⤵
  PID:5588
- C:\Windows\System\swLvHNs.exe
  C:\Windows\System\swLvHNs.exe
  2⤵
  PID:5608
- C:\Windows\System\wRdwOYs.exe
  C:\Windows\System\wRdwOYs.exe
  2⤵
  PID:5624
- C:\Windows\System\QPBHMiX.exe
  C:\Windows\System\QPBHMiX.exe
  2⤵
  PID:5640
- C:\Windows\System\uYeZtMj.exe
  C:\Windows\System\uYeZtMj.exe
  2⤵
  PID:5656
- C:\Windows\System\wPDPAfM.exe
  C:\Windows\System\wPDPAfM.exe
  2⤵
  PID:5676
- C:\Windows\System\AfRGVGA.exe
  C:\Windows\System\AfRGVGA.exe
  2⤵
  PID:5692
- C:\Windows\System\YtZzWfe.exe
  C:\Windows\System\YtZzWfe.exe
  2⤵
  PID:5708
- C:\Windows\System\PRXUKvP.exe
  C:\Windows\System\PRXUKvP.exe
  2⤵
  PID:5724
- C:\Windows\System\wLcXodk.exe
  C:\Windows\System\wLcXodk.exe
  2⤵
  PID:5740
- C:\Windows\System\vuSfSVW.exe
  C:\Windows\System\vuSfSVW.exe
  2⤵
  PID:5756
- C:\Windows\System\zmwqdwe.exe
  C:\Windows\System\zmwqdwe.exe
  2⤵
  PID:5776
- C:\Windows\System\EtAXPpG.exe
  C:\Windows\System\EtAXPpG.exe
  2⤵
  PID:5792
- C:\Windows\System\vfUtBHv.exe
  C:\Windows\System\vfUtBHv.exe
  2⤵
  PID:5808
- C:\Windows\System\vmmKJGW.exe
  C:\Windows\System\vmmKJGW.exe
  2⤵
  PID:5824
- C:\Windows\System\EINEClx.exe
  C:\Windows\System\EINEClx.exe
  2⤵
  PID:5844
- C:\Windows\System\lSCUdIo.exe
  C:\Windows\System\lSCUdIo.exe
  2⤵
  PID:5860
- C:\Windows\System\tXgIUGH.exe
  C:\Windows\System\tXgIUGH.exe
  2⤵
  PID:5876
- C:\Windows\System\jievGCR.exe
  C:\Windows\System\jievGCR.exe
  2⤵
  PID:5892
- C:\Windows\System\XheoSIP.exe
  C:\Windows\System\XheoSIP.exe
  2⤵
  PID:5908
- C:\Windows\System\LrodzVL.exe
  C:\Windows\System\LrodzVL.exe
  2⤵
  PID:5924
- C:\Windows\System\SzwLbsO.exe
  C:\Windows\System\SzwLbsO.exe
  2⤵
  PID:5940
- C:\Windows\System\sEalDOW.exe
  C:\Windows\System\sEalDOW.exe
  2⤵
  PID:5956
- C:\Windows\System\gzlBlKk.exe
  C:\Windows\System\gzlBlKk.exe
  2⤵
  PID:5972
- C:\Windows\System\hUyaHkc.exe
  C:\Windows\System\hUyaHkc.exe
  2⤵
  PID:5988
- C:\Windows\System\PbodTgR.exe
  C:\Windows\System\PbodTgR.exe
  2⤵
  PID:6008
- C:\Windows\System\SxfyueE.exe
  C:\Windows\System\SxfyueE.exe
  2⤵
  PID:6024
- C:\Windows\System\uxugJBS.exe
  C:\Windows\System\uxugJBS.exe
  2⤵
  PID:6040
- C:\Windows\System\bvpCYLY.exe
  C:\Windows\System\bvpCYLY.exe
  2⤵
  PID:6056
- C:\Windows\System\aLbjiOE.exe
  C:\Windows\System\aLbjiOE.exe
  2⤵
  PID:6076
- C:\Windows\System\rYvZIdk.exe
  C:\Windows\System\rYvZIdk.exe
  2⤵
  PID:6092
- C:\Windows\System\LtisPNe.exe
  C:\Windows\System\LtisPNe.exe
  2⤵
  PID:6108
- C:\Windows\System\WuQLEcf.exe
  C:\Windows\System\WuQLEcf.exe
  2⤵
  PID:6124
- C:\Windows\System\xPwLKJn.exe
  C:\Windows\System\xPwLKJn.exe
  2⤵
  PID:6140
- C:\Windows\System\toAOFcQ.exe
  C:\Windows\System\toAOFcQ.exe
  2⤵
  PID:2004
- C:\Windows\System\WBzjqxG.exe
  C:\Windows\System\WBzjqxG.exe
  2⤵
  PID:4988
- C:\Windows\System\EaUvAPo.exe
  C:\Windows\System\EaUvAPo.exe
  2⤵
  PID:4948
- C:\Windows\System\WRRUdAN.exe
  C:\Windows\System\WRRUdAN.exe
  2⤵
  PID:4260
- C:\Windows\System\fifEvyn.exe
  C:\Windows\System\fifEvyn.exe
  2⤵
  PID:4200
- C:\Windows\System\cWhpOWK.exe
  C:\Windows\System\cWhpOWK.exe
  2⤵
  PID:4372
- C:\Windows\System\qBHQvqL.exe
  C:\Windows\System\qBHQvqL.exe
  2⤵
  PID:4500
- C:\Windows\System\KYZhlHk.exe
  C:\Windows\System\KYZhlHk.exe
  2⤵
  PID:4484
- C:\Windows\System\waMgXAs.exe
  C:\Windows\System\waMgXAs.exe
  2⤵
  PID:484
- C:\Windows\System\FWrDgZH.exe
  C:\Windows\System\FWrDgZH.exe
  2⤵
  PID:4448
- C:\Windows\System\YNtIbFk.exe
  C:\Windows\System\YNtIbFk.exe
  2⤵
  PID:5356
- C:\Windows\System\CaSTtzE.exe
  C:\Windows\System\CaSTtzE.exe
  2⤵
  PID:5380
- C:\Windows\System\MWmhavL.exe
  C:\Windows\System\MWmhavL.exe
  2⤵
  PID:1864
- C:\Windows\System\qRMIgLv.exe
  C:\Windows\System\qRMIgLv.exe
  2⤵
  PID:4324
- C:\Windows\System\pEwxFCV.exe
  C:\Windows\System\pEwxFCV.exe
  2⤵
  PID:5204
- C:\Windows\System\QPzGyFm.exe
  C:\Windows\System\QPzGyFm.exe
  2⤵
  PID:5144
- C:\Windows\System\axzRfVP.exe
  C:\Windows\System\axzRfVP.exe
  2⤵
  PID:5208
- C:\Windows\System\QlUMofD.exe
  C:\Windows\System\QlUMofD.exe
  2⤵
  PID:5300
- C:\Windows\System\UuCAmfC.exe
  C:\Windows\System\UuCAmfC.exe
  2⤵
  PID:5400
- C:\Windows\System\lUtWygd.exe
  C:\Windows\System\lUtWygd.exe
  2⤵
  PID:5468
- C:\Windows\System\bbwZqdr.exe
  C:\Windows\System\bbwZqdr.exe
  2⤵
  PID:5536
- C:\Windows\System\UjcfjIg.exe
  C:\Windows\System\UjcfjIg.exe
  2⤵
  PID:5448
- C:\Windows\System\jqqfjYG.exe
  C:\Windows\System\jqqfjYG.exe
  2⤵
  PID:5488
- C:\Windows\System\LjHKCiG.exe
  C:\Windows\System\LjHKCiG.exe
  2⤵
  PID:5552
- C:\Windows\System\HqqajFb.exe
  C:\Windows\System\HqqajFb.exe
  2⤵
  PID:5616
- C:\Windows\System\izIAfTu.exe
  C:\Windows\System\izIAfTu.exe
  2⤵
  PID:5684
- C:\Windows\System\zPHMvNB.exe
  C:\Windows\System\zPHMvNB.exe
  2⤵
  PID:5748
- C:\Windows\System\QpifdkA.exe
  C:\Windows\System\QpifdkA.exe
  2⤵
  PID:5820
- C:\Windows\System\lWXvufR.exe
  C:\Windows\System\lWXvufR.exe
  2⤵
  PID:5888
- C:\Windows\System\PgDdOvE.exe
  C:\Windows\System\PgDdOvE.exe
  2⤵
  PID:5884
- C:\Windows\System\ILRSiVi.exe
  C:\Windows\System\ILRSiVi.exe
  2⤵
  PID:5636
- C:\Windows\System\VerNVDK.exe
  C:\Windows\System\VerNVDK.exe
  2⤵
  PID:5800
- C:\Windows\System\jRdEkMI.exe
  C:\Windows\System\jRdEkMI.exe
  2⤵
  PID:5804
- C:\Windows\System\brhTFKw.exe
  C:\Windows\System\brhTFKw.exe
  2⤵
  PID:5868
- C:\Windows\System\cskeqbF.exe
  C:\Windows\System\cskeqbF.exe
  2⤵
  PID:5936
- C:\Windows\System\KUEUhoA.exe
  C:\Windows\System\KUEUhoA.exe
  2⤵
  PID:5952
- C:\Windows\System\nKiNjqX.exe
  C:\Windows\System\nKiNjqX.exe
  2⤵
  PID:6020
- C:\Windows\System\Suraxck.exe
  C:\Windows\System\Suraxck.exe
  2⤵
  PID:6088
- C:\Windows\System\ZfVBUZr.exe
  C:\Windows\System\ZfVBUZr.exe
  2⤵
  PID:5020
- C:\Windows\System\zsBohuw.exe
  C:\Windows\System\zsBohuw.exe
  2⤵
  PID:4212
- C:\Windows\System\etqdgoT.exe
  C:\Windows\System\etqdgoT.exe
  2⤵
  PID:1044
- C:\Windows\System\orbvdlw.exe
  C:\Windows\System\orbvdlw.exe
  2⤵
  PID:5252
- C:\Windows\System\FvbammH.exe
  C:\Windows\System\FvbammH.exe
  2⤵
  PID:5288
- C:\Windows\System\CmuALdm.exe
  C:\Windows\System\CmuALdm.exe
  2⤵
  PID:5968
- C:\Windows\System\HIzsaIH.exe
  C:\Windows\System\HIzsaIH.exe
  2⤵
  PID:6004
- C:\Windows\System\gfkzsgf.exe
  C:\Windows\System\gfkzsgf.exe
  2⤵
  PID:6068
- C:\Windows\System\EPwpowx.exe
  C:\Windows\System\EPwpowx.exe
  2⤵
  PID:6132
- C:\Windows\System\REngdxb.exe
  C:\Windows\System\REngdxb.exe
  2⤵
  PID:5084
- C:\Windows\System\PgZINXV.exe
  C:\Windows\System\PgZINXV.exe
  2⤵
  PID:2700
- C:\Windows\System\LSqAkwc.exe
  C:\Windows\System\LSqAkwc.exe
  2⤵
  PID:5188
- C:\Windows\System\yhzKuxO.exe
  C:\Windows\System\yhzKuxO.exe
  2⤵
  PID:5384
- C:\Windows\System\FMKSVAD.exe
  C:\Windows\System\FMKSVAD.exe
  2⤵
  PID:5176
- C:\Windows\System\FqMCxiL.exe
  C:\Windows\System\FqMCxiL.exe
  2⤵
  PID:5480
- C:\Windows\System\cZVQkyw.exe
  C:\Windows\System\cZVQkyw.exe
  2⤵
  PID:5688
- C:\Windows\System\qMWqkOW.exe
  C:\Windows\System\qMWqkOW.exe
  2⤵
  PID:5856
- C:\Windows\System\YravHVP.exe
  C:\Windows\System\YravHVP.exe
  2⤵
  PID:5732
- C:\Windows\System\ulfSGDv.exe
  C:\Windows\System\ulfSGDv.exe
  2⤵
  PID:5372
- C:\Windows\System\NkLBzPC.exe
  C:\Windows\System\NkLBzPC.exe
  2⤵
  PID:5240
- C:\Windows\System\YXQguLx.exe
  C:\Windows\System\YXQguLx.exe
  2⤵
  PID:5436
- C:\Windows\System\ZdoTJho.exe
  C:\Windows\System\ZdoTJho.exe
  2⤵
  PID:5548
- C:\Windows\System\HRLooxI.exe
  C:\Windows\System\HRLooxI.exe
  2⤵
  PID:5648
- C:\Windows\System\HSUHpHX.exe
  C:\Windows\System\HSUHpHX.exe
  2⤵
  PID:5920
- C:\Windows\System\abviAHd.exe
  C:\Windows\System\abviAHd.exe
  2⤵
  PID:5772
- C:\Windows\System\RlGqZYg.exe
  C:\Windows\System\RlGqZYg.exe
  2⤵
  PID:6120
- C:\Windows\System\zzhPzUv.exe
  C:\Windows\System\zzhPzUv.exe
  2⤵
  PID:5964
- C:\Windows\System\kZJhoDB.exe
  C:\Windows\System\kZJhoDB.exe
  2⤵
  PID:6160
- C:\Windows\System\HsPXzBz.exe
  C:\Windows\System\HsPXzBz.exe
  2⤵
  PID:6176
- C:\Windows\System\VUhmzIe.exe
  C:\Windows\System\VUhmzIe.exe
  2⤵
  PID:6192
- C:\Windows\System\wTNvheo.exe
  C:\Windows\System\wTNvheo.exe
  2⤵
  PID:6208
- C:\Windows\System\RnAtecf.exe
  C:\Windows\System\RnAtecf.exe
  2⤵
  PID:6228
- C:\Windows\System\bzzutxR.exe
  C:\Windows\System\bzzutxR.exe
  2⤵
  PID:6244
- C:\Windows\System\zsmZpny.exe
  C:\Windows\System\zsmZpny.exe
  2⤵
  PID:6264
- C:\Windows\System\Mbjvelz.exe
  C:\Windows\System\Mbjvelz.exe
  2⤵
  PID:6280
- C:\Windows\System\stryzxP.exe
  C:\Windows\System\stryzxP.exe
  2⤵
  PID:6296
- C:\Windows\System\MgKMMfT.exe
  C:\Windows\System\MgKMMfT.exe
  2⤵
  PID:6312
- C:\Windows\System\MxBKPGB.exe
  C:\Windows\System\MxBKPGB.exe
  2⤵
  PID:6676
- C:\Windows\System\BJpIkSM.exe
  C:\Windows\System\BJpIkSM.exe
  2⤵
  PID:6788
- C:\Windows\System\zSqRbQh.exe
  C:\Windows\System\zSqRbQh.exe
  2⤵
  PID:6824
- C:\Windows\System\kLCNhxr.exe
  C:\Windows\System\kLCNhxr.exe
  2⤵
  PID:6840
- C:\Windows\System\HEIHwWO.exe
  C:\Windows\System\HEIHwWO.exe
  2⤵
  PID:6860
- C:\Windows\System\ZvoaxLt.exe
  C:\Windows\System\ZvoaxLt.exe
  2⤵
  PID:6880
- C:\Windows\System\PGusrlH.exe
  C:\Windows\System\PGusrlH.exe
  2⤵
  PID:6896
- C:\Windows\System\xKmoYGb.exe
  C:\Windows\System\xKmoYGb.exe
  2⤵
  PID:6916
- C:\Windows\System\RjiGWOW.exe
  C:\Windows\System\RjiGWOW.exe
  2⤵
  PID:6932
- C:\Windows\System\aXvAvlu.exe
  C:\Windows\System\aXvAvlu.exe
  2⤵
  PID:6948
- C:\Windows\System\fJoBldz.exe
  C:\Windows\System\fJoBldz.exe
  2⤵
  PID:6968
- C:\Windows\System\iNnrEiG.exe
  C:\Windows\System\iNnrEiG.exe
  2⤵
  PID:7024
- C:\Windows\System\eNlfoXN.exe
  C:\Windows\System\eNlfoXN.exe
  2⤵
  PID:7100
- C:\Windows\System\UfqQMBy.exe
  C:\Windows\System\UfqQMBy.exe
  2⤵
  PID:7132
- C:\Windows\System\TUxwjoU.exe
  C:\Windows\System\TUxwjoU.exe
  2⤵
  PID:5720
- C:\Windows\System\djladcV.exe
  C:\Windows\System\djladcV.exe
  2⤵
  PID:5272
- C:\Windows\System\GCVjQca.exe
  C:\Windows\System\GCVjQca.exe
  2⤵
  PID:5904
- C:\Windows\System\YUlYXIU.exe
  C:\Windows\System\YUlYXIU.exe
  2⤵
  PID:6216
- C:\Windows\System\vHQplVt.exe
  C:\Windows\System\vHQplVt.exe
  2⤵
  PID:6292
- C:\Windows\System\oKEwwml.exe
  C:\Windows\System\oKEwwml.exe
  2⤵
  PID:2164
- C:\Windows\System\ZxAqVvS.exe
  C:\Windows\System\ZxAqVvS.exe
  2⤵
  PID:4164
- C:\Windows\System\vbIFdNh.exe
  C:\Windows\System\vbIFdNh.exe
  2⤵
  PID:4904
- C:\Windows\System\hPNNHKn.exe
  C:\Windows\System\hPNNHKn.exe
  2⤵
  PID:4916
- C:\Windows\System\xBnVQFR.exe
  C:\Windows\System\xBnVQFR.exe
  2⤵
  PID:5632
- C:\Windows\System\ehEwpLt.exe
  C:\Windows\System\ehEwpLt.exe
  2⤵
  PID:6260
- C:\Windows\System\KWQjENO.exe
  C:\Windows\System\KWQjENO.exe
  2⤵
  PID:6464
- C:\Windows\System\abfZweP.exe
  C:\Windows\System\abfZweP.exe
  2⤵
  PID:6428
- C:\Windows\System\kJiTCNG.exe
  C:\Windows\System\kJiTCNG.exe
  2⤵
  PID:6352
- C:\Windows\System\KjqoItO.exe
  C:\Windows\System\KjqoItO.exe
  2⤵
  PID:6408
- C:\Windows\System\TUUzVwy.exe
  C:\Windows\System\TUUzVwy.exe
  2⤵
  PID:6468
- C:\Windows\System\pMoiixt.exe
  C:\Windows\System\pMoiixt.exe
  2⤵
  PID:6500
- C:\Windows\System\RPDKEWy.exe
  C:\Windows\System\RPDKEWy.exe
  2⤵
  PID:6544
- C:\Windows\System\fTOukte.exe
  C:\Windows\System\fTOukte.exe
  2⤵
  PID:6556
- C:\Windows\System\MjccAJT.exe
  C:\Windows\System\MjccAJT.exe
  2⤵
  PID:6576
- C:\Windows\System\xyBZRXC.exe
  C:\Windows\System\xyBZRXC.exe
  2⤵
  PID:6592
- C:\Windows\System\wENPGSE.exe
  C:\Windows\System\wENPGSE.exe
  2⤵
  PID:6652
- C:\Windows\System\ciSipja.exe
  C:\Windows\System\ciSipja.exe
  2⤵
  PID:6620
- C:\Windows\System\EWUivFq.exe
  C:\Windows\System\EWUivFq.exe
  2⤵
  PID:6644
- C:\Windows\System\qkHhQjo.exe
  C:\Windows\System\qkHhQjo.exe
  2⤵
  PID:6668
- C:\Windows\System\pxcCHIM.exe
  C:\Windows\System\pxcCHIM.exe
  2⤵
  PID:6700
- C:\Windows\System\qQGgnBx.exe
  C:\Windows\System\qQGgnBx.exe
  2⤵
  PID:6712
- C:\Windows\System\aIwEMOT.exe
  C:\Windows\System\aIwEMOT.exe
  2⤵
  PID:6720
- C:\Windows\System\yqeGyUV.exe
  C:\Windows\System\yqeGyUV.exe
  2⤵
  PID:6736
- C:\Windows\System\LClTxFc.exe
  C:\Windows\System\LClTxFc.exe
  2⤵
  PID:6776
- C:\Windows\System\dEYbARX.exe
  C:\Windows\System\dEYbARX.exe
  2⤵
  PID:6816
- C:\Windows\System\oTWVCaf.exe
  C:\Windows\System\oTWVCaf.exe
  2⤵
  PID:6960
- C:\Windows\System\XIsVjkA.exe
  C:\Windows\System\XIsVjkA.exe
  2⤵
  PID:7036
- C:\Windows\System\pktItTl.exe
  C:\Windows\System\pktItTl.exe
  2⤵
  PID:7044
- C:\Windows\System\OlgDbqb.exe
  C:\Windows\System\OlgDbqb.exe
  2⤵
  PID:7056
- C:\Windows\System\GHqqaTH.exe
  C:\Windows\System\GHqqaTH.exe
  2⤵
  PID:7012
- C:\Windows\System\sPMZGXY.exe
  C:\Windows\System\sPMZGXY.exe
  2⤵
  PID:7076
- C:\Windows\System\fTwapnV.exe
  C:\Windows\System\fTwapnV.exe
  2⤵
  PID:7092
- C:\Windows\System\VtiMtWv.exe
  C:\Windows\System\VtiMtWv.exe
  2⤵
  PID:7112
- C:\Windows\System\TBBzQJG.exe
  C:\Windows\System\TBBzQJG.exe
  2⤵
  PID:7120
- C:\Windows\System\yewsfgb.exe
  C:\Windows\System\yewsfgb.exe
  2⤵
  PID:4528
- C:\Windows\System\KsGIojB.exe
  C:\Windows\System\KsGIojB.exe
  2⤵
  PID:5504
- C:\Windows\System\VCMhtar.exe
  C:\Windows\System\VCMhtar.exe
  2⤵
  PID:5788
- C:\Windows\System\sassIck.exe
  C:\Windows\System\sassIck.exe
  2⤵
  PID:6252
- C:\Windows\System\AnmwYLc.exe
  C:\Windows\System\AnmwYLc.exe
  2⤵
  PID:4620
- C:\Windows\System\ttRsWBT.exe
  C:\Windows\System\ttRsWBT.exe
  2⤵
  PID:6200
- C:\Windows\System\oBkkymC.exe
  C:\Windows\System\oBkkymC.exe
  2⤵
  PID:5584
- C:\Windows\System\qjpzOcN.exe
  C:\Windows\System\qjpzOcN.exe
  2⤵
  PID:5836
- C:\Windows\System\zhsgrpB.exe
  C:\Windows\System\zhsgrpB.exe
  2⤵
  PID:6052
- C:\Windows\System\UgFNGtq.exe
  C:\Windows\System\UgFNGtq.exe
  2⤵
  PID:5564
- C:\Windows\System\PGjlMSD.exe
  C:\Windows\System\PGjlMSD.exe
  2⤵
  PID:5172
- C:\Windows\System\JIpNbwT.exe
  C:\Windows\System\JIpNbwT.exe
  2⤵
  PID:6220
- C:\Windows\System\mOnximw.exe
  C:\Windows\System\mOnximw.exe
  2⤵
  PID:6336
- C:\Windows\System\pBOkiZe.exe
  C:\Windows\System\pBOkiZe.exe
  2⤵
  PID:6460
- C:\Windows\System\KvliQGk.exe
  C:\Windows\System\KvliQGk.exe
  2⤵
  PID:6372
- C:\Windows\System\AIEDXFs.exe
  C:\Windows\System\AIEDXFs.exe
  2⤵
  PID:6388
- C:\Windows\System\ngVfQWW.exe
  C:\Windows\System\ngVfQWW.exe
  2⤵
  PID:6416
- C:\Windows\System\eoivHVW.exe
  C:\Windows\System\eoivHVW.exe
  2⤵
  PID:6444
- C:\Windows\System\DZqjKuF.exe
  C:\Windows\System\DZqjKuF.exe
  2⤵
  PID:6512
- C:\Windows\System\MILmYEf.exe
  C:\Windows\System\MILmYEf.exe
  2⤵
  PID:6452
- C:\Windows\System\oKbczLm.exe
  C:\Windows\System\oKbczLm.exe
  2⤵
  PID:6484
- C:\Windows\System\nbXokdi.exe
  C:\Windows\System\nbXokdi.exe
  2⤵
  PID:6536
- C:\Windows\System\sNobsrz.exe
  C:\Windows\System\sNobsrz.exe
  2⤵
  PID:6564
- C:\Windows\System\fLwSGWG.exe
  C:\Windows\System\fLwSGWG.exe
  2⤵
  PID:6632
- C:\Windows\System\LTGTaFn.exe
  C:\Windows\System\LTGTaFn.exe
  2⤵
  PID:6728
- C:\Windows\System\WEXvRZU.exe
  C:\Windows\System\WEXvRZU.exe
  2⤵
  PID:6780
- C:\Windows\System\KyGiixA.exe
  C:\Windows\System\KyGiixA.exe
  2⤵
  PID:6908
- C:\Windows\System\sHbqadC.exe
  C:\Windows\System\sHbqadC.exe
  2⤵
  PID:6944
- C:\Windows\System\NpwugLX.exe
  C:\Windows\System\NpwugLX.exe
  2⤵
  PID:6812
- C:\Windows\System\nMhRmoJ.exe
  C:\Windows\System\nMhRmoJ.exe
  2⤵
  PID:6964
- C:\Windows\System\xReRyvw.exe
  C:\Windows\System\xReRyvw.exe
  2⤵
  PID:6552
- C:\Windows\System\NNxxSuW.exe
  C:\Windows\System\NNxxSuW.exe
  2⤵
  PID:6696
- C:\Windows\System\zVqpsQY.exe
  C:\Windows\System\zVqpsQY.exe
  2⤵
  PID:6184
- C:\Windows\System\yvHaYyz.exe
  C:\Windows\System\yvHaYyz.exe
  2⤵
  PID:6608
- C:\Windows\System\fBShNTT.exe
  C:\Windows\System\fBShNTT.exe
  2⤵
  PID:6740
- C:\Windows\System\gLvPqPf.exe
  C:\Windows\System\gLvPqPf.exe
  2⤵
  PID:6924
- C:\Windows\System\PXhRTtu.exe
  C:\Windows\System\PXhRTtu.exe
  2⤵
  PID:7000
- C:\Windows\System\NeekLtj.exe
  C:\Windows\System\NeekLtj.exe
  2⤵
  PID:7088
- C:\Windows\System\gbIiYEQ.exe
  C:\Windows\System\gbIiYEQ.exe
  2⤵
  PID:6804
- C:\Windows\System\BilgvZB.exe
  C:\Windows\System\BilgvZB.exe
  2⤵
  PID:6984
- C:\Windows\System\xXcnhZF.exe
  C:\Windows\System\xXcnhZF.exe
  2⤵
  PID:7052
- C:\Windows\System\trYkLgv.exe
  C:\Windows\System\trYkLgv.exe
  2⤵
  PID:6172
- C:\Windows\System\xsxFZtm.exe
  C:\Windows\System\xsxFZtm.exe
  2⤵
  PID:5532
- C:\Windows\System\kjmOZFp.exe
  C:\Windows\System\kjmOZFp.exe
  2⤵
  PID:4744
- C:\Windows\System\UMqoCUp.exe
  C:\Windows\System\UMqoCUp.exe
  2⤵
  PID:7108
- C:\Windows\System\NfJIcoe.exe
  C:\Windows\System\NfJIcoe.exe
  2⤵
  PID:6236
- C:\Windows\System\vqCLpVz.exe
  C:\Windows\System\vqCLpVz.exe
  2⤵
  PID:4132
- C:\Windows\System\qyNTtoI.exe
  C:\Windows\System\qyNTtoI.exe
  2⤵
  PID:6436
- C:\Windows\System\dyQxyOC.exe
  C:\Windows\System\dyQxyOC.exe
  2⤵
  PID:4356
- C:\Windows\System\YlNnhSs.exe
  C:\Windows\System\YlNnhSs.exe
  2⤵
  PID:5704
- C:\Windows\System\lohfFEo.exe
  C:\Windows\System\lohfFEo.exe
  2⤵
  PID:6396
- C:\Windows\System\igoNIcx.exe
  C:\Windows\System\igoNIcx.exe
  2⤵
  PID:6772
- C:\Windows\System\KrKhryi.exe
  C:\Windows\System\KrKhryi.exe
  2⤵
  PID:6852
- C:\Windows\System\nEaUptK.exe
  C:\Windows\System\nEaUptK.exe
  2⤵
  PID:6664
- C:\Windows\System\hDbNWVq.exe
  C:\Windows\System\hDbNWVq.exe
  2⤵
  PID:6768
- C:\Windows\System\EtQBxdz.exe
  C:\Windows\System\EtQBxdz.exe
  2⤵
  PID:7008
- C:\Windows\System\ilaOQsl.exe
  C:\Windows\System\ilaOQsl.exe
  2⤵
  PID:6988
- C:\Windows\System\aNVSJNn.exe
  C:\Windows\System\aNVSJNn.exe
  2⤵
  PID:6404
- C:\Windows\System\tJbuBoo.exe
  C:\Windows\System\tJbuBoo.exe
  2⤵
  PID:6480
- C:\Windows\System\JfalCpY.exe
  C:\Windows\System\JfalCpY.exe
  2⤵
  PID:5516
- C:\Windows\System\uyTAnRi.exe
  C:\Windows\System\uyTAnRi.exe
  2⤵
  PID:6656
- C:\Windows\System\SvlJRMF.exe
  C:\Windows\System\SvlJRMF.exe
  2⤵
  PID:6476
- C:\Windows\System\pBiYvTJ.exe
  C:\Windows\System\pBiYvTJ.exe
  2⤵
  PID:6524
- C:\Windows\System\YCwQQYl.exe
  C:\Windows\System\YCwQQYl.exe
  2⤵
  PID:6892
- C:\Windows\System\UgTdkUQ.exe
  C:\Windows\System\UgTdkUQ.exe
  2⤵
  PID:7032
- C:\Windows\System\kJmkjEB.exe
  C:\Windows\System\kJmkjEB.exe
  2⤵
  PID:6332
- C:\Windows\System\LYWLjQx.exe
  C:\Windows\System\LYWLjQx.exe
  2⤵
  PID:5336
- C:\Windows\System\FCvPSVy.exe
  C:\Windows\System\FCvPSVy.exe
  2⤵
  PID:6368
- C:\Windows\System\EKpcTfZ.exe
  C:\Windows\System\EKpcTfZ.exe
  2⤵
  PID:5668
- C:\Windows\System\FxGZgmO.exe
  C:\Windows\System\FxGZgmO.exe
  2⤵
  PID:7144
- C:\Windows\System\koShBgo.exe
  C:\Windows\System\koShBgo.exe
  2⤵
  PID:6328
- C:\Windows\System\hTFXEwN.exe
  C:\Windows\System\hTFXEwN.exe
  2⤵
  PID:7072
- C:\Windows\System\pPxgwAe.exe
  C:\Windows\System\pPxgwAe.exe
  2⤵
  PID:6784
- C:\Windows\System\AdoMuBf.exe
  C:\Windows\System\AdoMuBf.exe
  2⤵
  PID:6708
- C:\Windows\System\EujApGG.exe
  C:\Windows\System\EujApGG.exe
  2⤵
  PID:6168
- C:\Windows\System\thtYIaN.exe
  C:\Windows\System\thtYIaN.exe
  2⤵
  PID:6272
- C:\Windows\System\KGSOZNz.exe
  C:\Windows\System\KGSOZNz.exe
  2⤵
  PID:6856
- C:\Windows\System\gqRkhih.exe
  C:\Windows\System\gqRkhih.exe
  2⤵
  PID:6508
- C:\Windows\System\xnrXttk.exe
  C:\Windows\System\xnrXttk.exe
  2⤵
  PID:5600
- C:\Windows\System\SsmFhZw.exe
  C:\Windows\System\SsmFhZw.exe
  2⤵
  PID:6872
- C:\Windows\System\FrcMvqf.exe
  C:\Windows\System\FrcMvqf.exe
  2⤵
  PID:6384
- C:\Windows\System\zjQrkuD.exe
  C:\Windows\System\zjQrkuD.exe
  2⤵
  PID:5140
- C:\Windows\System\ryAYNPg.exe
  C:\Windows\System\ryAYNPg.exe
  2⤵
  PID:6980
- C:\Windows\System\feXqMWT.exe
  C:\Windows\System\feXqMWT.exe
  2⤵
  PID:7084
- C:\Windows\System\bJNOAap.exe
  C:\Windows\System\bJNOAap.exe
  2⤵
  PID:1568
- C:\Windows\System\xxexAyz.exe
  C:\Windows\System\xxexAyz.exe
  2⤵
  PID:7172
- C:\Windows\System\HKLceqv.exe
  C:\Windows\System\HKLceqv.exe
  2⤵
  PID:7188
- C:\Windows\System\DnRQPsr.exe
  C:\Windows\System\DnRQPsr.exe
  2⤵
  PID:7204
- C:\Windows\System\fjtfOUC.exe
  C:\Windows\System\fjtfOUC.exe
  2⤵
  PID:7220
- C:\Windows\System\PPDGKFO.exe
  C:\Windows\System\PPDGKFO.exe
  2⤵
  PID:7236
- C:\Windows\System\jdGaIDj.exe
  C:\Windows\System\jdGaIDj.exe
  2⤵
  PID:7252
- C:\Windows\System\yTxjeQK.exe
  C:\Windows\System\yTxjeQK.exe
  2⤵
  PID:7268
- C:\Windows\System\cmOHDPa.exe
  C:\Windows\System\cmOHDPa.exe
  2⤵
  PID:7284
- C:\Windows\System\TZcHYYt.exe
  C:\Windows\System\TZcHYYt.exe
  2⤵
  PID:7300
- C:\Windows\System\AWkRlGm.exe
  C:\Windows\System\AWkRlGm.exe
  2⤵
  PID:7316
- C:\Windows\System\ZCFaTJE.exe
  C:\Windows\System\ZCFaTJE.exe
  2⤵
  PID:7332
- C:\Windows\System\NXsoyOE.exe
  C:\Windows\System\NXsoyOE.exe
  2⤵
  PID:7348
- C:\Windows\System\yeAFdHo.exe
  C:\Windows\System\yeAFdHo.exe
  2⤵
  PID:7364
- C:\Windows\System\GHPJYUF.exe
  C:\Windows\System\GHPJYUF.exe
  2⤵
  PID:7380
- C:\Windows\System\uqLqyoS.exe
  C:\Windows\System\uqLqyoS.exe
  2⤵
  PID:7396
- C:\Windows\System\mJGdBqu.exe
  C:\Windows\System\mJGdBqu.exe
  2⤵
  PID:7412
- C:\Windows\System\QuwqIno.exe
  C:\Windows\System\QuwqIno.exe
  2⤵
  PID:7428
- C:\Windows\System\OwHeGmA.exe
  C:\Windows\System\OwHeGmA.exe
  2⤵
  PID:7444
- C:\Windows\System\pjhizzp.exe
  C:\Windows\System\pjhizzp.exe
  2⤵
  PID:7460
- C:\Windows\System\ZLOOFDT.exe
  C:\Windows\System\ZLOOFDT.exe
  2⤵
  PID:7476
- C:\Windows\System\FJRBwOY.exe
  C:\Windows\System\FJRBwOY.exe
  2⤵
  PID:7492
- C:\Windows\System\pMSoCSD.exe
  C:\Windows\System\pMSoCSD.exe
  2⤵
  PID:7508
- C:\Windows\System\YFliOUO.exe
  C:\Windows\System\YFliOUO.exe
  2⤵
  PID:7524
- C:\Windows\System\pFNHDqo.exe
  C:\Windows\System\pFNHDqo.exe
  2⤵
  PID:7540
- C:\Windows\System\gaXaCkq.exe
  C:\Windows\System\gaXaCkq.exe
  2⤵
  PID:7556
- C:\Windows\System\pqOVMBv.exe
  C:\Windows\System\pqOVMBv.exe
  2⤵
  PID:7572
- C:\Windows\System\TaYBfYu.exe
  C:\Windows\System\TaYBfYu.exe
  2⤵
  PID:7588
- C:\Windows\System\wiSLNrv.exe
  C:\Windows\System\wiSLNrv.exe
  2⤵
  PID:7604
- C:\Windows\System\OXLXpHH.exe
  C:\Windows\System\OXLXpHH.exe
  2⤵
  PID:7620
- C:\Windows\System\pKDRKvg.exe
  C:\Windows\System\pKDRKvg.exe
  2⤵
  PID:7636
- C:\Windows\System\eIoQLin.exe
  C:\Windows\System\eIoQLin.exe
  2⤵
  PID:7652
- C:\Windows\System\HedAVaw.exe
  C:\Windows\System\HedAVaw.exe
  2⤵
  PID:7668
- C:\Windows\System\cdSMFmO.exe
  C:\Windows\System\cdSMFmO.exe
  2⤵
  PID:7684
- C:\Windows\System\RuHCTXA.exe
  C:\Windows\System\RuHCTXA.exe
  2⤵
  PID:7700
- C:\Windows\System\JtsJzSo.exe
  C:\Windows\System\JtsJzSo.exe
  2⤵
  PID:7716
- C:\Windows\System\zLRerzx.exe
  C:\Windows\System\zLRerzx.exe
  2⤵
  PID:7732
- C:\Windows\System\zELGEXU.exe
  C:\Windows\System\zELGEXU.exe
  2⤵
  PID:7748
- C:\Windows\System\dQoePip.exe
  C:\Windows\System\dQoePip.exe
  2⤵
  PID:7764
- C:\Windows\System\ELLPfiI.exe
  C:\Windows\System\ELLPfiI.exe
  2⤵
  PID:7780
- C:\Windows\System\LVFTLHt.exe
  C:\Windows\System\LVFTLHt.exe
  2⤵
  PID:7796
- C:\Windows\System\zxkZsOZ.exe
  C:\Windows\System\zxkZsOZ.exe
  2⤵
  PID:7812
- C:\Windows\System\gvGmvPm.exe
  C:\Windows\System\gvGmvPm.exe
  2⤵
  PID:7828
- C:\Windows\System\qrtkBrC.exe
  C:\Windows\System\qrtkBrC.exe
  2⤵
  PID:7844
- C:\Windows\System\qfftnfk.exe
  C:\Windows\System\qfftnfk.exe
  2⤵
  PID:7860
- C:\Windows\System\XXvmXcv.exe
  C:\Windows\System\XXvmXcv.exe
  2⤵
  PID:7880
- C:\Windows\System\XIauQsb.exe
  C:\Windows\System\XIauQsb.exe
  2⤵
  PID:7896
- C:\Windows\System\JHPMcKb.exe
  C:\Windows\System\JHPMcKb.exe
  2⤵
  PID:7912
- C:\Windows\System\ZEcsdgn.exe
  C:\Windows\System\ZEcsdgn.exe
  2⤵
  PID:7928
- C:\Windows\System\LpdDoBd.exe
  C:\Windows\System\LpdDoBd.exe
  2⤵
  PID:7944
- C:\Windows\System\gTZwOiS.exe
  C:\Windows\System\gTZwOiS.exe
  2⤵
  PID:7968
- C:\Windows\System\BJoXzhd.exe
  C:\Windows\System\BJoXzhd.exe
  2⤵
  PID:7984
- C:\Windows\System\OpPifaV.exe
  C:\Windows\System\OpPifaV.exe
  2⤵
  PID:8000
- C:\Windows\System\QDbWkFj.exe
  C:\Windows\System\QDbWkFj.exe
  2⤵
  PID:8016
- C:\Windows\System\HeCjZdp.exe
  C:\Windows\System\HeCjZdp.exe
  2⤵
  PID:8032
- C:\Windows\System\FbqprXN.exe
  C:\Windows\System\FbqprXN.exe
  2⤵
  PID:8048
- C:\Windows\System\HEwjTKL.exe
  C:\Windows\System\HEwjTKL.exe
  2⤵
  PID:8064
- C:\Windows\System\EKfDplh.exe
  C:\Windows\System\EKfDplh.exe
  2⤵
  PID:8080
- C:\Windows\System\TUmnorg.exe
  C:\Windows\System\TUmnorg.exe
  2⤵
  PID:8096
- C:\Windows\System\JDbLShI.exe
  C:\Windows\System\JDbLShI.exe
  2⤵
  PID:8116
- C:\Windows\System\kkVvPps.exe
  C:\Windows\System\kkVvPps.exe
  2⤵
  PID:8132
- C:\Windows\System\jYuyLbk.exe
  C:\Windows\System\jYuyLbk.exe
  2⤵
  PID:8148
- C:\Windows\System\cCJkNZv.exe
  C:\Windows\System\cCJkNZv.exe
  2⤵
  PID:8164
- C:\Windows\System\cpkPVoF.exe
  C:\Windows\System\cpkPVoF.exe
  2⤵
  PID:8180
- C:\Windows\System\DBllVDS.exe
  C:\Windows\System\DBllVDS.exe
  2⤵
  PID:6616
- C:\Windows\System\tBTmEIR.exe
  C:\Windows\System\tBTmEIR.exe
  2⤵
  PID:7228
- C:\Windows\System\cnvvNES.exe
  C:\Windows\System\cnvvNES.exe
  2⤵
  PID:7180
- C:\Windows\System\VhVKbPY.exe
  C:\Windows\System\VhVKbPY.exe
  2⤵
  PID:7216
- C:\Windows\System\HLwavXb.exe
  C:\Windows\System\HLwavXb.exe
  2⤵
  PID:7292
- C:\Windows\System\zSioRsq.exe
  C:\Windows\System\zSioRsq.exe
  2⤵
  PID:7360
- C:\Windows\System\ugEqZqP.exe
  C:\Windows\System\ugEqZqP.exe
  2⤵
  PID:7340
- C:\Windows\System\doFKQHF.exe
  C:\Windows\System\doFKQHF.exe
  2⤵
  PID:7344
- C:\Windows\System\GqfQBQt.exe
  C:\Windows\System\GqfQBQt.exe
  2⤵
  PID:7420
- C:\Windows\System\wZvYpga.exe
  C:\Windows\System\wZvYpga.exe
  2⤵
  PID:7456
- C:\Windows\System\gMjYVPW.exe
  C:\Windows\System\gMjYVPW.exe
  2⤵
  PID:7520
- C:\Windows\System\rCAPzJj.exe
  C:\Windows\System\rCAPzJj.exe
  2⤵
  PID:7584
- C:\Windows\System\WvixFrb.exe
  C:\Windows\System\WvixFrb.exe
  2⤵
  PID:7648
- C:\Windows\System\ivliUKA.exe
  C:\Windows\System\ivliUKA.exe
  2⤵
  PID:7564
- C:\Windows\System\rBjObfE.exe
  C:\Windows\System\rBjObfE.exe
  2⤵
  PID:7712
- C:\Windows\System\gxzqMUI.exe
  C:\Windows\System\gxzqMUI.exe
  2⤵
  PID:7772
- C:\Windows\System\KLKhfQi.exe
  C:\Windows\System\KLKhfQi.exe
  2⤵
  PID:7600
- C:\Windows\System\BVxwgSO.exe
  C:\Windows\System\BVxwgSO.exe
  2⤵
  PID:7808
- C:\Windows\System\kOeYBDi.exe
  C:\Windows\System\kOeYBDi.exe
  2⤵
  PID:7632
- C:\Windows\System\aTbcoLd.exe
  C:\Windows\System\aTbcoLd.exe
  2⤵
  PID:7696
- C:\Windows\System\YhkzbBk.exe
  C:\Windows\System\YhkzbBk.exe
  2⤵
  PID:7788
- C:\Windows\System\EobEXEP.exe
  C:\Windows\System\EobEXEP.exe
  2⤵
  PID:7840
- C:\Windows\System\yTqfqtp.exe
  C:\Windows\System\yTqfqtp.exe
  2⤵
  PID:7872
- C:\Windows\System\zHVdiaO.exe
  C:\Windows\System\zHVdiaO.exe
  2⤵
  PID:7936
- C:\Windows\System\IhOavxd.exe
  C:\Windows\System\IhOavxd.exe
  2⤵
  PID:8008
- C:\Windows\System\lwEwvNu.exe
  C:\Windows\System\lwEwvNu.exe
  2⤵
  PID:8072
- C:\Windows\System\rIPlgZq.exe
  C:\Windows\System\rIPlgZq.exe
  2⤵
  PID:8140
- C:\Windows\System\dZrXIFA.exe
  C:\Windows\System\dZrXIFA.exe
  2⤵
  PID:6496
- C:\Windows\System\KHAQicW.exe
  C:\Windows\System\KHAQicW.exe
  2⤵
  PID:7956
- C:\Windows\System\AeVMKnd.exe
  C:\Windows\System\AeVMKnd.exe
  2⤵
  PID:7248
- C:\Windows\System\DIvwjjg.exe
  C:\Windows\System\DIvwjjg.exe
  2⤵
  PID:7308
- C:\Windows\System\aaNZjvm.exe
  C:\Windows\System\aaNZjvm.exe
  2⤵
  PID:7892
- C:\Windows\System\SlXrhPf.exe
  C:\Windows\System\SlXrhPf.exe
  2⤵
  PID:8024
- C:\Windows\System\rJpiQAJ.exe
  C:\Windows\System\rJpiQAJ.exe
  2⤵
  PID:8088
- C:\Windows\System\ZSDkABw.exe
  C:\Windows\System\ZSDkABw.exe
  2⤵
  PID:8128
- C:\Windows\System\oBTVyjW.exe
  C:\Windows\System\oBTVyjW.exe
  2⤵
  PID:7260
- C:\Windows\System\JHcvzRk.exe
  C:\Windows\System\JHcvzRk.exe
  2⤵
  PID:7452
- C:\Windows\System\vdxoHII.exe
  C:\Windows\System\vdxoHII.exe
  2⤵
  PID:7404
- C:\Windows\System\rOgqEuf.exe
  C:\Windows\System\rOgqEuf.exe
  2⤵
  PID:7516
- C:\Windows\System\GtRbaei.exe
  C:\Windows\System\GtRbaei.exe
  2⤵
  PID:7536
- C:\Windows\System\RzNOHiZ.exe
  C:\Windows\System\RzNOHiZ.exe
  2⤵
  PID:7500
- C:\Windows\System\xvJhzRP.exe
  C:\Windows\System\xvJhzRP.exe
  2⤵
  PID:7664
- C:\Windows\System\HSzuQnJ.exe
  C:\Windows\System\HSzuQnJ.exe
  2⤵
  PID:7908
- C:\Windows\System\TuFxdsf.exe
  C:\Windows\System\TuFxdsf.exe
  2⤵
  PID:7440
- C:\Windows\System\vXofPiS.exe
  C:\Windows\System\vXofPiS.exe
  2⤵
  PID:7996
- C:\Windows\System\kWRbdjk.exe
  C:\Windows\System\kWRbdjk.exe
  2⤵
  PID:7756
- C:\Windows\System\hItZJxG.exe
  C:\Windows\System\hItZJxG.exe
  2⤵
  PID:7868
- C:\Windows\System\kZPvkWO.exe
  C:\Windows\System\kZPvkWO.exe
  2⤵
  PID:7356
- C:\Windows\System\pihsHua.exe
  C:\Windows\System\pihsHua.exe
  2⤵
  PID:8188
- C:\Windows\System\GgXpZQB.exe
  C:\Windows\System\GgXpZQB.exe
  2⤵
  PID:7628
- C:\Windows\System\wYdNMuB.exe
  C:\Windows\System\wYdNMuB.exe
  2⤵
  PID:7708
- C:\Windows\System\LbFXJqa.exe
  C:\Windows\System\LbFXJqa.exe
  2⤵
  PID:8108
- C:\Windows\System\IZpHQLf.exe
  C:\Windows\System\IZpHQLf.exe
  2⤵
  PID:8044
- C:\Windows\System\LvYeLjJ.exe
  C:\Windows\System\LvYeLjJ.exe
  2⤵
  PID:7328
- C:\Windows\System\ntgihgh.exe
  C:\Windows\System\ntgihgh.exe
  2⤵
  PID:7644
- C:\Windows\System\YKUZXOo.exe
  C:\Windows\System\YKUZXOo.exe
  2⤵
  PID:8196
- C:\Windows\System\XyRRJDU.exe
  C:\Windows\System\XyRRJDU.exe
  2⤵
  PID:8212
- C:\Windows\System\VWzXQEl.exe
  C:\Windows\System\VWzXQEl.exe
  2⤵
  PID:8228
- C:\Windows\System\lqZsNsK.exe
  C:\Windows\System\lqZsNsK.exe
  2⤵
  PID:8244
- C:\Windows\System\qaLBDjB.exe
  C:\Windows\System\qaLBDjB.exe
  2⤵
  PID:8260
- C:\Windows\System\yNNBkLK.exe
  C:\Windows\System\yNNBkLK.exe
  2⤵
  PID:8276
- C:\Windows\System\CFAafrf.exe
  C:\Windows\System\CFAafrf.exe
  2⤵
  PID:8292
- C:\Windows\System\XdgRDIA.exe
  C:\Windows\System\XdgRDIA.exe
  2⤵
  PID:8308
- C:\Windows\System\CmJvwEy.exe
  C:\Windows\System\CmJvwEy.exe
  2⤵
  PID:8324
- C:\Windows\System\BvMgWkj.exe
  C:\Windows\System\BvMgWkj.exe
  2⤵
  PID:8340
- C:\Windows\System\TdTHLyX.exe
  C:\Windows\System\TdTHLyX.exe
  2⤵
  PID:8360
- C:\Windows\System\aScpWKj.exe
  C:\Windows\System\aScpWKj.exe
  2⤵
  PID:8376
- C:\Windows\System\dqvcnHK.exe
  C:\Windows\System\dqvcnHK.exe
  2⤵
  PID:8392
- C:\Windows\System\uljrKFf.exe
  C:\Windows\System\uljrKFf.exe
  2⤵
  PID:8408
- C:\Windows\System\nzzrOLB.exe
  C:\Windows\System\nzzrOLB.exe
  2⤵
  PID:8424
- C:\Windows\System\fZGLqvv.exe
  C:\Windows\System\fZGLqvv.exe
  2⤵
  PID:8440
- C:\Windows\System\LeYvIcf.exe
  C:\Windows\System\LeYvIcf.exe
  2⤵
  PID:8456
- C:\Windows\System\cqiRXGx.exe
  C:\Windows\System\cqiRXGx.exe
  2⤵
  PID:8472
- C:\Windows\System\fIMiiyv.exe
  C:\Windows\System\fIMiiyv.exe
  2⤵
  PID:8488
- C:\Windows\System\mXXNgMk.exe
  C:\Windows\System\mXXNgMk.exe
  2⤵
  PID:8504
- C:\Windows\System\yBVAPuK.exe
  C:\Windows\System\yBVAPuK.exe
  2⤵
  PID:8520
- C:\Windows\System\LcxzmPg.exe
  C:\Windows\System\LcxzmPg.exe
  2⤵
  PID:8536
- C:\Windows\System\OkHBFFL.exe
  C:\Windows\System\OkHBFFL.exe
  2⤵
  PID:8552
- C:\Windows\System\ZPhXOir.exe
  C:\Windows\System\ZPhXOir.exe
  2⤵
  PID:8568
- C:\Windows\System\dmDsXrd.exe
  C:\Windows\System\dmDsXrd.exe
  2⤵
  PID:8584
- C:\Windows\System\dkddtiX.exe
  C:\Windows\System\dkddtiX.exe
  2⤵
  PID:8600
- C:\Windows\System\vsEelqI.exe
  C:\Windows\System\vsEelqI.exe
  2⤵
  PID:8616
- C:\Windows\System\qxaQiPv.exe
  C:\Windows\System\qxaQiPv.exe
  2⤵
  PID:8632
- C:\Windows\System\JekOoTC.exe
  C:\Windows\System\JekOoTC.exe
  2⤵
  PID:8648
- C:\Windows\System\cbvWvlb.exe
  C:\Windows\System\cbvWvlb.exe
  2⤵
  PID:8664
- C:\Windows\System\fASILkI.exe
  C:\Windows\System\fASILkI.exe
  2⤵
  PID:8680
- C:\Windows\System\palGSJD.exe
  C:\Windows\System\palGSJD.exe
  2⤵
  PID:8696
- C:\Windows\System\inBFTEc.exe
  C:\Windows\System\inBFTEc.exe
  2⤵
  PID:8712
- C:\Windows\System\sAqqKpu.exe
  C:\Windows\System\sAqqKpu.exe
  2⤵
  PID:8728
- C:\Windows\System\gpUOATz.exe
  C:\Windows\System\gpUOATz.exe
  2⤵
  PID:8744
- C:\Windows\System\tyZsJcb.exe
  C:\Windows\System\tyZsJcb.exe
  2⤵
  PID:8764
- C:\Windows\System\UWfBMvQ.exe
  C:\Windows\System\UWfBMvQ.exe
  2⤵
  PID:8780
- C:\Windows\System\jhjWpYs.exe
  C:\Windows\System\jhjWpYs.exe
  2⤵
  PID:8796
- C:\Windows\System\iZgsxnp.exe
  C:\Windows\System\iZgsxnp.exe
  2⤵
  PID:8812
- C:\Windows\System\PpGfYBw.exe
  C:\Windows\System\PpGfYBw.exe
  2⤵
  PID:8828
- C:\Windows\System\RpboYHh.exe
  C:\Windows\System\RpboYHh.exe
  2⤵
  PID:8844
- C:\Windows\System\nvrSKtm.exe
  C:\Windows\System\nvrSKtm.exe
  2⤵
  PID:8860
- C:\Windows\System\owuvPvq.exe
  C:\Windows\System\owuvPvq.exe
  2⤵
  PID:8876
- C:\Windows\System\IYMtEyj.exe
  C:\Windows\System\IYMtEyj.exe
  2⤵
  PID:8892
- C:\Windows\System\JAMdvuU.exe
  C:\Windows\System\JAMdvuU.exe
  2⤵
  PID:8908
- C:\Windows\System\SnQrtfl.exe
  C:\Windows\System\SnQrtfl.exe
  2⤵
  PID:8924
- C:\Windows\System\jaUIJUK.exe
  C:\Windows\System\jaUIJUK.exe
  2⤵
  PID:8940
- C:\Windows\System\eHqPZnm.exe
  C:\Windows\System\eHqPZnm.exe
  2⤵
  PID:8956
- C:\Windows\System\korBmtv.exe
  C:\Windows\System\korBmtv.exe
  2⤵
  PID:8972
- C:\Windows\System\cQzCfLB.exe
  C:\Windows\System\cQzCfLB.exe
  2⤵
  PID:8988
- C:\Windows\System\BMJJqls.exe
  C:\Windows\System\BMJJqls.exe
  2⤵
  PID:9004
- C:\Windows\System\VBJALlX.exe
  C:\Windows\System\VBJALlX.exe
  2⤵
  PID:9020
- C:\Windows\System\NlDiUhQ.exe
  C:\Windows\System\NlDiUhQ.exe
  2⤵
  PID:9036
- C:\Windows\System\TxZXlbW.exe
  C:\Windows\System\TxZXlbW.exe
  2⤵
  PID:9052
- C:\Windows\System\iKPZIlI.exe
  C:\Windows\System\iKPZIlI.exe
  2⤵
  PID:9068
- C:\Windows\System\HaWUqqy.exe
  C:\Windows\System\HaWUqqy.exe
  2⤵
  PID:9084
- C:\Windows\System\jEkRqgw.exe
  C:\Windows\System\jEkRqgw.exe
  2⤵
  PID:9100
- C:\Windows\System\GixQEdJ.exe
  C:\Windows\System\GixQEdJ.exe
  2⤵
  PID:9116
- C:\Windows\System\zmcbpJm.exe
  C:\Windows\System\zmcbpJm.exe
  2⤵
  PID:9132
- C:\Windows\System\DKxoAew.exe
  C:\Windows\System\DKxoAew.exe
  2⤵
  PID:9148
- C:\Windows\System\PcCPjOP.exe
  C:\Windows\System\PcCPjOP.exe
  2⤵
  PID:9164
- C:\Windows\System\UGIRTLI.exe
  C:\Windows\System\UGIRTLI.exe
  2⤵
  PID:9180
- C:\Windows\System\pfVsIBS.exe
  C:\Windows\System\pfVsIBS.exe
  2⤵
  PID:9196
- C:\Windows\System\duoVNUK.exe
  C:\Windows\System\duoVNUK.exe
  2⤵
  PID:9212
- C:\Windows\System\fOyKJVq.exe
  C:\Windows\System\fOyKJVq.exe
  2⤵
  PID:7488
- C:\Windows\System\sedaHGt.exe
  C:\Windows\System\sedaHGt.exe
  2⤵
  PID:8284
- C:\Windows\System\FsCzvwe.exe
  C:\Windows\System\FsCzvwe.exe
  2⤵
  PID:7680
- C:\Windows\System\eJpcMQa.exe
  C:\Windows\System\eJpcMQa.exe
  2⤵
  PID:7296
- C:\Windows\System\UDZzEmT.exe
  C:\Windows\System\UDZzEmT.exe
  2⤵
  PID:7532
- C:\Windows\System\vcLgkNk.exe
  C:\Windows\System\vcLgkNk.exe
  2⤵
  PID:8204
- C:\Windows\System\SnvphKc.exe
  C:\Windows\System\SnvphKc.exe
  2⤵
  PID:8348
- C:\Windows\System\bgDWyQV.exe
  C:\Windows\System\bgDWyQV.exe
  2⤵
  PID:7596
- C:\Windows\System\TrnFgcq.exe
  C:\Windows\System\TrnFgcq.exe
  2⤵
  PID:8416
- C:\Windows\System\IYpTKro.exe
  C:\Windows\System\IYpTKro.exe
  2⤵
  PID:8448
- C:\Windows\System\urhYSSe.exe
  C:\Windows\System\urhYSSe.exe
  2⤵
  PID:8512
- C:\Windows\System\vCdNsyP.exe
  C:\Windows\System\vCdNsyP.exe
  2⤵
  PID:8272
- C:\Windows\System\CPACLUA.exe
  C:\Windows\System\CPACLUA.exe
  2⤵
  PID:8336
- C:\Windows\System\YtvSDSV.exe
  C:\Windows\System\YtvSDSV.exe
  2⤵
  PID:8400
- C:\Windows\System\GBskscb.exe
  C:\Windows\System\GBskscb.exe
  2⤵
  PID:8576
- C:\Windows\System\BGxPPET.exe
  C:\Windows\System\BGxPPET.exe
  2⤵
  PID:8464
- C:\Windows\System\NZNqZhj.exe
  C:\Windows\System\NZNqZhj.exe
  2⤵
  PID:8528
- C:\Windows\System\JQMfsZN.exe
  C:\Windows\System\JQMfsZN.exe
  2⤵
  PID:8560
- C:\Windows\System\cyXQvFS.exe
  C:\Windows\System\cyXQvFS.exe
  2⤵
  PID:8640
- C:\Windows\System\poLtTke.exe
  C:\Windows\System\poLtTke.exe
  2⤵
  PID:8704
- C:\Windows\System\vPZtGEa.exe
  C:\Windows\System\vPZtGEa.exe
  2⤵
  PID:8692
- C:\Windows\System\ImsIBuI.exe
  C:\Windows\System\ImsIBuI.exe
  2⤵
  PID:8624
- C:\Windows\System\tPJXzDU.exe
  C:\Windows\System\tPJXzDU.exe
  2⤵
  PID:8776
- C:\Windows\System\tHmwMCH.exe
  C:\Windows\System\tHmwMCH.exe
  2⤵
  PID:8788
- C:\Windows\System\OnRVTRM.exe
  C:\Windows\System\OnRVTRM.exe
  2⤵
  PID:8840
- C:\Windows\System\kIudCeB.exe
  C:\Windows\System\kIudCeB.exe
  2⤵
  PID:8852
- C:\Windows\System\WNXhkjX.exe
  C:\Windows\System\WNXhkjX.exe
  2⤵
  PID:8900
- C:\Windows\System\nBCCVSz.exe
  C:\Windows\System\nBCCVSz.exe
  2⤵
  PID:8932
- C:\Windows\System\OwXJzpo.exe
  C:\Windows\System\OwXJzpo.exe
  2⤵
  PID:8996
- C:\Windows\System\eWSPklV.exe
  C:\Windows\System\eWSPklV.exe
  2⤵
  PID:9032
- C:\Windows\System\eNZPAPR.exe
  C:\Windows\System\eNZPAPR.exe
  2⤵
  PID:9016
- C:\Windows\System\SzzuKKC.exe
  C:\Windows\System\SzzuKKC.exe
  2⤵
  PID:9012
- C:\Windows\System\tjxAyUR.exe
  C:\Windows\System\tjxAyUR.exe
  2⤵
  PID:9092
- C:\Windows\System\uKplaLr.exe
  C:\Windows\System\uKplaLr.exe
  2⤵
  PID:9080
- C:\Windows\System\AtaUoyE.exe
  C:\Windows\System\AtaUoyE.exe
  2⤵
  PID:9108
- C:\Windows\System\OOrVUhb.exe
  C:\Windows\System\OOrVUhb.exe
  2⤵
  PID:9172
- C:\Windows\System\hDDHVrk.exe
  C:\Windows\System\hDDHVrk.exe
  2⤵
  PID:9204
- C:\Windows\System\NJzKhrp.exe
  C:\Windows\System\NJzKhrp.exe
  2⤵
  PID:8316
- C:\Windows\System\bOLaipI.exe
  C:\Windows\System\bOLaipI.exe
  2⤵
  PID:8256
- C:\Windows\System\UhPyEYZ.exe
  C:\Windows\System\UhPyEYZ.exe
  2⤵
  PID:7744
- C:\Windows\System\EVqljSm.exe
  C:\Windows\System\EVqljSm.exe
  2⤵
  PID:7820
- C:\Windows\System\tbCFuRW.exe
  C:\Windows\System\tbCFuRW.exe
  2⤵
  PID:8480
- C:\Windows\System\eWCQKEj.exe
  C:\Windows\System\eWCQKEj.exe
  2⤵
  PID:8208
- C:\Windows\System\HiawVaN.exe
  C:\Windows\System\HiawVaN.exe
  2⤵
  PID:8548
- C:\Windows\System\rzECdiL.exe
  C:\Windows\System\rzECdiL.exe
  2⤵
  PID:8468
- C:\Windows\System\uZdVxvt.exe
  C:\Windows\System\uZdVxvt.exe
  2⤵
  PID:8612
- C:\Windows\System\awLjgXn.exe
  C:\Windows\System\awLjgXn.exe
  2⤵
  PID:8672
- C:\Windows\System\LvrbZRh.exe
  C:\Windows\System\LvrbZRh.exe
  2⤵
  PID:8676
- C:\Windows\System\tHWRcjH.exe
  C:\Windows\System\tHWRcjH.exe
  2⤵
  PID:8968
- C:\Windows\System\NkJNuIK.exe
  C:\Windows\System\NkJNuIK.exe
  2⤵
  PID:9064
- C:\Windows\System\bwAFoyn.exe
  C:\Windows\System\bwAFoyn.exe
  2⤵
  PID:9156
- C:\Windows\System\QbDgsXw.exe
  C:\Windows\System\QbDgsXw.exe
  2⤵
  PID:9028
- C:\Windows\System\orgzYoa.exe
  C:\Windows\System\orgzYoa.exe
  2⤵
  PID:7964
- C:\Windows\System\wnXZNcC.exe
  C:\Windows\System\wnXZNcC.exe
  2⤵
  PID:8952
- C:\Windows\System\ffRqdCj.exe
  C:\Windows\System\ffRqdCj.exe
  2⤵
  PID:9096
- C:\Windows\System\QMbjaKb.exe
  C:\Windows\System\QMbjaKb.exe
  2⤵
  PID:8224
- C:\Windows\System\iQdFmCR.exe
  C:\Windows\System\iQdFmCR.exe
  2⤵
  PID:8268
- C:\Windows\System\AWzQRmZ.exe
  C:\Windows\System\AWzQRmZ.exe
  2⤵
  PID:8420
- C:\Windows\System\NzYWEiP.exe
  C:\Windows\System\NzYWEiP.exe
  2⤵
  PID:8372
- C:\Windows\System\ClJdCZF.exe
  C:\Windows\System\ClJdCZF.exe
  2⤵
  PID:8660
- C:\Windows\System\pQYPYiJ.exe
  C:\Windows\System\pQYPYiJ.exe
  2⤵
  PID:8592
- C:\Windows\System\VoIdfTz.exe
  C:\Windows\System\VoIdfTz.exe
  2⤵
  PID:8824
- C:\Windows\System\ktWgLSt.exe
  C:\Windows\System\ktWgLSt.exe
  2⤵
  PID:8916
- C:\Windows\System\RfqUMlf.exe
  C:\Windows\System\RfqUMlf.exe
  2⤵
  PID:8808
- C:\Windows\System\BbVCsDq.exe
  C:\Windows\System\BbVCsDq.exe
  2⤵
  PID:8384
- C:\Windows\System\eiPrwiP.exe
  C:\Windows\System\eiPrwiP.exe
  2⤵
  PID:8220
- C:\Windows\System\KSULpic.exe
  C:\Windows\System\KSULpic.exe
  2⤵
  PID:8496
- C:\Windows\System\rhqysox.exe
  C:\Windows\System\rhqysox.exe
  2⤵
  PID:8984
- C:\Windows\System\kIeNouN.exe
  C:\Windows\System\kIeNouN.exe
  2⤵
  PID:8904
- C:\Windows\System\UMxtRtM.exe
  C:\Windows\System\UMxtRtM.exe
  2⤵
  PID:7856
- C:\Windows\System\hDPiwoU.exe
  C:\Windows\System\hDPiwoU.exe
  2⤵
  PID:8580
- C:\Windows\System\ZVjXgBu.exe
  C:\Windows\System\ZVjXgBu.exe
  2⤵
  PID:8740
- C:\Windows\System\bKmmuiE.exe
  C:\Windows\System\bKmmuiE.exe
  2⤵
  PID:9192
- C:\Windows\System\hdtiGva.exe
  C:\Windows\System\hdtiGva.exe
  2⤵
  PID:9228
- C:\Windows\System\HdeSQfJ.exe
  C:\Windows\System\HdeSQfJ.exe
  2⤵
  PID:9244
- C:\Windows\System\MwfOcSC.exe
  C:\Windows\System\MwfOcSC.exe
  2⤵
  PID:9264
- C:\Windows\System\NrLEmzH.exe
  C:\Windows\System\NrLEmzH.exe
  2⤵
  PID:9280
- C:\Windows\System\bhsfqKK.exe
  C:\Windows\System\bhsfqKK.exe
  2⤵
  PID:9296
- C:\Windows\System\KwRYQNr.exe
  C:\Windows\System\KwRYQNr.exe
  2⤵
  PID:9312
- C:\Windows\System\lWIbrvN.exe
  C:\Windows\System\lWIbrvN.exe
  2⤵
  PID:9328
- C:\Windows\System\KeWzMhq.exe
  C:\Windows\System\KeWzMhq.exe
  2⤵
  PID:9344
- C:\Windows\System\XCVEtdC.exe
  C:\Windows\System\XCVEtdC.exe
  2⤵
  PID:9364
- C:\Windows\System\WQZqzRI.exe
  C:\Windows\System\WQZqzRI.exe
  2⤵
  PID:9380
- C:\Windows\System\rVbaRAq.exe
  C:\Windows\System\rVbaRAq.exe
  2⤵
  PID:9396
- C:\Windows\System\FYDWhQa.exe
  C:\Windows\System\FYDWhQa.exe
  2⤵
  PID:9416
- C:\Windows\System\gtRLNJj.exe
  C:\Windows\System\gtRLNJj.exe
  2⤵
  PID:9436
- C:\Windows\System\sXsiLYo.exe
  C:\Windows\System\sXsiLYo.exe
  2⤵
  PID:9452
- C:\Windows\System\KKlFmsQ.exe
  C:\Windows\System\KKlFmsQ.exe
  2⤵
  PID:9468
- C:\Windows\System\HavcCPK.exe
  C:\Windows\System\HavcCPK.exe
  2⤵
  PID:9484
- C:\Windows\System\KMulfzn.exe
  C:\Windows\System\KMulfzn.exe
  2⤵
  PID:9500
- C:\Windows\System\kOPbkWr.exe
  C:\Windows\System\kOPbkWr.exe
  2⤵
  PID:9516
- C:\Windows\System\LnPChBG.exe
  C:\Windows\System\LnPChBG.exe
  2⤵
  PID:9532
- C:\Windows\System\cytnfcK.exe
  C:\Windows\System\cytnfcK.exe
  2⤵
  PID:9548
- C:\Windows\System\xzyvnsS.exe
  C:\Windows\System\xzyvnsS.exe
  2⤵
  PID:9584
- C:\Windows\System\gjFUIaL.exe
  C:\Windows\System\gjFUIaL.exe
  2⤵
  PID:9600
- C:\Windows\System\cXfNtcp.exe
  C:\Windows\System\cXfNtcp.exe
  2⤵
  PID:9616
- C:\Windows\System\nlKVyYB.exe
  C:\Windows\System\nlKVyYB.exe
  2⤵
  PID:9632
- C:\Windows\System\RzyFxVJ.exe
  C:\Windows\System\RzyFxVJ.exe
  2⤵
  PID:9652
- C:\Windows\System\iIHOQCu.exe
  C:\Windows\System\iIHOQCu.exe
  2⤵
  PID:9668
- C:\Windows\System\bDKgxOG.exe
  C:\Windows\System\bDKgxOG.exe
  2⤵
  PID:9684
- C:\Windows\System\MwNBxoc.exe
  C:\Windows\System\MwNBxoc.exe
  2⤵
  PID:9700
- C:\Windows\System\utHhbtg.exe
  C:\Windows\System\utHhbtg.exe
  2⤵
  PID:9720
- C:\Windows\System\oFziELB.exe
  C:\Windows\System\oFziELB.exe
  2⤵
  PID:9772
- C:\Windows\System\XUziUgn.exe
  C:\Windows\System\XUziUgn.exe
  2⤵
  PID:9788
- C:\Windows\System\OCZsAMq.exe
  C:\Windows\System\OCZsAMq.exe
  2⤵
  PID:9808
- C:\Windows\System\RMLgCxe.exe
  C:\Windows\System\RMLgCxe.exe
  2⤵
  PID:9824
- C:\Windows\System\xQApcpp.exe
  C:\Windows\System\xQApcpp.exe
  2⤵
  PID:9840
- C:\Windows\System\WqcJoBZ.exe
  C:\Windows\System\WqcJoBZ.exe
  2⤵
  PID:9856
- C:\Windows\System\aQbKmHi.exe
  C:\Windows\System\aQbKmHi.exe
  2⤵
  PID:9872
- C:\Windows\System\ScGVinf.exe
  C:\Windows\System\ScGVinf.exe
  2⤵
  PID:9888
- C:\Windows\System\pgnPFyq.exe
  C:\Windows\System\pgnPFyq.exe
  2⤵
  PID:9904
- C:\Windows\System\mKvXxho.exe
  C:\Windows\System\mKvXxho.exe
  2⤵
  PID:9920
- C:\Windows\System\jMBDkZt.exe
  C:\Windows\System\jMBDkZt.exe
  2⤵
  PID:9936
- C:\Windows\System\oLBtpXv.exe
  C:\Windows\System\oLBtpXv.exe
  2⤵
  PID:9952
- C:\Windows\System\KbSlitK.exe
  C:\Windows\System\KbSlitK.exe
  2⤵
  PID:9968
- C:\Windows\System\ZBibufP.exe
  C:\Windows\System\ZBibufP.exe
  2⤵
  PID:9984
- C:\Windows\System\FMAMHEJ.exe
  C:\Windows\System\FMAMHEJ.exe
  2⤵
  PID:10004
- C:\Windows\System\gfVlyQQ.exe
  C:\Windows\System\gfVlyQQ.exe
  2⤵
  PID:10020
- C:\Windows\System\cKZcwbA.exe
  C:\Windows\System\cKZcwbA.exe
  2⤵
  PID:10036
- C:\Windows\System\WFZmWqo.exe
  C:\Windows\System\WFZmWqo.exe
  2⤵
  PID:10052
- C:\Windows\System\cCIuDDw.exe
  C:\Windows\System\cCIuDDw.exe
  2⤵
  PID:10068
- C:\Windows\System\hJhUmPW.exe
  C:\Windows\System\hJhUmPW.exe
  2⤵
  PID:10088
- C:\Windows\System\ZXioHVZ.exe
  C:\Windows\System\ZXioHVZ.exe
  2⤵
  PID:10104
- C:\Windows\System\MBXFlTV.exe
  C:\Windows\System\MBXFlTV.exe
  2⤵
  PID:10120
- C:\Windows\System\srWsCfP.exe
  C:\Windows\System\srWsCfP.exe
  2⤵
  PID:10136
- C:\Windows\System\tzQwIhx.exe
  C:\Windows\System\tzQwIhx.exe
  2⤵
  PID:10152
- C:\Windows\System\akEyXSj.exe
  C:\Windows\System\akEyXSj.exe
  2⤵
  PID:10168
- C:\Windows\System\eXogjEJ.exe
  C:\Windows\System\eXogjEJ.exe
  2⤵
  PID:10184
- C:\Windows\System\zltUORV.exe
  C:\Windows\System\zltUORV.exe
  2⤵
  PID:10200
- C:\Windows\System\WpLdZLe.exe
  C:\Windows\System\WpLdZLe.exe
  2⤵
  PID:10216
- C:\Windows\System\ADELbty.exe
  C:\Windows\System\ADELbty.exe
  2⤵
  PID:10232
- C:\Windows\System\AvjuZuL.exe
  C:\Windows\System\AvjuZuL.exe
  2⤵
  PID:9240
- C:\Windows\System\OLNPLjQ.exe
  C:\Windows\System\OLNPLjQ.exe
  2⤵
  PID:9224
- C:\Windows\System\dpbRjJa.exe
  C:\Windows\System\dpbRjJa.exe
  2⤵
  PID:9304
- C:\Windows\System\zEUSFBD.exe
  C:\Windows\System\zEUSFBD.exe
  2⤵
  PID:9372
- C:\Windows\System\NmjRuIw.exe
  C:\Windows\System\NmjRuIw.exe
  2⤵
  PID:9252
- C:\Windows\System\oqeEZgt.exe
  C:\Windows\System\oqeEZgt.exe
  2⤵
  PID:9288
- C:\Windows\System\UkQStLB.exe
  C:\Windows\System\UkQStLB.exe
  2⤵
  PID:9356
- C:\Windows\System\FiqHmlu.exe
  C:\Windows\System\FiqHmlu.exe
  2⤵
  PID:9444
- C:\Windows\System\ACtaRAE.exe
  C:\Windows\System\ACtaRAE.exe
  2⤵
  PID:9428
- C:\Windows\System\iGRDReT.exe
  C:\Windows\System\iGRDReT.exe
  2⤵
  PID:9480
- C:\Windows\System\ZyyquWy.exe
  C:\Windows\System\ZyyquWy.exe
  2⤵
  PID:9512
- C:\Windows\System\AIgxKJe.exe
  C:\Windows\System\AIgxKJe.exe
  2⤵
  PID:9544
- C:\Windows\System\bAFErbH.exe
  C:\Windows\System\bAFErbH.exe
  2⤵
  PID:9572
- C:\Windows\System\znoOloY.exe
  C:\Windows\System\znoOloY.exe
  2⤵
  PID:9624
- C:\Windows\System\CvQyKuk.exe
  C:\Windows\System\CvQyKuk.exe
  2⤵
  PID:9640
- C:\Windows\System\eUOdPKo.exe
  C:\Windows\System\eUOdPKo.exe
  2⤵
  PID:9660
- C:\Windows\System\swdKQeA.exe
  C:\Windows\System\swdKQeA.exe
  2⤵
  PID:9712
- C:\Windows\System\RNofQIj.exe
  C:\Windows\System\RNofQIj.exe
  2⤵
  PID:9736
- C:\Windows\System\HNhtXyo.exe
  C:\Windows\System\HNhtXyo.exe
  2⤵
  PID:9752
- C:\Windows\System\yUgcooK.exe
  C:\Windows\System\yUgcooK.exe
  2⤵
  PID:9768
- C:\Windows\System\tdLKcLl.exe
  C:\Windows\System\tdLKcLl.exe
  2⤵
  PID:9800
- C:\Windows\System\PeNdOwD.exe
  C:\Windows\System\PeNdOwD.exe
  2⤵
  PID:9864
- C:\Windows\System\pCElfSG.exe
  C:\Windows\System\pCElfSG.exe
  2⤵
  PID:9928
- C:\Windows\System\bmPtjJr.exe
  C:\Windows\System\bmPtjJr.exe
  2⤵
  PID:9992
- C:\Windows\System\YuRxbCP.exe
  C:\Windows\System\YuRxbCP.exe
  2⤵
  PID:10032
- C:\Windows\System\MHuKZgJ.exe
  C:\Windows\System\MHuKZgJ.exe
  2⤵
  PID:9848
- C:\Windows\System\DgvdDOB.exe
  C:\Windows\System\DgvdDOB.exe
  2⤵
  PID:9884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AHnAheX.exe

Filesize
1.9MB

MD5
0f2a69ce61ad0ab5ac10449faf0b3c11

SHA1
459797f2243f7846a3a07ba4548b4738fd4c4562

SHA256
f8a4d9ca3fe0163aeaed3b8a90dc720bb3de48a75c7cfaf9231ee5edaa800d62

SHA512
0d7e0e632da8297493f8a3371acd422e6e4f4a77cffd34e3b24e7b49e7db0dba2fdd1e8c21651f3b963d3b1abcd9976d95925c460e15a3afad93fc566882e4ed

Download Submit
C:\Windows\system\BgMNisx.exe

Filesize
1.9MB

MD5
7df093beec3a04215e6e9cfa87d9eb6f

SHA1
d978fe8e28428cd381d0b74f8d160895c7f8fcbe

SHA256
43b1627ee228a40780d28182aae144bccb8ec847b34b14d220a73d4c366adad3

SHA512
e34f3c3f77047a9d3bdd04d5d2384d664e54db5109f58f852bd116f5057ca0f94869dc426790239a9e4ebef938612545d4dde4424ab7ba0e6e11d12fbb476b28

Download Submit
C:\Windows\system\DdRvLoN.exe

Filesize
1.9MB

MD5
5529d03df3077827cd2ff00a863a50c8

SHA1
d7296b4b7b46439fcf0ca6e72dadeff99040eae7

SHA256
135c2fd042f8aa99fd1f118c25f48212bad5f7d74d93d2ce9d81732daf6edc02

SHA512
9212f7a409231957e45a17848670fd3f81ccd855fd5dcdd1167d2cece80d5bb88d68eed39ef18b2dc08f15e1f5bd316a220ad15de0337960f6da39c7a838a170

Download Submit
C:\Windows\system\EheYlFa.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\FKqebyq.exe

Filesize
1.9MB

MD5
c12fa39825bf52e8bc4927e11e64c2e4

SHA1
001c1e559034c2a54f46fe11749b1b52e40a0b55

SHA256
0eca5bc64ba620b6f4aeded55178796ecc0e33b1953bea1ab3fa20982d803c9b

SHA512
1b7415344f5e8b526d7f9710cf70ec0b45e109dd56c1d8c280408f0d6c1a23596eb4096cbf946068208497bea7ac5ea011a1af8dbc8f92cd4a1bb429fd498567

Download Submit
C:\Windows\system\HNwWqOr.exe

Filesize
1.9MB

MD5
3932154df637c7192296422d173766d9

SHA1
fd4236e988c55fa4d336e6524d2f8377a39b1813

SHA256
af19fe68461aae064ca833af3e407dfcbf8aaeef93cc69719a109e625bdccdf7

SHA512
ebb453213bbd249d737bcfeecc7107b66c874f182a6c71fbc2ab11239210cbffaaf466bc38d06ec4feb798831f5ef86aef228200c2345af242a7c824bfa9a2dd

Download Submit
C:\Windows\system\HXfgvUD.exe

Filesize
1.9MB

MD5
66ae19b143c7d3f5f5a160246ab81636

SHA1
c31111358443df2c40bd75bf15dfc1d3d79eea08

SHA256
58e2e070142eb2bd7da4ddf1ba81deeb6d945db3ca2a5b7290aeb400e9ddd95f

SHA512
9dd462c47af2b7dcb2c6941977726d3bd19f468a6ac2fb5df0895a81da01dfd38a52f7d080737261f860b411dc5cb1410cf228a524e283aef458339e531b65c7

Download Submit
C:\Windows\system\KFbJYlC.exe

Filesize
1.9MB

MD5
306df35632347b9f652821a623aa9865

SHA1
c67a9588b24121d02f18c65c3aac18133ccf4487

SHA256
e3f5178a6bef8886f1aee97883055e5a0b6a01f6d3d9ae429f4c299d1638aa90

SHA512
2e260c1195760a4ddb8441ecae8b8a985fb4b99d2f59f2f06f67640c033a190d50e694e3908220319af6ddd24e5dcd83a82185bd67f33b9579dfb873d3f4fdf8

Download Submit
C:\Windows\system\KSHjwXh.exe

Filesize
1.9MB

MD5
c470318cb39acc95d81083f9d1769805

SHA1
3cf827594866fbff7b04cb306faa7315b4581d8a

SHA256
d57d434e8e2ad2918617f1463d556ba307fbab57fa983d2b293e1793b8e7a0cc

SHA512
4ab1ba20b9f0fb05c6d131410ec2f4428752e79fa33f5548263f2595b6a240724ac3eac846f17af7adaab17d1b1c399d5ab302fc4bceb135ef4672d55f3603d9

Download Submit
C:\Windows\system\KguNMFX.exe

Filesize
1.9MB

MD5
f62089b4f63ab152839ea00f656165db

SHA1
8f99635f80c35b215201db506c99901fae7a40b3

SHA256
98f4d682703ce0994c9168efe90b82fcd7a15086dbacb21fe73f92f187bcebd1

SHA512
f7ec815cf9c4bc9fbc0171ec76d951a9b3cf69c9fc2b86e89eff9a3f9d0edb6b346fb8fa45e066f6edaac17e0f276ff6960a5f6733db241b5f63bb6c1daa488b

Download Submit
C:\Windows\system\NGALokm.exe

Filesize
1.9MB

MD5
866b29146f48ba3dcf152148da3a4033

SHA1
432256098c0f3d84d8f6c6b3399801a774d944b0

SHA256
005be5c98ba9a340f11e8f16d84911db4a573ef9032dc5fd949f265c89102824

SHA512
5e826e89eb325d86510656aa526c5510c65e85d4f6a261c77da2f2cf576ff9e8dafb54816214a26d1590c4e172276604f7b9e6369e95c5f17d677a6ce3fd273d

Download Submit
C:\Windows\system\QBTChCK.exe

Filesize
1.9MB

MD5
29bbd2323455868697fbf6a13d6d9388

SHA1
4b2aba69e770918c9b7a3f51acf949bb196ee678

SHA256
622e2bd814dc7218dae5c159a8cd8b1ce80c0ac5be32ba070a3348f532f56a18

SHA512
cd07330625b182f5df99cc655bdfcfae05d4f3fc87a4745605dbaca1b0149993e9af2db41562e84a57a1d54c2d065ca86fa9bdb1c76e7dd3f0e6d09d74f63927

Download Submit
C:\Windows\system\QTUnhJy.exe

Filesize
1.9MB

MD5
6025dffcb8fd8ab93db9bd578690100b

SHA1
ebb839094fbe3624ce68ce362e82a43765b70727

SHA256
69be57ffe82777e92ef87e675a3ed498fe1b1d125b4e7a7a44cba60bcc246ee8

SHA512
341a7b55c65788c9175418c2dc4382faff7b06c21497d4e3a62808c5ef63e7cdf0eb3fa9cd541df52dbe4cff27c6fa3b9b4e2d911bb9c7bb6ed6fcc61eb46b61

Download Submit
C:\Windows\system\SsnHPlC.exe

Filesize
1.9MB

MD5
735f08cd3ac85c1072a61f40a8e2bfa1

SHA1
946c9e2bd1e1a04eacaa06d1c9d0322dd21c4118

SHA256
f9fd4eb27ede33ff6188759860592e63ca5a7ede305bba37e515957324792b11

SHA512
ef61c8e2de9998637c6e8e8c691090bd5777d0411943f09a70924d27fa25118a2d9ef22e00ba17757e49019ce9c0c09aa2d9ccef0f0fa387a31e0c621bac05dc

Download Submit
C:\Windows\system\UIKfyrL.exe

Filesize
1.9MB

MD5
894e2776d721c623d140871f11187f2a

SHA1
907916de9e4b5b6ed40e908e5063c25e147a45f1

SHA256
aa0cf0d67a678e21fa6c9c4961798c06073720bbda221672602d5075bda8b97d

SHA512
4dc9e807b4d04638dde49c8cd6ddc1e0026a70f4955ada6ec2421c0e3b4cf6208ba72798337baaed5edcac541b192e0782962707c9d366a460a413b110930af8

Download Submit
C:\Windows\system\eTAgDQz.exe

Filesize
1.9MB

MD5
077496e3dce84e072d68f452e112aded

SHA1
92a0f98edf2936e4f7b2d7d92dd47899c9bf7eab

SHA256
c50241caa7168d03dd80f6c1fc13ccd20884951a3c228e0ba471e62c4de74385

SHA512
89d72a49f6726ab92545ef05114c8ed5649089b16cbac1804bfe3ffa1bc0372a37ff3eaed9d5a1be048c7419f8eb4274b3f213278bf5ace61b1b43bb9a06719f

Download Submit
C:\Windows\system\fyIYHuw.exe

Filesize
1.9MB

MD5
4a08593423f17eda8c47bae4a8365afa

SHA1
bcd480b85c78058358865cc1fb976843c7ad9d90

SHA256
5b525e802cb815140b7b39adece0f105615b38486f88573b0387d7c9db96889e

SHA512
fa5690d9e8e3bb6f85f852b2a942c20e219955decf1b583b543ad9bd755169cf142adf8a4befbbdcd566d6c67734ad91e993555848f07891fd3f83fcbc4c8c7c

Download Submit
C:\Windows\system\gLAdJJu.exe

Filesize
1.9MB

MD5
23ba5ef91f274fbe16b806791c644f7d

SHA1
2cc4e3ffb22cd87988fe5717f58b0437b3faa6bf

SHA256
0a6601bea5ce6b8fdf2e058673f2e3e1b31e515416d6cbce9ed420f9094a6f48

SHA512
0b9c32614a2a09ec02bccc50e2e1ed0d5997ab90a7ddc07604b674ed0cf8bfb13e609862e7dac6a8912ef712d7a0083ff689aa70ad7745515325c4cbb1631c68

Download Submit
C:\Windows\system\pCYQFKx.exe

Filesize
1.9MB

MD5
5b64f65795c174b1c6b4fb03322feec0

SHA1
3b44946f560d7e8be3da0d575b71133f083b5ff0

SHA256
10af551fe29b5cefa3a7b92c9be88ce0dc0d5322f688acc859ce38a6f6fa3e96

SHA512
a0a65f3b8fc072bcc8ead58001356c765bdd28c84a92559ac8f15ad89e041ef79c2a3c86d76313c2b124c79d002fc29a3a01953738603f49860670856a49b713

Download Submit
C:\Windows\system\pJjdBqA.exe

Filesize
1.9MB

MD5
c1ce9a479e3236f4b468041eaa101ac5

SHA1
02f26c3e3b91479078c75e75c391a59a7378ef7f

SHA256
df94498d55a799a417d340df5053fc97373953539388fc6825acb22432861945

SHA512
8931a69fc5e041b502cf2201405f4d46ce1899b7cb0824f47d6f464ce8fba611ecd8c255aa18b17fa7b080cbe12a36d9a11cd1820d295c6c74ccc9aaae4cdb49

Download Submit
C:\Windows\system\uTqUHSA.exe

Filesize
1.9MB

MD5
0dbb56e7101a1139ed3d4984d7232c75

SHA1
044e31bf95ee554bde6549981f2a76f551d7d4a8

SHA256
3beac7ce71b1d36b63d09c718b904ccdf321c75709afb84e2dcd274bd2d3e1be

SHA512
36f9e6fd0dfb5386f548a94730de49092e56ca99db859af1ee68bf37a73d5faf3a0b3faf75bbc32bf94db57a8dd02b6cf0f0333a92d1c57cdaa220f77e16feb3

Download Submit
C:\Windows\system\vlFaWpf.exe

Filesize
1.9MB

MD5
7e9ea9e96f542561e8987b79b9d09ba8

SHA1
648cfbc96e48ddcb874d8e4bffa277218460dc31

SHA256
5d6081273d3be6fdcaa5f20f7c80fdc8fbeb2488f1a15440a7fb83c385666574

SHA512
9987d85ab9cb83f4ade59ecc5b85b247e4d4c332d5ff2d7b8a5dae0da463dfe45c5801d96f26be5158cb45674687701e728de2e2bfa22c71fd32bc9fce4c3a60

Download Submit
C:\Windows\system\wbNUGEL.exe

Filesize
1.9MB

MD5
1ece9ba8257a6a755eb74e21c4adb7cc

SHA1
1115c651df800e641747157ea153d624fb9e6c14

SHA256
c0c78968c1b897532d8bb294d02b8f077170fe5a1199554e0219b1276af4dca4

SHA512
56b591c9f4daa34320d24ce346afb2140ceb0989a979b0377e0831870b1b95d4eab3ea48a8eee1849f7fa654410d1affc461ef990de01512b5e408c750cba371

Download Submit
C:\Windows\system\yIRMWgP.exe

Filesize
1.9MB

MD5
bb3ebe75104a7277930aff3d4f0e8308

SHA1
5be99c53caa41ffb95fe462e73a5e6fd5a40f824

SHA256
1262e266f6818d3f9753b920d5cbd0c4638ee7e39c82479e5587bf56d0cdc5e4

SHA512
d62d29f1218118393265c66186a76d93fa4456f961b1c2ae9e177405c6232144bb8841215de11dc6a99807b5a0479fd28083680e396c155f066ec4413ff14be8

Download Submit
C:\Windows\system\zunVvoH.exe

Filesize
1.9MB

MD5
ef6d61fc0d82beae94dcf5c5956f7607

SHA1
fd9839bd6822f63e3d46a286cb6afcabb3a2d081

SHA256
c9325b522b06b02472016a6278b518106c64e8ff58759be86260e66898b41287

SHA512
79e126e885c154894ec0694bbbb8586406bf949143fae6d843405c3f61aa3c162b857224f16c1f13d6770ca7575703ea10b6d6f345de11ed1719bbd189113863

Download Submit
\Windows\system\KIcEHIX.exe

Filesize
1.9MB

MD5
63b2e3a1b216f7ac8af5f138ff79fd25

SHA1
342c6573b076650a46ac55c03719e5af99ec3e83

SHA256
70525c397cbf65a8957abdc737f84e5553e001fc4b1b9166b4e4d74ded2844f4

SHA512
6ef159e7936a52a420475d41279c112f5e2635bdce31a746bf4448b675d3479180b5f53a73c571d299b0e5cb1fe8f59595afdc791f5cdea174462f2c13023758

Download Submit
\Windows\system\QPoROog.exe

Filesize
1.9MB

MD5
bbd4f9bb5b35d88c854d3d87942ada01

SHA1
3e960e52e290aa69d93c7b0c84c071eafd40b11c

SHA256
a24b969aabf385b711dd7449beccf0c6a0d25e95a7cce7df92739cd11a199e83

SHA512
753b0c398d8ddf732cc5c8f7e333348ba4f76f5031c18225de135a0db6c2c824747fcba5eacef947d2272ad0c98e8172b122b3d4fccc92e60196d7042d17627a

Download Submit
\Windows\system\RSJtmwZ.exe

Filesize
1.9MB

MD5
e762297fa85cae1121e4e73f9ed7be1b

SHA1
2f62cddfaa1b3c5080fd6d47a9532e1dfdd09611

SHA256
876dec4a6c6e1adf0f15b18b047900e0fbf4cd4b5a882a767fd9c7832af17ced

SHA512
17d82dc989e405416e6be00d2ba5f13b25adaa9effadcc0ed3dd561ea43f7f5aa916626e37f02e6b95d78197361562cbc5dab46f4474942c6c56e9df14c2aa76

Download Submit
\Windows\system\etVFwJe.exe

Filesize
1.9MB

MD5
494609f8780c25ca6d211df1f01f375c

SHA1
b5b186b9efa7f8d02650940cbd31befae912a8df

SHA256
b7148ad8de6282f23ffae0ae1c23166254725550a9c38bd916fcec6a3db1db9a

SHA512
2b6f993eae857f7f42cfd9107e59e1267c40d516c075673c10a140ea9e9a4c369daffc4e17b42f0e38843c574017b7a6d5ec7692ae9ca1cc1979744da4707f98

Download Submit
\Windows\system\hjexwqu.exe

Filesize
1.9MB

MD5
ad22ff16402162a9dfd119c4c88fc976

SHA1
e3e60700778b05cda243654cd60dd0b37f0d6415

SHA256
dc8f790ed98564c0397ce96b3b365c639c35e2def75a095e07bbe79423d631e1

SHA512
71c735647c8aa1977fb66a904a04f6f681dc6c907369009b7cb857f03ea6d67ddc29172fd23f87b0fead9d419545229b13a58b51e6d3553970dec3efc0ef6982

Download Submit
\Windows\system\mTMWHeG.exe

Filesize
1.9MB

MD5
ae098b2be5c04298fede3c9a646973fa

SHA1
859a648b422db55965de960d25a68e33e77fa069

SHA256
26f45c445f1c31ece6a02b0382384aca6abc36ca657e53f930ceec4a747608a2

SHA512
b58ad8fd9eb7269ed3c11af0f4719a59096afb1c2422fab96913238418c9e715870057b41a36125ef44a655cdabafb0fe88227a0ab557b33970cc5a75c567e64

Download Submit
\Windows\system\ooZihWP.exe

Filesize
1.9MB

MD5
32663bf20e94fa0e54acec0a20e82629

SHA1
ac2993341a1a5819e64b91819cfffb6906029389

SHA256
9c5430832cbc6a462a99fbeb813bbcfdb5d32bae7ebafaa86534e66165a755ec

SHA512
76a93b0267a5c96f43792e961945e4d78de255ba9a723ddf54a82d0ae650b1a26ba3c0c4c61925e14f0acec3d75ceb9abdd7a08ee3d81cc18ec2e0730d2b424b

Download Submit
\Windows\system\pxpmATR.exe

Filesize
1.9MB

MD5
f4fcd08f2d78a77eda6133317a94ce72

SHA1
17ca4a526390052ca04a12a974af96c829edaa9d

SHA256
6e7b9848bcfd0dd5f39bcb3796ba11f48e496b1b1bdf7ef2a94de37602461cc3

SHA512
2d4f8033dcfc4b74d9235caa016ff327481a051650823a71d2f5645242bc45bb0d662a1a40207ebf50585058dd00d073ea87fe4a311bd34aa2d96ddfaa5446d1

Download Submit
memory/1744-229-0x000000001B550000-0x000000001B832000-memory.dmp

Filesize
2.9MB

Download
memory/1744-230-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/1764-15-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-4640-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-84-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-4641-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2040-76-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2140-23-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-4645-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2524-75-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2588-77-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2588-8-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-83-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2588-85-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2588-74-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2588-21-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2588-59-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2588-48-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-2-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2588-628-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2588-51-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2588-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2588-81-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2588-17-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2600-22-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2600-4654-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2644-50-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-4666-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-37-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2748-43-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-5456-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-35-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2956-4670-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download