xmrig | b65ce2f805ceadb07eb071b2e5d982a363015027e3e3afa713e4184feb2940e5

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
Size

1.8MB
MD5

32f5926964e117e81a4d7b7439f81f1b
SHA1

1a8b76daa18576daee2f9f95f5a227416e78c25c
SHA256

b65ce2f805ceadb07eb071b2e5d982a363015027e3e3afa713e4184feb2940e5
SHA512

432518a39744cd46ded0c43714ae7f349e7d69986fbf1ed0d12d2c0fc8540b74e11d86cd757fbc9ddc81d51eed3ced5e048d9099df3344ba844ddbec260777f1
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFti:Lz071uv4BPMkibTIA5I4TNrpDGgDQGpB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2356-13-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2664-59-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2620-112-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2504-120-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2484-119-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2624-115-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2764-100-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2728-98-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2964-96-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2676-73-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2604-54-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2356-4265-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2764-4431-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2964-4428-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2484-4429-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2664-4425-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2504-4426-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2620-4422-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2676-4274-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2864-7358-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2308	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2356	KhGVnPh.exe
2604	yLeMTOU.exe
2664	EsEStAS.exe
2676	KTLUpdr.exe
2964	NWYYrjy.exe
2728	ngHqyCy.exe
2764	CpoGGts.exe
2620	ZGDywKO.exe
2624	kbTyzAG.exe
2484	FXlSCpq.exe
2504	xxHMCvI.exe
2340	kKyZVes.exe
2556	XpKdrgD.exe
2744	jXtaOlC.exe
2872	fzuNvsv.exe
1888	usaQnjE.exe
344	ZuGYGHq.exe
1760	UUKILHF.exe
1424	ktwCVcm.exe
1612	yOdubok.exe
1620	ubcEGYC.exe
1520	gJgzkzg.exe
2100	VTAEzLL.exe
1968	wjMrIiW.exe
1392	NPfgjIZ.exe
1648	wDUPHbB.exe
584	FyPldIr.exe
2312	VhgRXAS.exe
2552	tozVzDW.exe
2424	uSMXUNS.exe
3000	LJSRZFd.exe
1548	VFhHzzn.exe
964	RTrsGGo.exe
1920	aVSetnB.exe
3068	rBHPNqV.exe
3060	YXCoNFd.exe
864	pCLOgpU.exe
2156	dAcwNTb.exe
840	MMZsPdF.exe
1904	RYMmHgK.exe
992	FnbSHhK.exe
2996	fSipjfd.exe
2940	DpEpQuF.exe
3052	Pmhqotk.exe
1504	QRNoWuK.exe
2056	NDkqoof.exe
2364	HahKgil.exe
1596	GAfiaHc.exe
1724	CKPOeaA.exe
1280	BwnNRwm.exe
2792	pFxaJsZ.exe
848	SLNelbs.exe
2800	SvErIfy.exe
2928	EctoYuz.exe
2688	ZIpCVoT.exe
2628	knfqgoN.exe
2708	NjUmzmB.exe
2888	WBLZtHp.exe
2784	WQoSuTW.exe
2440	fSEXmid.exe
2336	VzekjHi.exe
1528	ohVlDBV.exe
332	UKxomeL.exe
2288	oSRmmGe.exe

Loads dropped DLL 64 IoCs

pid	Process
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2864-2-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x000b00000001267a-6.dat	upx
behavioral1/files/0x002b000000012721-19.dat	upx
behavioral1/memory/2356-13-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/files/0x000900000001322b-24.dat	upx
behavioral1/files/0x000e0000000054ab-23.dat	upx
behavioral1/files/0x000800000001332e-29.dat	upx
behavioral1/files/0x000a000000013413-42.dat	upx
behavioral1/files/0x000800000001340b-38.dat	upx
behavioral1/files/0x000900000001341c-44.dat	upx
behavioral1/memory/2664-59-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0006000000014312-68.dat	upx
behavioral1/files/0x00060000000143e5-81.dat	upx
behavioral1/files/0x000600000001443b-90.dat	upx
behavioral1/files/0x0006000000014597-109.dat	upx
behavioral1/files/0x000600000001458c-106.dat	upx
behavioral1/memory/2620-112-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x002b000000012747-135.dat	upx
behavioral1/files/0x0006000000014826-160.dat	upx
behavioral1/files/0x0006000000014fa2-195.dat	upx
behavioral1/files/0x0006000000014bbc-186.dat	upx
behavioral1/files/0x0006000000014e71-191.dat	upx
behavioral1/files/0x0006000000014b18-175.dat	upx
behavioral1/files/0x0006000000014b4c-180.dat	upx
behavioral1/files/0x0006000000014a9a-170.dat	upx
behavioral1/files/0x000600000001487f-165.dat	upx
behavioral1/files/0x000600000001471a-155.dat	upx
behavioral1/files/0x00060000000146fc-146.dat	upx
behavioral1/files/0x0006000000014712-150.dat	upx
behavioral1/files/0x00060000000146f4-139.dat	upx
behavioral1/files/0x000600000001469d-131.dat	upx
behavioral1/memory/2504-120-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2484-119-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2624-115-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x00060000000144e8-105.dat	upx
behavioral1/memory/2764-100-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2728-98-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2964-96-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/files/0x0006000000014358-89.dat	upx
behavioral1/files/0x0006000000014326-87.dat	upx
behavioral1/memory/2676-73-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x0006000000014228-67.dat	upx
behavioral1/files/0x0006000000014246-63.dat	upx
behavioral1/memory/2604-54-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2356-4265-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2764-4431-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2964-4428-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2484-4429-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2664-4425-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2504-4426-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2620-4422-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2676-4274-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2864-7358-0x000000013F530000-0x000000013F922000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GsAWfZD.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\UUGdEiI.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ISxuNrf.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\fFcAPIt.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\cnbIfDf.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\iYMflKo.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ltaGTJj.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ZQyuDHB.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\qSxxxQw.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\GRCtrHH.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\XPleiUS.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\AdDEFCP.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\MLoJfnZ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\DZNLxmc.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\OsuMbhb.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\XGLYpHb.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\mBVZaiA.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\nRkpylX.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\IPPjfgl.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\MuDsFzs.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\hPVmbtx.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\zFepFeZ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\jXnexIx.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\iKIEmBK.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\cTtDOaM.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\rcnDVpO.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\wXScYTT.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\tNgjBWq.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\GbHObhD.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\QhzGAaA.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\LZSjAzH.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\UkEngZU.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\bnKjGaW.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\eXhFAGj.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\XmrrZkW.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\KhutJQp.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\wKVWvwO.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\DEQxyBE.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\BAiUOkc.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\pqWYUSo.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\msZhmpC.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\rXYpvzP.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\VbouxiZ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\jDjzleE.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\aTPTCls.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\bcMRTIA.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\GqiPpcc.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\htHkgKL.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\vLcaYlw.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\YaXGFKe.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\MpbFPTs.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\TmYfULx.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\YHQfpiC.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\YmPOmfR.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\ppHUIzb.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\zJObIsr.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\bmXumxj.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\NEvZVOd.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\eZgKPHo.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\XuBDYOR.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\hbWlmfk.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\QviOHUY.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\GZqIIsZ.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
File created	C:\Windows\System\zxcpYCy.exe	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2308	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
Token: SeDebugPrivilege	2308	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2308	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2308	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2308	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2356	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2356	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2356	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2604	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2604	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2604	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2664	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2664	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2664	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2676	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2676	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2676	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2964	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2964	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2964	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2728	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2728	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2728	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2764	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2764	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2764	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2620	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2620	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2620	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2484	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2484	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2484	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2624	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2624	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2624	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2504	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2504	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2504	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2340	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2340	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2340	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2556	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	42
PID 2864 wrote to memory of 2556	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	42
PID 2864 wrote to memory of 2556	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	42
PID 2864 wrote to memory of 2872	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	43
PID 2864 wrote to memory of 2872	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	43
PID 2864 wrote to memory of 2872	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	43
PID 2864 wrote to memory of 2744	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	44
PID 2864 wrote to memory of 2744	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	44
PID 2864 wrote to memory of 2744	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	44
PID 2864 wrote to memory of 1888	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	45
PID 2864 wrote to memory of 1888	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	45
PID 2864 wrote to memory of 1888	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	45
PID 2864 wrote to memory of 344	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	46
PID 2864 wrote to memory of 344	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	46
PID 2864 wrote to memory of 344	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	46
PID 2864 wrote to memory of 1760	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1760	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1760	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1424	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	48
PID 2864 wrote to memory of 1424	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	48
PID 2864 wrote to memory of 1424	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	48
PID 2864 wrote to memory of 1612	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	49
PID 2864 wrote to memory of 1612	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	49
PID 2864 wrote to memory of 1612	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	49
PID 2864 wrote to memory of 1620	2864	32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\32f5926964e117e81a4d7b7439f81f1b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\System\KhGVnPh.exe
  C:\Windows\System\KhGVnPh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\yLeMTOU.exe
  C:\Windows\System\yLeMTOU.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\EsEStAS.exe
  C:\Windows\System\EsEStAS.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\KTLUpdr.exe
  C:\Windows\System\KTLUpdr.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\NWYYrjy.exe
  C:\Windows\System\NWYYrjy.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ngHqyCy.exe
  C:\Windows\System\ngHqyCy.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\CpoGGts.exe
  C:\Windows\System\CpoGGts.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ZGDywKO.exe
  C:\Windows\System\ZGDywKO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\FXlSCpq.exe
  C:\Windows\System\FXlSCpq.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\kbTyzAG.exe
  C:\Windows\System\kbTyzAG.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\xxHMCvI.exe
  C:\Windows\System\xxHMCvI.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\kKyZVes.exe
  C:\Windows\System\kKyZVes.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\XpKdrgD.exe
  C:\Windows\System\XpKdrgD.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\fzuNvsv.exe
  C:\Windows\System\fzuNvsv.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\jXtaOlC.exe
  C:\Windows\System\jXtaOlC.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\usaQnjE.exe
  C:\Windows\System\usaQnjE.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\ZuGYGHq.exe
  C:\Windows\System\ZuGYGHq.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\UUKILHF.exe
  C:\Windows\System\UUKILHF.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ktwCVcm.exe
  C:\Windows\System\ktwCVcm.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\yOdubok.exe
  C:\Windows\System\yOdubok.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ubcEGYC.exe
  C:\Windows\System\ubcEGYC.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\gJgzkzg.exe
  C:\Windows\System\gJgzkzg.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\VTAEzLL.exe
  C:\Windows\System\VTAEzLL.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\wjMrIiW.exe
  C:\Windows\System\wjMrIiW.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\NPfgjIZ.exe
  C:\Windows\System\NPfgjIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\wDUPHbB.exe
  C:\Windows\System\wDUPHbB.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\FyPldIr.exe
  C:\Windows\System\FyPldIr.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\VhgRXAS.exe
  C:\Windows\System\VhgRXAS.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\tozVzDW.exe
  C:\Windows\System\tozVzDW.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\uSMXUNS.exe
  C:\Windows\System\uSMXUNS.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\LJSRZFd.exe
  C:\Windows\System\LJSRZFd.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\VFhHzzn.exe
  C:\Windows\System\VFhHzzn.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\RTrsGGo.exe
  C:\Windows\System\RTrsGGo.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\aVSetnB.exe
  C:\Windows\System\aVSetnB.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\rBHPNqV.exe
  C:\Windows\System\rBHPNqV.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\YXCoNFd.exe
  C:\Windows\System\YXCoNFd.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\pCLOgpU.exe
  C:\Windows\System\pCLOgpU.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\dAcwNTb.exe
  C:\Windows\System\dAcwNTb.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\MMZsPdF.exe
  C:\Windows\System\MMZsPdF.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\RYMmHgK.exe
  C:\Windows\System\RYMmHgK.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\FnbSHhK.exe
  C:\Windows\System\FnbSHhK.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\fSipjfd.exe
  C:\Windows\System\fSipjfd.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\DpEpQuF.exe
  C:\Windows\System\DpEpQuF.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\Pmhqotk.exe
  C:\Windows\System\Pmhqotk.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\QRNoWuK.exe
  C:\Windows\System\QRNoWuK.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\NDkqoof.exe
  C:\Windows\System\NDkqoof.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\HahKgil.exe
  C:\Windows\System\HahKgil.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\CKPOeaA.exe
  C:\Windows\System\CKPOeaA.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\GAfiaHc.exe
  C:\Windows\System\GAfiaHc.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\BwnNRwm.exe
  C:\Windows\System\BwnNRwm.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\pFxaJsZ.exe
  C:\Windows\System\pFxaJsZ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\SLNelbs.exe
  C:\Windows\System\SLNelbs.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\SvErIfy.exe
  C:\Windows\System\SvErIfy.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\EctoYuz.exe
  C:\Windows\System\EctoYuz.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ZIpCVoT.exe
  C:\Windows\System\ZIpCVoT.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\knfqgoN.exe
  C:\Windows\System\knfqgoN.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\NjUmzmB.exe
  C:\Windows\System\NjUmzmB.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\WBLZtHp.exe
  C:\Windows\System\WBLZtHp.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\WQoSuTW.exe
  C:\Windows\System\WQoSuTW.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\UKxomeL.exe
  C:\Windows\System\UKxomeL.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\fSEXmid.exe
  C:\Windows\System\fSEXmid.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\bUPRShR.exe
  C:\Windows\System\bUPRShR.exe
  2⤵
  PID:1896
- C:\Windows\System\VzekjHi.exe
  C:\Windows\System\VzekjHi.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\xGaMVAq.exe
  C:\Windows\System\xGaMVAq.exe
  2⤵
  PID:2372
- C:\Windows\System\ohVlDBV.exe
  C:\Windows\System\ohVlDBV.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\BjiTMFS.exe
  C:\Windows\System\BjiTMFS.exe
  2⤵
  PID:1576
- C:\Windows\System\oSRmmGe.exe
  C:\Windows\System\oSRmmGe.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\RXumsyb.exe
  C:\Windows\System\RXumsyb.exe
  2⤵
  PID:2300
- C:\Windows\System\GqNyyTk.exe
  C:\Windows\System\GqNyyTk.exe
  2⤵
  PID:2224
- C:\Windows\System\HITEyVU.exe
  C:\Windows\System\HITEyVU.exe
  2⤵
  PID:1744
- C:\Windows\System\JCLCWia.exe
  C:\Windows\System\JCLCWia.exe
  2⤵
  PID:3012
- C:\Windows\System\BYniqeo.exe
  C:\Windows\System\BYniqeo.exe
  2⤵
  PID:1552
- C:\Windows\System\WVsAXTW.exe
  C:\Windows\System\WVsAXTW.exe
  2⤵
  PID:1608
- C:\Windows\System\JHnkJhb.exe
  C:\Windows\System\JHnkJhb.exe
  2⤵
  PID:1868
- C:\Windows\System\yNcYSVR.exe
  C:\Windows\System\yNcYSVR.exe
  2⤵
  PID:1696
- C:\Windows\System\lxYvwhc.exe
  C:\Windows\System\lxYvwhc.exe
  2⤵
  PID:1656
- C:\Windows\System\olFpeGV.exe
  C:\Windows\System\olFpeGV.exe
  2⤵
  PID:560
- C:\Windows\System\ZoUJAKV.exe
  C:\Windows\System\ZoUJAKV.exe
  2⤵
  PID:1808
- C:\Windows\System\OMBOqVf.exe
  C:\Windows\System\OMBOqVf.exe
  2⤵
  PID:1988
- C:\Windows\System\tKVefAx.exe
  C:\Windows\System\tKVefAx.exe
  2⤵
  PID:892
- C:\Windows\System\AQJTSSE.exe
  C:\Windows\System\AQJTSSE.exe
  2⤵
  PID:1712
- C:\Windows\System\byHXmtn.exe
  C:\Windows\System\byHXmtn.exe
  2⤵
  PID:2736
- C:\Windows\System\yQYjROE.exe
  C:\Windows\System\yQYjROE.exe
  2⤵
  PID:2548
- C:\Windows\System\HmZJURg.exe
  C:\Windows\System\HmZJURg.exe
  2⤵
  PID:2584
- C:\Windows\System\ZkJozZD.exe
  C:\Windows\System\ZkJozZD.exe
  2⤵
  PID:2460
- C:\Windows\System\aSfsIEk.exe
  C:\Windows\System\aSfsIEk.exe
  2⤵
  PID:2900
- C:\Windows\System\eyusTgU.exe
  C:\Windows\System\eyusTgU.exe
  2⤵
  PID:2636
- C:\Windows\System\PYafQcM.exe
  C:\Windows\System\PYafQcM.exe
  2⤵
  PID:1900
- C:\Windows\System\vzKqVYQ.exe
  C:\Windows\System\vzKqVYQ.exe
  2⤵
  PID:2432
- C:\Windows\System\dSqdzgO.exe
  C:\Windows\System\dSqdzgO.exe
  2⤵
  PID:1776
- C:\Windows\System\eByxUpd.exe
  C:\Windows\System\eByxUpd.exe
  2⤵
  PID:2344
- C:\Windows\System\TjVOnSV.exe
  C:\Windows\System\TjVOnSV.exe
  2⤵
  PID:2816
- C:\Windows\System\VPnRAIR.exe
  C:\Windows\System\VPnRAIR.exe
  2⤵
  PID:2004
- C:\Windows\System\SWyztin.exe
  C:\Windows\System\SWyztin.exe
  2⤵
  PID:2068
- C:\Windows\System\zrQhMTw.exe
  C:\Windows\System\zrQhMTw.exe
  2⤵
  PID:628
- C:\Windows\System\OkrHQqj.exe
  C:\Windows\System\OkrHQqj.exe
  2⤵
  PID:2952
- C:\Windows\System\fkKIHFx.exe
  C:\Windows\System\fkKIHFx.exe
  2⤵
  PID:2124
- C:\Windows\System\WLmrwJq.exe
  C:\Windows\System\WLmrwJq.exe
  2⤵
  PID:1256
- C:\Windows\System\sBQXnLO.exe
  C:\Windows\System\sBQXnLO.exe
  2⤵
  PID:1336
- C:\Windows\System\bkQZhBm.exe
  C:\Windows\System\bkQZhBm.exe
  2⤵
  PID:2804
- C:\Windows\System\ESqXQtC.exe
  C:\Windows\System\ESqXQtC.exe
  2⤵
  PID:912
- C:\Windows\System\ZZIKqEm.exe
  C:\Windows\System\ZZIKqEm.exe
  2⤵
  PID:2076
- C:\Windows\System\pUNuKcH.exe
  C:\Windows\System\pUNuKcH.exe
  2⤵
  PID:2568
- C:\Windows\System\VodjLrK.exe
  C:\Windows\System\VodjLrK.exe
  2⤵
  PID:2448
- C:\Windows\System\XUsCfih.exe
  C:\Windows\System\XUsCfih.exe
  2⤵
  PID:1980
- C:\Windows\System\iOZCsxd.exe
  C:\Windows\System\iOZCsxd.exe
  2⤵
  PID:2128
- C:\Windows\System\qtMUUMi.exe
  C:\Windows\System\qtMUUMi.exe
  2⤵
  PID:2732
- C:\Windows\System\qVsVuUE.exe
  C:\Windows\System\qVsVuUE.exe
  2⤵
  PID:1536
- C:\Windows\System\mHhBHLv.exe
  C:\Windows\System\mHhBHLv.exe
  2⤵
  PID:1692
- C:\Windows\System\FmwPEeF.exe
  C:\Windows\System\FmwPEeF.exe
  2⤵
  PID:2304
- C:\Windows\System\ysFuAsD.exe
  C:\Windows\System\ysFuAsD.exe
  2⤵
  PID:1828
- C:\Windows\System\LIsjCBF.exe
  C:\Windows\System\LIsjCBF.exe
  2⤵
  PID:2644
- C:\Windows\System\IzeVOtC.exe
  C:\Windows\System\IzeVOtC.exe
  2⤵
  PID:1892
- C:\Windows\System\IIhdVlm.exe
  C:\Windows\System\IIhdVlm.exe
  2⤵
  PID:2828
- C:\Windows\System\LWGwbpJ.exe
  C:\Windows\System\LWGwbpJ.exe
  2⤵
  PID:1044
- C:\Windows\System\DEBoWTd.exe
  C:\Windows\System\DEBoWTd.exe
  2⤵
  PID:1708
- C:\Windows\System\UsEdUtM.exe
  C:\Windows\System\UsEdUtM.exe
  2⤵
  PID:1816
- C:\Windows\System\tDkhMVo.exe
  C:\Windows\System\tDkhMVo.exe
  2⤵
  PID:2592
- C:\Windows\System\vmKoUSn.exe
  C:\Windows\System\vmKoUSn.exe
  2⤵
  PID:2692
- C:\Windows\System\AKqrhWJ.exe
  C:\Windows\System\AKqrhWJ.exe
  2⤵
  PID:2200
- C:\Windows\System\pPJmPzG.exe
  C:\Windows\System\pPJmPzG.exe
  2⤵
  PID:2172
- C:\Windows\System\FkkSxte.exe
  C:\Windows\System\FkkSxte.exe
  2⤵
  PID:1652
- C:\Windows\System\uwSVxJM.exe
  C:\Windows\System\uwSVxJM.exe
  2⤵
  PID:1688
- C:\Windows\System\YHYHMAl.exe
  C:\Windows\System\YHYHMAl.exe
  2⤵
  PID:2780
- C:\Windows\System\wPqbQGS.exe
  C:\Windows\System\wPqbQGS.exe
  2⤵
  PID:804
- C:\Windows\System\YnfOiDc.exe
  C:\Windows\System\YnfOiDc.exe
  2⤵
  PID:1524
- C:\Windows\System\pbEzzXq.exe
  C:\Windows\System\pbEzzXq.exe
  2⤵
  PID:692
- C:\Windows\System\VCMIWwO.exe
  C:\Windows\System\VCMIWwO.exe
  2⤵
  PID:836
- C:\Windows\System\ZUBsJDe.exe
  C:\Windows\System\ZUBsJDe.exe
  2⤵
  PID:2000
- C:\Windows\System\lwboEbt.exe
  C:\Windows\System\lwboEbt.exe
  2⤵
  PID:2468
- C:\Windows\System\ZSsrhmy.exe
  C:\Windows\System\ZSsrhmy.exe
  2⤵
  PID:3032
- C:\Windows\System\sWxHUQZ.exe
  C:\Windows\System\sWxHUQZ.exe
  2⤵
  PID:2400
- C:\Windows\System\YLTlptS.exe
  C:\Windows\System\YLTlptS.exe
  2⤵
  PID:1624
- C:\Windows\System\rGfKEkp.exe
  C:\Windows\System\rGfKEkp.exe
  2⤵
  PID:2180
- C:\Windows\System\zFtuHNP.exe
  C:\Windows\System\zFtuHNP.exe
  2⤵
  PID:1556
- C:\Windows\System\xrKVDEG.exe
  C:\Windows\System\xrKVDEG.exe
  2⤵
  PID:2528
- C:\Windows\System\pNXOCZN.exe
  C:\Windows\System\pNXOCZN.exe
  2⤵
  PID:2892
- C:\Windows\System\qvxMJlT.exe
  C:\Windows\System\qvxMJlT.exe
  2⤵
  PID:2104
- C:\Windows\System\gpzViIW.exe
  C:\Windows\System\gpzViIW.exe
  2⤵
  PID:2876
- C:\Windows\System\dnJUtUf.exe
  C:\Windows\System\dnJUtUf.exe
  2⤵
  PID:2084
- C:\Windows\System\yKasYzw.exe
  C:\Windows\System\yKasYzw.exe
  2⤵
  PID:3048
- C:\Windows\System\RPCcjcB.exe
  C:\Windows\System\RPCcjcB.exe
  2⤵
  PID:1856
- C:\Windows\System\sjIuuJq.exe
  C:\Windows\System\sjIuuJq.exe
  2⤵
  PID:1876
- C:\Windows\System\NohfCcK.exe
  C:\Windows\System\NohfCcK.exe
  2⤵
  PID:2560
- C:\Windows\System\ypbqLLb.exe
  C:\Windows\System\ypbqLLb.exe
  2⤵
  PID:2120
- C:\Windows\System\OticgdO.exe
  C:\Windows\System\OticgdO.exe
  2⤵
  PID:1316
- C:\Windows\System\cfyOEbi.exe
  C:\Windows\System\cfyOEbi.exe
  2⤵
  PID:3100
- C:\Windows\System\wVEfJDm.exe
  C:\Windows\System\wVEfJDm.exe
  2⤵
  PID:3116
- C:\Windows\System\yGkKuww.exe
  C:\Windows\System\yGkKuww.exe
  2⤵
  PID:3140
- C:\Windows\System\GzaRhOT.exe
  C:\Windows\System\GzaRhOT.exe
  2⤵
  PID:3156
- C:\Windows\System\iYMflKo.exe
  C:\Windows\System\iYMflKo.exe
  2⤵
  PID:3172
- C:\Windows\System\HBmxzFV.exe
  C:\Windows\System\HBmxzFV.exe
  2⤵
  PID:3188
- C:\Windows\System\UadAkmt.exe
  C:\Windows\System\UadAkmt.exe
  2⤵
  PID:3204
- C:\Windows\System\nmSVSXg.exe
  C:\Windows\System\nmSVSXg.exe
  2⤵
  PID:3220
- C:\Windows\System\RIgfnIn.exe
  C:\Windows\System\RIgfnIn.exe
  2⤵
  PID:3236
- C:\Windows\System\pILLZcO.exe
  C:\Windows\System\pILLZcO.exe
  2⤵
  PID:3264
- C:\Windows\System\mmWekTQ.exe
  C:\Windows\System\mmWekTQ.exe
  2⤵
  PID:3280
- C:\Windows\System\ADxqIPy.exe
  C:\Windows\System\ADxqIPy.exe
  2⤵
  PID:3296
- C:\Windows\System\ebrjcZF.exe
  C:\Windows\System\ebrjcZF.exe
  2⤵
  PID:3312
- C:\Windows\System\ITQOsvT.exe
  C:\Windows\System\ITQOsvT.exe
  2⤵
  PID:3332
- C:\Windows\System\jJubpSU.exe
  C:\Windows\System\jJubpSU.exe
  2⤵
  PID:3376
- C:\Windows\System\XqVJpmr.exe
  C:\Windows\System\XqVJpmr.exe
  2⤵
  PID:3392
- C:\Windows\System\RDwOojg.exe
  C:\Windows\System\RDwOojg.exe
  2⤵
  PID:3408
- C:\Windows\System\MNTSRdx.exe
  C:\Windows\System\MNTSRdx.exe
  2⤵
  PID:3424
- C:\Windows\System\ZnQJCtI.exe
  C:\Windows\System\ZnQJCtI.exe
  2⤵
  PID:3440
- C:\Windows\System\oNsAZCg.exe
  C:\Windows\System\oNsAZCg.exe
  2⤵
  PID:3456
- C:\Windows\System\VvyPqzv.exe
  C:\Windows\System\VvyPqzv.exe
  2⤵
  PID:3472
- C:\Windows\System\SKJWWoW.exe
  C:\Windows\System\SKJWWoW.exe
  2⤵
  PID:3488
- C:\Windows\System\EgJxENK.exe
  C:\Windows\System\EgJxENK.exe
  2⤵
  PID:3504
- C:\Windows\System\mfSZUid.exe
  C:\Windows\System\mfSZUid.exe
  2⤵
  PID:3520
- C:\Windows\System\zSKYbZz.exe
  C:\Windows\System\zSKYbZz.exe
  2⤵
  PID:3536
- C:\Windows\System\PSgTOft.exe
  C:\Windows\System\PSgTOft.exe
  2⤵
  PID:3552
- C:\Windows\System\kzAwank.exe
  C:\Windows\System\kzAwank.exe
  2⤵
  PID:3568
- C:\Windows\System\PFcARtU.exe
  C:\Windows\System\PFcARtU.exe
  2⤵
  PID:3584
- C:\Windows\System\wokSFus.exe
  C:\Windows\System\wokSFus.exe
  2⤵
  PID:3608
- C:\Windows\System\BPoeAtu.exe
  C:\Windows\System\BPoeAtu.exe
  2⤵
  PID:3624
- C:\Windows\System\OpZnLEH.exe
  C:\Windows\System\OpZnLEH.exe
  2⤵
  PID:3640
- C:\Windows\System\MBpaNNb.exe
  C:\Windows\System\MBpaNNb.exe
  2⤵
  PID:3656
- C:\Windows\System\uDOcYRY.exe
  C:\Windows\System\uDOcYRY.exe
  2⤵
  PID:3672
- C:\Windows\System\gcIOADI.exe
  C:\Windows\System\gcIOADI.exe
  2⤵
  PID:3764
- C:\Windows\System\DuWGPml.exe
  C:\Windows\System\DuWGPml.exe
  2⤵
  PID:3784
- C:\Windows\System\JVjxehj.exe
  C:\Windows\System\JVjxehj.exe
  2⤵
  PID:3804
- C:\Windows\System\NQqxcom.exe
  C:\Windows\System\NQqxcom.exe
  2⤵
  PID:3828
- C:\Windows\System\gFLBqxZ.exe
  C:\Windows\System\gFLBqxZ.exe
  2⤵
  PID:3856
- C:\Windows\System\DZiORoa.exe
  C:\Windows\System\DZiORoa.exe
  2⤵
  PID:3872
- C:\Windows\System\WIIJsqI.exe
  C:\Windows\System\WIIJsqI.exe
  2⤵
  PID:3896
- C:\Windows\System\DEPyLOa.exe
  C:\Windows\System\DEPyLOa.exe
  2⤵
  PID:3912
- C:\Windows\System\TjsKAmd.exe
  C:\Windows\System\TjsKAmd.exe
  2⤵
  PID:3932
- C:\Windows\System\ZECiGQu.exe
  C:\Windows\System\ZECiGQu.exe
  2⤵
  PID:3952
- C:\Windows\System\wcfLvgS.exe
  C:\Windows\System\wcfLvgS.exe
  2⤵
  PID:3976
- C:\Windows\System\kEjODkM.exe
  C:\Windows\System\kEjODkM.exe
  2⤵
  PID:3992
- C:\Windows\System\dBYFivq.exe
  C:\Windows\System\dBYFivq.exe
  2⤵
  PID:4012
- C:\Windows\System\FalErqa.exe
  C:\Windows\System\FalErqa.exe
  2⤵
  PID:4032
- C:\Windows\System\ztLnXLv.exe
  C:\Windows\System\ztLnXLv.exe
  2⤵
  PID:4056
- C:\Windows\System\YpBrEde.exe
  C:\Windows\System\YpBrEde.exe
  2⤵
  PID:4072
- C:\Windows\System\JYMwJmu.exe
  C:\Windows\System\JYMwJmu.exe
  2⤵
  PID:1664
- C:\Windows\System\bAgqXNd.exe
  C:\Windows\System\bAgqXNd.exe
  2⤵
  PID:1248
- C:\Windows\System\iYPXcRk.exe
  C:\Windows\System\iYPXcRk.exe
  2⤵
  PID:2832
- C:\Windows\System\BLzliAS.exe
  C:\Windows\System\BLzliAS.exe
  2⤵
  PID:2748
- C:\Windows\System\HjeITAE.exe
  C:\Windows\System\HjeITAE.exe
  2⤵
  PID:3080
- C:\Windows\System\fZaEqvV.exe
  C:\Windows\System\fZaEqvV.exe
  2⤵
  PID:3088
- C:\Windows\System\FtNNFPj.exe
  C:\Windows\System\FtNNFPj.exe
  2⤵
  PID:3108
- C:\Windows\System\fLgpIHH.exe
  C:\Windows\System\fLgpIHH.exe
  2⤵
  PID:3212
- C:\Windows\System\MEfgXjD.exe
  C:\Windows\System\MEfgXjD.exe
  2⤵
  PID:3256
- C:\Windows\System\FguvxST.exe
  C:\Windows\System\FguvxST.exe
  2⤵
  PID:3128
- C:\Windows\System\xhFnKLQ.exe
  C:\Windows\System\xhFnKLQ.exe
  2⤵
  PID:3320
- C:\Windows\System\SMASsWs.exe
  C:\Windows\System\SMASsWs.exe
  2⤵
  PID:3168
- C:\Windows\System\tDYgtWf.exe
  C:\Windows\System\tDYgtWf.exe
  2⤵
  PID:3276
- C:\Windows\System\LgeYpch.exe
  C:\Windows\System\LgeYpch.exe
  2⤵
  PID:3308
- C:\Windows\System\bdHidQB.exe
  C:\Windows\System\bdHidQB.exe
  2⤵
  PID:3360
- C:\Windows\System\bbfPqjM.exe
  C:\Windows\System\bbfPqjM.exe
  2⤵
  PID:3400
- C:\Windows\System\MywtviO.exe
  C:\Windows\System\MywtviO.exe
  2⤵
  PID:2880
- C:\Windows\System\DFdNdbC.exe
  C:\Windows\System\DFdNdbC.exe
  2⤵
  PID:2404
- C:\Windows\System\SGdOLQf.exe
  C:\Windows\System\SGdOLQf.exe
  2⤵
  PID:3496
- C:\Windows\System\hVbHzcd.exe
  C:\Windows\System\hVbHzcd.exe
  2⤵
  PID:3544
- C:\Windows\System\Ajowpwn.exe
  C:\Windows\System\Ajowpwn.exe
  2⤵
  PID:3548
- C:\Windows\System\dUUJcjI.exe
  C:\Windows\System\dUUJcjI.exe
  2⤵
  PID:3564
- C:\Windows\System\SSRDFpd.exe
  C:\Windows\System\SSRDFpd.exe
  2⤵
  PID:3704
- C:\Windows\System\kBUvYWp.exe
  C:\Windows\System\kBUvYWp.exe
  2⤵
  PID:3580
- C:\Windows\System\qzIMvHJ.exe
  C:\Windows\System\qzIMvHJ.exe
  2⤵
  PID:3700
- C:\Windows\System\sqLSHtW.exe
  C:\Windows\System\sqLSHtW.exe
  2⤵
  PID:3720
- C:\Windows\System\WEvoICu.exe
  C:\Windows\System\WEvoICu.exe
  2⤵
  PID:3748
- C:\Windows\System\xylmNwc.exe
  C:\Windows\System\xylmNwc.exe
  2⤵
  PID:1332
- C:\Windows\System\DMsaPfj.exe
  C:\Windows\System\DMsaPfj.exe
  2⤵
  PID:3600
- C:\Windows\System\PMymAbx.exe
  C:\Windows\System\PMymAbx.exe
  2⤵
  PID:3668
- C:\Windows\System\pWRIOKf.exe
  C:\Windows\System\pWRIOKf.exe
  2⤵
  PID:3776
- C:\Windows\System\QVTOgxW.exe
  C:\Windows\System\QVTOgxW.exe
  2⤵
  PID:3812
- C:\Windows\System\ZIKXzlf.exe
  C:\Windows\System\ZIKXzlf.exe
  2⤵
  PID:3844
- C:\Windows\System\adPIUbH.exe
  C:\Windows\System\adPIUbH.exe
  2⤵
  PID:3868
- C:\Windows\System\TzARoJE.exe
  C:\Windows\System\TzARoJE.exe
  2⤵
  PID:3892
- C:\Windows\System\ooSgDWB.exe
  C:\Windows\System\ooSgDWB.exe
  2⤵
  PID:3920
- C:\Windows\System\lsLLwkS.exe
  C:\Windows\System\lsLLwkS.exe
  2⤵
  PID:3948
- C:\Windows\System\wTuVDUa.exe
  C:\Windows\System\wTuVDUa.exe
  2⤵
  PID:3972
- C:\Windows\System\AMpNcOu.exe
  C:\Windows\System\AMpNcOu.exe
  2⤵
  PID:4000
- C:\Windows\System\NfauVFw.exe
  C:\Windows\System\NfauVFw.exe
  2⤵
  PID:4024
- C:\Windows\System\YmPOmfR.exe
  C:\Windows\System\YmPOmfR.exe
  2⤵
  PID:4044
- C:\Windows\System\jXlxhmI.exe
  C:\Windows\System\jXlxhmI.exe
  2⤵
  PID:4080
- C:\Windows\System\wGYATMp.exe
  C:\Windows\System\wGYATMp.exe
  2⤵
  PID:4084
- C:\Windows\System\mTgNLWu.exe
  C:\Windows\System\mTgNLWu.exe
  2⤵
  PID:2136
- C:\Windows\System\xqNWjFM.exe
  C:\Windows\System\xqNWjFM.exe
  2⤵
  PID:1676
- C:\Windows\System\SyHBenx.exe
  C:\Windows\System\SyHBenx.exe
  2⤵
  PID:3136
- C:\Windows\System\WHvtLbU.exe
  C:\Windows\System\WHvtLbU.exe
  2⤵
  PID:3272
- C:\Windows\System\iqTicwB.exe
  C:\Windows\System\iqTicwB.exe
  2⤵
  PID:3348
- C:\Windows\System\bOcvvge.exe
  C:\Windows\System\bOcvvge.exe
  2⤵
  PID:3368
- C:\Windows\System\DVuMhGD.exe
  C:\Windows\System\DVuMhGD.exe
  2⤵
  PID:3420
- C:\Windows\System\gxaWdmx.exe
  C:\Windows\System\gxaWdmx.exe
  2⤵
  PID:3480
- C:\Windows\System\yYqniWG.exe
  C:\Windows\System\yYqniWG.exe
  2⤵
  PID:2824
- C:\Windows\System\KhutJQp.exe
  C:\Windows\System\KhutJQp.exe
  2⤵
  PID:1836
- C:\Windows\System\hbTRsrR.exe
  C:\Windows\System\hbTRsrR.exe
  2⤵
  PID:3648
- C:\Windows\System\DZGGCVJ.exe
  C:\Windows\System\DZGGCVJ.exe
  2⤵
  PID:3592
- C:\Windows\System\dQysYxg.exe
  C:\Windows\System\dQysYxg.exe
  2⤵
  PID:3652
- C:\Windows\System\tNYklez.exe
  C:\Windows\System\tNYklez.exe
  2⤵
  PID:3664
- C:\Windows\System\IroaitP.exe
  C:\Windows\System\IroaitP.exe
  2⤵
  PID:3864
- C:\Windows\System\fTofyTy.exe
  C:\Windows\System\fTofyTy.exe
  2⤵
  PID:3968
- C:\Windows\System\yRmgNew.exe
  C:\Windows\System\yRmgNew.exe
  2⤵
  PID:4068
- C:\Windows\System\vqGUQMS.exe
  C:\Windows\System\vqGUQMS.exe
  2⤵
  PID:3728
- C:\Windows\System\dqYnHZd.exe
  C:\Windows\System\dqYnHZd.exe
  2⤵
  PID:3772
- C:\Windows\System\FDsMhKW.exe
  C:\Windows\System\FDsMhKW.exe
  2⤵
  PID:3836
- C:\Windows\System\XKUMZGi.exe
  C:\Windows\System\XKUMZGi.exe
  2⤵
  PID:3092
- C:\Windows\System\psLEjVh.exe
  C:\Windows\System\psLEjVh.exe
  2⤵
  PID:3096
- C:\Windows\System\fOmoQJX.exe
  C:\Windows\System\fOmoQJX.exe
  2⤵
  PID:3180
- C:\Windows\System\gXnkImM.exe
  C:\Windows\System\gXnkImM.exe
  2⤵
  PID:3372
- C:\Windows\System\VECQFET.exe
  C:\Windows\System\VECQFET.exe
  2⤵
  PID:3468
- C:\Windows\System\SLRebbq.exe
  C:\Windows\System\SLRebbq.exe
  2⤵
  PID:3164
- C:\Windows\System\ZOhNHeI.exe
  C:\Windows\System\ZOhNHeI.exe
  2⤵
  PID:3384
- C:\Windows\System\JirkEoE.exe
  C:\Windows\System\JirkEoE.exe
  2⤵
  PID:3516
- C:\Windows\System\HwDuSwg.exe
  C:\Windows\System\HwDuSwg.exe
  2⤵
  PID:3716
- C:\Windows\System\mvJkGTy.exe
  C:\Windows\System\mvJkGTy.exe
  2⤵
  PID:3692
- C:\Windows\System\tWMlVMJ.exe
  C:\Windows\System\tWMlVMJ.exe
  2⤵
  PID:2012
- C:\Windows\System\sZXprrY.exe
  C:\Windows\System\sZXprrY.exe
  2⤵
  PID:3960
- C:\Windows\System\TkAJPAb.exe
  C:\Windows\System\TkAJPAb.exe
  2⤵
  PID:3816
- C:\Windows\System\bXgoOTU.exe
  C:\Windows\System\bXgoOTU.exe
  2⤵
  PID:3984
- C:\Windows\System\fOpqfRE.exe
  C:\Windows\System\fOpqfRE.exe
  2⤵
  PID:3740
- C:\Windows\System\BFeWRmk.exe
  C:\Windows\System\BFeWRmk.exe
  2⤵
  PID:4052
- C:\Windows\System\cjKNwda.exe
  C:\Windows\System\cjKNwda.exe
  2⤵
  PID:3908
- C:\Windows\System\UKYOvxc.exe
  C:\Windows\System\UKYOvxc.exe
  2⤵
  PID:3112
- C:\Windows\System\NgwKPIv.exe
  C:\Windows\System\NgwKPIv.exe
  2⤵
  PID:2088
- C:\Windows\System\IPAuPvB.exe
  C:\Windows\System\IPAuPvB.exe
  2⤵
  PID:2316
- C:\Windows\System\YoVJDrN.exe
  C:\Windows\System\YoVJDrN.exe
  2⤵
  PID:2704
- C:\Windows\System\XNNwymB.exe
  C:\Windows\System\XNNwymB.exe
  2⤵
  PID:2544
- C:\Windows\System\gBvCJOF.exe
  C:\Windows\System\gBvCJOF.exe
  2⤵
  PID:3840
- C:\Windows\System\CnKyXGP.exe
  C:\Windows\System\CnKyXGP.exe
  2⤵
  PID:3824
- C:\Windows\System\AuJIxnD.exe
  C:\Windows\System\AuJIxnD.exe
  2⤵
  PID:1756
- C:\Windows\System\uxaoGWa.exe
  C:\Windows\System\uxaoGWa.exe
  2⤵
  PID:3216
- C:\Windows\System\sWbKhZp.exe
  C:\Windows\System\sWbKhZp.exe
  2⤵
  PID:1704
- C:\Windows\System\nXBOhZN.exe
  C:\Windows\System\nXBOhZN.exe
  2⤵
  PID:3712
- C:\Windows\System\qEAAjEN.exe
  C:\Windows\System\qEAAjEN.exe
  2⤵
  PID:3680
- C:\Windows\System\IstANJv.exe
  C:\Windows\System\IstANJv.exe
  2⤵
  PID:3888
- C:\Windows\System\eZdJkBV.exe
  C:\Windows\System\eZdJkBV.exe
  2⤵
  PID:1672
- C:\Windows\System\kGIWGgc.exe
  C:\Windows\System\kGIWGgc.exe
  2⤵
  PID:3252
- C:\Windows\System\AwPMHaR.exe
  C:\Windows\System\AwPMHaR.exe
  2⤵
  PID:2228
- C:\Windows\System\hxBDBzH.exe
  C:\Windows\System\hxBDBzH.exe
  2⤵
  PID:1308
- C:\Windows\System\NPdGwHK.exe
  C:\Windows\System\NPdGwHK.exe
  2⤵
  PID:3344
- C:\Windows\System\YAMSBYe.exe
  C:\Windows\System\YAMSBYe.exe
  2⤵
  PID:2524
- C:\Windows\System\CkflBSx.exe
  C:\Windows\System\CkflBSx.exe
  2⤵
  PID:2752
- C:\Windows\System\YyilpuO.exe
  C:\Windows\System\YyilpuO.exe
  2⤵
  PID:916
- C:\Windows\System\DszEXDU.exe
  C:\Windows\System\DszEXDU.exe
  2⤵
  PID:3904
- C:\Windows\System\eqKPasq.exe
  C:\Windows\System\eqKPasq.exe
  2⤵
  PID:1820
- C:\Windows\System\TBcmzrq.exe
  C:\Windows\System\TBcmzrq.exe
  2⤵
  PID:4104
- C:\Windows\System\XAjAsQD.exe
  C:\Windows\System\XAjAsQD.exe
  2⤵
  PID:4124
- C:\Windows\System\orbjLfh.exe
  C:\Windows\System\orbjLfh.exe
  2⤵
  PID:4140
- C:\Windows\System\tKZgKwB.exe
  C:\Windows\System\tKZgKwB.exe
  2⤵
  PID:4156
- C:\Windows\System\ikEgfGf.exe
  C:\Windows\System\ikEgfGf.exe
  2⤵
  PID:4172
- C:\Windows\System\BmFQovx.exe
  C:\Windows\System\BmFQovx.exe
  2⤵
  PID:4188
- C:\Windows\System\KBaftDW.exe
  C:\Windows\System\KBaftDW.exe
  2⤵
  PID:4204
- C:\Windows\System\kNzSxMV.exe
  C:\Windows\System\kNzSxMV.exe
  2⤵
  PID:4220
- C:\Windows\System\fFvtHCF.exe
  C:\Windows\System\fFvtHCF.exe
  2⤵
  PID:4236
- C:\Windows\System\KkNVjBR.exe
  C:\Windows\System\KkNVjBR.exe
  2⤵
  PID:4252
- C:\Windows\System\sAYgPgc.exe
  C:\Windows\System\sAYgPgc.exe
  2⤵
  PID:4268
- C:\Windows\System\mkBVtnQ.exe
  C:\Windows\System\mkBVtnQ.exe
  2⤵
  PID:4284
- C:\Windows\System\qWnbEiJ.exe
  C:\Windows\System\qWnbEiJ.exe
  2⤵
  PID:4300
- C:\Windows\System\NaMygxJ.exe
  C:\Windows\System\NaMygxJ.exe
  2⤵
  PID:4316
- C:\Windows\System\uigAYlx.exe
  C:\Windows\System\uigAYlx.exe
  2⤵
  PID:4332
- C:\Windows\System\GOxgTXH.exe
  C:\Windows\System\GOxgTXH.exe
  2⤵
  PID:4352
- C:\Windows\System\cRKkcLn.exe
  C:\Windows\System\cRKkcLn.exe
  2⤵
  PID:4368
- C:\Windows\System\zHEiDtH.exe
  C:\Windows\System\zHEiDtH.exe
  2⤵
  PID:4384
- C:\Windows\System\MdAYWVI.exe
  C:\Windows\System\MdAYWVI.exe
  2⤵
  PID:4400
- C:\Windows\System\pqETNiI.exe
  C:\Windows\System\pqETNiI.exe
  2⤵
  PID:4416
- C:\Windows\System\nYEWksu.exe
  C:\Windows\System\nYEWksu.exe
  2⤵
  PID:4432
- C:\Windows\System\CfTRWfq.exe
  C:\Windows\System\CfTRWfq.exe
  2⤵
  PID:4448
- C:\Windows\System\fBQJcNJ.exe
  C:\Windows\System\fBQJcNJ.exe
  2⤵
  PID:4464
- C:\Windows\System\heUSHAt.exe
  C:\Windows\System\heUSHAt.exe
  2⤵
  PID:4480
- C:\Windows\System\QLqKOyu.exe
  C:\Windows\System\QLqKOyu.exe
  2⤵
  PID:4500
- C:\Windows\System\ZbmcKNm.exe
  C:\Windows\System\ZbmcKNm.exe
  2⤵
  PID:4516
- C:\Windows\System\wgjwMPS.exe
  C:\Windows\System\wgjwMPS.exe
  2⤵
  PID:4532
- C:\Windows\System\teDxNXn.exe
  C:\Windows\System\teDxNXn.exe
  2⤵
  PID:4548
- C:\Windows\System\hXcziNW.exe
  C:\Windows\System\hXcziNW.exe
  2⤵
  PID:4568
- C:\Windows\System\PsSNBtg.exe
  C:\Windows\System\PsSNBtg.exe
  2⤵
  PID:4692
- C:\Windows\System\iDMZlmR.exe
  C:\Windows\System\iDMZlmR.exe
  2⤵
  PID:4720
- C:\Windows\System\eBngyMR.exe
  C:\Windows\System\eBngyMR.exe
  2⤵
  PID:4740
- C:\Windows\System\dPEMvAK.exe
  C:\Windows\System\dPEMvAK.exe
  2⤵
  PID:4756
- C:\Windows\System\nJLESoD.exe
  C:\Windows\System\nJLESoD.exe
  2⤵
  PID:4772
- C:\Windows\System\upbwBsk.exe
  C:\Windows\System\upbwBsk.exe
  2⤵
  PID:4792
- C:\Windows\System\uQODFbz.exe
  C:\Windows\System\uQODFbz.exe
  2⤵
  PID:4812
- C:\Windows\System\XTYEPGh.exe
  C:\Windows\System\XTYEPGh.exe
  2⤵
  PID:4828
- C:\Windows\System\uHLEneS.exe
  C:\Windows\System\uHLEneS.exe
  2⤵
  PID:4848
- C:\Windows\System\rbUfoDS.exe
  C:\Windows\System\rbUfoDS.exe
  2⤵
  PID:4868
- C:\Windows\System\cpPfkuH.exe
  C:\Windows\System\cpPfkuH.exe
  2⤵
  PID:4892
- C:\Windows\System\OlThROA.exe
  C:\Windows\System\OlThROA.exe
  2⤵
  PID:4912
- C:\Windows\System\iAxHrMo.exe
  C:\Windows\System\iAxHrMo.exe
  2⤵
  PID:4928
- C:\Windows\System\JvpdYrh.exe
  C:\Windows\System\JvpdYrh.exe
  2⤵
  PID:4952
- C:\Windows\System\KPjtkjy.exe
  C:\Windows\System\KPjtkjy.exe
  2⤵
  PID:4968
- C:\Windows\System\tSQMUaS.exe
  C:\Windows\System\tSQMUaS.exe
  2⤵
  PID:4992
- C:\Windows\System\qYrHzeI.exe
  C:\Windows\System\qYrHzeI.exe
  2⤵
  PID:5012
- C:\Windows\System\HsbTYJM.exe
  C:\Windows\System\HsbTYJM.exe
  2⤵
  PID:5028
- C:\Windows\System\XpBTjJx.exe
  C:\Windows\System\XpBTjJx.exe
  2⤵
  PID:5048
- C:\Windows\System\WThfoGe.exe
  C:\Windows\System\WThfoGe.exe
  2⤵
  PID:5072
- C:\Windows\System\RWMjPeu.exe
  C:\Windows\System\RWMjPeu.exe
  2⤵
  PID:5092
- C:\Windows\System\cnMNyJQ.exe
  C:\Windows\System\cnMNyJQ.exe
  2⤵
  PID:4112
- C:\Windows\System\HwsAXQO.exe
  C:\Windows\System\HwsAXQO.exe
  2⤵
  PID:4120
- C:\Windows\System\vdPuHFo.exe
  C:\Windows\System\vdPuHFo.exe
  2⤵
  PID:4312
- C:\Windows\System\FGkzfuY.exe
  C:\Windows\System\FGkzfuY.exe
  2⤵
  PID:4100
- C:\Windows\System\wtZLKPe.exe
  C:\Windows\System\wtZLKPe.exe
  2⤵
  PID:4264
- C:\Windows\System\QPhQsZF.exe
  C:\Windows\System\QPhQsZF.exe
  2⤵
  PID:4360
- C:\Windows\System\JntzmhL.exe
  C:\Windows\System\JntzmhL.exe
  2⤵
  PID:4328
- C:\Windows\System\wpATFUF.exe
  C:\Windows\System\wpATFUF.exe
  2⤵
  PID:4276
- C:\Windows\System\FatJEOs.exe
  C:\Windows\System\FatJEOs.exe
  2⤵
  PID:4408
- C:\Windows\System\ZkcmTsi.exe
  C:\Windows\System\ZkcmTsi.exe
  2⤵
  PID:4136
- C:\Windows\System\zSDqEfL.exe
  C:\Windows\System\zSDqEfL.exe
  2⤵
  PID:4196
- C:\Windows\System\BJkhRbK.exe
  C:\Windows\System\BJkhRbK.exe
  2⤵
  PID:4508
- C:\Windows\System\FvUSTwA.exe
  C:\Windows\System\FvUSTwA.exe
  2⤵
  PID:4524
- C:\Windows\System\GNeWgJn.exe
  C:\Windows\System\GNeWgJn.exe
  2⤵
  PID:4584
- C:\Windows\System\bIYrzIv.exe
  C:\Windows\System\bIYrzIv.exe
  2⤵
  PID:4620
- C:\Windows\System\iGjVHVP.exe
  C:\Windows\System\iGjVHVP.exe
  2⤵
  PID:4628
- C:\Windows\System\GIkTzTW.exe
  C:\Windows\System\GIkTzTW.exe
  2⤵
  PID:4648
- C:\Windows\System\pINgmVW.exe
  C:\Windows\System\pINgmVW.exe
  2⤵
  PID:4680
- C:\Windows\System\JdIzsOl.exe
  C:\Windows\System\JdIzsOl.exe
  2⤵
  PID:4704
- C:\Windows\System\XCTgIMC.exe
  C:\Windows\System\XCTgIMC.exe
  2⤵
  PID:4748
- C:\Windows\System\VHFcunl.exe
  C:\Windows\System\VHFcunl.exe
  2⤵
  PID:4768
- C:\Windows\System\HsicdDi.exe
  C:\Windows\System\HsicdDi.exe
  2⤵
  PID:4836
- C:\Windows\System\JMRSlyx.exe
  C:\Windows\System\JMRSlyx.exe
  2⤵
  PID:4860
- C:\Windows\System\svpJYnK.exe
  C:\Windows\System\svpJYnK.exe
  2⤵
  PID:4888
- C:\Windows\System\icIpHNK.exe
  C:\Windows\System\icIpHNK.exe
  2⤵
  PID:4904
- C:\Windows\System\MtBRali.exe
  C:\Windows\System\MtBRali.exe
  2⤵
  PID:4948
- C:\Windows\System\tsUkUaJ.exe
  C:\Windows\System\tsUkUaJ.exe
  2⤵
  PID:4984
- C:\Windows\System\xnrOmlx.exe
  C:\Windows\System\xnrOmlx.exe
  2⤵
  PID:5020
- C:\Windows\System\Cximhhb.exe
  C:\Windows\System\Cximhhb.exe
  2⤵
  PID:5068
- C:\Windows\System\CIHUvTZ.exe
  C:\Windows\System\CIHUvTZ.exe
  2⤵
  PID:5104
- C:\Windows\System\kvBurEl.exe
  C:\Windows\System\kvBurEl.exe
  2⤵
  PID:4248
- C:\Windows\System\zqUfWSy.exe
  C:\Windows\System\zqUfWSy.exe
  2⤵
  PID:5112
- C:\Windows\System\FtuHEgd.exe
  C:\Windows\System\FtuHEgd.exe
  2⤵
  PID:4184
- C:\Windows\System\HrRjOKo.exe
  C:\Windows\System\HrRjOKo.exe
  2⤵
  PID:4232
- C:\Windows\System\jafnQLu.exe
  C:\Windows\System\jafnQLu.exe
  2⤵
  PID:4348
- C:\Windows\System\ythPDGr.exe
  C:\Windows\System\ythPDGr.exe
  2⤵
  PID:4152
- C:\Windows\System\tOFLiOP.exe
  C:\Windows\System\tOFLiOP.exe
  2⤵
  PID:4148
- C:\Windows\System\aJWlPQo.exe
  C:\Windows\System\aJWlPQo.exe
  2⤵
  PID:4476
- C:\Windows\System\dBdaSJW.exe
  C:\Windows\System\dBdaSJW.exe
  2⤵
  PID:4456
- C:\Windows\System\EUNETJw.exe
  C:\Windows\System\EUNETJw.exe
  2⤵
  PID:4460
- C:\Windows\System\jwmWIzd.exe
  C:\Windows\System\jwmWIzd.exe
  2⤵
  PID:4560
- C:\Windows\System\ZzHJQhR.exe
  C:\Windows\System\ZzHJQhR.exe
  2⤵
  PID:4600
- C:\Windows\System\YJvRMib.exe
  C:\Windows\System\YJvRMib.exe
  2⤵
  PID:4604
- C:\Windows\System\ceddTZi.exe
  C:\Windows\System\ceddTZi.exe
  2⤵
  PID:4636
- C:\Windows\System\dyomxLA.exe
  C:\Windows\System\dyomxLA.exe
  2⤵
  PID:4700
- C:\Windows\System\wgGTbeh.exe
  C:\Windows\System\wgGTbeh.exe
  2⤵
  PID:4712
- C:\Windows\System\zmwADqX.exe
  C:\Windows\System\zmwADqX.exe
  2⤵
  PID:4764
- C:\Windows\System\sqBnoqK.exe
  C:\Windows\System\sqBnoqK.exe
  2⤵
  PID:4820
- C:\Windows\System\AxxJzjE.exe
  C:\Windows\System\AxxJzjE.exe
  2⤵
  PID:4824
- C:\Windows\System\MywEToj.exe
  C:\Windows\System\MywEToj.exe
  2⤵
  PID:4876
- C:\Windows\System\WtouMZo.exe
  C:\Windows\System\WtouMZo.exe
  2⤵
  PID:4976
- C:\Windows\System\PgAHbML.exe
  C:\Windows\System\PgAHbML.exe
  2⤵
  PID:5060
- C:\Windows\System\NubEJyq.exe
  C:\Windows\System\NubEJyq.exe
  2⤵
  PID:4980
- C:\Windows\System\oHnaSxq.exe
  C:\Windows\System\oHnaSxq.exe
  2⤵
  PID:5080
- C:\Windows\System\xvCbQRL.exe
  C:\Windows\System\xvCbQRL.exe
  2⤵
  PID:4280
- C:\Windows\System\UhhkdRj.exe
  C:\Windows\System\UhhkdRj.exe
  2⤵
  PID:4392
- C:\Windows\System\iohRwVX.exe
  C:\Windows\System\iohRwVX.exe
  2⤵
  PID:5140
- C:\Windows\System\TSPIVrM.exe
  C:\Windows\System\TSPIVrM.exe
  2⤵
  PID:5156
- C:\Windows\System\OHbeuXW.exe
  C:\Windows\System\OHbeuXW.exe
  2⤵
  PID:5172
- C:\Windows\System\bgcbCxe.exe
  C:\Windows\System\bgcbCxe.exe
  2⤵
  PID:5188
- C:\Windows\System\AByPnpK.exe
  C:\Windows\System\AByPnpK.exe
  2⤵
  PID:5204
- C:\Windows\System\ezuyrPW.exe
  C:\Windows\System\ezuyrPW.exe
  2⤵
  PID:5220
- C:\Windows\System\tRHwzcx.exe
  C:\Windows\System\tRHwzcx.exe
  2⤵
  PID:5240
- C:\Windows\System\HxOLAjz.exe
  C:\Windows\System\HxOLAjz.exe
  2⤵
  PID:5256
- C:\Windows\System\mpztOSX.exe
  C:\Windows\System\mpztOSX.exe
  2⤵
  PID:5272
- C:\Windows\System\idHSGkC.exe
  C:\Windows\System\idHSGkC.exe
  2⤵
  PID:5288
- C:\Windows\System\vsCzrKl.exe
  C:\Windows\System\vsCzrKl.exe
  2⤵
  PID:5304
- C:\Windows\System\EMqcQaQ.exe
  C:\Windows\System\EMqcQaQ.exe
  2⤵
  PID:5444
- C:\Windows\System\CwuRMap.exe
  C:\Windows\System\CwuRMap.exe
  2⤵
  PID:5460
- C:\Windows\System\SUIJuUe.exe
  C:\Windows\System\SUIJuUe.exe
  2⤵
  PID:5476
- C:\Windows\System\rfmsjjR.exe
  C:\Windows\System\rfmsjjR.exe
  2⤵
  PID:5492
- C:\Windows\System\fAEPCDh.exe
  C:\Windows\System\fAEPCDh.exe
  2⤵
  PID:5508
- C:\Windows\System\iRbxXAn.exe
  C:\Windows\System\iRbxXAn.exe
  2⤵
  PID:5524
- C:\Windows\System\dKhKmsM.exe
  C:\Windows\System\dKhKmsM.exe
  2⤵
  PID:5540
- C:\Windows\System\kQkeVID.exe
  C:\Windows\System\kQkeVID.exe
  2⤵
  PID:5556
- C:\Windows\System\DhAmIzX.exe
  C:\Windows\System\DhAmIzX.exe
  2⤵
  PID:5572
- C:\Windows\System\jWGcRsm.exe
  C:\Windows\System\jWGcRsm.exe
  2⤵
  PID:5588
- C:\Windows\System\asjfURw.exe
  C:\Windows\System\asjfURw.exe
  2⤵
  PID:5604
- C:\Windows\System\MEnyPUZ.exe
  C:\Windows\System\MEnyPUZ.exe
  2⤵
  PID:5620
- C:\Windows\System\oVfSyvJ.exe
  C:\Windows\System\oVfSyvJ.exe
  2⤵
  PID:5636
- C:\Windows\System\hCzVbFk.exe
  C:\Windows\System\hCzVbFk.exe
  2⤵
  PID:5652
- C:\Windows\System\QFCHomi.exe
  C:\Windows\System\QFCHomi.exe
  2⤵
  PID:5668
- C:\Windows\System\EzkdFPG.exe
  C:\Windows\System\EzkdFPG.exe
  2⤵
  PID:5688
- C:\Windows\System\GjjJXDw.exe
  C:\Windows\System\GjjJXDw.exe
  2⤵
  PID:5708
- C:\Windows\System\XnlJsEG.exe
  C:\Windows\System\XnlJsEG.exe
  2⤵
  PID:5744
- C:\Windows\System\UUaIhOj.exe
  C:\Windows\System\UUaIhOj.exe
  2⤵
  PID:5916
- C:\Windows\System\NkBcOAx.exe
  C:\Windows\System\NkBcOAx.exe
  2⤵
  PID:5932
- C:\Windows\System\BWFWieO.exe
  C:\Windows\System\BWFWieO.exe
  2⤵
  PID:5948
- C:\Windows\System\pdzwXMI.exe
  C:\Windows\System\pdzwXMI.exe
  2⤵
  PID:5964
- C:\Windows\System\wRoMxcS.exe
  C:\Windows\System\wRoMxcS.exe
  2⤵
  PID:5980
- C:\Windows\System\zotgUOA.exe
  C:\Windows\System\zotgUOA.exe
  2⤵
  PID:5996
- C:\Windows\System\ilpeTrm.exe
  C:\Windows\System\ilpeTrm.exe
  2⤵
  PID:6016
- C:\Windows\System\JGPUbxA.exe
  C:\Windows\System\JGPUbxA.exe
  2⤵
  PID:6032
- C:\Windows\System\jmzBPbO.exe
  C:\Windows\System\jmzBPbO.exe
  2⤵
  PID:6048
- C:\Windows\System\xmCBxLQ.exe
  C:\Windows\System\xmCBxLQ.exe
  2⤵
  PID:6064
- C:\Windows\System\vBUhKHe.exe
  C:\Windows\System\vBUhKHe.exe
  2⤵
  PID:6084
- C:\Windows\System\ndHsqdz.exe
  C:\Windows\System\ndHsqdz.exe
  2⤵
  PID:6100
- C:\Windows\System\UiVGDCS.exe
  C:\Windows\System\UiVGDCS.exe
  2⤵
  PID:6116
- C:\Windows\System\yjTVJGd.exe
  C:\Windows\System\yjTVJGd.exe
  2⤵
  PID:6132
- C:\Windows\System\XfGbELA.exe
  C:\Windows\System\XfGbELA.exe
  2⤵
  PID:4428
- C:\Windows\System\qSxxxQw.exe
  C:\Windows\System\qSxxxQw.exe
  2⤵
  PID:4528
- C:\Windows\System\QpqTvbj.exe
  C:\Windows\System\QpqTvbj.exe
  2⤵
  PID:4656
- C:\Windows\System\kHXYBPn.exe
  C:\Windows\System\kHXYBPn.exe
  2⤵
  PID:4804
- C:\Windows\System\uQAbAmi.exe
  C:\Windows\System\uQAbAmi.exe
  2⤵
  PID:5004
- C:\Windows\System\eDTtmCw.exe
  C:\Windows\System\eDTtmCw.exe
  2⤵
  PID:5128
- C:\Windows\System\MGspTMk.exe
  C:\Windows\System\MGspTMk.exe
  2⤵
  PID:4856
- C:\Windows\System\yWmbfDr.exe
  C:\Windows\System\yWmbfDr.exe
  2⤵
  PID:5200
- C:\Windows\System\SMunwdo.exe
  C:\Windows\System\SMunwdo.exe
  2⤵
  PID:5148
- C:\Windows\System\szfqBAd.exe
  C:\Windows\System\szfqBAd.exe
  2⤵
  PID:5184
- C:\Windows\System\UzmWLfW.exe
  C:\Windows\System\UzmWLfW.exe
  2⤵
  PID:4472
- C:\Windows\System\jFFWWjp.exe
  C:\Windows\System\jFFWWjp.exe
  2⤵
  PID:4736
- C:\Windows\System\jRXqScz.exe
  C:\Windows\System\jRXqScz.exe
  2⤵
  PID:5180
- C:\Windows\System\UhBnZtf.exe
  C:\Windows\System\UhBnZtf.exe
  2⤵
  PID:4396
- C:\Windows\System\QWjxzOy.exe
  C:\Windows\System\QWjxzOy.exe
  2⤵
  PID:5376
- C:\Windows\System\ABskrti.exe
  C:\Windows\System\ABskrti.exe
  2⤵
  PID:5368
- C:\Windows\System\UVnDWRR.exe
  C:\Windows\System\UVnDWRR.exe
  2⤵
  PID:5388
- C:\Windows\System\fwGhDqg.exe
  C:\Windows\System\fwGhDqg.exe
  2⤵
  PID:5392
- C:\Windows\System\FdALbaR.exe
  C:\Windows\System\FdALbaR.exe
  2⤵
  PID:5412
- C:\Windows\System\JVnKXjd.exe
  C:\Windows\System\JVnKXjd.exe
  2⤵
  PID:5280
- C:\Windows\System\khhkgGP.exe
  C:\Windows\System\khhkgGP.exe
  2⤵
  PID:5332
- C:\Windows\System\YJqqvyN.exe
  C:\Windows\System\YJqqvyN.exe
  2⤵
  PID:5348
- C:\Windows\System\XDmPUAp.exe
  C:\Windows\System\XDmPUAp.exe
  2⤵
  PID:5360
- C:\Windows\System\ieCkaww.exe
  C:\Windows\System\ieCkaww.exe
  2⤵
  PID:5400
- C:\Windows\System\QAKsBbg.exe
  C:\Windows\System\QAKsBbg.exe
  2⤵
  PID:4180
- C:\Windows\System\RiqLIlZ.exe
  C:\Windows\System\RiqLIlZ.exe
  2⤵
  PID:5436
- C:\Windows\System\NuhGGnA.exe
  C:\Windows\System\NuhGGnA.exe
  2⤵
  PID:5488
- C:\Windows\System\NMjSxdn.exe
  C:\Windows\System\NMjSxdn.exe
  2⤵
  PID:5548
- C:\Windows\System\QjYxXoz.exe
  C:\Windows\System\QjYxXoz.exe
  2⤵
  PID:5612
- C:\Windows\System\FXtftnz.exe
  C:\Windows\System\FXtftnz.exe
  2⤵
  PID:2844
- C:\Windows\System\MgJbOJT.exe
  C:\Windows\System\MgJbOJT.exe
  2⤵
  PID:5532
- C:\Windows\System\ySxcJLN.exe
  C:\Windows\System\ySxcJLN.exe
  2⤵
  PID:5596
- C:\Windows\System\zqBDDQl.exe
  C:\Windows\System\zqBDDQl.exe
  2⤵
  PID:5632
- C:\Windows\System\GRCLImn.exe
  C:\Windows\System\GRCLImn.exe
  2⤵
  PID:5696
- C:\Windows\System\AaFvcbo.exe
  C:\Windows\System\AaFvcbo.exe
  2⤵
  PID:5716
- C:\Windows\System\TQgLIgU.exe
  C:\Windows\System\TQgLIgU.exe
  2⤵
  PID:5732
- C:\Windows\System\ARvuQij.exe
  C:\Windows\System\ARvuQij.exe
  2⤵
  PID:5764
- C:\Windows\System\IqHTxhO.exe
  C:\Windows\System\IqHTxhO.exe
  2⤵
  PID:5768
- C:\Windows\System\jfpeKxo.exe
  C:\Windows\System\jfpeKxo.exe
  2⤵
  PID:5800
- C:\Windows\System\LExFGOi.exe
  C:\Windows\System\LExFGOi.exe
  2⤵
  PID:5832
- C:\Windows\System\ameZHmj.exe
  C:\Windows\System\ameZHmj.exe
  2⤵
  PID:5848
- C:\Windows\System\bzfqoym.exe
  C:\Windows\System\bzfqoym.exe
  2⤵
  PID:5864
- C:\Windows\System\QwrJMDB.exe
  C:\Windows\System\QwrJMDB.exe
  2⤵
  PID:6092
- C:\Windows\System\nrQbGif.exe
  C:\Windows\System\nrQbGif.exe
  2⤵
  PID:4164
- C:\Windows\System\RYUfXxx.exe
  C:\Windows\System\RYUfXxx.exe
  2⤵
  PID:5972
- C:\Windows\System\RNAgPel.exe
  C:\Windows\System\RNAgPel.exe
  2⤵
  PID:6076
- C:\Windows\System\CsPaaoU.exe
  C:\Windows\System\CsPaaoU.exe
  2⤵
  PID:5164
- C:\Windows\System\uJcDoRR.exe
  C:\Windows\System\uJcDoRR.exe
  2⤵
  PID:4380
- C:\Windows\System\uFpQCxO.exe
  C:\Windows\System\uFpQCxO.exe
  2⤵
  PID:4632
- C:\Windows\System\gycRTWp.exe
  C:\Windows\System\gycRTWp.exe
  2⤵
  PID:4800
- C:\Windows\System\GApaMaQ.exe
  C:\Windows\System\GApaMaQ.exe
  2⤵
  PID:5248
- C:\Windows\System\RZLIDSi.exe
  C:\Windows\System\RZLIDSi.exe
  2⤵
  PID:5380
- C:\Windows\System\RHeiOBI.exe
  C:\Windows\System\RHeiOBI.exe
  2⤵
  PID:5520
- C:\Windows\System\RavgibO.exe
  C:\Windows\System\RavgibO.exe
  2⤵
  PID:5504
- C:\Windows\System\QsATovH.exe
  C:\Windows\System\QsATovH.exe
  2⤵
  PID:5700
- C:\Windows\System\taCjmfJ.exe
  C:\Windows\System\taCjmfJ.exe
  2⤵
  PID:5456
- C:\Windows\System\NEsZrgy.exe
  C:\Windows\System\NEsZrgy.exe
  2⤵
  PID:5780
- C:\Windows\System\TNZKWtT.exe
  C:\Windows\System\TNZKWtT.exe
  2⤵
  PID:5564
- C:\Windows\System\NaWgRAo.exe
  C:\Windows\System\NaWgRAo.exe
  2⤵
  PID:5728
- C:\Windows\System\gVKSLRP.exe
  C:\Windows\System\gVKSLRP.exe
  2⤵
  PID:5816
- C:\Windows\System\eKgtfUZ.exe
  C:\Windows\System\eKgtfUZ.exe
  2⤵
  PID:5828
- C:\Windows\System\eFeajkA.exe
  C:\Windows\System\eFeajkA.exe
  2⤵
  PID:5872
- C:\Windows\System\vZCdKvb.exe
  C:\Windows\System\vZCdKvb.exe
  2⤵
  PID:5880
- C:\Windows\System\laiFzGd.exe
  C:\Windows\System\laiFzGd.exe
  2⤵
  PID:5904
- C:\Windows\System\lKwkLuw.exe
  C:\Windows\System\lKwkLuw.exe
  2⤵
  PID:5924
- C:\Windows\System\mtpzlNr.exe
  C:\Windows\System\mtpzlNr.exe
  2⤵
  PID:5720
- C:\Windows\System\fRMmNsn.exe
  C:\Windows\System\fRMmNsn.exe
  2⤵
  PID:6028
- C:\Windows\System\AWSczun.exe
  C:\Windows\System\AWSczun.exe
  2⤵
  PID:4752
- C:\Windows\System\CHIOXfp.exe
  C:\Windows\System\CHIOXfp.exe
  2⤵
  PID:5944
- C:\Windows\System\jsCiwQP.exe
  C:\Windows\System\jsCiwQP.exe
  2⤵
  PID:5056
- C:\Windows\System\qdBZsTB.exe
  C:\Windows\System\qdBZsTB.exe
  2⤵
  PID:5408
- C:\Windows\System\rltBXuE.exe
  C:\Windows\System\rltBXuE.exe
  2⤵
  PID:5152
- C:\Windows\System\KDxzsOr.exe
  C:\Windows\System\KDxzsOr.exe
  2⤵
  PID:5428
- C:\Windows\System\ywflbmw.exe
  C:\Windows\System\ywflbmw.exe
  2⤵
  PID:6072
- C:\Windows\System\gURknuk.exe
  C:\Windows\System\gURknuk.exe
  2⤵
  PID:4324
- C:\Windows\System\MephBmf.exe
  C:\Windows\System\MephBmf.exe
  2⤵
  PID:4212
- C:\Windows\System\anpBmby.exe
  C:\Windows\System\anpBmby.exe
  2⤵
  PID:4672
- C:\Windows\System\MugvFZO.exe
  C:\Windows\System\MugvFZO.exe
  2⤵
  PID:5500
- C:\Windows\System\ENaCcYP.exe
  C:\Windows\System\ENaCcYP.exe
  2⤵
  PID:5888
- C:\Windows\System\FQsuCFS.exe
  C:\Windows\System\FQsuCFS.exe
  2⤵
  PID:6056
- C:\Windows\System\anxJcEP.exe
  C:\Windows\System\anxJcEP.exe
  2⤵
  PID:5644
- C:\Windows\System\LgCWves.exe
  C:\Windows\System\LgCWves.exe
  2⤵
  PID:5940
- C:\Windows\System\zDgFcmw.exe
  C:\Windows\System\zDgFcmw.exe
  2⤵
  PID:4216
- C:\Windows\System\qUmnpcI.exe
  C:\Windows\System\qUmnpcI.exe
  2⤵
  PID:6080
- C:\Windows\System\gzqYkHS.exe
  C:\Windows\System\gzqYkHS.exe
  2⤵
  PID:2576
- C:\Windows\System\zaaiGiz.exe
  C:\Windows\System\zaaiGiz.exe
  2⤵
  PID:5676
- C:\Windows\System\ejaCMGE.exe
  C:\Windows\System\ejaCMGE.exe
  2⤵
  PID:2848
- C:\Windows\System\AcFluRc.exe
  C:\Windows\System\AcFluRc.exe
  2⤵
  PID:6124
- C:\Windows\System\vtTEyrn.exe
  C:\Windows\System\vtTEyrn.exe
  2⤵
  PID:5088
- C:\Windows\System\JpJSCOP.exe
  C:\Windows\System\JpJSCOP.exe
  2⤵
  PID:5196
- C:\Windows\System\GdWLImD.exe
  C:\Windows\System\GdWLImD.exe
  2⤵
  PID:4920
- C:\Windows\System\WwFWeAG.exe
  C:\Windows\System\WwFWeAG.exe
  2⤵
  PID:5844
- C:\Windows\System\sLXoneE.exe
  C:\Windows\System\sLXoneE.exe
  2⤵
  PID:5216
- C:\Windows\System\FKRuomS.exe
  C:\Windows\System\FKRuomS.exe
  2⤵
  PID:5840
- C:\Windows\System\dhcgEmq.exe
  C:\Windows\System\dhcgEmq.exe
  2⤵
  PID:4940
- C:\Windows\System\kaMJbym.exe
  C:\Windows\System\kaMJbym.exe
  2⤵
  PID:6044
- C:\Windows\System\ImjjelS.exe
  C:\Windows\System\ImjjelS.exe
  2⤵
  PID:5344
- C:\Windows\System\lNyMMKf.exe
  C:\Windows\System\lNyMMKf.exe
  2⤵
  PID:5908
- C:\Windows\System\gVgrgPt.exe
  C:\Windows\System\gVgrgPt.exe
  2⤵
  PID:2540
- C:\Windows\System\bVxDbfa.exe
  C:\Windows\System\bVxDbfa.exe
  2⤵
  PID:5956
- C:\Windows\System\htHkgKL.exe
  C:\Windows\System\htHkgKL.exe
  2⤵
  PID:6112
- C:\Windows\System\DGdjusu.exe
  C:\Windows\System\DGdjusu.exe
  2⤵
  PID:4588
- C:\Windows\System\pviOQbz.exe
  C:\Windows\System\pviOQbz.exe
  2⤵
  PID:4716
- C:\Windows\System\eeChlNy.exe
  C:\Windows\System\eeChlNy.exe
  2⤵
  PID:5820
- C:\Windows\System\SDzGsDo.exe
  C:\Windows\System\SDzGsDo.exe
  2⤵
  PID:4088
- C:\Windows\System\rKdUcEw.exe
  C:\Windows\System\rKdUcEw.exe
  2⤵
  PID:5680
- C:\Windows\System\DFlGPsS.exe
  C:\Windows\System\DFlGPsS.exe
  2⤵
  PID:6152
- C:\Windows\System\KMCFEHN.exe
  C:\Windows\System\KMCFEHN.exe
  2⤵
  PID:6168
- C:\Windows\System\dVAYiYX.exe
  C:\Windows\System\dVAYiYX.exe
  2⤵
  PID:6192
- C:\Windows\System\qYcQhyK.exe
  C:\Windows\System\qYcQhyK.exe
  2⤵
  PID:6208
- C:\Windows\System\DvQtqeI.exe
  C:\Windows\System\DvQtqeI.exe
  2⤵
  PID:6224
- C:\Windows\System\GJYdgYW.exe
  C:\Windows\System\GJYdgYW.exe
  2⤵
  PID:6244
- C:\Windows\System\jQuJUhP.exe
  C:\Windows\System\jQuJUhP.exe
  2⤵
  PID:6260
- C:\Windows\System\UkvyTZu.exe
  C:\Windows\System\UkvyTZu.exe
  2⤵
  PID:6276
- C:\Windows\System\ttShKmB.exe
  C:\Windows\System\ttShKmB.exe
  2⤵
  PID:6296
- C:\Windows\System\vuviqib.exe
  C:\Windows\System\vuviqib.exe
  2⤵
  PID:6312
- C:\Windows\System\AGaaaRn.exe
  C:\Windows\System\AGaaaRn.exe
  2⤵
  PID:6328
- C:\Windows\System\HkSrPvU.exe
  C:\Windows\System\HkSrPvU.exe
  2⤵
  PID:6348
- C:\Windows\System\GFYhNnD.exe
  C:\Windows\System\GFYhNnD.exe
  2⤵
  PID:6364
- C:\Windows\System\FHbqtRI.exe
  C:\Windows\System\FHbqtRI.exe
  2⤵
  PID:6384
- C:\Windows\System\wDSNSMr.exe
  C:\Windows\System\wDSNSMr.exe
  2⤵
  PID:6400
- C:\Windows\System\NgLEbHL.exe
  C:\Windows\System\NgLEbHL.exe
  2⤵
  PID:6416
- C:\Windows\System\UNqoXJj.exe
  C:\Windows\System\UNqoXJj.exe
  2⤵
  PID:6436
- C:\Windows\System\TJrBAGK.exe
  C:\Windows\System\TJrBAGK.exe
  2⤵
  PID:6452
- C:\Windows\System\AyEueui.exe
  C:\Windows\System\AyEueui.exe
  2⤵
  PID:6468
- C:\Windows\System\PiWirvx.exe
  C:\Windows\System\PiWirvx.exe
  2⤵
  PID:6484
- C:\Windows\System\eBfPSVl.exe
  C:\Windows\System\eBfPSVl.exe
  2⤵
  PID:6500
- C:\Windows\System\CDJyWTI.exe
  C:\Windows\System\CDJyWTI.exe
  2⤵
  PID:6516
- C:\Windows\System\cNFztEx.exe
  C:\Windows\System\cNFztEx.exe
  2⤵
  PID:6532
- C:\Windows\System\xayYOkH.exe
  C:\Windows\System\xayYOkH.exe
  2⤵
  PID:6552
- C:\Windows\System\fOlKvsG.exe
  C:\Windows\System\fOlKvsG.exe
  2⤵
  PID:6568
- C:\Windows\System\BVAVJNk.exe
  C:\Windows\System\BVAVJNk.exe
  2⤵
  PID:6584
- C:\Windows\System\XAExbNO.exe
  C:\Windows\System\XAExbNO.exe
  2⤵
  PID:6688
- C:\Windows\System\VNgJEYi.exe
  C:\Windows\System\VNgJEYi.exe
  2⤵
  PID:6708
- C:\Windows\System\EeFgWzt.exe
  C:\Windows\System\EeFgWzt.exe
  2⤵
  PID:6724
- C:\Windows\System\vLcaYlw.exe
  C:\Windows\System\vLcaYlw.exe
  2⤵
  PID:6760
- C:\Windows\System\PSLlLea.exe
  C:\Windows\System\PSLlLea.exe
  2⤵
  PID:6776
- C:\Windows\System\UjqVBAR.exe
  C:\Windows\System\UjqVBAR.exe
  2⤵
  PID:6792
- C:\Windows\System\eBSLZEt.exe
  C:\Windows\System\eBSLZEt.exe
  2⤵
  PID:6808
- C:\Windows\System\hHPOKBl.exe
  C:\Windows\System\hHPOKBl.exe
  2⤵
  PID:6824
- C:\Windows\System\jDgTXWP.exe
  C:\Windows\System\jDgTXWP.exe
  2⤵
  PID:6840
- C:\Windows\System\CbwAtYq.exe
  C:\Windows\System\CbwAtYq.exe
  2⤵
  PID:6856
- C:\Windows\System\uOFPrfq.exe
  C:\Windows\System\uOFPrfq.exe
  2⤵
  PID:6876
- C:\Windows\System\RVZjjaR.exe
  C:\Windows\System\RVZjjaR.exe
  2⤵
  PID:6896
- C:\Windows\System\eOAwlqc.exe
  C:\Windows\System\eOAwlqc.exe
  2⤵
  PID:6916
- C:\Windows\System\DfBNXPb.exe
  C:\Windows\System\DfBNXPb.exe
  2⤵
  PID:6944
- C:\Windows\System\WHONjxI.exe
  C:\Windows\System\WHONjxI.exe
  2⤵
  PID:6964
- C:\Windows\System\UAPlibC.exe
  C:\Windows\System\UAPlibC.exe
  2⤵
  PID:6980
- C:\Windows\System\zQDTJFX.exe
  C:\Windows\System\zQDTJFX.exe
  2⤵
  PID:6996
- C:\Windows\System\jdEDXQO.exe
  C:\Windows\System\jdEDXQO.exe
  2⤵
  PID:7012
- C:\Windows\System\QCOQRYp.exe
  C:\Windows\System\QCOQRYp.exe
  2⤵
  PID:7032
- C:\Windows\System\yYYavzy.exe
  C:\Windows\System\yYYavzy.exe
  2⤵
  PID:7048
- C:\Windows\System\XPmtfKG.exe
  C:\Windows\System\XPmtfKG.exe
  2⤵
  PID:7064
- C:\Windows\System\QGZCJbr.exe
  C:\Windows\System\QGZCJbr.exe
  2⤵
  PID:7080
- C:\Windows\System\gVVLqMl.exe
  C:\Windows\System\gVVLqMl.exe
  2⤵
  PID:7096
- C:\Windows\System\oEunvGV.exe
  C:\Windows\System\oEunvGV.exe
  2⤵
  PID:7112
- C:\Windows\System\QKlKoFY.exe
  C:\Windows\System\QKlKoFY.exe
  2⤵
  PID:7132
- C:\Windows\System\yurDNnu.exe
  C:\Windows\System\yurDNnu.exe
  2⤵
  PID:7148
- C:\Windows\System\SxPkugQ.exe
  C:\Windows\System\SxPkugQ.exe
  2⤵
  PID:7164
- C:\Windows\System\JVEZTNO.exe
  C:\Windows\System\JVEZTNO.exe
  2⤵
  PID:6232
- C:\Windows\System\KhXdMpX.exe
  C:\Windows\System\KhXdMpX.exe
  2⤵
  PID:6272
- C:\Windows\System\oIrBaPd.exe
  C:\Windows\System\oIrBaPd.exe
  2⤵
  PID:6344
- C:\Windows\System\sNCsjvW.exe
  C:\Windows\System\sNCsjvW.exe
  2⤵
  PID:6408
- C:\Windows\System\pPExWJt.exe
  C:\Windows\System\pPExWJt.exe
  2⤵
  PID:6476
- C:\Windows\System\sAXXEGK.exe
  C:\Windows\System\sAXXEGK.exe
  2⤵
  PID:6544
- C:\Windows\System\QEGcCmh.exe
  C:\Windows\System\QEGcCmh.exe
  2⤵
  PID:5420
- C:\Windows\System\ylXZCJD.exe
  C:\Windows\System\ylXZCJD.exe
  2⤵
  PID:6220
- C:\Windows\System\obLwckx.exe
  C:\Windows\System\obLwckx.exe
  2⤵
  PID:6360
- C:\Windows\System\vxlABKM.exe
  C:\Windows\System\vxlABKM.exe
  2⤵
  PID:6528
- C:\Windows\System\BZXtqLQ.exe
  C:\Windows\System\BZXtqLQ.exe
  2⤵
  PID:5296
- C:\Windows\System\DKVPVPL.exe
  C:\Windows\System\DKVPVPL.exe
  2⤵
  PID:6356
- C:\Windows\System\ORjFJzX.exe
  C:\Windows\System\ORjFJzX.exe
  2⤵
  PID:6460
- C:\Windows\System\kdMgpMP.exe
  C:\Windows\System\kdMgpMP.exe
  2⤵
  PID:6660
- C:\Windows\System\ovBHeQA.exe
  C:\Windows\System\ovBHeQA.exe
  2⤵
  PID:6696
- C:\Windows\System\vvBvjCW.exe
  C:\Windows\System\vvBvjCW.exe
  2⤵
  PID:6716
- C:\Windows\System\qApGFjN.exe
  C:\Windows\System\qApGFjN.exe
  2⤵
  PID:6736
- C:\Windows\System\tTcHkhV.exe
  C:\Windows\System\tTcHkhV.exe
  2⤵
  PID:6768
- C:\Windows\System\woLhQcy.exe
  C:\Windows\System\woLhQcy.exe
  2⤵
  PID:6800
- C:\Windows\System\FHtubIX.exe
  C:\Windows\System\FHtubIX.exe
  2⤵
  PID:6884
- C:\Windows\System\ygONdwj.exe
  C:\Windows\System\ygONdwj.exe
  2⤵
  PID:6892
- C:\Windows\System\jFHdghN.exe
  C:\Windows\System\jFHdghN.exe
  2⤵
  PID:6836
- C:\Windows\System\OTHeUrL.exe
  C:\Windows\System\OTHeUrL.exe
  2⤵
  PID:6928
- C:\Windows\System\gdwzmIh.exe
  C:\Windows\System\gdwzmIh.exe
  2⤵
  PID:6972
- C:\Windows\System\JTwxJTq.exe
  C:\Windows\System\JTwxJTq.exe
  2⤵
  PID:7044
- C:\Windows\System\VHCjdmX.exe
  C:\Windows\System\VHCjdmX.exe
  2⤵
  PID:7108
- C:\Windows\System\tAwlosG.exe
  C:\Windows\System\tAwlosG.exe
  2⤵
  PID:6200
- C:\Windows\System\xicPMsN.exe
  C:\Windows\System\xicPMsN.exe
  2⤵
  PID:6444
- C:\Windows\System\YZKFLpV.exe
  C:\Windows\System\YZKFLpV.exe
  2⤵
  PID:6580
- C:\Windows\System\lMluJJN.exe
  C:\Windows\System\lMluJJN.exe
  2⤵
  PID:6184
- C:\Windows\System\owVsKcP.exe
  C:\Windows\System\owVsKcP.exe
  2⤵
  PID:6988
- C:\Windows\System\MJsJjvK.exe
  C:\Windows\System\MJsJjvK.exe
  2⤵
  PID:6216
- C:\Windows\System\jgJGzMp.exe
  C:\Windows\System\jgJGzMp.exe
  2⤵
  PID:6992
- C:\Windows\System\JqQAjdK.exe
  C:\Windows\System\JqQAjdK.exe
  2⤵
  PID:7124
- C:\Windows\System\XiCQZPC.exe
  C:\Windows\System\XiCQZPC.exe
  2⤵
  PID:6268
- C:\Windows\System\oEzMwPm.exe
  C:\Windows\System\oEzMwPm.exe
  2⤵
  PID:6512
- C:\Windows\System\bSEjtyF.exe
  C:\Windows\System\bSEjtyF.exe
  2⤵
  PID:6292
- C:\Windows\System\mcfjEsm.exe
  C:\Windows\System\mcfjEsm.exe
  2⤵
  PID:6524
- C:\Windows\System\YTbNcze.exe
  C:\Windows\System\YTbNcze.exe
  2⤵
  PID:6592
- C:\Windows\System\RdmfxYi.exe
  C:\Windows\System\RdmfxYi.exe
  2⤵
  PID:6608
- C:\Windows\System\bzjGyEC.exe
  C:\Windows\System\bzjGyEC.exe
  2⤵
  PID:6628
- C:\Windows\System\ZGOMthg.exe
  C:\Windows\System\ZGOMthg.exe
  2⤵
  PID:6656
- C:\Windows\System\EgOAhLN.exe
  C:\Windows\System\EgOAhLN.exe
  2⤵
  PID:6652
- C:\Windows\System\cyVbnhW.exe
  C:\Windows\System\cyVbnhW.exe
  2⤵
  PID:6684
- C:\Windows\System\gQTRPZf.exe
  C:\Windows\System\gQTRPZf.exe
  2⤵
  PID:6784
- C:\Windows\System\IuCxomb.exe
  C:\Windows\System\IuCxomb.exe
  2⤵
  PID:1568
- C:\Windows\System\dBiwMqB.exe
  C:\Windows\System\dBiwMqB.exe
  2⤵
  PID:7040
- C:\Windows\System\YmcfKGn.exe
  C:\Windows\System\YmcfKGn.exe
  2⤵
  PID:6148
- C:\Windows\System\xRpAYPl.exe
  C:\Windows\System\xRpAYPl.exe
  2⤵
  PID:7180
- C:\Windows\System\fhFtViH.exe
  C:\Windows\System\fhFtViH.exe
  2⤵
  PID:7200
- C:\Windows\System\KZhVJET.exe
  C:\Windows\System\KZhVJET.exe
  2⤵
  PID:7232
- C:\Windows\System\rOyLKGj.exe
  C:\Windows\System\rOyLKGj.exe
  2⤵
  PID:7248
- C:\Windows\System\covBulF.exe
  C:\Windows\System\covBulF.exe
  2⤵
  PID:7264
- C:\Windows\System\ZMDaHIy.exe
  C:\Windows\System\ZMDaHIy.exe
  2⤵
  PID:7280
- C:\Windows\System\ofEdYAk.exe
  C:\Windows\System\ofEdYAk.exe
  2⤵
  PID:7296
- C:\Windows\System\GLxuczI.exe
  C:\Windows\System\GLxuczI.exe
  2⤵
  PID:7312
- C:\Windows\System\IXHDCqj.exe
  C:\Windows\System\IXHDCqj.exe
  2⤵
  PID:7332
- C:\Windows\System\IVbfjwk.exe
  C:\Windows\System\IVbfjwk.exe
  2⤵
  PID:7348
- C:\Windows\System\SatohmN.exe
  C:\Windows\System\SatohmN.exe
  2⤵
  PID:7364
- C:\Windows\System\ParYeNz.exe
  C:\Windows\System\ParYeNz.exe
  2⤵
  PID:7380
- C:\Windows\System\Lcwumeo.exe
  C:\Windows\System\Lcwumeo.exe
  2⤵
  PID:7396
- C:\Windows\System\SkwkqYC.exe
  C:\Windows\System\SkwkqYC.exe
  2⤵
  PID:7420
- C:\Windows\System\QmrCmsl.exe
  C:\Windows\System\QmrCmsl.exe
  2⤵
  PID:7436
- C:\Windows\System\toncqjr.exe
  C:\Windows\System\toncqjr.exe
  2⤵
  PID:7456
- C:\Windows\System\ZLfxAks.exe
  C:\Windows\System\ZLfxAks.exe
  2⤵
  PID:7472
- C:\Windows\System\xCRgtbM.exe
  C:\Windows\System\xCRgtbM.exe
  2⤵
  PID:7488
- C:\Windows\System\SxAeFRh.exe
  C:\Windows\System\SxAeFRh.exe
  2⤵
  PID:7504
- C:\Windows\System\OxFbSRg.exe
  C:\Windows\System\OxFbSRg.exe
  2⤵
  PID:7520
- C:\Windows\System\TJRUsZU.exe
  C:\Windows\System\TJRUsZU.exe
  2⤵
  PID:7536
- C:\Windows\System\rlGlWDG.exe
  C:\Windows\System\rlGlWDG.exe
  2⤵
  PID:7556
- C:\Windows\System\BawHWus.exe
  C:\Windows\System\BawHWus.exe
  2⤵
  PID:7572
- C:\Windows\System\fCUfVki.exe
  C:\Windows\System\fCUfVki.exe
  2⤵
  PID:7588
- C:\Windows\System\NTxClgS.exe
  C:\Windows\System\NTxClgS.exe
  2⤵
  PID:7604
- C:\Windows\System\mDCIwMx.exe
  C:\Windows\System\mDCIwMx.exe
  2⤵
  PID:7620
- C:\Windows\System\HRZNUqr.exe
  C:\Windows\System\HRZNUqr.exe
  2⤵
  PID:7636
- C:\Windows\System\YcDTGll.exe
  C:\Windows\System\YcDTGll.exe
  2⤵
  PID:7716
- C:\Windows\System\MnCbplZ.exe
  C:\Windows\System\MnCbplZ.exe
  2⤵
  PID:7740
- C:\Windows\System\jjhQZwa.exe
  C:\Windows\System\jjhQZwa.exe
  2⤵
  PID:7760
- C:\Windows\System\kwgrbly.exe
  C:\Windows\System\kwgrbly.exe
  2⤵
  PID:7884
- C:\Windows\System\WTapdda.exe
  C:\Windows\System\WTapdda.exe
  2⤵
  PID:7900
- C:\Windows\System\VNJrIfb.exe
  C:\Windows\System\VNJrIfb.exe
  2⤵
  PID:7916
- C:\Windows\System\wuFHIWs.exe
  C:\Windows\System\wuFHIWs.exe
  2⤵
  PID:7932
- C:\Windows\System\uDHFqDP.exe
  C:\Windows\System\uDHFqDP.exe
  2⤵
  PID:7948
- C:\Windows\System\GZqIIsZ.exe
  C:\Windows\System\GZqIIsZ.exe
  2⤵
  PID:7968
- C:\Windows\System\ujuGjlU.exe
  C:\Windows\System\ujuGjlU.exe
  2⤵
  PID:7988
- C:\Windows\System\MBoEHWd.exe
  C:\Windows\System\MBoEHWd.exe
  2⤵
  PID:8008
- C:\Windows\System\NmioJRN.exe
  C:\Windows\System\NmioJRN.exe
  2⤵
  PID:8024
- C:\Windows\System\RnnsNlq.exe
  C:\Windows\System\RnnsNlq.exe
  2⤵
  PID:8040
- C:\Windows\System\HxxACzh.exe
  C:\Windows\System\HxxACzh.exe
  2⤵
  PID:8056
- C:\Windows\System\WQESKDk.exe
  C:\Windows\System\WQESKDk.exe
  2⤵
  PID:8072
- C:\Windows\System\loShvjz.exe
  C:\Windows\System\loShvjz.exe
  2⤵
  PID:8088
- C:\Windows\System\GTxPsmr.exe
  C:\Windows\System\GTxPsmr.exe
  2⤵
  PID:8104
- C:\Windows\System\COofuCE.exe
  C:\Windows\System\COofuCE.exe
  2⤵
  PID:8144
- C:\Windows\System\NNaBCRy.exe
  C:\Windows\System\NNaBCRy.exe
  2⤵
  PID:8160
- C:\Windows\System\nrmMZDB.exe
  C:\Windows\System\nrmMZDB.exe
  2⤵
  PID:8176
- C:\Windows\System\hbqDpuB.exe
  C:\Windows\System\hbqDpuB.exe
  2⤵
  PID:6428
- C:\Windows\System\TDERMWX.exe
  C:\Windows\System\TDERMWX.exe
  2⤵
  PID:6748
- C:\Windows\System\eSVaIRr.exe
  C:\Windows\System\eSVaIRr.exe
  2⤵
  PID:6620
- C:\Windows\System\MhLZgTL.exe
  C:\Windows\System\MhLZgTL.exe
  2⤵
  PID:6624
- C:\Windows\System\GKAEYMh.exe
  C:\Windows\System\GKAEYMh.exe
  2⤵
  PID:5992
- C:\Windows\System\iWuwEqq.exe
  C:\Windows\System\iWuwEqq.exe
  2⤵
  PID:6820
- C:\Windows\System\gHbtqnL.exe
  C:\Windows\System\gHbtqnL.exe
  2⤵
  PID:7104
- C:\Windows\System\QFRLrRV.exe
  C:\Windows\System\QFRLrRV.exe
  2⤵
  PID:6832
- C:\Windows\System\AbHaRlC.exe
  C:\Windows\System\AbHaRlC.exe
  2⤵
  PID:7076
- C:\Windows\System\NCHfeAy.exe
  C:\Windows\System\NCHfeAy.exe
  2⤵
  PID:6180
- C:\Windows\System\rXYpvzP.exe
  C:\Windows\System\rXYpvzP.exe
  2⤵
  PID:7120
- C:\Windows\System\TgmSODu.exe
  C:\Windows\System\TgmSODu.exe
  2⤵
  PID:6604
- C:\Windows\System\EIumjsn.exe
  C:\Windows\System\EIumjsn.exe
  2⤵
  PID:6680
- C:\Windows\System\hqxNult.exe
  C:\Windows\System\hqxNult.exe
  2⤵
  PID:6164
- C:\Windows\System\QXtrXvZ.exe
  C:\Windows\System\QXtrXvZ.exe
  2⤵
  PID:7220
- C:\Windows\System\xADguCh.exe
  C:\Windows\System\xADguCh.exe
  2⤵
  PID:7244
- C:\Windows\System\pRHmCqC.exe
  C:\Windows\System\pRHmCqC.exe
  2⤵
  PID:7288
- C:\Windows\System\YYqxjFf.exe
  C:\Windows\System\YYqxjFf.exe
  2⤵
  PID:7328
- C:\Windows\System\pVlMhtR.exe
  C:\Windows\System\pVlMhtR.exe
  2⤵
  PID:7276
- C:\Windows\System\sZZQkCG.exe
  C:\Windows\System\sZZQkCG.exe
  2⤵
  PID:7464
- C:\Windows\System\pbYGkOz.exe
  C:\Windows\System\pbYGkOz.exe
  2⤵
  PID:7528
- C:\Windows\System\UdIbWdQ.exe
  C:\Windows\System\UdIbWdQ.exe
  2⤵
  PID:7568
- C:\Windows\System\qqQBywL.exe
  C:\Windows\System\qqQBywL.exe
  2⤵
  PID:7600
- C:\Windows\System\evCmfUu.exe
  C:\Windows\System\evCmfUu.exe
  2⤵
  PID:7340
- C:\Windows\System\uDCbjSy.exe
  C:\Windows\System\uDCbjSy.exe
  2⤵
  PID:7408
- C:\Windows\System\MpbDmxh.exe
  C:\Windows\System\MpbDmxh.exe
  2⤵
  PID:7448
- C:\Windows\System\bgGnmEj.exe
  C:\Windows\System\bgGnmEj.exe
  2⤵
  PID:7516
- C:\Windows\System\vVFrCcR.exe
  C:\Windows\System\vVFrCcR.exe
  2⤵
  PID:7584
- C:\Windows\System\LfWfFQq.exe
  C:\Windows\System\LfWfFQq.exe
  2⤵
  PID:7648
- C:\Windows\System\oCRHcZU.exe
  C:\Windows\System\oCRHcZU.exe
  2⤵
  PID:7664
- C:\Windows\System\UcONFoi.exe
  C:\Windows\System\UcONFoi.exe
  2⤵
  PID:7676
- C:\Windows\System\vTZCSLB.exe
  C:\Windows\System\vTZCSLB.exe
  2⤵
  PID:7700
- C:\Windows\System\wNmDiqN.exe
  C:\Windows\System\wNmDiqN.exe
  2⤵
  PID:2464
- C:\Windows\System\ZrnISkI.exe
  C:\Windows\System\ZrnISkI.exe
  2⤵
  PID:7724
- C:\Windows\System\JDlpOnh.exe
  C:\Windows\System\JDlpOnh.exe
  2⤵
  PID:7752
- C:\Windows\System\btoGlPn.exe
  C:\Windows\System\btoGlPn.exe
  2⤵
  PID:7780
- C:\Windows\System\BRDgfNe.exe
  C:\Windows\System\BRDgfNe.exe
  2⤵
  PID:7868
- C:\Windows\System\ThsaRxX.exe
  C:\Windows\System\ThsaRxX.exe
  2⤵
  PID:7908
- C:\Windows\System\hJeiAVp.exe
  C:\Windows\System\hJeiAVp.exe
  2⤵
  PID:7980
- C:\Windows\System\AodogtA.exe
  C:\Windows\System\AodogtA.exe
  2⤵
  PID:7976
- C:\Windows\System\aJZmaMP.exe
  C:\Windows\System\aJZmaMP.exe
  2⤵
  PID:8112
- C:\Windows\System\ppuoDpB.exe
  C:\Windows\System\ppuoDpB.exe
  2⤵
  PID:7928
- C:\Windows\System\VCIujJy.exe
  C:\Windows\System\VCIujJy.exe
  2⤵
  PID:7892
- C:\Windows\System\QhzGAaA.exe
  C:\Windows\System\QhzGAaA.exe
  2⤵
  PID:7964
- C:\Windows\System\jqrMmWu.exe
  C:\Windows\System\jqrMmWu.exe
  2⤵
  PID:8036
- C:\Windows\System\bGnekKP.exe
  C:\Windows\System\bGnekKP.exe
  2⤵
  PID:8128
- C:\Windows\System\kIyjjFT.exe
  C:\Windows\System\kIyjjFT.exe
  2⤵
  PID:8172
- C:\Windows\System\wpqwGJQ.exe
  C:\Windows\System\wpqwGJQ.exe
  2⤵
  PID:8152
- C:\Windows\System\phgLMmg.exe
  C:\Windows\System\phgLMmg.exe
  2⤵
  PID:6752
- C:\Windows\System\khmXfDW.exe
  C:\Windows\System\khmXfDW.exe
  2⤵
  PID:6632
- C:\Windows\System\UnTBjzS.exe
  C:\Windows\System\UnTBjzS.exe
  2⤵
  PID:6464
- C:\Windows\System\YtDkKQz.exe
  C:\Windows\System\YtDkKQz.exe
  2⤵
  PID:7004
- C:\Windows\System\AopQLYq.exe
  C:\Windows\System\AopQLYq.exe
  2⤵
  PID:6700
- C:\Windows\System\netRDtd.exe
  C:\Windows\System\netRDtd.exe
  2⤵
  PID:6600
- C:\Windows\System\BFRGrIb.exe
  C:\Windows\System\BFRGrIb.exe
  2⤵
  PID:7228
- C:\Windows\System\uiHTQVw.exe
  C:\Windows\System\uiHTQVw.exe
  2⤵
  PID:7260
- C:\Windows\System\FsUCxik.exe
  C:\Windows\System\FsUCxik.exe
  2⤵
  PID:7468
- C:\Windows\System\lebmIee.exe
  C:\Windows\System\lebmIee.exe
  2⤵
  PID:7308
- C:\Windows\System\VpwrXCt.exe
  C:\Windows\System\VpwrXCt.exe
  2⤵
  PID:7612
- C:\Windows\System\UKgZnKm.exe
  C:\Windows\System\UKgZnKm.exe
  2⤵
  PID:7692
- C:\Windows\System\BMIcjqK.exe
  C:\Windows\System\BMIcjqK.exe
  2⤵
  PID:7776
- C:\Windows\System\FzsHsjr.exe
  C:\Windows\System\FzsHsjr.exe
  2⤵
  PID:7480
- C:\Windows\System\ABCQEZp.exe
  C:\Windows\System\ABCQEZp.exe
  2⤵
  PID:6936
- C:\Windows\System\zSiFeaH.exe
  C:\Windows\System\zSiFeaH.exe
  2⤵
  PID:6648
- C:\Windows\System\OgzhpmZ.exe
  C:\Windows\System\OgzhpmZ.exe
  2⤵
  PID:7216
- C:\Windows\System\uYwpHAc.exe
  C:\Windows\System\uYwpHAc.exe
  2⤵
  PID:7388
- C:\Windows\System\BkpuHft.exe
  C:\Windows\System\BkpuHft.exe
  2⤵
  PID:7404
- C:\Windows\System\JmoFFTz.exe
  C:\Windows\System\JmoFFTz.exe
  2⤵
  PID:7828
- C:\Windows\System\mpqmTYd.exe
  C:\Windows\System\mpqmTYd.exe
  2⤵
  PID:7680
- C:\Windows\System\OEmGvVf.exe
  C:\Windows\System\OEmGvVf.exe
  2⤵
  PID:7832
- C:\Windows\System\aAjOFLf.exe
  C:\Windows\System\aAjOFLf.exe
  2⤵
  PID:7796
- C:\Windows\System\JYAbpll.exe
  C:\Windows\System\JYAbpll.exe
  2⤵
  PID:7816
- C:\Windows\System\LccUCHM.exe
  C:\Windows\System\LccUCHM.exe
  2⤵
  PID:7860
- C:\Windows\System\LQWnCts.exe
  C:\Windows\System\LQWnCts.exe
  2⤵
  PID:7984
- C:\Windows\System\MwnvrLK.exe
  C:\Windows\System\MwnvrLK.exe
  2⤵
  PID:7960
- C:\Windows\System\GbmkULW.exe
  C:\Windows\System\GbmkULW.exe
  2⤵
  PID:8140
- C:\Windows\System\VjBKLux.exe
  C:\Windows\System\VjBKLux.exe
  2⤵
  PID:8064
- C:\Windows\System\qJtfxjX.exe
  C:\Windows\System\qJtfxjX.exe
  2⤵
  PID:7188
- C:\Windows\System\fscszAU.exe
  C:\Windows\System\fscszAU.exe
  2⤵
  PID:8048
- C:\Windows\System\qjKnzpB.exe
  C:\Windows\System\qjKnzpB.exe
  2⤵
  PID:6340
- C:\Windows\System\JqvSkrc.exe
  C:\Windows\System\JqvSkrc.exe
  2⤵
  PID:7564
- C:\Windows\System\txiFzkg.exe
  C:\Windows\System\txiFzkg.exe
  2⤵
  PID:7020
- C:\Windows\System\kKbsTDr.exe
  C:\Windows\System\kKbsTDr.exe
  2⤵
  PID:7304
- C:\Windows\System\ZIxrIxa.exe
  C:\Windows\System\ZIxrIxa.exe
  2⤵
  PID:7392
- C:\Windows\System\gccbJxT.exe
  C:\Windows\System\gccbJxT.exe
  2⤵
  PID:6380
- C:\Windows\System\SDYSsdH.exe
  C:\Windows\System\SDYSsdH.exe
  2⤵
  PID:7092
- C:\Windows\System\anRffYm.exe
  C:\Windows\System\anRffYm.exe
  2⤵
  PID:7212
- C:\Windows\System\CjKAOOJ.exe
  C:\Windows\System\CjKAOOJ.exe
  2⤵
  PID:7672
- C:\Windows\System\WZacTKl.exe
  C:\Windows\System\WZacTKl.exe
  2⤵
  PID:7772
- C:\Windows\System\XdKLKRe.exe
  C:\Windows\System\XdKLKRe.exe
  2⤵
  PID:8000
- C:\Windows\System\GHnpFXe.exe
  C:\Windows\System\GHnpFXe.exe
  2⤵
  PID:6240
- C:\Windows\System\PXBZRAL.exe
  C:\Windows\System\PXBZRAL.exe
  2⤵
  PID:7844
- C:\Windows\System\kZMrkVw.exe
  C:\Windows\System\kZMrkVw.exe
  2⤵
  PID:6508
- C:\Windows\System\xoolGvj.exe
  C:\Windows\System\xoolGvj.exe
  2⤵
  PID:7856
- C:\Windows\System\xfpmpgx.exe
  C:\Windows\System\xfpmpgx.exe
  2⤵
  PID:8052
- C:\Windows\System\DgFoRYp.exe
  C:\Windows\System\DgFoRYp.exe
  2⤵
  PID:7324
- C:\Windows\System\OJRvYWR.exe
  C:\Windows\System\OJRvYWR.exe
  2⤵
  PID:7544
- C:\Windows\System\HyPHadO.exe
  C:\Windows\System\HyPHadO.exe
  2⤵
  PID:6912
- C:\Windows\System\GVHYFfe.exe
  C:\Windows\System\GVHYFfe.exe
  2⤵
  PID:7272
- C:\Windows\System\DgNmTNn.exe
  C:\Windows\System\DgNmTNn.exe
  2⤵
  PID:8120
- C:\Windows\System\VmHiskE.exe
  C:\Windows\System\VmHiskE.exe
  2⤵
  PID:7784
- C:\Windows\System\EUlwquG.exe
  C:\Windows\System\EUlwquG.exe
  2⤵
  PID:7660
- C:\Windows\System\WHqskbV.exe
  C:\Windows\System\WHqskbV.exe
  2⤵
  PID:7548
- C:\Windows\System\DkzKSLU.exe
  C:\Windows\System\DkzKSLU.exe
  2⤵
  PID:7852
- C:\Windows\System\ksewwsi.exe
  C:\Windows\System\ksewwsi.exe
  2⤵
  PID:7880
- C:\Windows\System\wiAWueK.exe
  C:\Windows\System\wiAWueK.exe
  2⤵
  PID:7712
- C:\Windows\System\uZZhldj.exe
  C:\Windows\System\uZZhldj.exe
  2⤵
  PID:7940
- C:\Windows\System\MjtKIaO.exe
  C:\Windows\System\MjtKIaO.exe
  2⤵
  PID:7812
- C:\Windows\System\WmZDGdY.exe
  C:\Windows\System\WmZDGdY.exe
  2⤵
  PID:8196
- C:\Windows\System\ydHOCFG.exe
  C:\Windows\System\ydHOCFG.exe
  2⤵
  PID:8212
- C:\Windows\System\VLPepLd.exe
  C:\Windows\System\VLPepLd.exe
  2⤵
  PID:8228
- C:\Windows\System\iWWIZLt.exe
  C:\Windows\System\iWWIZLt.exe
  2⤵
  PID:8244
- C:\Windows\System\mmtcEzt.exe
  C:\Windows\System\mmtcEzt.exe
  2⤵
  PID:8260
- C:\Windows\System\tfvnscA.exe
  C:\Windows\System\tfvnscA.exe
  2⤵
  PID:8276
- C:\Windows\System\OYkgNmA.exe
  C:\Windows\System\OYkgNmA.exe
  2⤵
  PID:8292
- C:\Windows\System\RFTmeJJ.exe
  C:\Windows\System\RFTmeJJ.exe
  2⤵
  PID:8352
- C:\Windows\System\jjCOmBA.exe
  C:\Windows\System\jjCOmBA.exe
  2⤵
  PID:8368
- C:\Windows\System\NuWBnoC.exe
  C:\Windows\System\NuWBnoC.exe
  2⤵
  PID:8388
- C:\Windows\System\ZDiIoTg.exe
  C:\Windows\System\ZDiIoTg.exe
  2⤵
  PID:8404
- C:\Windows\System\Uyzkuhe.exe
  C:\Windows\System\Uyzkuhe.exe
  2⤵
  PID:8420
- C:\Windows\System\FEEyeJB.exe
  C:\Windows\System\FEEyeJB.exe
  2⤵
  PID:8436
- C:\Windows\System\emMfAeS.exe
  C:\Windows\System\emMfAeS.exe
  2⤵
  PID:8456
- C:\Windows\System\xCXqDFK.exe
  C:\Windows\System\xCXqDFK.exe
  2⤵
  PID:8472
- C:\Windows\System\uLPlkyA.exe
  C:\Windows\System\uLPlkyA.exe
  2⤵
  PID:8488
- C:\Windows\System\YGwnZZt.exe
  C:\Windows\System\YGwnZZt.exe
  2⤵
  PID:8504
- C:\Windows\System\tyBcBuP.exe
  C:\Windows\System\tyBcBuP.exe
  2⤵
  PID:8520
- C:\Windows\System\LjDrvyG.exe
  C:\Windows\System\LjDrvyG.exe
  2⤵
  PID:8536
- C:\Windows\System\caDTnSp.exe
  C:\Windows\System\caDTnSp.exe
  2⤵
  PID:8552
- C:\Windows\System\hnBWdOA.exe
  C:\Windows\System\hnBWdOA.exe
  2⤵
  PID:8568
- C:\Windows\System\YQwoLjc.exe
  C:\Windows\System\YQwoLjc.exe
  2⤵
  PID:8584
- C:\Windows\System\ZqyjuHO.exe
  C:\Windows\System\ZqyjuHO.exe
  2⤵
  PID:8600
- C:\Windows\System\EuNUvNc.exe
  C:\Windows\System\EuNUvNc.exe
  2⤵
  PID:8616
- C:\Windows\System\TBPFmmJ.exe
  C:\Windows\System\TBPFmmJ.exe
  2⤵
  PID:8632
- C:\Windows\System\QCthpCo.exe
  C:\Windows\System\QCthpCo.exe
  2⤵
  PID:8648
- C:\Windows\System\CzjDZop.exe
  C:\Windows\System\CzjDZop.exe
  2⤵
  PID:8664
- C:\Windows\System\LrOMaUk.exe
  C:\Windows\System\LrOMaUk.exe
  2⤵
  PID:8680
- C:\Windows\System\RYOJQKY.exe
  C:\Windows\System\RYOJQKY.exe
  2⤵
  PID:8696
- C:\Windows\System\wYSywbI.exe
  C:\Windows\System\wYSywbI.exe
  2⤵
  PID:8712
- C:\Windows\System\FmZPPqV.exe
  C:\Windows\System\FmZPPqV.exe
  2⤵
  PID:8728
- C:\Windows\System\AFnKnIg.exe
  C:\Windows\System\AFnKnIg.exe
  2⤵
  PID:8744
- C:\Windows\System\ryrTGnH.exe
  C:\Windows\System\ryrTGnH.exe
  2⤵
  PID:8760
- C:\Windows\System\Aoszjgm.exe
  C:\Windows\System\Aoszjgm.exe
  2⤵
  PID:8776
- C:\Windows\System\FnblxWy.exe
  C:\Windows\System\FnblxWy.exe
  2⤵
  PID:8792
- C:\Windows\System\sPGTEbl.exe
  C:\Windows\System\sPGTEbl.exe
  2⤵
  PID:8808
- C:\Windows\System\cumJXwD.exe
  C:\Windows\System\cumJXwD.exe
  2⤵
  PID:8824
- C:\Windows\System\qlPVMLu.exe
  C:\Windows\System\qlPVMLu.exe
  2⤵
  PID:8840
- C:\Windows\System\ErrCJTh.exe
  C:\Windows\System\ErrCJTh.exe
  2⤵
  PID:8856
- C:\Windows\System\CRJStgp.exe
  C:\Windows\System\CRJStgp.exe
  2⤵
  PID:8872
- C:\Windows\System\juXVJGL.exe
  C:\Windows\System\juXVJGL.exe
  2⤵
  PID:8892
- C:\Windows\System\IpCDCOb.exe
  C:\Windows\System\IpCDCOb.exe
  2⤵
  PID:8912
- C:\Windows\System\puXJwlM.exe
  C:\Windows\System\puXJwlM.exe
  2⤵
  PID:8928
- C:\Windows\System\GEhroCk.exe
  C:\Windows\System\GEhroCk.exe
  2⤵
  PID:8948
- C:\Windows\System\VuWdNTz.exe
  C:\Windows\System\VuWdNTz.exe
  2⤵
  PID:8968
- C:\Windows\System\GoiLsaE.exe
  C:\Windows\System\GoiLsaE.exe
  2⤵
  PID:8988
- C:\Windows\System\OzTYGIG.exe
  C:\Windows\System\OzTYGIG.exe
  2⤵
  PID:9004
- C:\Windows\System\zjlngkM.exe
  C:\Windows\System\zjlngkM.exe
  2⤵
  PID:9020
- C:\Windows\System\eEoJepD.exe
  C:\Windows\System\eEoJepD.exe
  2⤵
  PID:9036
- C:\Windows\System\cWNpjDm.exe
  C:\Windows\System\cWNpjDm.exe
  2⤵
  PID:9060
- C:\Windows\System\FAkfzBd.exe
  C:\Windows\System\FAkfzBd.exe
  2⤵
  PID:9076
- C:\Windows\System\dubLbgt.exe
  C:\Windows\System\dubLbgt.exe
  2⤵
  PID:9096
- C:\Windows\System\fkJRzOb.exe
  C:\Windows\System\fkJRzOb.exe
  2⤵
  PID:9112
- C:\Windows\System\xUDKGba.exe
  C:\Windows\System\xUDKGba.exe
  2⤵
  PID:9128
- C:\Windows\System\VjQgjJs.exe
  C:\Windows\System\VjQgjJs.exe
  2⤵
  PID:9144
- C:\Windows\System\WRWFVBN.exe
  C:\Windows\System\WRWFVBN.exe
  2⤵
  PID:9160
- C:\Windows\System\aYQGkKK.exe
  C:\Windows\System\aYQGkKK.exe
  2⤵
  PID:9176
- C:\Windows\System\CddRVvt.exe
  C:\Windows\System\CddRVvt.exe
  2⤵
  PID:9192
- C:\Windows\System\iUDJdOY.exe
  C:\Windows\System\iUDJdOY.exe
  2⤵
  PID:9208
- C:\Windows\System\kbgqDbX.exe
  C:\Windows\System\kbgqDbX.exe
  2⤵
  PID:7792
- C:\Windows\System\yAfxTND.exe
  C:\Windows\System\yAfxTND.exe
  2⤵
  PID:8256
- C:\Windows\System\uaBvbYh.exe
  C:\Windows\System\uaBvbYh.exe
  2⤵
  PID:8236
- C:\Windows\System\QioSifQ.exe
  C:\Windows\System\QioSifQ.exe
  2⤵
  PID:8284
- C:\Windows\System\oMHheUD.exe
  C:\Windows\System\oMHheUD.exe
  2⤵
  PID:8308
- C:\Windows\System\nNFnwHe.exe
  C:\Windows\System\nNFnwHe.exe
  2⤵
  PID:8328
- C:\Windows\System\rsMNUjg.exe
  C:\Windows\System\rsMNUjg.exe
  2⤵
  PID:8344
- C:\Windows\System\VuEMRlG.exe
  C:\Windows\System\VuEMRlG.exe
  2⤵
  PID:8412
- C:\Windows\System\wpgZzgg.exe
  C:\Windows\System\wpgZzgg.exe
  2⤵
  PID:8452
- C:\Windows\System\DdLYZkD.exe
  C:\Windows\System\DdLYZkD.exe
  2⤵
  PID:8348
- C:\Windows\System\RlMTZdw.exe
  C:\Windows\System\RlMTZdw.exe
  2⤵
  PID:8396
- C:\Windows\System\ppfkjMf.exe
  C:\Windows\System\ppfkjMf.exe
  2⤵
  PID:8464
- C:\Windows\System\BkzdIiY.exe
  C:\Windows\System\BkzdIiY.exe
  2⤵
  PID:8884
- C:\Windows\System\YfqVnuS.exe
  C:\Windows\System\YfqVnuS.exe
  2⤵
  PID:8920
- C:\Windows\System\MzVjXhs.exe
  C:\Windows\System\MzVjXhs.exe
  2⤵
  PID:9120
- C:\Windows\System\EAjuuGi.exe
  C:\Windows\System\EAjuuGi.exe
  2⤵
  PID:9156
- C:\Windows\System\MfEaQDR.exe
  C:\Windows\System\MfEaQDR.exe
  2⤵
  PID:7800
- C:\Windows\System\LXArwQb.exe
  C:\Windows\System\LXArwQb.exe
  2⤵
  PID:8272
- C:\Windows\System\mwyNIPw.exe
  C:\Windows\System\mwyNIPw.exe
  2⤵
  PID:8340
- C:\Windows\System\WNfOuNk.exe
  C:\Windows\System\WNfOuNk.exe
  2⤵
  PID:8448
- C:\Windows\System\rSZdWab.exe
  C:\Windows\System\rSZdWab.exe
  2⤵
  PID:9168
- C:\Windows\System\tljsWHD.exe
  C:\Windows\System\tljsWHD.exe
  2⤵
  PID:8224
- C:\Windows\System\ihlOmoi.exe
  C:\Windows\System\ihlOmoi.exe
  2⤵
  PID:8384
- C:\Windows\System\MUICjLy.exe
  C:\Windows\System\MUICjLy.exe
  2⤵
  PID:8364
- C:\Windows\System\CuKHeGT.exe
  C:\Windows\System\CuKHeGT.exe
  2⤵
  PID:8608
- C:\Windows\System\ARCyzfy.exe
  C:\Windows\System\ARCyzfy.exe
  2⤵
  PID:8676
- C:\Windows\System\xTcGILd.exe
  C:\Windows\System\xTcGILd.exe
  2⤵
  PID:8656
- C:\Windows\System\mdZvczY.exe
  C:\Windows\System\mdZvczY.exe
  2⤵
  PID:8720
- C:\Windows\System\TROHWKL.exe
  C:\Windows\System\TROHWKL.exe
  2⤵
  PID:8752
- C:\Windows\System\AleJHcx.exe
  C:\Windows\System\AleJHcx.exe
  2⤵
  PID:8756
- C:\Windows\System\uVRTmBd.exe
  C:\Windows\System\uVRTmBd.exe
  2⤵
  PID:8784
- C:\Windows\System\SGwETdh.exe
  C:\Windows\System\SGwETdh.exe
  2⤵
  PID:8816
- C:\Windows\System\jIamHSY.exe
  C:\Windows\System\jIamHSY.exe
  2⤵
  PID:8944
- C:\Windows\System\LCHrApu.exe
  C:\Windows\System\LCHrApu.exe
  2⤵
  PID:9028
- C:\Windows\System\LHKyntq.exe
  C:\Windows\System\LHKyntq.exe
  2⤵
  PID:8204
- C:\Windows\System\HEZFpXB.exe
  C:\Windows\System\HEZFpXB.exe
  2⤵
  PID:8672
- C:\Windows\System\sFPHkqY.exe
  C:\Windows\System\sFPHkqY.exe
  2⤵
  PID:9136
- C:\Windows\System\KiOaceR.exe
  C:\Windows\System\KiOaceR.exe
  2⤵
  PID:8708
- C:\Windows\System\AkAQEDc.exe
  C:\Windows\System\AkAQEDc.exe
  2⤵
  PID:8832
- C:\Windows\System\PYiJrAG.exe
  C:\Windows\System\PYiJrAG.exe
  2⤵
  PID:9072
- C:\Windows\System\rHpVznp.exe
  C:\Windows\System\rHpVznp.exe
  2⤵
  PID:8336
- C:\Windows\System\HBOTvqF.exe
  C:\Windows\System\HBOTvqF.exe
  2⤵
  PID:8688
- C:\Windows\System\eXIIuXj.exe
  C:\Windows\System\eXIIuXj.exe
  2⤵
  PID:8692
- C:\Windows\System\ZtJOKKQ.exe
  C:\Windows\System\ZtJOKKQ.exe
  2⤵
  PID:8788
- C:\Windows\System\FZNYboW.exe
  C:\Windows\System\FZNYboW.exe
  2⤵
  PID:8964
- C:\Windows\System\gEzJgCX.exe
  C:\Windows\System\gEzJgCX.exe
  2⤵
  PID:8980
- C:\Windows\System\QACySni.exe
  C:\Windows\System\QACySni.exe
  2⤵
  PID:9044
- C:\Windows\System\wUsTniv.exe
  C:\Windows\System\wUsTniv.exe
  2⤵
  PID:9124
- C:\Windows\System\QpNQJBf.exe
  C:\Windows\System\QpNQJBf.exe
  2⤵
  PID:8848
- C:\Windows\System\bmOtkAK.exe
  C:\Windows\System\bmOtkAK.exe
  2⤵
  PID:8852
- C:\Windows\System\TKOOUDR.exe
  C:\Windows\System\TKOOUDR.exe
  2⤵
  PID:9032
- C:\Windows\System\YAsJGoF.exe
  C:\Windows\System\YAsJGoF.exe
  2⤵
  PID:9052
- C:\Windows\System\xhOklNK.exe
  C:\Windows\System\xhOklNK.exe
  2⤵
  PID:9092
- C:\Windows\System\yrasrAu.exe
  C:\Windows\System\yrasrAu.exe
  2⤵
  PID:8940
- C:\Windows\System\ApEPfey.exe
  C:\Windows\System\ApEPfey.exe
  2⤵
  PID:8976
- C:\Windows\System\wkzPSTA.exe
  C:\Windows\System\wkzPSTA.exe
  2⤵
  PID:8984
- C:\Windows\System\DxgcATp.exe
  C:\Windows\System\DxgcATp.exe
  2⤵
  PID:8740
- C:\Windows\System\XFwAjoT.exe
  C:\Windows\System\XFwAjoT.exe
  2⤵
  PID:8432
- C:\Windows\System\igXQLlc.exe
  C:\Windows\System\igXQLlc.exe
  2⤵
  PID:9088
- C:\Windows\System\MSGOlZR.exe
  C:\Windows\System\MSGOlZR.exe
  2⤵
  PID:8444
- C:\Windows\System\MBvEdVy.exe
  C:\Windows\System\MBvEdVy.exe
  2⤵
  PID:9000
- C:\Windows\System\NDwLnHY.exe
  C:\Windows\System\NDwLnHY.exe
  2⤵
  PID:8624
- C:\Windows\System\huSvkKd.exe
  C:\Windows\System\huSvkKd.exe
  2⤵
  PID:8936
- C:\Windows\System\hQHhzFB.exe
  C:\Windows\System\hQHhzFB.exe
  2⤵
  PID:9232
- C:\Windows\System\ecHAyaD.exe
  C:\Windows\System\ecHAyaD.exe
  2⤵
  PID:9248
- C:\Windows\System\DMJebui.exe
  C:\Windows\System\DMJebui.exe
  2⤵
  PID:9264
- C:\Windows\System\AAjNsyK.exe
  C:\Windows\System\AAjNsyK.exe
  2⤵
  PID:9280
- C:\Windows\System\nCFkrPy.exe
  C:\Windows\System\nCFkrPy.exe
  2⤵
  PID:9296
- C:\Windows\System\mLmAZGy.exe
  C:\Windows\System\mLmAZGy.exe
  2⤵
  PID:9312
- C:\Windows\System\JiwtisM.exe
  C:\Windows\System\JiwtisM.exe
  2⤵
  PID:9328
- C:\Windows\System\llnRYgj.exe
  C:\Windows\System\llnRYgj.exe
  2⤵
  PID:9344
- C:\Windows\System\gWdPecV.exe
  C:\Windows\System\gWdPecV.exe
  2⤵
  PID:9360
- C:\Windows\System\wrEbUzC.exe
  C:\Windows\System\wrEbUzC.exe
  2⤵
  PID:9376
- C:\Windows\System\PXoVgnw.exe
  C:\Windows\System\PXoVgnw.exe
  2⤵
  PID:9392
- C:\Windows\System\xMNekYd.exe
  C:\Windows\System\xMNekYd.exe
  2⤵
  PID:9408
- C:\Windows\System\oXwnPsl.exe
  C:\Windows\System\oXwnPsl.exe
  2⤵
  PID:9424
- C:\Windows\System\EJXTvwv.exe
  C:\Windows\System\EJXTvwv.exe
  2⤵
  PID:9440
- C:\Windows\System\lELSohQ.exe
  C:\Windows\System\lELSohQ.exe
  2⤵
  PID:9456
- C:\Windows\System\ZUqOBcN.exe
  C:\Windows\System\ZUqOBcN.exe
  2⤵
  PID:9472
- C:\Windows\System\yXpMpVr.exe
  C:\Windows\System\yXpMpVr.exe
  2⤵
  PID:9488
- C:\Windows\System\otTCZzE.exe
  C:\Windows\System\otTCZzE.exe
  2⤵
  PID:9504
- C:\Windows\System\NANDcns.exe
  C:\Windows\System\NANDcns.exe
  2⤵
  PID:9520
- C:\Windows\System\FRwqWZo.exe
  C:\Windows\System\FRwqWZo.exe
  2⤵
  PID:9540
- C:\Windows\System\AgOscNl.exe
  C:\Windows\System\AgOscNl.exe
  2⤵
  PID:9568
- C:\Windows\System\LAzwBjh.exe
  C:\Windows\System\LAzwBjh.exe
  2⤵
  PID:9584
- C:\Windows\System\HdguLXG.exe
  C:\Windows\System\HdguLXG.exe
  2⤵
  PID:9600
- C:\Windows\System\oAHvhwa.exe
  C:\Windows\System\oAHvhwa.exe
  2⤵
  PID:9616
- C:\Windows\System\BTdoAZL.exe
  C:\Windows\System\BTdoAZL.exe
  2⤵
  PID:9632
- C:\Windows\System\dPcNJMt.exe
  C:\Windows\System\dPcNJMt.exe
  2⤵
  PID:9648
- C:\Windows\System\hawbJcZ.exe
  C:\Windows\System\hawbJcZ.exe
  2⤵
  PID:9664
- C:\Windows\System\CFEAGzI.exe
  C:\Windows\System\CFEAGzI.exe
  2⤵
  PID:9680
- C:\Windows\System\QsHzlpV.exe
  C:\Windows\System\QsHzlpV.exe
  2⤵
  PID:9696
- C:\Windows\System\dWDqKFp.exe
  C:\Windows\System\dWDqKFp.exe
  2⤵
  PID:9712
- C:\Windows\System\vCrgQXR.exe
  C:\Windows\System\vCrgQXR.exe
  2⤵
  PID:9728
- C:\Windows\System\CoARykb.exe
  C:\Windows\System\CoARykb.exe
  2⤵
  PID:9744
- C:\Windows\System\hHkwpDn.exe
  C:\Windows\System\hHkwpDn.exe
  2⤵
  PID:9760
- C:\Windows\System\LcMvOeE.exe
  C:\Windows\System\LcMvOeE.exe
  2⤵
  PID:9776
- C:\Windows\System\ryxowMK.exe
  C:\Windows\System\ryxowMK.exe
  2⤵
  PID:9792
- C:\Windows\System\ylSgrnu.exe
  C:\Windows\System\ylSgrnu.exe
  2⤵
  PID:9808
- C:\Windows\System\roXwbvE.exe
  C:\Windows\System\roXwbvE.exe
  2⤵
  PID:9824
- C:\Windows\System\UvbYhwm.exe
  C:\Windows\System\UvbYhwm.exe
  2⤵
  PID:9840
- C:\Windows\System\mTQDtEH.exe
  C:\Windows\System\mTQDtEH.exe
  2⤵
  PID:9856
- C:\Windows\System\wRzDkND.exe
  C:\Windows\System\wRzDkND.exe
  2⤵
  PID:9872
- C:\Windows\System\fYlduoM.exe
  C:\Windows\System\fYlduoM.exe
  2⤵
  PID:9888
- C:\Windows\System\sFqsGOZ.exe
  C:\Windows\System\sFqsGOZ.exe
  2⤵
  PID:9904
- C:\Windows\System\QeaNQNN.exe
  C:\Windows\System\QeaNQNN.exe
  2⤵
  PID:9920
- C:\Windows\System\dEGrmUu.exe
  C:\Windows\System\dEGrmUu.exe
  2⤵
  PID:9936
- C:\Windows\System\LENnaYj.exe
  C:\Windows\System\LENnaYj.exe
  2⤵
  PID:9952
- C:\Windows\System\AERJWkh.exe
  C:\Windows\System\AERJWkh.exe
  2⤵
  PID:9968
- C:\Windows\System\DTubbUL.exe
  C:\Windows\System\DTubbUL.exe
  2⤵
  PID:9984
- C:\Windows\System\BDoGGWp.exe
  C:\Windows\System\BDoGGWp.exe
  2⤵
  PID:10000
- C:\Windows\System\FtdsjQh.exe
  C:\Windows\System\FtdsjQh.exe
  2⤵
  PID:10016
- C:\Windows\System\fnIbabu.exe
  C:\Windows\System\fnIbabu.exe
  2⤵
  PID:10032
- C:\Windows\System\MULRMik.exe
  C:\Windows\System\MULRMik.exe
  2⤵
  PID:10048
- C:\Windows\System\QixgEdI.exe
  C:\Windows\System\QixgEdI.exe
  2⤵
  PID:10064
- C:\Windows\System\TVIgCDo.exe
  C:\Windows\System\TVIgCDo.exe
  2⤵
  PID:10084
- C:\Windows\System\TLepeuX.exe
  C:\Windows\System\TLepeuX.exe
  2⤵
  PID:10100
- C:\Windows\System\eLSmXOV.exe
  C:\Windows\System\eLSmXOV.exe
  2⤵
  PID:10116
- C:\Windows\System\sVBKCMK.exe
  C:\Windows\System\sVBKCMK.exe
  2⤵
  PID:10132
- C:\Windows\System\afOTxFg.exe
  C:\Windows\System\afOTxFg.exe
  2⤵
  PID:10148
- C:\Windows\System\ToKrJRW.exe
  C:\Windows\System\ToKrJRW.exe
  2⤵
  PID:10164
- C:\Windows\System\GVsuNRO.exe
  C:\Windows\System\GVsuNRO.exe
  2⤵
  PID:10180
- C:\Windows\System\ZyLKyDZ.exe
  C:\Windows\System\ZyLKyDZ.exe
  2⤵
  PID:10196
- C:\Windows\System\hyrKKZT.exe
  C:\Windows\System\hyrKKZT.exe
  2⤵
  PID:10212
- C:\Windows\System\xndXBxI.exe
  C:\Windows\System\xndXBxI.exe
  2⤵
  PID:10228
- C:\Windows\System\YaXGFKe.exe
  C:\Windows\System\YaXGFKe.exe
  2⤵
  PID:9240
- C:\Windows\System\BPqWlrw.exe
  C:\Windows\System\BPqWlrw.exe
  2⤵
  PID:9272
- C:\Windows\System\MurNuSU.exe
  C:\Windows\System\MurNuSU.exe
  2⤵
  PID:8800
- C:\Windows\System\tpgnVjD.exe
  C:\Windows\System\tpgnVjD.exe
  2⤵
  PID:9304
- C:\Windows\System\bKqPcgr.exe
  C:\Windows\System\bKqPcgr.exe
  2⤵
  PID:9292
- C:\Windows\System\UdRtPFO.exe
  C:\Windows\System\UdRtPFO.exe
  2⤵
  PID:9340
- C:\Windows\System\LkwEqbT.exe
  C:\Windows\System\LkwEqbT.exe
  2⤵
  PID:9372
- C:\Windows\System\URIDFkn.exe
  C:\Windows\System\URIDFkn.exe
  2⤵
  PID:9404
- C:\Windows\System\fXxIXji.exe
  C:\Windows\System\fXxIXji.exe
  2⤵
  PID:9420
- C:\Windows\System\ZeVGord.exe
  C:\Windows\System\ZeVGord.exe
  2⤵
  PID:9452
- C:\Windows\System\KiecADP.exe
  C:\Windows\System\KiecADP.exe
  2⤵
  PID:9484
- C:\Windows\System\VHiDMdw.exe
  C:\Windows\System\VHiDMdw.exe
  2⤵
  PID:9512
- C:\Windows\System\GzONfaT.exe
  C:\Windows\System\GzONfaT.exe
  2⤵
  PID:9556
- C:\Windows\System\QHWBkHF.exe
  C:\Windows\System\QHWBkHF.exe
  2⤵
  PID:9580
- C:\Windows\System\JOTHvvs.exe
  C:\Windows\System\JOTHvvs.exe
  2⤵
  PID:9608
- C:\Windows\System\CdDoaHD.exe
  C:\Windows\System\CdDoaHD.exe
  2⤵
  PID:9672
- C:\Windows\System\URHZofz.exe
  C:\Windows\System\URHZofz.exe
  2⤵
  PID:9676
- C:\Windows\System\OCFHyvL.exe
  C:\Windows\System\OCFHyvL.exe
  2⤵
  PID:9692
- C:\Windows\System\zFepFeZ.exe
  C:\Windows\System\zFepFeZ.exe
  2⤵
  PID:9740
- C:\Windows\System\lXprYyD.exe
  C:\Windows\System\lXprYyD.exe
  2⤵
  PID:9772
- C:\Windows\System\tPVjEQj.exe
  C:\Windows\System\tPVjEQj.exe
  2⤵
  PID:9804
- C:\Windows\System\YBeeRHS.exe
  C:\Windows\System\YBeeRHS.exe
  2⤵
  PID:9864
- C:\Windows\System\oLWPNDj.exe
  C:\Windows\System\oLWPNDj.exe
  2⤵
  PID:9816
- C:\Windows\System\CRGHtxE.exe
  C:\Windows\System\CRGHtxE.exe
  2⤵
  PID:9852
- C:\Windows\System\elgaeSJ.exe
  C:\Windows\System\elgaeSJ.exe
  2⤵
  PID:9912
- C:\Windows\System\YMXdsHi.exe
  C:\Windows\System\YMXdsHi.exe
  2⤵
  PID:9976
- C:\Windows\System\RtXWCIX.exe
  C:\Windows\System\RtXWCIX.exe
  2⤵
  PID:10056
- C:\Windows\System\NNzNzpr.exe
  C:\Windows\System\NNzNzpr.exe
  2⤵
  PID:10008
- C:\Windows\System\mJWOZCW.exe
  C:\Windows\System\mJWOZCW.exe
  2⤵
  PID:10092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CpoGGts.exe

Filesize
1.8MB

MD5
58426c175aab98c084028d3d63e03efe

SHA1
671452cda5b703f97461c7a0ac230fc698b5adfa

SHA256
a119da26d75da58662b0028b3613edc181eeacde77802fc91e9a2ebc4d8ead87

SHA512
c387905a1895a0274fabca1b020fcdacd378a20f696a438597809f3b9debfc83dbf4248401c053b2894192f182bd668d5eab137f67c13b2217165e88392234c6

Download Submit
C:\Windows\system\DbIHcyM.exe

Filesize
8B

MD5
20f50227b408431507e9e4298a89a7d5

SHA1
021be5cef03ca413a261257f3fa674d51e4eaecb

SHA256
f053af72ebaae8c20b4aa760dccbaa50d5e8c1b0612207e6dff562e592b0ee16

SHA512
a69e9f155961cdfb2c580f410cf1f9148255cadde0f420c64800ffc84ebbf2c4fc4d8c24eda7cee14ae357ad0398853cbe4f84f9db0bb9573e1f43351f2da9c0

Download Submit
C:\Windows\system\EsEStAS.exe

Filesize
1.8MB

MD5
2b8476d4183fd2e5de0ba97a31b2b94b

SHA1
a9ca73e2ed72e455656dad7f746a2b700fa2e4e9

SHA256
8634c0a9f16d40079a269dc528740f1a3c5d836de577363a7b247c8ca9211632

SHA512
6fde69ee4c0f8178f667ab43e2f18696d849b628e20b7467fdd02601805621780b7197bde155604a1ca248759c0a158a4c232c457d48087207494dc824f1e295

Download Submit
C:\Windows\system\FXlSCpq.exe

Filesize
1.8MB

MD5
1f9a5b5295e08684d6f1c043c618599e

SHA1
e4e098d312f9a000b0f4f1d443c7e31c794265c9

SHA256
e0d29b5c6c7ff52f09db30b6f34c390648dedf8b30c7c60b87fed27ef35a6ef5

SHA512
fe03cbc7cee3a0f87c9d6159b69c289522ab35cc3e6dd24a5cb2a2f93381cfa32fdb704b6d90bee6ba547d618b9a90c6d5b4db6dc5a61f103107e07da9cde1bc

Download Submit
C:\Windows\system\FyPldIr.exe

Filesize
1.8MB

MD5
6867df8e1cb608d6bd67526220a654fb

SHA1
b6830f29f1acbca9e61769943cd16753a724c7f1

SHA256
0a3f53cebac70a7093aab71f3ffe7c0207fae1ac8f21c83b486a41cd1492eb33

SHA512
e9ba57ed96229c3acca361f0c1e8fa51f8c6d5a05a29f7d8c1c5d4621caebdd2bfc94a4adac1b49025871ecaecf4162ac588bb0d4f919e33e737ef0431736127

Download Submit
C:\Windows\system\KhGVnPh.exe

Filesize
1.8MB

MD5
3a0617ba52a8a6d3daff16d75c4c4d3a

SHA1
600b11747abd5130bd623fedbd6aa4081a7b32a1

SHA256
be77aff572c07573ca927983d714348c0b7b504439ca1a0c197235d29aafaaf9

SHA512
4c7b23a0efb78559b827bf5d7ea29abba1d25ec2e32c0cc4b54b0968100bd6f69d8638faaf82921bfb1e88297fcb5b14d07f2863a44fdc34918b17e178b7a6dd

Download Submit
C:\Windows\system\LJSRZFd.exe

Filesize
1.8MB

MD5
ae5e3de789d0d3a620ddfa8d04109fdd

SHA1
b59b687e8c192b0d46c0fda2dd6e7188492b1477

SHA256
957ca4854df40bc33ceb560c6960f96305bfb442f6086fd77a72e53c10a1caa1

SHA512
ac3d198f35c68c77c32fab318ccabb8717102b7413122b3d9b55f37555014e8c2727a95f27c2d46e6618148c022fcac557696583104f1593480a3f11cf1be80c

Download Submit
C:\Windows\system\NPfgjIZ.exe

Filesize
1.8MB

MD5
8fca651be03c947705523cc4bd564871

SHA1
a277b6343110d9f76ae5b80a2c0846942aed553b

SHA256
acec3465589a0feb87c27129e681842ca033651a50dff1d78ce1a5f99aa941b9

SHA512
2d41bd2a0f1f5c980a2cd8393ae6efec2577aec3001e6dc91c387942a1629f2c83f027f52b2efcf9554c0ac9c8401198a47c0aaf7868b5e415d7020905ac3ec3

Download Submit
C:\Windows\system\VFhHzzn.exe

Filesize
1.8MB

MD5
79828335b754e3fabe428422ec26a572

SHA1
4ab9b478c9d06afd4183ae11cce8e8956dba0647

SHA256
dee6273ecc55fe46ac0136ec325eab07528f35567f68ed5fe772a31a13a24f60

SHA512
aa86d911c5c3d137f80a218aab7236a848af5dd8b44b524e40ee35bedcf10278428160b25fc2690aa43c4850cc9230699a7b510654013eb10e7b5a4527939196

Download Submit
C:\Windows\system\VTAEzLL.exe

Filesize
1.8MB

MD5
8825f67fb5fba19bae533d29662df764

SHA1
00f7798eb4b12fabfb6f22217fe0f8c25784857c

SHA256
25baf007325bfe490c444ea358758b37a19edaa0dd4d6a93aff8c098148d4004

SHA512
c35be7218807f8addc58155c954bdf78089a433f1eba5fdcbc4fd87056c5cbaa721e16056b4abdb091839b2f78cb7a60e62dc35f9d94446ee74923cc867246ef

Download Submit
C:\Windows\system\VhgRXAS.exe

Filesize
1.8MB

MD5
80c862efd5e406f3e293c486b59ef4c7

SHA1
7479d64137ad12f6b365fc0f9cc44c255aeb5342

SHA256
60bc1804f47280bb50909f1eb2fa7ddf9f3351521da219f9c9a2dca44cfb57a8

SHA512
411060f63d45e0630e74d9745a99bc8cf08a18465d4592852562ad373d2d41822a1a3a2b3d0977cc032f7af896b7d0ba048c96e212ee91b3aa5c039c66c4190a

Download Submit
C:\Windows\system\XpKdrgD.exe

Filesize
1.8MB

MD5
1e2b3a73c7c20ab9e86b4e955a747e61

SHA1
5e16a9942c0d3b1e4a45ac03b2706f18a79b490a

SHA256
cf99401be6c5cd6f85184bc6dce440215728bd2ec2c6c6f13dd27e088e7d7c95

SHA512
57022fd3645d6da6e5b7b30de1c811ab03b581af7bedbcf6f84cd4d6ebe4e27f6b8e5f4c3dca7f637d8dc06ca6346f26ec403b169954a890dd4d5c66d912af5b

Download Submit
C:\Windows\system\gJgzkzg.exe

Filesize
1.8MB

MD5
3b7a488e35e0712ac8bf0aec7c08859a

SHA1
0abf7c731215d04fbbdfa5696b20b1f4eb32dcd0

SHA256
80d3c26689f692e52a733d7e7810d84170578af301f60a13526b5c13e4bfd0b1

SHA512
dce13961e3a0a19c0190ca448ec3ebea902e1f6205ce5ddc496bcaf5a50e776d5326dc437b51fb73c5ee24c3cc99bbb276de2fb516d5cf3787af1f0a74787972

Download Submit
C:\Windows\system\jXtaOlC.exe

Filesize
1.8MB

MD5
3fdccc6bb427506f1931e1e446097115

SHA1
0ae11bcbe0cf5b9e62b3534db5be5d8bad7eb6da

SHA256
0a4869863bb638fc03984e6eb595e3e7c24455595d71220a34c961b589b9a9c2

SHA512
bfed16793baedc9e06de8e387cafaa8758280d8d4585fd61247dc05b93c37f3b8735f9d3bfe86a11e2dced7b3da036935bdfab257977f46dbfe28860141a21b9

Download Submit
C:\Windows\system\kKyZVes.exe

Filesize
1.8MB

MD5
1878a00d0ded921dec692748ca9ed18f

SHA1
21f244274acc087bef02e70eddddbf12898317da

SHA256
ecc31449920abe6625d50188ef9d8eec1501a08d3eb1fb4ee7685c0b044b0aa3

SHA512
1b9a608f5c9c518178565ba44a7f24f9bc06bcce4bc237c6e385447f3c8f778c4275ae4394122cd57a4976913d092491b20a03836e62fa8e91f09a876358ba4e

Download Submit
C:\Windows\system\kbTyzAG.exe

Filesize
1.8MB

MD5
c1c19001ec1928f4483df3b4c189aba2

SHA1
08f50fadcb9c577f59e9b5a4b6ab5625068fcab3

SHA256
5538013ff3616ee72af0b901f3ecf081c330bdefd6b14dd345d227009c065427

SHA512
f706df8bc37d8ae72502de904866de665c62fe9b17a4294e3949cc7b67730e7d57d8ddf6ead229515a148f7a563bba78730e1048eb546c37484fb161ff45eef4

Download Submit
C:\Windows\system\ktwCVcm.exe

Filesize
1.8MB

MD5
3ccc7b11bda94262abab016bab7d0e32

SHA1
ca1fb22471d845d3071f4a2b8ea5e9c8b3cb31c2

SHA256
af68417983b6e3e5e2e9f4c100a231d9ed64772a991d6eca38ab2076591d3476

SHA512
ed0d1a80715c33062dc914c42109d0cee12e1ee97d2c89d7fd99ea301a969cd374afb84547642ac0dd49dec2ea78cbfa962d07a913ac159127e21cf33e3a262d

Download Submit
C:\Windows\system\ngHqyCy.exe

Filesize
1.8MB

MD5
ba1554fb43eb8febd5bb79627c3c95a8

SHA1
45f3025ec59d494b29fbe9db153e9e3b1d3ddf77

SHA256
86f092d40056f3538d01e6d6cca3d7c2813a696ac87e2517020144ecabb610cd

SHA512
641743d95822f697983e212b5e2c234d77930aaca5845eba66c8d4cef700f8153362a3c7e326fbe2cbb23be95bff0e1545a7c184e8b4e03c9b470188bc00ddc4

Download Submit
C:\Windows\system\tozVzDW.exe

Filesize
1.8MB

MD5
63509b5747036a4be081a0d5ef0056e1

SHA1
73898209d6ede3d38ea7b861100d3df3ca48c407

SHA256
91c99390b6c4cf3f71b84db1984559ea5cea731fdb22b423cce798ba07b8be45

SHA512
07f3fc9008864cbac460fe6a0077b1a0c94588712d2d599a5601d469e586600a52e57d7ab6fcd20f3f815a51759a90e758203ecd76deee4c9641375e0e557994

Download Submit
C:\Windows\system\uSMXUNS.exe

Filesize
1.8MB

MD5
fc8fd1d42b06ed28f32a73e88f441f3e

SHA1
884dc1a70ad27813b4df11a33b71be42162d035a

SHA256
c3f27523866ef5aa9ac1a9bbc91ac47dbf6fc55f220bfaa4abb123d69080d038

SHA512
bd915e05d251f79057a1ba77ab858d094905198e7696fef74dea1a2689891a96e8e2a3972ca82edef6fff5ef020be04cbb302589e2a8e60708284f4b512ed618

Download Submit
C:\Windows\system\ubcEGYC.exe

Filesize
1.8MB

MD5
4ff9352ba9ab3ec329a6bfefcff7bf41

SHA1
ae134a8b8e0b38ae784c8c848ea65282b9360a5c

SHA256
0fb54a7ed669eb4047491cce17e9ffe8a80c63e97818c31547873820f2c60ebe

SHA512
9cdd9845321b76bc993be0d3ba5d8bae56778a11d34a689a575f42b544be06b97a29e6c2c954f047a295845d126f39f4377f3b6b8967b46d946cb831a4eae5b8

Download Submit
C:\Windows\system\usaQnjE.exe

Filesize
1.8MB

MD5
f6fd0d4296e0ab3de3c6355a79853719

SHA1
f86e393c6d87581d3f7f9d2f30e79d45e9cbbe0e

SHA256
b1ca2a9e12fb9b7229e791feee91d0e21d1ee3b1dc53edff9600f2e90a10f489

SHA512
8f8b9fdd8cc057842c16c99d3d66e670a0f97e2a8b5186bc94a7302289004333a6491e9cb3eaf7144bdd50d895e034b59fc10b77767d402307a4274b2fdd78c9

Download Submit
C:\Windows\system\wDUPHbB.exe

Filesize
1.8MB

MD5
aee8ead1c292630ef6347bd3a0dfa937

SHA1
03d696aa2367ae9f76365f6687b5092ff283fc65

SHA256
31e954625ba757a80afd7c1c95894c0bcdc0dfb51561f431b98a1a87d89068a4

SHA512
368a01f418dbf547469acb651877df2b4e527f7f93c1031bb394c23182618b27fa154d81044e70f42c7028f384f03f4858e61f82e2a4d53c218ea3e291fc172e

Download Submit
C:\Windows\system\wjMrIiW.exe

Filesize
1.8MB

MD5
70e7175f76ee2d8a196c5c640cef4d20

SHA1
cf3685e21fd2868239a0b0227c1b344b1612acf1

SHA256
90b8aa59634fd20a438a9fb489916a89dc82b21a5a1f8a459f95641d89b8e70a

SHA512
06a8fe89b5a72e253f0df9d414dd039cf18675ed5df07409e3d85c0647fd17900b02a92128d68da53244a5dfd7b480cdd850018803f4b00f8de2772202f91d6c

Download Submit
C:\Windows\system\xxHMCvI.exe

Filesize
1.8MB

MD5
a6b3d15bdc7b6399392b0f8fd4d27d34

SHA1
ba87bbb9648a354050d8ce2b3b1bb4fa15d8ebb3

SHA256
4ff82312ffd7adaa6df30dfe39d38cc7d3094e9d314ecbd6d057b4618b48670d

SHA512
2b10058dc77f8c267da36c3655a54816d2a090cb99c5629dcf56c865c94b9b0ffcf080c9c0be1e237e12c67d374deebdf9b4e5189dfe05cd759b0b0522f1bdc2

Download Submit
C:\Windows\system\yLeMTOU.exe

Filesize
1.8MB

MD5
7378d86098ecee7b8336cdf981bf81b2

SHA1
cc475c8ab63ce789fda88e658bb10b16e571556e

SHA256
49dc218c1cf8284557399016e220b8004139cdfbaae250ee4fa6ec4c61d46794

SHA512
c00a46bae1e5a7dda6be9b75c62de2e30541891b8b45297abc71b6971db2d8f5ba60fb64d381926a14f730e5b00bce309f86ff689adb0b183dcf15afbfed7e48

Download Submit
C:\Windows\system\yOdubok.exe

Filesize
1.8MB

MD5
ac8d18b4130ce1abf876c4c58fdf0541

SHA1
5044c833e72d9ff28162455b3185b57f6ffce359

SHA256
6df33b0cc3304ed7ebe383a74a301fbebb3398114ebf8e75967606d2f7b91343

SHA512
fed5e06a4029b76c5e0a3c74937c1a2432323886993170163b854571d3043dadfe968abbb322236a73975c31d082f94555afa228555e52eb0e2fbe513b495ab8

Download Submit
\Windows\system\KTLUpdr.exe

Filesize
1.8MB

MD5
a82587f892bb7b65799d933b1f3e288d

SHA1
3564c98cc7e5b91dfbd7cd5a1639ec0b75c78a59

SHA256
fd856ed29d1da3847da0dbc80164cd38cbd750d3fb5487367b6418c47289cbc3

SHA512
11191b9ea97d7159e06be4159384c34783ba83ddca6f3aa8a2dd26972a2c3966c1d3c6220da614aca8568457b1fd0fb8c2aa1c3cd9a1f643f44b9c3c8f91c49d

Download Submit
\Windows\system\NWYYrjy.exe

Filesize
1.8MB

MD5
a822fd9cf7349e73057c842c286f5258

SHA1
f9a1722f80002417038c9603229b1b7313ed256e

SHA256
61846a2cb65088774710c52adba8d17d21913d741a9670fbdfe900a0da991b00

SHA512
a48e720ed2c5fae464e4fc763d50997db897b2c0ef738ebdc476ce71bacb91ff6b5017be5d659ecc7bd909acd896c82099571240227c82ba8aa2eeb996a20f6f

Download Submit
\Windows\system\UUKILHF.exe

Filesize
1.8MB

MD5
f3729133122b4e3f69f0882a0345a3ae

SHA1
457c89d602ec5fd603861a442a3a2d118ccbcd37

SHA256
e6046718a4ee0a8760ad568bb2a59b769d887f4cf16b829aecfb2d5370091ccb

SHA512
c9d36ba4245dccbd041205143f351b69f7d7ab7fef492d03998083de0d373062cee61e89fded25e492fe1c51898644628a3dc3ffa6bbedd3a14d1814d8f5e859

Download Submit
\Windows\system\ZGDywKO.exe

Filesize
1.8MB

MD5
083b905de54471e7ffa98809a96cf64e

SHA1
20c8bb98b194bb3fe5849bc5584954fe9d9a95fe

SHA256
2a5ca0ec4f2de97e7aaa79833a718020f3f4045c342c9d9c67b617fc6226fbbf

SHA512
46b03b6116a2977879848e0f71496607a8ff5dbabf0d1b17d35fb0cef2fbb5d8d41fbb6de31d3a94e1172a0c28c58129680a9ad499259437ed1a745e96a8dae1

Download Submit
\Windows\system\ZuGYGHq.exe

Filesize
1.8MB

MD5
ae671df1f931d74b69abc24492c031a4

SHA1
ef2cce4feed2837e7ab9af7db44405818610b677

SHA256
d369fafad79ca58489b71b332b349aaeb3be6bccd283fc8c4660f46e8e53e552

SHA512
67fd23fc880f305cc4e60fe991791ce4f1874ce2eea89da6156462edced718d9702228879b2257cb5de5b488031bfbd4dec219fa51baf7502a4a21f31edce9dc

Download Submit
\Windows\system\fzuNvsv.exe

Filesize
1.8MB

MD5
60b9926b06b9bf75ba2bec0dfd2de49d

SHA1
225f2624340ec40e51d6b07421407a0ab61919e7

SHA256
78d5c5e1ea1c871022c953cbe194100cfa7e30dfdaa715ace409c13e4ffb1f62

SHA512
d4c97352e44e6f03793af3982047491fdbf74283043166414ce6c7ef323e3c37d196297a159a177682d6d4c025d57229521b08727436b81777520fdaf26b82b4

Download Submit
memory/2308-88-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2308-14-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2308-15-0x000007FEF5ECE000-0x000007FEF5ECF000-memory.dmp

Filesize
4KB

Download
memory/2308-43-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2308-32-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2308-53-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2308-123-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2356-13-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2356-4265-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2484-119-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2484-4429-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2504-120-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2504-4426-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2604-54-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2620-4422-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2620-112-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2624-115-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-4425-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2664-59-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2676-73-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2676-4274-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2728-98-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4431-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2764-100-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2864-124-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2864-116-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2864-72-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2864-99-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-8-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2864-55-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2864-77-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2864-125-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2864-126-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-91-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-13161-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-122-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-12771-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2864-104-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2864-127-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-7358-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2864-2-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2864-12755-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-4428-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2964-96-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download