xmrig | e23d8ca335d0451b7f5bb1dd082fbebc1cd1bdc081d9804dc6148118cfb744ba

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
Size

1.7MB
MD5

39d5bef7bd1d4018dc6f90446198936b
SHA1

1d545ba25fce7d24225aa33ce44a0c0294b0ddb0
SHA256

e23d8ca335d0451b7f5bb1dd082fbebc1cd1bdc081d9804dc6148118cfb744ba
SHA512

cc4fcf2f1a550c838438033708c23a76434cc93836ac4bab8949de9a068d8f9de675d09fcf4f1f7f6e282a9920d508139d128be3778c143591aebe8e328188fa
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFt0:Lz071uv4BPMkibTIA5I4TNrpDGgDQI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-20-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/3052-23-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2604-40-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2332-14-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/3008-57-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2100-61-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2512-66-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2780-73-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2332-62-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2100-83-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2604-93-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2100-95-0x0000000003630000-0x0000000003A22000-memory.dmp	xmrig
behavioral1/memory/2432-97-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2960-88-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2608-334-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2504-82-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2100-1039-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2960-4547-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/3052-4826-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2604-4828-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2608-4827-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2332-4841-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2640-4881-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2780-5537-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2432-6220-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2960-6229-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2100-6569-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2124	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2332	kcMSqyN.exe
2640	bHdYcgv.exe
3052	JFkGyGV.exe
2504	AhXYksM.exe
2604	TVyUtAD.exe
2608	JNAgisA.exe
3008	WDYirFl.exe
2512	BeVnsMn.exe
2780	HtLCZbg.exe
2960	ABgBXaE.exe
2432	ziyfChx.exe
2916	EiVHnjo.exe
1852	URztQUy.exe
1244	UhYRnMY.exe
1092	vKnXfZf.exe
2556	gYzbghF.exe
1768	XrRmOlB.exe
2416	iMYTsPR.exe
1652	wLsHKvQ.exe
1912	gvWiWyw.exe
308	BfgdxOK.exe
2260	exesuWP.exe
2480	WFTkYMA.exe
2868	OYirzCF.exe
1776	UvInxMB.exe
380	vbRqpBb.exe
548	mjRbWDk.exe
692	bSDUThe.exe
816	lGgpWKu.exe
1088	KwEIYkd.exe
1656	nomkaSg.exe
836	EFgwmpk.exe
2196	AzryVCQ.exe
1956	pyexveq.exe
2116	XZUOEFO.exe
1760	JIIVgcv.exe
952	ENbxass.exe
1972	bIBnpaY.exe
1960	lkGhDDT.exe
1944	CWHFMeW.exe
1392	lCCNyQM.exe
560	efKTuIA.exe
2220	lkZmBYV.exe
2580	kjKFhqK.exe
2436	dKJuqrx.exe
2000	mymFqjU.exe
576	SkMlxAm.exe
1500	OvDNLht.exe
2404	BCOoZDG.exe
1620	VjkLDBi.exe
2060	OlZUpuT.exe
2364	bJuMrgQ.exe
1316	MWUFQWS.exe
3020	bSiTwJw.exe
2652	SsvgNcv.exe
2692	PHcHxFh.exe
2188	TdlJzub.exe
3024	IUZmYIk.exe
2712	jddkHTi.exe
2520	qTdIwHM.exe
2708	AMydPXj.exe
2572	uaYtdwn.exe
2752	MdiaNAk.exe
2632	HejQaHV.exe

Loads dropped DLL 64 IoCs

pid	Process
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012286-2.dat	upx
behavioral1/memory/2100-5-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x0038000000015bf4-8.dat	upx
behavioral1/files/0x0007000000015d08-15.dat	upx
behavioral1/memory/2640-20-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/3052-23-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0007000000015d24-32.dat	upx
behavioral1/memory/2504-39-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0007000000015d12-24.dat	upx
behavioral1/files/0x0009000000015d3b-41.dat	upx
behavioral1/memory/2100-42-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2604-40-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2332-14-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x000d00000000549e-53.dat	upx
behavioral1/memory/2608-49-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/3008-57-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x0038000000015cb8-58.dat	upx
behavioral1/memory/2100-61-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x0008000000016581-69.dat	upx
behavioral1/memory/2512-66-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2780-73-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x00060000000165e1-74.dat	upx
behavioral1/memory/2332-62-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x0006000000016835-80.dat	upx
behavioral1/memory/2604-93-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2432-97-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2960-88-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x0006000000016ceb-115.dat	upx
behavioral1/files/0x0006000000016d3b-133.dat	upx
behavioral1/files/0x0006000000016d4b-149.dat	upx
behavioral1/files/0x0006000000016d6f-169.dat	upx
behavioral1/files/0x0006000000016ddc-194.dat	upx
behavioral1/memory/2608-334-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0006000000016dba-192.dat	upx
behavioral1/files/0x0006000000016dd1-188.dat	upx
behavioral1/files/0x0006000000016d8b-175.dat	upx
behavioral1/files/0x0006000000016dc8-186.dat	upx
behavioral1/files/0x0006000000016d9f-178.dat	upx
behavioral1/files/0x0006000000016d68-164.dat	upx
behavioral1/files/0x0006000000016d5f-151.dat	upx
behavioral1/files/0x0006000000016d64-157.dat	upx
behavioral1/files/0x0006000000016d43-144.dat	upx
behavioral1/files/0x0006000000016d32-128.dat	upx
behavioral1/files/0x0006000000016cc1-122.dat	upx
behavioral1/files/0x0006000000016d17-119.dat	upx
behavioral1/files/0x0006000000016d2a-127.dat	upx
behavioral1/files/0x0006000000016c78-109.dat	upx
behavioral1/files/0x0006000000016c6f-104.dat	upx
behavioral1/files/0x0006000000016a8a-85.dat	upx
behavioral1/files/0x0006000000016c52-94.dat	upx
behavioral1/memory/2504-82-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2960-4547-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/3052-4826-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2604-4828-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2608-4827-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2332-4841-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2640-4881-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2780-5537-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2432-6220-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2960-6229-0x000000013F740000-0x000000013FB32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fTbpkhQ.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\lJITnuI.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\LLGsbZr.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\myXrFOx.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\EIlCCmw.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\ztJehCo.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\wRfJnXd.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\UWPuasZ.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\Egdiwur.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\ipWhIYs.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\GykKtQH.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\ipmHtNY.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\DcTrxQz.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\oaCGWpq.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\pVbBbBI.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\KilUjDE.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\pzPGbxi.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\UxlHNHG.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\kYYzuwR.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\pcOIDkm.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\DlhqciG.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\icyzzMx.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\eNecCqu.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\vMsNXND.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\LSJSyzQ.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\mGfwSxK.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\QPwmXtj.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\AAEnPnq.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\tPuClir.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\HWvOpiC.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\czQbAle.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\DdkcwwX.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\VCGLiIz.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\XZTIzek.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\khkbBYM.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\iPohQde.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\iixxVHW.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\YTMjWqP.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\CbevaEf.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\NIKyqkb.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\DlHxZLy.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\LyGSUuc.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\pUsBfRV.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\XmcMYLl.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\rcqAIuN.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\IPQyJDr.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\QdYsist.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\cJjmEAl.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\NfAVhJj.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\KkCFdVI.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\oMclkTL.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\dmopYBM.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\lZhSAjD.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\ldQHHiC.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\nGYYcch.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\fzFwxMa.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\IfNUGcF.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\TufxyRz.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\JvCLpbU.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\HQXOgxd.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\XbZqwLa.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\ntAHgwH.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\zjqLPVQ.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
File created	C:\Windows\System\hTJXWmQ.exe	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2124	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
Token: SeDebugPrivilege	2124	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2124	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	29
PID 2100 wrote to memory of 2124	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	29
PID 2100 wrote to memory of 2124	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	29
PID 2100 wrote to memory of 2332	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2332	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	30
PID 2100 wrote to memory of 2332	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	30
PID 2100 wrote to memory of 3052	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	31
PID 2100 wrote to memory of 3052	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	31
PID 2100 wrote to memory of 3052	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	31
PID 2100 wrote to memory of 2640	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	32
PID 2100 wrote to memory of 2640	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	32
PID 2100 wrote to memory of 2640	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	32
PID 2100 wrote to memory of 2604	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	33
PID 2100 wrote to memory of 2604	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	33
PID 2100 wrote to memory of 2604	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	33
PID 2100 wrote to memory of 2504	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	34
PID 2100 wrote to memory of 2504	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	34
PID 2100 wrote to memory of 2504	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	34
PID 2100 wrote to memory of 2608	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	35
PID 2100 wrote to memory of 2608	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	35
PID 2100 wrote to memory of 2608	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	35
PID 2100 wrote to memory of 3008	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	36
PID 2100 wrote to memory of 3008	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	36
PID 2100 wrote to memory of 3008	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	36
PID 2100 wrote to memory of 2512	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	37
PID 2100 wrote to memory of 2512	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	37
PID 2100 wrote to memory of 2512	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	37
PID 2100 wrote to memory of 2780	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	38
PID 2100 wrote to memory of 2780	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	38
PID 2100 wrote to memory of 2780	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	38
PID 2100 wrote to memory of 2916	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	39
PID 2100 wrote to memory of 2916	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	39
PID 2100 wrote to memory of 2916	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	39
PID 2100 wrote to memory of 2960	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	40
PID 2100 wrote to memory of 2960	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	40
PID 2100 wrote to memory of 2960	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	40
PID 2100 wrote to memory of 1852	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	41
PID 2100 wrote to memory of 1852	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	41
PID 2100 wrote to memory of 1852	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	41
PID 2100 wrote to memory of 2432	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	42
PID 2100 wrote to memory of 2432	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	42
PID 2100 wrote to memory of 2432	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	42
PID 2100 wrote to memory of 1244	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	43
PID 2100 wrote to memory of 1244	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	43
PID 2100 wrote to memory of 1244	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	43
PID 2100 wrote to memory of 1092	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	44
PID 2100 wrote to memory of 1092	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	44
PID 2100 wrote to memory of 1092	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	44
PID 2100 wrote to memory of 1768	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	45
PID 2100 wrote to memory of 1768	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	45
PID 2100 wrote to memory of 1768	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	45
PID 2100 wrote to memory of 2556	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	46
PID 2100 wrote to memory of 2556	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	46
PID 2100 wrote to memory of 2556	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	46
PID 2100 wrote to memory of 1912	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	47
PID 2100 wrote to memory of 1912	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	47
PID 2100 wrote to memory of 1912	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	47
PID 2100 wrote to memory of 2416	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	48
PID 2100 wrote to memory of 2416	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	48
PID 2100 wrote to memory of 2416	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	48
PID 2100 wrote to memory of 308	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	49
PID 2100 wrote to memory of 308	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	49
PID 2100 wrote to memory of 308	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	49
PID 2100 wrote to memory of 1652	2100	39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\39d5bef7bd1d4018dc6f90446198936b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\System\kcMSqyN.exe
  C:\Windows\System\kcMSqyN.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\JFkGyGV.exe
  C:\Windows\System\JFkGyGV.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\bHdYcgv.exe
  C:\Windows\System\bHdYcgv.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\TVyUtAD.exe
  C:\Windows\System\TVyUtAD.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\AhXYksM.exe
  C:\Windows\System\AhXYksM.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\JNAgisA.exe
  C:\Windows\System\JNAgisA.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\WDYirFl.exe
  C:\Windows\System\WDYirFl.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\BeVnsMn.exe
  C:\Windows\System\BeVnsMn.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\HtLCZbg.exe
  C:\Windows\System\HtLCZbg.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\EiVHnjo.exe
  C:\Windows\System\EiVHnjo.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ABgBXaE.exe
  C:\Windows\System\ABgBXaE.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\URztQUy.exe
  C:\Windows\System\URztQUy.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\ziyfChx.exe
  C:\Windows\System\ziyfChx.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\UhYRnMY.exe
  C:\Windows\System\UhYRnMY.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\vKnXfZf.exe
  C:\Windows\System\vKnXfZf.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\XrRmOlB.exe
  C:\Windows\System\XrRmOlB.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\gYzbghF.exe
  C:\Windows\System\gYzbghF.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\gvWiWyw.exe
  C:\Windows\System\gvWiWyw.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\iMYTsPR.exe
  C:\Windows\System\iMYTsPR.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\BfgdxOK.exe
  C:\Windows\System\BfgdxOK.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\wLsHKvQ.exe
  C:\Windows\System\wLsHKvQ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\exesuWP.exe
  C:\Windows\System\exesuWP.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\WFTkYMA.exe
  C:\Windows\System\WFTkYMA.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\UvInxMB.exe
  C:\Windows\System\UvInxMB.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\OYirzCF.exe
  C:\Windows\System\OYirzCF.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\vbRqpBb.exe
  C:\Windows\System\vbRqpBb.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\mjRbWDk.exe
  C:\Windows\System\mjRbWDk.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\bSDUThe.exe
  C:\Windows\System\bSDUThe.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\lGgpWKu.exe
  C:\Windows\System\lGgpWKu.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\nomkaSg.exe
  C:\Windows\System\nomkaSg.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\KwEIYkd.exe
  C:\Windows\System\KwEIYkd.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\pyexveq.exe
  C:\Windows\System\pyexveq.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\EFgwmpk.exe
  C:\Windows\System\EFgwmpk.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\XZUOEFO.exe
  C:\Windows\System\XZUOEFO.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\AzryVCQ.exe
  C:\Windows\System\AzryVCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\JIIVgcv.exe
  C:\Windows\System\JIIVgcv.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ENbxass.exe
  C:\Windows\System\ENbxass.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\bIBnpaY.exe
  C:\Windows\System\bIBnpaY.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\lkGhDDT.exe
  C:\Windows\System\lkGhDDT.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\CWHFMeW.exe
  C:\Windows\System\CWHFMeW.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\lCCNyQM.exe
  C:\Windows\System\lCCNyQM.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\efKTuIA.exe
  C:\Windows\System\efKTuIA.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\lkZmBYV.exe
  C:\Windows\System\lkZmBYV.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\dKJuqrx.exe
  C:\Windows\System\dKJuqrx.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\kjKFhqK.exe
  C:\Windows\System\kjKFhqK.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\SkMlxAm.exe
  C:\Windows\System\SkMlxAm.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\mymFqjU.exe
  C:\Windows\System\mymFqjU.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\BCOoZDG.exe
  C:\Windows\System\BCOoZDG.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\OvDNLht.exe
  C:\Windows\System\OvDNLht.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\VjkLDBi.exe
  C:\Windows\System\VjkLDBi.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\OlZUpuT.exe
  C:\Windows\System\OlZUpuT.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\bJuMrgQ.exe
  C:\Windows\System\bJuMrgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\MWUFQWS.exe
  C:\Windows\System\MWUFQWS.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\bSiTwJw.exe
  C:\Windows\System\bSiTwJw.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\SsvgNcv.exe
  C:\Windows\System\SsvgNcv.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\PHcHxFh.exe
  C:\Windows\System\PHcHxFh.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\TdlJzub.exe
  C:\Windows\System\TdlJzub.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\IUZmYIk.exe
  C:\Windows\System\IUZmYIk.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\jddkHTi.exe
  C:\Windows\System\jddkHTi.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\qTdIwHM.exe
  C:\Windows\System\qTdIwHM.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\AMydPXj.exe
  C:\Windows\System\AMydPXj.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\uaYtdwn.exe
  C:\Windows\System\uaYtdwn.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\MdiaNAk.exe
  C:\Windows\System\MdiaNAk.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\HejQaHV.exe
  C:\Windows\System\HejQaHV.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hGljVaM.exe
  C:\Windows\System\hGljVaM.exe
  2⤵
  PID:2980
- C:\Windows\System\HiVeJFh.exe
  C:\Windows\System\HiVeJFh.exe
  2⤵
  PID:2672
- C:\Windows\System\CVehVmP.exe
  C:\Windows\System\CVehVmP.exe
  2⤵
  PID:2664
- C:\Windows\System\dUKZADk.exe
  C:\Windows\System\dUKZADk.exe
  2⤵
  PID:328
- C:\Windows\System\tqIGVEp.exe
  C:\Windows\System\tqIGVEp.exe
  2⤵
  PID:2040
- C:\Windows\System\KDuorzV.exe
  C:\Windows\System\KDuorzV.exe
  2⤵
  PID:2936
- C:\Windows\System\YATsUHC.exe
  C:\Windows\System\YATsUHC.exe
  2⤵
  PID:2012
- C:\Windows\System\rqbWdHp.exe
  C:\Windows\System\rqbWdHp.exe
  2⤵
  PID:812
- C:\Windows\System\OlKTyUu.exe
  C:\Windows\System\OlKTyUu.exe
  2⤵
  PID:2228
- C:\Windows\System\cMuTgKH.exe
  C:\Windows\System\cMuTgKH.exe
  2⤵
  PID:1272
- C:\Windows\System\UkGCckv.exe
  C:\Windows\System\UkGCckv.exe
  2⤵
  PID:808
- C:\Windows\System\vqupSsI.exe
  C:\Windows\System\vqupSsI.exe
  2⤵
  PID:2800
- C:\Windows\System\HWgEWzo.exe
  C:\Windows\System\HWgEWzo.exe
  2⤵
  PID:2264
- C:\Windows\System\bcSXizL.exe
  C:\Windows\System\bcSXizL.exe
  2⤵
  PID:2232
- C:\Windows\System\xXOKoKl.exe
  C:\Windows\System\xXOKoKl.exe
  2⤵
  PID:304
- C:\Windows\System\LpODqCi.exe
  C:\Windows\System\LpODqCi.exe
  2⤵
  PID:792
- C:\Windows\System\EPuDKAB.exe
  C:\Windows\System\EPuDKAB.exe
  2⤵
  PID:1516
- C:\Windows\System\lvKPMvT.exe
  C:\Windows\System\lvKPMvT.exe
  2⤵
  PID:448
- C:\Windows\System\aHOMmVq.exe
  C:\Windows\System\aHOMmVq.exe
  2⤵
  PID:1736
- C:\Windows\System\EdTbxnS.exe
  C:\Windows\System\EdTbxnS.exe
  2⤵
  PID:1640
- C:\Windows\System\XBKJxLi.exe
  C:\Windows\System\XBKJxLi.exe
  2⤵
  PID:1592
- C:\Windows\System\WoUPSsB.exe
  C:\Windows\System\WoUPSsB.exe
  2⤵
  PID:2896
- C:\Windows\System\YwpeNGk.exe
  C:\Windows\System\YwpeNGk.exe
  2⤵
  PID:2576
- C:\Windows\System\BeYnywu.exe
  C:\Windows\System\BeYnywu.exe
  2⤵
  PID:912
- C:\Windows\System\gZLrMzu.exe
  C:\Windows\System\gZLrMzu.exe
  2⤵
  PID:848
- C:\Windows\System\byBxfXC.exe
  C:\Windows\System\byBxfXC.exe
  2⤵
  PID:2900
- C:\Windows\System\WuTGncX.exe
  C:\Windows\System\WuTGncX.exe
  2⤵
  PID:1664
- C:\Windows\System\MRJfZhD.exe
  C:\Windows\System\MRJfZhD.exe
  2⤵
  PID:1732
- C:\Windows\System\AuDcFKv.exe
  C:\Windows\System\AuDcFKv.exe
  2⤵
  PID:2004
- C:\Windows\System\pqaKpya.exe
  C:\Windows\System\pqaKpya.exe
  2⤵
  PID:2988
- C:\Windows\System\byluUBZ.exe
  C:\Windows\System\byluUBZ.exe
  2⤵
  PID:2968
- C:\Windows\System\nrMWlAQ.exe
  C:\Windows\System\nrMWlAQ.exe
  2⤵
  PID:2764
- C:\Windows\System\wyXBFpg.exe
  C:\Windows\System\wyXBFpg.exe
  2⤵
  PID:3044
- C:\Windows\System\NnwCUdm.exe
  C:\Windows\System\NnwCUdm.exe
  2⤵
  PID:2600
- C:\Windows\System\nZOILiw.exe
  C:\Windows\System\nZOILiw.exe
  2⤵
  PID:2648
- C:\Windows\System\fntuioB.exe
  C:\Windows\System\fntuioB.exe
  2⤵
  PID:2736
- C:\Windows\System\XQoeFnS.exe
  C:\Windows\System\XQoeFnS.exe
  2⤵
  PID:1996
- C:\Windows\System\rCjfven.exe
  C:\Windows\System\rCjfven.exe
  2⤵
  PID:2904
- C:\Windows\System\YnhRWQs.exe
  C:\Windows\System\YnhRWQs.exe
  2⤵
  PID:2568
- C:\Windows\System\suHRXqc.exe
  C:\Windows\System\suHRXqc.exe
  2⤵
  PID:1820
- C:\Windows\System\xwsHBYm.exe
  C:\Windows\System\xwsHBYm.exe
  2⤵
  PID:2308
- C:\Windows\System\kBguufg.exe
  C:\Windows\System\kBguufg.exe
  2⤵
  PID:544
- C:\Windows\System\zFIZQVW.exe
  C:\Windows\System\zFIZQVW.exe
  2⤵
  PID:884
- C:\Windows\System\YMvMPSr.exe
  C:\Windows\System\YMvMPSr.exe
  2⤵
  PID:2284
- C:\Windows\System\EkuUFec.exe
  C:\Windows\System\EkuUFec.exe
  2⤵
  PID:2172
- C:\Windows\System\teZFqCm.exe
  C:\Windows\System\teZFqCm.exe
  2⤵
  PID:2120
- C:\Windows\System\YWiQmVV.exe
  C:\Windows\System\YWiQmVV.exe
  2⤵
  PID:988
- C:\Windows\System\zIgffng.exe
  C:\Windows\System\zIgffng.exe
  2⤵
  PID:1856
- C:\Windows\System\EFPdEMg.exe
  C:\Windows\System\EFPdEMg.exe
  2⤵
  PID:844
- C:\Windows\System\ZoKxOwc.exe
  C:\Windows\System\ZoKxOwc.exe
  2⤵
  PID:2032
- C:\Windows\System\OhZFgKU.exe
  C:\Windows\System\OhZFgKU.exe
  2⤵
  PID:1964
- C:\Windows\System\EXfqWlH.exe
  C:\Windows\System\EXfqWlH.exe
  2⤵
  PID:1028
- C:\Windows\System\tsCPhyB.exe
  C:\Windows\System\tsCPhyB.exe
  2⤵
  PID:2296
- C:\Windows\System\uJuuQAl.exe
  C:\Windows\System\uJuuQAl.exe
  2⤵
  PID:1492
- C:\Windows\System\wtlYfJX.exe
  C:\Windows\System\wtlYfJX.exe
  2⤵
  PID:2140
- C:\Windows\System\lrOILLR.exe
  C:\Windows\System\lrOILLR.exe
  2⤵
  PID:2312
- C:\Windows\System\GYuzSqd.exe
  C:\Windows\System\GYuzSqd.exe
  2⤵
  PID:2732
- C:\Windows\System\eNtzoeL.exe
  C:\Windows\System\eNtzoeL.exe
  2⤵
  PID:2824
- C:\Windows\System\wDrOrvT.exe
  C:\Windows\System\wDrOrvT.exe
  2⤵
  PID:2804
- C:\Windows\System\FLGmNKR.exe
  C:\Windows\System\FLGmNKR.exe
  2⤵
  PID:2656
- C:\Windows\System\vMsNXND.exe
  C:\Windows\System\vMsNXND.exe
  2⤵
  PID:1924
- C:\Windows\System\QhcBtKe.exe
  C:\Windows\System\QhcBtKe.exe
  2⤵
  PID:564
- C:\Windows\System\jioAIRH.exe
  C:\Windows\System\jioAIRH.exe
  2⤵
  PID:1556
- C:\Windows\System\vVRUjQo.exe
  C:\Windows\System\vVRUjQo.exe
  2⤵
  PID:852
- C:\Windows\System\kTRtnbO.exe
  C:\Windows\System\kTRtnbO.exe
  2⤵
  PID:1292
- C:\Windows\System\RlLHlHE.exe
  C:\Windows\System\RlLHlHE.exe
  2⤵
  PID:1364
- C:\Windows\System\KckTnHq.exe
  C:\Windows\System\KckTnHq.exe
  2⤵
  PID:352
- C:\Windows\System\WGsSmXB.exe
  C:\Windows\System\WGsSmXB.exe
  2⤵
  PID:1444
- C:\Windows\System\SXFazab.exe
  C:\Windows\System\SXFazab.exe
  2⤵
  PID:2888
- C:\Windows\System\SZBosLq.exe
  C:\Windows\System\SZBosLq.exe
  2⤵
  PID:3000
- C:\Windows\System\UYuSMmj.exe
  C:\Windows\System\UYuSMmj.exe
  2⤵
  PID:2884
- C:\Windows\System\NXRWZYy.exe
  C:\Windows\System\NXRWZYy.exe
  2⤵
  PID:2636
- C:\Windows\System\yEPbaDY.exe
  C:\Windows\System\yEPbaDY.exe
  2⤵
  PID:2208
- C:\Windows\System\oYIWXdb.exe
  C:\Windows\System\oYIWXdb.exe
  2⤵
  PID:1804
- C:\Windows\System\mHGpyWW.exe
  C:\Windows\System\mHGpyWW.exe
  2⤵
  PID:2864
- C:\Windows\System\CGPIsRe.exe
  C:\Windows\System\CGPIsRe.exe
  2⤵
  PID:2704
- C:\Windows\System\aYFvLxp.exe
  C:\Windows\System\aYFvLxp.exe
  2⤵
  PID:1676
- C:\Windows\System\TjmuMkr.exe
  C:\Windows\System\TjmuMkr.exe
  2⤵
  PID:1128
- C:\Windows\System\ZfQCZdk.exe
  C:\Windows\System\ZfQCZdk.exe
  2⤵
  PID:376
- C:\Windows\System\bxrJjVk.exe
  C:\Windows\System\bxrJjVk.exe
  2⤵
  PID:2080
- C:\Windows\System\YVnwntW.exe
  C:\Windows\System\YVnwntW.exe
  2⤵
  PID:2564
- C:\Windows\System\elqysXp.exe
  C:\Windows\System\elqysXp.exe
  2⤵
  PID:2456
- C:\Windows\System\SvICyOB.exe
  C:\Windows\System\SvICyOB.exe
  2⤵
  PID:640
- C:\Windows\System\hSRVMcD.exe
  C:\Windows\System\hSRVMcD.exe
  2⤵
  PID:588
- C:\Windows\System\CFJKZaW.exe
  C:\Windows\System\CFJKZaW.exe
  2⤵
  PID:596
- C:\Windows\System\cnGCeAM.exe
  C:\Windows\System\cnGCeAM.exe
  2⤵
  PID:1480
- C:\Windows\System\TGWgFCg.exe
  C:\Windows\System\TGWgFCg.exe
  2⤵
  PID:2180
- C:\Windows\System\iixxVHW.exe
  C:\Windows\System\iixxVHW.exe
  2⤵
  PID:1728
- C:\Windows\System\kyTAZWY.exe
  C:\Windows\System\kyTAZWY.exe
  2⤵
  PID:1176
- C:\Windows\System\rmqZKVO.exe
  C:\Windows\System\rmqZKVO.exe
  2⤵
  PID:2760
- C:\Windows\System\QahUCoF.exe
  C:\Windows\System\QahUCoF.exe
  2⤵
  PID:1596
- C:\Windows\System\HHMXfmV.exe
  C:\Windows\System\HHMXfmV.exe
  2⤵
  PID:1152
- C:\Windows\System\ivvVteL.exe
  C:\Windows\System\ivvVteL.exe
  2⤵
  PID:2016
- C:\Windows\System\YbZRvPh.exe
  C:\Windows\System\YbZRvPh.exe
  2⤵
  PID:2212
- C:\Windows\System\RbgdPnn.exe
  C:\Windows\System\RbgdPnn.exe
  2⤵
  PID:1416
- C:\Windows\System\RduVxcA.exe
  C:\Windows\System\RduVxcA.exe
  2⤵
  PID:1860
- C:\Windows\System\RjUWjnC.exe
  C:\Windows\System\RjUWjnC.exe
  2⤵
  PID:1668
- C:\Windows\System\GWIBBdc.exe
  C:\Windows\System\GWIBBdc.exe
  2⤵
  PID:1220
- C:\Windows\System\uBvoqVm.exe
  C:\Windows\System\uBvoqVm.exe
  2⤵
  PID:1988
- C:\Windows\System\mNwDYsx.exe
  C:\Windows\System\mNwDYsx.exe
  2⤵
  PID:2484
- C:\Windows\System\eEyFile.exe
  C:\Windows\System\eEyFile.exe
  2⤵
  PID:2252
- C:\Windows\System\loMHsTi.exe
  C:\Windows\System\loMHsTi.exe
  2⤵
  PID:2108
- C:\Windows\System\BEKNwFe.exe
  C:\Windows\System\BEKNwFe.exe
  2⤵
  PID:1052
- C:\Windows\System\SofzHxo.exe
  C:\Windows\System\SofzHxo.exe
  2⤵
  PID:1504
- C:\Windows\System\isEuTVB.exe
  C:\Windows\System\isEuTVB.exe
  2⤵
  PID:2928
- C:\Windows\System\eLaDcdG.exe
  C:\Windows\System\eLaDcdG.exe
  2⤵
  PID:1040
- C:\Windows\System\vvrPVKO.exe
  C:\Windows\System\vvrPVKO.exe
  2⤵
  PID:1848
- C:\Windows\System\xinWDxi.exe
  C:\Windows\System\xinWDxi.exe
  2⤵
  PID:1784
- C:\Windows\System\jyuwXNt.exe
  C:\Windows\System\jyuwXNt.exe
  2⤵
  PID:1524
- C:\Windows\System\aaJZCBS.exe
  C:\Windows\System\aaJZCBS.exe
  2⤵
  PID:2392
- C:\Windows\System\iSlzbYn.exe
  C:\Windows\System\iSlzbYn.exe
  2⤵
  PID:3040
- C:\Windows\System\pStxLqM.exe
  C:\Windows\System\pStxLqM.exe
  2⤵
  PID:1548
- C:\Windows\System\kamyqhH.exe
  C:\Windows\System\kamyqhH.exe
  2⤵
  PID:2036
- C:\Windows\System\mPgBnVh.exe
  C:\Windows\System\mPgBnVh.exe
  2⤵
  PID:2788
- C:\Windows\System\KBeRJMn.exe
  C:\Windows\System\KBeRJMn.exe
  2⤵
  PID:1628
- C:\Windows\System\YHuUtnm.exe
  C:\Windows\System\YHuUtnm.exe
  2⤵
  PID:1836
- C:\Windows\System\umFbIVO.exe
  C:\Windows\System\umFbIVO.exe
  2⤵
  PID:2044
- C:\Windows\System\aLlOocv.exe
  C:\Windows\System\aLlOocv.exe
  2⤵
  PID:1936
- C:\Windows\System\ZotoJOg.exe
  C:\Windows\System\ZotoJOg.exe
  2⤵
  PID:2544
- C:\Windows\System\aQdPKIA.exe
  C:\Windows\System\aQdPKIA.exe
  2⤵
  PID:2776
- C:\Windows\System\LLBakcX.exe
  C:\Windows\System\LLBakcX.exe
  2⤵
  PID:1900
- C:\Windows\System\ksjzCXN.exe
  C:\Windows\System\ksjzCXN.exe
  2⤵
  PID:2428
- C:\Windows\System\ghSHFPC.exe
  C:\Windows\System\ghSHFPC.exe
  2⤵
  PID:1156
- C:\Windows\System\lHlAZCP.exe
  C:\Windows\System\lHlAZCP.exe
  2⤵
  PID:3104
- C:\Windows\System\xlSzkez.exe
  C:\Windows\System\xlSzkez.exe
  2⤵
  PID:3120
- C:\Windows\System\pMeuZht.exe
  C:\Windows\System\pMeuZht.exe
  2⤵
  PID:3144
- C:\Windows\System\JTJrkrb.exe
  C:\Windows\System\JTJrkrb.exe
  2⤵
  PID:3160
- C:\Windows\System\vSUuVQa.exe
  C:\Windows\System\vSUuVQa.exe
  2⤵
  PID:3184
- C:\Windows\System\UHvmxBO.exe
  C:\Windows\System\UHvmxBO.exe
  2⤵
  PID:3200
- C:\Windows\System\iNWvkkS.exe
  C:\Windows\System\iNWvkkS.exe
  2⤵
  PID:3220
- C:\Windows\System\JkqAALM.exe
  C:\Windows\System\JkqAALM.exe
  2⤵
  PID:3240
- C:\Windows\System\sIBvIkq.exe
  C:\Windows\System\sIBvIkq.exe
  2⤵
  PID:3256
- C:\Windows\System\CCDwuUh.exe
  C:\Windows\System\CCDwuUh.exe
  2⤵
  PID:3272
- C:\Windows\System\SyoYpJb.exe
  C:\Windows\System\SyoYpJb.exe
  2⤵
  PID:3288
- C:\Windows\System\eDiAVSp.exe
  C:\Windows\System\eDiAVSp.exe
  2⤵
  PID:3304
- C:\Windows\System\LdUNqZi.exe
  C:\Windows\System\LdUNqZi.exe
  2⤵
  PID:3320
- C:\Windows\System\tqbQHHw.exe
  C:\Windows\System\tqbQHHw.exe
  2⤵
  PID:3336
- C:\Windows\System\ftGSsXP.exe
  C:\Windows\System\ftGSsXP.exe
  2⤵
  PID:3352
- C:\Windows\System\pAdRiqf.exe
  C:\Windows\System\pAdRiqf.exe
  2⤵
  PID:3368
- C:\Windows\System\gJfoGTt.exe
  C:\Windows\System\gJfoGTt.exe
  2⤵
  PID:3384
- C:\Windows\System\WnQZVCl.exe
  C:\Windows\System\WnQZVCl.exe
  2⤵
  PID:3400
- C:\Windows\System\IeZwWmL.exe
  C:\Windows\System\IeZwWmL.exe
  2⤵
  PID:3416
- C:\Windows\System\rLEFRws.exe
  C:\Windows\System\rLEFRws.exe
  2⤵
  PID:3432
- C:\Windows\System\KLGOOMW.exe
  C:\Windows\System\KLGOOMW.exe
  2⤵
  PID:3448
- C:\Windows\System\TVbEwiE.exe
  C:\Windows\System\TVbEwiE.exe
  2⤵
  PID:3464
- C:\Windows\System\OwGHuKB.exe
  C:\Windows\System\OwGHuKB.exe
  2⤵
  PID:3480
- C:\Windows\System\KkHCcyf.exe
  C:\Windows\System\KkHCcyf.exe
  2⤵
  PID:3496
- C:\Windows\System\rrmrXDx.exe
  C:\Windows\System\rrmrXDx.exe
  2⤵
  PID:3512
- C:\Windows\System\QXYVjNF.exe
  C:\Windows\System\QXYVjNF.exe
  2⤵
  PID:3528
- C:\Windows\System\LhWVKkg.exe
  C:\Windows\System\LhWVKkg.exe
  2⤵
  PID:3544
- C:\Windows\System\QvWDtep.exe
  C:\Windows\System\QvWDtep.exe
  2⤵
  PID:3560
- C:\Windows\System\vYGWWVd.exe
  C:\Windows\System\vYGWWVd.exe
  2⤵
  PID:3576
- C:\Windows\System\qKmNZqi.exe
  C:\Windows\System\qKmNZqi.exe
  2⤵
  PID:3668
- C:\Windows\System\WnfcDhp.exe
  C:\Windows\System\WnfcDhp.exe
  2⤵
  PID:3684
- C:\Windows\System\XjkLfjC.exe
  C:\Windows\System\XjkLfjC.exe
  2⤵
  PID:3700
- C:\Windows\System\kQbHtpT.exe
  C:\Windows\System\kQbHtpT.exe
  2⤵
  PID:3716
- C:\Windows\System\QNYcjoa.exe
  C:\Windows\System\QNYcjoa.exe
  2⤵
  PID:3732
- C:\Windows\System\STjvxtp.exe
  C:\Windows\System\STjvxtp.exe
  2⤵
  PID:3748
- C:\Windows\System\pHuLqaB.exe
  C:\Windows\System\pHuLqaB.exe
  2⤵
  PID:3768
- C:\Windows\System\SpmfbIX.exe
  C:\Windows\System\SpmfbIX.exe
  2⤵
  PID:3784
- C:\Windows\System\EHzQlaE.exe
  C:\Windows\System\EHzQlaE.exe
  2⤵
  PID:3800
- C:\Windows\System\vqlGEwV.exe
  C:\Windows\System\vqlGEwV.exe
  2⤵
  PID:3816
- C:\Windows\System\VJfyHbX.exe
  C:\Windows\System\VJfyHbX.exe
  2⤵
  PID:3832
- C:\Windows\System\LGSIaCV.exe
  C:\Windows\System\LGSIaCV.exe
  2⤵
  PID:3848
- C:\Windows\System\AKQjoSk.exe
  C:\Windows\System\AKQjoSk.exe
  2⤵
  PID:3864
- C:\Windows\System\tQIbsxS.exe
  C:\Windows\System\tQIbsxS.exe
  2⤵
  PID:3884
- C:\Windows\System\bhCVSII.exe
  C:\Windows\System\bhCVSII.exe
  2⤵
  PID:3900
- C:\Windows\System\QbYGhTP.exe
  C:\Windows\System\QbYGhTP.exe
  2⤵
  PID:3916
- C:\Windows\System\NkEpNzt.exe
  C:\Windows\System\NkEpNzt.exe
  2⤵
  PID:3932
- C:\Windows\System\vnBCvbj.exe
  C:\Windows\System\vnBCvbj.exe
  2⤵
  PID:3948
- C:\Windows\System\gPYXUmh.exe
  C:\Windows\System\gPYXUmh.exe
  2⤵
  PID:3964
- C:\Windows\System\fTqMOGx.exe
  C:\Windows\System\fTqMOGx.exe
  2⤵
  PID:3980
- C:\Windows\System\eBDCerI.exe
  C:\Windows\System\eBDCerI.exe
  2⤵
  PID:3996
- C:\Windows\System\paruhdG.exe
  C:\Windows\System\paruhdG.exe
  2⤵
  PID:4012
- C:\Windows\System\XRXLLMp.exe
  C:\Windows\System\XRXLLMp.exe
  2⤵
  PID:4028
- C:\Windows\System\CCEhBQu.exe
  C:\Windows\System\CCEhBQu.exe
  2⤵
  PID:4044
- C:\Windows\System\RHbiWIM.exe
  C:\Windows\System\RHbiWIM.exe
  2⤵
  PID:4060
- C:\Windows\System\iWbERql.exe
  C:\Windows\System\iWbERql.exe
  2⤵
  PID:4076
- C:\Windows\System\STXyDyA.exe
  C:\Windows\System\STXyDyA.exe
  2⤵
  PID:4092
- C:\Windows\System\RDEKUGn.exe
  C:\Windows\System\RDEKUGn.exe
  2⤵
  PID:2448
- C:\Windows\System\OClRBfX.exe
  C:\Windows\System\OClRBfX.exe
  2⤵
  PID:2700
- C:\Windows\System\gYWVEpk.exe
  C:\Windows\System\gYWVEpk.exe
  2⤵
  PID:3096
- C:\Windows\System\HHMgntd.exe
  C:\Windows\System\HHMgntd.exe
  2⤵
  PID:3112
- C:\Windows\System\OyglHwq.exe
  C:\Windows\System\OyglHwq.exe
  2⤵
  PID:3140
- C:\Windows\System\dwXJqCO.exe
  C:\Windows\System\dwXJqCO.exe
  2⤵
  PID:3168
- C:\Windows\System\REctCHi.exe
  C:\Windows\System\REctCHi.exe
  2⤵
  PID:3192
- C:\Windows\System\JBllkSF.exe
  C:\Windows\System\JBllkSF.exe
  2⤵
  PID:3232
- C:\Windows\System\OhDmoPN.exe
  C:\Windows\System\OhDmoPN.exe
  2⤵
  PID:3296
- C:\Windows\System\fQpzrKV.exe
  C:\Windows\System\fQpzrKV.exe
  2⤵
  PID:3364
- C:\Windows\System\ztzixCB.exe
  C:\Windows\System\ztzixCB.exe
  2⤵
  PID:3456
- C:\Windows\System\XPExPef.exe
  C:\Windows\System\XPExPef.exe
  2⤵
  PID:3216
- C:\Windows\System\KggbNHy.exe
  C:\Windows\System\KggbNHy.exe
  2⤵
  PID:3524
- C:\Windows\System\KGEErty.exe
  C:\Windows\System\KGEErty.exe
  2⤵
  PID:3376
- C:\Windows\System\nRRxLZa.exe
  C:\Windows\System\nRRxLZa.exe
  2⤵
  PID:4100
- C:\Windows\System\HlKHlTA.exe
  C:\Windows\System\HlKHlTA.exe
  2⤵
  PID:4116
- C:\Windows\System\zJwsSjg.exe
  C:\Windows\System\zJwsSjg.exe
  2⤵
  PID:4132
- C:\Windows\System\DyuFnth.exe
  C:\Windows\System\DyuFnth.exe
  2⤵
  PID:4148
- C:\Windows\System\NWBxlnN.exe
  C:\Windows\System\NWBxlnN.exe
  2⤵
  PID:4164
- C:\Windows\System\tCaaUDo.exe
  C:\Windows\System\tCaaUDo.exe
  2⤵
  PID:4180
- C:\Windows\System\FcImocg.exe
  C:\Windows\System\FcImocg.exe
  2⤵
  PID:4196
- C:\Windows\System\ovCFnTM.exe
  C:\Windows\System\ovCFnTM.exe
  2⤵
  PID:4212
- C:\Windows\System\GclsiMl.exe
  C:\Windows\System\GclsiMl.exe
  2⤵
  PID:4228
- C:\Windows\System\HeecAOH.exe
  C:\Windows\System\HeecAOH.exe
  2⤵
  PID:4244
- C:\Windows\System\zvlonrx.exe
  C:\Windows\System\zvlonrx.exe
  2⤵
  PID:4260
- C:\Windows\System\NuLApuI.exe
  C:\Windows\System\NuLApuI.exe
  2⤵
  PID:4276
- C:\Windows\System\AzTXsVM.exe
  C:\Windows\System\AzTXsVM.exe
  2⤵
  PID:4292
- C:\Windows\System\yNfMdtU.exe
  C:\Windows\System\yNfMdtU.exe
  2⤵
  PID:4312
- C:\Windows\System\NdlRPGW.exe
  C:\Windows\System\NdlRPGW.exe
  2⤵
  PID:4328
- C:\Windows\System\rVuNtlC.exe
  C:\Windows\System\rVuNtlC.exe
  2⤵
  PID:4344
- C:\Windows\System\qkADdZw.exe
  C:\Windows\System\qkADdZw.exe
  2⤵
  PID:4360
- C:\Windows\System\qvmJnFI.exe
  C:\Windows\System\qvmJnFI.exe
  2⤵
  PID:4376
- C:\Windows\System\TaxJyCn.exe
  C:\Windows\System\TaxJyCn.exe
  2⤵
  PID:4392
- C:\Windows\System\LNICzqT.exe
  C:\Windows\System\LNICzqT.exe
  2⤵
  PID:4412
- C:\Windows\System\oSFNxWo.exe
  C:\Windows\System\oSFNxWo.exe
  2⤵
  PID:4664
- C:\Windows\System\XzsFFAr.exe
  C:\Windows\System\XzsFFAr.exe
  2⤵
  PID:4724
- C:\Windows\System\jvvUYbS.exe
  C:\Windows\System\jvvUYbS.exe
  2⤵
  PID:4744
- C:\Windows\System\pxnWtvZ.exe
  C:\Windows\System\pxnWtvZ.exe
  2⤵
  PID:4760
- C:\Windows\System\VaSxWZf.exe
  C:\Windows\System\VaSxWZf.exe
  2⤵
  PID:4780
- C:\Windows\System\dqERpWK.exe
  C:\Windows\System\dqERpWK.exe
  2⤵
  PID:4800
- C:\Windows\System\HMIriQB.exe
  C:\Windows\System\HMIriQB.exe
  2⤵
  PID:4816
- C:\Windows\System\eEtFbmv.exe
  C:\Windows\System\eEtFbmv.exe
  2⤵
  PID:4832
- C:\Windows\System\UWPuasZ.exe
  C:\Windows\System\UWPuasZ.exe
  2⤵
  PID:4848
- C:\Windows\System\vyTipqf.exe
  C:\Windows\System\vyTipqf.exe
  2⤵
  PID:4864
- C:\Windows\System\rBGaxKd.exe
  C:\Windows\System\rBGaxKd.exe
  2⤵
  PID:4880
- C:\Windows\System\pFieHCq.exe
  C:\Windows\System\pFieHCq.exe
  2⤵
  PID:4896
- C:\Windows\System\MvOthKI.exe
  C:\Windows\System\MvOthKI.exe
  2⤵
  PID:4912
- C:\Windows\System\fXpaKEf.exe
  C:\Windows\System\fXpaKEf.exe
  2⤵
  PID:4928
- C:\Windows\System\lrfSIJx.exe
  C:\Windows\System\lrfSIJx.exe
  2⤵
  PID:4944
- C:\Windows\System\CgviMDi.exe
  C:\Windows\System\CgviMDi.exe
  2⤵
  PID:5012
- C:\Windows\System\asqgkwm.exe
  C:\Windows\System\asqgkwm.exe
  2⤵
  PID:5028
- C:\Windows\System\MZplIgX.exe
  C:\Windows\System\MZplIgX.exe
  2⤵
  PID:5044
- C:\Windows\System\lSKtUFh.exe
  C:\Windows\System\lSKtUFh.exe
  2⤵
  PID:5064
- C:\Windows\System\iPxgXnZ.exe
  C:\Windows\System\iPxgXnZ.exe
  2⤵
  PID:5084
- C:\Windows\System\sMkYQXO.exe
  C:\Windows\System\sMkYQXO.exe
  2⤵
  PID:5100
- C:\Windows\System\wDIlxJu.exe
  C:\Windows\System\wDIlxJu.exe
  2⤵
  PID:5116
- C:\Windows\System\LzouGot.exe
  C:\Windows\System\LzouGot.exe
  2⤵
  PID:3608
- C:\Windows\System\BCwvbxG.exe
  C:\Windows\System\BCwvbxG.exe
  2⤵
  PID:3624
- C:\Windows\System\pRgztDc.exe
  C:\Windows\System\pRgztDc.exe
  2⤵
  PID:3640
- C:\Windows\System\dnXOHmP.exe
  C:\Windows\System\dnXOHmP.exe
  2⤵
  PID:3652
- C:\Windows\System\PTXjkxw.exe
  C:\Windows\System\PTXjkxw.exe
  2⤵
  PID:3692
- C:\Windows\System\wqfLfDc.exe
  C:\Windows\System\wqfLfDc.exe
  2⤵
  PID:3756
- C:\Windows\System\lPvIpyj.exe
  C:\Windows\System\lPvIpyj.exe
  2⤵
  PID:3412
- C:\Windows\System\Fyomfbk.exe
  C:\Windows\System\Fyomfbk.exe
  2⤵
  PID:3508
- C:\Windows\System\oSgFHfb.exe
  C:\Windows\System\oSgFHfb.exe
  2⤵
  PID:3896
- C:\Windows\System\SzdZUQu.exe
  C:\Windows\System\SzdZUQu.exe
  2⤵
  PID:3960
- C:\Windows\System\YxOwbbX.exe
  C:\Windows\System\YxOwbbX.exe
  2⤵
  PID:3228
- C:\Windows\System\uoNRpGr.exe
  C:\Windows\System\uoNRpGr.exe
  2⤵
  PID:4112
- C:\Windows\System\ONEUmPr.exe
  C:\Windows\System\ONEUmPr.exe
  2⤵
  PID:4220
- C:\Windows\System\xVLMkmx.exe
  C:\Windows\System\xVLMkmx.exe
  2⤵
  PID:4208
- C:\Windows\System\qxTlfPx.exe
  C:\Windows\System\qxTlfPx.exe
  2⤵
  PID:4324
- C:\Windows\System\kWNiRIV.exe
  C:\Windows\System\kWNiRIV.exe
  2⤵
  PID:4300
- C:\Windows\System\FzHoDlU.exe
  C:\Windows\System\FzHoDlU.exe
  2⤵
  PID:4308
- C:\Windows\System\pUsBfRV.exe
  C:\Windows\System\pUsBfRV.exe
  2⤵
  PID:4368
- C:\Windows\System\eyLXool.exe
  C:\Windows\System\eyLXool.exe
  2⤵
  PID:3676
- C:\Windows\System\gpqYFzM.exe
  C:\Windows\System\gpqYFzM.exe
  2⤵
  PID:4156
- C:\Windows\System\tnQRvBF.exe
  C:\Windows\System\tnQRvBF.exe
  2⤵
  PID:3680
- C:\Windows\System\VQgFwlP.exe
  C:\Windows\System\VQgFwlP.exe
  2⤵
  PID:4404
- C:\Windows\System\bfFFNcJ.exe
  C:\Windows\System\bfFFNcJ.exe
  2⤵
  PID:4456
- C:\Windows\System\tTBktBf.exe
  C:\Windows\System\tTBktBf.exe
  2⤵
  PID:3844
- C:\Windows\System\VdmpPWr.exe
  C:\Windows\System\VdmpPWr.exe
  2⤵
  PID:3908
- C:\Windows\System\WTNjStY.exe
  C:\Windows\System\WTNjStY.exe
  2⤵
  PID:3976
- C:\Windows\System\ROYJdvI.exe
  C:\Windows\System\ROYJdvI.exe
  2⤵
  PID:4040
- C:\Windows\System\ifUhwGP.exe
  C:\Windows\System\ifUhwGP.exe
  2⤵
  PID:1788
- C:\Windows\System\mZYJNXJ.exe
  C:\Windows\System\mZYJNXJ.exe
  2⤵
  PID:3208
- C:\Windows\System\WUHqqFt.exe
  C:\Windows\System\WUHqqFt.exe
  2⤵
  PID:4640
- C:\Windows\System\JndZCUq.exe
  C:\Windows\System\JndZCUq.exe
  2⤵
  PID:4620
- C:\Windows\System\RVrxPtV.exe
  C:\Windows\System\RVrxPtV.exe
  2⤵
  PID:4604
- C:\Windows\System\UxjxtDR.exe
  C:\Windows\System\UxjxtDR.exe
  2⤵
  PID:4588
- C:\Windows\System\TnWOHdN.exe
  C:\Windows\System\TnWOHdN.exe
  2⤵
  PID:4572
- C:\Windows\System\FjDiFsF.exe
  C:\Windows\System\FjDiFsF.exe
  2⤵
  PID:4556
- C:\Windows\System\fLxcZTB.exe
  C:\Windows\System\fLxcZTB.exe
  2⤵
  PID:4540
- C:\Windows\System\IQwSRHk.exe
  C:\Windows\System\IQwSRHk.exe
  2⤵
  PID:4484
- C:\Windows\System\RBjdZBl.exe
  C:\Windows\System\RBjdZBl.exe
  2⤵
  PID:4452
- C:\Windows\System\xVygCiR.exe
  C:\Windows\System\xVygCiR.exe
  2⤵
  PID:4428
- C:\Windows\System\BeSFALI.exe
  C:\Windows\System\BeSFALI.exe
  2⤵
  PID:3520
- C:\Windows\System\tZywInC.exe
  C:\Windows\System\tZywInC.exe
  2⤵
  PID:3264
- C:\Windows\System\EEMZkTf.exe
  C:\Windows\System\EEMZkTf.exe
  2⤵
  PID:4720
- C:\Windows\System\beqgAFV.exe
  C:\Windows\System\beqgAFV.exe
  2⤵
  PID:4740
- C:\Windows\System\oasXQbd.exe
  C:\Windows\System\oasXQbd.exe
  2⤵
  PID:4792
- C:\Windows\System\jqiFXcp.exe
  C:\Windows\System\jqiFXcp.exe
  2⤵
  PID:4860
- C:\Windows\System\KLrPQSV.exe
  C:\Windows\System\KLrPQSV.exe
  2⤵
  PID:4892
- C:\Windows\System\oZYMeYE.exe
  C:\Windows\System\oZYMeYE.exe
  2⤵
  PID:4888
- C:\Windows\System\jpIsgro.exe
  C:\Windows\System\jpIsgro.exe
  2⤵
  PID:4844
- C:\Windows\System\jzQYvtx.exe
  C:\Windows\System\jzQYvtx.exe
  2⤵
  PID:4908
- C:\Windows\System\UIbMEfv.exe
  C:\Windows\System\UIbMEfv.exe
  2⤵
  PID:4964
- C:\Windows\System\BEuJDcR.exe
  C:\Windows\System\BEuJDcR.exe
  2⤵
  PID:4976
- C:\Windows\System\aYassDe.exe
  C:\Windows\System\aYassDe.exe
  2⤵
  PID:4988
- C:\Windows\System\cnOcygx.exe
  C:\Windows\System\cnOcygx.exe
  2⤵
  PID:5008
- C:\Windows\System\HLjbovJ.exe
  C:\Windows\System\HLjbovJ.exe
  2⤵
  PID:5040
- C:\Windows\System\pGQGPzb.exe
  C:\Windows\System\pGQGPzb.exe
  2⤵
  PID:5060
- C:\Windows\System\JSLoGMV.exe
  C:\Windows\System\JSLoGMV.exe
  2⤵
  PID:5076
- C:\Windows\System\hqujJRm.exe
  C:\Windows\System\hqujJRm.exe
  2⤵
  PID:3620
- C:\Windows\System\AsXoGeK.exe
  C:\Windows\System\AsXoGeK.exe
  2⤵
  PID:3600
- C:\Windows\System\drjQYIr.exe
  C:\Windows\System\drjQYIr.exe
  2⤵
  PID:3764
- C:\Windows\System\pYKqxxn.exe
  C:\Windows\System\pYKqxxn.exe
  2⤵
  PID:3636
- C:\Windows\System\WXRFZJd.exe
  C:\Windows\System\WXRFZJd.exe
  2⤵
  PID:3792
- C:\Windows\System\shSbEDe.exe
  C:\Windows\System\shSbEDe.exe
  2⤵
  PID:3380
- C:\Windows\System\xxMcTnF.exe
  C:\Windows\System\xxMcTnF.exe
  2⤵
  PID:3472
- C:\Windows\System\vpWBHEu.exe
  C:\Windows\System\vpWBHEu.exe
  2⤵
  PID:3860
- C:\Windows\System\QWRkgLJ.exe
  C:\Windows\System\QWRkgLJ.exe
  2⤵
  PID:4024
- C:\Windows\System\bLGRWWS.exe
  C:\Windows\System\bLGRWWS.exe
  2⤵
  PID:4204
- C:\Windows\System\XvgcUBp.exe
  C:\Windows\System\XvgcUBp.exe
  2⤵
  PID:4340
- C:\Windows\System\xAyKSoj.exe
  C:\Windows\System\xAyKSoj.exe
  2⤵
  PID:4124
- C:\Windows\System\EVvDJiI.exe
  C:\Windows\System\EVvDJiI.exe
  2⤵
  PID:4052
- C:\Windows\System\ZFBUPTZ.exe
  C:\Windows\System\ZFBUPTZ.exe
  2⤵
  PID:3076
- C:\Windows\System\Jszrrxz.exe
  C:\Windows\System\Jszrrxz.exe
  2⤵
  PID:3080
- C:\Windows\System\oSrzVWL.exe
  C:\Windows\System\oSrzVWL.exe
  2⤵
  PID:3712
- C:\Windows\System\dhnjxwY.exe
  C:\Windows\System\dhnjxwY.exe
  2⤵
  PID:4612
- C:\Windows\System\NtWbYMr.exe
  C:\Windows\System\NtWbYMr.exe
  2⤵
  PID:4544
- C:\Windows\System\FUFkdju.exe
  C:\Windows\System\FUFkdju.exe
  2⤵
  PID:3972
- C:\Windows\System\vtBJmnW.exe
  C:\Windows\System\vtBJmnW.exe
  2⤵
  PID:4256
- C:\Windows\System\KmoSPFO.exe
  C:\Windows\System\KmoSPFO.exe
  2⤵
  PID:3876
- C:\Windows\System\LZertHZ.exe
  C:\Windows\System\LZertHZ.exe
  2⤵
  PID:3300
- C:\Windows\System\zrqXKRb.exe
  C:\Windows\System\zrqXKRb.exe
  2⤵
  PID:4624
- C:\Windows\System\gQOQXlF.exe
  C:\Windows\System\gQOQXlF.exe
  2⤵
  PID:4520
- C:\Windows\System\CMmWyYQ.exe
  C:\Windows\System\CMmWyYQ.exe
  2⤵
  PID:4508
- C:\Windows\System\mEYRxow.exe
  C:\Windows\System\mEYRxow.exe
  2⤵
  PID:4532
- C:\Windows\System\AthMjaa.exe
  C:\Windows\System\AthMjaa.exe
  2⤵
  PID:4440
- C:\Windows\System\WffPQtu.exe
  C:\Windows\System\WffPQtu.exe
  2⤵
  PID:4188
- C:\Windows\System\vzBCKqu.exe
  C:\Windows\System\vzBCKqu.exe
  2⤵
  PID:4128
- C:\Windows\System\WGmfBHR.exe
  C:\Windows\System\WGmfBHR.exe
  2⤵
  PID:4736
- C:\Windows\System\IKdMfTq.exe
  C:\Windows\System\IKdMfTq.exe
  2⤵
  PID:4904
- C:\Windows\System\TPGDVLI.exe
  C:\Windows\System\TPGDVLI.exe
  2⤵
  PID:4876
- C:\Windows\System\ITPPkbu.exe
  C:\Windows\System\ITPPkbu.exe
  2⤵
  PID:4996
- C:\Windows\System\uJpEDUV.exe
  C:\Windows\System\uJpEDUV.exe
  2⤵
  PID:5072
- C:\Windows\System\vQLKFff.exe
  C:\Windows\System\vQLKFff.exe
  2⤵
  PID:3504
- C:\Windows\System\ZgpTLRP.exe
  C:\Windows\System\ZgpTLRP.exe
  2⤵
  PID:3284
- C:\Windows\System\GetXbdB.exe
  C:\Windows\System\GetXbdB.exe
  2⤵
  PID:4252
- C:\Windows\System\NfvTREW.exe
  C:\Windows\System\NfvTREW.exe
  2⤵
  PID:5108
- C:\Windows\System\bbNcbMe.exe
  C:\Windows\System\bbNcbMe.exe
  2⤵
  PID:3928
- C:\Windows\System\qOVtEWy.exe
  C:\Windows\System\qOVtEWy.exe
  2⤵
  PID:3664
- C:\Windows\System\GBOpZZe.exe
  C:\Windows\System\GBOpZZe.exe
  2⤵
  PID:5056
- C:\Windows\System\hynZrDB.exe
  C:\Windows\System\hynZrDB.exe
  2⤵
  PID:5000
- C:\Windows\System\UnusaCE.exe
  C:\Windows\System\UnusaCE.exe
  2⤵
  PID:4088
- C:\Windows\System\mbxgkur.exe
  C:\Windows\System\mbxgkur.exe
  2⤵
  PID:4172
- C:\Windows\System\qZsudfx.exe
  C:\Windows\System\qZsudfx.exe
  2⤵
  PID:3180
- C:\Windows\System\cjLGtuN.exe
  C:\Windows\System\cjLGtuN.exe
  2⤵
  PID:4576
- C:\Windows\System\csMkUSZ.exe
  C:\Windows\System\csMkUSZ.exe
  2⤵
  PID:3744
- C:\Windows\System\XfScete.exe
  C:\Windows\System\XfScete.exe
  2⤵
  PID:3776
- C:\Windows\System\gOzyCpK.exe
  C:\Windows\System\gOzyCpK.exe
  2⤵
  PID:4596
- C:\Windows\System\qJVavHW.exe
  C:\Windows\System\qJVavHW.exe
  2⤵
  PID:4632
- C:\Windows\System\PtuQjpr.exe
  C:\Windows\System\PtuQjpr.exe
  2⤵
  PID:4488
- C:\Windows\System\GhEyvGY.exe
  C:\Windows\System\GhEyvGY.exe
  2⤵
  PID:4828
- C:\Windows\System\HHJIoXQ.exe
  C:\Windows\System\HHJIoXQ.exe
  2⤵
  PID:3312
- C:\Windows\System\YZBMLNK.exe
  C:\Windows\System\YZBMLNK.exe
  2⤵
  PID:4840
- C:\Windows\System\WGoCQKX.exe
  C:\Windows\System\WGoCQKX.exe
  2⤵
  PID:4072
- C:\Windows\System\wyBqKsU.exe
  C:\Windows\System\wyBqKsU.exe
  2⤵
  PID:3780
- C:\Windows\System\YymIorp.exe
  C:\Windows\System\YymIorp.exe
  2⤵
  PID:4940
- C:\Windows\System\FRBhzzt.exe
  C:\Windows\System\FRBhzzt.exe
  2⤵
  PID:4020
- C:\Windows\System\nKMIoCD.exe
  C:\Windows\System\nKMIoCD.exe
  2⤵
  PID:5136
- C:\Windows\System\XOAvaVG.exe
  C:\Windows\System\XOAvaVG.exe
  2⤵
  PID:5156
- C:\Windows\System\MKEwsZQ.exe
  C:\Windows\System\MKEwsZQ.exe
  2⤵
  PID:5172
- C:\Windows\System\LwKhYZl.exe
  C:\Windows\System\LwKhYZl.exe
  2⤵
  PID:5188
- C:\Windows\System\tJbJXYz.exe
  C:\Windows\System\tJbJXYz.exe
  2⤵
  PID:5204
- C:\Windows\System\OOqsoTO.exe
  C:\Windows\System\OOqsoTO.exe
  2⤵
  PID:5220
- C:\Windows\System\PNgJuvw.exe
  C:\Windows\System\PNgJuvw.exe
  2⤵
  PID:5272
- C:\Windows\System\pcnkxJI.exe
  C:\Windows\System\pcnkxJI.exe
  2⤵
  PID:5288
- C:\Windows\System\GRrNfBx.exe
  C:\Windows\System\GRrNfBx.exe
  2⤵
  PID:5376
- C:\Windows\System\ROeStDP.exe
  C:\Windows\System\ROeStDP.exe
  2⤵
  PID:5392
- C:\Windows\System\eewDQgk.exe
  C:\Windows\System\eewDQgk.exe
  2⤵
  PID:5408
- C:\Windows\System\MGZOtZk.exe
  C:\Windows\System\MGZOtZk.exe
  2⤵
  PID:5424
- C:\Windows\System\JQAhDCp.exe
  C:\Windows\System\JQAhDCp.exe
  2⤵
  PID:5440
- C:\Windows\System\OoUwiJk.exe
  C:\Windows\System\OoUwiJk.exe
  2⤵
  PID:5456
- C:\Windows\System\AAEnPnq.exe
  C:\Windows\System\AAEnPnq.exe
  2⤵
  PID:5612
- C:\Windows\System\NWhKelS.exe
  C:\Windows\System\NWhKelS.exe
  2⤵
  PID:5628
- C:\Windows\System\qYakeZE.exe
  C:\Windows\System\qYakeZE.exe
  2⤵
  PID:5644
- C:\Windows\System\SxPCBIL.exe
  C:\Windows\System\SxPCBIL.exe
  2⤵
  PID:5660
- C:\Windows\System\MQPioyq.exe
  C:\Windows\System\MQPioyq.exe
  2⤵
  PID:5676
- C:\Windows\System\jbLdnxT.exe
  C:\Windows\System\jbLdnxT.exe
  2⤵
  PID:5692
- C:\Windows\System\PjQEuTP.exe
  C:\Windows\System\PjQEuTP.exe
  2⤵
  PID:5708
- C:\Windows\System\yPxvQhZ.exe
  C:\Windows\System\yPxvQhZ.exe
  2⤵
  PID:5724
- C:\Windows\System\bCBimDO.exe
  C:\Windows\System\bCBimDO.exe
  2⤵
  PID:5740
- C:\Windows\System\NEDDuIQ.exe
  C:\Windows\System\NEDDuIQ.exe
  2⤵
  PID:5756
- C:\Windows\System\oDywMfu.exe
  C:\Windows\System\oDywMfu.exe
  2⤵
  PID:5772
- C:\Windows\System\uBIyDdV.exe
  C:\Windows\System\uBIyDdV.exe
  2⤵
  PID:5788
- C:\Windows\System\lbOeFqz.exe
  C:\Windows\System\lbOeFqz.exe
  2⤵
  PID:5804
- C:\Windows\System\egEKWZe.exe
  C:\Windows\System\egEKWZe.exe
  2⤵
  PID:5824
- C:\Windows\System\HaWgbbv.exe
  C:\Windows\System\HaWgbbv.exe
  2⤵
  PID:5840
- C:\Windows\System\frDNXBn.exe
  C:\Windows\System\frDNXBn.exe
  2⤵
  PID:5856
- C:\Windows\System\tggFYJw.exe
  C:\Windows\System\tggFYJw.exe
  2⤵
  PID:5876
- C:\Windows\System\zyFbldG.exe
  C:\Windows\System\zyFbldG.exe
  2⤵
  PID:5892
- C:\Windows\System\XoGluWo.exe
  C:\Windows\System\XoGluWo.exe
  2⤵
  PID:5908
- C:\Windows\System\acOGuTM.exe
  C:\Windows\System\acOGuTM.exe
  2⤵
  PID:5924
- C:\Windows\System\Rtblffn.exe
  C:\Windows\System\Rtblffn.exe
  2⤵
  PID:5940
- C:\Windows\System\BKHhOav.exe
  C:\Windows\System\BKHhOav.exe
  2⤵
  PID:5956
- C:\Windows\System\LaeEMpC.exe
  C:\Windows\System\LaeEMpC.exe
  2⤵
  PID:5972
- C:\Windows\System\crLpQAI.exe
  C:\Windows\System\crLpQAI.exe
  2⤵
  PID:5988
- C:\Windows\System\MKKZRJz.exe
  C:\Windows\System\MKKZRJz.exe
  2⤵
  PID:6008
- C:\Windows\System\dVqrtKB.exe
  C:\Windows\System\dVqrtKB.exe
  2⤵
  PID:6024
- C:\Windows\System\amgCEdf.exe
  C:\Windows\System\amgCEdf.exe
  2⤵
  PID:6040
- C:\Windows\System\VLMOpen.exe
  C:\Windows\System\VLMOpen.exe
  2⤵
  PID:6056
- C:\Windows\System\DhGSCKD.exe
  C:\Windows\System\DhGSCKD.exe
  2⤵
  PID:6072
- C:\Windows\System\dWdUUZA.exe
  C:\Windows\System\dWdUUZA.exe
  2⤵
  PID:6088
- C:\Windows\System\lpWpOqc.exe
  C:\Windows\System\lpWpOqc.exe
  2⤵
  PID:6104
- C:\Windows\System\jfbCKrC.exe
  C:\Windows\System\jfbCKrC.exe
  2⤵
  PID:6124
- C:\Windows\System\ShRNxXz.exe
  C:\Windows\System\ShRNxXz.exe
  2⤵
  PID:6140
- C:\Windows\System\LlcPUow.exe
  C:\Windows\System\LlcPUow.exe
  2⤵
  PID:772
- C:\Windows\System\gmUMaAC.exe
  C:\Windows\System\gmUMaAC.exe
  2⤵
  PID:3584
- C:\Windows\System\mXUAjCh.exe
  C:\Windows\System\mXUAjCh.exe
  2⤵
  PID:4960
- C:\Windows\System\YCVvKeh.exe
  C:\Windows\System\YCVvKeh.exe
  2⤵
  PID:4492
- C:\Windows\System\usNDcIh.exe
  C:\Windows\System\usNDcIh.exe
  2⤵
  PID:4472
- C:\Windows\System\DXcGgCE.exe
  C:\Windows\System\DXcGgCE.exe
  2⤵
  PID:4160
- C:\Windows\System\ZxAxehv.exe
  C:\Windows\System\ZxAxehv.exe
  2⤵
  PID:5096
- C:\Windows\System\Rrepnwa.exe
  C:\Windows\System\Rrepnwa.exe
  2⤵
  PID:4352
- C:\Windows\System\LuvBrGs.exe
  C:\Windows\System\LuvBrGs.exe
  2⤵
  PID:3156
- C:\Windows\System\ErlIFKd.exe
  C:\Windows\System\ErlIFKd.exe
  2⤵
  PID:4672
- C:\Windows\System\RWKdNrU.exe
  C:\Windows\System\RWKdNrU.exe
  2⤵
  PID:4224
- C:\Windows\System\iNMZzix.exe
  C:\Windows\System\iNMZzix.exe
  2⤵
  PID:5200
- C:\Windows\System\YdiBCFD.exe
  C:\Windows\System\YdiBCFD.exe
  2⤵
  PID:5180
- C:\Windows\System\cskpvAN.exe
  C:\Windows\System\cskpvAN.exe
  2⤵
  PID:5244
- C:\Windows\System\JrvOJEA.exe
  C:\Windows\System\JrvOJEA.exe
  2⤵
  PID:3728
- C:\Windows\System\MnTkoWB.exe
  C:\Windows\System\MnTkoWB.exe
  2⤵
  PID:3348
- C:\Windows\System\dEUIruX.exe
  C:\Windows\System\dEUIruX.exe
  2⤵
  PID:4140
- C:\Windows\System\jmATMcZ.exe
  C:\Windows\System\jmATMcZ.exe
  2⤵
  PID:5256
- C:\Windows\System\GnRmDAH.exe
  C:\Windows\System\GnRmDAH.exe
  2⤵
  PID:5236
- C:\Windows\System\QRKuENm.exe
  C:\Windows\System\QRKuENm.exe
  2⤵
  PID:5296
- C:\Windows\System\okAntJF.exe
  C:\Windows\System\okAntJF.exe
  2⤵
  PID:5348
- C:\Windows\System\kynjwXz.exe
  C:\Windows\System\kynjwXz.exe
  2⤵
  PID:5328
- C:\Windows\System\ILJCPlF.exe
  C:\Windows\System\ILJCPlF.exe
  2⤵
  PID:5340
- C:\Windows\System\yGROqFy.exe
  C:\Windows\System\yGROqFy.exe
  2⤵
  PID:5384
- C:\Windows\System\augZmzG.exe
  C:\Windows\System\augZmzG.exe
  2⤵
  PID:5448
- C:\Windows\System\MWVyKsn.exe
  C:\Windows\System\MWVyKsn.exe
  2⤵
  PID:5368
- C:\Windows\System\SbtneSc.exe
  C:\Windows\System\SbtneSc.exe
  2⤵
  PID:5432
- C:\Windows\System\HtXDcDe.exe
  C:\Windows\System\HtXDcDe.exe
  2⤵
  PID:5476
- C:\Windows\System\dWnVmMW.exe
  C:\Windows\System\dWnVmMW.exe
  2⤵
  PID:5492
- C:\Windows\System\hEmZtYN.exe
  C:\Windows\System\hEmZtYN.exe
  2⤵
  PID:5508
- C:\Windows\System\xHLMApd.exe
  C:\Windows\System\xHLMApd.exe
  2⤵
  PID:5520
- C:\Windows\System\AZRJFtA.exe
  C:\Windows\System\AZRJFtA.exe
  2⤵
  PID:5540
- C:\Windows\System\TekJwUf.exe
  C:\Windows\System\TekJwUf.exe
  2⤵
  PID:5556
- C:\Windows\System\UALKdeX.exe
  C:\Windows\System\UALKdeX.exe
  2⤵
  PID:5572
- C:\Windows\System\NAsOggz.exe
  C:\Windows\System\NAsOggz.exe
  2⤵
  PID:5588
- C:\Windows\System\LkQiAYD.exe
  C:\Windows\System\LkQiAYD.exe
  2⤵
  PID:5604
- C:\Windows\System\HXGauwS.exe
  C:\Windows\System\HXGauwS.exe
  2⤵
  PID:5656
- C:\Windows\System\ujynTwl.exe
  C:\Windows\System\ujynTwl.exe
  2⤵
  PID:5688
- C:\Windows\System\AONNpgt.exe
  C:\Windows\System\AONNpgt.exe
  2⤵
  PID:5700
- C:\Windows\System\COFgQWN.exe
  C:\Windows\System\COFgQWN.exe
  2⤵
  PID:5732
- C:\Windows\System\jglBhOH.exe
  C:\Windows\System\jglBhOH.exe
  2⤵
  PID:5784
- C:\Windows\System\wBmcqBT.exe
  C:\Windows\System\wBmcqBT.exe
  2⤵
  PID:5820
- C:\Windows\System\TQlWvFx.exe
  C:\Windows\System\TQlWvFx.exe
  2⤵
  PID:5888
- C:\Windows\System\YWQgwHb.exe
  C:\Windows\System\YWQgwHb.exe
  2⤵
  PID:5952
- C:\Windows\System\rasBSIs.exe
  C:\Windows\System\rasBSIs.exe
  2⤵
  PID:5768
- C:\Windows\System\SXWKlEL.exe
  C:\Windows\System\SXWKlEL.exe
  2⤵
  PID:6052
- C:\Windows\System\mLZIpIH.exe
  C:\Windows\System\mLZIpIH.exe
  2⤵
  PID:5832
- C:\Windows\System\BDsDaqx.exe
  C:\Windows\System\BDsDaqx.exe
  2⤵
  PID:5968
- C:\Windows\System\ctXUeuT.exe
  C:\Windows\System\ctXUeuT.exe
  2⤵
  PID:6112
- C:\Windows\System\PyBiQbW.exe
  C:\Windows\System\PyBiQbW.exe
  2⤵
  PID:4920
- C:\Windows\System\XNohbHf.exe
  C:\Windows\System\XNohbHf.exe
  2⤵
  PID:5872
- C:\Windows\System\frVWmud.exe
  C:\Windows\System\frVWmud.exe
  2⤵
  PID:6132
- C:\Windows\System\hiaTKKB.exe
  C:\Windows\System\hiaTKKB.exe
  2⤵
  PID:6068
- C:\Windows\System\nAIOSKR.exe
  C:\Windows\System\nAIOSKR.exe
  2⤵
  PID:4756
- C:\Windows\System\xVpIcQX.exe
  C:\Windows\System\xVpIcQX.exe
  2⤵
  PID:3396
- C:\Windows\System\SfUmpQH.exe
  C:\Windows\System\SfUmpQH.exe
  2⤵
  PID:4084
- C:\Windows\System\gxrQhzb.exe
  C:\Windows\System\gxrQhzb.exe
  2⤵
  PID:4420
- C:\Windows\System\XyPLrEE.exe
  C:\Windows\System\XyPLrEE.exe
  2⤵
  PID:5248
- C:\Windows\System\rCCdnYI.exe
  C:\Windows\System\rCCdnYI.exe
  2⤵
  PID:5252
- C:\Windows\System\OdEXnfo.exe
  C:\Windows\System\OdEXnfo.exe
  2⤵
  PID:4036
- C:\Windows\System\nUaqmeG.exe
  C:\Windows\System\nUaqmeG.exe
  2⤵
  PID:5164
- C:\Windows\System\LXUzLMk.exe
  C:\Windows\System\LXUzLMk.exe
  2⤵
  PID:3604
- C:\Windows\System\ExGNvjs.exe
  C:\Windows\System\ExGNvjs.exe
  2⤵
  PID:5228
- C:\Windows\System\rMWehLB.exe
  C:\Windows\System\rMWehLB.exe
  2⤵
  PID:5304
- C:\Windows\System\cRBPyVd.exe
  C:\Windows\System\cRBPyVd.exe
  2⤵
  PID:5416
- C:\Windows\System\WfcryPW.exe
  C:\Windows\System\WfcryPW.exe
  2⤵
  PID:5352
- C:\Windows\System\QaiUlLo.exe
  C:\Windows\System\QaiUlLo.exe
  2⤵
  PID:2268
- C:\Windows\System\aVeqhEM.exe
  C:\Windows\System\aVeqhEM.exe
  2⤵
  PID:5488
- C:\Windows\System\oBmATbq.exe
  C:\Windows\System\oBmATbq.exe
  2⤵
  PID:5548
- C:\Windows\System\BonaZFJ.exe
  C:\Windows\System\BonaZFJ.exe
  2⤵
  PID:5652
- C:\Windows\System\XLawIVq.exe
  C:\Windows\System\XLawIVq.exe
  2⤵
  PID:5780
- C:\Windows\System\vTzAMZH.exe
  C:\Windows\System\vTzAMZH.exe
  2⤵
  PID:5764
- C:\Windows\System\DlBzSMM.exe
  C:\Windows\System\DlBzSMM.exe
  2⤵
  PID:6084
- C:\Windows\System\ohmcXAY.exe
  C:\Windows\System\ohmcXAY.exe
  2⤵
  PID:5868
- C:\Windows\System\zjqLPVQ.exe
  C:\Windows\System\zjqLPVQ.exe
  2⤵
  PID:5532
- C:\Windows\System\VwYkMAc.exe
  C:\Windows\System\VwYkMAc.exe
  2⤵
  PID:5596
- C:\Windows\System\ehenoDc.exe
  C:\Windows\System\ehenoDc.exe
  2⤵
  PID:6032
- C:\Windows\System\WbUuscd.exe
  C:\Windows\System\WbUuscd.exe
  2⤵
  PID:5816
- C:\Windows\System\eilAZCK.exe
  C:\Windows\System\eilAZCK.exe
  2⤵
  PID:6064
- C:\Windows\System\tYvhAuy.exe
  C:\Windows\System\tYvhAuy.exe
  2⤵
  PID:5932
- C:\Windows\System\yDQSlom.exe
  C:\Windows\System\yDQSlom.exe
  2⤵
  PID:5936
- C:\Windows\System\ASbWQYH.exe
  C:\Windows\System\ASbWQYH.exe
  2⤵
  PID:4240
- C:\Windows\System\KWkRxpg.exe
  C:\Windows\System\KWkRxpg.exe
  2⤵
  PID:5672
- C:\Windows\System\HOkSuAi.exe
  C:\Windows\System\HOkSuAi.exe
  2⤵
  PID:5736
- C:\Windows\System\bzRaNZq.exe
  C:\Windows\System\bzRaNZq.exe
  2⤵
  PID:5216
- C:\Windows\System\nIbaHVd.exe
  C:\Windows\System\nIbaHVd.exe
  2⤵
  PID:5196
- C:\Windows\System\oRxTwfz.exe
  C:\Windows\System\oRxTwfz.exe
  2⤵
  PID:5436
- C:\Windows\System\nfQAKlF.exe
  C:\Windows\System\nfQAKlF.exe
  2⤵
  PID:5132
- C:\Windows\System\qNSVxDa.exe
  C:\Windows\System\qNSVxDa.exe
  2⤵
  PID:5584
- C:\Windows\System\bGKjNDm.exe
  C:\Windows\System\bGKjNDm.exe
  2⤵
  PID:5544
- C:\Windows\System\pAmouTN.exe
  C:\Windows\System\pAmouTN.exe
  2⤵
  PID:6080
- C:\Windows\System\GxgCKJW.exe
  C:\Windows\System\GxgCKJW.exe
  2⤵
  PID:4460
- C:\Windows\System\IqrtqLF.exe
  C:\Windows\System\IqrtqLF.exe
  2⤵
  PID:4476
- C:\Windows\System\QegLQdP.exe
  C:\Windows\System\QegLQdP.exe
  2⤵
  PID:5984
- C:\Windows\System\IJeGjZd.exe
  C:\Windows\System\IJeGjZd.exe
  2⤵
  PID:4356
- C:\Windows\System\DCSoPTO.exe
  C:\Windows\System\DCSoPTO.exe
  2⤵
  PID:5472
- C:\Windows\System\wTcGbmU.exe
  C:\Windows\System\wTcGbmU.exe
  2⤵
  PID:5212
- C:\Windows\System\CbevaEf.exe
  C:\Windows\System\CbevaEf.exe
  2⤵
  PID:5964
- C:\Windows\System\GrOCWuI.exe
  C:\Windows\System\GrOCWuI.exe
  2⤵
  PID:5312
- C:\Windows\System\zVexOOD.exe
  C:\Windows\System\zVexOOD.exe
  2⤵
  PID:5484
- C:\Windows\System\JzpPlrZ.exe
  C:\Windows\System\JzpPlrZ.exe
  2⤵
  PID:5684
- C:\Windows\System\EIQgVAd.exe
  C:\Windows\System\EIQgVAd.exe
  2⤵
  PID:5128
- C:\Windows\System\apxZLlP.exe
  C:\Windows\System\apxZLlP.exe
  2⤵
  PID:5720
- C:\Windows\System\gqQrJTI.exe
  C:\Windows\System\gqQrJTI.exe
  2⤵
  PID:5464
- C:\Windows\System\ydwSOwc.exe
  C:\Windows\System\ydwSOwc.exe
  2⤵
  PID:6148
- C:\Windows\System\jOsMzMA.exe
  C:\Windows\System\jOsMzMA.exe
  2⤵
  PID:6164
- C:\Windows\System\JqdXXBS.exe
  C:\Windows\System\JqdXXBS.exe
  2⤵
  PID:6180
- C:\Windows\System\nlCAKSG.exe
  C:\Windows\System\nlCAKSG.exe
  2⤵
  PID:6196
- C:\Windows\System\xHTFbEu.exe
  C:\Windows\System\xHTFbEu.exe
  2⤵
  PID:6212
- C:\Windows\System\GADKBIY.exe
  C:\Windows\System\GADKBIY.exe
  2⤵
  PID:6228
- C:\Windows\System\sEbRlfv.exe
  C:\Windows\System\sEbRlfv.exe
  2⤵
  PID:6244
- C:\Windows\System\LJPWIdC.exe
  C:\Windows\System\LJPWIdC.exe
  2⤵
  PID:6260
- C:\Windows\System\kulaJye.exe
  C:\Windows\System\kulaJye.exe
  2⤵
  PID:6276
- C:\Windows\System\hwvTRCR.exe
  C:\Windows\System\hwvTRCR.exe
  2⤵
  PID:6292
- C:\Windows\System\fIxYwoa.exe
  C:\Windows\System\fIxYwoa.exe
  2⤵
  PID:6308
- C:\Windows\System\gXEFyRb.exe
  C:\Windows\System\gXEFyRb.exe
  2⤵
  PID:6324
- C:\Windows\System\bBQmmXJ.exe
  C:\Windows\System\bBQmmXJ.exe
  2⤵
  PID:6344
- C:\Windows\System\SGaveua.exe
  C:\Windows\System\SGaveua.exe
  2⤵
  PID:6360
- C:\Windows\System\uYfSWrB.exe
  C:\Windows\System\uYfSWrB.exe
  2⤵
  PID:6376
- C:\Windows\System\mjVMZsR.exe
  C:\Windows\System\mjVMZsR.exe
  2⤵
  PID:6396
- C:\Windows\System\yTxXyUM.exe
  C:\Windows\System\yTxXyUM.exe
  2⤵
  PID:6412
- C:\Windows\System\FqhUFEB.exe
  C:\Windows\System\FqhUFEB.exe
  2⤵
  PID:6428
- C:\Windows\System\rAOUBnC.exe
  C:\Windows\System\rAOUBnC.exe
  2⤵
  PID:6444
- C:\Windows\System\KqXfCus.exe
  C:\Windows\System\KqXfCus.exe
  2⤵
  PID:6460
- C:\Windows\System\vVCfMEh.exe
  C:\Windows\System\vVCfMEh.exe
  2⤵
  PID:6476
- C:\Windows\System\UDGdZYY.exe
  C:\Windows\System\UDGdZYY.exe
  2⤵
  PID:6492
- C:\Windows\System\EdGDsnR.exe
  C:\Windows\System\EdGDsnR.exe
  2⤵
  PID:6512
- C:\Windows\System\byxKhsg.exe
  C:\Windows\System\byxKhsg.exe
  2⤵
  PID:6528
- C:\Windows\System\lLrFDdh.exe
  C:\Windows\System\lLrFDdh.exe
  2⤵
  PID:6544
- C:\Windows\System\dcmOSga.exe
  C:\Windows\System\dcmOSga.exe
  2⤵
  PID:6564
- C:\Windows\System\rUSEzhw.exe
  C:\Windows\System\rUSEzhw.exe
  2⤵
  PID:6580
- C:\Windows\System\vtMAWmN.exe
  C:\Windows\System\vtMAWmN.exe
  2⤵
  PID:6596
- C:\Windows\System\NIKyqkb.exe
  C:\Windows\System\NIKyqkb.exe
  2⤵
  PID:6624
- C:\Windows\System\vlAYlXJ.exe
  C:\Windows\System\vlAYlXJ.exe
  2⤵
  PID:6668
- C:\Windows\System\dvodvcY.exe
  C:\Windows\System\dvodvcY.exe
  2⤵
  PID:6688
- C:\Windows\System\zSXXxuI.exe
  C:\Windows\System\zSXXxuI.exe
  2⤵
  PID:6704
- C:\Windows\System\HRYqdBL.exe
  C:\Windows\System\HRYqdBL.exe
  2⤵
  PID:6720
- C:\Windows\System\BZmMUkv.exe
  C:\Windows\System\BZmMUkv.exe
  2⤵
  PID:6736
- C:\Windows\System\WDRqVZZ.exe
  C:\Windows\System\WDRqVZZ.exe
  2⤵
  PID:6756
- C:\Windows\System\XUldiFG.exe
  C:\Windows\System\XUldiFG.exe
  2⤵
  PID:6772
- C:\Windows\System\lEcsqGj.exe
  C:\Windows\System\lEcsqGj.exe
  2⤵
  PID:6788
- C:\Windows\System\nbCWzoY.exe
  C:\Windows\System\nbCWzoY.exe
  2⤵
  PID:6804
- C:\Windows\System\KWMcbIW.exe
  C:\Windows\System\KWMcbIW.exe
  2⤵
  PID:6820
- C:\Windows\System\HrJmfHs.exe
  C:\Windows\System\HrJmfHs.exe
  2⤵
  PID:6840
- C:\Windows\System\uoUlRKh.exe
  C:\Windows\System\uoUlRKh.exe
  2⤵
  PID:6856
- C:\Windows\System\roQJQxv.exe
  C:\Windows\System\roQJQxv.exe
  2⤵
  PID:6872
- C:\Windows\System\oRWMyaB.exe
  C:\Windows\System\oRWMyaB.exe
  2⤵
  PID:6888
- C:\Windows\System\KtDMJmN.exe
  C:\Windows\System\KtDMJmN.exe
  2⤵
  PID:6904
- C:\Windows\System\kqkUQLQ.exe
  C:\Windows\System\kqkUQLQ.exe
  2⤵
  PID:6920
- C:\Windows\System\yTjEgHF.exe
  C:\Windows\System\yTjEgHF.exe
  2⤵
  PID:6940
- C:\Windows\System\NcmVrbs.exe
  C:\Windows\System\NcmVrbs.exe
  2⤵
  PID:6956
- C:\Windows\System\WTuqShd.exe
  C:\Windows\System\WTuqShd.exe
  2⤵
  PID:6972
- C:\Windows\System\npYstgg.exe
  C:\Windows\System\npYstgg.exe
  2⤵
  PID:6988
- C:\Windows\System\hORAbgG.exe
  C:\Windows\System\hORAbgG.exe
  2⤵
  PID:7008
- C:\Windows\System\dXqFqEf.exe
  C:\Windows\System\dXqFqEf.exe
  2⤵
  PID:7024
- C:\Windows\System\yThXKWV.exe
  C:\Windows\System\yThXKWV.exe
  2⤵
  PID:7044
- C:\Windows\System\doCkqcE.exe
  C:\Windows\System\doCkqcE.exe
  2⤵
  PID:7060
- C:\Windows\System\zYeXlyz.exe
  C:\Windows\System\zYeXlyz.exe
  2⤵
  PID:7076
- C:\Windows\System\ifaDzQv.exe
  C:\Windows\System\ifaDzQv.exe
  2⤵
  PID:7092
- C:\Windows\System\bpZSYOF.exe
  C:\Windows\System\bpZSYOF.exe
  2⤵
  PID:7108
- C:\Windows\System\tVAFUzr.exe
  C:\Windows\System\tVAFUzr.exe
  2⤵
  PID:7132
- C:\Windows\System\zSwIMLf.exe
  C:\Windows\System\zSwIMLf.exe
  2⤵
  PID:7148
- C:\Windows\System\MIkWYJi.exe
  C:\Windows\System\MIkWYJi.exe
  2⤵
  PID:7164
- C:\Windows\System\eEUlWzB.exe
  C:\Windows\System\eEUlWzB.exe
  2⤵
  PID:5624
- C:\Windows\System\YbyEfUB.exe
  C:\Windows\System\YbyEfUB.exe
  2⤵
  PID:6208
- C:\Windows\System\arHnFEB.exe
  C:\Windows\System\arHnFEB.exe
  2⤵
  PID:6272
- C:\Windows\System\HqizvRV.exe
  C:\Windows\System\HqizvRV.exe
  2⤵
  PID:6336
- C:\Windows\System\bAFedhw.exe
  C:\Windows\System\bAFedhw.exe
  2⤵
  PID:6404
- C:\Windows\System\MYrIMRk.exe
  C:\Windows\System\MYrIMRk.exe
  2⤵
  PID:6456
- C:\Windows\System\eytUwUF.exe
  C:\Windows\System\eytUwUF.exe
  2⤵
  PID:6524
- C:\Windows\System\dUokaTn.exe
  C:\Windows\System\dUokaTn.exe
  2⤵
  PID:6592
- C:\Windows\System\xKBWVdg.exe
  C:\Windows\System\xKBWVdg.exe
  2⤵
  PID:3616
- C:\Windows\System\RTNMiRo.exe
  C:\Windows\System\RTNMiRo.exe
  2⤵
  PID:6192
- C:\Windows\System\BHddmXp.exe
  C:\Windows\System\BHddmXp.exe
  2⤵
  PID:6256
- C:\Windows\System\WfCcCIZ.exe
  C:\Windows\System\WfCcCIZ.exe
  2⤵
  PID:6320
- C:\Windows\System\aexIFNM.exe
  C:\Windows\System\aexIFNM.exe
  2⤵
  PID:6388
- C:\Windows\System\LjbTxhv.exe
  C:\Windows\System\LjbTxhv.exe
  2⤵
  PID:1544
- C:\Windows\System\dAstnBg.exe
  C:\Windows\System\dAstnBg.exe
  2⤵
  PID:6644
- C:\Windows\System\TjMvpzi.exe
  C:\Windows\System\TjMvpzi.exe
  2⤵
  PID:6472
- C:\Windows\System\ZHfakXP.exe
  C:\Windows\System\ZHfakXP.exe
  2⤵
  PID:6536
- C:\Windows\System\CDRsRRF.exe
  C:\Windows\System\CDRsRRF.exe
  2⤵
  PID:6576
- C:\Windows\System\UORiXBm.exe
  C:\Windows\System\UORiXBm.exe
  2⤵
  PID:6612
- C:\Windows\System\uryVqFd.exe
  C:\Windows\System\uryVqFd.exe
  2⤵
  PID:6660
- C:\Windows\System\bLguglS.exe
  C:\Windows\System\bLguglS.exe
  2⤵
  PID:6712
- C:\Windows\System\kVHghXA.exe
  C:\Windows\System\kVHghXA.exe
  2⤵
  PID:6752
- C:\Windows\System\KhqFDaL.exe
  C:\Windows\System\KhqFDaL.exe
  2⤵
  PID:6816
- C:\Windows\System\sRNXrjk.exe
  C:\Windows\System\sRNXrjk.exe
  2⤵
  PID:6884
- C:\Windows\System\JQGBWsi.exe
  C:\Windows\System\JQGBWsi.exe
  2⤵
  PID:6952
- C:\Windows\System\JJQtOQl.exe
  C:\Windows\System\JJQtOQl.exe
  2⤵
  PID:7020
- C:\Windows\System\dIwQtwS.exe
  C:\Windows\System\dIwQtwS.exe
  2⤵
  PID:6728
- C:\Windows\System\ceOHAVV.exe
  C:\Windows\System\ceOHAVV.exe
  2⤵
  PID:6696
- C:\Windows\System\LzQTUyr.exe
  C:\Windows\System\LzQTUyr.exe
  2⤵
  PID:6800
- C:\Windows\System\yBiBNDL.exe
  C:\Windows\System\yBiBNDL.exe
  2⤵
  PID:6868
- C:\Windows\System\SQAtJdT.exe
  C:\Windows\System\SQAtJdT.exe
  2⤵
  PID:6932
- C:\Windows\System\UelEZJc.exe
  C:\Windows\System\UelEZJc.exe
  2⤵
  PID:7004
- C:\Windows\System\ISzssSZ.exe
  C:\Windows\System\ISzssSZ.exe
  2⤵
  PID:7068
- C:\Windows\System\aXILIBR.exe
  C:\Windows\System\aXILIBR.exe
  2⤵
  PID:7072
- C:\Windows\System\hgZMucs.exe
  C:\Windows\System\hgZMucs.exe
  2⤵
  PID:7156
- C:\Windows\System\ylfMkqd.exe
  C:\Windows\System\ylfMkqd.exe
  2⤵
  PID:6304
- C:\Windows\System\xAiCBYi.exe
  C:\Windows\System\xAiCBYi.exe
  2⤵
  PID:6424
- C:\Windows\System\bmYIjWM.exe
  C:\Windows\System\bmYIjWM.exe
  2⤵
  PID:7100
- C:\Windows\System\LpsExAn.exe
  C:\Windows\System\LpsExAn.exe
  2⤵
  PID:7144
- C:\Windows\System\KeTVLVT.exe
  C:\Windows\System\KeTVLVT.exe
  2⤵
  PID:6288
- C:\Windows\System\tyKEShX.exe
  C:\Windows\System\tyKEShX.exe
  2⤵
  PID:6240
- C:\Windows\System\uBZWoGe.exe
  C:\Windows\System\uBZWoGe.exe
  2⤵
  PID:5948
- C:\Windows\System\HQocnGe.exe
  C:\Windows\System\HQocnGe.exe
  2⤵
  PID:6520
- C:\Windows\System\SPTuDmB.exe
  C:\Windows\System\SPTuDmB.exe
  2⤵
  PID:6384
- C:\Windows\System\YaCKWGv.exe
  C:\Windows\System\YaCKWGv.exe
  2⤵
  PID:6572
- C:\Windows\System\FOxjSWm.exe
  C:\Windows\System\FOxjSWm.exe
  2⤵
  PID:6748
- C:\Windows\System\LWcJnWq.exe
  C:\Windows\System\LWcJnWq.exe
  2⤵
  PID:6504
- C:\Windows\System\UfWMiBE.exe
  C:\Windows\System\UfWMiBE.exe
  2⤵
  PID:6680
- C:\Windows\System\hArIxbe.exe
  C:\Windows\System\hArIxbe.exe
  2⤵
  PID:6916
- C:\Windows\System\KHyeIdi.exe
  C:\Windows\System\KHyeIdi.exe
  2⤵
  PID:7000
- C:\Windows\System\JvYMWsc.exe
  C:\Windows\System\JvYMWsc.exe
  2⤵
  PID:6996
- C:\Windows\System\NhbWvnX.exe
  C:\Windows\System\NhbWvnX.exe
  2⤵
  PID:6176
- C:\Windows\System\OGywxjR.exe
  C:\Windows\System\OGywxjR.exe
  2⤵
  PID:6928
- C:\Windows\System\WPCcuLB.exe
  C:\Windows\System\WPCcuLB.exe
  2⤵
  PID:7128
- C:\Windows\System\QQIxtCC.exe
  C:\Windows\System\QQIxtCC.exe
  2⤵
  PID:6036
- C:\Windows\System\fmoWRrK.exe
  C:\Windows\System\fmoWRrK.exe
  2⤵
  PID:6368
- C:\Windows\System\ZlGdrSb.exe
  C:\Windows\System\ZlGdrSb.exe
  2⤵
  PID:6356
- C:\Windows\System\rOsUxPg.exe
  C:\Windows\System\rOsUxPg.exe
  2⤵
  PID:6556
- C:\Windows\System\KjBygFD.exe
  C:\Windows\System\KjBygFD.exe
  2⤵
  PID:6664
- C:\Windows\System\UWrGKmM.exe
  C:\Windows\System\UWrGKmM.exe
  2⤵
  PID:7016
- C:\Windows\System\AoWlxnZ.exe
  C:\Windows\System\AoWlxnZ.exe
  2⤵
  PID:7124
- C:\Windows\System\dMpqDIp.exe
  C:\Windows\System\dMpqDIp.exe
  2⤵
  PID:6604
- C:\Windows\System\xkpipTs.exe
  C:\Windows\System\xkpipTs.exe
  2⤵
  PID:7172
- C:\Windows\System\wtwKlxR.exe
  C:\Windows\System\wtwKlxR.exe
  2⤵
  PID:7188
- C:\Windows\System\NDXMvbX.exe
  C:\Windows\System\NDXMvbX.exe
  2⤵
  PID:7204
- C:\Windows\System\FxmGhqR.exe
  C:\Windows\System\FxmGhqR.exe
  2⤵
  PID:7220
- C:\Windows\System\zmaMfOC.exe
  C:\Windows\System\zmaMfOC.exe
  2⤵
  PID:7236
- C:\Windows\System\UEfXNpF.exe
  C:\Windows\System\UEfXNpF.exe
  2⤵
  PID:7252
- C:\Windows\System\PmeFVEo.exe
  C:\Windows\System\PmeFVEo.exe
  2⤵
  PID:7268
- C:\Windows\System\yTPNBhX.exe
  C:\Windows\System\yTPNBhX.exe
  2⤵
  PID:7284
- C:\Windows\System\AVdwJlE.exe
  C:\Windows\System\AVdwJlE.exe
  2⤵
  PID:7300
- C:\Windows\System\mABZymR.exe
  C:\Windows\System\mABZymR.exe
  2⤵
  PID:7316
- C:\Windows\System\XctydDA.exe
  C:\Windows\System\XctydDA.exe
  2⤵
  PID:7332
- C:\Windows\System\nfloejD.exe
  C:\Windows\System\nfloejD.exe
  2⤵
  PID:7348
- C:\Windows\System\TXrKpBv.exe
  C:\Windows\System\TXrKpBv.exe
  2⤵
  PID:7364
- C:\Windows\System\IGetkFJ.exe
  C:\Windows\System\IGetkFJ.exe
  2⤵
  PID:7380
- C:\Windows\System\bDFLmuP.exe
  C:\Windows\System\bDFLmuP.exe
  2⤵
  PID:7396
- C:\Windows\System\TJWyIbM.exe
  C:\Windows\System\TJWyIbM.exe
  2⤵
  PID:7412
- C:\Windows\System\iXTmgtl.exe
  C:\Windows\System\iXTmgtl.exe
  2⤵
  PID:7428
- C:\Windows\System\pIJKRyX.exe
  C:\Windows\System\pIJKRyX.exe
  2⤵
  PID:7444
- C:\Windows\System\ulndoci.exe
  C:\Windows\System\ulndoci.exe
  2⤵
  PID:7460
- C:\Windows\System\MAgScgB.exe
  C:\Windows\System\MAgScgB.exe
  2⤵
  PID:7476
- C:\Windows\System\LSJSyzQ.exe
  C:\Windows\System\LSJSyzQ.exe
  2⤵
  PID:7492
- C:\Windows\System\OoJXrCv.exe
  C:\Windows\System\OoJXrCv.exe
  2⤵
  PID:7508
- C:\Windows\System\uxKcjTF.exe
  C:\Windows\System\uxKcjTF.exe
  2⤵
  PID:7524
- C:\Windows\System\RRWXBqv.exe
  C:\Windows\System\RRWXBqv.exe
  2⤵
  PID:7540
- C:\Windows\System\ErCrtsC.exe
  C:\Windows\System\ErCrtsC.exe
  2⤵
  PID:7560
- C:\Windows\System\HmDqowb.exe
  C:\Windows\System\HmDqowb.exe
  2⤵
  PID:7576
- C:\Windows\System\cDGNEaT.exe
  C:\Windows\System\cDGNEaT.exe
  2⤵
  PID:7596
- C:\Windows\System\EYFPnpy.exe
  C:\Windows\System\EYFPnpy.exe
  2⤵
  PID:7612
- C:\Windows\System\qSkVCre.exe
  C:\Windows\System\qSkVCre.exe
  2⤵
  PID:7628
- C:\Windows\System\EILhBmr.exe
  C:\Windows\System\EILhBmr.exe
  2⤵
  PID:7644
- C:\Windows\System\KPgwfhb.exe
  C:\Windows\System\KPgwfhb.exe
  2⤵
  PID:7660
- C:\Windows\System\yBtUoVo.exe
  C:\Windows\System\yBtUoVo.exe
  2⤵
  PID:7676
- C:\Windows\System\NAwtQgQ.exe
  C:\Windows\System\NAwtQgQ.exe
  2⤵
  PID:7692
- C:\Windows\System\TSCpKNl.exe
  C:\Windows\System\TSCpKNl.exe
  2⤵
  PID:7708
- C:\Windows\System\kkGeMeT.exe
  C:\Windows\System\kkGeMeT.exe
  2⤵
  PID:7724
- C:\Windows\System\KBFhyMw.exe
  C:\Windows\System\KBFhyMw.exe
  2⤵
  PID:7740
- C:\Windows\System\aIjLMEV.exe
  C:\Windows\System\aIjLMEV.exe
  2⤵
  PID:7756
- C:\Windows\System\nrvpOTo.exe
  C:\Windows\System\nrvpOTo.exe
  2⤵
  PID:7772
- C:\Windows\System\JawJlcJ.exe
  C:\Windows\System\JawJlcJ.exe
  2⤵
  PID:7788
- C:\Windows\System\DIgQmhc.exe
  C:\Windows\System\DIgQmhc.exe
  2⤵
  PID:7804
- C:\Windows\System\EEtgauw.exe
  C:\Windows\System\EEtgauw.exe
  2⤵
  PID:7820
- C:\Windows\System\UUkQgCV.exe
  C:\Windows\System\UUkQgCV.exe
  2⤵
  PID:7836
- C:\Windows\System\bkUtLVz.exe
  C:\Windows\System\bkUtLVz.exe
  2⤵
  PID:7852
- C:\Windows\System\YmhQhnB.exe
  C:\Windows\System\YmhQhnB.exe
  2⤵
  PID:7868
- C:\Windows\System\kCeMlQG.exe
  C:\Windows\System\kCeMlQG.exe
  2⤵
  PID:7884
- C:\Windows\System\xJXKJmX.exe
  C:\Windows\System\xJXKJmX.exe
  2⤵
  PID:7900
- C:\Windows\System\JoOTdVq.exe
  C:\Windows\System\JoOTdVq.exe
  2⤵
  PID:7916
- C:\Windows\System\AlbXNuZ.exe
  C:\Windows\System\AlbXNuZ.exe
  2⤵
  PID:7932
- C:\Windows\System\irHAiVf.exe
  C:\Windows\System\irHAiVf.exe
  2⤵
  PID:7948
- C:\Windows\System\xtlXXBT.exe
  C:\Windows\System\xtlXXBT.exe
  2⤵
  PID:7964
- C:\Windows\System\TETCMwW.exe
  C:\Windows\System\TETCMwW.exe
  2⤵
  PID:7980
- C:\Windows\System\mAPZvRN.exe
  C:\Windows\System\mAPZvRN.exe
  2⤵
  PID:8000
- C:\Windows\System\PQGyGwi.exe
  C:\Windows\System\PQGyGwi.exe
  2⤵
  PID:8016
- C:\Windows\System\VWxhJeF.exe
  C:\Windows\System\VWxhJeF.exe
  2⤵
  PID:8032
- C:\Windows\System\ccpyEeW.exe
  C:\Windows\System\ccpyEeW.exe
  2⤵
  PID:8048
- C:\Windows\System\qtWWWtR.exe
  C:\Windows\System\qtWWWtR.exe
  2⤵
  PID:8064
- C:\Windows\System\dKYencf.exe
  C:\Windows\System\dKYencf.exe
  2⤵
  PID:8148
- C:\Windows\System\acyLAjB.exe
  C:\Windows\System\acyLAjB.exe
  2⤵
  PID:8164
- C:\Windows\System\zNomqNz.exe
  C:\Windows\System\zNomqNz.exe
  2⤵
  PID:8180
- C:\Windows\System\HLQQUud.exe
  C:\Windows\System\HLQQUud.exe
  2⤵
  PID:7180
- C:\Windows\System\kcVOATd.exe
  C:\Windows\System\kcVOATd.exe
  2⤵
  PID:7244
- C:\Windows\System\pSoTNXH.exe
  C:\Windows\System\pSoTNXH.exe
  2⤵
  PID:6784
- C:\Windows\System\cNSExJZ.exe
  C:\Windows\System\cNSExJZ.exe
  2⤵
  PID:6732
- C:\Windows\System\JIrSAPZ.exe
  C:\Windows\System\JIrSAPZ.exe
  2⤵
  PID:7404
- C:\Windows\System\wQYXqMy.exe
  C:\Windows\System\wQYXqMy.exe
  2⤵
  PID:6880
- C:\Windows\System\KRXTDSo.exe
  C:\Windows\System\KRXTDSo.exe
  2⤵
  PID:6900
- C:\Windows\System\PkblRvW.exe
  C:\Windows\System\PkblRvW.exe
  2⤵
  PID:6252
- C:\Windows\System\LKQDjpW.exe
  C:\Windows\System\LKQDjpW.exe
  2⤵
  PID:6812
- C:\Windows\System\sKCEqIb.exe
  C:\Windows\System\sKCEqIb.exe
  2⤵
  PID:7360
- C:\Windows\System\pyFuMfr.exe
  C:\Windows\System\pyFuMfr.exe
  2⤵
  PID:7056
- C:\Windows\System\VbENNsd.exe
  C:\Windows\System\VbENNsd.exe
  2⤵
  PID:6268
- C:\Windows\System\DksoygI.exe
  C:\Windows\System\DksoygI.exe
  2⤵
  PID:7228
- C:\Windows\System\TskAOPT.exe
  C:\Windows\System\TskAOPT.exe
  2⤵
  PID:7324
- C:\Windows\System\FQoHgun.exe
  C:\Windows\System\FQoHgun.exe
  2⤵
  PID:7424
- C:\Windows\System\oDJJrgL.exe
  C:\Windows\System\oDJJrgL.exe
  2⤵
  PID:7532
- C:\Windows\System\aZYUhvn.exe
  C:\Windows\System\aZYUhvn.exe
  2⤵
  PID:7604
- C:\Windows\System\hQqRuSZ.exe
  C:\Windows\System\hQqRuSZ.exe
  2⤵
  PID:7668
- C:\Windows\System\JfiVktA.exe
  C:\Windows\System\JfiVktA.exe
  2⤵
  PID:7704
- C:\Windows\System\yCUOGAy.exe
  C:\Windows\System\yCUOGAy.exe
  2⤵
  PID:7584
- C:\Windows\System\ShGvzYP.exe
  C:\Windows\System\ShGvzYP.exe
  2⤵
  PID:7520
- C:\Windows\System\tGpoNfB.exe
  C:\Windows\System\tGpoNfB.exe
  2⤵
  PID:7592
- C:\Windows\System\tZGWOCk.exe
  C:\Windows\System\tZGWOCk.exe
  2⤵
  PID:7688
- C:\Windows\System\qgwnZsL.exe
  C:\Windows\System\qgwnZsL.exe
  2⤵
  PID:7768
- C:\Windows\System\uYepXNS.exe
  C:\Windows\System\uYepXNS.exe
  2⤵
  PID:7860
- C:\Windows\System\JcpRLVi.exe
  C:\Windows\System\JcpRLVi.exe
  2⤵
  PID:7924
- C:\Windows\System\FCWzBjY.exe
  C:\Windows\System\FCWzBjY.exe
  2⤵
  PID:7752
- C:\Windows\System\fLerSns.exe
  C:\Windows\System\fLerSns.exe
  2⤵
  PID:7876
- C:\Windows\System\vWmtkUc.exe
  C:\Windows\System\vWmtkUc.exe
  2⤵
  PID:7940
- C:\Windows\System\HkIUbrF.exe
  C:\Windows\System\HkIUbrF.exe
  2⤵
  PID:7960
- C:\Windows\System\HRMxZKj.exe
  C:\Windows\System\HRMxZKj.exe
  2⤵
  PID:8028
- C:\Windows\System\WrGKYXy.exe
  C:\Windows\System\WrGKYXy.exe
  2⤵
  PID:6656
- C:\Windows\System\tKpQcaP.exe
  C:\Windows\System\tKpQcaP.exe
  2⤵
  PID:8100
- C:\Windows\System\GhUBZJe.exe
  C:\Windows\System\GhUBZJe.exe
  2⤵
  PID:8072
- C:\Windows\System\LDVATTU.exe
  C:\Windows\System\LDVATTU.exe
  2⤵
  PID:8108
- C:\Windows\System\KvMFRaT.exe
  C:\Windows\System\KvMFRaT.exe
  2⤵
  PID:8132
- C:\Windows\System\uuxYJyA.exe
  C:\Windows\System\uuxYJyA.exe
  2⤵
  PID:7276
- C:\Windows\System\OySBekO.exe
  C:\Windows\System\OySBekO.exe
  2⤵
  PID:8176
- C:\Windows\System\cqWxzbW.exe
  C:\Windows\System\cqWxzbW.exe
  2⤵
  PID:7372
- C:\Windows\System\oraGapY.exe
  C:\Windows\System\oraGapY.exe
  2⤵
  PID:7232
- C:\Windows\System\fOZKAbY.exe
  C:\Windows\System\fOZKAbY.exe
  2⤵
  PID:7420
- C:\Windows\System\XlhbUzZ.exe
  C:\Windows\System\XlhbUzZ.exe
  2⤵
  PID:7568
- C:\Windows\System\feHNCna.exe
  C:\Windows\System\feHNCna.exe
  2⤵
  PID:7700
- C:\Windows\System\GmkYhpc.exe
  C:\Windows\System\GmkYhpc.exe
  2⤵
  PID:7684
- C:\Windows\System\mnpeyID.exe
  C:\Windows\System\mnpeyID.exe
  2⤵
  PID:7956
- C:\Windows\System\piZousp.exe
  C:\Windows\System\piZousp.exe
  2⤵
  PID:7992
- C:\Windows\System\UFfUEVv.exe
  C:\Windows\System\UFfUEVv.exe
  2⤵
  PID:8092
- C:\Windows\System\EwXxqfN.exe
  C:\Windows\System\EwXxqfN.exe
  2⤵
  PID:8140
- C:\Windows\System\VnzOytF.exe
  C:\Windows\System\VnzOytF.exe
  2⤵
  PID:7216
- C:\Windows\System\sGRGtVN.exe
  C:\Windows\System\sGRGtVN.exe
  2⤵
  PID:7436
- C:\Windows\System\kcExQdk.exe
  C:\Windows\System\kcExQdk.exe
  2⤵
  PID:7832
- C:\Windows\System\xxogPyl.exe
  C:\Windows\System\xxogPyl.exe
  2⤵
  PID:7732
- C:\Windows\System\PJBFSUo.exe
  C:\Windows\System\PJBFSUo.exe
  2⤵
  PID:8124
- C:\Windows\System\tHMAcOA.exe
  C:\Windows\System\tHMAcOA.exe
  2⤵
  PID:7040
- C:\Windows\System\bZDXSiy.exe
  C:\Windows\System\bZDXSiy.exe
  2⤵
  PID:7636
- C:\Windows\System\RmsTQsh.exe
  C:\Windows\System\RmsTQsh.exe
  2⤵
  PID:7588
- C:\Windows\System\AMWvNOh.exe
  C:\Windows\System\AMWvNOh.exe
  2⤵
  PID:7892
- C:\Windows\System\AatmPbT.exe
  C:\Windows\System\AatmPbT.exe
  2⤵
  PID:7848
- C:\Windows\System\cJjmEAl.exe
  C:\Windows\System\cJjmEAl.exe
  2⤵
  PID:8008
- C:\Windows\System\HBDtKiQ.exe
  C:\Windows\System\HBDtKiQ.exe
  2⤵
  PID:8060
- C:\Windows\System\pJWPzmz.exe
  C:\Windows\System\pJWPzmz.exe
  2⤵
  PID:8172
- C:\Windows\System\zqgsAYg.exe
  C:\Windows\System\zqgsAYg.exe
  2⤵
  PID:7196
- C:\Windows\System\wJdoiUV.exe
  C:\Windows\System\wJdoiUV.exe
  2⤵
  PID:7812
- C:\Windows\System\xOHFavV.exe
  C:\Windows\System\xOHFavV.exe
  2⤵
  PID:6420
- C:\Windows\System\JrbIHGu.exe
  C:\Windows\System\JrbIHGu.exe
  2⤵
  PID:7292
- C:\Windows\System\muppqtl.exe
  C:\Windows\System\muppqtl.exe
  2⤵
  PID:7748
- C:\Windows\System\qIuqPjd.exe
  C:\Windows\System\qIuqPjd.exe
  2⤵
  PID:8120
- C:\Windows\System\YiBLOMS.exe
  C:\Windows\System\YiBLOMS.exe
  2⤵
  PID:8088
- C:\Windows\System\tNNfFGU.exe
  C:\Windows\System\tNNfFGU.exe
  2⤵
  PID:7548
- C:\Windows\System\NMKJCHQ.exe
  C:\Windows\System\NMKJCHQ.exe
  2⤵
  PID:8044
- C:\Windows\System\tAwPPQc.exe
  C:\Windows\System\tAwPPQc.exe
  2⤵
  PID:7656
- C:\Windows\System\laDoiJN.exe
  C:\Windows\System\laDoiJN.exe
  2⤵
  PID:8188
- C:\Windows\System\rvVBdWg.exe
  C:\Windows\System\rvVBdWg.exe
  2⤵
  PID:8104
- C:\Windows\System\ZwjFPBG.exe
  C:\Windows\System\ZwjFPBG.exe
  2⤵
  PID:8204
- C:\Windows\System\ZmwWhZE.exe
  C:\Windows\System\ZmwWhZE.exe
  2⤵
  PID:8220
- C:\Windows\System\JvCEoxX.exe
  C:\Windows\System\JvCEoxX.exe
  2⤵
  PID:8236
- C:\Windows\System\YCpBCGQ.exe
  C:\Windows\System\YCpBCGQ.exe
  2⤵
  PID:8252
- C:\Windows\System\rRtJuqu.exe
  C:\Windows\System\rRtJuqu.exe
  2⤵
  PID:8268
- C:\Windows\System\dDvIvLS.exe
  C:\Windows\System\dDvIvLS.exe
  2⤵
  PID:8284
- C:\Windows\System\efSxzUk.exe
  C:\Windows\System\efSxzUk.exe
  2⤵
  PID:8300
- C:\Windows\System\zPCELgA.exe
  C:\Windows\System\zPCELgA.exe
  2⤵
  PID:8316
- C:\Windows\System\byNqxHN.exe
  C:\Windows\System\byNqxHN.exe
  2⤵
  PID:8332
- C:\Windows\System\CJjOanO.exe
  C:\Windows\System\CJjOanO.exe
  2⤵
  PID:8348
- C:\Windows\System\KdJxHHa.exe
  C:\Windows\System\KdJxHHa.exe
  2⤵
  PID:8364
- C:\Windows\System\IpvuhEU.exe
  C:\Windows\System\IpvuhEU.exe
  2⤵
  PID:8380
- C:\Windows\System\iPqhVaj.exe
  C:\Windows\System\iPqhVaj.exe
  2⤵
  PID:8396
- C:\Windows\System\nxVlRkC.exe
  C:\Windows\System\nxVlRkC.exe
  2⤵
  PID:8412
- C:\Windows\System\eoZSYTT.exe
  C:\Windows\System\eoZSYTT.exe
  2⤵
  PID:8428
- C:\Windows\System\HTvwZyE.exe
  C:\Windows\System\HTvwZyE.exe
  2⤵
  PID:8444
- C:\Windows\System\WbmSRVd.exe
  C:\Windows\System\WbmSRVd.exe
  2⤵
  PID:8460
- C:\Windows\System\MSaBWao.exe
  C:\Windows\System\MSaBWao.exe
  2⤵
  PID:8476
- C:\Windows\System\NYVdsrM.exe
  C:\Windows\System\NYVdsrM.exe
  2⤵
  PID:8492
- C:\Windows\System\bESYgZn.exe
  C:\Windows\System\bESYgZn.exe
  2⤵
  PID:8508
- C:\Windows\System\ocUazEg.exe
  C:\Windows\System\ocUazEg.exe
  2⤵
  PID:8524
- C:\Windows\System\ZPjklGv.exe
  C:\Windows\System\ZPjklGv.exe
  2⤵
  PID:8540
- C:\Windows\System\wJDzRSk.exe
  C:\Windows\System\wJDzRSk.exe
  2⤵
  PID:8556
- C:\Windows\System\rYXaJdE.exe
  C:\Windows\System\rYXaJdE.exe
  2⤵
  PID:8572
- C:\Windows\System\NecKujv.exe
  C:\Windows\System\NecKujv.exe
  2⤵
  PID:8588
- C:\Windows\System\mDHLQzT.exe
  C:\Windows\System\mDHLQzT.exe
  2⤵
  PID:8604
- C:\Windows\System\TZmeDzI.exe
  C:\Windows\System\TZmeDzI.exe
  2⤵
  PID:8620
- C:\Windows\System\KUCHQCO.exe
  C:\Windows\System\KUCHQCO.exe
  2⤵
  PID:8636
- C:\Windows\System\cDEYVRx.exe
  C:\Windows\System\cDEYVRx.exe
  2⤵
  PID:8652
- C:\Windows\System\xYtmMuE.exe
  C:\Windows\System\xYtmMuE.exe
  2⤵
  PID:8668
- C:\Windows\System\wPuUtHA.exe
  C:\Windows\System\wPuUtHA.exe
  2⤵
  PID:8684
- C:\Windows\System\qSLYlAU.exe
  C:\Windows\System\qSLYlAU.exe
  2⤵
  PID:8700
- C:\Windows\System\PXcKOtj.exe
  C:\Windows\System\PXcKOtj.exe
  2⤵
  PID:8716
- C:\Windows\System\HroSQuG.exe
  C:\Windows\System\HroSQuG.exe
  2⤵
  PID:8736
- C:\Windows\System\YmuAgbM.exe
  C:\Windows\System\YmuAgbM.exe
  2⤵
  PID:8752
- C:\Windows\System\lPTGpJE.exe
  C:\Windows\System\lPTGpJE.exe
  2⤵
  PID:8768
- C:\Windows\System\RjflKgH.exe
  C:\Windows\System\RjflKgH.exe
  2⤵
  PID:8784
- C:\Windows\System\xpIjUpb.exe
  C:\Windows\System\xpIjUpb.exe
  2⤵
  PID:8800
- C:\Windows\System\JFOWHlZ.exe
  C:\Windows\System\JFOWHlZ.exe
  2⤵
  PID:8816
- C:\Windows\System\yWUQasS.exe
  C:\Windows\System\yWUQasS.exe
  2⤵
  PID:8832
- C:\Windows\System\bOVymBC.exe
  C:\Windows\System\bOVymBC.exe
  2⤵
  PID:8848
- C:\Windows\System\TVlKcAn.exe
  C:\Windows\System\TVlKcAn.exe
  2⤵
  PID:8864
- C:\Windows\System\WaxqhEG.exe
  C:\Windows\System\WaxqhEG.exe
  2⤵
  PID:8880
- C:\Windows\System\yawlACJ.exe
  C:\Windows\System\yawlACJ.exe
  2⤵
  PID:8896
- C:\Windows\System\biYUyLW.exe
  C:\Windows\System\biYUyLW.exe
  2⤵
  PID:8912
- C:\Windows\System\wkHOqcK.exe
  C:\Windows\System\wkHOqcK.exe
  2⤵
  PID:8928
- C:\Windows\System\TYWNFiu.exe
  C:\Windows\System\TYWNFiu.exe
  2⤵
  PID:8944
- C:\Windows\System\nTYGnIF.exe
  C:\Windows\System\nTYGnIF.exe
  2⤵
  PID:8960
- C:\Windows\System\iqwYKZO.exe
  C:\Windows\System\iqwYKZO.exe
  2⤵
  PID:8976
- C:\Windows\System\rhvBRNR.exe
  C:\Windows\System\rhvBRNR.exe
  2⤵
  PID:8992
- C:\Windows\System\MynfYLu.exe
  C:\Windows\System\MynfYLu.exe
  2⤵
  PID:9008
- C:\Windows\System\vtOlCjU.exe
  C:\Windows\System\vtOlCjU.exe
  2⤵
  PID:9024
- C:\Windows\System\fCydZOC.exe
  C:\Windows\System\fCydZOC.exe
  2⤵
  PID:9040
- C:\Windows\System\XNwilqt.exe
  C:\Windows\System\XNwilqt.exe
  2⤵
  PID:9056
- C:\Windows\System\PsjaEoj.exe
  C:\Windows\System\PsjaEoj.exe
  2⤵
  PID:9072
- C:\Windows\System\ImYIFYU.exe
  C:\Windows\System\ImYIFYU.exe
  2⤵
  PID:9088
- C:\Windows\System\gpypCuY.exe
  C:\Windows\System\gpypCuY.exe
  2⤵
  PID:9104
- C:\Windows\System\PHkHGmq.exe
  C:\Windows\System\PHkHGmq.exe
  2⤵
  PID:9124
- C:\Windows\System\XyDDBYX.exe
  C:\Windows\System\XyDDBYX.exe
  2⤵
  PID:9140
- C:\Windows\System\MAwrRTR.exe
  C:\Windows\System\MAwrRTR.exe
  2⤵
  PID:9156
- C:\Windows\System\oPzbiiL.exe
  C:\Windows\System\oPzbiiL.exe
  2⤵
  PID:9172
- C:\Windows\System\yKkwsEE.exe
  C:\Windows\System\yKkwsEE.exe
  2⤵
  PID:9188
- C:\Windows\System\GIopMnh.exe
  C:\Windows\System\GIopMnh.exe
  2⤵
  PID:9204
- C:\Windows\System\sqITSnq.exe
  C:\Windows\System\sqITSnq.exe
  2⤵
  PID:7440
- C:\Windows\System\RPcpxZU.exe
  C:\Windows\System\RPcpxZU.exe
  2⤵
  PID:8248
- C:\Windows\System\lzTBPeQ.exe
  C:\Windows\System\lzTBPeQ.exe
  2⤵
  PID:8312
- C:\Windows\System\PyuHfMl.exe
  C:\Windows\System\PyuHfMl.exe
  2⤵
  PID:8200
- C:\Windows\System\AYOITDv.exe
  C:\Windows\System\AYOITDv.exe
  2⤵
  PID:8260
- C:\Windows\System\eesBxHr.exe
  C:\Windows\System\eesBxHr.exe
  2⤵
  PID:7504
- C:\Windows\System\MQUJZGC.exe
  C:\Windows\System\MQUJZGC.exe
  2⤵
  PID:7912
- C:\Windows\System\yQYMNrI.exe
  C:\Windows\System\yQYMNrI.exe
  2⤵
  PID:8196
- C:\Windows\System\OMCMiFN.exe
  C:\Windows\System\OMCMiFN.exe
  2⤵
  PID:8324
- C:\Windows\System\htpxQek.exe
  C:\Windows\System\htpxQek.exe
  2⤵
  PID:8440
- C:\Windows\System\ncJaqlq.exe
  C:\Windows\System\ncJaqlq.exe
  2⤵
  PID:8356
- C:\Windows\System\kvtpOzf.exe
  C:\Windows\System\kvtpOzf.exe
  2⤵
  PID:8452
- C:\Windows\System\zvEDwfd.exe
  C:\Windows\System\zvEDwfd.exe
  2⤵
  PID:8532
- C:\Windows\System\YglfdRZ.exe
  C:\Windows\System\YglfdRZ.exe
  2⤵
  PID:8516
- C:\Windows\System\GAKxwSQ.exe
  C:\Windows\System\GAKxwSQ.exe
  2⤵
  PID:8564
- C:\Windows\System\FmDAoJa.exe
  C:\Windows\System\FmDAoJa.exe
  2⤵
  PID:8600
- C:\Windows\System\VSCrbVb.exe
  C:\Windows\System\VSCrbVb.exe
  2⤵
  PID:8632
- C:\Windows\System\vTnaxVo.exe
  C:\Windows\System\vTnaxVo.exe
  2⤵
  PID:8696
- C:\Windows\System\vKYtwZD.exe
  C:\Windows\System\vKYtwZD.exe
  2⤵
  PID:8680
- C:\Windows\System\BILEiNg.exe
  C:\Windows\System\BILEiNg.exe
  2⤵
  PID:8712
- C:\Windows\System\sHXuFdq.exe
  C:\Windows\System\sHXuFdq.exe
  2⤵
  PID:8748
- C:\Windows\System\nAIXImx.exe
  C:\Windows\System\nAIXImx.exe
  2⤵
  PID:8764
- C:\Windows\System\ZlEApGU.exe
  C:\Windows\System\ZlEApGU.exe
  2⤵
  PID:8824
- C:\Windows\System\yrdpwdZ.exe
  C:\Windows\System\yrdpwdZ.exe
  2⤵
  PID:8808
- C:\Windows\System\jsLZdpC.exe
  C:\Windows\System\jsLZdpC.exe
  2⤵
  PID:8840
- C:\Windows\System\FnmKNTA.exe
  C:\Windows\System\FnmKNTA.exe
  2⤵
  PID:8924
- C:\Windows\System\sstPOpd.exe
  C:\Windows\System\sstPOpd.exe
  2⤵
  PID:8988
- C:\Windows\System\HnbIheS.exe
  C:\Windows\System\HnbIheS.exe
  2⤵
  PID:9080
- C:\Windows\System\hnTThlD.exe
  C:\Windows\System\hnTThlD.exe
  2⤵
  PID:9120
- C:\Windows\System\DQYoODE.exe
  C:\Windows\System\DQYoODE.exe
  2⤵
  PID:8876
- C:\Windows\System\VmGbgeL.exe
  C:\Windows\System\VmGbgeL.exe
  2⤵
  PID:9212
- C:\Windows\System\jlvQCAG.exe
  C:\Windows\System\jlvQCAG.exe
  2⤵
  PID:9000
- C:\Windows\System\CZUWieg.exe
  C:\Windows\System\CZUWieg.exe
  2⤵
  PID:8968
- C:\Windows\System\rLIyBXo.exe
  C:\Windows\System\rLIyBXo.exe
  2⤵
  PID:9100
- C:\Windows\System\LwOuXpC.exe
  C:\Windows\System\LwOuXpC.exe
  2⤵
  PID:9168
- C:\Windows\System\oxgDTFl.exe
  C:\Windows\System\oxgDTFl.exe
  2⤵
  PID:8280
- C:\Windows\System\vhpwRuQ.exe
  C:\Windows\System\vhpwRuQ.exe
  2⤵
  PID:6636
- C:\Windows\System\CTQypRZ.exe
  C:\Windows\System\CTQypRZ.exe
  2⤵
  PID:8404
- C:\Windows\System\Asxzkyf.exe
  C:\Windows\System\Asxzkyf.exe
  2⤵
  PID:8388
- C:\Windows\System\WTyCZqR.exe
  C:\Windows\System\WTyCZqR.exe
  2⤵
  PID:8360
- C:\Windows\System\msPumMQ.exe
  C:\Windows\System\msPumMQ.exe
  2⤵
  PID:6968
- C:\Windows\System\fkiYRkS.exe
  C:\Windows\System\fkiYRkS.exe
  2⤵
  PID:8484
- C:\Windows\System\ZyTInlZ.exe
  C:\Windows\System\ZyTInlZ.exe
  2⤵
  PID:8584
- C:\Windows\System\JdQzqKm.exe
  C:\Windows\System\JdQzqKm.exe
  2⤵
  PID:8776
- C:\Windows\System\QhvLYrY.exe
  C:\Windows\System\QhvLYrY.exe
  2⤵
  PID:8792
- C:\Windows\System\CJqMINY.exe
  C:\Windows\System\CJqMINY.exe
  2⤵
  PID:8956
- C:\Windows\System\mTeOdnP.exe
  C:\Windows\System\mTeOdnP.exe
  2⤵
  PID:9032
- C:\Windows\System\IIISAki.exe
  C:\Windows\System\IIISAki.exe
  2⤵
  PID:9136
- C:\Windows\System\sxhpVQy.exe
  C:\Windows\System\sxhpVQy.exe
  2⤵
  PID:9180
- C:\Windows\System\DuwUPCr.exe
  C:\Windows\System\DuwUPCr.exe
  2⤵
  PID:8568
- C:\Windows\System\pqOycpS.exe
  C:\Windows\System\pqOycpS.exe
  2⤵
  PID:8296
- C:\Windows\System\bdCWqlc.exe
  C:\Windows\System\bdCWqlc.exe
  2⤵
  PID:8724
- C:\Windows\System\CPICCyg.exe
  C:\Windows\System\CPICCyg.exe
  2⤵
  PID:8728
- C:\Windows\System\cliHBUV.exe
  C:\Windows\System\cliHBUV.exe
  2⤵
  PID:8856
- C:\Windows\System\LkFXaZm.exe
  C:\Windows\System\LkFXaZm.exe
  2⤵
  PID:8920
- C:\Windows\System\dHjykZz.exe
  C:\Windows\System\dHjykZz.exe
  2⤵
  PID:9048
- C:\Windows\System\VcAALCr.exe
  C:\Windows\System\VcAALCr.exe
  2⤵
  PID:8908
- C:\Windows\System\llEYPGu.exe
  C:\Windows\System\llEYPGu.exe
  2⤵
  PID:9200
- C:\Windows\System\PjHGLoB.exe
  C:\Windows\System\PjHGLoB.exe
  2⤵
  PID:8612
- C:\Windows\System\vmzuxNp.exe
  C:\Windows\System\vmzuxNp.exe
  2⤵
  PID:8436
- C:\Windows\System\LIwhCgm.exe
  C:\Windows\System\LIwhCgm.exe
  2⤵
  PID:8692
- C:\Windows\System\ZhmtOfn.exe
  C:\Windows\System\ZhmtOfn.exe
  2⤵
  PID:9152
- C:\Windows\System\AAGVMIp.exe
  C:\Windows\System\AAGVMIp.exe
  2⤵
  PID:9068
- C:\Windows\System\fxlEDjx.exe
  C:\Windows\System\fxlEDjx.exe
  2⤵
  PID:8420
- C:\Windows\System\wNLtCmp.exe
  C:\Windows\System\wNLtCmp.exe
  2⤵
  PID:9220
- C:\Windows\System\hnGLtoA.exe
  C:\Windows\System\hnGLtoA.exe
  2⤵
  PID:9236
- C:\Windows\System\YmneIub.exe
  C:\Windows\System\YmneIub.exe
  2⤵
  PID:9252
- C:\Windows\System\iFwTmTY.exe
  C:\Windows\System\iFwTmTY.exe
  2⤵
  PID:9268
- C:\Windows\System\UYduyjI.exe
  C:\Windows\System\UYduyjI.exe
  2⤵
  PID:9284
- C:\Windows\System\meaKJkv.exe
  C:\Windows\System\meaKJkv.exe
  2⤵
  PID:9300
- C:\Windows\System\kpnjXly.exe
  C:\Windows\System\kpnjXly.exe
  2⤵
  PID:9316
- C:\Windows\System\DXyxAhr.exe
  C:\Windows\System\DXyxAhr.exe
  2⤵
  PID:9332
- C:\Windows\System\ibxsDkn.exe
  C:\Windows\System\ibxsDkn.exe
  2⤵
  PID:9348
- C:\Windows\System\StuuqRG.exe
  C:\Windows\System\StuuqRG.exe
  2⤵
  PID:9364
- C:\Windows\System\TQvcvrZ.exe
  C:\Windows\System\TQvcvrZ.exe
  2⤵
  PID:9380
- C:\Windows\System\gEQwipU.exe
  C:\Windows\System\gEQwipU.exe
  2⤵
  PID:9396
- C:\Windows\System\VGuOgaj.exe
  C:\Windows\System\VGuOgaj.exe
  2⤵
  PID:9412
- C:\Windows\System\wsPFAuU.exe
  C:\Windows\System\wsPFAuU.exe
  2⤵
  PID:9428
- C:\Windows\System\bCOBrez.exe
  C:\Windows\System\bCOBrez.exe
  2⤵
  PID:9444
- C:\Windows\System\IURkqHn.exe
  C:\Windows\System\IURkqHn.exe
  2⤵
  PID:9460
- C:\Windows\System\cjYGplW.exe
  C:\Windows\System\cjYGplW.exe
  2⤵
  PID:9476
- C:\Windows\System\YMpzvYh.exe
  C:\Windows\System\YMpzvYh.exe
  2⤵
  PID:9492
- C:\Windows\System\ZUGQjvc.exe
  C:\Windows\System\ZUGQjvc.exe
  2⤵
  PID:9508
- C:\Windows\System\yHDmwIO.exe
  C:\Windows\System\yHDmwIO.exe
  2⤵
  PID:9524
- C:\Windows\System\wkFWEwX.exe
  C:\Windows\System\wkFWEwX.exe
  2⤵
  PID:9540
- C:\Windows\System\HGJlkAG.exe
  C:\Windows\System\HGJlkAG.exe
  2⤵
  PID:9556
- C:\Windows\System\WqhotYl.exe
  C:\Windows\System\WqhotYl.exe
  2⤵
  PID:9572
- C:\Windows\System\DDAFgXA.exe
  C:\Windows\System\DDAFgXA.exe
  2⤵
  PID:9588
- C:\Windows\System\ZsXPtXZ.exe
  C:\Windows\System\ZsXPtXZ.exe
  2⤵
  PID:9604
- C:\Windows\System\EigkFeX.exe
  C:\Windows\System\EigkFeX.exe
  2⤵
  PID:9620
- C:\Windows\System\mGZxRXq.exe
  C:\Windows\System\mGZxRXq.exe
  2⤵
  PID:9636
- C:\Windows\System\UviRWdR.exe
  C:\Windows\System\UviRWdR.exe
  2⤵
  PID:9652
- C:\Windows\System\YnlunAS.exe
  C:\Windows\System\YnlunAS.exe
  2⤵
  PID:9668
- C:\Windows\System\dXiAYSM.exe
  C:\Windows\System\dXiAYSM.exe
  2⤵
  PID:9684
- C:\Windows\System\SDuLkfm.exe
  C:\Windows\System\SDuLkfm.exe
  2⤵
  PID:9700
- C:\Windows\System\iXNasUz.exe
  C:\Windows\System\iXNasUz.exe
  2⤵
  PID:9716
- C:\Windows\System\ILAAuRd.exe
  C:\Windows\System\ILAAuRd.exe
  2⤵
  PID:9732
- C:\Windows\System\Xboxevw.exe
  C:\Windows\System\Xboxevw.exe
  2⤵
  PID:9748
- C:\Windows\System\GLwEYGX.exe
  C:\Windows\System\GLwEYGX.exe
  2⤵
  PID:9764
- C:\Windows\System\absvhWK.exe
  C:\Windows\System\absvhWK.exe
  2⤵
  PID:9780
- C:\Windows\System\NTLtuSb.exe
  C:\Windows\System\NTLtuSb.exe
  2⤵
  PID:9796
- C:\Windows\System\laEewnB.exe
  C:\Windows\System\laEewnB.exe
  2⤵
  PID:9812
- C:\Windows\System\RzkqYQv.exe
  C:\Windows\System\RzkqYQv.exe
  2⤵
  PID:9828
- C:\Windows\System\CCboRtP.exe
  C:\Windows\System\CCboRtP.exe
  2⤵
  PID:9844
- C:\Windows\System\nGiUuGW.exe
  C:\Windows\System\nGiUuGW.exe
  2⤵
  PID:9860
- C:\Windows\System\GnXANGx.exe
  C:\Windows\System\GnXANGx.exe
  2⤵
  PID:9880
- C:\Windows\System\jBSlzWl.exe
  C:\Windows\System\jBSlzWl.exe
  2⤵
  PID:9896
- C:\Windows\System\prCAIaA.exe
  C:\Windows\System\prCAIaA.exe
  2⤵
  PID:9912
- C:\Windows\System\NwvMVLS.exe
  C:\Windows\System\NwvMVLS.exe
  2⤵
  PID:9928
- C:\Windows\System\fmfkhlT.exe
  C:\Windows\System\fmfkhlT.exe
  2⤵
  PID:9944
- C:\Windows\System\tggOccF.exe
  C:\Windows\System\tggOccF.exe
  2⤵
  PID:9960
- C:\Windows\System\JRjZNZM.exe
  C:\Windows\System\JRjZNZM.exe
  2⤵
  PID:9976
- C:\Windows\System\GSgkaQP.exe
  C:\Windows\System\GSgkaQP.exe
  2⤵
  PID:9992
- C:\Windows\System\LsoKZrc.exe
  C:\Windows\System\LsoKZrc.exe
  2⤵
  PID:10008
- C:\Windows\System\XMrSohj.exe
  C:\Windows\System\XMrSohj.exe
  2⤵
  PID:10024
- C:\Windows\System\DoAlAJk.exe
  C:\Windows\System\DoAlAJk.exe
  2⤵
  PID:10040
- C:\Windows\System\PyKlwly.exe
  C:\Windows\System\PyKlwly.exe
  2⤵
  PID:10056
- C:\Windows\System\bHphJLQ.exe
  C:\Windows\System\bHphJLQ.exe
  2⤵
  PID:10072
- C:\Windows\System\dmopYBM.exe
  C:\Windows\System\dmopYBM.exe
  2⤵
  PID:10088
- C:\Windows\System\WnMHNtN.exe
  C:\Windows\System\WnMHNtN.exe
  2⤵
  PID:10104
- C:\Windows\System\nlfYBaW.exe
  C:\Windows\System\nlfYBaW.exe
  2⤵
  PID:10120
- C:\Windows\System\mimlWhP.exe
  C:\Windows\System\mimlWhP.exe
  2⤵
  PID:10136
- C:\Windows\System\LrPUVmr.exe
  C:\Windows\System\LrPUVmr.exe
  2⤵
  PID:10152
- C:\Windows\System\NIJpwjk.exe
  C:\Windows\System\NIJpwjk.exe
  2⤵
  PID:10168
- C:\Windows\System\SccwVQI.exe
  C:\Windows\System\SccwVQI.exe
  2⤵
  PID:10184
- C:\Windows\System\vSIjBZD.exe
  C:\Windows\System\vSIjBZD.exe
  2⤵
  PID:10200
- C:\Windows\System\kYEOzWj.exe
  C:\Windows\System\kYEOzWj.exe
  2⤵
  PID:10216
- C:\Windows\System\kaTWRDT.exe
  C:\Windows\System\kaTWRDT.exe
  2⤵
  PID:10232
- C:\Windows\System\lrHnjNN.exe
  C:\Windows\System\lrHnjNN.exe
  2⤵
  PID:8488
- C:\Windows\System\FItOrqL.exe
  C:\Windows\System\FItOrqL.exe
  2⤵
  PID:9248
- C:\Windows\System\jBMhdpA.exe
  C:\Windows\System\jBMhdpA.exe
  2⤵
  PID:9096
- C:\Windows\System\eKyzkEo.exe
  C:\Windows\System\eKyzkEo.exe
  2⤵
  PID:9228
- C:\Windows\System\wGMRWfs.exe
  C:\Windows\System\wGMRWfs.exe
  2⤵
  PID:9276
- C:\Windows\System\rgvDQXt.exe
  C:\Windows\System\rgvDQXt.exe
  2⤵
  PID:9340
- C:\Windows\System\lZKJQRD.exe
  C:\Windows\System\lZKJQRD.exe
  2⤵
  PID:9404
- C:\Windows\System\LydsEXQ.exe
  C:\Windows\System\LydsEXQ.exe
  2⤵
  PID:9324
- C:\Windows\System\cGyldst.exe
  C:\Windows\System\cGyldst.exe
  2⤵
  PID:9328
- C:\Windows\System\qKruZLa.exe
  C:\Windows\System\qKruZLa.exe
  2⤵
  PID:9392
- C:\Windows\System\mFOQSDz.exe
  C:\Windows\System\mFOQSDz.exe
  2⤵
  PID:9452
- C:\Windows\System\JEpEVXK.exe
  C:\Windows\System\JEpEVXK.exe
  2⤵
  PID:9484
- C:\Windows\System\SaEDbsV.exe
  C:\Windows\System\SaEDbsV.exe
  2⤵
  PID:9536
- C:\Windows\System\uTzHvsD.exe
  C:\Windows\System\uTzHvsD.exe
  2⤵
  PID:9600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABgBXaE.exe

Filesize
1.7MB

MD5
11e9bffa09e422856c309af71888f62f

SHA1
60a05c141349fcb86f6cc8dde473a0b64624aa24

SHA256
57a1b3be7ef07fb1c597a5f77cde7dbb4c81c9c84d82529683c370cbd664d094

SHA512
68b372fcec8b955c471f070765ce1f1033668223852be8510d23cf1e320298ff788a898e94d2f8ff1e3c2c6232d6a81f8a97132e12ba182e9cd1d5975e2468e7

Download Submit
C:\Windows\system\AhXYksM.exe

Filesize
1.7MB

MD5
91a0a96b4d7268025359c5b552691247

SHA1
3f474bba405cdaf7c5ba7d92a902b7ecda854065

SHA256
0fd644cb12ce37464758ce7a16ce0d0723a7e8f11ba2c55764b676baf545e8e3

SHA512
7ab5d90488e6fc6756fa245863faae19c4f0a54c4578b6707f605a73521297ed50666ca286333eecf6f1bf6e6bd7b1c873297909995aab61bd204095208dc418

Download Submit
C:\Windows\system\HtLCZbg.exe

Filesize
1.7MB

MD5
1e8477abe40733e189ad7c3a25d07734

SHA1
b66cd2c9e2cd1a77c0015422b00c90d12467f804

SHA256
e4555bf5125903380feb36fc24d1c103c35ecae068369fc9e52e22a413d2e3f7

SHA512
8a3d831b47bc058cf2d60f7a77ae526a76adce025df8b55df88615ad08b3c14e43e7668f2b7e39ab84dbdff2fa2afd335dbe45e80190eec38812d4db284299d5

Download Submit
C:\Windows\system\KwEIYkd.exe

Filesize
1.7MB

MD5
268a6f762ca60b3a14cf3db54657bc98

SHA1
6a7ea8913b8c4c6a6d403af310e732d5a7828281

SHA256
a2218061d24ea5016f5ad434a22420c6af05c33b2d8cf87332ad5e8ec2d61923

SHA512
b0a89559d49ad7b7f00b7cd65a9627b60dfa3d876d52f04db0da35030c4236929c8ed6d1e51ea2031f8f5ae9831d592770b4a93ae1628128ddadb4d5e0744921

Download Submit
C:\Windows\system\OYirzCF.exe

Filesize
1.7MB

MD5
0c0e0f30563d31eff2a9c2f7da04c2e3

SHA1
cbb3b039fdeeea8114a6ca805e86b14a200eba78

SHA256
e48d04c8e1d0a1d2415e5386aa89aee15818e694c7fc82043d4da679a672ee5d

SHA512
67da80b863e3f5f11479c19e573b82175a92f8bbee78e39930eb9f0e18253b43174339524c141076a6ef489820d38d6aa2243392b20e01f0370118bf15c77a1f

Download Submit
C:\Windows\system\UhYRnMY.exe

Filesize
1.7MB

MD5
73ceda174b349bc6b335e848fdfeb0bf

SHA1
5c906bb16d7666f8bbdc398cf9317dbac75481fe

SHA256
3f9882dc2d02c89a5ae331d0b4e8662c1a163b1d573074aad67d43e297b7e14e

SHA512
773779f0a0ffbf80d5cd709c9e4fda578462e42ae8cfd951572d6dc24f3f00f9141b77c24fe214e6840f4e832ab8a0feb2f832b3efa031d50aa2dbce48170b58

Download Submit
C:\Windows\system\WDYirFl.exe

Filesize
1.7MB

MD5
c85e1cf27f4bc61fc4ac3f6e15cac696

SHA1
85a1c8a9eb53ea91f1942b21cc7bacd3b305c88f

SHA256
a601efb79cb920498360ba23ba053c7936469a4a00dce7deb773197cefced7a4

SHA512
d0f5932910800090febd4739dadac383d2194177ac2b9608f2e06fb5c672a4251eed0d244a22bb14b7c4da28ff3e76f60264fac6dbc947e71e0b895f708d6f81

Download Submit
C:\Windows\system\WFTkYMA.exe

Filesize
1.7MB

MD5
5bcfd9376b92d186c6d7a350d736c338

SHA1
9c49e8f4c11e3546f31917ac3ab9deee4334d28b

SHA256
f11a41932067d82a52f11ec7710a19589505b19f79837b5fa769c0b16828d5ed

SHA512
4dff6c0be8beae28f0b17e832372be18f6886b4f2431ad5f5e255ceeb03f70ed3ca1e195a8ab5f9613fb26cc2bfbf02c7592bfdb25cd18f357a40fca465ec15a

Download Submit
C:\Windows\system\XrRmOlB.exe

Filesize
1.7MB

MD5
dd9310e41740da18aaaa0566865bf12a

SHA1
13ae31270fa1d6f147d36dd0211e8710917722aa

SHA256
7c59295bee22ca04dd80af0a85c4a911b75b85b622c484b4dcc483240ab5d40a

SHA512
a2477086284143d218227e750537a7179d1066b1a0273ad4acd5a4ea2e7607bcab628614c69d8fc307a1dede666d7d30e2978626530b84bdb12ccecffb19a435

Download Submit
C:\Windows\system\bHdYcgv.exe

Filesize
1.7MB

MD5
8d63200118ddf8ec912ccc69b678376b

SHA1
73fab4b8aeb5ca90beacd5af5e57ff25d8b5289d

SHA256
8ae8a0997d72f7b818d54ab15823bb5f4b91558930398ae9af0624feaeb20351

SHA512
1c185b0808feb5112ed588c0b26a993b39bad0a776ccff181d9243ce5cf3a4b6f1df431bac081a360292801e1ea7dc65ced16ea6ca5431199477557ecce5dd7f

Download Submit
C:\Windows\system\bSDUThe.exe

Filesize
1.7MB

MD5
d767eb19e739ebdc07c463fb66948aed

SHA1
75c6f8dfc0e1bf920fc8e23bf7a2721d8621aa94

SHA256
1c213ba7b6e7f9a417170e093e7ea422dce3df4607fe63f6b16af612969e582b

SHA512
55ae4752f7f96ad2afb4f2405ceba573e1f2292a0a23081a9ad37bc4762b39bca74332c46bc099dfb8ae94f47855f598e271fd264f6bc0d77308fa299c1d355a

Download Submit
C:\Windows\system\exesuWP.exe

Filesize
1.7MB

MD5
bf590f125e996d938bf6cacfaa228cec

SHA1
3f771fc408c1aa6d566b4973eef2dcec52a5b223

SHA256
d8f65b753448a17d620b441d1477d7a222664e5c2f9cb09e4f4ac321b12e15c2

SHA512
2084847e81e81fbb0df27d9cec620faf65c64ae4bbd31751b4c8b7985fcecf855b93588d8b8695b0679f6ad8b26c88c158b1b42f8c87fafff4aa97197b39e9f2

Download Submit
C:\Windows\system\iMYTsPR.exe

Filesize
1.7MB

MD5
5fa8de21601108670f880c21185662e9

SHA1
a4e3338528acb125ef9e8f2ae2c6c2bb10e9d3bd

SHA256
67a6724f816ba9c5a3ae5000c18bd397af6f386a7889cf6a092d356e6bccefb9

SHA512
3400b756fc27e1f51c69173ef189a505fef8c9244ae3f331fdc734243c9bfebdc25457b1a3c7b0470e2ecff3fdfb7a937076b87d2e27cd219017e8a65f633c63

Download Submit
C:\Windows\system\lGgpWKu.exe

Filesize
1.7MB

MD5
29ab6aef3a81a9180e1766b11cce6b38

SHA1
812cc8eaf02de9f1f3ed843b506cbd8ba05c242c

SHA256
946ee05388e6a2abafdcd1ce8b5137c22d8ca704f37cb6fd8bfda3a20bb1001b

SHA512
273fa75c82622fa9359e25d7ac4da4663fb6737b7db0764757009c8bcde9bfbb4828259a1aa8bb002931a04350e541f27b85dc6c18c447bc6fc9ba505e22e238

Download Submit
C:\Windows\system\mjRbWDk.exe

Filesize
1.7MB

MD5
8b4a27b84c2e23ebc182046b47725044

SHA1
622d50a40adcea09320fdc7b6c4777f1da6b3cbe

SHA256
05eed65a950d483186d569ce7eafe8aa0c7d0d1b4023ea9d0bb8a82007cdb438

SHA512
a512f04c914f0a6784dc2d2af87cd8fb2c16765e154dca0f80e99a47fa307e6cc4dd2d439e3313d726fd0b5a94c34b83e62e4f8f84c7630a3ad3d20b6738a661

Download Submit
C:\Windows\system\nomkaSg.exe

Filesize
1.7MB

MD5
e000ba00b781b2967a9ce07486082d4b

SHA1
8e059b7c966f0c64f4f1e6c5a4b520a2bd5a0140

SHA256
bcf371d5db8a0c098e36578b73992f0cd70cfb85779f4ddbc122ed1180f9e4cb

SHA512
2e1e2b149f6e724a96da480aa8f94db9098e64ed4145beda5deec628bb4495f3a118618dd4686fba10be4dc5174845332bf7685f4ea802fb02677486243092c0

Download Submit
C:\Windows\system\vKnXfZf.exe

Filesize
1.7MB

MD5
79d6f3b86d7bbb178c2c58bdb0f5b2f6

SHA1
3252365038f4b5f7a9c42f310bfd57a626cc1c94

SHA256
700d5cdcd119f2c4b96953da289d477ce35ec1dea695871462f948fe88dbce5d

SHA512
4518f6ae94ccf7497a1d8db4ad9b89d13dab7622d23414a4deaa0fc7e7d73bdf7afeebda65bb3b98b178ebe70ff218be08a05523fdda2af016da5c2033347ad2

Download Submit
C:\Windows\system\vbRqpBb.exe

Filesize
1.7MB

MD5
7a8bc496e9cd3ab835071638c938de3c

SHA1
4b00402c280b08ee86aaea9666251c8dcbcaf12f

SHA256
52a4d50060959682fccbaaa9fd94ad094484e04ba82aa9e370d0037e1dd1ca97

SHA512
de5e0b880d0e51dccb3fd2e0daff5a37615cf9dc7e64efa3f6ce94867caf4500799d20d2b2097db6ff8f2e1f570d706064bee03115bceef15bbd23be79836458

Download Submit
C:\Windows\system\ziyfChx.exe

Filesize
1.7MB

MD5
cede41f510a19d84506973a06cac9bab

SHA1
1302e8d219f3d9b7092149d4640f8cf66ae7ccf6

SHA256
19a763fb1fc5bf0a63fb9a41c466962aea393ecdbc4fae2d68dcebe4a09be255

SHA512
f2ff03a9644b5017e5be604b30c81a0b8be71bdeb8b631890f54ceb5603299be8eef5bbbb3fd355e09c4b61c84a9ea084c6d9d9ee03f6618c50ec71598293411

Download Submit
\Windows\system\BeVnsMn.exe

Filesize
1.7MB

MD5
54e10acb85c9d083f845550012017315

SHA1
85f8c3874ba39a465a20372eca94e739b06f559c

SHA256
12cff6284c4c90789af5c5ef7670ae96d607ced9b45775c55be4067462ce7d6d

SHA512
211fee9fad34707ab937187693fc6fe1cb363c8bc765ef3e055ebf5f600b650074a0dbff965c6be8b8767c7ea7bd1210fffcade9cbf0bb553d48e212eb6d20ec

Download Submit
\Windows\system\BfgdxOK.exe

Filesize
1.7MB

MD5
a0bb8ee2687ec85c4bb3bd6dcb805fb7

SHA1
2d9d35c4bd4e7cbc2b6fd7a402cb46d7c137d9e0

SHA256
5c66e590b8ebecb87ba416fe3207083ac7324ee11fe8b99c5267531382f173ba

SHA512
6c090d0a2b674920a9f8e62fd45bf912487c27ccf14a8d07f23324f73cba46a9214c792c07eb28996ff67657b5e753023e223d693b65f759379a7b2b84aed991

Download Submit
\Windows\system\EFgwmpk.exe

Filesize
1.7MB

MD5
2384d3e6003e7f1914f2ab0a60321101

SHA1
575e92e4f9e20222d43488dcd4af913f9ab346ff

SHA256
39f5946ebd833f2b0375c2894dfa7be5815ba8629ed1071cc008eace02e0b648

SHA512
3288827d98cc48eb6e58d6940f80b3a996d3a1f9c7131752c42e004e43ab7d5c01555482197a1c7f57466278207b607d49e6c8c73f908bfbfe23dab5e89f7458

Download Submit
\Windows\system\EiVHnjo.exe

Filesize
1.7MB

MD5
d35edf5a9c220eae032239d81ac92638

SHA1
2ae914e6e1eed010efc9d9de606d3e385f323078

SHA256
4ee1ba5c436cbd65d82d85fb8b0b1991cf2aea016dca7ced3a5f38584222ecaf

SHA512
1a8b3d3c142a01e0562d8f234cdff84197f77e0bdfd763f21a926b942a954af6a07fe83563a876052c293ae1ec97745485c4162b2018c05f77c756c7c868c4d7

Download Submit
\Windows\system\JFkGyGV.exe

Filesize
1.7MB

MD5
6d18b4d979da5c6e51de7ac951dd4a7d

SHA1
7e924f4fa0be4ab7916bc10fbeecc1706f15fb4d

SHA256
a9e379efec0d643d3a848cfa4353d56a3b42f4acb6ba4022d4d84fa09dbaf844

SHA512
5052c550716d4bb031464a5516655b3b956ad05a867f439005769810a39a4b054fc75e5767440de1469526024834d6f89f1fb4ae29f59b20a9546b062dcccc89

Download Submit
\Windows\system\JNAgisA.exe

Filesize
1.7MB

MD5
f2612c22108ca2d5281dc1b8c8693cd3

SHA1
6570c01e0d584023b409642bbf9c7e74ffbdc516

SHA256
7f7680debd27e73de63920fecbed0998db77890bb8e7a12d142b61e55a47283c

SHA512
178bdff66ffbbf5a16a588e170ebfb0e48005ddc7f78080024d46c4d4def0517c3971743bfe608efaaae9e7d49787a9909df4a5b86edc2992d7480bb76e6fb11

Download Submit
\Windows\system\TVyUtAD.exe

Filesize
1.7MB

MD5
b95c0367fb2313a1fcf202f7d5ac4bab

SHA1
5cb042fd9b74a916c46a3522019c8e0b36027f38

SHA256
5a12b597529890511d09f1373bcc2c4cd23784c36fa1743fc91981a64a76874b

SHA512
d79f37515b45a272a0f4084abf192f95a06ab63f71840808ec52250a39dd9068e37af1465af9355657e69a1c6c25dd56b0ed0879312012c69c22ba90793abe4f

Download Submit
\Windows\system\URztQUy.exe

Filesize
1.7MB

MD5
73774fd48455b7bb293252a6a05da5a7

SHA1
4b18e57d5ac9605ce7f30446a17605e8f2e372fa

SHA256
6398a67d29dc1e789521a767db036d197851247ad64c28044c8db00ee3adb474

SHA512
e3d6e16299f960f5c6cb93701e4b3acd33b8cf5ac36b50faff2d5d61852540d2e4560829b9675a9083471bbb7c89c6e8f02a9450968d88da96ac7fce7c9c99b8

Download Submit
\Windows\system\UvInxMB.exe

Filesize
1.7MB

MD5
6b09ef549b788034a63f42268bcf1756

SHA1
372b353cd6ab5c9faab894f517fde99b9962610f

SHA256
e88977e6e790238a98de2c6c49eaa11e68807d8167a7b94984621c893754492e

SHA512
038b110411c30e3003e578ff4faeff8810ecf459dcb59be32222ae29cb57c38edd88cbf878ac89d6649fabb90765a7be1f6645916fecec84626a266fdf4e7aea

Download Submit
\Windows\system\gYzbghF.exe

Filesize
1.7MB

MD5
886e1155313cbf192378784ed06893c3

SHA1
8bd683c98fb062ff67c5f4e0734ff955b772f824

SHA256
c521e4c11c01ef2acbd021ea38fa8d7393d68ee49bf674aacbba7303b34f47e5

SHA512
d7657081e62549368de05011c6b426b25a4eb2939de2ee6db9b4966c6eb0cc2437d5de83a07d5e57a510e08785930c129f53e707e14f3c7704fee21cba95d7aa

Download Submit
\Windows\system\gvWiWyw.exe

Filesize
1.7MB

MD5
7c59f38c00138746140f98f109630b16

SHA1
6d7dfefd55e1050fb5eab34c8998e8cd209f75fb

SHA256
eef0b61c41b9a6efc199ce7c2b0af4d9752548dd2e0b9b01449570d84ced3bf1

SHA512
61ee4e03364cf24849ae3ffb4f5f6791ebe1767311c9ed34fd75f05ff1be1864593c688e86e354f7d6c6b502844b5bdb6981ab2f5650fd914fece6244610efd5

Download Submit
\Windows\system\kcMSqyN.exe

Filesize
1.7MB

MD5
e0f7e67023af86d529d771ee1490dcee

SHA1
5693e36a61b80066a16b1f9bc53e6740bd691643

SHA256
eb87601d5ced255e6885a4639e91a3fbb91c5b6c47b50147bcc834894efcb852

SHA512
248000035b078298ae0281bbd3d2e594d095926a6c8ce3df434757a799d189de588aaa2b2bfcfb6fccee2d8ed37a6f527fd1669633d1f563e3c8f426af6ede08

Download Submit
\Windows\system\pyexveq.exe

Filesize
1.7MB

MD5
4a0c9c70d26d7d806143f620c14fc926

SHA1
2368be7b516f9a1bc8c921f9c0a67d04db758cb8

SHA256
f3fd6b35b149b4d128ee18ea999fb3f666d65bcac0696cae3bc2d3e4388df67f

SHA512
e7b9184496fe9b5dcbe9ef8c3d595089cf15eb6f2cf2dfdaa62a66d57bb14086c87f227f376c9642318042a23008c572bfbd857d170eaec3fd847bd0e37e45b9

Download Submit
\Windows\system\wLsHKvQ.exe

Filesize
1.7MB

MD5
a0254478a902f690840a696d18617308

SHA1
9ed7341e5c123c04cb36b6a065f4c6cab541f1e5

SHA256
b5ca2be478796c1d17c06ceace652f90fd3db901885b565049a8dfdd81c9d1c2

SHA512
dcc1862e5ef591c48a045bb77e9fa1cce0603f998af2cffe2cf2da421c315561dde0d138fac54b21e0a857c52a52ee3f47e97408276b87e028a726c8f3c37c29

Download Submit
memory/2100-19-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2100-42-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-92-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2100-83-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2100-1039-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2100-95-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-0-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2100-72-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-64-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2100-75-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-21-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2100-61-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2100-30-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2100-33-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/2100-4376-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-5-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2100-56-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2100-4544-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-6569-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2100-22-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-9106-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2124-48-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2124-43-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2332-14-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2332-62-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2332-4841-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2432-6220-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2432-97-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2504-82-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-39-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-66-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2604-40-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2604-93-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2604-4828-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2608-4827-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-49-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-334-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-4881-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2640-20-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2780-73-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2780-5537-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2960-4547-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2960-88-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2960-6229-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/3008-57-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/3052-4826-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-23-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download