xmrig | b56c1ff9ba4941f75ec83231f5b84400f91ebe13b4fa5322066e7515a903a690

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
Size

2.1MB
MD5

5b11724d49db1957863970be63ec4131
SHA1

fb8253b72f776d7e75ab6a82f0ad2e6a686b3b52
SHA256

b56c1ff9ba4941f75ec83231f5b84400f91ebe13b4fa5322066e7515a903a690
SHA512

29391856f20a891afadbdc8881015f4c4909574a3838959c5c43d40da9a961a4ab0677c2edb61a83f91d39877a276efd6b5b3963bb9680e1ae15ebf4476217ed
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMF:NABd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2672-204-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2520-4529-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2996-4532-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2472-4539-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2440-4542-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/1780-4540-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2716-4537-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2672-4536-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2556-4535-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2564-4534-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2596-4533-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2152-4531-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2440-215-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/1780-213-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2716-212-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2556-211-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2472-222-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2564-206-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2596-200-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2152-197-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2520-13-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/1632-12482-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2236	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2520	qNBvxEw.exe
2152	sMkFTdC.exe
2996	NRDrZqY.exe
2596	TxAqBOu.exe
2672	uNOjkRs.exe
2564	GRkioIU.exe
2556	khmDBCl.exe
2716	pdUNELR.exe
1780	dHeZnLw.exe
2440	zkazWOZ.exe
2472	leyETTZ.exe
2488	mJUVZcZ.exe
1224	eKwLKMQ.exe
2800	qBGjKaa.exe
2176	ehOptOt.exe
2388	pxwHczq.exe
2764	pggWWxL.exe
1680	CDhhpFy.exe
2024	tBFIJwq.exe
2684	JSDpjdW.exe
2788	iHsclbz.exe
2956	cgPHbPo.exe
1936	hWsxNXm.exe
2508	HCrfzdD.exe
2500	yBIgXMY.exe
704	LzHxuRk.exe
2676	CvhyrCj.exe
956	snLapyR.exe
852	tiTqHeO.exe
1144	HzSdNYM.exe
2404	htGAaoP.exe
1764	sssBwbd.exe
1812	eYjCSPD.exe
1124	doJvOlM.exe
848	pdnvRXV.exe
1116	JFAiEQO.exe
1640	VtgdBQP.exe
2840	ujomByn.exe
288	jtHBBqq.exe
1692	cpdcuET.exe
1244	vcXFFPv.exe
2412	KDYCeRG.exe
444	KtOqMuz.exe
2828	MyosOJO.exe
1736	NtkOsdg.exe
1376	GnHYUHe.exe
1820	vfYyeir.exe
864	ncxiShw.exe
2120	wkqMHHP.exe
880	TeuCXHu.exe
2076	QWkxBxM.exe
2088	ykySIKO.exe
2988	QxpYnbq.exe
1700	mLEAKZe.exe
2868	QuJUkTW.exe
2476	QJDdkqd.exe
2452	TANPMLJ.exe
2944	IAMWaHX.exe
2012	cOpNZrE.exe
1912	wAYUpSr.exe
1824	rveFfLq.exe
748	klbIBqm.exe
1188	qvXbsiY.exe
1532	kmAqbGA.exe

Loads dropped DLL 64 IoCs

pid	Process
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-1-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x000a000000015f7a-6.dat	upx
behavioral1/files/0x000f000000005578-23.dat	upx
behavioral1/files/0x0007000000016c7c-34.dat	upx
behavioral1/files/0x0009000000016cc6-52.dat	upx
behavioral1/files/0x0007000000016d1a-56.dat	upx
behavioral1/files/0x0006000000016d57-71.dat	upx
behavioral1/files/0x0006000000016e4a-75.dat	upx
behavioral1/files/0x000500000001860c-133.dat	upx
behavioral1/files/0x0007000000016d1a-59.dat	upx
behavioral1/files/0x0006000000017407-108.dat	upx
behavioral1/files/0x0006000000018ba1-149.dat	upx
behavioral1/memory/2996-198-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2672-204-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000017371-93.dat	upx
behavioral1/files/0x000600000001737c-102.dat	upx
behavioral1/files/0x00060000000173f2-112.dat	upx
behavioral1/memory/2520-4529-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2996-4532-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2472-4539-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2440-4542-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/1780-4540-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2716-4537-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2672-4536-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2556-4535-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2564-4534-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2596-4533-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2152-4531-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2440-215-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/1780-213-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2716-212-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2556-211-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/files/0x0006000000018fbf-159.dat	upx
behavioral1/memory/2472-222-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x0006000000017374-111.dat	upx
behavioral1/files/0x0006000000016fed-98.dat	upx
behavioral1/files/0x0006000000016e24-97.dat	upx
behavioral1/memory/2564-206-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/files/0x0006000000016d51-86.dat	upx
behavioral1/memory/2596-200-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2152-197-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x0005000000018717-134.dat	upx
behavioral1/files/0x00140000000185e9-129.dat	upx
behavioral1/files/0x0006000000017422-128.dat	upx
behavioral1/files/0x000d0000000185f4-122.dat	upx
behavioral1/files/0x00060000000174a5-116.dat	upx
behavioral1/files/0x0006000000019052-164.dat	upx
behavioral1/files/0x0006000000018ed8-157.dat	upx
behavioral1/files/0x0006000000016e24-72.dat	upx
behavioral1/files/0x00060000000173f2-105.dat	upx
behavioral1/files/0x000600000001735a-90.dat	upx
behavioral1/files/0x0007000000016d3e-70.dat	upx
behavioral1/files/0x0009000000016cc6-42.dat	upx
behavioral1/files/0x0008000000016ca5-50.dat	upx
behavioral1/files/0x0007000000016d16-46.dat	upx
behavioral1/files/0x0008000000016c04-27.dat	upx
behavioral1/files/0x0007000000016c51-32.dat	upx
behavioral1/files/0x0007000000016c51-29.dat	upx
behavioral1/files/0x00090000000167d5-16.dat	upx
behavioral1/memory/2520-13-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/1632-12482-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hYsVJEV.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\XUwxaXe.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\ypQJsNE.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\VLksUyQ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\AeDCRWM.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\wBMkJJp.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\nBQjXyw.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\hupPLVP.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\rMfgDMT.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\OFAxkPJ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\VWmQskk.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\Jbrpysp.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\RFcPlwq.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\UnpOImU.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\ngQwKnE.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\MHXDHZQ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\vizDugm.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\yhMkInp.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\JgqVBdX.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\gJoftaT.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\tTQQUbP.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\dWGIEgJ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\XaJRVGk.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\FljHBEJ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\mtEdfXU.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\QQsBmeL.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\uBAPgyQ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\pXkRMBK.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\mNWHDyW.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\UZWbfJC.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\pJzCZpr.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\vIDSaWm.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\MqhuLpk.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\gutqqOB.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\egeFLEW.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\eNOEZLA.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\zIsKOzU.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\PGyqWMN.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\XRJnJQJ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\sCVpaYp.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\ZIzgHhH.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\cocHdKF.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\NdOACOb.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\LUgojRt.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\rHbgyxH.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\atqlVjU.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\uoCAeSc.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\SDzKait.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\sNNeyXH.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\dbsldcA.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\SrMAGQe.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\uEPPZye.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\RyRdLKm.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\qTDjuCY.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\cODXQMP.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\DpeCdDY.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\UYnpGdb.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\BxknHkQ.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\qodkemW.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\PotYvTs.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\LasdsWG.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\KfPkMFE.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\hVQaKpa.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
File created	C:\Windows\System\OhtiEVf.exe	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2236	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
Token: SeDebugPrivilege	2236	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2236	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	29
PID 1632 wrote to memory of 2236	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	29
PID 1632 wrote to memory of 2236	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	29
PID 1632 wrote to memory of 2520	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	30
PID 1632 wrote to memory of 2520	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	30
PID 1632 wrote to memory of 2520	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	30
PID 1632 wrote to memory of 2152	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2152	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2152	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2996	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	32
PID 1632 wrote to memory of 2996	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	32
PID 1632 wrote to memory of 2996	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	32
PID 1632 wrote to memory of 2596	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2596	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2596	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2672	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	34
PID 1632 wrote to memory of 2672	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	34
PID 1632 wrote to memory of 2672	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	34
PID 1632 wrote to memory of 2564	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2564	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2564	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2556	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2556	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2556	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	36
PID 1632 wrote to memory of 1780	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	37
PID 1632 wrote to memory of 1780	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	37
PID 1632 wrote to memory of 1780	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	37
PID 1632 wrote to memory of 2716	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2716	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2716	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2440	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2440	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2440	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2472	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2472	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2472	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2800	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	41
PID 1632 wrote to memory of 2800	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	41
PID 1632 wrote to memory of 2800	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	41
PID 1632 wrote to memory of 2488	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	42
PID 1632 wrote to memory of 2488	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	42
PID 1632 wrote to memory of 2488	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	42
PID 1632 wrote to memory of 2388	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	43
PID 1632 wrote to memory of 2388	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	43
PID 1632 wrote to memory of 2388	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	43
PID 1632 wrote to memory of 1224	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	44
PID 1632 wrote to memory of 1224	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	44
PID 1632 wrote to memory of 1224	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	44
PID 1632 wrote to memory of 2764	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2764	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2764	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2176	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	46
PID 1632 wrote to memory of 2176	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	46
PID 1632 wrote to memory of 2176	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	46
PID 1632 wrote to memory of 1936	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1936	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1936	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1680	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	48
PID 1632 wrote to memory of 1680	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	48
PID 1632 wrote to memory of 1680	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	48
PID 1632 wrote to memory of 2508	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	49
PID 1632 wrote to memory of 2508	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	49
PID 1632 wrote to memory of 2508	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	49
PID 1632 wrote to memory of 2024	1632	5b11724d49db1957863970be63ec4131_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\5b11724d49db1957863970be63ec4131_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b11724d49db1957863970be63ec4131_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\System\qNBvxEw.exe
  C:\Windows\System\qNBvxEw.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\sMkFTdC.exe
  C:\Windows\System\sMkFTdC.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\NRDrZqY.exe
  C:\Windows\System\NRDrZqY.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\TxAqBOu.exe
  C:\Windows\System\TxAqBOu.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\uNOjkRs.exe
  C:\Windows\System\uNOjkRs.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\GRkioIU.exe
  C:\Windows\System\GRkioIU.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\khmDBCl.exe
  C:\Windows\System\khmDBCl.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\dHeZnLw.exe
  C:\Windows\System\dHeZnLw.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\pdUNELR.exe
  C:\Windows\System\pdUNELR.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\zkazWOZ.exe
  C:\Windows\System\zkazWOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\leyETTZ.exe
  C:\Windows\System\leyETTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\qBGjKaa.exe
  C:\Windows\System\qBGjKaa.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\mJUVZcZ.exe
  C:\Windows\System\mJUVZcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\pxwHczq.exe
  C:\Windows\System\pxwHczq.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\eKwLKMQ.exe
  C:\Windows\System\eKwLKMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\pggWWxL.exe
  C:\Windows\System\pggWWxL.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ehOptOt.exe
  C:\Windows\System\ehOptOt.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\hWsxNXm.exe
  C:\Windows\System\hWsxNXm.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\CDhhpFy.exe
  C:\Windows\System\CDhhpFy.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\HCrfzdD.exe
  C:\Windows\System\HCrfzdD.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\tBFIJwq.exe
  C:\Windows\System\tBFIJwq.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\yBIgXMY.exe
  C:\Windows\System\yBIgXMY.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\JSDpjdW.exe
  C:\Windows\System\JSDpjdW.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\CvhyrCj.exe
  C:\Windows\System\CvhyrCj.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\iHsclbz.exe
  C:\Windows\System\iHsclbz.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\VtgdBQP.exe
  C:\Windows\System\VtgdBQP.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\cgPHbPo.exe
  C:\Windows\System\cgPHbPo.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\ujomByn.exe
  C:\Windows\System\ujomByn.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\LzHxuRk.exe
  C:\Windows\System\LzHxuRk.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\jtHBBqq.exe
  C:\Windows\System\jtHBBqq.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\snLapyR.exe
  C:\Windows\System\snLapyR.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\cpdcuET.exe
  C:\Windows\System\cpdcuET.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\tiTqHeO.exe
  C:\Windows\System\tiTqHeO.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\KDYCeRG.exe
  C:\Windows\System\KDYCeRG.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\HzSdNYM.exe
  C:\Windows\System\HzSdNYM.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\KtOqMuz.exe
  C:\Windows\System\KtOqMuz.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\htGAaoP.exe
  C:\Windows\System\htGAaoP.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\MyosOJO.exe
  C:\Windows\System\MyosOJO.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\sssBwbd.exe
  C:\Windows\System\sssBwbd.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\NtkOsdg.exe
  C:\Windows\System\NtkOsdg.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\eYjCSPD.exe
  C:\Windows\System\eYjCSPD.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\GnHYUHe.exe
  C:\Windows\System\GnHYUHe.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\doJvOlM.exe
  C:\Windows\System\doJvOlM.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\vfYyeir.exe
  C:\Windows\System\vfYyeir.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\pdnvRXV.exe
  C:\Windows\System\pdnvRXV.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\ncxiShw.exe
  C:\Windows\System\ncxiShw.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\JFAiEQO.exe
  C:\Windows\System\JFAiEQO.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\wkqMHHP.exe
  C:\Windows\System\wkqMHHP.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\vcXFFPv.exe
  C:\Windows\System\vcXFFPv.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\QWkxBxM.exe
  C:\Windows\System\QWkxBxM.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\TeuCXHu.exe
  C:\Windows\System\TeuCXHu.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\ykySIKO.exe
  C:\Windows\System\ykySIKO.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\QxpYnbq.exe
  C:\Windows\System\QxpYnbq.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\mLEAKZe.exe
  C:\Windows\System\mLEAKZe.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\QuJUkTW.exe
  C:\Windows\System\QuJUkTW.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\QJDdkqd.exe
  C:\Windows\System\QJDdkqd.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\TANPMLJ.exe
  C:\Windows\System\TANPMLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\IAMWaHX.exe
  C:\Windows\System\IAMWaHX.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\cOpNZrE.exe
  C:\Windows\System\cOpNZrE.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\wAYUpSr.exe
  C:\Windows\System\wAYUpSr.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\rveFfLq.exe
  C:\Windows\System\rveFfLq.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\klbIBqm.exe
  C:\Windows\System\klbIBqm.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\qvXbsiY.exe
  C:\Windows\System\qvXbsiY.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\kmAqbGA.exe
  C:\Windows\System\kmAqbGA.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\mjVVwol.exe
  C:\Windows\System\mjVVwol.exe
  2⤵
  PID:652
- C:\Windows\System\cYSUIBv.exe
  C:\Windows\System\cYSUIBv.exe
  2⤵
  PID:2080
- C:\Windows\System\xBzJzAm.exe
  C:\Windows\System\xBzJzAm.exe
  2⤵
  PID:2308
- C:\Windows\System\KpkALXn.exe
  C:\Windows\System\KpkALXn.exe
  2⤵
  PID:1484
- C:\Windows\System\qUkWWYq.exe
  C:\Windows\System\qUkWWYq.exe
  2⤵
  PID:676
- C:\Windows\System\XLNkTom.exe
  C:\Windows\System\XLNkTom.exe
  2⤵
  PID:1528
- C:\Windows\System\RvgwubV.exe
  C:\Windows\System\RvgwubV.exe
  2⤵
  PID:1436
- C:\Windows\System\gaSHRGv.exe
  C:\Windows\System\gaSHRGv.exe
  2⤵
  PID:2756
- C:\Windows\System\cnedGUV.exe
  C:\Windows\System\cnedGUV.exe
  2⤵
  PID:616
- C:\Windows\System\qOAwpLo.exe
  C:\Windows\System\qOAwpLo.exe
  2⤵
  PID:1660
- C:\Windows\System\EVMOxPb.exe
  C:\Windows\System\EVMOxPb.exe
  2⤵
  PID:1296
- C:\Windows\System\ExIZlWW.exe
  C:\Windows\System\ExIZlWW.exe
  2⤵
  PID:2752
- C:\Windows\System\rKvmjkq.exe
  C:\Windows\System\rKvmjkq.exe
  2⤵
  PID:976
- C:\Windows\System\QtqXcAm.exe
  C:\Windows\System\QtqXcAm.exe
  2⤵
  PID:2072
- C:\Windows\System\EKporMp.exe
  C:\Windows\System\EKporMp.exe
  2⤵
  PID:1768
- C:\Windows\System\IBcaLvo.exe
  C:\Windows\System\IBcaLvo.exe
  2⤵
  PID:2400
- C:\Windows\System\gRqZmnd.exe
  C:\Windows\System\gRqZmnd.exe
  2⤵
  PID:1592
- C:\Windows\System\mAVYtuR.exe
  C:\Windows\System\mAVYtuR.exe
  2⤵
  PID:2084
- C:\Windows\System\eniYUYU.exe
  C:\Windows\System\eniYUYU.exe
  2⤵
  PID:2192
- C:\Windows\System\fVCJDCt.exe
  C:\Windows\System\fVCJDCt.exe
  2⤵
  PID:2644
- C:\Windows\System\ZkkkZRE.exe
  C:\Windows\System\ZkkkZRE.exe
  2⤵
  PID:1732
- C:\Windows\System\NYFRnSt.exe
  C:\Windows\System\NYFRnSt.exe
  2⤵
  PID:2584
- C:\Windows\System\hTKlZou.exe
  C:\Windows\System\hTKlZou.exe
  2⤵
  PID:2612
- C:\Windows\System\ussakPE.exe
  C:\Windows\System\ussakPE.exe
  2⤵
  PID:2516
- C:\Windows\System\dYsPJbI.exe
  C:\Windows\System\dYsPJbI.exe
  2⤵
  PID:2656
- C:\Windows\System\ByWjInM.exe
  C:\Windows\System\ByWjInM.exe
  2⤵
  PID:2328
- C:\Windows\System\MCOlSBl.exe
  C:\Windows\System\MCOlSBl.exe
  2⤵
  PID:1940
- C:\Windows\System\vizDugm.exe
  C:\Windows\System\vizDugm.exe
  2⤵
  PID:2836
- C:\Windows\System\cNJpkbb.exe
  C:\Windows\System\cNJpkbb.exe
  2⤵
  PID:556
- C:\Windows\System\dAOoHRL.exe
  C:\Windows\System\dAOoHRL.exe
  2⤵
  PID:1036
- C:\Windows\System\REeiLHh.exe
  C:\Windows\System\REeiLHh.exe
  2⤵
  PID:1808
- C:\Windows\System\SCglREE.exe
  C:\Windows\System\SCglREE.exe
  2⤵
  PID:2008
- C:\Windows\System\DFPyGLr.exe
  C:\Windows\System\DFPyGLr.exe
  2⤵
  PID:1968
- C:\Windows\System\yJWNNzt.exe
  C:\Windows\System\yJWNNzt.exe
  2⤵
  PID:2608
- C:\Windows\System\bMSTbog.exe
  C:\Windows\System\bMSTbog.exe
  2⤵
  PID:2824
- C:\Windows\System\YNVXNgZ.exe
  C:\Windows\System\YNVXNgZ.exe
  2⤵
  PID:2296
- C:\Windows\System\OuGYfUY.exe
  C:\Windows\System\OuGYfUY.exe
  2⤵
  PID:1016
- C:\Windows\System\fhQqMLx.exe
  C:\Windows\System\fhQqMLx.exe
  2⤵
  PID:3084
- C:\Windows\System\mNWHDyW.exe
  C:\Windows\System\mNWHDyW.exe
  2⤵
  PID:3100
- C:\Windows\System\gaIgnOc.exe
  C:\Windows\System\gaIgnOc.exe
  2⤵
  PID:3120
- C:\Windows\System\xwSCGcC.exe
  C:\Windows\System\xwSCGcC.exe
  2⤵
  PID:3140
- C:\Windows\System\CorXVQz.exe
  C:\Windows\System\CorXVQz.exe
  2⤵
  PID:3156
- C:\Windows\System\xSVPvQy.exe
  C:\Windows\System\xSVPvQy.exe
  2⤵
  PID:3172
- C:\Windows\System\ZKCsTSN.exe
  C:\Windows\System\ZKCsTSN.exe
  2⤵
  PID:3188
- C:\Windows\System\hvOnMFT.exe
  C:\Windows\System\hvOnMFT.exe
  2⤵
  PID:3208
- C:\Windows\System\jfHHsNP.exe
  C:\Windows\System\jfHHsNP.exe
  2⤵
  PID:3224
- C:\Windows\System\OhtiEVf.exe
  C:\Windows\System\OhtiEVf.exe
  2⤵
  PID:3252
- C:\Windows\System\EYdKCiL.exe
  C:\Windows\System\EYdKCiL.exe
  2⤵
  PID:3268
- C:\Windows\System\cdncBOP.exe
  C:\Windows\System\cdncBOP.exe
  2⤵
  PID:3284
- C:\Windows\System\xdJPuSk.exe
  C:\Windows\System\xdJPuSk.exe
  2⤵
  PID:3300
- C:\Windows\System\KDzpert.exe
  C:\Windows\System\KDzpert.exe
  2⤵
  PID:3316
- C:\Windows\System\IPzvQsk.exe
  C:\Windows\System\IPzvQsk.exe
  2⤵
  PID:3332
- C:\Windows\System\yYPWXQH.exe
  C:\Windows\System\yYPWXQH.exe
  2⤵
  PID:3352
- C:\Windows\System\UTkxehU.exe
  C:\Windows\System\UTkxehU.exe
  2⤵
  PID:3368
- C:\Windows\System\lxddQGM.exe
  C:\Windows\System\lxddQGM.exe
  2⤵
  PID:3384
- C:\Windows\System\AEeerKm.exe
  C:\Windows\System\AEeerKm.exe
  2⤵
  PID:3400
- C:\Windows\System\CviDRyX.exe
  C:\Windows\System\CviDRyX.exe
  2⤵
  PID:3416
- C:\Windows\System\qkQVADb.exe
  C:\Windows\System\qkQVADb.exe
  2⤵
  PID:3432
- C:\Windows\System\xPSAiew.exe
  C:\Windows\System\xPSAiew.exe
  2⤵
  PID:3448
- C:\Windows\System\BJwFHgN.exe
  C:\Windows\System\BJwFHgN.exe
  2⤵
  PID:3464
- C:\Windows\System\giERpjC.exe
  C:\Windows\System\giERpjC.exe
  2⤵
  PID:3480
- C:\Windows\System\HSEMgFl.exe
  C:\Windows\System\HSEMgFl.exe
  2⤵
  PID:3496
- C:\Windows\System\pkEattE.exe
  C:\Windows\System\pkEattE.exe
  2⤵
  PID:3512
- C:\Windows\System\AfdGZGo.exe
  C:\Windows\System\AfdGZGo.exe
  2⤵
  PID:3528
- C:\Windows\System\THkwPKa.exe
  C:\Windows\System\THkwPKa.exe
  2⤵
  PID:3544
- C:\Windows\System\AToPDfP.exe
  C:\Windows\System\AToPDfP.exe
  2⤵
  PID:3560
- C:\Windows\System\RELrxOO.exe
  C:\Windows\System\RELrxOO.exe
  2⤵
  PID:3576
- C:\Windows\System\OlKnAiU.exe
  C:\Windows\System\OlKnAiU.exe
  2⤵
  PID:3592
- C:\Windows\System\JJlbqBR.exe
  C:\Windows\System\JJlbqBR.exe
  2⤵
  PID:3608
- C:\Windows\System\tCANVDl.exe
  C:\Windows\System\tCANVDl.exe
  2⤵
  PID:3628
- C:\Windows\System\sGkvStl.exe
  C:\Windows\System\sGkvStl.exe
  2⤵
  PID:3644
- C:\Windows\System\mVCYNVo.exe
  C:\Windows\System\mVCYNVo.exe
  2⤵
  PID:3660
- C:\Windows\System\cubSvlF.exe
  C:\Windows\System\cubSvlF.exe
  2⤵
  PID:3676
- C:\Windows\System\EvZZxYs.exe
  C:\Windows\System\EvZZxYs.exe
  2⤵
  PID:3692
- C:\Windows\System\tDjMRjI.exe
  C:\Windows\System\tDjMRjI.exe
  2⤵
  PID:3708
- C:\Windows\System\TTPoPhy.exe
  C:\Windows\System\TTPoPhy.exe
  2⤵
  PID:3724
- C:\Windows\System\nZXSWMd.exe
  C:\Windows\System\nZXSWMd.exe
  2⤵
  PID:3740
- C:\Windows\System\gyGJoQb.exe
  C:\Windows\System\gyGJoQb.exe
  2⤵
  PID:3760
- C:\Windows\System\nmJDPie.exe
  C:\Windows\System\nmJDPie.exe
  2⤵
  PID:3776
- C:\Windows\System\apJtpSf.exe
  C:\Windows\System\apJtpSf.exe
  2⤵
  PID:3792
- C:\Windows\System\DSRylvd.exe
  C:\Windows\System\DSRylvd.exe
  2⤵
  PID:3808
- C:\Windows\System\eJapwlq.exe
  C:\Windows\System\eJapwlq.exe
  2⤵
  PID:3824
- C:\Windows\System\kZffQyI.exe
  C:\Windows\System\kZffQyI.exe
  2⤵
  PID:3844
- C:\Windows\System\sMCxbxX.exe
  C:\Windows\System\sMCxbxX.exe
  2⤵
  PID:3860
- C:\Windows\System\DZoTHqU.exe
  C:\Windows\System\DZoTHqU.exe
  2⤵
  PID:3876
- C:\Windows\System\qodkemW.exe
  C:\Windows\System\qodkemW.exe
  2⤵
  PID:3892
- C:\Windows\System\LUgojRt.exe
  C:\Windows\System\LUgojRt.exe
  2⤵
  PID:3908
- C:\Windows\System\dlXrbpq.exe
  C:\Windows\System\dlXrbpq.exe
  2⤵
  PID:3924
- C:\Windows\System\kFGnfRU.exe
  C:\Windows\System\kFGnfRU.exe
  2⤵
  PID:3940
- C:\Windows\System\JFPkFvn.exe
  C:\Windows\System\JFPkFvn.exe
  2⤵
  PID:3956
- C:\Windows\System\rKFLWgs.exe
  C:\Windows\System\rKFLWgs.exe
  2⤵
  PID:3976
- C:\Windows\System\hdAKaRb.exe
  C:\Windows\System\hdAKaRb.exe
  2⤵
  PID:3992
- C:\Windows\System\piLkGyX.exe
  C:\Windows\System\piLkGyX.exe
  2⤵
  PID:4008
- C:\Windows\System\BHYRYAQ.exe
  C:\Windows\System\BHYRYAQ.exe
  2⤵
  PID:4024
- C:\Windows\System\LVaLAMl.exe
  C:\Windows\System\LVaLAMl.exe
  2⤵
  PID:4040
- C:\Windows\System\EbnqSoc.exe
  C:\Windows\System\EbnqSoc.exe
  2⤵
  PID:4056
- C:\Windows\System\ThYwMTQ.exe
  C:\Windows\System\ThYwMTQ.exe
  2⤵
  PID:4072
- C:\Windows\System\FSosUPi.exe
  C:\Windows\System\FSosUPi.exe
  2⤵
  PID:4088
- C:\Windows\System\TgbNqpJ.exe
  C:\Windows\System\TgbNqpJ.exe
  2⤵
  PID:1876
- C:\Windows\System\auaFOlC.exe
  C:\Windows\System\auaFOlC.exe
  2⤵
  PID:972
- C:\Windows\System\zTuvlVz.exe
  C:\Windows\System\zTuvlVz.exe
  2⤵
  PID:1992
- C:\Windows\System\cQWJqkb.exe
  C:\Windows\System\cQWJqkb.exe
  2⤵
  PID:3052
- C:\Windows\System\tSbXEQk.exe
  C:\Windows\System\tSbXEQk.exe
  2⤵
  PID:2604
- C:\Windows\System\myQFTUy.exe
  C:\Windows\System\myQFTUy.exe
  2⤵
  PID:1304
- C:\Windows\System\mhgMgrw.exe
  C:\Windows\System\mhgMgrw.exe
  2⤵
  PID:4108
- C:\Windows\System\ukOiApb.exe
  C:\Windows\System\ukOiApb.exe
  2⤵
  PID:4128
- C:\Windows\System\IbySJhF.exe
  C:\Windows\System\IbySJhF.exe
  2⤵
  PID:4144
- C:\Windows\System\kafEPHj.exe
  C:\Windows\System\kafEPHj.exe
  2⤵
  PID:4160
- C:\Windows\System\YrNzzcH.exe
  C:\Windows\System\YrNzzcH.exe
  2⤵
  PID:4176
- C:\Windows\System\TfZJAkq.exe
  C:\Windows\System\TfZJAkq.exe
  2⤵
  PID:4192
- C:\Windows\System\oFsgAxA.exe
  C:\Windows\System\oFsgAxA.exe
  2⤵
  PID:4212
- C:\Windows\System\QfMjLRZ.exe
  C:\Windows\System\QfMjLRZ.exe
  2⤵
  PID:4228
- C:\Windows\System\GJdEwvj.exe
  C:\Windows\System\GJdEwvj.exe
  2⤵
  PID:4244
- C:\Windows\System\xDbQVbj.exe
  C:\Windows\System\xDbQVbj.exe
  2⤵
  PID:4260
- C:\Windows\System\AjQgmNG.exe
  C:\Windows\System\AjQgmNG.exe
  2⤵
  PID:4276
- C:\Windows\System\bXbKHAb.exe
  C:\Windows\System\bXbKHAb.exe
  2⤵
  PID:4296
- C:\Windows\System\uNkQfWD.exe
  C:\Windows\System\uNkQfWD.exe
  2⤵
  PID:4312
- C:\Windows\System\fLbyQLJ.exe
  C:\Windows\System\fLbyQLJ.exe
  2⤵
  PID:4328
- C:\Windows\System\kAfgTCG.exe
  C:\Windows\System\kAfgTCG.exe
  2⤵
  PID:4344
- C:\Windows\System\iyZGqmu.exe
  C:\Windows\System\iyZGqmu.exe
  2⤵
  PID:4360
- C:\Windows\System\CSpYNwq.exe
  C:\Windows\System\CSpYNwq.exe
  2⤵
  PID:4376
- C:\Windows\System\rOrgXIp.exe
  C:\Windows\System\rOrgXIp.exe
  2⤵
  PID:4396
- C:\Windows\System\KrTAtBy.exe
  C:\Windows\System\KrTAtBy.exe
  2⤵
  PID:4412
- C:\Windows\System\EfiBBkL.exe
  C:\Windows\System\EfiBBkL.exe
  2⤵
  PID:4428
- C:\Windows\System\MgfkQMn.exe
  C:\Windows\System\MgfkQMn.exe
  2⤵
  PID:4444
- C:\Windows\System\LEuGbmn.exe
  C:\Windows\System\LEuGbmn.exe
  2⤵
  PID:4460
- C:\Windows\System\VqEaeTk.exe
  C:\Windows\System\VqEaeTk.exe
  2⤵
  PID:4480
- C:\Windows\System\zmuQYWX.exe
  C:\Windows\System\zmuQYWX.exe
  2⤵
  PID:4496
- C:\Windows\System\BnghxPL.exe
  C:\Windows\System\BnghxPL.exe
  2⤵
  PID:4512
- C:\Windows\System\SVuerwJ.exe
  C:\Windows\System\SVuerwJ.exe
  2⤵
  PID:4528
- C:\Windows\System\klgFhyB.exe
  C:\Windows\System\klgFhyB.exe
  2⤵
  PID:4544
- C:\Windows\System\sCapzEy.exe
  C:\Windows\System\sCapzEy.exe
  2⤵
  PID:4560
- C:\Windows\System\zIzdCZj.exe
  C:\Windows\System\zIzdCZj.exe
  2⤵
  PID:4576
- C:\Windows\System\gqZrDpv.exe
  C:\Windows\System\gqZrDpv.exe
  2⤵
  PID:4596
- C:\Windows\System\rRmvNLk.exe
  C:\Windows\System\rRmvNLk.exe
  2⤵
  PID:4612
- C:\Windows\System\EOPRROv.exe
  C:\Windows\System\EOPRROv.exe
  2⤵
  PID:4628
- C:\Windows\System\hNFJivq.exe
  C:\Windows\System\hNFJivq.exe
  2⤵
  PID:4644
- C:\Windows\System\oWjmalv.exe
  C:\Windows\System\oWjmalv.exe
  2⤵
  PID:4660
- C:\Windows\System\CXTdKfS.exe
  C:\Windows\System\CXTdKfS.exe
  2⤵
  PID:4676
- C:\Windows\System\bRNxhyG.exe
  C:\Windows\System\bRNxhyG.exe
  2⤵
  PID:4692
- C:\Windows\System\GmCOTNu.exe
  C:\Windows\System\GmCOTNu.exe
  2⤵
  PID:4712
- C:\Windows\System\hoQoeqs.exe
  C:\Windows\System\hoQoeqs.exe
  2⤵
  PID:4728
- C:\Windows\System\ITHASrv.exe
  C:\Windows\System\ITHASrv.exe
  2⤵
  PID:4744
- C:\Windows\System\bbSzZWo.exe
  C:\Windows\System\bbSzZWo.exe
  2⤵
  PID:4760
- C:\Windows\System\wTausud.exe
  C:\Windows\System\wTausud.exe
  2⤵
  PID:4776
- C:\Windows\System\xMbzLte.exe
  C:\Windows\System\xMbzLte.exe
  2⤵
  PID:4792
- C:\Windows\System\CuVVZWG.exe
  C:\Windows\System\CuVVZWG.exe
  2⤵
  PID:4808
- C:\Windows\System\dpJjOna.exe
  C:\Windows\System\dpJjOna.exe
  2⤵
  PID:4824
- C:\Windows\System\GigXSAv.exe
  C:\Windows\System\GigXSAv.exe
  2⤵
  PID:4844
- C:\Windows\System\XUXMwCU.exe
  C:\Windows\System\XUXMwCU.exe
  2⤵
  PID:4860
- C:\Windows\System\ONPPcZV.exe
  C:\Windows\System\ONPPcZV.exe
  2⤵
  PID:4876
- C:\Windows\System\bjWnbHT.exe
  C:\Windows\System\bjWnbHT.exe
  2⤵
  PID:4892
- C:\Windows\System\sWuhdTd.exe
  C:\Windows\System\sWuhdTd.exe
  2⤵
  PID:4908
- C:\Windows\System\rvVIigI.exe
  C:\Windows\System\rvVIigI.exe
  2⤵
  PID:4928
- C:\Windows\System\OiIMbAB.exe
  C:\Windows\System\OiIMbAB.exe
  2⤵
  PID:4944
- C:\Windows\System\cVsKZlL.exe
  C:\Windows\System\cVsKZlL.exe
  2⤵
  PID:4960
- C:\Windows\System\dhKDKRm.exe
  C:\Windows\System\dhKDKRm.exe
  2⤵
  PID:4976
- C:\Windows\System\lHQPkBk.exe
  C:\Windows\System\lHQPkBk.exe
  2⤵
  PID:4992
- C:\Windows\System\pnJGYSK.exe
  C:\Windows\System\pnJGYSK.exe
  2⤵
  PID:5008
- C:\Windows\System\ltqPHEa.exe
  C:\Windows\System\ltqPHEa.exe
  2⤵
  PID:5028
- C:\Windows\System\wBMkJJp.exe
  C:\Windows\System\wBMkJJp.exe
  2⤵
  PID:5044
- C:\Windows\System\PxzmMPR.exe
  C:\Windows\System\PxzmMPR.exe
  2⤵
  PID:5060
- C:\Windows\System\anLbqrR.exe
  C:\Windows\System\anLbqrR.exe
  2⤵
  PID:5076
- C:\Windows\System\XjGJxMP.exe
  C:\Windows\System\XjGJxMP.exe
  2⤵
  PID:5092
- C:\Windows\System\XxNrsWY.exe
  C:\Windows\System\XxNrsWY.exe
  2⤵
  PID:5108
- C:\Windows\System\ekLWDHy.exe
  C:\Windows\System\ekLWDHy.exe
  2⤵
  PID:1956
- C:\Windows\System\yACkBJq.exe
  C:\Windows\System\yACkBJq.exe
  2⤵
  PID:4240
- C:\Windows\System\DBxmUCu.exe
  C:\Windows\System\DBxmUCu.exe
  2⤵
  PID:4368
- C:\Windows\System\rHbgyxH.exe
  C:\Windows\System\rHbgyxH.exe
  2⤵
  PID:4472
- C:\Windows\System\MjSdgbc.exe
  C:\Windows\System\MjSdgbc.exe
  2⤵
  PID:4572
- C:\Windows\System\eTwFgSv.exe
  C:\Windows\System\eTwFgSv.exe
  2⤵
  PID:4640
- C:\Windows\System\ZSxyCUZ.exe
  C:\Windows\System\ZSxyCUZ.exe
  2⤵
  PID:4740
- C:\Windows\System\jSFHMUp.exe
  C:\Windows\System\jSFHMUp.exe
  2⤵
  PID:4904
- C:\Windows\System\JnsFUWk.exe
  C:\Windows\System\JnsFUWk.exe
  2⤵
  PID:5036
- C:\Windows\System\Tmlbjcq.exe
  C:\Windows\System\Tmlbjcq.exe
  2⤵
  PID:5100
- C:\Windows\System\jVnrFNJ.exe
  C:\Windows\System\jVnrFNJ.exe
  2⤵
  PID:3348
- C:\Windows\System\ZfxKWPw.exe
  C:\Windows\System\ZfxKWPw.exe
  2⤵
  PID:3444
- C:\Windows\System\wYQhJWs.exe
  C:\Windows\System\wYQhJWs.exe
  2⤵
  PID:3736
- C:\Windows\System\Ghtmoih.exe
  C:\Windows\System\Ghtmoih.exe
  2⤵
  PID:3932
- C:\Windows\System\vcMzBnt.exe
  C:\Windows\System\vcMzBnt.exe
  2⤵
  PID:1576
- C:\Windows\System\yEetooB.exe
  C:\Windows\System\yEetooB.exe
  2⤵
  PID:3324
- C:\Windows\System\TgAVCXH.exe
  C:\Windows\System\TgAVCXH.exe
  2⤵
  PID:3392
- C:\Windows\System\jUMhRyM.exe
  C:\Windows\System\jUMhRyM.exe
  2⤵
  PID:3456
- C:\Windows\System\oapBOmM.exe
  C:\Windows\System\oapBOmM.exe
  2⤵
  PID:3552
- C:\Windows\System\TOaHcxo.exe
  C:\Windows\System\TOaHcxo.exe
  2⤵
  PID:3488
- C:\Windows\System\jLXyThG.exe
  C:\Windows\System\jLXyThG.exe
  2⤵
  PID:892
- C:\Windows\System\aGkrQdm.exe
  C:\Windows\System\aGkrQdm.exe
  2⤵
  PID:4052
- C:\Windows\System\DJOxmMN.exe
  C:\Windows\System\DJOxmMN.exe
  2⤵
  PID:3988
- C:\Windows\System\PlBncGP.exe
  C:\Windows\System\PlBncGP.exe
  2⤵
  PID:3920
- C:\Windows\System\AavNlTS.exe
  C:\Windows\System\AavNlTS.exe
  2⤵
  PID:3856
- C:\Windows\System\rQNrxfx.exe
  C:\Windows\System\rQNrxfx.exe
  2⤵
  PID:3788
- C:\Windows\System\uknPgLE.exe
  C:\Windows\System\uknPgLE.exe
  2⤵
  PID:3748
- C:\Windows\System\InXUifN.exe
  C:\Windows\System\InXUifN.exe
  2⤵
  PID:3684
- C:\Windows\System\AdlIwPm.exe
  C:\Windows\System\AdlIwPm.exe
  2⤵
  PID:3620
- C:\Windows\System\nRQKiCa.exe
  C:\Windows\System\nRQKiCa.exe
  2⤵
  PID:4120
- C:\Windows\System\iIkYatn.exe
  C:\Windows\System\iIkYatn.exe
  2⤵
  PID:4184
- C:\Windows\System\ReVZYHQ.exe
  C:\Windows\System\ReVZYHQ.exe
  2⤵
  PID:4252
- C:\Windows\System\NmYbrNK.exe
  C:\Windows\System\NmYbrNK.exe
  2⤵
  PID:4288
- C:\Windows\System\olGdXDs.exe
  C:\Windows\System\olGdXDs.exe
  2⤵
  PID:4356
- C:\Windows\System\QybKTKU.exe
  C:\Windows\System\QybKTKU.exe
  2⤵
  PID:4420
- C:\Windows\System\bhuyKEe.exe
  C:\Windows\System\bhuyKEe.exe
  2⤵
  PID:4488
- C:\Windows\System\YIcbZAU.exe
  C:\Windows\System\YIcbZAU.exe
  2⤵
  PID:4552
- C:\Windows\System\uTiyfMv.exe
  C:\Windows\System\uTiyfMv.exe
  2⤵
  PID:4620
- C:\Windows\System\DfZXtuO.exe
  C:\Windows\System\DfZXtuO.exe
  2⤵
  PID:4684
- C:\Windows\System\onOKQjx.exe
  C:\Windows\System\onOKQjx.exe
  2⤵
  PID:4752
- C:\Windows\System\gyUUELI.exe
  C:\Windows\System\gyUUELI.exe
  2⤵
  PID:4816
- C:\Windows\System\GkAixbs.exe
  C:\Windows\System\GkAixbs.exe
  2⤵
  PID:4884
- C:\Windows\System\Hcvqlib.exe
  C:\Windows\System\Hcvqlib.exe
  2⤵
  PID:4924
- C:\Windows\System\BJqbqXm.exe
  C:\Windows\System\BJqbqXm.exe
  2⤵
  PID:5016
- C:\Windows\System\wStwzpQ.exe
  C:\Windows\System\wStwzpQ.exe
  2⤵
  PID:5056
- C:\Windows\System\XyefbWW.exe
  C:\Windows\System\XyefbWW.exe
  2⤵
  PID:5084
- C:\Windows\System\YdhGXnI.exe
  C:\Windows\System\YdhGXnI.exe
  2⤵
  PID:2456
- C:\Windows\System\jYQKGew.exe
  C:\Windows\System\jYQKGew.exe
  2⤵
  PID:3132
- C:\Windows\System\KWCChMa.exe
  C:\Windows\System\KWCChMa.exe
  2⤵
  PID:4936
- C:\Windows\System\iEFNcch.exe
  C:\Windows\System\iEFNcch.exe
  2⤵
  PID:3196
- C:\Windows\System\ldxysat.exe
  C:\Windows\System\ldxysat.exe
  2⤵
  PID:3204
- C:\Windows\System\qQodeHl.exe
  C:\Windows\System\qQodeHl.exe
  2⤵
  PID:3248
- C:\Windows\System\FsSFVuv.exe
  C:\Windows\System\FsSFVuv.exe
  2⤵
  PID:3340
- C:\Windows\System\cXXpVRJ.exe
  C:\Windows\System\cXXpVRJ.exe
  2⤵
  PID:2068
- C:\Windows\System\NStbzcL.exe
  C:\Windows\System\NStbzcL.exe
  2⤵
  PID:3048
- C:\Windows\System\TnteHNm.exe
  C:\Windows\System\TnteHNm.exe
  2⤵
  PID:2728
- C:\Windows\System\PYZXsUd.exe
  C:\Windows\System\PYZXsUd.exe
  2⤵
  PID:2468
- C:\Windows\System\VmVWzQO.exe
  C:\Windows\System\VmVWzQO.exe
  2⤵
  PID:4832
- C:\Windows\System\JzJjihV.exe
  C:\Windows\System\JzJjihV.exe
  2⤵
  PID:1536
- C:\Windows\System\CCKZGOX.exe
  C:\Windows\System\CCKZGOX.exe
  2⤵
  PID:1524
- C:\Windows\System\YCxQCMi.exe
  C:\Windows\System\YCxQCMi.exe
  2⤵
  PID:3220
- C:\Windows\System\PQrsEBf.exe
  C:\Windows\System\PQrsEBf.exe
  2⤵
  PID:3028
- C:\Windows\System\IljfsuB.exe
  C:\Windows\System\IljfsuB.exe
  2⤵
  PID:1908
- C:\Windows\System\yHhdpAr.exe
  C:\Windows\System\yHhdpAr.exe
  2⤵
  PID:2928
- C:\Windows\System\dENlvAI.exe
  C:\Windows\System\dENlvAI.exe
  2⤵
  PID:2692
- C:\Windows\System\jaYLAhM.exe
  C:\Windows\System\jaYLAhM.exe
  2⤵
  PID:3904
- C:\Windows\System\vOROiRh.exe
  C:\Windows\System\vOROiRh.exe
  2⤵
  PID:3508
- C:\Windows\System\mdVJCOZ.exe
  C:\Windows\System\mdVJCOZ.exe
  2⤵
  PID:1332
- C:\Windows\System\xkSjxOY.exe
  C:\Windows\System\xkSjxOY.exe
  2⤵
  PID:2244
- C:\Windows\System\oixwIjD.exe
  C:\Windows\System\oixwIjD.exe
  2⤵
  PID:1880
- C:\Windows\System\GTCdQTA.exe
  C:\Windows\System\GTCdQTA.exe
  2⤵
  PID:3700
- C:\Windows\System\MQRjDwd.exe
  C:\Windows\System\MQRjDwd.exe
  2⤵
  PID:3804
- C:\Windows\System\crRCUSP.exe
  C:\Windows\System\crRCUSP.exe
  2⤵
  PID:3936
- C:\Windows\System\vcQUMlT.exe
  C:\Windows\System\vcQUMlT.exe
  2⤵
  PID:2156
- C:\Windows\System\YlWjwlT.exe
  C:\Windows\System\YlWjwlT.exe
  2⤵
  PID:4140
- C:\Windows\System\ZdEmfOE.exe
  C:\Windows\System\ZdEmfOE.exe
  2⤵
  PID:4304
- C:\Windows\System\SbKimYK.exe
  C:\Windows\System\SbKimYK.exe
  2⤵
  PID:4536
- C:\Windows\System\CCPYDBe.exe
  C:\Windows\System\CCPYDBe.exe
  2⤵
  PID:1904
- C:\Windows\System\MVENbxc.exe
  C:\Windows\System\MVENbxc.exe
  2⤵
  PID:4208
- C:\Windows\System\pGoZPPs.exe
  C:\Windows\System\pGoZPPs.exe
  2⤵
  PID:4700
- C:\Windows\System\AKymHrw.exe
  C:\Windows\System\AKymHrw.exe
  2⤵
  PID:3704
- C:\Windows\System\gQnjrEG.exe
  C:\Windows\System\gQnjrEG.exe
  2⤵
  PID:4036
- C:\Windows\System\JUgZXvk.exe
  C:\Windows\System\JUgZXvk.exe
  2⤵
  PID:4608
- C:\Windows\System\VeBIXkj.exe
  C:\Windows\System\VeBIXkj.exe
  2⤵
  PID:3408
- C:\Windows\System\KznAsPs.exe
  C:\Windows\System\KznAsPs.exe
  2⤵
  PID:4272
- C:\Windows\System\UQYAuVQ.exe
  C:\Windows\System\UQYAuVQ.exe
  2⤵
  PID:3164
- C:\Windows\System\ycIZOEh.exe
  C:\Windows\System\ycIZOEh.exe
  2⤵
  PID:4592
- C:\Windows\System\SlmOiRJ.exe
  C:\Windows\System\SlmOiRJ.exe
  2⤵
  PID:2636
- C:\Windows\System\hbBDQpV.exe
  C:\Windows\System\hbBDQpV.exe
  2⤵
  PID:1428
- C:\Windows\System\ztYZtUj.exe
  C:\Windows\System\ztYZtUj.exe
  2⤵
  PID:3280
- C:\Windows\System\MFoEKGS.exe
  C:\Windows\System\MFoEKGS.exe
  2⤵
  PID:4840
- C:\Windows\System\NAnSuWs.exe
  C:\Windows\System\NAnSuWs.exe
  2⤵
  PID:1976
- C:\Windows\System\MsxrAqA.exe
  C:\Windows\System\MsxrAqA.exe
  2⤵
  PID:4800
- C:\Windows\System\qPhwQEp.exe
  C:\Windows\System\qPhwQEp.exe
  2⤵
  PID:3668
- C:\Windows\System\BnXiXFG.exe
  C:\Windows\System\BnXiXFG.exe
  2⤵
  PID:3900
- C:\Windows\System\nTVkbMF.exe
  C:\Windows\System\nTVkbMF.exe
  2⤵
  PID:4000
- C:\Windows\System\eKMZcaB.exe
  C:\Windows\System\eKMZcaB.exe
  2⤵
  PID:3768
- C:\Windows\System\YcTyBQg.exe
  C:\Windows\System\YcTyBQg.exe
  2⤵
  PID:5004
- C:\Windows\System\nWRIMgj.exe
  C:\Windows\System\nWRIMgj.exe
  2⤵
  PID:5072
- C:\Windows\System\XpWnMqC.exe
  C:\Windows\System\XpWnMqC.exe
  2⤵
  PID:3872
- C:\Windows\System\VUdvSCW.exe
  C:\Windows\System\VUdvSCW.exe
  2⤵
  PID:2464
- C:\Windows\System\mKKndsq.exe
  C:\Windows\System\mKKndsq.exe
  2⤵
  PID:4504
- C:\Windows\System\RyRdLKm.exe
  C:\Windows\System\RyRdLKm.exe
  2⤵
  PID:3296
- C:\Windows\System\TZnDUHp.exe
  C:\Windows\System\TZnDUHp.exe
  2⤵
  PID:2428
- C:\Windows\System\pWeqOBG.exe
  C:\Windows\System\pWeqOBG.exe
  2⤵
  PID:4068
- C:\Windows\System\XLEATHh.exe
  C:\Windows\System\XLEATHh.exe
  2⤵
  PID:4568
- C:\Windows\System\ELDxWLO.exe
  C:\Windows\System\ELDxWLO.exe
  2⤵
  PID:3492
- C:\Windows\System\CbzpcPg.exe
  C:\Windows\System\CbzpcPg.exe
  2⤵
  PID:2732
- C:\Windows\System\XAsxOXd.exe
  C:\Windows\System\XAsxOXd.exe
  2⤵
  PID:3756
- C:\Windows\System\YnQHkuz.exe
  C:\Windows\System\YnQHkuz.exe
  2⤵
  PID:3652
- C:\Windows\System\vqIobGe.exe
  C:\Windows\System\vqIobGe.exe
  2⤵
  PID:2040
- C:\Windows\System\yIwaSgL.exe
  C:\Windows\System\yIwaSgL.exe
  2⤵
  PID:3816
- C:\Windows\System\USxAnOi.exe
  C:\Windows\System\USxAnOi.exe
  2⤵
  PID:4756
- C:\Windows\System\FJtxGyS.exe
  C:\Windows\System\FJtxGyS.exe
  2⤵
  PID:3716
- C:\Windows\System\QLsrCpO.exe
  C:\Windows\System\QLsrCpO.exe
  2⤵
  PID:4116
- C:\Windows\System\WTEdxMw.exe
  C:\Windows\System\WTEdxMw.exe
  2⤵
  PID:3948
- C:\Windows\System\YsfhwSu.exe
  C:\Windows\System\YsfhwSu.exe
  2⤵
  PID:4688
- C:\Windows\System\KzwLZJT.exe
  C:\Windows\System\KzwLZJT.exe
  2⤵
  PID:4452
- C:\Windows\System\VUHMhaN.exe
  C:\Windows\System\VUHMhaN.exe
  2⤵
  PID:3376
- C:\Windows\System\iFFVKmW.exe
  C:\Windows\System\iFFVKmW.exe
  2⤵
  PID:2184
- C:\Windows\System\rJIwxgK.exe
  C:\Windows\System\rJIwxgK.exe
  2⤵
  PID:4900
- C:\Windows\System\IfcLyXn.exe
  C:\Windows\System\IfcLyXn.exe
  2⤵
  PID:3024
- C:\Windows\System\JTJEVmA.exe
  C:\Windows\System\JTJEVmA.exe
  2⤵
  PID:2960
- C:\Windows\System\NXgaFJW.exe
  C:\Windows\System\NXgaFJW.exe
  2⤵
  PID:2632
- C:\Windows\System\UwMsCEX.exe
  C:\Windows\System\UwMsCEX.exe
  2⤵
  PID:3292
- C:\Windows\System\ecOaRjj.exe
  C:\Windows\System\ecOaRjj.exe
  2⤵
  PID:3020
- C:\Windows\System\oLlUuKc.exe
  C:\Windows\System\oLlUuKc.exe
  2⤵
  PID:3536
- C:\Windows\System\ZJdRKkH.exe
  C:\Windows\System\ZJdRKkH.exe
  2⤵
  PID:4104
- C:\Windows\System\RdnojHK.exe
  C:\Windows\System\RdnojHK.exe
  2⤵
  PID:1324
- C:\Windows\System\elyidBB.exe
  C:\Windows\System\elyidBB.exe
  2⤵
  PID:4636
- C:\Windows\System\CMJsiZE.exe
  C:\Windows\System\CMJsiZE.exe
  2⤵
  PID:1440
- C:\Windows\System\egeJLpe.exe
  C:\Windows\System\egeJLpe.exe
  2⤵
  PID:4436
- C:\Windows\System\kHCaqRc.exe
  C:\Windows\System\kHCaqRc.exe
  2⤵
  PID:3888
- C:\Windows\System\NJlxFBe.exe
  C:\Windows\System\NJlxFBe.exe
  2⤵
  PID:4520
- C:\Windows\System\NYkCeAM.exe
  C:\Windows\System\NYkCeAM.exe
  2⤵
  PID:4388
- C:\Windows\System\UFZJGpe.exe
  C:\Windows\System\UFZJGpe.exe
  2⤵
  PID:2780
- C:\Windows\System\tORvBwg.exe
  C:\Windows\System\tORvBwg.exe
  2⤵
  PID:4724
- C:\Windows\System\Rotzkes.exe
  C:\Windows\System\Rotzkes.exe
  2⤵
  PID:3096
- C:\Windows\System\iAsnnzd.exe
  C:\Windows\System\iAsnnzd.exe
  2⤵
  PID:3184
- C:\Windows\System\vZbjYQT.exe
  C:\Windows\System\vZbjYQT.exe
  2⤵
  PID:3128
- C:\Windows\System\uOhuvgm.exe
  C:\Windows\System\uOhuvgm.exe
  2⤵
  PID:1884
- C:\Windows\System\LDOArdT.exe
  C:\Windows\System\LDOArdT.exe
  2⤵
  PID:1988
- C:\Windows\System\uviearC.exe
  C:\Windows\System\uviearC.exe
  2⤵
  PID:3964
- C:\Windows\System\nYrpOFK.exe
  C:\Windows\System\nYrpOFK.exe
  2⤵
  PID:4204
- C:\Windows\System\CqkrTBc.exe
  C:\Windows\System\CqkrTBc.exe
  2⤵
  PID:1060
- C:\Windows\System\BGjwiBR.exe
  C:\Windows\System\BGjwiBR.exe
  2⤵
  PID:4004
- C:\Windows\System\AremQiW.exe
  C:\Windows\System\AremQiW.exe
  2⤵
  PID:320
- C:\Windows\System\gCHSTVQ.exe
  C:\Windows\System\gCHSTVQ.exe
  2⤵
  PID:484
- C:\Windows\System\sGbkSnB.exe
  C:\Windows\System\sGbkSnB.exe
  2⤵
  PID:2936
- C:\Windows\System\OAdwRqm.exe
  C:\Windows\System\OAdwRqm.exe
  2⤵
  PID:2952
- C:\Windows\System\zqPvkHp.exe
  C:\Windows\System\zqPvkHp.exe
  2⤵
  PID:536
- C:\Windows\System\FdDoarY.exe
  C:\Windows\System\FdDoarY.exe
  2⤵
  PID:1996
- C:\Windows\System\hTPQxHi.exe
  C:\Windows\System\hTPQxHi.exe
  2⤵
  PID:4984
- C:\Windows\System\kkZjEmz.exe
  C:\Windows\System\kkZjEmz.exe
  2⤵
  PID:4308
- C:\Windows\System\GeTaRio.exe
  C:\Windows\System\GeTaRio.exe
  2⤵
  PID:3424
- C:\Windows\System\deiDZmQ.exe
  C:\Windows\System\deiDZmQ.exe
  2⤵
  PID:5136
- C:\Windows\System\oZlLDzV.exe
  C:\Windows\System\oZlLDzV.exe
  2⤵
  PID:5152
- C:\Windows\System\vGvSWqS.exe
  C:\Windows\System\vGvSWqS.exe
  2⤵
  PID:5168
- C:\Windows\System\lrdSrcm.exe
  C:\Windows\System\lrdSrcm.exe
  2⤵
  PID:5184
- C:\Windows\System\lwlXdVL.exe
  C:\Windows\System\lwlXdVL.exe
  2⤵
  PID:5204
- C:\Windows\System\pfkrJvN.exe
  C:\Windows\System\pfkrJvN.exe
  2⤵
  PID:5264
- C:\Windows\System\vxAepuJ.exe
  C:\Windows\System\vxAepuJ.exe
  2⤵
  PID:5320
- C:\Windows\System\zrGfljc.exe
  C:\Windows\System\zrGfljc.exe
  2⤵
  PID:5340
- C:\Windows\System\BAEGluP.exe
  C:\Windows\System\BAEGluP.exe
  2⤵
  PID:5356
- C:\Windows\System\jZEnGRH.exe
  C:\Windows\System\jZEnGRH.exe
  2⤵
  PID:5372
- C:\Windows\System\lqewcNr.exe
  C:\Windows\System\lqewcNr.exe
  2⤵
  PID:5388
- C:\Windows\System\JvBYPRO.exe
  C:\Windows\System\JvBYPRO.exe
  2⤵
  PID:5404
- C:\Windows\System\oRzmUxP.exe
  C:\Windows\System\oRzmUxP.exe
  2⤵
  PID:5424
- C:\Windows\System\gVqTDGT.exe
  C:\Windows\System\gVqTDGT.exe
  2⤵
  PID:5440
- C:\Windows\System\JZeVlQA.exe
  C:\Windows\System\JZeVlQA.exe
  2⤵
  PID:5456
- C:\Windows\System\gCeVGmb.exe
  C:\Windows\System\gCeVGmb.exe
  2⤵
  PID:5472
- C:\Windows\System\GWsBnoy.exe
  C:\Windows\System\GWsBnoy.exe
  2⤵
  PID:5488
- C:\Windows\System\alSyrwV.exe
  C:\Windows\System\alSyrwV.exe
  2⤵
  PID:5644
- C:\Windows\System\NZVxQTG.exe
  C:\Windows\System\NZVxQTG.exe
  2⤵
  PID:5660
- C:\Windows\System\fugyFKv.exe
  C:\Windows\System\fugyFKv.exe
  2⤵
  PID:5676
- C:\Windows\System\baIbpDx.exe
  C:\Windows\System\baIbpDx.exe
  2⤵
  PID:5692
- C:\Windows\System\ueHBlSu.exe
  C:\Windows\System\ueHBlSu.exe
  2⤵
  PID:5708
- C:\Windows\System\hTkgZGh.exe
  C:\Windows\System\hTkgZGh.exe
  2⤵
  PID:5724
- C:\Windows\System\UWXGtqH.exe
  C:\Windows\System\UWXGtqH.exe
  2⤵
  PID:5740
- C:\Windows\System\phGkeCo.exe
  C:\Windows\System\phGkeCo.exe
  2⤵
  PID:5756
- C:\Windows\System\sLaRQvt.exe
  C:\Windows\System\sLaRQvt.exe
  2⤵
  PID:5772
- C:\Windows\System\lVGgqYo.exe
  C:\Windows\System\lVGgqYo.exe
  2⤵
  PID:5788
- C:\Windows\System\urKSgXS.exe
  C:\Windows\System\urKSgXS.exe
  2⤵
  PID:5804
- C:\Windows\System\eTvQkDM.exe
  C:\Windows\System\eTvQkDM.exe
  2⤵
  PID:5820
- C:\Windows\System\NVBUCCH.exe
  C:\Windows\System\NVBUCCH.exe
  2⤵
  PID:5836
- C:\Windows\System\GuIDTWj.exe
  C:\Windows\System\GuIDTWj.exe
  2⤵
  PID:5852
- C:\Windows\System\Bmjxgwa.exe
  C:\Windows\System\Bmjxgwa.exe
  2⤵
  PID:5904
- C:\Windows\System\AKibpDz.exe
  C:\Windows\System\AKibpDz.exe
  2⤵
  PID:5932
- C:\Windows\System\wzdgCAB.exe
  C:\Windows\System\wzdgCAB.exe
  2⤵
  PID:5956
- C:\Windows\System\RHMfaCk.exe
  C:\Windows\System\RHMfaCk.exe
  2⤵
  PID:5972
- C:\Windows\System\BmtGxpM.exe
  C:\Windows\System\BmtGxpM.exe
  2⤵
  PID:5988
- C:\Windows\System\PrUPgTO.exe
  C:\Windows\System\PrUPgTO.exe
  2⤵
  PID:6004
- C:\Windows\System\VJsaxYp.exe
  C:\Windows\System\VJsaxYp.exe
  2⤵
  PID:6020
- C:\Windows\System\xgqGyOM.exe
  C:\Windows\System\xgqGyOM.exe
  2⤵
  PID:6036
- C:\Windows\System\LfjxVfn.exe
  C:\Windows\System\LfjxVfn.exe
  2⤵
  PID:6052
- C:\Windows\System\tqGWmdC.exe
  C:\Windows\System\tqGWmdC.exe
  2⤵
  PID:6068
- C:\Windows\System\UGcoMMs.exe
  C:\Windows\System\UGcoMMs.exe
  2⤵
  PID:6084
- C:\Windows\System\JrWIxld.exe
  C:\Windows\System\JrWIxld.exe
  2⤵
  PID:6104
- C:\Windows\System\lHQYeek.exe
  C:\Windows\System\lHQYeek.exe
  2⤵
  PID:6120
- C:\Windows\System\xryKvSi.exe
  C:\Windows\System\xryKvSi.exe
  2⤵
  PID:6136
- C:\Windows\System\HpNvNXW.exe
  C:\Windows\System\HpNvNXW.exe
  2⤵
  PID:2524
- C:\Windows\System\VBNiaoS.exe
  C:\Windows\System\VBNiaoS.exe
  2⤵
  PID:3216
- C:\Windows\System\lPGmjvx.exe
  C:\Windows\System\lPGmjvx.exe
  2⤵
  PID:3600
- C:\Windows\System\riBnrMy.exe
  C:\Windows\System\riBnrMy.exe
  2⤵
  PID:5148
- C:\Windows\System\xoGPHnX.exe
  C:\Windows\System\xoGPHnX.exe
  2⤵
  PID:5176
- C:\Windows\System\fNGmTEp.exe
  C:\Windows\System\fNGmTEp.exe
  2⤵
  PID:5232
- C:\Windows\System\fLgFnfO.exe
  C:\Windows\System\fLgFnfO.exe
  2⤵
  PID:4404
- C:\Windows\System\SDLlhNM.exe
  C:\Windows\System\SDLlhNM.exe
  2⤵
  PID:1624
- C:\Windows\System\QvWlLsj.exe
  C:\Windows\System\QvWlLsj.exe
  2⤵
  PID:3232
- C:\Windows\System\syjeWky.exe
  C:\Windows\System\syjeWky.exe
  2⤵
  PID:5200
- C:\Windows\System\MlGCNOR.exe
  C:\Windows\System\MlGCNOR.exe
  2⤵
  PID:5132
- C:\Windows\System\eLrLmoz.exe
  C:\Windows\System\eLrLmoz.exe
  2⤵
  PID:2796
- C:\Windows\System\ltdqdlH.exe
  C:\Windows\System\ltdqdlH.exe
  2⤵
  PID:4440
- C:\Windows\System\NUvmTNt.exe
  C:\Windows\System\NUvmTNt.exe
  2⤵
  PID:3772
- C:\Windows\System\gnKhsif.exe
  C:\Windows\System\gnKhsif.exe
  2⤵
  PID:5244
- C:\Windows\System\eNOEZLA.exe
  C:\Windows\System\eNOEZLA.exe
  2⤵
  PID:5272
- C:\Windows\System\aHvyObe.exe
  C:\Windows\System\aHvyObe.exe
  2⤵
  PID:5276
- C:\Windows\System\kDPwrxv.exe
  C:\Windows\System\kDPwrxv.exe
  2⤵
  PID:5332
- C:\Windows\System\xFcJTKq.exe
  C:\Windows\System\xFcJTKq.exe
  2⤵
  PID:5304
- C:\Windows\System\AqBIair.exe
  C:\Windows\System\AqBIair.exe
  2⤵
  PID:5336
- C:\Windows\System\oBCnXNo.exe
  C:\Windows\System\oBCnXNo.exe
  2⤵
  PID:5436
- C:\Windows\System\lxwGGfk.exe
  C:\Windows\System\lxwGGfk.exe
  2⤵
  PID:5432
- C:\Windows\System\EtLycbR.exe
  C:\Windows\System\EtLycbR.exe
  2⤵
  PID:5420
- C:\Windows\System\hqXsDef.exe
  C:\Windows\System\hqXsDef.exe
  2⤵
  PID:5348
- C:\Windows\System\NdDKkvR.exe
  C:\Windows\System\NdDKkvR.exe
  2⤵
  PID:5412
- C:\Windows\System\ZlclKgB.exe
  C:\Windows\System\ZlclKgB.exe
  2⤵
  PID:5524
- C:\Windows\System\htNNFMV.exe
  C:\Windows\System\htNNFMV.exe
  2⤵
  PID:5516
- C:\Windows\System\mamVDmi.exe
  C:\Windows\System\mamVDmi.exe
  2⤵
  PID:5544
- C:\Windows\System\AoAjPMu.exe
  C:\Windows\System\AoAjPMu.exe
  2⤵
  PID:5536
- C:\Windows\System\NnsMKZk.exe
  C:\Windows\System\NnsMKZk.exe
  2⤵
  PID:5572
- C:\Windows\System\hblzIsL.exe
  C:\Windows\System\hblzIsL.exe
  2⤵
  PID:5624
- C:\Windows\System\dpOQjFc.exe
  C:\Windows\System\dpOQjFc.exe
  2⤵
  PID:5580
- C:\Windows\System\mQJyeSd.exe
  C:\Windows\System\mQJyeSd.exe
  2⤵
  PID:5596
- C:\Windows\System\XaXCZuG.exe
  C:\Windows\System\XaXCZuG.exe
  2⤵
  PID:5700
- C:\Windows\System\JKgnVjU.exe
  C:\Windows\System\JKgnVjU.exe
  2⤵
  PID:5600
- C:\Windows\System\iEeJzfW.exe
  C:\Windows\System\iEeJzfW.exe
  2⤵
  PID:5768
- C:\Windows\System\pxbHwuU.exe
  C:\Windows\System\pxbHwuU.exe
  2⤵
  PID:5832
- C:\Windows\System\XcQBHwh.exe
  C:\Windows\System\XcQBHwh.exe
  2⤵
  PID:5656
- C:\Windows\System\lRIIZqn.exe
  C:\Windows\System\lRIIZqn.exe
  2⤵
  PID:5688
- C:\Windows\System\NRCCMdf.exe
  C:\Windows\System\NRCCMdf.exe
  2⤵
  PID:5812
- C:\Windows\System\NOjDysK.exe
  C:\Windows\System\NOjDysK.exe
  2⤵
  PID:5752
- C:\Windows\System\AZYnNXe.exe
  C:\Windows\System\AZYnNXe.exe
  2⤵
  PID:5884
- C:\Windows\System\pSXLPyk.exe
  C:\Windows\System\pSXLPyk.exe
  2⤵
  PID:5892
- C:\Windows\System\ghAPsKp.exe
  C:\Windows\System\ghAPsKp.exe
  2⤵
  PID:3832
- C:\Windows\System\PAyJKSb.exe
  C:\Windows\System\PAyJKSb.exe
  2⤵
  PID:5952
- C:\Windows\System\wIxSFOF.exe
  C:\Windows\System\wIxSFOF.exe
  2⤵
  PID:6012
- C:\Windows\System\jFhrgRZ.exe
  C:\Windows\System\jFhrgRZ.exe
  2⤵
  PID:6076
- C:\Windows\System\DZYhMiF.exe
  C:\Windows\System\DZYhMiF.exe
  2⤵
  PID:2396
- C:\Windows\System\ExkVesv.exe
  C:\Windows\System\ExkVesv.exe
  2⤵
  PID:2784
- C:\Windows\System\gTTSFZR.exe
  C:\Windows\System\gTTSFZR.exe
  2⤵
  PID:4352
- C:\Windows\System\uMcHOdk.exe
  C:\Windows\System\uMcHOdk.exe
  2⤵
  PID:5964
- C:\Windows\System\Hvpkiqf.exe
  C:\Windows\System\Hvpkiqf.exe
  2⤵
  PID:5996
- C:\Windows\System\zgWgPYd.exe
  C:\Windows\System\zgWgPYd.exe
  2⤵
  PID:6060
- C:\Windows\System\CzXiWYO.exe
  C:\Windows\System\CzXiWYO.exe
  2⤵
  PID:6128
- C:\Windows\System\qfKDIhJ.exe
  C:\Windows\System\qfKDIhJ.exe
  2⤵
  PID:4524
- C:\Windows\System\dNZOaFR.exe
  C:\Windows\System\dNZOaFR.exe
  2⤵
  PID:4956
- C:\Windows\System\qlkeKfH.exe
  C:\Windows\System\qlkeKfH.exe
  2⤵
  PID:5124
- C:\Windows\System\OVTZnGo.exe
  C:\Windows\System\OVTZnGo.exe
  2⤵
  PID:1636
- C:\Windows\System\lLjfnDG.exe
  C:\Windows\System\lLjfnDG.exe
  2⤵
  PID:5368
- C:\Windows\System\sPSPjBo.exe
  C:\Windows\System\sPSPjBo.exe
  2⤵
  PID:5352
- C:\Windows\System\KFRWcQn.exe
  C:\Windows\System\KFRWcQn.exe
  2⤵
  PID:5508
- C:\Windows\System\mCtcFIk.exe
  C:\Windows\System\mCtcFIk.exe
  2⤵
  PID:5328
- C:\Windows\System\UIMLUMv.exe
  C:\Windows\System\UIMLUMv.exe
  2⤵
  PID:5452
- C:\Windows\System\oxewUKN.exe
  C:\Windows\System\oxewUKN.exe
  2⤵
  PID:5736
- C:\Windows\System\jlKwtUg.exe
  C:\Windows\System\jlKwtUg.exe
  2⤵
  PID:5780
- C:\Windows\System\JZANIub.exe
  C:\Windows\System\JZANIub.exe
  2⤵
  PID:5912
- C:\Windows\System\APbjayq.exe
  C:\Windows\System\APbjayq.exe
  2⤵
  PID:6112
- C:\Windows\System\PNbDjdL.exe
  C:\Windows\System\PNbDjdL.exe
  2⤵
  PID:5128
- C:\Windows\System\vZYYKYr.exe
  C:\Windows\System\vZYYKYr.exe
  2⤵
  PID:5568
- C:\Windows\System\oxIJtec.exe
  C:\Windows\System\oxIJtec.exe
  2⤵
  PID:6100
- C:\Windows\System\IRvNFbc.exe
  C:\Windows\System\IRvNFbc.exe
  2⤵
  PID:6048
- C:\Windows\System\bCETUMu.exe
  C:\Windows\System\bCETUMu.exe
  2⤵
  PID:4152
- C:\Windows\System\gSIEiCJ.exe
  C:\Windows\System\gSIEiCJ.exe
  2⤵
  PID:5828
- C:\Windows\System\jQHdWfQ.exe
  C:\Windows\System\jQHdWfQ.exe
  2⤵
  PID:5848
- C:\Windows\System\abswJiQ.exe
  C:\Windows\System\abswJiQ.exe
  2⤵
  PID:4988
- C:\Windows\System\CjHELkn.exe
  C:\Windows\System\CjHELkn.exe
  2⤵
  PID:6044
- C:\Windows\System\iqOvpkM.exe
  C:\Windows\System\iqOvpkM.exe
  2⤵
  PID:5300
- C:\Windows\System\FFshkuw.exe
  C:\Windows\System\FFshkuw.exe
  2⤵
  PID:5256
- C:\Windows\System\oqBmxOf.exe
  C:\Windows\System\oqBmxOf.exe
  2⤵
  PID:5584
- C:\Windows\System\cRzSjKP.exe
  C:\Windows\System\cRzSjKP.exe
  2⤵
  PID:5068
- C:\Windows\System\gQdmaxj.exe
  C:\Windows\System\gQdmaxj.exe
  2⤵
  PID:5312
- C:\Windows\System\DHApsdc.exe
  C:\Windows\System\DHApsdc.exe
  2⤵
  PID:1212
- C:\Windows\System\cELahQc.exe
  C:\Windows\System\cELahQc.exe
  2⤵
  PID:5616
- C:\Windows\System\alwVXPw.exe
  C:\Windows\System\alwVXPw.exe
  2⤵
  PID:5844
- C:\Windows\System\WwfTZYC.exe
  C:\Windows\System\WwfTZYC.exe
  2⤵
  PID:5216
- C:\Windows\System\cFXbVWO.exe
  C:\Windows\System\cFXbVWO.exe
  2⤵
  PID:5088
- C:\Windows\System\eRVlejS.exe
  C:\Windows\System\eRVlejS.exe
  2⤵
  PID:6160
- C:\Windows\System\ugKSsEC.exe
  C:\Windows\System\ugKSsEC.exe
  2⤵
  PID:6176
- C:\Windows\System\rgzWbmG.exe
  C:\Windows\System\rgzWbmG.exe
  2⤵
  PID:6192
- C:\Windows\System\OTJFcom.exe
  C:\Windows\System\OTJFcom.exe
  2⤵
  PID:6208
- C:\Windows\System\fzGstEW.exe
  C:\Windows\System\fzGstEW.exe
  2⤵
  PID:6228
- C:\Windows\System\LqgsyXA.exe
  C:\Windows\System\LqgsyXA.exe
  2⤵
  PID:6248
- C:\Windows\System\UlMmaob.exe
  C:\Windows\System\UlMmaob.exe
  2⤵
  PID:6272
- C:\Windows\System\PotYvTs.exe
  C:\Windows\System\PotYvTs.exe
  2⤵
  PID:6292
- C:\Windows\System\DWlhCoP.exe
  C:\Windows\System\DWlhCoP.exe
  2⤵
  PID:6352
- C:\Windows\System\UmrXRBl.exe
  C:\Windows\System\UmrXRBl.exe
  2⤵
  PID:6372
- C:\Windows\System\QkhCRQr.exe
  C:\Windows\System\QkhCRQr.exe
  2⤵
  PID:6388
- C:\Windows\System\TxpjqEl.exe
  C:\Windows\System\TxpjqEl.exe
  2⤵
  PID:6404
- C:\Windows\System\HSIikvd.exe
  C:\Windows\System\HSIikvd.exe
  2⤵
  PID:6420
- C:\Windows\System\ptMAjmM.exe
  C:\Windows\System\ptMAjmM.exe
  2⤵
  PID:6440
- C:\Windows\System\ajRsXpA.exe
  C:\Windows\System\ajRsXpA.exe
  2⤵
  PID:6456
- C:\Windows\System\XPyjRiU.exe
  C:\Windows\System\XPyjRiU.exe
  2⤵
  PID:6472
- C:\Windows\System\vygVRTw.exe
  C:\Windows\System\vygVRTw.exe
  2⤵
  PID:6488
- C:\Windows\System\IVPzRah.exe
  C:\Windows\System\IVPzRah.exe
  2⤵
  PID:6504
- C:\Windows\System\WfZDiCz.exe
  C:\Windows\System\WfZDiCz.exe
  2⤵
  PID:6520
- C:\Windows\System\pwUJGAm.exe
  C:\Windows\System\pwUJGAm.exe
  2⤵
  PID:6536
- C:\Windows\System\jDmlNhF.exe
  C:\Windows\System\jDmlNhF.exe
  2⤵
  PID:6556
- C:\Windows\System\TUnuTmR.exe
  C:\Windows\System\TUnuTmR.exe
  2⤵
  PID:6572
- C:\Windows\System\RZyccZP.exe
  C:\Windows\System\RZyccZP.exe
  2⤵
  PID:6588
- C:\Windows\System\BnTPELG.exe
  C:\Windows\System\BnTPELG.exe
  2⤵
  PID:6604
- C:\Windows\System\GNooGff.exe
  C:\Windows\System\GNooGff.exe
  2⤵
  PID:6620
- C:\Windows\System\hwOkUMe.exe
  C:\Windows\System\hwOkUMe.exe
  2⤵
  PID:6640
- C:\Windows\System\RGNgCQg.exe
  C:\Windows\System\RGNgCQg.exe
  2⤵
  PID:6656
- C:\Windows\System\EHPtIZu.exe
  C:\Windows\System\EHPtIZu.exe
  2⤵
  PID:6672
- C:\Windows\System\Ycmvfwp.exe
  C:\Windows\System\Ycmvfwp.exe
  2⤵
  PID:6688
- C:\Windows\System\xDgMkld.exe
  C:\Windows\System\xDgMkld.exe
  2⤵
  PID:6704
- C:\Windows\System\hcvglAH.exe
  C:\Windows\System\hcvglAH.exe
  2⤵
  PID:6724
- C:\Windows\System\zcpOJRs.exe
  C:\Windows\System\zcpOJRs.exe
  2⤵
  PID:6740
- C:\Windows\System\FzCtthd.exe
  C:\Windows\System\FzCtthd.exe
  2⤵
  PID:6756
- C:\Windows\System\AgsXmlY.exe
  C:\Windows\System\AgsXmlY.exe
  2⤵
  PID:6772
- C:\Windows\System\EuGPOZq.exe
  C:\Windows\System\EuGPOZq.exe
  2⤵
  PID:6788
- C:\Windows\System\HUQwisL.exe
  C:\Windows\System\HUQwisL.exe
  2⤵
  PID:6804
- C:\Windows\System\UIdnQit.exe
  C:\Windows\System\UIdnQit.exe
  2⤵
  PID:6820
- C:\Windows\System\KHykoSA.exe
  C:\Windows\System\KHykoSA.exe
  2⤵
  PID:6836
- C:\Windows\System\YRbvBwX.exe
  C:\Windows\System\YRbvBwX.exe
  2⤵
  PID:6852
- C:\Windows\System\UZLRwRG.exe
  C:\Windows\System\UZLRwRG.exe
  2⤵
  PID:6868
- C:\Windows\System\iYExOaI.exe
  C:\Windows\System\iYExOaI.exe
  2⤵
  PID:6884
- C:\Windows\System\zgIEfpN.exe
  C:\Windows\System\zgIEfpN.exe
  2⤵
  PID:6900
- C:\Windows\System\ANuUzjG.exe
  C:\Windows\System\ANuUzjG.exe
  2⤵
  PID:6916
- C:\Windows\System\HUIQIZy.exe
  C:\Windows\System\HUIQIZy.exe
  2⤵
  PID:6932
- C:\Windows\System\hHmhjLP.exe
  C:\Windows\System\hHmhjLP.exe
  2⤵
  PID:6948
- C:\Windows\System\NXZSUWz.exe
  C:\Windows\System\NXZSUWz.exe
  2⤵
  PID:6964
- C:\Windows\System\AIqEhBt.exe
  C:\Windows\System\AIqEhBt.exe
  2⤵
  PID:6980
- C:\Windows\System\RQFdXqw.exe
  C:\Windows\System\RQFdXqw.exe
  2⤵
  PID:6996
- C:\Windows\System\jxdwUhV.exe
  C:\Windows\System\jxdwUhV.exe
  2⤵
  PID:7012
- C:\Windows\System\NuHWVWF.exe
  C:\Windows\System\NuHWVWF.exe
  2⤵
  PID:7028
- C:\Windows\System\OJrVkLI.exe
  C:\Windows\System\OJrVkLI.exe
  2⤵
  PID:7044
- C:\Windows\System\kxfawrI.exe
  C:\Windows\System\kxfawrI.exe
  2⤵
  PID:7060
- C:\Windows\System\AuDHAPv.exe
  C:\Windows\System\AuDHAPv.exe
  2⤵
  PID:7076
- C:\Windows\System\WVvtVQu.exe
  C:\Windows\System\WVvtVQu.exe
  2⤵
  PID:7092
- C:\Windows\System\NdEwunr.exe
  C:\Windows\System\NdEwunr.exe
  2⤵
  PID:7108
- C:\Windows\System\LDPWJSC.exe
  C:\Windows\System\LDPWJSC.exe
  2⤵
  PID:7124
- C:\Windows\System\aAEfzXZ.exe
  C:\Windows\System\aAEfzXZ.exe
  2⤵
  PID:7140
- C:\Windows\System\KfvmEzD.exe
  C:\Windows\System\KfvmEzD.exe
  2⤵
  PID:7156
- C:\Windows\System\PttARLg.exe
  C:\Windows\System\PttARLg.exe
  2⤵
  PID:2112
- C:\Windows\System\hmaxWBD.exe
  C:\Windows\System\hmaxWBD.exe
  2⤵
  PID:6168
- C:\Windows\System\hIEFdlF.exe
  C:\Windows\System\hIEFdlF.exe
  2⤵
  PID:6236
- C:\Windows\System\LivZWEC.exe
  C:\Windows\System\LivZWEC.exe
  2⤵
  PID:1328
- C:\Windows\System\UNkfjzd.exe
  C:\Windows\System\UNkfjzd.exe
  2⤵
  PID:5872
- C:\Windows\System\sijuAYJ.exe
  C:\Windows\System\sijuAYJ.exe
  2⤵
  PID:6096
- C:\Windows\System\fVYRdjw.exe
  C:\Windows\System\fVYRdjw.exe
  2⤵
  PID:5800
- C:\Windows\System\AoUCYOJ.exe
  C:\Windows\System\AoUCYOJ.exe
  2⤵
  PID:5296
- C:\Windows\System\VTqthjq.exe
  C:\Windows\System\VTqthjq.exe
  2⤵
  PID:5160
- C:\Windows\System\qceHEoG.exe
  C:\Windows\System\qceHEoG.exe
  2⤵
  PID:5512
- C:\Windows\System\PadEYyb.exe
  C:\Windows\System\PadEYyb.exe
  2⤵
  PID:5636
- C:\Windows\System\uRDDCcn.exe
  C:\Windows\System\uRDDCcn.exe
  2⤵
  PID:6184
- C:\Windows\System\LhIFtoa.exe
  C:\Windows\System\LhIFtoa.exe
  2⤵
  PID:6224
- C:\Windows\System\JyLTDEt.exe
  C:\Windows\System\JyLTDEt.exe
  2⤵
  PID:6268
- C:\Windows\System\JPGPFZJ.exe
  C:\Windows\System\JPGPFZJ.exe
  2⤵
  PID:6312
- C:\Windows\System\QYdkebb.exe
  C:\Windows\System\QYdkebb.exe
  2⤵
  PID:6344
- C:\Windows\System\DxIFvlk.exe
  C:\Windows\System\DxIFvlk.exe
  2⤵
  PID:6320
- C:\Windows\System\vnqEwUH.exe
  C:\Windows\System\vnqEwUH.exe
  2⤵
  PID:6380
- C:\Windows\System\mHVEJuy.exe
  C:\Windows\System\mHVEJuy.exe
  2⤵
  PID:6416
- C:\Windows\System\DQSglaU.exe
  C:\Windows\System\DQSglaU.exe
  2⤵
  PID:6480
- C:\Windows\System\nIzUnQP.exe
  C:\Windows\System\nIzUnQP.exe
  2⤵
  PID:6360
- C:\Windows\System\jrtHnoP.exe
  C:\Windows\System\jrtHnoP.exe
  2⤵
  PID:6400
- C:\Windows\System\sCRuHhH.exe
  C:\Windows\System\sCRuHhH.exe
  2⤵
  PID:6848
- C:\Windows\System\FVxxqto.exe
  C:\Windows\System\FVxxqto.exe
  2⤵
  PID:6568
- C:\Windows\System\EoBRear.exe
  C:\Windows\System\EoBRear.exe
  2⤵
  PID:6532
- C:\Windows\System\ePseVmv.exe
  C:\Windows\System\ePseVmv.exe
  2⤵
  PID:6940
- C:\Windows\System\uUDJZSm.exe
  C:\Windows\System\uUDJZSm.exe
  2⤵
  PID:6912
- C:\Windows\System\QmFEnur.exe
  C:\Windows\System\QmFEnur.exe
  2⤵
  PID:7036
- C:\Windows\System\CEBnoIR.exe
  C:\Windows\System\CEBnoIR.exe
  2⤵
  PID:7136
- C:\Windows\System\zjnMmva.exe
  C:\Windows\System\zjnMmva.exe
  2⤵
  PID:5672
- C:\Windows\System\ZEglgGq.exe
  C:\Windows\System\ZEglgGq.exe
  2⤵
  PID:6308
- C:\Windows\System\ooGIPpw.exe
  C:\Windows\System\ooGIPpw.exe
  2⤵
  PID:6600
- C:\Windows\System\OAQJZiV.exe
  C:\Windows\System\OAQJZiV.exe
  2⤵
  PID:6800
- C:\Windows\System\gSibRxA.exe
  C:\Windows\System\gSibRxA.exe
  2⤵
  PID:6928
- C:\Windows\System\QcicrTo.exe
  C:\Windows\System\QcicrTo.exe
  2⤵
  PID:6764
- C:\Windows\System\OOXQDlJ.exe
  C:\Windows\System\OOXQDlJ.exe
  2⤵
  PID:7148
- C:\Windows\System\vyUfYCX.exe
  C:\Windows\System\vyUfYCX.exe
  2⤵
  PID:5196
- C:\Windows\System\aBBITAH.exe
  C:\Windows\System\aBBITAH.exe
  2⤵
  PID:6896
- C:\Windows\System\cmTNPub.exe
  C:\Windows\System\cmTNPub.exe
  2⤵
  PID:6960
- C:\Windows\System\BbICGHM.exe
  C:\Windows\System\BbICGHM.exe
  2⤵
  PID:6156
- C:\Windows\System\noRaKZA.exe
  C:\Windows\System\noRaKZA.exe
  2⤵
  PID:7052
- C:\Windows\System\TiZfOOM.exe
  C:\Windows\System\TiZfOOM.exe
  2⤵
  PID:7120
- C:\Windows\System\dWGIEgJ.exe
  C:\Windows\System\dWGIEgJ.exe
  2⤵
  PID:6244
- C:\Windows\System\jlygHkP.exe
  C:\Windows\System\jlygHkP.exe
  2⤵
  PID:5228
- C:\Windows\System\JJhgLdZ.exe
  C:\Windows\System\JJhgLdZ.exe
  2⤵
  PID:5504
- C:\Windows\System\rZydpeR.exe
  C:\Windows\System\rZydpeR.exe
  2⤵
  PID:6092
- C:\Windows\System\IrRyyqv.exe
  C:\Windows\System\IrRyyqv.exe
  2⤵
  PID:6468
- C:\Windows\System\EYUCWqA.exe
  C:\Windows\System\EYUCWqA.exe
  2⤵
  PID:6516
- C:\Windows\System\yKMhIRv.exe
  C:\Windows\System\yKMhIRv.exe
  2⤵
  PID:6580
- C:\Windows\System\wZcGYEj.exe
  C:\Windows\System\wZcGYEj.exe
  2⤵
  PID:6648
- C:\Windows\System\zJLVUTo.exe
  C:\Windows\System\zJLVUTo.exe
  2⤵
  PID:6712
- C:\Windows\System\rjbZfso.exe
  C:\Windows\System\rjbZfso.exe
  2⤵
  PID:6784
- C:\Windows\System\kOYohOs.exe
  C:\Windows\System\kOYohOs.exe
  2⤵
  PID:6876
- C:\Windows\System\MxHXApH.exe
  C:\Windows\System\MxHXApH.exe
  2⤵
  PID:7004
- C:\Windows\System\FBcDkPb.exe
  C:\Windows\System\FBcDkPb.exe
  2⤵
  PID:6668
- C:\Windows\System\sbtfpez.exe
  C:\Windows\System\sbtfpez.exe
  2⤵
  PID:7104
- C:\Windows\System\QhcQNam.exe
  C:\Windows\System\QhcQNam.exe
  2⤵
  PID:7132
- C:\Windows\System\hRPgfzi.exe
  C:\Windows\System\hRPgfzi.exe
  2⤵
  PID:6032
- C:\Windows\System\kVJYawv.exe
  C:\Windows\System\kVJYawv.exe
  2⤵
  PID:5416
- C:\Windows\System\ZGMlIxD.exe
  C:\Windows\System\ZGMlIxD.exe
  2⤵
  PID:6632
- C:\Windows\System\EvWVpTQ.exe
  C:\Windows\System\EvWVpTQ.exe
  2⤵
  PID:7056
- C:\Windows\System\JhUNYtK.exe
  C:\Windows\System\JhUNYtK.exe
  2⤵
  PID:7024
- C:\Windows\System\IkbvmUh.exe
  C:\Windows\System\IkbvmUh.exe
  2⤵
  PID:6464
- C:\Windows\System\qlkDlHm.exe
  C:\Windows\System\qlkDlHm.exe
  2⤵
  PID:6844
- C:\Windows\System\zPXHwih.exe
  C:\Windows\System\zPXHwih.exe
  2⤵
  PID:2484
- C:\Windows\System\uswmphB.exe
  C:\Windows\System\uswmphB.exe
  2⤵
  PID:6736
- C:\Windows\System\vUwpBpY.exe
  C:\Windows\System\vUwpBpY.exe
  2⤵
  PID:6264
- C:\Windows\System\kuitKbb.exe
  C:\Windows\System\kuitKbb.exe
  2⤵
  PID:6696
- C:\Windows\System\JJhdjSS.exe
  C:\Windows\System\JJhdjSS.exe
  2⤵
  PID:1248
- C:\Windows\System\ykqfuQD.exe
  C:\Windows\System\ykqfuQD.exe
  2⤵
  PID:6700
- C:\Windows\System\HXCLuFF.exe
  C:\Windows\System\HXCLuFF.exe
  2⤵
  PID:6680
- C:\Windows\System\rjcTTiI.exe
  C:\Windows\System\rjcTTiI.exe
  2⤵
  PID:6200
- C:\Windows\System\ZLrIJrT.exe
  C:\Windows\System\ZLrIJrT.exe
  2⤵
  PID:6452
- C:\Windows\System\tTnaYQY.exe
  C:\Windows\System\tTnaYQY.exe
  2⤵
  PID:7088
- C:\Windows\System\gqbSuft.exe
  C:\Windows\System\gqbSuft.exe
  2⤵
  PID:6436
- C:\Windows\System\JPBxnyc.exe
  C:\Windows\System\JPBxnyc.exe
  2⤵
  PID:6528
- C:\Windows\System\ycPchxY.exe
  C:\Windows\System\ycPchxY.exe
  2⤵
  PID:6304
- C:\Windows\System\VkwzeTe.exe
  C:\Windows\System\VkwzeTe.exe
  2⤵
  PID:6796
- C:\Windows\System\KDScVLx.exe
  C:\Windows\System\KDScVLx.exe
  2⤵
  PID:7172
- C:\Windows\System\JKrWyrA.exe
  C:\Windows\System\JKrWyrA.exe
  2⤵
  PID:7192
- C:\Windows\System\HeZMckO.exe
  C:\Windows\System\HeZMckO.exe
  2⤵
  PID:7208
- C:\Windows\System\uUIgjfj.exe
  C:\Windows\System\uUIgjfj.exe
  2⤵
  PID:7228
- C:\Windows\System\vBNWpTH.exe
  C:\Windows\System\vBNWpTH.exe
  2⤵
  PID:7244
- C:\Windows\System\VqwHomD.exe
  C:\Windows\System\VqwHomD.exe
  2⤵
  PID:7260
- C:\Windows\System\iDKkYQs.exe
  C:\Windows\System\iDKkYQs.exe
  2⤵
  PID:7276
- C:\Windows\System\FYTILIK.exe
  C:\Windows\System\FYTILIK.exe
  2⤵
  PID:7300
- C:\Windows\System\kZGnxnp.exe
  C:\Windows\System\kZGnxnp.exe
  2⤵
  PID:7320
- C:\Windows\System\iqidOvu.exe
  C:\Windows\System\iqidOvu.exe
  2⤵
  PID:7344
- C:\Windows\System\SyQIRYw.exe
  C:\Windows\System\SyQIRYw.exe
  2⤵
  PID:7364
- C:\Windows\System\jIMQYxK.exe
  C:\Windows\System\jIMQYxK.exe
  2⤵
  PID:7380
- C:\Windows\System\WaGjhFw.exe
  C:\Windows\System\WaGjhFw.exe
  2⤵
  PID:7404
- C:\Windows\System\karedfv.exe
  C:\Windows\System\karedfv.exe
  2⤵
  PID:7420
- C:\Windows\System\vNpuhMd.exe
  C:\Windows\System\vNpuhMd.exe
  2⤵
  PID:7440
- C:\Windows\System\aEdcXlY.exe
  C:\Windows\System\aEdcXlY.exe
  2⤵
  PID:7456
- C:\Windows\System\qWPZQyv.exe
  C:\Windows\System\qWPZQyv.exe
  2⤵
  PID:7476
- C:\Windows\System\MAlKxAN.exe
  C:\Windows\System\MAlKxAN.exe
  2⤵
  PID:7492
- C:\Windows\System\deuLGDW.exe
  C:\Windows\System\deuLGDW.exe
  2⤵
  PID:7512
- C:\Windows\System\TrelWSd.exe
  C:\Windows\System\TrelWSd.exe
  2⤵
  PID:7528
- C:\Windows\System\ERZXmni.exe
  C:\Windows\System\ERZXmni.exe
  2⤵
  PID:7544
- C:\Windows\System\SjbcrxL.exe
  C:\Windows\System\SjbcrxL.exe
  2⤵
  PID:7560
- C:\Windows\System\XgViEMS.exe
  C:\Windows\System\XgViEMS.exe
  2⤵
  PID:7576
- C:\Windows\System\uzzLERN.exe
  C:\Windows\System\uzzLERN.exe
  2⤵
  PID:7596
- C:\Windows\System\pvDqGDD.exe
  C:\Windows\System\pvDqGDD.exe
  2⤵
  PID:7612
- C:\Windows\System\vkwuQFj.exe
  C:\Windows\System\vkwuQFj.exe
  2⤵
  PID:7628
- C:\Windows\System\zKHDcdv.exe
  C:\Windows\System\zKHDcdv.exe
  2⤵
  PID:7768
- C:\Windows\System\SHmlGFL.exe
  C:\Windows\System\SHmlGFL.exe
  2⤵
  PID:7784
- C:\Windows\System\CIUjcYk.exe
  C:\Windows\System\CIUjcYk.exe
  2⤵
  PID:7800
- C:\Windows\System\nWjceKP.exe
  C:\Windows\System\nWjceKP.exe
  2⤵
  PID:7816
- C:\Windows\System\lPjsiyu.exe
  C:\Windows\System\lPjsiyu.exe
  2⤵
  PID:7832
- C:\Windows\System\nqAlaoI.exe
  C:\Windows\System\nqAlaoI.exe
  2⤵
  PID:7852
- C:\Windows\System\UglgDdo.exe
  C:\Windows\System\UglgDdo.exe
  2⤵
  PID:7868
- C:\Windows\System\ZRKJMeI.exe
  C:\Windows\System\ZRKJMeI.exe
  2⤵
  PID:7884
- C:\Windows\System\BYUvBOC.exe
  C:\Windows\System\BYUvBOC.exe
  2⤵
  PID:7904
- C:\Windows\System\ppzIOJO.exe
  C:\Windows\System\ppzIOJO.exe
  2⤵
  PID:7920
- C:\Windows\System\GfSrYVF.exe
  C:\Windows\System\GfSrYVF.exe
  2⤵
  PID:7936
- C:\Windows\System\oWCEOjU.exe
  C:\Windows\System\oWCEOjU.exe
  2⤵
  PID:7952
- C:\Windows\System\rHTUXwX.exe
  C:\Windows\System\rHTUXwX.exe
  2⤵
  PID:7968
- C:\Windows\System\FGIrAKS.exe
  C:\Windows\System\FGIrAKS.exe
  2⤵
  PID:7988
- C:\Windows\System\XHmBWeI.exe
  C:\Windows\System\XHmBWeI.exe
  2⤵
  PID:8004
- C:\Windows\System\wokWNxl.exe
  C:\Windows\System\wokWNxl.exe
  2⤵
  PID:8024
- C:\Windows\System\jRwEVcp.exe
  C:\Windows\System\jRwEVcp.exe
  2⤵
  PID:8120
- C:\Windows\System\UsXRMoP.exe
  C:\Windows\System\UsXRMoP.exe
  2⤵
  PID:8152
- C:\Windows\System\ZqBOPby.exe
  C:\Windows\System\ZqBOPby.exe
  2⤵
  PID:8176
- C:\Windows\System\LasdsWG.exe
  C:\Windows\System\LasdsWG.exe
  2⤵
  PID:6500
- C:\Windows\System\SIYpwYr.exe
  C:\Windows\System\SIYpwYr.exe
  2⤵
  PID:6552
- C:\Windows\System\xcvZHjZ.exe
  C:\Windows\System\xcvZHjZ.exe
  2⤵
  PID:7268
- C:\Windows\System\qTDjuCY.exe
  C:\Windows\System\qTDjuCY.exe
  2⤵
  PID:7200
- C:\Windows\System\bzsZsWa.exe
  C:\Windows\System\bzsZsWa.exe
  2⤵
  PID:7352
- C:\Windows\System\YGcFlxK.exe
  C:\Windows\System\YGcFlxK.exe
  2⤵
  PID:7392
- C:\Windows\System\atqlVjU.exe
  C:\Windows\System\atqlVjU.exe
  2⤵
  PID:7432
- C:\Windows\System\vZNHAjG.exe
  C:\Windows\System\vZNHAjG.exe
  2⤵
  PID:7500
- C:\Windows\System\rpZxPBe.exe
  C:\Windows\System\rpZxPBe.exe
  2⤵
  PID:6260
- C:\Windows\System\RHbcnjW.exe
  C:\Windows\System\RHbcnjW.exe
  2⤵
  PID:2164
- C:\Windows\System\sKnVnTJ.exe
  C:\Windows\System\sKnVnTJ.exe
  2⤵
  PID:7332
- C:\Windows\System\evJePik.exe
  C:\Windows\System\evJePik.exe
  2⤵
  PID:6752
- C:\Windows\System\kQyqBFs.exe
  C:\Windows\System\kQyqBFs.exe
  2⤵
  PID:6328
- C:\Windows\System\dAWKFKY.exe
  C:\Windows\System\dAWKFKY.exe
  2⤵
  PID:7188
- C:\Windows\System\ANUMFpE.exe
  C:\Windows\System\ANUMFpE.exe
  2⤵
  PID:7256
- C:\Windows\System\aGyGXbm.exe
  C:\Windows\System\aGyGXbm.exe
  2⤵
  PID:7568
- C:\Windows\System\znIzppg.exe
  C:\Windows\System\znIzppg.exe
  2⤵
  PID:7328
- C:\Windows\System\oWsmvzX.exe
  C:\Windows\System\oWsmvzX.exe
  2⤵
  PID:7416
- C:\Windows\System\uzOZdBU.exe
  C:\Windows\System\uzOZdBU.exe
  2⤵
  PID:7488
- C:\Windows\System\yinlzpH.exe
  C:\Windows\System\yinlzpH.exe
  2⤵
  PID:7588
- C:\Windows\System\sFyCibi.exe
  C:\Windows\System\sFyCibi.exe
  2⤵
  PID:7640
- C:\Windows\System\tUYiEbt.exe
  C:\Windows\System\tUYiEbt.exe
  2⤵
  PID:7664
- C:\Windows\System\UbuAIQh.exe
  C:\Windows\System\UbuAIQh.exe
  2⤵
  PID:7680
- C:\Windows\System\sTPHZmk.exe
  C:\Windows\System\sTPHZmk.exe
  2⤵
  PID:7692
- C:\Windows\System\FePxRXb.exe
  C:\Windows\System\FePxRXb.exe
  2⤵
  PID:7712
- C:\Windows\System\hhwomoX.exe
  C:\Windows\System\hhwomoX.exe
  2⤵
  PID:7728
- C:\Windows\System\QBqmPDO.exe
  C:\Windows\System\QBqmPDO.exe
  2⤵
  PID:7744
- C:\Windows\System\rOqXFOM.exe
  C:\Windows\System\rOqXFOM.exe
  2⤵
  PID:7792
- C:\Windows\System\pAEyRHh.exe
  C:\Windows\System\pAEyRHh.exe
  2⤵
  PID:7860
- C:\Windows\System\exctONR.exe
  C:\Windows\System\exctONR.exe
  2⤵
  PID:7900
- C:\Windows\System\OQgoRAA.exe
  C:\Windows\System\OQgoRAA.exe
  2⤵
  PID:7964
- C:\Windows\System\XsTyPEN.exe
  C:\Windows\System\XsTyPEN.exe
  2⤵
  PID:7776
- C:\Windows\System\YFuUjxp.exe
  C:\Windows\System\YFuUjxp.exe
  2⤵
  PID:8036
- C:\Windows\System\CploONL.exe
  C:\Windows\System\CploONL.exe
  2⤵
  PID:8052
- C:\Windows\System\OJtpoKR.exe
  C:\Windows\System\OJtpoKR.exe
  2⤵
  PID:8064
- C:\Windows\System\jqbdUuv.exe
  C:\Windows\System\jqbdUuv.exe
  2⤵
  PID:7840
- C:\Windows\System\yNeZyef.exe
  C:\Windows\System\yNeZyef.exe
  2⤵
  PID:8072
- C:\Windows\System\NpJLjXv.exe
  C:\Windows\System\NpJLjXv.exe
  2⤵
  PID:7944
- C:\Windows\System\NrqXxAL.exe
  C:\Windows\System\NrqXxAL.exe
  2⤵
  PID:8012
- C:\Windows\System\SmNsdjg.exe
  C:\Windows\System\SmNsdjg.exe
  2⤵
  PID:8084
- C:\Windows\System\pfCLZvf.exe
  C:\Windows\System\pfCLZvf.exe
  2⤵
  PID:1232
- C:\Windows\System\vrOIZSW.exe
  C:\Windows\System\vrOIZSW.exe
  2⤵
  PID:8104
- C:\Windows\System\HFrwhav.exe
  C:\Windows\System\HFrwhav.exe
  2⤵
  PID:8160
- C:\Windows\System\ajoCWdB.exe
  C:\Windows\System\ajoCWdB.exe
  2⤵
  PID:8144
- C:\Windows\System\GAdMCBz.exe
  C:\Windows\System\GAdMCBz.exe
  2⤵
  PID:5220
- C:\Windows\System\EZrhyna.exe
  C:\Windows\System\EZrhyna.exe
  2⤵
  PID:5608
- C:\Windows\System\wzfDcFM.exe
  C:\Windows\System\wzfDcFM.exe
  2⤵
  PID:8184
- C:\Windows\System\lGlcSLQ.exe
  C:\Windows\System\lGlcSLQ.exe
  2⤵
  PID:7316
- C:\Windows\System\rKIATda.exe
  C:\Windows\System\rKIATda.exe
  2⤵
  PID:7468
- C:\Windows\System\lAptSgo.exe
  C:\Windows\System\lAptSgo.exe
  2⤵
  PID:7448
- C:\Windows\System\JLTMOuM.exe
  C:\Windows\System\JLTMOuM.exe
  2⤵
  PID:7292
- C:\Windows\System\jUewxqn.exe
  C:\Windows\System\jUewxqn.exe
  2⤵
  PID:7308
- C:\Windows\System\gimmhRA.exe
  C:\Windows\System\gimmhRA.exe
  2⤵
  PID:7284
- C:\Windows\System\ZSuQZmU.exe
  C:\Windows\System\ZSuQZmU.exe
  2⤵
  PID:7608
- C:\Windows\System\trLKxln.exe
  C:\Windows\System\trLKxln.exe
  2⤵
  PID:7656
- C:\Windows\System\qRHWniT.exe
  C:\Windows\System\qRHWniT.exe
  2⤵
  PID:7604
- C:\Windows\System\osEizmN.exe
  C:\Windows\System\osEizmN.exe
  2⤵
  PID:7752
- C:\Windows\System\pulDpjb.exe
  C:\Windows\System\pulDpjb.exe
  2⤵
  PID:7896
- C:\Windows\System\azutDai.exe
  C:\Windows\System\azutDai.exe
  2⤵
  PID:7484
- C:\Windows\System\PjxjYZy.exe
  C:\Windows\System\PjxjYZy.exe
  2⤵
  PID:7824
- C:\Windows\System\dmuGXzM.exe
  C:\Windows\System\dmuGXzM.exe
  2⤵
  PID:7932
- C:\Windows\System\EqxdcBM.exe
  C:\Windows\System\EqxdcBM.exe
  2⤵
  PID:7960
- C:\Windows\System\jdzORmS.exe
  C:\Windows\System\jdzORmS.exe
  2⤵
  PID:7584
- C:\Windows\System\OejGrsW.exe
  C:\Windows\System\OejGrsW.exe
  2⤵
  PID:8168
- C:\Windows\System\QEJENgb.exe
  C:\Windows\System\QEJENgb.exe
  2⤵
  PID:7676
- C:\Windows\System\jgWhIZs.exe
  C:\Windows\System\jgWhIZs.exe
  2⤵
  PID:7848
- C:\Windows\System\xvULlXU.exe
  C:\Windows\System\xvULlXU.exe
  2⤵
  PID:8060
- C:\Windows\System\WJqbDtB.exe
  C:\Windows\System\WJqbDtB.exe
  2⤵
  PID:8092
- C:\Windows\System\RjaVXTm.exe
  C:\Windows\System\RjaVXTm.exe
  2⤵
  PID:7240
- C:\Windows\System\rZbDpWP.exe
  C:\Windows\System\rZbDpWP.exe
  2⤵
  PID:8128
- C:\Windows\System\ycItCBe.exe
  C:\Windows\System\ycItCBe.exe
  2⤵
  PID:6976
- C:\Windows\System\zHVeazA.exe
  C:\Windows\System\zHVeazA.exe
  2⤵
  PID:6332
- C:\Windows\System\yeBsNhI.exe
  C:\Windows\System\yeBsNhI.exe
  2⤵
  PID:7764
- C:\Windows\System\IQkypIU.exe
  C:\Windows\System\IQkypIU.exe
  2⤵
  PID:7464
- C:\Windows\System\kljZylE.exe
  C:\Windows\System\kljZylE.exe
  2⤵
  PID:7552
- C:\Windows\System\pHcXmNm.exe
  C:\Windows\System\pHcXmNm.exe
  2⤵
  PID:7660
- C:\Windows\System\Jhbjjqz.exe
  C:\Windows\System\Jhbjjqz.exe
  2⤵
  PID:7644
- C:\Windows\System\TFLZRjp.exe
  C:\Windows\System\TFLZRjp.exe
  2⤵
  PID:1568
- C:\Windows\System\hGmlcjG.exe
  C:\Windows\System\hGmlcjG.exe
  2⤵
  PID:7740
- C:\Windows\System\dHUcrBI.exe
  C:\Windows\System\dHUcrBI.exe
  2⤵
  PID:8076
- C:\Windows\System\vibwNga.exe
  C:\Windows\System\vibwNga.exe
  2⤵
  PID:8100
- C:\Windows\System\syUYaNR.exe
  C:\Windows\System\syUYaNR.exe
  2⤵
  PID:7620
- C:\Windows\System\EirkCWN.exe
  C:\Windows\System\EirkCWN.exe
  2⤵
  PID:8116
- C:\Windows\System\FfnKVEj.exe
  C:\Windows\System\FfnKVEj.exe
  2⤵
  PID:7892
- C:\Windows\System\nEvgEpI.exe
  C:\Windows\System\nEvgEpI.exe
  2⤵
  PID:7360
- C:\Windows\System\IuhRTPP.exe
  C:\Windows\System\IuhRTPP.exe
  2⤵
  PID:7724
- C:\Windows\System\iNYTBpu.exe
  C:\Windows\System\iNYTBpu.exe
  2⤵
  PID:6780
- C:\Windows\System\LNUUIVt.exe
  C:\Windows\System\LNUUIVt.exe
  2⤵
  PID:8040
- C:\Windows\System\klBniBm.exe
  C:\Windows\System\klBniBm.exe
  2⤵
  PID:7708
- C:\Windows\System\nGabFFJ.exe
  C:\Windows\System\nGabFFJ.exe
  2⤵
  PID:6684
- C:\Windows\System\oPMeSkR.exe
  C:\Windows\System\oPMeSkR.exe
  2⤵
  PID:7340
- C:\Windows\System\lirTiOu.exe
  C:\Windows\System\lirTiOu.exe
  2⤵
  PID:2436
- C:\Windows\System\dOhqLSj.exe
  C:\Windows\System\dOhqLSj.exe
  2⤵
  PID:8044
- C:\Windows\System\TcToHxO.exe
  C:\Windows\System\TcToHxO.exe
  2⤵
  PID:7388
- C:\Windows\System\cywFDIc.exe
  C:\Windows\System\cywFDIc.exe
  2⤵
  PID:1128
- C:\Windows\System\SLKfFJn.exe
  C:\Windows\System\SLKfFJn.exe
  2⤵
  PID:7684
- C:\Windows\System\mDNBfkJ.exe
  C:\Windows\System\mDNBfkJ.exe
  2⤵
  PID:8196
- C:\Windows\System\NsCKOmr.exe
  C:\Windows\System\NsCKOmr.exe
  2⤵
  PID:8212
- C:\Windows\System\zLHMvBO.exe
  C:\Windows\System\zLHMvBO.exe
  2⤵
  PID:8228
- C:\Windows\System\LlWdmnx.exe
  C:\Windows\System\LlWdmnx.exe
  2⤵
  PID:8244
- C:\Windows\System\Rjguffl.exe
  C:\Windows\System\Rjguffl.exe
  2⤵
  PID:8260
- C:\Windows\System\mZrlPZJ.exe
  C:\Windows\System\mZrlPZJ.exe
  2⤵
  PID:8280
- C:\Windows\System\OZqkcOc.exe
  C:\Windows\System\OZqkcOc.exe
  2⤵
  PID:8296
- C:\Windows\System\RwcKCRu.exe
  C:\Windows\System\RwcKCRu.exe
  2⤵
  PID:8312
- C:\Windows\System\fKuaHkB.exe
  C:\Windows\System\fKuaHkB.exe
  2⤵
  PID:8328
- C:\Windows\System\uWQmAiR.exe
  C:\Windows\System\uWQmAiR.exe
  2⤵
  PID:8344
- C:\Windows\System\FcOPgNy.exe
  C:\Windows\System\FcOPgNy.exe
  2⤵
  PID:8360
- C:\Windows\System\CCVGvQN.exe
  C:\Windows\System\CCVGvQN.exe
  2⤵
  PID:8376
- C:\Windows\System\OegXXfq.exe
  C:\Windows\System\OegXXfq.exe
  2⤵
  PID:8392
- C:\Windows\System\GYixybd.exe
  C:\Windows\System\GYixybd.exe
  2⤵
  PID:8408
- C:\Windows\System\Bdggwlb.exe
  C:\Windows\System\Bdggwlb.exe
  2⤵
  PID:8424
- C:\Windows\System\EFXikJT.exe
  C:\Windows\System\EFXikJT.exe
  2⤵
  PID:8440
- C:\Windows\System\FwYfNxj.exe
  C:\Windows\System\FwYfNxj.exe
  2⤵
  PID:8456
- C:\Windows\System\PrfoXOF.exe
  C:\Windows\System\PrfoXOF.exe
  2⤵
  PID:8472
- C:\Windows\System\PFxMtmn.exe
  C:\Windows\System\PFxMtmn.exe
  2⤵
  PID:8508
- C:\Windows\System\qnuJgfA.exe
  C:\Windows\System\qnuJgfA.exe
  2⤵
  PID:8528
- C:\Windows\System\AAcwxao.exe
  C:\Windows\System\AAcwxao.exe
  2⤵
  PID:8544
- C:\Windows\System\exyeXgW.exe
  C:\Windows\System\exyeXgW.exe
  2⤵
  PID:8560
- C:\Windows\System\LMwnxHy.exe
  C:\Windows\System\LMwnxHy.exe
  2⤵
  PID:8576
- C:\Windows\System\rMqrGuU.exe
  C:\Windows\System\rMqrGuU.exe
  2⤵
  PID:8592
- C:\Windows\System\TozsReh.exe
  C:\Windows\System\TozsReh.exe
  2⤵
  PID:8608
- C:\Windows\System\vAwCBLZ.exe
  C:\Windows\System\vAwCBLZ.exe
  2⤵
  PID:8624
- C:\Windows\System\ohnYqRt.exe
  C:\Windows\System\ohnYqRt.exe
  2⤵
  PID:8640
- C:\Windows\System\bugJEtv.exe
  C:\Windows\System\bugJEtv.exe
  2⤵
  PID:8656
- C:\Windows\System\Hoiwtnz.exe
  C:\Windows\System\Hoiwtnz.exe
  2⤵
  PID:8672
- C:\Windows\System\RElNTUr.exe
  C:\Windows\System\RElNTUr.exe
  2⤵
  PID:8688
- C:\Windows\System\xozibQz.exe
  C:\Windows\System\xozibQz.exe
  2⤵
  PID:8704
- C:\Windows\System\VoAQWlR.exe
  C:\Windows\System\VoAQWlR.exe
  2⤵
  PID:8720
- C:\Windows\System\UFKvTTL.exe
  C:\Windows\System\UFKvTTL.exe
  2⤵
  PID:8740
- C:\Windows\System\vuMFmur.exe
  C:\Windows\System\vuMFmur.exe
  2⤵
  PID:8756
- C:\Windows\System\zDnXORf.exe
  C:\Windows\System\zDnXORf.exe
  2⤵
  PID:8776
- C:\Windows\System\xhaKiMT.exe
  C:\Windows\System\xhaKiMT.exe
  2⤵
  PID:8792
- C:\Windows\System\suCjlHS.exe
  C:\Windows\System\suCjlHS.exe
  2⤵
  PID:8880
- C:\Windows\System\CpLANWI.exe
  C:\Windows\System\CpLANWI.exe
  2⤵
  PID:8900
- C:\Windows\System\YCKcsrG.exe
  C:\Windows\System\YCKcsrG.exe
  2⤵
  PID:8928
- C:\Windows\System\MhvQLTT.exe
  C:\Windows\System\MhvQLTT.exe
  2⤵
  PID:8944
- C:\Windows\System\gKIrcpD.exe
  C:\Windows\System\gKIrcpD.exe
  2⤵
  PID:8960
- C:\Windows\System\jAmYctP.exe
  C:\Windows\System\jAmYctP.exe
  2⤵
  PID:8976
- C:\Windows\System\AAYKyRK.exe
  C:\Windows\System\AAYKyRK.exe
  2⤵
  PID:8992
- C:\Windows\System\SgbFicl.exe
  C:\Windows\System\SgbFicl.exe
  2⤵
  PID:9008
- C:\Windows\System\MvVFTav.exe
  C:\Windows\System\MvVFTav.exe
  2⤵
  PID:9024
- C:\Windows\System\mTamLrG.exe
  C:\Windows\System\mTamLrG.exe
  2⤵
  PID:9040
- C:\Windows\System\myPbUFn.exe
  C:\Windows\System\myPbUFn.exe
  2⤵
  PID:9060
- C:\Windows\System\eJYHKOe.exe
  C:\Windows\System\eJYHKOe.exe
  2⤵
  PID:9076
- C:\Windows\System\TERhdUt.exe
  C:\Windows\System\TERhdUt.exe
  2⤵
  PID:9092
- C:\Windows\System\AJcxGYZ.exe
  C:\Windows\System\AJcxGYZ.exe
  2⤵
  PID:9108
- C:\Windows\System\fbCdbVq.exe
  C:\Windows\System\fbCdbVq.exe
  2⤵
  PID:9124
- C:\Windows\System\HPUKdzp.exe
  C:\Windows\System\HPUKdzp.exe
  2⤵
  PID:9144
- C:\Windows\System\MIGTulm.exe
  C:\Windows\System\MIGTulm.exe
  2⤵
  PID:9160
- C:\Windows\System\LVYGmrZ.exe
  C:\Windows\System\LVYGmrZ.exe
  2⤵
  PID:9200
- C:\Windows\System\WJaKETU.exe
  C:\Windows\System\WJaKETU.exe
  2⤵
  PID:8204
- C:\Windows\System\utykWKz.exe
  C:\Windows\System\utykWKz.exe
  2⤵
  PID:8268
- C:\Windows\System\HPMhAPL.exe
  C:\Windows\System\HPMhAPL.exe
  2⤵
  PID:2896
- C:\Windows\System\QdliRrU.exe
  C:\Windows\System\QdliRrU.exe
  2⤵
  PID:8304
- C:\Windows\System\hKAYvEl.exe
  C:\Windows\System\hKAYvEl.exe
  2⤵
  PID:8288
- C:\Windows\System\ykIWQuq.exe
  C:\Windows\System\ykIWQuq.exe
  2⤵
  PID:8340
- C:\Windows\System\qloKBTO.exe
  C:\Windows\System\qloKBTO.exe
  2⤵
  PID:8372
- C:\Windows\System\yUgUvMf.exe
  C:\Windows\System\yUgUvMf.exe
  2⤵
  PID:8400
- C:\Windows\System\WTFpiVu.exe
  C:\Windows\System\WTFpiVu.exe
  2⤵
  PID:8416
- C:\Windows\System\pzoFuYB.exe
  C:\Windows\System\pzoFuYB.exe
  2⤵
  PID:8468
- C:\Windows\System\EvoKAfw.exe
  C:\Windows\System\EvoKAfw.exe
  2⤵
  PID:8480
- C:\Windows\System\edGHSpV.exe
  C:\Windows\System\edGHSpV.exe
  2⤵
  PID:8492
- C:\Windows\System\ClIwVzc.exe
  C:\Windows\System\ClIwVzc.exe
  2⤵
  PID:8484
- C:\Windows\System\qfWcVpJ.exe
  C:\Windows\System\qfWcVpJ.exe
  2⤵
  PID:8588
- C:\Windows\System\IdthKuT.exe
  C:\Windows\System\IdthKuT.exe
  2⤵
  PID:8652
- C:\Windows\System\kNHsOqS.exe
  C:\Windows\System\kNHsOqS.exe
  2⤵
  PID:8572
- C:\Windows\System\CyKFdFv.exe
  C:\Windows\System\CyKFdFv.exe
  2⤵
  PID:8636
- C:\Windows\System\FKVCjBR.exe
  C:\Windows\System\FKVCjBR.exe
  2⤵
  PID:8684
- C:\Windows\System\JPRVvLR.exe
  C:\Windows\System\JPRVvLR.exe
  2⤵
  PID:8752
- C:\Windows\System\nndwPKO.exe
  C:\Windows\System\nndwPKO.exe
  2⤵
  PID:8768
- C:\Windows\System\hEWbLaZ.exe
  C:\Windows\System\hEWbLaZ.exe
  2⤵
  PID:8732
- C:\Windows\System\lDGZSYI.exe
  C:\Windows\System\lDGZSYI.exe
  2⤵
  PID:1496
- C:\Windows\System\vACYPtO.exe
  C:\Windows\System\vACYPtO.exe
  2⤵
  PID:8816
- C:\Windows\System\KYSLyyA.exe
  C:\Windows\System\KYSLyyA.exe
  2⤵
  PID:8888
- C:\Windows\System\JpCNEZJ.exe
  C:\Windows\System\JpCNEZJ.exe
  2⤵
  PID:8984
- C:\Windows\System\tZIuFxf.exe
  C:\Windows\System\tZIuFxf.exe
  2⤵
  PID:8952
- C:\Windows\System\vVJWcde.exe
  C:\Windows\System\vVJWcde.exe
  2⤵
  PID:9084
- C:\Windows\System\BZKUJyg.exe
  C:\Windows\System\BZKUJyg.exe
  2⤵
  PID:9176
- C:\Windows\System\bYZWoBD.exe
  C:\Windows\System\bYZWoBD.exe
  2⤵
  PID:9192
- C:\Windows\System\EUHlYBb.exe
  C:\Windows\System\EUHlYBb.exe
  2⤵
  PID:8240
- C:\Windows\System\RqttUuU.exe
  C:\Windows\System\RqttUuU.exe
  2⤵
  PID:8336
- C:\Windows\System\kowhZQt.exe
  C:\Windows\System\kowhZQt.exe
  2⤵
  PID:8488
- C:\Windows\System\tQgMKtE.exe
  C:\Windows\System\tQgMKtE.exe
  2⤵
  PID:8680
- C:\Windows\System\xITJLQa.exe
  C:\Windows\System\xITJLQa.exe
  2⤵
  PID:8764
- C:\Windows\System\JTddgvn.exe
  C:\Windows\System\JTddgvn.exe
  2⤵
  PID:2624
- C:\Windows\System\XRGhanB.exe
  C:\Windows\System\XRGhanB.exe
  2⤵
  PID:8252
- C:\Windows\System\EASUTmh.exe
  C:\Windows\System\EASUTmh.exe
  2⤵
  PID:8632
- C:\Windows\System\OcbGkRK.exe
  C:\Windows\System\OcbGkRK.exe
  2⤵
  PID:9212
- C:\Windows\System\jsAwyOy.exe
  C:\Windows\System\jsAwyOy.exe
  2⤵
  PID:8368
- C:\Windows\System\oKHqQJG.exe
  C:\Windows\System\oKHqQJG.exe
  2⤵
  PID:8620
- C:\Windows\System\eLUKvbt.exe
  C:\Windows\System\eLUKvbt.exe
  2⤵
  PID:8700
- C:\Windows\System\qqerVYJ.exe
  C:\Windows\System\qqerVYJ.exe
  2⤵
  PID:8916
- C:\Windows\System\vFveeSw.exe
  C:\Windows\System\vFveeSw.exe
  2⤵
  PID:8896
- C:\Windows\System\OqnMNtR.exe
  C:\Windows\System\OqnMNtR.exe
  2⤵
  PID:8836
- C:\Windows\System\KENsCzf.exe
  C:\Windows\System\KENsCzf.exe
  2⤵
  PID:8852
- C:\Windows\System\EcapxcY.exe
  C:\Windows\System\EcapxcY.exe
  2⤵
  PID:8876
- C:\Windows\System\RDcjCVS.exe
  C:\Windows\System\RDcjCVS.exe
  2⤵
  PID:8920
- C:\Windows\System\jJqhgsO.exe
  C:\Windows\System\jJqhgsO.exe
  2⤵
  PID:2128
- C:\Windows\System\CugfgaM.exe
  C:\Windows\System\CugfgaM.exe
  2⤵
  PID:8936
- C:\Windows\System\DYmqjBx.exe
  C:\Windows\System\DYmqjBx.exe
  2⤵
  PID:2124
- C:\Windows\System\BVItQKY.exe
  C:\Windows\System\BVItQKY.exe
  2⤵
  PID:9132
- C:\Windows\System\UCfKYfV.exe
  C:\Windows\System\UCfKYfV.exe
  2⤵
  PID:9220
- C:\Windows\System\ykbhEUV.exe
  C:\Windows\System\ykbhEUV.exe
  2⤵
  PID:9244
- C:\Windows\System\XJqKHAK.exe
  C:\Windows\System\XJqKHAK.exe
  2⤵
  PID:9272
- C:\Windows\System\UheVzwf.exe
  C:\Windows\System\UheVzwf.exe
  2⤵
  PID:9288
- C:\Windows\System\ydkQgNn.exe
  C:\Windows\System\ydkQgNn.exe
  2⤵
  PID:9304
- C:\Windows\System\ughEYQp.exe
  C:\Windows\System\ughEYQp.exe
  2⤵
  PID:9320
- C:\Windows\System\rjZUwaM.exe
  C:\Windows\System\rjZUwaM.exe
  2⤵
  PID:9336
- C:\Windows\System\ngguXlv.exe
  C:\Windows\System\ngguXlv.exe
  2⤵
  PID:9352
- C:\Windows\System\bWlrrbb.exe
  C:\Windows\System\bWlrrbb.exe
  2⤵
  PID:9368
- C:\Windows\System\vgjjvro.exe
  C:\Windows\System\vgjjvro.exe
  2⤵
  PID:9424
- C:\Windows\System\kaxmmzW.exe
  C:\Windows\System\kaxmmzW.exe
  2⤵
  PID:9440
- C:\Windows\System\pNQMXMs.exe
  C:\Windows\System\pNQMXMs.exe
  2⤵
  PID:9456
- C:\Windows\System\YZOAvNM.exe
  C:\Windows\System\YZOAvNM.exe
  2⤵
  PID:9472
- C:\Windows\System\xIRFkNB.exe
  C:\Windows\System\xIRFkNB.exe
  2⤵
  PID:9488
- C:\Windows\System\TJWtvdE.exe
  C:\Windows\System\TJWtvdE.exe
  2⤵
  PID:9504
- C:\Windows\System\BvPGQiS.exe
  C:\Windows\System\BvPGQiS.exe
  2⤵
  PID:9520
- C:\Windows\System\svooeRV.exe
  C:\Windows\System\svooeRV.exe
  2⤵
  PID:9536
- C:\Windows\System\LFicMiR.exe
  C:\Windows\System\LFicMiR.exe
  2⤵
  PID:9552
- C:\Windows\System\vethzrw.exe
  C:\Windows\System\vethzrw.exe
  2⤵
  PID:9568
- C:\Windows\System\MQhBBcJ.exe
  C:\Windows\System\MQhBBcJ.exe
  2⤵
  PID:9584
- C:\Windows\System\lJyCuJB.exe
  C:\Windows\System\lJyCuJB.exe
  2⤵
  PID:9600
- C:\Windows\System\mzBVeeq.exe
  C:\Windows\System\mzBVeeq.exe
  2⤵
  PID:9616
- C:\Windows\System\KrXqOKv.exe
  C:\Windows\System\KrXqOKv.exe
  2⤵
  PID:9632
- C:\Windows\System\VenHGGY.exe
  C:\Windows\System\VenHGGY.exe
  2⤵
  PID:9648
- C:\Windows\System\fxrwzvW.exe
  C:\Windows\System\fxrwzvW.exe
  2⤵
  PID:9664
- C:\Windows\System\psuKDMx.exe
  C:\Windows\System\psuKDMx.exe
  2⤵
  PID:9680
- C:\Windows\System\ojCnxvP.exe
  C:\Windows\System\ojCnxvP.exe
  2⤵
  PID:9700
- C:\Windows\System\hYsVJEV.exe
  C:\Windows\System\hYsVJEV.exe
  2⤵
  PID:9716
- C:\Windows\System\XaJRVGk.exe
  C:\Windows\System\XaJRVGk.exe
  2⤵
  PID:9732
- C:\Windows\System\FKPVLoU.exe
  C:\Windows\System\FKPVLoU.exe
  2⤵
  PID:9748
- C:\Windows\System\uJMoDxA.exe
  C:\Windows\System\uJMoDxA.exe
  2⤵
  PID:9764
- C:\Windows\System\NnlDkmk.exe
  C:\Windows\System\NnlDkmk.exe
  2⤵
  PID:9780
- C:\Windows\System\gmzBYep.exe
  C:\Windows\System\gmzBYep.exe
  2⤵
  PID:9796
- C:\Windows\System\dYUFtjY.exe
  C:\Windows\System\dYUFtjY.exe
  2⤵
  PID:9812
- C:\Windows\System\YLbExUU.exe
  C:\Windows\System\YLbExUU.exe
  2⤵
  PID:9828
- C:\Windows\System\VaxbKRi.exe
  C:\Windows\System\VaxbKRi.exe
  2⤵
  PID:9844
- C:\Windows\System\ilcGFEU.exe
  C:\Windows\System\ilcGFEU.exe
  2⤵
  PID:9860
- C:\Windows\System\JJDGNbw.exe
  C:\Windows\System\JJDGNbw.exe
  2⤵
  PID:9876
- C:\Windows\System\XGvwUgv.exe
  C:\Windows\System\XGvwUgv.exe
  2⤵
  PID:9892
- C:\Windows\System\DNOoYOn.exe
  C:\Windows\System\DNOoYOn.exe
  2⤵
  PID:9908
- C:\Windows\System\ZaEbBxt.exe
  C:\Windows\System\ZaEbBxt.exe
  2⤵
  PID:9924
- C:\Windows\System\cPjJtKK.exe
  C:\Windows\System\cPjJtKK.exe
  2⤵
  PID:9940
- C:\Windows\System\VsItSnJ.exe
  C:\Windows\System\VsItSnJ.exe
  2⤵
  PID:9956
- C:\Windows\System\DJrGKYI.exe
  C:\Windows\System\DJrGKYI.exe
  2⤵
  PID:9972
- C:\Windows\System\UohWmsv.exe
  C:\Windows\System\UohWmsv.exe
  2⤵
  PID:9988
- C:\Windows\System\emUgcMX.exe
  C:\Windows\System\emUgcMX.exe
  2⤵
  PID:10004
- C:\Windows\System\gkfBgBj.exe
  C:\Windows\System\gkfBgBj.exe
  2⤵
  PID:10020
- C:\Windows\System\KJoHUwf.exe
  C:\Windows\System\KJoHUwf.exe
  2⤵
  PID:10036
- C:\Windows\System\bkhvQrI.exe
  C:\Windows\System\bkhvQrI.exe
  2⤵
  PID:10052
- C:\Windows\System\toDboOp.exe
  C:\Windows\System\toDboOp.exe
  2⤵
  PID:10068
- C:\Windows\System\MRqXein.exe
  C:\Windows\System\MRqXein.exe
  2⤵
  PID:10084
- C:\Windows\System\HzoRygV.exe
  C:\Windows\System\HzoRygV.exe
  2⤵
  PID:10100
- C:\Windows\System\IRTMtea.exe
  C:\Windows\System\IRTMtea.exe
  2⤵
  PID:10116
- C:\Windows\System\KEhmomL.exe
  C:\Windows\System\KEhmomL.exe
  2⤵
  PID:10132
- C:\Windows\System\XgzwvhB.exe
  C:\Windows\System\XgzwvhB.exe
  2⤵
  PID:10148
- C:\Windows\System\WzwUzqc.exe
  C:\Windows\System\WzwUzqc.exe
  2⤵
  PID:10164
- C:\Windows\System\lWpTkck.exe
  C:\Windows\System\lWpTkck.exe
  2⤵
  PID:10180
- C:\Windows\System\uJIbFHm.exe
  C:\Windows\System\uJIbFHm.exe
  2⤵
  PID:10196
- C:\Windows\System\WtSQSpL.exe
  C:\Windows\System\WtSQSpL.exe
  2⤵
  PID:10212
- C:\Windows\System\qkIoeuW.exe
  C:\Windows\System\qkIoeuW.exe
  2⤵
  PID:10228
- C:\Windows\System\QPThKto.exe
  C:\Windows\System\QPThKto.exe
  2⤵
  PID:8220
- C:\Windows\System\vBitAOI.exe
  C:\Windows\System\vBitAOI.exe
  2⤵
  PID:2776
- C:\Windows\System\TrADWpk.exe
  C:\Windows\System\TrADWpk.exe
  2⤵
  PID:8324
- C:\Windows\System\ROsnqjk.exe
  C:\Windows\System\ROsnqjk.exe
  2⤵
  PID:2900
- C:\Windows\System\pPpfNOV.exe
  C:\Windows\System\pPpfNOV.exe
  2⤵
  PID:2460
- C:\Windows\System\xBhGVSk.exe
  C:\Windows\System\xBhGVSk.exe
  2⤵
  PID:9184
- C:\Windows\System\LopntMm.exe
  C:\Windows\System\LopntMm.exe
  2⤵
  PID:9232
- C:\Windows\System\YYkPqxH.exe
  C:\Windows\System\YYkPqxH.exe
  2⤵
  PID:9316
- C:\Windows\System\HcjQliF.exe
  C:\Windows\System\HcjQliF.exe
  2⤵
  PID:8256
- C:\Windows\System\lkasyEG.exe
  C:\Windows\System\lkasyEG.exe
  2⤵
  PID:8716
- C:\Windows\System\qWmeuoW.exe
  C:\Windows\System\qWmeuoW.exe
  2⤵
  PID:9240
- C:\Windows\System\JvTSGuU.exe
  C:\Windows\System\JvTSGuU.exe
  2⤵
  PID:9020
- C:\Windows\System\qOVHhkv.exe
  C:\Windows\System\qOVHhkv.exe
  2⤵
  PID:9120
- C:\Windows\System\ABKvaYB.exe
  C:\Windows\System\ABKvaYB.exe
  2⤵
  PID:9404
- C:\Windows\System\tLGpggI.exe
  C:\Windows\System\tLGpggI.exe
  2⤵
  PID:9400
- C:\Windows\System\ceUzPWT.exe
  C:\Windows\System\ceUzPWT.exe
  2⤵
  PID:8352
- C:\Windows\System\uNNUABC.exe
  C:\Windows\System\uNNUABC.exe
  2⤵
  PID:8668
- C:\Windows\System\cODXQMP.exe
  C:\Windows\System\cODXQMP.exe
  2⤵
  PID:8520
- C:\Windows\System\FqFsLIC.exe
  C:\Windows\System\FqFsLIC.exe
  2⤵
  PID:8832
- C:\Windows\System\uiBrtZP.exe
  C:\Windows\System\uiBrtZP.exe
  2⤵
  PID:8972
- C:\Windows\System\YEDOdAN.exe
  C:\Windows\System\YEDOdAN.exe
  2⤵
  PID:9332
- C:\Windows\System\qBOhNwR.exe
  C:\Windows\System\qBOhNwR.exe
  2⤵
  PID:9208
- C:\Windows\System\OpbIMAI.exe
  C:\Windows\System\OpbIMAI.exe
  2⤵
  PID:8844
- C:\Windows\System\ftYVFCE.exe
  C:\Windows\System\ftYVFCE.exe
  2⤵
  PID:8988
- C:\Windows\System\hCwNBYO.exe
  C:\Windows\System\hCwNBYO.exe
  2⤵
  PID:9260
- C:\Windows\System\WZCMrwE.exe
  C:\Windows\System\WZCMrwE.exe
  2⤵
  PID:9360
- C:\Windows\System\wgFrGbl.exe
  C:\Windows\System\wgFrGbl.exe
  2⤵
  PID:2720
- C:\Windows\System\tPqbdvP.exe
  C:\Windows\System\tPqbdvP.exe
  2⤵
  PID:9432
- C:\Windows\System\zAHNlCQ.exe
  C:\Windows\System\zAHNlCQ.exe
  2⤵
  PID:9496
- C:\Windows\System\SwHeEPP.exe
  C:\Windows\System\SwHeEPP.exe
  2⤵
  PID:9560
- C:\Windows\System\JCqBPFz.exe
  C:\Windows\System\JCqBPFz.exe
  2⤵
  PID:9624
- C:\Windows\System\TriPHAE.exe
  C:\Windows\System\TriPHAE.exe
  2⤵
  PID:9688
- C:\Windows\System\XrtjCsF.exe
  C:\Windows\System\XrtjCsF.exe
  2⤵
  PID:9480
- C:\Windows\System\vwLJisT.exe
  C:\Windows\System\vwLJisT.exe
  2⤵
  PID:9696
- C:\Windows\System\gVhjZzO.exe
  C:\Windows\System\gVhjZzO.exe
  2⤵
  PID:9576
- C:\Windows\System\lGxtShk.exe
  C:\Windows\System\lGxtShk.exe
  2⤵
  PID:9640
- C:\Windows\System\wAVGyne.exe
  C:\Windows\System\wAVGyne.exe
  2⤵
  PID:9724
- C:\Windows\System\ONJBVVj.exe
  C:\Windows\System\ONJBVVj.exe
  2⤵
  PID:9760
- C:\Windows\System\dhpzSsL.exe
  C:\Windows\System\dhpzSsL.exe
  2⤵
  PID:9804
- C:\Windows\System\pyTbdjy.exe
  C:\Windows\System\pyTbdjy.exe
  2⤵
  PID:9820
- C:\Windows\System\sKZXbwD.exe
  C:\Windows\System\sKZXbwD.exe
  2⤵
  PID:9840
- C:\Windows\System\LCxGIVe.exe
  C:\Windows\System\LCxGIVe.exe
  2⤵
  PID:9888
- C:\Windows\System\KrUbzmH.exe
  C:\Windows\System\KrUbzmH.exe
  2⤵
  PID:9952
- C:\Windows\System\bTEmGPC.exe
  C:\Windows\System\bTEmGPC.exe
  2⤵
  PID:10012
- C:\Windows\System\tNrpyOs.exe
  C:\Windows\System\tNrpyOs.exe
  2⤵
  PID:10048
- C:\Windows\System\xuzqSma.exe
  C:\Windows\System\xuzqSma.exe
  2⤵
  PID:9904
- C:\Windows\System\RnpwASY.exe
  C:\Windows\System\RnpwASY.exe
  2⤵
  PID:10092
- C:\Windows\System\jFIiEJg.exe
  C:\Windows\System\jFIiEJg.exe
  2⤵
  PID:9996
- C:\Windows\System\whzFTeK.exe
  C:\Windows\System\whzFTeK.exe
  2⤵
  PID:9936
- C:\Windows\System\CHZcEnx.exe
  C:\Windows\System\CHZcEnx.exe
  2⤵
  PID:10064
- C:\Windows\System\RZJHTRF.exe
  C:\Windows\System\RZJHTRF.exe
  2⤵
  PID:10128
- C:\Windows\System\zBbfVuR.exe
  C:\Windows\System\zBbfVuR.exe
  2⤵
  PID:10156
- C:\Windows\System\KyEdXUZ.exe
  C:\Windows\System\KyEdXUZ.exe
  2⤵
  PID:10220
- C:\Windows\System\qoKDXgp.exe
  C:\Windows\System\qoKDXgp.exe
  2⤵
  PID:10224
- C:\Windows\System\dQiUlMS.exe
  C:\Windows\System\dQiUlMS.exe
  2⤵
  PID:8848
- C:\Windows\System\JsCoNQw.exe
  C:\Windows\System\JsCoNQw.exe
  2⤵
  PID:9348
- C:\Windows\System\VMZwxhd.exe
  C:\Windows\System\VMZwxhd.exe
  2⤵
  PID:9100
- C:\Windows\System\erRdJma.exe
  C:\Windows\System\erRdJma.exe
  2⤵
  PID:9032
- C:\Windows\System\xQpTnNV.exe
  C:\Windows\System\xQpTnNV.exe
  2⤵
  PID:9396
- C:\Windows\System\jzJukXl.exe
  C:\Windows\System\jzJukXl.exe
  2⤵
  PID:8604
- C:\Windows\System\uskGJDq.exe
  C:\Windows\System\uskGJDq.exe
  2⤵
  PID:8800
- C:\Windows\System\LfunTJS.exe
  C:\Windows\System\LfunTJS.exe
  2⤵
  PID:9384
- C:\Windows\System\SRWOkyM.exe
  C:\Windows\System\SRWOkyM.exe
  2⤵
  PID:268
- C:\Windows\System\RmODqya.exe
  C:\Windows\System\RmODqya.exe
  2⤵
  PID:2256
- C:\Windows\System\fUKWzVJ.exe
  C:\Windows\System\fUKWzVJ.exe
  2⤵
  PID:9252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CDhhpFy.exe

Filesize
2.1MB

MD5
2a19fbc0334cebf7b61928aa152bb06c

SHA1
323c6f8c51f055ef8745b3b30923d150bf9da53c

SHA256
c921ce61fd4f7112c656ce3e43261755bfb000f3ba5d64799176ab5d3a42ed1b

SHA512
0bb47030d524dc96c3f8b05d89e640820f04d5a756e115bf06e590ad1ad45adfaf58ba4b06eafcecd69367a4a9d5f2382a728baf1e21c2da78ed6b99a39f2cfe

Download Submit
C:\Windows\system\JSDpjdW.exe

Filesize
2.1MB

MD5
7440172c2a7832703e6fd950a6e1464b

SHA1
359267f62114cb94c55ad0aa0ff92fdb4d4b4294

SHA256
8c3382f09604d108b4fc71ad4add2b2df4dff140f6177274f6f452e2c4580c6e

SHA512
3653edf3325b765fdee64308b0f74773aa1d2baa718fa327b0158e6a476d9978c9a3f68673fb8273f23fd4183825dc19a826dc048e3b9b8139197868daa85b3c

Download Submit
C:\Windows\system\LzHxuRk.exe

Filesize
2.1MB

MD5
f669c613a55916232039e6260350942d

SHA1
eb1ac7316d3cb77478c3296bdf94548ef7004151

SHA256
d8520b767198d25658c2c5551e4d7aa6abcb6280a3f094c8568bb6c2327582dc

SHA512
39bedbe6ab79e2e02569325c683e23b9ef66f21d4584bb1d5bca3df09434b79ba19d90cbfed299df140282e09d00c93f445a33cad9bace560d7cc8ba18304325

Download Submit
C:\Windows\system\NRDrZqY.exe

Filesize
2.1MB

MD5
c58a126b600dc857df983fa02e23d308

SHA1
b3be712cbeefeb69d2c8d8bb6b2a935dba0ce9f6

SHA256
36e23c62dbd67d4fa2ed339ec9a5007abd0214a83a57bad53ae4f3261071fce2

SHA512
3709af1321c709be4565ffc0192ac2001d5468483a1a58435288a68277fecddf4347a6b91335a2a998f32a37322fece4dfc10aa9716727d33932a6a886c78d25

Download Submit
C:\Windows\system\TrPydGZ.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\system\TxAqBOu.exe

Filesize
2.1MB

MD5
1919e1a7833fe8be551d883871a64f3e

SHA1
f744c56f3f40eeb641c19f915c5b6ee20d2afeca

SHA256
d56f12d0069f12c021c748044b8485f10abce3f26fd6e0eaa6e7bff31d8dcb77

SHA512
17eab0e12f37bce59c5ebd410e68ce70812307caf971ba0e9f12b55a8fc04a6e88101e5087e8f559c2234a2671b26802f6af8779b6cf32330734319fc83c90d3

Download Submit
C:\Windows\system\cgPHbPo.exe

Filesize
1.1MB

MD5
a093996abe7835e88584180c57950227

SHA1
f5920a542348decd0056be3a87a1ebc9c3386a7e

SHA256
93daf8ef56540f6302ad2d84984497e4b8556382a87ce404daadbc7c57d91d3e

SHA512
1242dd7797f9ae6b8802e7416446c32b2e7b0547d149b48b7c9a2d2c3f7931daf0de7c76d0b42629f664b31654b498df0ac76a74be79956db543888d1af56c75

Download Submit
C:\Windows\system\dHeZnLw.exe

Filesize
1.8MB

MD5
481d028534e82a4ec954575cfcae44f8

SHA1
3a2cf7a9847d360a63374f21236e90771e5961b5

SHA256
37b836ec74fa47401e5af0fe819d7f69fe8bb4710815b911e63a7f1e4e0aaf26

SHA512
8168058dc40f92adad47313c1cb84a2bb9a43d557001cc8a8a3ad36bc8dd4a771efd9939e8eace2a5e3774cd515a7b968ec9ed8e36a1bb0a52658d9d9c4a7d9c

Download Submit
C:\Windows\system\ehOptOt.exe

Filesize
2.1MB

MD5
4fb499312c6c2b0be79c70f21981a0df

SHA1
71bf502fa52fe2d3dc5431d95958951d3a1c1330

SHA256
a13f4f2b4bd077c392edafef38f5643df7a869cdb709b2d9e504f953a2e8d3e0

SHA512
7189d5961e69ca5434d6044ecf35b61edb8769b85639aaa188d6ffde50b9d3dfb918d259c8c3b715feafe7b33faba03e8620db9c9e2b598360782139d6d4b13c

Download Submit
C:\Windows\system\iHsclbz.exe

Filesize
2.1MB

MD5
7f43a1dbba92d83fb353d03913ce7081

SHA1
132ae65a432a364073ffb5201562d74c8a920db7

SHA256
0dae97426e9201b76f6a707668f4b3f6ffe8f44b08856607b8fb88eef9aeed60

SHA512
b65bfd25238496ff9f3376ca2392775b1b1ccbc69bf7a7e922687a05066c93c6649ec9cafb5b13e32b8776900044332f199fd20c24932f15415de9cfc9ca4247

Download Submit
C:\Windows\system\khmDBCl.exe

Filesize
2.1MB

MD5
db8f71b55d0acbdeb736d582ccde2585

SHA1
816666a032c39ec6982526fbbbfe8cc658e3e6d7

SHA256
20e4b3e53fda411e626180e483a7d816398a3966a854f55051042d4dda20008d

SHA512
331081af714ec8a1b644b4a357d11476ee4af6dc401892520cab5f08caf694da3ec8d098b9e5715e47c5a2d82d81955adcaf6c7597a7e4e2f52353a96addfbd7

Download Submit
C:\Windows\system\leyETTZ.exe

Filesize
2.1MB

MD5
04af9051868d65da8dc4a745d150fe1a

SHA1
baf869064ec07738b2979b9bef7f9e6c06b2ed62

SHA256
05155a856de4a22ff0c5b8cad315ca8d895cb2d9589a38c26ca5b5656a42cfb6

SHA512
e094e98593cfb92d6b3b695f7bd92c0301247a0cc500545f9fc17f8d7f7f5173ae39d65c17186f88f84bf32ab2d3ac477f26b8a5090e10dc89c8b02d21fe65b7

Download Submit
C:\Windows\system\mJUVZcZ.exe

Filesize
2.1MB

MD5
9f10c27f77de21038eed5b10f8296d91

SHA1
31d9b906429f34eb6386f391e0a2e6c653f424f6

SHA256
2a12d3603f0ecdde6da04a020ac633f4a4451498c36dce4d185732a1b60a02e5

SHA512
c540af4946477a818d570b702e9d9eab871096c2ca41e1e81cb4502413ab3d43b4fd2ed194285f8b13a937a077983eb19e4face4b0fe688b32ff73389405558d

Download Submit
C:\Windows\system\pggWWxL.exe

Filesize
2.1MB

MD5
edc49b7ee6f2c51bacac289dab5f7988

SHA1
e88b578426cfc3edbdb58e84a36e9aaa08c0277c

SHA256
8c9b32783f54150a648741e16f4590a7d45ad085eb430b38916086ee081089c5

SHA512
f99f050be6d4fb15a2c32fe229e47039136a0c9d81024cd84afde1cfb732d46523b67318e3b626e336a6bd2e614b431531f27e2261cf42b1a3f1f7211124d08d

Download Submit
C:\Windows\system\pxwHczq.exe

Filesize
1.1MB

MD5
f36ec215f82a5782ccb9780f94b752e1

SHA1
84e88485b6d38ceb84b71ea3a8d522e35df6936c

SHA256
03fda1835733bb0ac6e0cad0059f41e8e03a186960850d77c277bd82ea67b2bb

SHA512
837902d3a8cc8cdadb087904e19dbdbcd2ca7df108c5a5f618e56b2e37354f8b4f58466f427ff4d84efb58508f8929304ad3e5ed0828fc3afde0bcede8033bb8

Download Submit
C:\Windows\system\qBGjKaa.exe

Filesize
2.1MB

MD5
dce263e5ecbe91a11a38f0cf38cf3998

SHA1
36322d18d5b0531ded4e865f3f698ea4293cecef

SHA256
f23a43bae2681214ec842e61cb13ccd625232525300c5923d2378671a0a1c93e

SHA512
d5a2d531ac842f3b449703eb20dbf59a70172543f39897ae193b8db5d3cdf4a38a38edefe42afbc3a4f284c6f57239f52776125185e279c08434937399631cb4

Download Submit
C:\Windows\system\qNBvxEw.exe

Filesize
2.1MB

MD5
31dd1c776a80f5ad2b639b8300ede1d2

SHA1
b5f7024a22961db6adc84f22c4364b89a26a7764

SHA256
866ad221960b1a988cd5615b99a61d1721dbd70bc344abe785422deedf7f121e

SHA512
e4825d03d763ff09736329dbe917bdbbd1954c3795a6b4f8a56d8593254bc694f3499872a8f525b9547245d55398e644d9f9575247f548b71f20414cec801cef

Download Submit
C:\Windows\system\sMkFTdC.exe

Filesize
2.1MB

MD5
c70b527c04ef3edec27ebfb4595806c6

SHA1
0d8857d2e42eee5c40ace86d5631c2ece27091f6

SHA256
5e622ce8fe0041f99cc67d839808928a1ad1d4889b17365c07df0c72198706f2

SHA512
2b210f6d6c11b8b1942dedc45f1697e9d8efea66416e8fb1a5f34cf704d286c3f13674640243ddfd29c1dd6d5f24ef698e5360d283da965278dd0b9862698522

Download Submit
C:\Windows\system\snLapyR.exe

Filesize
2.1MB

MD5
fc2b597701638abd1352e330e36ee226

SHA1
7efadd559f520a1d3c9a3149ca9abc793a217d51

SHA256
ddaa4073841cfb9f2bbbe676b84f4f505ad73e374a1e949986074aa91d9cb63a

SHA512
be9d9a4ee612b10c0b6bd84dac8bb9dd0151bf3e3a09ae84173f4f23c196de0b9d0ca18f4cb8c42093d7bcba39e935f556d607cb844f82fe65d7a5c237742bca

Download Submit
C:\Windows\system\tBFIJwq.exe

Filesize
1.2MB

MD5
79280af93d358e9cddb0dd704c769973

SHA1
a365c3436004a87f5b4722b955b5d15d4c020431

SHA256
fe492aeccc915e0cf6ec4d2106f512e438c4076addae9f49a9a069b80a1dcd27

SHA512
6c574000a6a82bc330fd88227faeec0a3141f8d8ef12db1c3148da5f52be8f2870ff28e575f31c1b2bae14d1f0e178a22f4ff77963e9f9b121395f8bf328c932

Download Submit
C:\Windows\system\tiTqHeO.exe

Filesize
2.1MB

MD5
f0f09c606fdc3645d6503a1998d8b512

SHA1
7339fc62791de953478bc2d49aa18be9cf8c6b51

SHA256
1c20c93e20656c089446cc8f6bf2c97186caf8e1817e2ff75f1a9f7b6be4297b

SHA512
53de1fec8ce99649fec10f5eb854e524833aa6d2d5600fa0633a51fe6dbd2ff9fc67b8e0d71fd45bda8b294680fcd2b01a240bbec031f3b87dacdc9e8f23023f

Download Submit
C:\Windows\system\uNOjkRs.exe

Filesize
2.1MB

MD5
de26915a5fd43ce3b50d4776fcb88aee

SHA1
ef94704ae077385e376b581cccb99eb4343b598a

SHA256
4cf56516721a09cfa4aeb5b98088f9d828fb8f4ec8715915c2fbc22156691c67

SHA512
744a1ad7544be6fc864dd69dba71adb10aa18f918d91c390cf96f18d6d55e3ef87788e11310ddfa91cebe9ac0594839c990a344a7fd292ba72c0f1df4cd666d1

Download Submit
C:\Windows\system\zkazWOZ.exe

Filesize
1.9MB

MD5
d63489651d5beea3b9ca4a1f60ba7270

SHA1
210bae16460260b420c5a3fd6f0f1bd15ef7db24

SHA256
ec2c407217f45c3ff7e0b2ce947f0d12da4ef8089b97e28f5b2178f75908579a

SHA512
be623ae1ef1fba909fec9fb4d9b2d2766c3321badc1bd7f6a4b745e46e91f0dd006cfbe836e10b76b90b60dfe1401528c455d2797078abdd6c8c58755e1c9b0b

Download Submit
\Windows\system\CvhyrCj.exe

Filesize
2.1MB

MD5
531113fef495ce0103cb4c7e2e742402

SHA1
6e3a9ab49e1e16375befd8403fcd1bcd1f44375d

SHA256
0c24cf31029f4cfcb15c1e1bc63afbda4d85becbbe3d7f75614b483a787ec522

SHA512
067d32ee1db0db6c3ac01eebbfee844b26d72c1448948ff2888a04757bf08bdfa5dd78706e18e39570d1f9bb6db4ad900fea82a86c9bbb70642a5780d4006221

Download Submit
\Windows\system\GRkioIU.exe

Filesize
2.1MB

MD5
6d47df59d9340ff8f73ffc0cdf0b5e54

SHA1
de7385bfebb9742883a61eb8623c6070519ab714

SHA256
10d22b68e6b6d5857d2bc4555fc85648f6632e2701fa35c8c0edf9cd8b79ccc4

SHA512
f76dd9190064b032393f9b09a1472ad6f0c1bc7861095686e1784849ac176a1b229a803bd265b7dc11f8987a21a8c6b2152cf0351e77b6655752949e6121dde7

Download Submit
\Windows\system\HCrfzdD.exe

Filesize
2.1MB

MD5
9f892c22d8d7ff61b551e2eb8489e89e

SHA1
0749bd3053a34c4e263e25ff406d130c3f1625d7

SHA256
967c1eb156db8d23cf39b3d7d0f2e539810407023dfb1b7f43d2334093df6b89

SHA512
ec00b6f2b2e9a6544658665e29df72d8fc169dec5ac69369100344d7d5429014448ae93161b17bb82df5e48635025185ecd112e5b20a2f7a78d167d20fc75a0f

Download Submit
\Windows\system\VtgdBQP.exe

Filesize
1.6MB

MD5
619bcbaf75ed68ba403c6fe0a4cc2273

SHA1
6efe227909e8a08696cba1f26eae3a0b584562af

SHA256
4fdc1bb76d9c333165fe9797b06d9d319bd2da71d34f48ec60d4b9e08e67fafb

SHA512
f15d166736619115d26b32bc8c5e4d2ee5fff948e84fb59cfc145175192504258f0a0f2aeadb79f47dbe60b5b326d23bab2f8b9f1deb2cfd2bc51f38e9c2da19

Download Submit
\Windows\system\cpdcuET.exe

Filesize
2.1MB

MD5
040371db542ec7254901ce584de2bd02

SHA1
13ecf6b0cecb6ec702c2bb5f25e1cf03ab13e5f9

SHA256
36b77e8406b7237ca258c6ecacc1c1abf1194e75c4a8e5b5f9968df28a2f018f

SHA512
f60ecdb524f57cb29dfe971b29f42fe51d3236d06b9773009dc639a7ca45f6d16974588ed6bb35075a15486f2876ce0c060275256e6d42feffcd65bc8b44bf3c

Download Submit
\Windows\system\dHeZnLw.exe

Filesize
2.1MB

MD5
49079c9efb1b13faae6e615ce4a2385d

SHA1
e22d93c5b8bf8492aa07f051dc8d66305fc37ea6

SHA256
2807c52a79e57688a8ed650f57150c41570c2cb72155126f8576025dd4bedfbe

SHA512
7d17e6a5e0c939844e51b5ad5b0c22351c945aa6d448361282308929142f1c29d9d6c8a9e8d2137818539c218c3fddc1bc0700c21a7e3e5144dee347a00bed3e

Download Submit
\Windows\system\eKwLKMQ.exe

Filesize
2.1MB

MD5
619cdd8c15c10cfca155c948648548ce

SHA1
981e9cf0752d4b61a33f231608e8213baadb7ff3

SHA256
23d97573af8ec46f0f0465261b40bfcfef6a747f92d496e37e0f498da708d0df

SHA512
8121b02ade6992bfe84161dba9ca9bae1e910b404abe157ceb0bffec2f032cac81591a1c9e94e06998a7f47230bf2bfc7ffe74c6e5b7f68d65b0fc4985fc0711

Download Submit
\Windows\system\hWsxNXm.exe

Filesize
2.1MB

MD5
fa3f13c111ce45eb18a834d1eea5074c

SHA1
b2ccd3f4b6154e2fc1ab035e8293a5ec14f6d6c6

SHA256
08a09548c4eebb3f17a7f3263675a8e7e384ac75be7861c87d093ba6660c4c5a

SHA512
1c76349bf6cc2f5fc94d4610d8a4fc8d12109b830ec23a6cbbe4839e88457cc841a7b62af61184737a861a277b8cb8bc8e39473f475e8da4493a324866b71b3b

Download Submit
\Windows\system\pdUNELR.exe

Filesize
2.1MB

MD5
cf2b57aacacdcaacf08b495e4f109796

SHA1
5ab9738b4d3ce6cd4195f5e1239b1b7d293105b0

SHA256
75e0d28498c50161be942b07ab896d151f200e4b762ae877e0c14b023dc0aeff

SHA512
540759c973d479614bbc8a665e61f7a360c9a0508402da15e91e7adb95c3df0380ff9b831e59dbc8287d29d20640a288ebb1f362434e8bc76c824e937a7ed4ee

Download Submit
\Windows\system\pxwHczq.exe

Filesize
1.4MB

MD5
8c65bf048d79c20d76a6ab977bdbe46d

SHA1
9ea4e92aec6dec88dfe6bd542a346aeb787732da

SHA256
ad569c0225fa96f78c0937c41bd21a1e91c64d90cb4ce697f14f9a5f1e2f4506

SHA512
39d348eae857f2097704385e0803075573c149ddbdadedd19f01cf7e9beff3cf6094febd226f27958db3d9c422c833413a00b6d7b2a3ebccbb9969ef676cc097

Download Submit
\Windows\system\tBFIJwq.exe

Filesize
2.1MB

MD5
928aee63b74d9fd1dec0a5a2b7b2a14b

SHA1
e9cdd66cc7c968ae9182670734bdafb613665191

SHA256
d186c5a219f9923faca41439e20f10c15cea631cdcde7f9b0e70d6db4e44b7fb

SHA512
5028c6bb54fb8c703ca2f5c98dd72bc7859776848ae1c85dafb4d9c122d972988241d7fb21ac0c2523cbbeb8c66793091eef96bcb80b5f3807952bc06d4e7296

Download Submit
\Windows\system\uNOjkRs.exe

Filesize
1.6MB

MD5
05a331103ecdffe0180b3703fd8674d5

SHA1
27ddc5aa6407b12306e4cba92a0a3e83f6d2b2fd

SHA256
d5c332128500d9d40a05cfd81f26912a9d5c6fc20bc98445964462c679230f01

SHA512
04609c18f9b8c314877dcf3f193f487111b3bdee4c5a11b521d0ea13ea4980aa7a84b38289a00171227bef1be14585b66bbb25cea978ffa3071fa72f41b81c33

Download Submit
\Windows\system\ujomByn.exe

Filesize
832KB

MD5
5a44f7cdb1383926341c50c0b001559c

SHA1
072604877b2958c577c586d14139d39f012c00dc

SHA256
b75baa9dc61a064a9b06da3e5924cf08262f544320736d419b68b7e009465f5a

SHA512
30a6a06711e9a2cdc19340bf113bead6e9cba8ddda330cd10bd1e6eff2082327b1e5ffa8ccbfcf381b643fb74eb238f08dbcab8fcd9bf4de72412df3047a6c30

Download Submit
\Windows\system\yBIgXMY.exe

Filesize
2.1MB

MD5
f0884c1d5ddc78f010f4df77d4c27aa2

SHA1
f5376b776c5fcf7e8a1cec977210284d1610a4cb

SHA256
60053f8e7565feb3eb0d8b4bfff68ce9f0898ab6333a2e098289af25090dc0d0

SHA512
4744ec1fd783c6068e4480ea641428ca1af0c3cfdc2e9dec2640fefb2e49002ad2e1549c754fbca6110d2c1bafad4043654d744c1ab61c107e64732e860cab64

Download Submit
\Windows\system\zkazWOZ.exe

Filesize
2.0MB

MD5
b3ea71763dd4a2e2ac7c6a5b45eb75ce

SHA1
5aab1de6b6a564d4f6a9dd77fd3692a3e820132b

SHA256
cb25a5365a18df8a2204cbb9912873a06243a02009d7c30edfc40e6d6da01a21

SHA512
d66f24ab083c2ab886ee1e5335bccddfcc85eaee8674b8a99c01abe852bbe3c19c8cf617261c50a6c87431dd14ec009e4c81f7bcb2a38ce081d7bb3c1974dae8

Download Submit
memory/1632-225-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/1632-1-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-12482-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1632-224-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1632-214-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/1632-199-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1632-221-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/1632-207-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-203-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-217-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/1632-208-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/1632-12-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/1632-218-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-205-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/1780-213-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/1780-4540-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2152-197-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2152-4531-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2236-216-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2236-223-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2236-18-0x0000000002F20000-0x0000000002FA0000-memory.dmp

Filesize
512KB

Download
memory/2236-19-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmp

Filesize
4KB

Download
memory/2236-87-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2236-54-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/2236-787-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2236-194-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Filesize
9.6MB

Download
memory/2440-4542-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2440-215-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2472-4539-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-222-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-13-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2520-4529-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2556-4535-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-211-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-4534-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2564-206-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2596-4533-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-200-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-4536-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-204-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-4537-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2716-212-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2996-4532-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2996-198-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download