xmrig | 7f426cc552fb8fa050b7f0ef516060ff59c29c71ab9582b25a0bedb67c8b8ddc

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
Size

2.1MB
MD5

9d29787878dbac06f0a7091d3f24c47c
SHA1

11438f9c2e79a46962a5e5df0b50b49ac672d83a
SHA256

7f426cc552fb8fa050b7f0ef516060ff59c29c71ab9582b25a0bedb67c8b8ddc
SHA512

9de171fcc6ca83706435c3c8d8fad6a2b1932208c44d0cfcd6bdeab75035ca61bd73d64919e6bc09657888e3b23bfcb77b040fcd02b6d2bc94dc22f6089560bf
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMG:NAB+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2092-145-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2544-125-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2676-74-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2632-69-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2540-148-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2808-134-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2344-41-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2032-36-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2544-3927-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2092-3928-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2676-3929-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2632-3930-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2808-3931-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2344-3932-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2540-3934-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2204-11722-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1508	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2032	hJeDpLr.exe
2344	izRPCZk.exe
2632	ZrwWwQr.exe
2676	ZyqAcjP.exe
2092	AenzLFv.exe
2544	FZZJlqV.exe
2808	YDHCikV.exe
2540	AmILLsg.exe
3068	fuRzRqC.exe
316	KmuGruN.exe
2964	xijCMdM.exe
2924	DFyFIGj.exe
3048	mnLEVyb.exe
2020	rPkgpuk.exe
1340	xINrMQc.exe
2712	SKjbPeY.exe
2736	uwhgouS.exe
3020	UOLiNBD.exe
2556	uwSPdtp.exe
1636	LCYdMjW.exe
2644	eeHjmDo.exe
2072	kDIGvCR.exe
2856	jBjqutv.exe
3044	Kqcfnva.exe
1264	wExPEsk.exe
1964	rUzpoKP.exe
1464	OgrzgTH.exe
2464	LNFKvEC.exe
2744	dyGGRJg.exe
1432	AtUDplQ.exe
1100	UmXKZTx.exe
1816	vHmhlJX.exe
444	WmziHmU.exe
2332	ivvjCoZ.exe
2296	CiotRCS.exe
780	bPkcVcj.exe
3008	mTrmZKY.exe
1796	XoOYOmK.exe
1936	EfvBsWi.exe
2472	ZOQGbPM.exe
3000	RoqafPA.exe
1164	KnxjeJB.exe
2952	CjIQasY.exe
2024	uSLjisv.exe
2136	BHfDvfc.exe
1632	muTOeRK.exe
1700	OeHEJHg.exe
876	fFEqdTw.exe
2944	hPgIczk.exe
1572	YjgcLEg.exe
1736	SLsthrf.exe
2012	kmDNSAI.exe
2568	CCfAMMH.exe
2832	YwpfsRx.exe
2560	LbQWxEv.exe
1160	rohISoj.exe
2772	lBhinLH.exe
2948	nggBkps.exe
624	zeOqMsL.exe
1968	QoplQzB.exe
1836	LdStPqK.exe
656	vrpNBgZ.exe
1928	SzjkjUt.exe
2276	fFAiVPe.exe

Loads dropped DLL 64 IoCs

pid	Process
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0031000000015cf5-8.dat	upx
behavioral1/files/0x000c000000012263-5.dat	upx
behavioral1/files/0x0007000000015fbb-19.dat	upx
behavioral1/files/0x0008000000015d99-13.dat	upx
behavioral1/files/0x0008000000015d28-11.dat	upx
behavioral1/memory/2092-145-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d2d-45.dat	upx
behavioral1/files/0x00060000000175f7-174.dat	upx
behavioral1/files/0x00130000000054a8-175.dat	upx
behavioral1/files/0x000600000001738f-164.dat	upx
behavioral1/files/0x00060000000171ad-163.dat	upx
behavioral1/files/0x0006000000016fa9-162.dat	upx
behavioral1/files/0x0006000000016d79-161.dat	upx
behavioral1/files/0x0006000000016d5f-159.dat	upx
behavioral1/files/0x0006000000016d4f-158.dat	upx
behavioral1/files/0x0006000000016d3e-157.dat	upx
behavioral1/files/0x0008000000016d01-152.dat	upx
behavioral1/memory/2544-125-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x00060000000174ef-122.dat	upx
behavioral1/files/0x00060000000173e5-113.dat	upx
behavioral1/files/0x00060000000175fd-168.dat	upx
behavioral1/memory/2676-74-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x0006000000016d57-73.dat	upx
behavioral1/files/0x0006000000016d46-72.dat	upx
behavioral1/files/0x0006000000016d36-71.dat	upx
behavioral1/memory/2632-69-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/files/0x0006000000016d21-43.dat	upx
behavioral1/files/0x0007000000016126-42.dat	upx
behavioral1/memory/2540-148-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2808-134-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x0006000000017577-132.dat	upx
behavioral1/files/0x0006000000017436-131.dat	upx
behavioral1/files/0x00060000000173e2-130.dat	upx
behavioral1/files/0x000600000001738e-129.dat	upx
behavioral1/files/0x000600000001708c-99.dat	upx
behavioral1/files/0x0006000000016d7d-97.dat	upx
behavioral1/files/0x0006000000016d73-96.dat	upx
behavioral1/files/0x0007000000016020-95.dat	upx
behavioral1/memory/2344-41-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2032-36-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2544-3927-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2092-3928-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2676-3929-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2632-3930-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2808-3931-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2344-3932-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2540-3934-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2204-11722-0x000000013FE90000-0x0000000140282000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\upfGwtd.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\SLsthrf.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\oAwdySK.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\bIGUPci.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\jjICLWN.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\XYEVTMC.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\FRmsnVq.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\FBxTjvK.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\EWilPEx.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\BStnVEv.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\zberjwD.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\LaRImWB.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ezAFoYl.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\rNqqanI.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\DcpzLOS.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\vKJezaF.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\IpfxWTF.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\JdOMHjJ.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\xWvHEMX.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\OTHzyDn.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\OizYhaF.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\GAJMvIn.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ZyCraBU.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\BjzzIYd.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\yNFFMOn.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\rVvCTXS.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\VUsJOPO.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\lFZuaDy.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\aqYNRYO.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\AWINeTb.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\xJKJwch.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ZmQPgtR.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\rzyVwFO.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\bODZfqF.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\UWBzXvD.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\yRgdapw.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\GmqKujm.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\zxJEjhJ.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\yIGWjBs.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\KLUlNyY.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\clzQusK.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\tEhRuzC.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\snBpUYh.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ADjePkh.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\wBIFllA.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\xOErzLV.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\UYLxyjU.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\sEltHiL.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\xIynxbi.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\kcyRRBW.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\BEXkRir.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\hEniDzn.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\LveFXQK.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\plmSats.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\yoZxMBN.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\hqXpdDl.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\WJIqaXY.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\NYQOuBV.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\jgwoIPd.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\tLfcHmD.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\lhUXEuA.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\ajeXjft.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\eiMSkGg.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
File created	C:\Windows\System\RMprRIh.exe	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1508	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
Token: SeDebugPrivilege	1508	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1508	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	29
PID 2204 wrote to memory of 1508	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	29
PID 2204 wrote to memory of 1508	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2032	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2032	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2032	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2344	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2344	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2344	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2632	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2632	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2632	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	32
PID 2204 wrote to memory of 2808	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2808	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2808	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	33
PID 2204 wrote to memory of 2676	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2676	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2676	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	34
PID 2204 wrote to memory of 2964	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2964	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2964	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	35
PID 2204 wrote to memory of 2092	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2092	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2092	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	36
PID 2204 wrote to memory of 2556	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2556	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2556	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	37
PID 2204 wrote to memory of 2544	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2544	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	38
PID 2204 wrote to memory of 2544	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	38
PID 2204 wrote to memory of 1636	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	39
PID 2204 wrote to memory of 1636	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	39
PID 2204 wrote to memory of 1636	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	39
PID 2204 wrote to memory of 2540	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2540	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2540	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	40
PID 2204 wrote to memory of 2644	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	41
PID 2204 wrote to memory of 2644	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	41
PID 2204 wrote to memory of 2644	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	41
PID 2204 wrote to memory of 3068	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	42
PID 2204 wrote to memory of 3068	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	42
PID 2204 wrote to memory of 3068	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	42
PID 2204 wrote to memory of 2072	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	43
PID 2204 wrote to memory of 2072	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	43
PID 2204 wrote to memory of 2072	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	43
PID 2204 wrote to memory of 316	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	44
PID 2204 wrote to memory of 316	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	44
PID 2204 wrote to memory of 316	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	44
PID 2204 wrote to memory of 2856	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	45
PID 2204 wrote to memory of 2856	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	45
PID 2204 wrote to memory of 2856	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	45
PID 2204 wrote to memory of 2924	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2924	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	46
PID 2204 wrote to memory of 2924	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	46
PID 2204 wrote to memory of 3044	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	47
PID 2204 wrote to memory of 3044	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	47
PID 2204 wrote to memory of 3044	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	47
PID 2204 wrote to memory of 3048	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	48
PID 2204 wrote to memory of 3048	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	48
PID 2204 wrote to memory of 3048	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	48
PID 2204 wrote to memory of 1264	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	49
PID 2204 wrote to memory of 1264	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	49
PID 2204 wrote to memory of 1264	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	49
PID 2204 wrote to memory of 2020	2204	9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9d29787878dbac06f0a7091d3f24c47c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System\hJeDpLr.exe
  C:\Windows\System\hJeDpLr.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\izRPCZk.exe
  C:\Windows\System\izRPCZk.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\ZrwWwQr.exe
  C:\Windows\System\ZrwWwQr.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\YDHCikV.exe
  C:\Windows\System\YDHCikV.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\ZyqAcjP.exe
  C:\Windows\System\ZyqAcjP.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\xijCMdM.exe
  C:\Windows\System\xijCMdM.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\AenzLFv.exe
  C:\Windows\System\AenzLFv.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\uwSPdtp.exe
  C:\Windows\System\uwSPdtp.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\FZZJlqV.exe
  C:\Windows\System\FZZJlqV.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\LCYdMjW.exe
  C:\Windows\System\LCYdMjW.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\AmILLsg.exe
  C:\Windows\System\AmILLsg.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\eeHjmDo.exe
  C:\Windows\System\eeHjmDo.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\fuRzRqC.exe
  C:\Windows\System\fuRzRqC.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\kDIGvCR.exe
  C:\Windows\System\kDIGvCR.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\KmuGruN.exe
  C:\Windows\System\KmuGruN.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\jBjqutv.exe
  C:\Windows\System\jBjqutv.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\DFyFIGj.exe
  C:\Windows\System\DFyFIGj.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\Kqcfnva.exe
  C:\Windows\System\Kqcfnva.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\mnLEVyb.exe
  C:\Windows\System\mnLEVyb.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\wExPEsk.exe
  C:\Windows\System\wExPEsk.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\rPkgpuk.exe
  C:\Windows\System\rPkgpuk.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\rUzpoKP.exe
  C:\Windows\System\rUzpoKP.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\xINrMQc.exe
  C:\Windows\System\xINrMQc.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\OgrzgTH.exe
  C:\Windows\System\OgrzgTH.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\SKjbPeY.exe
  C:\Windows\System\SKjbPeY.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\dyGGRJg.exe
  C:\Windows\System\dyGGRJg.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\uwhgouS.exe
  C:\Windows\System\uwhgouS.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\AtUDplQ.exe
  C:\Windows\System\AtUDplQ.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\UOLiNBD.exe
  C:\Windows\System\UOLiNBD.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\UmXKZTx.exe
  C:\Windows\System\UmXKZTx.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\LNFKvEC.exe
  C:\Windows\System\LNFKvEC.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\vHmhlJX.exe
  C:\Windows\System\vHmhlJX.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\WmziHmU.exe
  C:\Windows\System\WmziHmU.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\CiotRCS.exe
  C:\Windows\System\CiotRCS.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ivvjCoZ.exe
  C:\Windows\System\ivvjCoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\bPkcVcj.exe
  C:\Windows\System\bPkcVcj.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\mTrmZKY.exe
  C:\Windows\System\mTrmZKY.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\XoOYOmK.exe
  C:\Windows\System\XoOYOmK.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\EfvBsWi.exe
  C:\Windows\System\EfvBsWi.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\ZOQGbPM.exe
  C:\Windows\System\ZOQGbPM.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\RoqafPA.exe
  C:\Windows\System\RoqafPA.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\KnxjeJB.exe
  C:\Windows\System\KnxjeJB.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\CjIQasY.exe
  C:\Windows\System\CjIQasY.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\uSLjisv.exe
  C:\Windows\System\uSLjisv.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\BHfDvfc.exe
  C:\Windows\System\BHfDvfc.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\muTOeRK.exe
  C:\Windows\System\muTOeRK.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\OeHEJHg.exe
  C:\Windows\System\OeHEJHg.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\fFEqdTw.exe
  C:\Windows\System\fFEqdTw.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\hPgIczk.exe
  C:\Windows\System\hPgIczk.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\YjgcLEg.exe
  C:\Windows\System\YjgcLEg.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\SLsthrf.exe
  C:\Windows\System\SLsthrf.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\kmDNSAI.exe
  C:\Windows\System\kmDNSAI.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\CCfAMMH.exe
  C:\Windows\System\CCfAMMH.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\YwpfsRx.exe
  C:\Windows\System\YwpfsRx.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\LbQWxEv.exe
  C:\Windows\System\LbQWxEv.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\rohISoj.exe
  C:\Windows\System\rohISoj.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\lBhinLH.exe
  C:\Windows\System\lBhinLH.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\nggBkps.exe
  C:\Windows\System\nggBkps.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\zeOqMsL.exe
  C:\Windows\System\zeOqMsL.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\QoplQzB.exe
  C:\Windows\System\QoplQzB.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\LdStPqK.exe
  C:\Windows\System\LdStPqK.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\vrpNBgZ.exe
  C:\Windows\System\vrpNBgZ.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\SzjkjUt.exe
  C:\Windows\System\SzjkjUt.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\fFAiVPe.exe
  C:\Windows\System\fFAiVPe.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\APXsyHD.exe
  C:\Windows\System\APXsyHD.exe
  2⤵
  PID:2536
- C:\Windows\System\nfGCmEi.exe
  C:\Windows\System\nfGCmEi.exe
  2⤵
  PID:1800
- C:\Windows\System\gZoOmRm.exe
  C:\Windows\System\gZoOmRm.exe
  2⤵
  PID:2700
- C:\Windows\System\XuueZiX.exe
  C:\Windows\System\XuueZiX.exe
  2⤵
  PID:1612
- C:\Windows\System\uCFJWUq.exe
  C:\Windows\System\uCFJWUq.exe
  2⤵
  PID:2236
- C:\Windows\System\BqlzJtx.exe
  C:\Windows\System\BqlzJtx.exe
  2⤵
  PID:2828
- C:\Windows\System\vPLTBUG.exe
  C:\Windows\System\vPLTBUG.exe
  2⤵
  PID:2840
- C:\Windows\System\uDmMILD.exe
  C:\Windows\System\uDmMILD.exe
  2⤵
  PID:2928
- C:\Windows\System\WPuLHHx.exe
  C:\Windows\System\WPuLHHx.exe
  2⤵
  PID:2508
- C:\Windows\System\frqMqwI.exe
  C:\Windows\System\frqMqwI.exe
  2⤵
  PID:2380
- C:\Windows\System\MJJOccJ.exe
  C:\Windows\System\MJJOccJ.exe
  2⤵
  PID:2028
- C:\Windows\System\oAnOOCH.exe
  C:\Windows\System\oAnOOCH.exe
  2⤵
  PID:2476
- C:\Windows\System\jiUWiFt.exe
  C:\Windows\System\jiUWiFt.exe
  2⤵
  PID:2920
- C:\Windows\System\BpNzmne.exe
  C:\Windows\System\BpNzmne.exe
  2⤵
  PID:2040
- C:\Windows\System\AlIgONf.exe
  C:\Windows\System\AlIgONf.exe
  2⤵
  PID:1528
- C:\Windows\System\aLnkmWM.exe
  C:\Windows\System\aLnkmWM.exe
  2⤵
  PID:1260
- C:\Windows\System\YXFYDZW.exe
  C:\Windows\System\YXFYDZW.exe
  2⤵
  PID:1352
- C:\Windows\System\FBwqGTy.exe
  C:\Windows\System\FBwqGTy.exe
  2⤵
  PID:740
- C:\Windows\System\BaoGHLn.exe
  C:\Windows\System\BaoGHLn.exe
  2⤵
  PID:3028
- C:\Windows\System\CRRpTgf.exe
  C:\Windows\System\CRRpTgf.exe
  2⤵
  PID:1272
- C:\Windows\System\olRjNgx.exe
  C:\Windows\System\olRjNgx.exe
  2⤵
  PID:2036
- C:\Windows\System\UZfPjxv.exe
  C:\Windows\System\UZfPjxv.exe
  2⤵
  PID:2604
- C:\Windows\System\ibpxgYY.exe
  C:\Windows\System\ibpxgYY.exe
  2⤵
  PID:348
- C:\Windows\System\Qmqoclc.exe
  C:\Windows\System\Qmqoclc.exe
  2⤵
  PID:2284
- C:\Windows\System\ZaHvzKk.exe
  C:\Windows\System\ZaHvzKk.exe
  2⤵
  PID:2244
- C:\Windows\System\BnkFSIq.exe
  C:\Windows\System\BnkFSIq.exe
  2⤵
  PID:2112
- C:\Windows\System\BffwZvv.exe
  C:\Windows\System\BffwZvv.exe
  2⤵
  PID:888
- C:\Windows\System\EkIEUwI.exe
  C:\Windows\System\EkIEUwI.exe
  2⤵
  PID:2384
- C:\Windows\System\KNdAEBJ.exe
  C:\Windows\System\KNdAEBJ.exe
  2⤵
  PID:2900
- C:\Windows\System\CLPQEHF.exe
  C:\Windows\System\CLPQEHF.exe
  2⤵
  PID:1772
- C:\Windows\System\qMCBouK.exe
  C:\Windows\System\qMCBouK.exe
  2⤵
  PID:1420
- C:\Windows\System\HfPRhrv.exe
  C:\Windows\System\HfPRhrv.exe
  2⤵
  PID:2692
- C:\Windows\System\yHDbKKo.exe
  C:\Windows\System\yHDbKKo.exe
  2⤵
  PID:2696
- C:\Windows\System\Rayxkeo.exe
  C:\Windows\System\Rayxkeo.exe
  2⤵
  PID:1672
- C:\Windows\System\vNnzfnJ.exe
  C:\Windows\System\vNnzfnJ.exe
  2⤵
  PID:2424
- C:\Windows\System\rEVrFfF.exe
  C:\Windows\System\rEVrFfF.exe
  2⤵
  PID:1580
- C:\Windows\System\FKbKIep.exe
  C:\Windows\System\FKbKIep.exe
  2⤵
  PID:1012
- C:\Windows\System\TXGFVyT.exe
  C:\Windows\System\TXGFVyT.exe
  2⤵
  PID:2044
- C:\Windows\System\BhgjZEz.exe
  C:\Windows\System\BhgjZEz.exe
  2⤵
  PID:2648
- C:\Windows\System\SxUfrJG.exe
  C:\Windows\System\SxUfrJG.exe
  2⤵
  PID:2636
- C:\Windows\System\AeUVkCO.exe
  C:\Windows\System\AeUVkCO.exe
  2⤵
  PID:2732
- C:\Windows\System\yvVsEdC.exe
  C:\Windows\System\yvVsEdC.exe
  2⤵
  PID:2728
- C:\Windows\System\aMYqQXr.exe
  C:\Windows\System\aMYqQXr.exe
  2⤵
  PID:748
- C:\Windows\System\mcwDCFM.exe
  C:\Windows\System\mcwDCFM.exe
  2⤵
  PID:2004
- C:\Windows\System\rPWbCzE.exe
  C:\Windows\System\rPWbCzE.exe
  2⤵
  PID:2456
- C:\Windows\System\xKZYBcE.exe
  C:\Windows\System\xKZYBcE.exe
  2⤵
  PID:2532
- C:\Windows\System\cgAWduK.exe
  C:\Windows\System\cgAWduK.exe
  2⤵
  PID:1764
- C:\Windows\System\WxhKAjc.exe
  C:\Windows\System\WxhKAjc.exe
  2⤵
  PID:3032
- C:\Windows\System\SYSiNiD.exe
  C:\Windows\System\SYSiNiD.exe
  2⤵
  PID:2000
- C:\Windows\System\ZmQPgtR.exe
  C:\Windows\System\ZmQPgtR.exe
  2⤵
  PID:2904
- C:\Windows\System\LOJnBVw.exe
  C:\Windows\System\LOJnBVw.exe
  2⤵
  PID:684
- C:\Windows\System\XCpLaXy.exe
  C:\Windows\System\XCpLaXy.exe
  2⤵
  PID:1256
- C:\Windows\System\PqxmIBX.exe
  C:\Windows\System\PqxmIBX.exe
  2⤵
  PID:1688
- C:\Windows\System\RjYdQoB.exe
  C:\Windows\System\RjYdQoB.exe
  2⤵
  PID:2488
- C:\Windows\System\CfUOQuI.exe
  C:\Windows\System\CfUOQuI.exe
  2⤵
  PID:1504
- C:\Windows\System\SqIBIoB.exe
  C:\Windows\System\SqIBIoB.exe
  2⤵
  PID:2148
- C:\Windows\System\LZmDnOB.exe
  C:\Windows\System\LZmDnOB.exe
  2⤵
  PID:2328
- C:\Windows\System\CTEmdAt.exe
  C:\Windows\System\CTEmdAt.exe
  2⤵
  PID:1288
- C:\Windows\System\JHmYRpe.exe
  C:\Windows\System\JHmYRpe.exe
  2⤵
  PID:2932
- C:\Windows\System\KkZsaYK.exe
  C:\Windows\System\KkZsaYK.exe
  2⤵
  PID:2988
- C:\Windows\System\jgwoIPd.exe
  C:\Windows\System\jgwoIPd.exe
  2⤵
  PID:1988
- C:\Windows\System\sNiZCnf.exe
  C:\Windows\System\sNiZCnf.exe
  2⤵
  PID:3088
- C:\Windows\System\OBibpap.exe
  C:\Windows\System\OBibpap.exe
  2⤵
  PID:3104
- C:\Windows\System\qXTJyLV.exe
  C:\Windows\System\qXTJyLV.exe
  2⤵
  PID:3124
- C:\Windows\System\wPBtmyC.exe
  C:\Windows\System\wPBtmyC.exe
  2⤵
  PID:3304
- C:\Windows\System\PbHmTht.exe
  C:\Windows\System\PbHmTht.exe
  2⤵
  PID:3328
- C:\Windows\System\KPzvpdy.exe
  C:\Windows\System\KPzvpdy.exe
  2⤵
  PID:3348
- C:\Windows\System\jyatqxM.exe
  C:\Windows\System\jyatqxM.exe
  2⤵
  PID:3368
- C:\Windows\System\wmTcNky.exe
  C:\Windows\System\wmTcNky.exe
  2⤵
  PID:3384
- C:\Windows\System\aMpkdGS.exe
  C:\Windows\System\aMpkdGS.exe
  2⤵
  PID:3408
- C:\Windows\System\GqhCBoB.exe
  C:\Windows\System\GqhCBoB.exe
  2⤵
  PID:3424
- C:\Windows\System\BLpzmim.exe
  C:\Windows\System\BLpzmim.exe
  2⤵
  PID:3448
- C:\Windows\System\nDtAWEJ.exe
  C:\Windows\System\nDtAWEJ.exe
  2⤵
  PID:3468
- C:\Windows\System\nBXstsj.exe
  C:\Windows\System\nBXstsj.exe
  2⤵
  PID:3488
- C:\Windows\System\gEHiTRr.exe
  C:\Windows\System\gEHiTRr.exe
  2⤵
  PID:3504
- C:\Windows\System\vwhMZti.exe
  C:\Windows\System\vwhMZti.exe
  2⤵
  PID:3524
- C:\Windows\System\KCrGPZK.exe
  C:\Windows\System\KCrGPZK.exe
  2⤵
  PID:3540
- C:\Windows\System\eGbGZTB.exe
  C:\Windows\System\eGbGZTB.exe
  2⤵
  PID:3556
- C:\Windows\System\HGHOAIk.exe
  C:\Windows\System\HGHOAIk.exe
  2⤵
  PID:3576
- C:\Windows\System\AOlcamg.exe
  C:\Windows\System\AOlcamg.exe
  2⤵
  PID:3592
- C:\Windows\System\JPuJRzg.exe
  C:\Windows\System\JPuJRzg.exe
  2⤵
  PID:3608
- C:\Windows\System\vEstBJB.exe
  C:\Windows\System\vEstBJB.exe
  2⤵
  PID:3632
- C:\Windows\System\jSdELyl.exe
  C:\Windows\System\jSdELyl.exe
  2⤵
  PID:3672
- C:\Windows\System\Fopjwjd.exe
  C:\Windows\System\Fopjwjd.exe
  2⤵
  PID:3696
- C:\Windows\System\jXRIxkw.exe
  C:\Windows\System\jXRIxkw.exe
  2⤵
  PID:3712
- C:\Windows\System\xrRswom.exe
  C:\Windows\System\xrRswom.exe
  2⤵
  PID:3728
- C:\Windows\System\zDqLrzz.exe
  C:\Windows\System\zDqLrzz.exe
  2⤵
  PID:3744
- C:\Windows\System\oxDphSn.exe
  C:\Windows\System\oxDphSn.exe
  2⤵
  PID:3772
- C:\Windows\System\IjxZibL.exe
  C:\Windows\System\IjxZibL.exe
  2⤵
  PID:3788
- C:\Windows\System\nIRBsqm.exe
  C:\Windows\System\nIRBsqm.exe
  2⤵
  PID:3804
- C:\Windows\System\HiAAnQF.exe
  C:\Windows\System\HiAAnQF.exe
  2⤵
  PID:3820
- C:\Windows\System\dBpcJkz.exe
  C:\Windows\System\dBpcJkz.exe
  2⤵
  PID:3836
- C:\Windows\System\CDboDzC.exe
  C:\Windows\System\CDboDzC.exe
  2⤵
  PID:3856
- C:\Windows\System\dFBRcsJ.exe
  C:\Windows\System\dFBRcsJ.exe
  2⤵
  PID:3872
- C:\Windows\System\qKYILEe.exe
  C:\Windows\System\qKYILEe.exe
  2⤵
  PID:3912
- C:\Windows\System\RfobnDQ.exe
  C:\Windows\System\RfobnDQ.exe
  2⤵
  PID:3932
- C:\Windows\System\vWBDwND.exe
  C:\Windows\System\vWBDwND.exe
  2⤵
  PID:3948
- C:\Windows\System\eSLJTco.exe
  C:\Windows\System\eSLJTco.exe
  2⤵
  PID:3964
- C:\Windows\System\CsuZkvZ.exe
  C:\Windows\System\CsuZkvZ.exe
  2⤵
  PID:3980
- C:\Windows\System\LEwlIhu.exe
  C:\Windows\System\LEwlIhu.exe
  2⤵
  PID:4000
- C:\Windows\System\DMPvnRM.exe
  C:\Windows\System\DMPvnRM.exe
  2⤵
  PID:4016
- C:\Windows\System\EEtumnv.exe
  C:\Windows\System\EEtumnv.exe
  2⤵
  PID:4036
- C:\Windows\System\ONSQVtM.exe
  C:\Windows\System\ONSQVtM.exe
  2⤵
  PID:4052
- C:\Windows\System\mJmOcGP.exe
  C:\Windows\System\mJmOcGP.exe
  2⤵
  PID:4068
- C:\Windows\System\kLTIzlD.exe
  C:\Windows\System\kLTIzlD.exe
  2⤵
  PID:4084
- C:\Windows\System\JCMifgg.exe
  C:\Windows\System\JCMifgg.exe
  2⤵
  PID:1884
- C:\Windows\System\ZVfsWXc.exe
  C:\Windows\System\ZVfsWXc.exe
  2⤵
  PID:1820
- C:\Windows\System\bFXHcXN.exe
  C:\Windows\System\bFXHcXN.exe
  2⤵
  PID:668
- C:\Windows\System\zDNIpMu.exe
  C:\Windows\System\zDNIpMu.exe
  2⤵
  PID:2860
- C:\Windows\System\oAwdySK.exe
  C:\Windows\System\oAwdySK.exe
  2⤵
  PID:2864
- C:\Windows\System\jUKncpf.exe
  C:\Windows\System\jUKncpf.exe
  2⤵
  PID:1676
- C:\Windows\System\DNtglaG.exe
  C:\Windows\System\DNtglaG.exe
  2⤵
  PID:872
- C:\Windows\System\PguDgNN.exe
  C:\Windows\System\PguDgNN.exe
  2⤵
  PID:1156
- C:\Windows\System\fuorNcw.exe
  C:\Windows\System\fuorNcw.exe
  2⤵
  PID:1944
- C:\Windows\System\CppmrZK.exe
  C:\Windows\System\CppmrZK.exe
  2⤵
  PID:988
- C:\Windows\System\uYxkUvc.exe
  C:\Windows\System\uYxkUvc.exe
  2⤵
  PID:380
- C:\Windows\System\ZbbGcQM.exe
  C:\Windows\System\ZbbGcQM.exe
  2⤵
  PID:2576
- C:\Windows\System\ndxSXok.exe
  C:\Windows\System\ndxSXok.exe
  2⤵
  PID:2144
- C:\Windows\System\eAmAXMk.exe
  C:\Windows\System\eAmAXMk.exe
  2⤵
  PID:2132
- C:\Windows\System\flBXrOI.exe
  C:\Windows\System\flBXrOI.exe
  2⤵
  PID:2516
- C:\Windows\System\BQlPgtH.exe
  C:\Windows\System\BQlPgtH.exe
  2⤵
  PID:2240
- C:\Windows\System\rPTRwhc.exe
  C:\Windows\System\rPTRwhc.exe
  2⤵
  PID:2688
- C:\Windows\System\eAxLHUQ.exe
  C:\Windows\System\eAxLHUQ.exe
  2⤵
  PID:2912
- C:\Windows\System\FvPFyWj.exe
  C:\Windows\System\FvPFyWj.exe
  2⤵
  PID:2704
- C:\Windows\System\QntEyiX.exe
  C:\Windows\System\QntEyiX.exe
  2⤵
  PID:2776
- C:\Windows\System\hMFAyWM.exe
  C:\Windows\System\hMFAyWM.exe
  2⤵
  PID:2844
- C:\Windows\System\eSHluhJ.exe
  C:\Windows\System\eSHluhJ.exe
  2⤵
  PID:1652
- C:\Windows\System\UVtNYuN.exe
  C:\Windows\System\UVtNYuN.exe
  2⤵
  PID:2316
- C:\Windows\System\pJVdxSx.exe
  C:\Windows\System\pJVdxSx.exe
  2⤵
  PID:3080
- C:\Windows\System\BjYzoIV.exe
  C:\Windows\System\BjYzoIV.exe
  2⤵
  PID:2796
- C:\Windows\System\bWrmZbv.exe
  C:\Windows\System\bWrmZbv.exe
  2⤵
  PID:2288
- C:\Windows\System\zREqusJ.exe
  C:\Windows\System\zREqusJ.exe
  2⤵
  PID:3132
- C:\Windows\System\SucTdFc.exe
  C:\Windows\System\SucTdFc.exe
  2⤵
  PID:3100
- C:\Windows\System\LUGfzie.exe
  C:\Windows\System\LUGfzie.exe
  2⤵
  PID:3152
- C:\Windows\System\KjEpQMU.exe
  C:\Windows\System\KjEpQMU.exe
  2⤵
  PID:3288
- C:\Windows\System\CLkCqkr.exe
  C:\Windows\System\CLkCqkr.exe
  2⤵
  PID:3312
- C:\Windows\System\aVVYZBY.exe
  C:\Windows\System\aVVYZBY.exe
  2⤵
  PID:2260
- C:\Windows\System\laokIFg.exe
  C:\Windows\System\laokIFg.exe
  2⤵
  PID:2876
- C:\Windows\System\FbYciBK.exe
  C:\Windows\System\FbYciBK.exe
  2⤵
  PID:1052
- C:\Windows\System\GaVBOtl.exe
  C:\Windows\System\GaVBOtl.exe
  2⤵
  PID:3380
- C:\Windows\System\cCJwZwE.exe
  C:\Windows\System\cCJwZwE.exe
  2⤵
  PID:3400
- C:\Windows\System\XFPFmwF.exe
  C:\Windows\System\XFPFmwF.exe
  2⤵
  PID:3444
- C:\Windows\System\WVVKgDl.exe
  C:\Windows\System\WVVKgDl.exe
  2⤵
  PID:3464
- C:\Windows\System\EMskGTg.exe
  C:\Windows\System\EMskGTg.exe
  2⤵
  PID:3484
- C:\Windows\System\XKtquKO.exe
  C:\Windows\System\XKtquKO.exe
  2⤵
  PID:3512
- C:\Windows\System\bLwSIWg.exe
  C:\Windows\System\bLwSIWg.exe
  2⤵
  PID:3564
- C:\Windows\System\bRtsuLM.exe
  C:\Windows\System\bRtsuLM.exe
  2⤵
  PID:3548
- C:\Windows\System\lBkbYDT.exe
  C:\Windows\System\lBkbYDT.exe
  2⤵
  PID:3628
- C:\Windows\System\RlwuSCw.exe
  C:\Windows\System\RlwuSCw.exe
  2⤵
  PID:3600
- C:\Windows\System\UQdhYsB.exe
  C:\Windows\System\UQdhYsB.exe
  2⤵
  PID:3656
- C:\Windows\System\FiBHUXt.exe
  C:\Windows\System\FiBHUXt.exe
  2⤵
  PID:3688
- C:\Windows\System\bnpUbpH.exe
  C:\Windows\System\bnpUbpH.exe
  2⤵
  PID:3752
- C:\Windows\System\tzdLHEr.exe
  C:\Windows\System\tzdLHEr.exe
  2⤵
  PID:3764
- C:\Windows\System\zKaOHOb.exe
  C:\Windows\System\zKaOHOb.exe
  2⤵
  PID:3796
- C:\Windows\System\jxBVdSN.exe
  C:\Windows\System\jxBVdSN.exe
  2⤵
  PID:3832
- C:\Windows\System\ShgLlfV.exe
  C:\Windows\System\ShgLlfV.exe
  2⤵
  PID:3812
- C:\Windows\System\NXIdnMw.exe
  C:\Windows\System\NXIdnMw.exe
  2⤵
  PID:3852
- C:\Windows\System\hiFOkcs.exe
  C:\Windows\System\hiFOkcs.exe
  2⤵
  PID:3896
- C:\Windows\System\KSvdVbm.exe
  C:\Windows\System\KSvdVbm.exe
  2⤵
  PID:3924
- C:\Windows\System\qwEhElA.exe
  C:\Windows\System\qwEhElA.exe
  2⤵
  PID:3956
- C:\Windows\System\QXgrcJC.exe
  C:\Windows\System\QXgrcJC.exe
  2⤵
  PID:3992
- C:\Windows\System\qSTjTgh.exe
  C:\Windows\System\qSTjTgh.exe
  2⤵
  PID:4012
- C:\Windows\System\YaRoeGc.exe
  C:\Windows\System\YaRoeGc.exe
  2⤵
  PID:4080
- C:\Windows\System\jNJfKAL.exe
  C:\Windows\System\jNJfKAL.exe
  2⤵
  PID:1608
- C:\Windows\System\AGfZnFl.exe
  C:\Windows\System\AGfZnFl.exe
  2⤵
  PID:4024
- C:\Windows\System\ajxRhLb.exe
  C:\Windows\System\ajxRhLb.exe
  2⤵
  PID:2400
- C:\Windows\System\AXDQTjM.exe
  C:\Windows\System\AXDQTjM.exe
  2⤵
  PID:836
- C:\Windows\System\lgluiYw.exe
  C:\Windows\System\lgluiYw.exe
  2⤵
  PID:3144
- C:\Windows\System\cfsRRUY.exe
  C:\Windows\System\cfsRRUY.exe
  2⤵
  PID:804
- C:\Windows\System\WWTOHMc.exe
  C:\Windows\System\WWTOHMc.exe
  2⤵
  PID:2788
- C:\Windows\System\OWqIZGy.exe
  C:\Windows\System\OWqIZGy.exe
  2⤵
  PID:1680
- C:\Windows\System\IYPuUkO.exe
  C:\Windows\System\IYPuUkO.exe
  2⤵
  PID:3212
- C:\Windows\System\qfnaiMF.exe
  C:\Windows\System\qfnaiMF.exe
  2⤵
  PID:3228
- C:\Windows\System\nIdmORr.exe
  C:\Windows\System\nIdmORr.exe
  2⤵
  PID:1592
- C:\Windows\System\umCzuFz.exe
  C:\Windows\System\umCzuFz.exe
  2⤵
  PID:1192
- C:\Windows\System\HSxfuGW.exe
  C:\Windows\System\HSxfuGW.exe
  2⤵
  PID:2432
- C:\Windows\System\lizzaQD.exe
  C:\Windows\System\lizzaQD.exe
  2⤵
  PID:1000
- C:\Windows\System\ldEYzah.exe
  C:\Windows\System\ldEYzah.exe
  2⤵
  PID:2588
- C:\Windows\System\XFRyBTa.exe
  C:\Windows\System\XFRyBTa.exe
  2⤵
  PID:2584
- C:\Windows\System\hsaUizO.exe
  C:\Windows\System\hsaUizO.exe
  2⤵
  PID:3168
- C:\Windows\System\zvweBuH.exe
  C:\Windows\System\zvweBuH.exe
  2⤵
  PID:3176
- C:\Windows\System\WEEiQDb.exe
  C:\Windows\System\WEEiQDb.exe
  2⤵
  PID:3356
- C:\Windows\System\WEmaDyd.exe
  C:\Windows\System\WEmaDyd.exe
  2⤵
  PID:3532
- C:\Windows\System\vsPHHWV.exe
  C:\Windows\System\vsPHHWV.exe
  2⤵
  PID:3572
- C:\Windows\System\zZZOlVw.exe
  C:\Windows\System\zZZOlVw.exe
  2⤵
  PID:3760
- C:\Windows\System\LKRAOoY.exe
  C:\Windows\System\LKRAOoY.exe
  2⤵
  PID:2908
- C:\Windows\System\iJYHdZG.exe
  C:\Windows\System\iJYHdZG.exe
  2⤵
  PID:3476
- C:\Windows\System\RYrWCkn.exe
  C:\Windows\System\RYrWCkn.exe
  2⤵
  PID:3616
- C:\Windows\System\pyeGorC.exe
  C:\Windows\System\pyeGorC.exe
  2⤵
  PID:3720
- C:\Windows\System\fGlXFkB.exe
  C:\Windows\System\fGlXFkB.exe
  2⤵
  PID:3780
- C:\Windows\System\ytdilDt.exe
  C:\Windows\System\ytdilDt.exe
  2⤵
  PID:3988
- C:\Windows\System\AIbOCAn.exe
  C:\Windows\System\AIbOCAn.exe
  2⤵
  PID:3112
- C:\Windows\System\HRvcvqw.exe
  C:\Windows\System\HRvcvqw.exe
  2⤵
  PID:324
- C:\Windows\System\uQEqHRH.exe
  C:\Windows\System\uQEqHRH.exe
  2⤵
  PID:2176
- C:\Windows\System\SYupBmT.exe
  C:\Windows\System\SYupBmT.exe
  2⤵
  PID:2124
- C:\Windows\System\kJnDdPi.exe
  C:\Windows\System\kJnDdPi.exe
  2⤵
  PID:3024
- C:\Windows\System\CvioNJv.exe
  C:\Windows\System\CvioNJv.exe
  2⤵
  PID:2496
- C:\Windows\System\NaxSYXS.exe
  C:\Windows\System\NaxSYXS.exe
  2⤵
  PID:1276
- C:\Windows\System\eyZHJYG.exe
  C:\Windows\System\eyZHJYG.exe
  2⤵
  PID:3164
- C:\Windows\System\yeSPKfW.exe
  C:\Windows\System\yeSPKfW.exe
  2⤵
  PID:3848
- C:\Windows\System\ABaTqeD.exe
  C:\Windows\System\ABaTqeD.exe
  2⤵
  PID:4060
- C:\Windows\System\NYAqQtT.exe
  C:\Windows\System\NYAqQtT.exe
  2⤵
  PID:3196
- C:\Windows\System\uSZOxDX.exe
  C:\Windows\System\uSZOxDX.exe
  2⤵
  PID:3208
- C:\Windows\System\CCCiSVX.exe
  C:\Windows\System\CCCiSVX.exe
  2⤵
  PID:3884
- C:\Windows\System\IqHOTJx.exe
  C:\Windows\System\IqHOTJx.exe
  2⤵
  PID:3996
- C:\Windows\System\JjFLJFI.exe
  C:\Windows\System\JjFLJFI.exe
  2⤵
  PID:700
- C:\Windows\System\ZyAWTGq.exe
  C:\Windows\System\ZyAWTGq.exe
  2⤵
  PID:948
- C:\Windows\System\LvSBIbj.exe
  C:\Windows\System\LvSBIbj.exe
  2⤵
  PID:3224
- C:\Windows\System\KnxuFFE.exe
  C:\Windows\System\KnxuFFE.exe
  2⤵
  PID:4116
- C:\Windows\System\trrrpxC.exe
  C:\Windows\System\trrrpxC.exe
  2⤵
  PID:4132
- C:\Windows\System\yQpkvWE.exe
  C:\Windows\System\yQpkvWE.exe
  2⤵
  PID:4148
- C:\Windows\System\pIzPaLB.exe
  C:\Windows\System\pIzPaLB.exe
  2⤵
  PID:4164
- C:\Windows\System\CwrZzuJ.exe
  C:\Windows\System\CwrZzuJ.exe
  2⤵
  PID:4184
- C:\Windows\System\CrScTrA.exe
  C:\Windows\System\CrScTrA.exe
  2⤵
  PID:4200
- C:\Windows\System\MvhmQDL.exe
  C:\Windows\System\MvhmQDL.exe
  2⤵
  PID:4216
- C:\Windows\System\ZOygRfV.exe
  C:\Windows\System\ZOygRfV.exe
  2⤵
  PID:4232
- C:\Windows\System\JdSYLah.exe
  C:\Windows\System\JdSYLah.exe
  2⤵
  PID:4248
- C:\Windows\System\HHyUGtO.exe
  C:\Windows\System\HHyUGtO.exe
  2⤵
  PID:4268
- C:\Windows\System\WxuwYGL.exe
  C:\Windows\System\WxuwYGL.exe
  2⤵
  PID:4284
- C:\Windows\System\AnYeYnI.exe
  C:\Windows\System\AnYeYnI.exe
  2⤵
  PID:4300
- C:\Windows\System\TulLoOA.exe
  C:\Windows\System\TulLoOA.exe
  2⤵
  PID:4316
- C:\Windows\System\dRGKKRT.exe
  C:\Windows\System\dRGKKRT.exe
  2⤵
  PID:4332
- C:\Windows\System\DnZeOZR.exe
  C:\Windows\System\DnZeOZR.exe
  2⤵
  PID:4352
- C:\Windows\System\WgglXpk.exe
  C:\Windows\System\WgglXpk.exe
  2⤵
  PID:4368
- C:\Windows\System\SzARPZQ.exe
  C:\Windows\System\SzARPZQ.exe
  2⤵
  PID:4384
- C:\Windows\System\srfSjWg.exe
  C:\Windows\System\srfSjWg.exe
  2⤵
  PID:4400
- C:\Windows\System\thAEZTQ.exe
  C:\Windows\System\thAEZTQ.exe
  2⤵
  PID:4420
- C:\Windows\System\tNzfqDv.exe
  C:\Windows\System\tNzfqDv.exe
  2⤵
  PID:4436
- C:\Windows\System\LJaQbQn.exe
  C:\Windows\System\LJaQbQn.exe
  2⤵
  PID:4452
- C:\Windows\System\MYDXIYC.exe
  C:\Windows\System\MYDXIYC.exe
  2⤵
  PID:4468
- C:\Windows\System\zDgMECt.exe
  C:\Windows\System\zDgMECt.exe
  2⤵
  PID:4488
- C:\Windows\System\SsTrspM.exe
  C:\Windows\System\SsTrspM.exe
  2⤵
  PID:4504
- C:\Windows\System\RcHedvN.exe
  C:\Windows\System\RcHedvN.exe
  2⤵
  PID:4520
- C:\Windows\System\aBFKvHp.exe
  C:\Windows\System\aBFKvHp.exe
  2⤵
  PID:4536
- C:\Windows\System\mPcpFXO.exe
  C:\Windows\System\mPcpFXO.exe
  2⤵
  PID:4552
- C:\Windows\System\iWpgYiW.exe
  C:\Windows\System\iWpgYiW.exe
  2⤵
  PID:4572
- C:\Windows\System\TnxFvyC.exe
  C:\Windows\System\TnxFvyC.exe
  2⤵
  PID:4588
- C:\Windows\System\oSUNJAY.exe
  C:\Windows\System\oSUNJAY.exe
  2⤵
  PID:4604
- C:\Windows\System\jDcbXcc.exe
  C:\Windows\System\jDcbXcc.exe
  2⤵
  PID:4620
- C:\Windows\System\ZeRnzBj.exe
  C:\Windows\System\ZeRnzBj.exe
  2⤵
  PID:4640
- C:\Windows\System\AWOujfE.exe
  C:\Windows\System\AWOujfE.exe
  2⤵
  PID:4684
- C:\Windows\System\pUjflmT.exe
  C:\Windows\System\pUjflmT.exe
  2⤵
  PID:4732
- C:\Windows\System\wwRjQUH.exe
  C:\Windows\System\wwRjQUH.exe
  2⤵
  PID:4748
- C:\Windows\System\yGBzJXn.exe
  C:\Windows\System\yGBzJXn.exe
  2⤵
  PID:4764
- C:\Windows\System\nQxMLxL.exe
  C:\Windows\System\nQxMLxL.exe
  2⤵
  PID:4780
- C:\Windows\System\hmsRoHd.exe
  C:\Windows\System\hmsRoHd.exe
  2⤵
  PID:4796
- C:\Windows\System\zSvfDUN.exe
  C:\Windows\System\zSvfDUN.exe
  2⤵
  PID:4904
- C:\Windows\System\iOUzwsA.exe
  C:\Windows\System\iOUzwsA.exe
  2⤵
  PID:4920
- C:\Windows\System\bHTNgcc.exe
  C:\Windows\System\bHTNgcc.exe
  2⤵
  PID:4940
- C:\Windows\System\euAtKxK.exe
  C:\Windows\System\euAtKxK.exe
  2⤵
  PID:4964
- C:\Windows\System\JPmsEwT.exe
  C:\Windows\System\JPmsEwT.exe
  2⤵
  PID:4984
- C:\Windows\System\pCAOsJb.exe
  C:\Windows\System\pCAOsJb.exe
  2⤵
  PID:5008
- C:\Windows\System\URnwLfC.exe
  C:\Windows\System\URnwLfC.exe
  2⤵
  PID:5028
- C:\Windows\System\iqrkbLy.exe
  C:\Windows\System\iqrkbLy.exe
  2⤵
  PID:5048
- C:\Windows\System\wZpucJE.exe
  C:\Windows\System\wZpucJE.exe
  2⤵
  PID:5064
- C:\Windows\System\TKNVELj.exe
  C:\Windows\System\TKNVELj.exe
  2⤵
  PID:5080
- C:\Windows\System\xojOLau.exe
  C:\Windows\System\xojOLau.exe
  2⤵
  PID:5096
- C:\Windows\System\qEwdFwj.exe
  C:\Windows\System\qEwdFwj.exe
  2⤵
  PID:5112
- C:\Windows\System\sbNNykc.exe
  C:\Windows\System\sbNNykc.exe
  2⤵
  PID:3116
- C:\Windows\System\WkVTryi.exe
  C:\Windows\System\WkVTryi.exe
  2⤵
  PID:3520
- C:\Windows\System\ArSeaXw.exe
  C:\Windows\System\ArSeaXw.exe
  2⤵
  PID:4008
- C:\Windows\System\HyCIgXR.exe
  C:\Windows\System\HyCIgXR.exe
  2⤵
  PID:4192
- C:\Windows\System\LHgfekQ.exe
  C:\Windows\System\LHgfekQ.exe
  2⤵
  PID:4460
- C:\Windows\System\ZScoGtG.exe
  C:\Windows\System\ZScoGtG.exe
  2⤵
  PID:4568
- C:\Windows\System\InOBuAq.exe
  C:\Windows\System\InOBuAq.exe
  2⤵
  PID:4224
- C:\Windows\System\tmUFonv.exe
  C:\Windows\System\tmUFonv.exe
  2⤵
  PID:4616
- C:\Windows\System\xeRpyau.exe
  C:\Windows\System\xeRpyau.exe
  2⤵
  PID:4280
- C:\Windows\System\WUoOlZl.exe
  C:\Windows\System\WUoOlZl.exe
  2⤵
  PID:3668
- C:\Windows\System\TLAezPH.exe
  C:\Windows\System\TLAezPH.exe
  2⤵
  PID:3404
- C:\Windows\System\cqFwHie.exe
  C:\Windows\System\cqFwHie.exe
  2⤵
  PID:1668
- C:\Windows\System\StIVVmq.exe
  C:\Windows\System\StIVVmq.exe
  2⤵
  PID:4176
- C:\Windows\System\FJvYFRH.exe
  C:\Windows\System\FJvYFRH.exe
  2⤵
  PID:4328
- C:\Windows\System\NuPxjoN.exe
  C:\Windows\System\NuPxjoN.exe
  2⤵
  PID:4432
- C:\Windows\System\fmSiWdx.exe
  C:\Windows\System\fmSiWdx.exe
  2⤵
  PID:4656
- C:\Windows\System\MQJqwUz.exe
  C:\Windows\System\MQJqwUz.exe
  2⤵
  PID:4636
- C:\Windows\System\VihWLrW.exe
  C:\Windows\System\VihWLrW.exe
  2⤵
  PID:4580
- C:\Windows\System\BmappBp.exe
  C:\Windows\System\BmappBp.exe
  2⤵
  PID:4308
- C:\Windows\System\ijZzMbm.exe
  C:\Windows\System\ijZzMbm.exe
  2⤵
  PID:4376
- C:\Windows\System\DNnJHIh.exe
  C:\Windows\System\DNnJHIh.exe
  2⤵
  PID:4696
- C:\Windows\System\hdTxvyt.exe
  C:\Windows\System\hdTxvyt.exe
  2⤵
  PID:4756
- C:\Windows\System\vhdQZXc.exe
  C:\Windows\System\vhdQZXc.exe
  2⤵
  PID:4772
- C:\Windows\System\FherGBr.exe
  C:\Windows\System\FherGBr.exe
  2⤵
  PID:4820
- C:\Windows\System\cMWcPky.exe
  C:\Windows\System\cMWcPky.exe
  2⤵
  PID:4832
- C:\Windows\System\jreLtnG.exe
  C:\Windows\System\jreLtnG.exe
  2⤵
  PID:4848
- C:\Windows\System\HpJaFGJ.exe
  C:\Windows\System\HpJaFGJ.exe
  2⤵
  PID:4864
- C:\Windows\System\mxNBraF.exe
  C:\Windows\System\mxNBraF.exe
  2⤵
  PID:4884
- C:\Windows\System\NnUGyoo.exe
  C:\Windows\System\NnUGyoo.exe
  2⤵
  PID:4912
- C:\Windows\System\wJLSGAb.exe
  C:\Windows\System\wJLSGAb.exe
  2⤵
  PID:4956
- C:\Windows\System\sUeHsxv.exe
  C:\Windows\System\sUeHsxv.exe
  2⤵
  PID:4932
- C:\Windows\System\VjHCAOA.exe
  C:\Windows\System\VjHCAOA.exe
  2⤵
  PID:4976
- C:\Windows\System\QTPRoym.exe
  C:\Windows\System\QTPRoym.exe
  2⤵
  PID:5004
- C:\Windows\System\jXDHVXD.exe
  C:\Windows\System\jXDHVXD.exe
  2⤵
  PID:5072
- C:\Windows\System\djEBtJa.exe
  C:\Windows\System\djEBtJa.exe
  2⤵
  PID:5016
- C:\Windows\System\CMKdZlC.exe
  C:\Windows\System\CMKdZlC.exe
  2⤵
  PID:5060
- C:\Windows\System\eSkejcw.exe
  C:\Windows\System\eSkejcw.exe
  2⤵
  PID:3260
- C:\Windows\System\ikpVvQJ.exe
  C:\Windows\System\ikpVvQJ.exe
  2⤵
  PID:1092
- C:\Windows\System\PrLiQnN.exe
  C:\Windows\System\PrLiQnN.exe
  2⤵
  PID:4672
- C:\Windows\System\tRjUYkk.exe
  C:\Windows\System\tRjUYkk.exe
  2⤵
  PID:3192
- C:\Windows\System\IRvTCuc.exe
  C:\Windows\System\IRvTCuc.exe
  2⤵
  PID:4476
- C:\Windows\System\tNMKCsO.exe
  C:\Windows\System\tNMKCsO.exe
  2⤵
  PID:4360
- C:\Windows\System\PcOBoqp.exe
  C:\Windows\System\PcOBoqp.exe
  2⤵
  PID:4392
- C:\Windows\System\JDMoLrE.exe
  C:\Windows\System\JDMoLrE.exe
  2⤵
  PID:4600
- C:\Windows\System\vxzJiAo.exe
  C:\Windows\System\vxzJiAo.exe
  2⤵
  PID:4244
- C:\Windows\System\yHFQCCu.exe
  C:\Windows\System\yHFQCCu.exe
  2⤵
  PID:3440
- C:\Windows\System\srfNmKm.exe
  C:\Windows\System\srfNmKm.exe
  2⤵
  PID:4064
- C:\Windows\System\LISWJMD.exe
  C:\Windows\System\LISWJMD.exe
  2⤵
  PID:3888
- C:\Windows\System\fkMyjmC.exe
  C:\Windows\System\fkMyjmC.exe
  2⤵
  PID:4112
- C:\Windows\System\DzFKcfk.exe
  C:\Windows\System\DzFKcfk.exe
  2⤵
  PID:3184
- C:\Windows\System\BsqKhGJ.exe
  C:\Windows\System\BsqKhGJ.exe
  2⤵
  PID:4544
- C:\Windows\System\xqNznbL.exe
  C:\Windows\System\xqNznbL.exe
  2⤵
  PID:4076
- C:\Windows\System\cuKnBiw.exe
  C:\Windows\System\cuKnBiw.exe
  2⤵
  PID:4744
- C:\Windows\System\EFMMNcI.exe
  C:\Windows\System\EFMMNcI.exe
  2⤵
  PID:4396
- C:\Windows\System\CADOWbF.exe
  C:\Windows\System\CADOWbF.exe
  2⤵
  PID:4412
- C:\Windows\System\jOBDCAB.exe
  C:\Windows\System\jOBDCAB.exe
  2⤵
  PID:4516
- C:\Windows\System\WMRCgKZ.exe
  C:\Windows\System\WMRCgKZ.exe
  2⤵
  PID:4996
- C:\Windows\System\WXTxQnD.exe
  C:\Windows\System\WXTxQnD.exe
  2⤵
  PID:4892
- C:\Windows\System\iVTsjcQ.exe
  C:\Windows\System\iVTsjcQ.exe
  2⤵
  PID:5108
- C:\Windows\System\ZEnITGa.exe
  C:\Windows\System\ZEnITGa.exe
  2⤵
  PID:5000
- C:\Windows\System\qEHxowL.exe
  C:\Windows\System\qEHxowL.exe
  2⤵
  PID:2652
- C:\Windows\System\FNjccMU.exe
  C:\Windows\System\FNjccMU.exe
  2⤵
  PID:4180
- C:\Windows\System\bUoLiag.exe
  C:\Windows\System\bUoLiag.exe
  2⤵
  PID:3280
- C:\Windows\System\UJkudds.exe
  C:\Windows\System\UJkudds.exe
  2⤵
  PID:3800
- C:\Windows\System\RaDrLsm.exe
  C:\Windows\System\RaDrLsm.exe
  2⤵
  PID:4348
- C:\Windows\System\ExTKHpS.exe
  C:\Windows\System\ExTKHpS.exe
  2⤵
  PID:3740
- C:\Windows\System\yMPdsHm.exe
  C:\Windows\System\yMPdsHm.exe
  2⤵
  PID:4172
- C:\Windows\System\SxYVywE.exe
  C:\Windows\System\SxYVywE.exe
  2⤵
  PID:3828
- C:\Windows\System\VvMLIVV.exe
  C:\Windows\System\VvMLIVV.exe
  2⤵
  PID:4612
- C:\Windows\System\KuqDLZo.exe
  C:\Windows\System\KuqDLZo.exe
  2⤵
  PID:3892
- C:\Windows\System\UIPDIFc.exe
  C:\Windows\System\UIPDIFc.exe
  2⤵
  PID:3160
- C:\Windows\System\yEkRCzZ.exe
  C:\Windows\System\yEkRCzZ.exe
  2⤵
  PID:4876
- C:\Windows\System\HpZGCNL.exe
  C:\Windows\System\HpZGCNL.exe
  2⤵
  PID:4952
- C:\Windows\System\TlccqAf.exe
  C:\Windows\System\TlccqAf.exe
  2⤵
  PID:3652
- C:\Windows\System\cDGPLoy.exe
  C:\Windows\System\cDGPLoy.exe
  2⤵
  PID:4512
- C:\Windows\System\LoyQkvY.exe
  C:\Windows\System\LoyQkvY.exe
  2⤵
  PID:4728
- C:\Windows\System\PXybFZe.exe
  C:\Windows\System\PXybFZe.exe
  2⤵
  PID:3904
- C:\Windows\System\xcVrYpl.exe
  C:\Windows\System\xcVrYpl.exe
  2⤵
  PID:4564
- C:\Windows\System\JvPLXvG.exe
  C:\Windows\System\JvPLXvG.exe
  2⤵
  PID:4992
- C:\Windows\System\XyBaHoW.exe
  C:\Windows\System\XyBaHoW.exe
  2⤵
  PID:5024
- C:\Windows\System\cYEliPS.exe
  C:\Windows\System\cYEliPS.exe
  2⤵
  PID:3284
- C:\Windows\System\PlEkLTa.exe
  C:\Windows\System\PlEkLTa.exe
  2⤵
  PID:4448
- C:\Windows\System\bxwXURm.exe
  C:\Windows\System\bxwXURm.exe
  2⤵
  PID:2884
- C:\Windows\System\yelRQbY.exe
  C:\Windows\System\yelRQbY.exe
  2⤵
  PID:3624
- C:\Windows\System\bGnLscv.exe
  C:\Windows\System\bGnLscv.exe
  2⤵
  PID:4484
- C:\Windows\System\AsEPDzq.exe
  C:\Windows\System\AsEPDzq.exe
  2⤵
  PID:3316
- C:\Windows\System\dnRbSEG.exe
  C:\Windows\System\dnRbSEG.exe
  2⤵
  PID:4844
- C:\Windows\System\xvGQWrF.exe
  C:\Windows\System\xvGQWrF.exe
  2⤵
  PID:2068
- C:\Windows\System\ZnWxPhD.exe
  C:\Windows\System\ZnWxPhD.exe
  2⤵
  PID:5040
- C:\Windows\System\SoWQBjv.exe
  C:\Windows\System\SoWQBjv.exe
  2⤵
  PID:4948
- C:\Windows\System\mddqXRU.exe
  C:\Windows\System\mddqXRU.exe
  2⤵
  PID:4776
- C:\Windows\System\XwhPrXI.exe
  C:\Windows\System\XwhPrXI.exe
  2⤵
  PID:3644
- C:\Windows\System\bBUovWH.exe
  C:\Windows\System\bBUovWH.exe
  2⤵
  PID:4228
- C:\Windows\System\FaLwicj.exe
  C:\Windows\System\FaLwicj.exe
  2⤵
  PID:3344
- C:\Windows\System\XAWYkVA.exe
  C:\Windows\System\XAWYkVA.exe
  2⤵
  PID:832
- C:\Windows\System\JQXYKNf.exe
  C:\Windows\System\JQXYKNf.exe
  2⤵
  PID:3096
- C:\Windows\System\CSFHcjZ.exe
  C:\Windows\System\CSFHcjZ.exe
  2⤵
  PID:4840
- C:\Windows\System\BPJmquP.exe
  C:\Windows\System\BPJmquP.exe
  2⤵
  PID:3204
- C:\Windows\System\mqvaLEI.exe
  C:\Windows\System\mqvaLEI.exe
  2⤵
  PID:4124
- C:\Windows\System\OFLNgiJ.exe
  C:\Windows\System\OFLNgiJ.exe
  2⤵
  PID:4276
- C:\Windows\System\eeBrlSA.exe
  C:\Windows\System\eeBrlSA.exe
  2⤵
  PID:4740
- C:\Windows\System\IcaBPxb.exe
  C:\Windows\System\IcaBPxb.exe
  2⤵
  PID:4560
- C:\Windows\System\hJRdSml.exe
  C:\Windows\System\hJRdSml.exe
  2⤵
  PID:4264
- C:\Windows\System\OxpyBTF.exe
  C:\Windows\System\OxpyBTF.exe
  2⤵
  PID:5136
- C:\Windows\System\xHsefvn.exe
  C:\Windows\System\xHsefvn.exe
  2⤵
  PID:5156
- C:\Windows\System\MvtWWeV.exe
  C:\Windows\System\MvtWWeV.exe
  2⤵
  PID:5172
- C:\Windows\System\ugTrKod.exe
  C:\Windows\System\ugTrKod.exe
  2⤵
  PID:5188
- C:\Windows\System\rViaHiI.exe
  C:\Windows\System\rViaHiI.exe
  2⤵
  PID:5204
- C:\Windows\System\pOEHLPj.exe
  C:\Windows\System\pOEHLPj.exe
  2⤵
  PID:5224
- C:\Windows\System\BMYWcRn.exe
  C:\Windows\System\BMYWcRn.exe
  2⤵
  PID:5240
- C:\Windows\System\UIRCDlK.exe
  C:\Windows\System\UIRCDlK.exe
  2⤵
  PID:5316
- C:\Windows\System\lUErNgR.exe
  C:\Windows\System\lUErNgR.exe
  2⤵
  PID:5332
- C:\Windows\System\gwPhTrT.exe
  C:\Windows\System\gwPhTrT.exe
  2⤵
  PID:5348
- C:\Windows\System\xBLLFEp.exe
  C:\Windows\System\xBLLFEp.exe
  2⤵
  PID:5364
- C:\Windows\System\XlaWcSl.exe
  C:\Windows\System\XlaWcSl.exe
  2⤵
  PID:5380
- C:\Windows\System\RktVgHF.exe
  C:\Windows\System\RktVgHF.exe
  2⤵
  PID:5400
- C:\Windows\System\bkqDSZs.exe
  C:\Windows\System\bkqDSZs.exe
  2⤵
  PID:5416
- C:\Windows\System\QUhjCre.exe
  C:\Windows\System\QUhjCre.exe
  2⤵
  PID:5432
- C:\Windows\System\DTgPSvI.exe
  C:\Windows\System\DTgPSvI.exe
  2⤵
  PID:5448
- C:\Windows\System\feHyCWK.exe
  C:\Windows\System\feHyCWK.exe
  2⤵
  PID:5468
- C:\Windows\System\VGayQCR.exe
  C:\Windows\System\VGayQCR.exe
  2⤵
  PID:5484
- C:\Windows\System\nKXvbtK.exe
  C:\Windows\System\nKXvbtK.exe
  2⤵
  PID:5500
- C:\Windows\System\aUXYjgI.exe
  C:\Windows\System\aUXYjgI.exe
  2⤵
  PID:5516
- C:\Windows\System\lgYcWSi.exe
  C:\Windows\System\lgYcWSi.exe
  2⤵
  PID:5536
- C:\Windows\System\wBWYjeR.exe
  C:\Windows\System\wBWYjeR.exe
  2⤵
  PID:5552
- C:\Windows\System\RAQtUYP.exe
  C:\Windows\System\RAQtUYP.exe
  2⤵
  PID:5568
- C:\Windows\System\jLicfzy.exe
  C:\Windows\System\jLicfzy.exe
  2⤵
  PID:5584
- C:\Windows\System\xBzMJZr.exe
  C:\Windows\System\xBzMJZr.exe
  2⤵
  PID:5600
- C:\Windows\System\oNVWBGS.exe
  C:\Windows\System\oNVWBGS.exe
  2⤵
  PID:5616
- C:\Windows\System\LYABGRy.exe
  C:\Windows\System\LYABGRy.exe
  2⤵
  PID:5636
- C:\Windows\System\yBLVKRj.exe
  C:\Windows\System\yBLVKRj.exe
  2⤵
  PID:5652
- C:\Windows\System\ONsFjFz.exe
  C:\Windows\System\ONsFjFz.exe
  2⤵
  PID:5736
- C:\Windows\System\vQiemFL.exe
  C:\Windows\System\vQiemFL.exe
  2⤵
  PID:5752
- C:\Windows\System\WejLRnn.exe
  C:\Windows\System\WejLRnn.exe
  2⤵
  PID:5768
- C:\Windows\System\IKOvtPC.exe
  C:\Windows\System\IKOvtPC.exe
  2⤵
  PID:5784
- C:\Windows\System\LGISDhE.exe
  C:\Windows\System\LGISDhE.exe
  2⤵
  PID:5800
- C:\Windows\System\PpRowhl.exe
  C:\Windows\System\PpRowhl.exe
  2⤵
  PID:5816
- C:\Windows\System\VbCSGBc.exe
  C:\Windows\System\VbCSGBc.exe
  2⤵
  PID:5836
- C:\Windows\System\IEiRbMf.exe
  C:\Windows\System\IEiRbMf.exe
  2⤵
  PID:5852
- C:\Windows\System\LnxYIUm.exe
  C:\Windows\System\LnxYIUm.exe
  2⤵
  PID:5872
- C:\Windows\System\ASKkAdh.exe
  C:\Windows\System\ASKkAdh.exe
  2⤵
  PID:5888
- C:\Windows\System\EfewTDk.exe
  C:\Windows\System\EfewTDk.exe
  2⤵
  PID:5904
- C:\Windows\System\duAECPK.exe
  C:\Windows\System\duAECPK.exe
  2⤵
  PID:5924
- C:\Windows\System\lOrPBRA.exe
  C:\Windows\System\lOrPBRA.exe
  2⤵
  PID:5940
- C:\Windows\System\HkDRYlY.exe
  C:\Windows\System\HkDRYlY.exe
  2⤵
  PID:5956
- C:\Windows\System\NTRNNEX.exe
  C:\Windows\System\NTRNNEX.exe
  2⤵
  PID:5972
- C:\Windows\System\kgaZXQs.exe
  C:\Windows\System\kgaZXQs.exe
  2⤵
  PID:5988
- C:\Windows\System\bgAmeLy.exe
  C:\Windows\System\bgAmeLy.exe
  2⤵
  PID:6008
- C:\Windows\System\PlcoVIg.exe
  C:\Windows\System\PlcoVIg.exe
  2⤵
  PID:6024
- C:\Windows\System\RvIaDnZ.exe
  C:\Windows\System\RvIaDnZ.exe
  2⤵
  PID:6100
- C:\Windows\System\srTCKqA.exe
  C:\Windows\System\srTCKqA.exe
  2⤵
  PID:6116
- C:\Windows\System\YZFRDAh.exe
  C:\Windows\System\YZFRDAh.exe
  2⤵
  PID:6132
- C:\Windows\System\bLlmswh.exe
  C:\Windows\System\bLlmswh.exe
  2⤵
  PID:5132
- C:\Windows\System\yhrXzjM.exe
  C:\Windows\System\yhrXzjM.exe
  2⤵
  PID:5196
- C:\Windows\System\AUZfOVQ.exe
  C:\Windows\System\AUZfOVQ.exe
  2⤵
  PID:5236
- C:\Windows\System\yuYspVd.exe
  C:\Windows\System\yuYspVd.exe
  2⤵
  PID:4664
- C:\Windows\System\mZeWIlh.exe
  C:\Windows\System\mZeWIlh.exe
  2⤵
  PID:2192
- C:\Windows\System\hvtvizJ.exe
  C:\Windows\System\hvtvizJ.exe
  2⤵
  PID:5212
- C:\Windows\System\LJscHuG.exe
  C:\Windows\System\LJscHuG.exe
  2⤵
  PID:5252
- C:\Windows\System\TVWKoli.exe
  C:\Windows\System\TVWKoli.exe
  2⤵
  PID:5268
- C:\Windows\System\PRjvkeC.exe
  C:\Windows\System\PRjvkeC.exe
  2⤵
  PID:5288
- C:\Windows\System\gBgfetW.exe
  C:\Windows\System\gBgfetW.exe
  2⤵
  PID:5304
- C:\Windows\System\BdxFxNX.exe
  C:\Windows\System\BdxFxNX.exe
  2⤵
  PID:5456
- C:\Windows\System\SZihCPb.exe
  C:\Windows\System\SZihCPb.exe
  2⤵
  PID:5496
- C:\Windows\System\ThDgKJf.exe
  C:\Windows\System\ThDgKJf.exe
  2⤵
  PID:5560
- C:\Windows\System\igbhTEL.exe
  C:\Windows\System\igbhTEL.exe
  2⤵
  PID:5624
- C:\Windows\System\MlpvmKN.exe
  C:\Windows\System\MlpvmKN.exe
  2⤵
  PID:5668
- C:\Windows\System\mFSaAoP.exe
  C:\Windows\System\mFSaAoP.exe
  2⤵
  PID:5684
- C:\Windows\System\woaqNmk.exe
  C:\Windows\System\woaqNmk.exe
  2⤵
  PID:5444
- C:\Windows\System\UmgBdEI.exe
  C:\Windows\System\UmgBdEI.exe
  2⤵
  PID:5372
- C:\Windows\System\blYWREn.exe
  C:\Windows\System\blYWREn.exe
  2⤵
  PID:5512
- C:\Windows\System\ZyCraBU.exe
  C:\Windows\System\ZyCraBU.exe
  2⤵
  PID:5580
- C:\Windows\System\vkrsfvi.exe
  C:\Windows\System\vkrsfvi.exe
  2⤵
  PID:5648
- C:\Windows\System\AdqaAmt.exe
  C:\Windows\System\AdqaAmt.exe
  2⤵
  PID:5704
- C:\Windows\System\NyFnUUH.exe
  C:\Windows\System\NyFnUUH.exe
  2⤵
  PID:5720
- C:\Windows\System\goioByE.exe
  C:\Windows\System\goioByE.exe
  2⤵
  PID:5744
- C:\Windows\System\IQaWwJl.exe
  C:\Windows\System\IQaWwJl.exe
  2⤵
  PID:5796
- C:\Windows\System\XqngJsZ.exe
  C:\Windows\System\XqngJsZ.exe
  2⤵
  PID:5824
- C:\Windows\System\GmunMEP.exe
  C:\Windows\System\GmunMEP.exe
  2⤵
  PID:5964
- C:\Windows\System\DAahQfH.exe
  C:\Windows\System\DAahQfH.exe
  2⤵
  PID:5896
- C:\Windows\System\BokVhfb.exe
  C:\Windows\System\BokVhfb.exe
  2⤵
  PID:6032
- C:\Windows\System\LgdbBbO.exe
  C:\Windows\System\LgdbBbO.exe
  2⤵
  PID:6040
- C:\Windows\System\YRTndeo.exe
  C:\Windows\System\YRTndeo.exe
  2⤵
  PID:5884
- C:\Windows\System\FakqQhB.exe
  C:\Windows\System\FakqQhB.exe
  2⤵
  PID:6048
- C:\Windows\System\fgMKRjS.exe
  C:\Windows\System\fgMKRjS.exe
  2⤵
  PID:6064
- C:\Windows\System\avdQBMp.exe
  C:\Windows\System\avdQBMp.exe
  2⤵
  PID:6080
- C:\Windows\System\FULqUqR.exe
  C:\Windows\System\FULqUqR.exe
  2⤵
  PID:6108
- C:\Windows\System\BGzjbpO.exe
  C:\Windows\System\BGzjbpO.exe
  2⤵
  PID:5164
- C:\Windows\System\DxbBdtj.exe
  C:\Windows\System\DxbBdtj.exe
  2⤵
  PID:5144
- C:\Windows\System\orAGQNk.exe
  C:\Windows\System\orAGQNk.exe
  2⤵
  PID:5148
- C:\Windows\System\fbbLvrH.exe
  C:\Windows\System\fbbLvrH.exe
  2⤵
  PID:5152
- C:\Windows\System\xeSrJLI.exe
  C:\Windows\System\xeSrJLI.exe
  2⤵
  PID:3588
- C:\Windows\System\awGSAvE.exe
  C:\Windows\System\awGSAvE.exe
  2⤵
  PID:5220
- C:\Windows\System\iJOGHAp.exe
  C:\Windows\System\iJOGHAp.exe
  2⤵
  PID:5324
- C:\Windows\System\QyLmsNo.exe
  C:\Windows\System\QyLmsNo.exe
  2⤵
  PID:5392
- C:\Windows\System\SIZVGGV.exe
  C:\Windows\System\SIZVGGV.exe
  2⤵
  PID:5428
- C:\Windows\System\eIZIGSr.exe
  C:\Windows\System\eIZIGSr.exe
  2⤵
  PID:5596
- C:\Windows\System\kqgQAbk.exe
  C:\Windows\System\kqgQAbk.exe
  2⤵
  PID:5532
- C:\Windows\System\ebefNEv.exe
  C:\Windows\System\ebefNEv.exe
  2⤵
  PID:5576
- C:\Windows\System\mMvdKVR.exe
  C:\Windows\System\mMvdKVR.exe
  2⤵
  PID:5104
- C:\Windows\System\qpQqaXp.exe
  C:\Windows\System\qpQqaXp.exe
  2⤵
  PID:5776
- C:\Windows\System\jAGTkxN.exe
  C:\Windows\System\jAGTkxN.exe
  2⤵
  PID:5980
- C:\Windows\System\jovAwxG.exe
  C:\Windows\System\jovAwxG.exe
  2⤵
  PID:5692
- C:\Windows\System\MZtKOag.exe
  C:\Windows\System\MZtKOag.exe
  2⤵
  PID:5864
- C:\Windows\System\bcfxJZk.exe
  C:\Windows\System\bcfxJZk.exe
  2⤵
  PID:5764
- C:\Windows\System\ZiCyLjt.exe
  C:\Windows\System\ZiCyLjt.exe
  2⤵
  PID:5612
- C:\Windows\System\KjuQEmD.exe
  C:\Windows\System\KjuQEmD.exe
  2⤵
  PID:6076
- C:\Windows\System\ueRaIRQ.exe
  C:\Windows\System\ueRaIRQ.exe
  2⤵
  PID:5128
- C:\Windows\System\oMlqnRn.exe
  C:\Windows\System\oMlqnRn.exe
  2⤵
  PID:4444
- C:\Windows\System\vafVmMP.exe
  C:\Windows\System\vafVmMP.exe
  2⤵
  PID:5664
- C:\Windows\System\TrAdDdg.exe
  C:\Windows\System\TrAdDdg.exe
  2⤵
  PID:5480
- C:\Windows\System\wTfSHzH.exe
  C:\Windows\System\wTfSHzH.exe
  2⤵
  PID:5396
- C:\Windows\System\kTDLXxE.exe
  C:\Windows\System\kTDLXxE.exe
  2⤵
  PID:4312
- C:\Windows\System\NaYKnBp.exe
  C:\Windows\System\NaYKnBp.exe
  2⤵
  PID:5264
- C:\Windows\System\vdDXQYd.exe
  C:\Windows\System\vdDXQYd.exe
  2⤵
  PID:5680
- C:\Windows\System\WvsUZLC.exe
  C:\Windows\System\WvsUZLC.exe
  2⤵
  PID:5388
- C:\Windows\System\dHpWRsS.exe
  C:\Windows\System\dHpWRsS.exe
  2⤵
  PID:5548
- C:\Windows\System\WfSSgbR.exe
  C:\Windows\System\WfSSgbR.exe
  2⤵
  PID:6000
- C:\Windows\System\kEsGJgq.exe
  C:\Windows\System\kEsGJgq.exe
  2⤵
  PID:5848
- C:\Windows\System\wpTIhiH.exe
  C:\Windows\System\wpTIhiH.exe
  2⤵
  PID:5280
- C:\Windows\System\JneoHwT.exe
  C:\Windows\System\JneoHwT.exe
  2⤵
  PID:5932
- C:\Windows\System\vkQbXbQ.exe
  C:\Windows\System\vkQbXbQ.exe
  2⤵
  PID:6160
- C:\Windows\System\LxLHwCT.exe
  C:\Windows\System\LxLHwCT.exe
  2⤵
  PID:6176
- C:\Windows\System\cqEezUc.exe
  C:\Windows\System\cqEezUc.exe
  2⤵
  PID:6192
- C:\Windows\System\icYjJTE.exe
  C:\Windows\System\icYjJTE.exe
  2⤵
  PID:6208
- C:\Windows\System\YppARtl.exe
  C:\Windows\System\YppARtl.exe
  2⤵
  PID:6224
- C:\Windows\System\XwatIRP.exe
  C:\Windows\System\XwatIRP.exe
  2⤵
  PID:6240
- C:\Windows\System\OHCMvMh.exe
  C:\Windows\System\OHCMvMh.exe
  2⤵
  PID:6256
- C:\Windows\System\wuAkJfF.exe
  C:\Windows\System\wuAkJfF.exe
  2⤵
  PID:6272
- C:\Windows\System\dRILcJh.exe
  C:\Windows\System\dRILcJh.exe
  2⤵
  PID:6288
- C:\Windows\System\cGukJaA.exe
  C:\Windows\System\cGukJaA.exe
  2⤵
  PID:6316
- C:\Windows\System\UtvDybT.exe
  C:\Windows\System\UtvDybT.exe
  2⤵
  PID:6332
- C:\Windows\System\bqbUzfL.exe
  C:\Windows\System\bqbUzfL.exe
  2⤵
  PID:6348
- C:\Windows\System\dkQcriL.exe
  C:\Windows\System\dkQcriL.exe
  2⤵
  PID:6372
- C:\Windows\System\zSwBcGT.exe
  C:\Windows\System\zSwBcGT.exe
  2⤵
  PID:6388
- C:\Windows\System\sovfnVn.exe
  C:\Windows\System\sovfnVn.exe
  2⤵
  PID:6404
- C:\Windows\System\NlvTuzN.exe
  C:\Windows\System\NlvTuzN.exe
  2⤵
  PID:6420
- C:\Windows\System\USZCcpt.exe
  C:\Windows\System\USZCcpt.exe
  2⤵
  PID:6436
- C:\Windows\System\CifLTwL.exe
  C:\Windows\System\CifLTwL.exe
  2⤵
  PID:6452
- C:\Windows\System\TYnLOSZ.exe
  C:\Windows\System\TYnLOSZ.exe
  2⤵
  PID:6472
- C:\Windows\System\vYMElyF.exe
  C:\Windows\System\vYMElyF.exe
  2⤵
  PID:6488
- C:\Windows\System\aZgQLVx.exe
  C:\Windows\System\aZgQLVx.exe
  2⤵
  PID:6504
- C:\Windows\System\RDNxsnS.exe
  C:\Windows\System\RDNxsnS.exe
  2⤵
  PID:6520
- C:\Windows\System\ovcNuXE.exe
  C:\Windows\System\ovcNuXE.exe
  2⤵
  PID:6540
- C:\Windows\System\lKgjzKZ.exe
  C:\Windows\System\lKgjzKZ.exe
  2⤵
  PID:6556
- C:\Windows\System\srsErir.exe
  C:\Windows\System\srsErir.exe
  2⤵
  PID:6572
- C:\Windows\System\iIQenqX.exe
  C:\Windows\System\iIQenqX.exe
  2⤵
  PID:6592
- C:\Windows\System\yCVvufF.exe
  C:\Windows\System\yCVvufF.exe
  2⤵
  PID:6608
- C:\Windows\System\ktoYHbF.exe
  C:\Windows\System\ktoYHbF.exe
  2⤵
  PID:6624
- C:\Windows\System\EjlBZqY.exe
  C:\Windows\System\EjlBZqY.exe
  2⤵
  PID:6640
- C:\Windows\System\PQOhylw.exe
  C:\Windows\System\PQOhylw.exe
  2⤵
  PID:6776
- C:\Windows\System\mKIYXYJ.exe
  C:\Windows\System\mKIYXYJ.exe
  2⤵
  PID:6792
- C:\Windows\System\bGyWKkJ.exe
  C:\Windows\System\bGyWKkJ.exe
  2⤵
  PID:6808
- C:\Windows\System\JyoBOlu.exe
  C:\Windows\System\JyoBOlu.exe
  2⤵
  PID:6832
- C:\Windows\System\bKdWWgw.exe
  C:\Windows\System\bKdWWgw.exe
  2⤵
  PID:6848
- C:\Windows\System\jnMfPey.exe
  C:\Windows\System\jnMfPey.exe
  2⤵
  PID:6864
- C:\Windows\System\CrzXLtH.exe
  C:\Windows\System\CrzXLtH.exe
  2⤵
  PID:6880
- C:\Windows\System\OYWafMr.exe
  C:\Windows\System\OYWafMr.exe
  2⤵
  PID:6896
- C:\Windows\System\lHqFkkI.exe
  C:\Windows\System\lHqFkkI.exe
  2⤵
  PID:6912
- C:\Windows\System\bxQDZTf.exe
  C:\Windows\System\bxQDZTf.exe
  2⤵
  PID:6972
- C:\Windows\System\KGuaYWo.exe
  C:\Windows\System\KGuaYWo.exe
  2⤵
  PID:6988
- C:\Windows\System\pbEGzhv.exe
  C:\Windows\System\pbEGzhv.exe
  2⤵
  PID:7004
- C:\Windows\System\zGsOzWk.exe
  C:\Windows\System\zGsOzWk.exe
  2⤵
  PID:7020
- C:\Windows\System\cyJUNnE.exe
  C:\Windows\System\cyJUNnE.exe
  2⤵
  PID:7036
- C:\Windows\System\DQrWJre.exe
  C:\Windows\System\DQrWJre.exe
  2⤵
  PID:7052
- C:\Windows\System\SDTzVZN.exe
  C:\Windows\System\SDTzVZN.exe
  2⤵
  PID:7068
- C:\Windows\System\YlbwiMW.exe
  C:\Windows\System\YlbwiMW.exe
  2⤵
  PID:7088
- C:\Windows\System\FxrcKLd.exe
  C:\Windows\System\FxrcKLd.exe
  2⤵
  PID:7104
- C:\Windows\System\CoyMaBH.exe
  C:\Windows\System\CoyMaBH.exe
  2⤵
  PID:7120
- C:\Windows\System\VJKdfZs.exe
  C:\Windows\System\VJKdfZs.exe
  2⤵
  PID:7136
- C:\Windows\System\ADTIweq.exe
  C:\Windows\System\ADTIweq.exe
  2⤵
  PID:7152
- C:\Windows\System\OyahHee.exe
  C:\Windows\System\OyahHee.exe
  2⤵
  PID:6140
- C:\Windows\System\UYfdunQ.exe
  C:\Windows\System\UYfdunQ.exe
  2⤵
  PID:1540
- C:\Windows\System\nscIKxz.exe
  C:\Windows\System\nscIKxz.exe
  2⤵
  PID:6148
- C:\Windows\System\haNdzcG.exe
  C:\Windows\System\haNdzcG.exe
  2⤵
  PID:5868
- C:\Windows\System\ekJFjzY.exe
  C:\Windows\System\ekJFjzY.exe
  2⤵
  PID:5200
- C:\Windows\System\emnPoWZ.exe
  C:\Windows\System\emnPoWZ.exe
  2⤵
  PID:6280
- C:\Windows\System\YOPTFsY.exe
  C:\Windows\System\YOPTFsY.exe
  2⤵
  PID:6156
- C:\Windows\System\TNlclOK.exe
  C:\Windows\System\TNlclOK.exe
  2⤵
  PID:5412
- C:\Windows\System\OqvXLne.exe
  C:\Windows\System\OqvXLne.exe
  2⤵
  PID:6200
- C:\Windows\System\dzzajTP.exe
  C:\Windows\System\dzzajTP.exe
  2⤵
  PID:5408
- C:\Windows\System\zDfIwMx.exe
  C:\Windows\System\zDfIwMx.exe
  2⤵
  PID:5344
- C:\Windows\System\XcvRVRC.exe
  C:\Windows\System\XcvRVRC.exe
  2⤵
  PID:5660
- C:\Windows\System\gKVkdwg.exe
  C:\Windows\System\gKVkdwg.exe
  2⤵
  PID:6232
- C:\Windows\System\VcAoNnF.exe
  C:\Windows\System\VcAoNnF.exe
  2⤵
  PID:6304
- C:\Windows\System\MJewsWV.exe
  C:\Windows\System\MJewsWV.exe
  2⤵
  PID:6324
- C:\Windows\System\QTwhgDA.exe
  C:\Windows\System\QTwhgDA.exe
  2⤵
  PID:6368
- C:\Windows\System\nHLGLVL.exe
  C:\Windows\System\nHLGLVL.exe
  2⤵
  PID:6428
- C:\Windows\System\DbdFXnp.exe
  C:\Windows\System\DbdFXnp.exe
  2⤵
  PID:6468
- C:\Windows\System\sbvIqAo.exe
  C:\Windows\System\sbvIqAo.exe
  2⤵
  PID:6340
- C:\Windows\System\jXTiYaO.exe
  C:\Windows\System\jXTiYaO.exe
  2⤵
  PID:6448
- C:\Windows\System\kTwuTxX.exe
  C:\Windows\System\kTwuTxX.exe
  2⤵
  PID:6444
- C:\Windows\System\ioFnjyn.exe
  C:\Windows\System\ioFnjyn.exe
  2⤵
  PID:6580
- C:\Windows\System\YlQtxQZ.exe
  C:\Windows\System\YlQtxQZ.exe
  2⤵
  PID:6412
- C:\Windows\System\AWkwbhT.exe
  C:\Windows\System\AWkwbhT.exe
  2⤵
  PID:6552
- C:\Windows\System\dWDxKAg.exe
  C:\Windows\System\dWDxKAg.exe
  2⤵
  PID:6632
- C:\Windows\System\Mgkeyjf.exe
  C:\Windows\System\Mgkeyjf.exe
  2⤵
  PID:6652
- C:\Windows\System\GIqavFJ.exe
  C:\Windows\System\GIqavFJ.exe
  2⤵
  PID:6668
- C:\Windows\System\dmoGEzA.exe
  C:\Windows\System\dmoGEzA.exe
  2⤵
  PID:6684
- C:\Windows\System\jlZOHMq.exe
  C:\Windows\System\jlZOHMq.exe
  2⤵
  PID:6704
- C:\Windows\System\YotqULA.exe
  C:\Windows\System\YotqULA.exe
  2⤵
  PID:6716
- C:\Windows\System\IjnQlaG.exe
  C:\Windows\System\IjnQlaG.exe
  2⤵
  PID:6768
- C:\Windows\System\QUiOgci.exe
  C:\Windows\System\QUiOgci.exe
  2⤵
  PID:6732
- C:\Windows\System\AotfwoH.exe
  C:\Windows\System\AotfwoH.exe
  2⤵
  PID:6744
- C:\Windows\System\lAKCrpj.exe
  C:\Windows\System\lAKCrpj.exe
  2⤵
  PID:6748
- C:\Windows\System\tVPbsVk.exe
  C:\Windows\System\tVPbsVk.exe
  2⤵
  PID:6856
- C:\Windows\System\qMkcRlG.exe
  C:\Windows\System\qMkcRlG.exe
  2⤵
  PID:6920
- C:\Windows\System\fDVErvc.exe
  C:\Windows\System\fDVErvc.exe
  2⤵
  PID:6924
- C:\Windows\System\lHRbkpj.exe
  C:\Windows\System\lHRbkpj.exe
  2⤵
  PID:6844
- C:\Windows\System\kabGzfC.exe
  C:\Windows\System\kabGzfC.exe
  2⤵
  PID:6940
- C:\Windows\System\IZSErKq.exe
  C:\Windows\System\IZSErKq.exe
  2⤵
  PID:6956
- C:\Windows\System\aiBpcrf.exe
  C:\Windows\System\aiBpcrf.exe
  2⤵
  PID:6996
- C:\Windows\System\sDpXddl.exe
  C:\Windows\System\sDpXddl.exe
  2⤵
  PID:7032
- C:\Windows\System\AweIUQa.exe
  C:\Windows\System\AweIUQa.exe
  2⤵
  PID:7128
- C:\Windows\System\zwZZYTR.exe
  C:\Windows\System\zwZZYTR.exe
  2⤵
  PID:6128
- C:\Windows\System\UliNWwM.exe
  C:\Windows\System\UliNWwM.exe
  2⤵
  PID:6152
- C:\Windows\System\nFOCdbm.exe
  C:\Windows\System\nFOCdbm.exe
  2⤵
  PID:6096
- C:\Windows\System\lhwBbDa.exe
  C:\Windows\System\lhwBbDa.exe
  2⤵
  PID:6984
- C:\Windows\System\YTksnMZ.exe
  C:\Windows\System\YTksnMZ.exe
  2⤵
  PID:7012
- C:\Windows\System\YUnsMES.exe
  C:\Windows\System\YUnsMES.exe
  2⤵
  PID:7080
- C:\Windows\System\NmcpzJE.exe
  C:\Windows\System\NmcpzJE.exe
  2⤵
  PID:5276
- C:\Windows\System\ryLSiPa.exe
  C:\Windows\System\ryLSiPa.exe
  2⤵
  PID:7144
- C:\Windows\System\NQtgYUR.exe
  C:\Windows\System\NQtgYUR.exe
  2⤵
  PID:5920
- C:\Windows\System\EoRtpFZ.exe
  C:\Windows\System\EoRtpFZ.exe
  2⤵
  PID:6188
- C:\Windows\System\OeByZTI.exe
  C:\Windows\System\OeByZTI.exe
  2⤵
  PID:5780
- C:\Windows\System\RDktGiP.exe
  C:\Windows\System\RDktGiP.exe
  2⤵
  PID:5916
- C:\Windows\System\WnLoMAh.exe
  C:\Windows\System\WnLoMAh.exe
  2⤵
  PID:6664
- C:\Windows\System\gYAJFjo.exe
  C:\Windows\System\gYAJFjo.exe
  2⤵
  PID:6676
- C:\Windows\System\nUlPkCt.exe
  C:\Windows\System\nUlPkCt.exe
  2⤵
  PID:6740
- C:\Windows\System\BjynhGB.exe
  C:\Windows\System\BjynhGB.exe
  2⤵
  PID:6268
- C:\Windows\System\YGbGIWM.exe
  C:\Windows\System\YGbGIWM.exe
  2⤵
  PID:6708
- C:\Windows\System\vnCpeda.exe
  C:\Windows\System\vnCpeda.exe
  2⤵
  PID:6548
- C:\Windows\System\tefDMZB.exe
  C:\Windows\System\tefDMZB.exe
  2⤵
  PID:6816
- C:\Windows\System\YAWFsBY.exe
  C:\Windows\System\YAWFsBY.exe
  2⤵
  PID:6752
- C:\Windows\System\SchKzBq.exe
  C:\Windows\System\SchKzBq.exe
  2⤵
  PID:6888
- C:\Windows\System\tWPqnZV.exe
  C:\Windows\System\tWPqnZV.exe
  2⤵
  PID:6876
- C:\Windows\System\fMBoyPG.exe
  C:\Windows\System\fMBoyPG.exe
  2⤵
  PID:6904
- C:\Windows\System\GIFjgCq.exe
  C:\Windows\System\GIFjgCq.exe
  2⤵
  PID:6908
- C:\Windows\System\hxOjxNO.exe
  C:\Windows\System\hxOjxNO.exe
  2⤵
  PID:7064
- C:\Windows\System\hsswyTU.exe
  C:\Windows\System\hsswyTU.exe
  2⤵
  PID:5592
- C:\Windows\System\pwlNEHF.exe
  C:\Windows\System\pwlNEHF.exe
  2⤵
  PID:6952
- C:\Windows\System\JZGKamn.exe
  C:\Windows\System\JZGKamn.exe
  2⤵
  PID:6312
- C:\Windows\System\sYzPQwL.exe
  C:\Windows\System\sYzPQwL.exe
  2⤵
  PID:6568
- C:\Windows\System\pgVEOyq.exe
  C:\Windows\System\pgVEOyq.exe
  2⤵
  PID:5996
- C:\Windows\System\UDyDxUH.exe
  C:\Windows\System\UDyDxUH.exe
  2⤵
  PID:6484
- C:\Windows\System\hyVlSMp.exe
  C:\Windows\System\hyVlSMp.exe
  2⤵
  PID:7076
- C:\Windows\System\hsaaKoo.exe
  C:\Windows\System\hsaaKoo.exe
  2⤵
  PID:6512
- C:\Windows\System\UmEaXVo.exe
  C:\Windows\System\UmEaXVo.exe
  2⤵
  PID:6784
- C:\Windows\System\muXTqOm.exe
  C:\Windows\System\muXTqOm.exe
  2⤵
  PID:6892
- C:\Windows\System\nakLbfc.exe
  C:\Windows\System\nakLbfc.exe
  2⤵
  PID:6648
- C:\Windows\System\ZHGSfso.exe
  C:\Windows\System\ZHGSfso.exe
  2⤵
  PID:6968
- C:\Windows\System\NsQojMI.exe
  C:\Windows\System\NsQojMI.exe
  2⤵
  PID:6248
- C:\Windows\System\QPxsNIS.exe
  C:\Windows\System\QPxsNIS.exe
  2⤵
  PID:5812
- C:\Windows\System\VUIAGoe.exe
  C:\Windows\System\VUIAGoe.exe
  2⤵
  PID:6220
- C:\Windows\System\TyYwMOB.exe
  C:\Windows\System\TyYwMOB.exe
  2⤵
  PID:6936
- C:\Windows\System\plbXFys.exe
  C:\Windows\System\plbXFys.exe
  2⤵
  PID:6380
- C:\Windows\System\dJdRQFh.exe
  C:\Windows\System\dJdRQFh.exe
  2⤵
  PID:6500
- C:\Windows\System\NmoxXyC.exe
  C:\Windows\System\NmoxXyC.exe
  2⤵
  PID:7184
- C:\Windows\System\dsBgLtO.exe
  C:\Windows\System\dsBgLtO.exe
  2⤵
  PID:7200
- C:\Windows\System\FmTIOwA.exe
  C:\Windows\System\FmTIOwA.exe
  2⤵
  PID:7216
- C:\Windows\System\XiUqCgk.exe
  C:\Windows\System\XiUqCgk.exe
  2⤵
  PID:7244
- C:\Windows\System\wWuzqbb.exe
  C:\Windows\System\wWuzqbb.exe
  2⤵
  PID:7260
- C:\Windows\System\jHPwxBH.exe
  C:\Windows\System\jHPwxBH.exe
  2⤵
  PID:7276
- C:\Windows\System\TouIygU.exe
  C:\Windows\System\TouIygU.exe
  2⤵
  PID:7292
- C:\Windows\System\wxEBAbq.exe
  C:\Windows\System\wxEBAbq.exe
  2⤵
  PID:7312
- C:\Windows\System\ewMqOyB.exe
  C:\Windows\System\ewMqOyB.exe
  2⤵
  PID:7328
- C:\Windows\System\fFfwpvF.exe
  C:\Windows\System\fFfwpvF.exe
  2⤵
  PID:7344
- C:\Windows\System\owZgeND.exe
  C:\Windows\System\owZgeND.exe
  2⤵
  PID:7360
- C:\Windows\System\NsIuJWG.exe
  C:\Windows\System\NsIuJWG.exe
  2⤵
  PID:7376
- C:\Windows\System\qoPIXKb.exe
  C:\Windows\System\qoPIXKb.exe
  2⤵
  PID:7392
- C:\Windows\System\mxHBOFs.exe
  C:\Windows\System\mxHBOFs.exe
  2⤵
  PID:7408
- C:\Windows\System\CWOWLYA.exe
  C:\Windows\System\CWOWLYA.exe
  2⤵
  PID:7424
- C:\Windows\System\pdIXbYZ.exe
  C:\Windows\System\pdIXbYZ.exe
  2⤵
  PID:7440
- C:\Windows\System\fyixvKH.exe
  C:\Windows\System\fyixvKH.exe
  2⤵
  PID:7456
- C:\Windows\System\PRGdWyI.exe
  C:\Windows\System\PRGdWyI.exe
  2⤵
  PID:7472
- C:\Windows\System\IzNdLBH.exe
  C:\Windows\System\IzNdLBH.exe
  2⤵
  PID:7488
- C:\Windows\System\eFFfgFY.exe
  C:\Windows\System\eFFfgFY.exe
  2⤵
  PID:7504
- C:\Windows\System\QgZXSfo.exe
  C:\Windows\System\QgZXSfo.exe
  2⤵
  PID:7520
- C:\Windows\System\qIbrrnL.exe
  C:\Windows\System\qIbrrnL.exe
  2⤵
  PID:7536
- C:\Windows\System\qRKlDnq.exe
  C:\Windows\System\qRKlDnq.exe
  2⤵
  PID:7552
- C:\Windows\System\wTssXCr.exe
  C:\Windows\System\wTssXCr.exe
  2⤵
  PID:7568
- C:\Windows\System\UwcaiDn.exe
  C:\Windows\System\UwcaiDn.exe
  2⤵
  PID:7584
- C:\Windows\System\mmiQjFB.exe
  C:\Windows\System\mmiQjFB.exe
  2⤵
  PID:7604
- C:\Windows\System\zaAGfQQ.exe
  C:\Windows\System\zaAGfQQ.exe
  2⤵
  PID:7620
- C:\Windows\System\rtNAEAj.exe
  C:\Windows\System\rtNAEAj.exe
  2⤵
  PID:7636
- C:\Windows\System\EBaZPzc.exe
  C:\Windows\System\EBaZPzc.exe
  2⤵
  PID:7652
- C:\Windows\System\UpsdwPf.exe
  C:\Windows\System\UpsdwPf.exe
  2⤵
  PID:7668
- C:\Windows\System\rdrSxeG.exe
  C:\Windows\System\rdrSxeG.exe
  2⤵
  PID:7684
- C:\Windows\System\PItWBcA.exe
  C:\Windows\System\PItWBcA.exe
  2⤵
  PID:7700
- C:\Windows\System\rEIeHMN.exe
  C:\Windows\System\rEIeHMN.exe
  2⤵
  PID:7716
- C:\Windows\System\lqoNfOB.exe
  C:\Windows\System\lqoNfOB.exe
  2⤵
  PID:7732
- C:\Windows\System\HLGHVWG.exe
  C:\Windows\System\HLGHVWG.exe
  2⤵
  PID:7748
- C:\Windows\System\yRDZIOp.exe
  C:\Windows\System\yRDZIOp.exe
  2⤵
  PID:7764
- C:\Windows\System\yrmlzSd.exe
  C:\Windows\System\yrmlzSd.exe
  2⤵
  PID:7780
- C:\Windows\System\qLSQnRM.exe
  C:\Windows\System\qLSQnRM.exe
  2⤵
  PID:7796
- C:\Windows\System\hTosveu.exe
  C:\Windows\System\hTosveu.exe
  2⤵
  PID:7812
- C:\Windows\System\pSxIyVv.exe
  C:\Windows\System\pSxIyVv.exe
  2⤵
  PID:7828
- C:\Windows\System\ZYmfiky.exe
  C:\Windows\System\ZYmfiky.exe
  2⤵
  PID:7844
- C:\Windows\System\NwIUNlx.exe
  C:\Windows\System\NwIUNlx.exe
  2⤵
  PID:7860
- C:\Windows\System\aiUforu.exe
  C:\Windows\System\aiUforu.exe
  2⤵
  PID:7876
- C:\Windows\System\BtKpnRG.exe
  C:\Windows\System\BtKpnRG.exe
  2⤵
  PID:7892
- C:\Windows\System\PylohXB.exe
  C:\Windows\System\PylohXB.exe
  2⤵
  PID:7908
- C:\Windows\System\cwbqOIn.exe
  C:\Windows\System\cwbqOIn.exe
  2⤵
  PID:7924
- C:\Windows\System\YNpRjwc.exe
  C:\Windows\System\YNpRjwc.exe
  2⤵
  PID:7940
- C:\Windows\System\kjxercw.exe
  C:\Windows\System\kjxercw.exe
  2⤵
  PID:7956
- C:\Windows\System\txcStOt.exe
  C:\Windows\System\txcStOt.exe
  2⤵
  PID:7972
- C:\Windows\System\tZYaCKX.exe
  C:\Windows\System\tZYaCKX.exe
  2⤵
  PID:7988
- C:\Windows\System\zHPCRvt.exe
  C:\Windows\System\zHPCRvt.exe
  2⤵
  PID:8004
- C:\Windows\System\tXoewQk.exe
  C:\Windows\System\tXoewQk.exe
  2⤵
  PID:8020
- C:\Windows\System\bqRtjNN.exe
  C:\Windows\System\bqRtjNN.exe
  2⤵
  PID:8036
- C:\Windows\System\hQQYrdv.exe
  C:\Windows\System\hQQYrdv.exe
  2⤵
  PID:8052
- C:\Windows\System\IbEAPfx.exe
  C:\Windows\System\IbEAPfx.exe
  2⤵
  PID:8068
- C:\Windows\System\DfDKBpn.exe
  C:\Windows\System\DfDKBpn.exe
  2⤵
  PID:8084
- C:\Windows\System\tjRCJGE.exe
  C:\Windows\System\tjRCJGE.exe
  2⤵
  PID:8100
- C:\Windows\System\LJiKAdA.exe
  C:\Windows\System\LJiKAdA.exe
  2⤵
  PID:8116
- C:\Windows\System\iZKrYpe.exe
  C:\Windows\System\iZKrYpe.exe
  2⤵
  PID:8132
- C:\Windows\System\jWmHwEy.exe
  C:\Windows\System\jWmHwEy.exe
  2⤵
  PID:8148
- C:\Windows\System\TqJGgsc.exe
  C:\Windows\System\TqJGgsc.exe
  2⤵
  PID:8164
- C:\Windows\System\gtZjtbD.exe
  C:\Windows\System\gtZjtbD.exe
  2⤵
  PID:8180
- C:\Windows\System\MFosVUx.exe
  C:\Windows\System\MFosVUx.exe
  2⤵
  PID:7180
- C:\Windows\System\UpKevor.exe
  C:\Windows\System\UpKevor.exe
  2⤵
  PID:7208
- C:\Windows\System\UOMWWdh.exe
  C:\Windows\System\UOMWWdh.exe
  2⤵
  PID:7116
- C:\Windows\System\eNrWmKc.exe
  C:\Windows\System\eNrWmKc.exe
  2⤵
  PID:7196
- C:\Windows\System\jfzYyWY.exe
  C:\Windows\System\jfzYyWY.exe
  2⤵
  PID:6756
- C:\Windows\System\FcETKcU.exe
  C:\Windows\System\FcETKcU.exe
  2⤵
  PID:7224
- C:\Windows\System\eujaAmo.exe
  C:\Windows\System\eujaAmo.exe
  2⤵
  PID:7236
- C:\Windows\System\apzXyCz.exe
  C:\Windows\System\apzXyCz.exe
  2⤵
  PID:7284
- C:\Windows\System\EmQaPon.exe
  C:\Windows\System\EmQaPon.exe
  2⤵
  PID:7384
- C:\Windows\System\xgyqnDD.exe
  C:\Windows\System\xgyqnDD.exe
  2⤵
  PID:7416
- C:\Windows\System\buKKUse.exe
  C:\Windows\System\buKKUse.exe
  2⤵
  PID:7452
- C:\Windows\System\uEtVwjU.exe
  C:\Windows\System\uEtVwjU.exe
  2⤵
  PID:7340
- C:\Windows\System\OsqadLt.exe
  C:\Windows\System\OsqadLt.exe
  2⤵
  PID:7404
- C:\Windows\System\vlpkAyf.exe
  C:\Windows\System\vlpkAyf.exe
  2⤵
  PID:7468
- C:\Windows\System\yatCmrm.exe
  C:\Windows\System\yatCmrm.exe
  2⤵
  PID:7272
- C:\Windows\System\gfVutEU.exe
  C:\Windows\System\gfVutEU.exe
  2⤵
  PID:7544
- C:\Windows\System\tOGDBEo.exe
  C:\Windows\System\tOGDBEo.exe
  2⤵
  PID:7616
- C:\Windows\System\TmkKZba.exe
  C:\Windows\System\TmkKZba.exe
  2⤵
  PID:7680
- C:\Windows\System\oaJJszp.exe
  C:\Windows\System\oaJJszp.exe
  2⤵
  PID:7740
- C:\Windows\System\LXfaDWu.exe
  C:\Windows\System\LXfaDWu.exe
  2⤵
  PID:7772
- C:\Windows\System\NUlpLRM.exe
  C:\Windows\System\NUlpLRM.exe
  2⤵
  PID:7804
- C:\Windows\System\nwZwznX.exe
  C:\Windows\System\nwZwznX.exe
  2⤵
  PID:7500
- C:\Windows\System\MlucOmB.exe
  C:\Windows\System\MlucOmB.exe
  2⤵
  PID:7868
- C:\Windows\System\XQdlmKD.exe
  C:\Windows\System\XQdlmKD.exe
  2⤵
  PID:7852
- C:\Windows\System\VAHFfXY.exe
  C:\Windows\System\VAHFfXY.exe
  2⤵
  PID:7724
- C:\Windows\System\SjMmLaE.exe
  C:\Windows\System\SjMmLaE.exe
  2⤵
  PID:7932
- C:\Windows\System\qgjEtpK.exe
  C:\Windows\System\qgjEtpK.exe
  2⤵
  PID:7968
- C:\Windows\System\pIMUWaR.exe
  C:\Windows\System\pIMUWaR.exe
  2⤵
  PID:8028
- C:\Windows\System\VDGaOKf.exe
  C:\Windows\System\VDGaOKf.exe
  2⤵
  PID:7788
- C:\Windows\System\HphppVX.exe
  C:\Windows\System\HphppVX.exe
  2⤵
  PID:7824
- C:\Windows\System\ObyfXfx.exe
  C:\Windows\System\ObyfXfx.exe
  2⤵
  PID:8156
- C:\Windows\System\xLCuibA.exe
  C:\Windows\System\xLCuibA.exe
  2⤵
  PID:7176
- C:\Windows\System\VMzBbUH.exe
  C:\Windows\System\VMzBbUH.exe
  2⤵
  PID:6772
- C:\Windows\System\gAXQYdX.exe
  C:\Windows\System\gAXQYdX.exe
  2⤵
  PID:7232
- C:\Windows\System\UZrfopZ.exe
  C:\Windows\System\UZrfopZ.exe
  2⤵
  PID:7300
- C:\Windows\System\ZffFtgB.exe
  C:\Windows\System\ZffFtgB.exe
  2⤵
  PID:8044
- C:\Windows\System\ZiLBmvG.exe
  C:\Windows\System\ZiLBmvG.exe
  2⤵
  PID:8172
- C:\Windows\System\gttZIdA.exe
  C:\Windows\System\gttZIdA.exe
  2⤵
  PID:6516
- C:\Windows\System\asQHoDM.exe
  C:\Windows\System\asQHoDM.exe
  2⤵
  PID:7212
- C:\Windows\System\TwxoTzt.exe
  C:\Windows\System\TwxoTzt.exe
  2⤵
  PID:7368
- C:\Windows\System\EZfzkwu.exe
  C:\Windows\System\EZfzkwu.exe
  2⤵
  PID:7516
- C:\Windows\System\acZxGuc.exe
  C:\Windows\System\acZxGuc.exe
  2⤵
  PID:7712
- C:\Windows\System\JTdxYtp.exe
  C:\Windows\System\JTdxYtp.exe
  2⤵
  PID:7464
- C:\Windows\System\tVqABVH.exe
  C:\Windows\System\tVqABVH.exe
  2⤵
  PID:7560
- C:\Windows\System\RWsuRuB.exe
  C:\Windows\System\RWsuRuB.exe
  2⤵
  PID:7496
- C:\Windows\System\NFPHRNs.exe
  C:\Windows\System\NFPHRNs.exe
  2⤵
  PID:7900
- C:\Windows\System\MmyRlkr.exe
  C:\Windows\System\MmyRlkr.exe
  2⤵
  PID:7936
- C:\Windows\System\WoXahxd.exe
  C:\Windows\System\WoXahxd.exe
  2⤵
  PID:8092
- C:\Windows\System\oFPKOlE.exe
  C:\Windows\System\oFPKOlE.exe
  2⤵
  PID:7760
- C:\Windows\System\PdKLExr.exe
  C:\Windows\System\PdKLExr.exe
  2⤵
  PID:8016
- C:\Windows\System\UhzyUpj.exe
  C:\Windows\System\UhzyUpj.exe
  2⤵
  PID:7324
- C:\Windows\System\rLeAfgH.exe
  C:\Windows\System\rLeAfgH.exe
  2⤵
  PID:8160
- C:\Windows\System\PBkRxqd.exe
  C:\Windows\System\PBkRxqd.exe
  2⤵
  PID:7920
- C:\Windows\System\OTNdUFG.exe
  C:\Windows\System\OTNdUFG.exe
  2⤵
  PID:7952
- C:\Windows\System\GpOAHeM.exe
  C:\Windows\System\GpOAHeM.exe
  2⤵
  PID:7252
- C:\Windows\System\wkyztFr.exe
  C:\Windows\System\wkyztFr.exe
  2⤵
  PID:7192
- C:\Windows\System\KHiAmJl.exe
  C:\Windows\System\KHiAmJl.exe
  2⤵
  PID:7388
- C:\Windows\System\daCfuQn.exe
  C:\Windows\System\daCfuQn.exe
  2⤵
  PID:7836
- C:\Windows\System\KVOLVYe.exe
  C:\Windows\System\KVOLVYe.exe
  2⤵
  PID:7692
- C:\Windows\System\GCgiQxD.exe
  C:\Windows\System\GCgiQxD.exe
  2⤵
  PID:7664
- C:\Windows\System\JHLzRQy.exe
  C:\Windows\System\JHLzRQy.exe
  2⤵
  PID:7984
- C:\Windows\System\wOdYEej.exe
  C:\Windows\System\wOdYEej.exe
  2⤵
  PID:7820
- C:\Windows\System\FbNXScV.exe
  C:\Windows\System\FbNXScV.exe
  2⤵
  PID:8144
- C:\Windows\System\JdFLzPa.exe
  C:\Windows\System\JdFLzPa.exe
  2⤵
  PID:7596
- C:\Windows\System\DrvzdpS.exe
  C:\Windows\System\DrvzdpS.exe
  2⤵
  PID:8204
- C:\Windows\System\rutywXE.exe
  C:\Windows\System\rutywXE.exe
  2⤵
  PID:8220
- C:\Windows\System\nzTYBfJ.exe
  C:\Windows\System\nzTYBfJ.exe
  2⤵
  PID:8316
- C:\Windows\System\gjqEPSC.exe
  C:\Windows\System\gjqEPSC.exe
  2⤵
  PID:8332
- C:\Windows\System\AoGaopj.exe
  C:\Windows\System\AoGaopj.exe
  2⤵
  PID:8356
- C:\Windows\System\OnHkHuR.exe
  C:\Windows\System\OnHkHuR.exe
  2⤵
  PID:8372
- C:\Windows\System\NkCCENJ.exe
  C:\Windows\System\NkCCENJ.exe
  2⤵
  PID:8388
- C:\Windows\System\VmBnMxx.exe
  C:\Windows\System\VmBnMxx.exe
  2⤵
  PID:8404
- C:\Windows\System\SBMSrcU.exe
  C:\Windows\System\SBMSrcU.exe
  2⤵
  PID:8516
- C:\Windows\System\upkiMsd.exe
  C:\Windows\System\upkiMsd.exe
  2⤵
  PID:8532
- C:\Windows\System\mPGzvLE.exe
  C:\Windows\System\mPGzvLE.exe
  2⤵
  PID:8552
- C:\Windows\System\ixlelbD.exe
  C:\Windows\System\ixlelbD.exe
  2⤵
  PID:8592
- C:\Windows\System\XNCmhYp.exe
  C:\Windows\System\XNCmhYp.exe
  2⤵
  PID:8608
- C:\Windows\System\VNdmoLZ.exe
  C:\Windows\System\VNdmoLZ.exe
  2⤵
  PID:8624
- C:\Windows\System\cNJmSgs.exe
  C:\Windows\System\cNJmSgs.exe
  2⤵
  PID:8640
- C:\Windows\System\VcDJPgm.exe
  C:\Windows\System\VcDJPgm.exe
  2⤵
  PID:8656
- C:\Windows\System\KJPDSBs.exe
  C:\Windows\System\KJPDSBs.exe
  2⤵
  PID:8672
- C:\Windows\System\BEXkRir.exe
  C:\Windows\System\BEXkRir.exe
  2⤵
  PID:8688
- C:\Windows\System\sVPalKl.exe
  C:\Windows\System\sVPalKl.exe
  2⤵
  PID:8716
- C:\Windows\System\zLCtHTo.exe
  C:\Windows\System\zLCtHTo.exe
  2⤵
  PID:8736
- C:\Windows\System\xUgTYLb.exe
  C:\Windows\System\xUgTYLb.exe
  2⤵
  PID:8880
- C:\Windows\System\mCRGTYZ.exe
  C:\Windows\System\mCRGTYZ.exe
  2⤵
  PID:8896
- C:\Windows\System\ZJItdUu.exe
  C:\Windows\System\ZJItdUu.exe
  2⤵
  PID:8916
- C:\Windows\System\zILpuCQ.exe
  C:\Windows\System\zILpuCQ.exe
  2⤵
  PID:8932
- C:\Windows\System\tlCTCLW.exe
  C:\Windows\System\tlCTCLW.exe
  2⤵
  PID:8952
- C:\Windows\System\UMRYiJE.exe
  C:\Windows\System\UMRYiJE.exe
  2⤵
  PID:8968
- C:\Windows\System\efKjhlj.exe
  C:\Windows\System\efKjhlj.exe
  2⤵
  PID:8984
- C:\Windows\System\krFgjzA.exe
  C:\Windows\System\krFgjzA.exe
  2⤵
  PID:9000
- C:\Windows\System\WJnWuXD.exe
  C:\Windows\System\WJnWuXD.exe
  2⤵
  PID:9016
- C:\Windows\System\eQASXgl.exe
  C:\Windows\System\eQASXgl.exe
  2⤵
  PID:9032
- C:\Windows\System\NrEctvz.exe
  C:\Windows\System\NrEctvz.exe
  2⤵
  PID:9052
- C:\Windows\System\QkslAue.exe
  C:\Windows\System\QkslAue.exe
  2⤵
  PID:9068
- C:\Windows\System\pqgULtP.exe
  C:\Windows\System\pqgULtP.exe
  2⤵
  PID:9156
- C:\Windows\System\OSXGheC.exe
  C:\Windows\System\OSXGheC.exe
  2⤵
  PID:9176
- C:\Windows\System\YtuaJky.exe
  C:\Windows\System\YtuaJky.exe
  2⤵
  PID:9192
- C:\Windows\System\pjcIWLd.exe
  C:\Windows\System\pjcIWLd.exe
  2⤵
  PID:9212
- C:\Windows\System\hAERoxP.exe
  C:\Windows\System\hAERoxP.exe
  2⤵
  PID:7916
- C:\Windows\System\wFexamP.exe
  C:\Windows\System\wFexamP.exe
  2⤵
  PID:8060
- C:\Windows\System\cjQDEgr.exe
  C:\Windows\System\cjQDEgr.exe
  2⤵
  PID:6724
- C:\Windows\System\DRUFDDw.exe
  C:\Windows\System\DRUFDDw.exe
  2⤵
  PID:7904
- C:\Windows\System\oJneXWO.exe
  C:\Windows\System\oJneXWO.exe
  2⤵
  PID:8232
- C:\Windows\System\vQDxpKt.exe
  C:\Windows\System\vQDxpKt.exe
  2⤵
  PID:8248
- C:\Windows\System\sPTRvXW.exe
  C:\Windows\System\sPTRvXW.exe
  2⤵
  PID:8268
- C:\Windows\System\hRZcwNG.exe
  C:\Windows\System\hRZcwNG.exe
  2⤵
  PID:8284
- C:\Windows\System\wLEuvol.exe
  C:\Windows\System\wLEuvol.exe
  2⤵
  PID:8296
- C:\Windows\System\PmEBXfD.exe
  C:\Windows\System\PmEBXfD.exe
  2⤵
  PID:8312
- C:\Windows\System\OdIlLdN.exe
  C:\Windows\System\OdIlLdN.exe
  2⤵
  PID:8324
- C:\Windows\System\uwPjIoC.exe
  C:\Windows\System\uwPjIoC.exe
  2⤵
  PID:8384
- C:\Windows\System\ZfDqANH.exe
  C:\Windows\System\ZfDqANH.exe
  2⤵
  PID:8396
- C:\Windows\System\jFZSIWa.exe
  C:\Windows\System\jFZSIWa.exe
  2⤵
  PID:8456
- C:\Windows\System\NcFAclI.exe
  C:\Windows\System\NcFAclI.exe
  2⤵
  PID:8444
- C:\Windows\System\msSxjqm.exe
  C:\Windows\System\msSxjqm.exe
  2⤵
  PID:8464
- C:\Windows\System\esVaaky.exe
  C:\Windows\System\esVaaky.exe
  2⤵
  PID:8480
- C:\Windows\System\McjWooz.exe
  C:\Windows\System\McjWooz.exe
  2⤵
  PID:8500
- C:\Windows\System\SWNrVmf.exe
  C:\Windows\System\SWNrVmf.exe
  2⤵
  PID:8540
- C:\Windows\System\RIMXTiO.exe
  C:\Windows\System\RIMXTiO.exe
  2⤵
  PID:8560
- C:\Windows\System\vhKcYjE.exe
  C:\Windows\System\vhKcYjE.exe
  2⤵
  PID:8572
- C:\Windows\System\HjpYTED.exe
  C:\Windows\System\HjpYTED.exe
  2⤵
  PID:8604
- C:\Windows\System\lbyVNTS.exe
  C:\Windows\System\lbyVNTS.exe
  2⤵
  PID:8668
- C:\Windows\System\dInJyfn.exe
  C:\Windows\System\dInJyfn.exe
  2⤵
  PID:8708
- C:\Windows\System\PEkQDRT.exe
  C:\Windows\System\PEkQDRT.exe
  2⤵
  PID:8744
- C:\Windows\System\NJNqcuK.exe
  C:\Windows\System\NJNqcuK.exe
  2⤵
  PID:8648
- C:\Windows\System\YGqgNES.exe
  C:\Windows\System\YGqgNES.exe
  2⤵
  PID:8728
- C:\Windows\System\oNgxFZX.exe
  C:\Windows\System\oNgxFZX.exe
  2⤵
  PID:8756
- C:\Windows\System\XfrxSfi.exe
  C:\Windows\System\XfrxSfi.exe
  2⤵
  PID:8416
- C:\Windows\System\sxNVpqJ.exe
  C:\Windows\System\sxNVpqJ.exe
  2⤵
  PID:8784
- C:\Windows\System\LQZodTv.exe
  C:\Windows\System\LQZodTv.exe
  2⤵
  PID:8804
- C:\Windows\System\HjYFPub.exe
  C:\Windows\System\HjYFPub.exe
  2⤵
  PID:8820
- C:\Windows\System\oghEyjX.exe
  C:\Windows\System\oghEyjX.exe
  2⤵
  PID:8840
- C:\Windows\System\BxvTFSL.exe
  C:\Windows\System\BxvTFSL.exe
  2⤵
  PID:8836
- C:\Windows\System\RguQPcK.exe
  C:\Windows\System\RguQPcK.exe
  2⤵
  PID:8868
- C:\Windows\System\mfclLSt.exe
  C:\Windows\System\mfclLSt.exe
  2⤵
  PID:8908
- C:\Windows\System\sSlmZoe.exe
  C:\Windows\System\sSlmZoe.exe
  2⤵
  PID:8888
- C:\Windows\System\nBNaQYK.exe
  C:\Windows\System\nBNaQYK.exe
  2⤵
  PID:8976
- C:\Windows\System\sxvReJI.exe
  C:\Windows\System\sxvReJI.exe
  2⤵
  PID:9008
- C:\Windows\System\bcLZlvl.exe
  C:\Windows\System\bcLZlvl.exe
  2⤵
  PID:9048
- C:\Windows\System\DFCOhLd.exe
  C:\Windows\System\DFCOhLd.exe
  2⤵
  PID:9024
- C:\Windows\System\giKtUCq.exe
  C:\Windows\System\giKtUCq.exe
  2⤵
  PID:9060
- C:\Windows\System\qyStqhy.exe
  C:\Windows\System\qyStqhy.exe
  2⤵
  PID:9092
- C:\Windows\System\NKtxTWh.exe
  C:\Windows\System\NKtxTWh.exe
  2⤵
  PID:9108
- C:\Windows\System\eKWauuj.exe
  C:\Windows\System\eKWauuj.exe
  2⤵
  PID:9124
- C:\Windows\System\HhKZoxM.exe
  C:\Windows\System\HhKZoxM.exe
  2⤵
  PID:9140
- C:\Windows\System\rtAlzwa.exe
  C:\Windows\System\rtAlzwa.exe
  2⤵
  PID:9184
- C:\Windows\System\cMDkyvV.exe
  C:\Windows\System\cMDkyvV.exe
  2⤵
  PID:8788
- C:\Windows\System\LlHKxgT.exe
  C:\Windows\System\LlHKxgT.exe
  2⤵
  PID:8212
- C:\Windows\System\oYExQeU.exe
  C:\Windows\System\oYExQeU.exe
  2⤵
  PID:9168
- C:\Windows\System\LjEFvjv.exe
  C:\Windows\System\LjEFvjv.exe
  2⤵
  PID:8292
- C:\Windows\System\KtkpvQv.exe
  C:\Windows\System\KtkpvQv.exe
  2⤵
  PID:8348
- C:\Windows\System\xIrAnHD.exe
  C:\Windows\System\xIrAnHD.exe
  2⤵
  PID:9200
- C:\Windows\System\jIUoANA.exe
  C:\Windows\System\jIUoANA.exe
  2⤵
  PID:8112
- C:\Windows\System\cjoYZgS.exe
  C:\Windows\System\cjoYZgS.exe
  2⤵
  PID:7612
- C:\Windows\System\jYbSHUH.exe
  C:\Windows\System\jYbSHUH.exe
  2⤵
  PID:8200
- C:\Windows\System\dmzgSdK.exe
  C:\Windows\System\dmzgSdK.exe
  2⤵
  PID:8432
- C:\Windows\System\UoQZKBt.exe
  C:\Windows\System\UoQZKBt.exe
  2⤵
  PID:8472
- C:\Windows\System\sxIsWfs.exe
  C:\Windows\System\sxIsWfs.exe
  2⤵
  PID:8488
- C:\Windows\System\qmZlebN.exe
  C:\Windows\System\qmZlebN.exe
  2⤵
  PID:8564
- C:\Windows\System\JZfmiTD.exe
  C:\Windows\System\JZfmiTD.exe
  2⤵
  PID:8580
- C:\Windows\System\ZHcLZsg.exe
  C:\Windows\System\ZHcLZsg.exe
  2⤵
  PID:8700
- C:\Windows\System\umZSLJJ.exe
  C:\Windows\System\umZSLJJ.exe
  2⤵
  PID:8680
- C:\Windows\System\mAOiiNU.exe
  C:\Windows\System\mAOiiNU.exe
  2⤵
  PID:8828
- C:\Windows\System\kzxWeWa.exe
  C:\Windows\System\kzxWeWa.exe
  2⤵
  PID:8768
- C:\Windows\System\iWDzYdt.exe
  C:\Windows\System\iWDzYdt.exe
  2⤵
  PID:8980
- C:\Windows\System\CcVXWtS.exe
  C:\Windows\System\CcVXWtS.exe
  2⤵
  PID:8992
- C:\Windows\System\RLKjsNJ.exe
  C:\Windows\System\RLKjsNJ.exe
  2⤵
  PID:8776
- C:\Windows\System\QodXRQl.exe
  C:\Windows\System\QodXRQl.exe
  2⤵
  PID:8816
- C:\Windows\System\VniIGDq.exe
  C:\Windows\System\VniIGDq.exe
  2⤵
  PID:8948
- C:\Windows\System\FCVRbkZ.exe
  C:\Windows\System\FCVRbkZ.exe
  2⤵
  PID:9028
- C:\Windows\System\inxfBCk.exe
  C:\Windows\System\inxfBCk.exe
  2⤵
  PID:9100
- C:\Windows\System\pcbDqAz.exe
  C:\Windows\System\pcbDqAz.exe
  2⤵
  PID:8876
- C:\Windows\System\oPcxdkY.exe
  C:\Windows\System\oPcxdkY.exe
  2⤵
  PID:7592
- C:\Windows\System\stsYcWH.exe
  C:\Windows\System\stsYcWH.exe
  2⤵
  PID:8364
- C:\Windows\System\hTmtESo.exe
  C:\Windows\System\hTmtESo.exe
  2⤵
  PID:9204
- C:\Windows\System\ebwZRGu.exe
  C:\Windows\System\ebwZRGu.exe
  2⤵
  PID:8216
- C:\Windows\System\UnGdODp.exe
  C:\Windows\System\UnGdODp.exe
  2⤵
  PID:8620
- C:\Windows\System\xAuvYvy.exe
  C:\Windows\System\xAuvYvy.exe
  2⤵
  PID:8508
- C:\Windows\System\JPzJVBN.exe
  C:\Windows\System\JPzJVBN.exe
  2⤵
  PID:8800
- C:\Windows\System\IfyfLLx.exe
  C:\Windows\System\IfyfLLx.exe
  2⤵
  PID:9084
- C:\Windows\System\CwsYtOU.exe
  C:\Windows\System\CwsYtOU.exe
  2⤵
  PID:9120
- C:\Windows\System\edyUKnl.exe
  C:\Windows\System\edyUKnl.exe
  2⤵
  PID:6460
- C:\Windows\System\xRRoGBZ.exe
  C:\Windows\System\xRRoGBZ.exe
  2⤵
  PID:8748
- C:\Windows\System\mBoDhdT.exe
  C:\Windows\System\mBoDhdT.exe
  2⤵
  PID:8420
- C:\Windows\System\jJDgOcr.exe
  C:\Windows\System\jJDgOcr.exe
  2⤵
  PID:9044
- C:\Windows\System\zkrMKgb.exe
  C:\Windows\System\zkrMKgb.exe
  2⤵
  PID:8256
- C:\Windows\System\xwgDbUR.exe
  C:\Windows\System\xwgDbUR.exe
  2⤵
  PID:8452
- C:\Windows\System\gSkOetz.exe
  C:\Windows\System\gSkOetz.exe
  2⤵
  PID:996
- C:\Windows\System\gdYWhIW.exe
  C:\Windows\System\gdYWhIW.exe
  2⤵
  PID:8616
- C:\Windows\System\ozkEQwn.exe
  C:\Windows\System\ozkEQwn.exe
  2⤵
  PID:9228
- C:\Windows\System\dQcHgpV.exe
  C:\Windows\System\dQcHgpV.exe
  2⤵
  PID:9256
- C:\Windows\System\XiJXDRS.exe
  C:\Windows\System\XiJXDRS.exe
  2⤵
  PID:9272
- C:\Windows\System\hLLAoGt.exe
  C:\Windows\System\hLLAoGt.exe
  2⤵
  PID:9288
- C:\Windows\System\fJMQFBb.exe
  C:\Windows\System\fJMQFBb.exe
  2⤵
  PID:9304
- C:\Windows\System\OuSlWnY.exe
  C:\Windows\System\OuSlWnY.exe
  2⤵
  PID:9324
- C:\Windows\System\SloYAfE.exe
  C:\Windows\System\SloYAfE.exe
  2⤵
  PID:9340
- C:\Windows\System\HkFrvQQ.exe
  C:\Windows\System\HkFrvQQ.exe
  2⤵
  PID:9360
- C:\Windows\System\ujcVIHT.exe
  C:\Windows\System\ujcVIHT.exe
  2⤵
  PID:9376
- C:\Windows\System\BRaDWBC.exe
  C:\Windows\System\BRaDWBC.exe
  2⤵
  PID:9392
- C:\Windows\System\yqUhyML.exe
  C:\Windows\System\yqUhyML.exe
  2⤵
  PID:9412
- C:\Windows\System\iarMXdu.exe
  C:\Windows\System\iarMXdu.exe
  2⤵
  PID:9448
- C:\Windows\System\cXrgepm.exe
  C:\Windows\System\cXrgepm.exe
  2⤵
  PID:9464
- C:\Windows\System\sJakUwa.exe
  C:\Windows\System\sJakUwa.exe
  2⤵
  PID:9480
- C:\Windows\System\dutUCAI.exe
  C:\Windows\System\dutUCAI.exe
  2⤵
  PID:9500
- C:\Windows\System\rbiKRoX.exe
  C:\Windows\System\rbiKRoX.exe
  2⤵
  PID:9516
- C:\Windows\System\kSZwknM.exe
  C:\Windows\System\kSZwknM.exe
  2⤵
  PID:9532
- C:\Windows\System\jQyJLLu.exe
  C:\Windows\System\jQyJLLu.exe
  2⤵
  PID:9552
- C:\Windows\System\QpGVUjy.exe
  C:\Windows\System\QpGVUjy.exe
  2⤵
  PID:9576
- C:\Windows\System\ugQVOBI.exe
  C:\Windows\System\ugQVOBI.exe
  2⤵
  PID:9596
- C:\Windows\System\EdiICbh.exe
  C:\Windows\System\EdiICbh.exe
  2⤵
  PID:9612
- C:\Windows\System\lhxhjjC.exe
  C:\Windows\System\lhxhjjC.exe
  2⤵
  PID:9628
- C:\Windows\System\EqiKGmx.exe
  C:\Windows\System\EqiKGmx.exe
  2⤵
  PID:9644
- C:\Windows\System\VTyWJHw.exe
  C:\Windows\System\VTyWJHw.exe
  2⤵
  PID:9664
- C:\Windows\System\ujyQXyP.exe
  C:\Windows\System\ujyQXyP.exe
  2⤵
  PID:9680
- C:\Windows\System\vlFvwNE.exe
  C:\Windows\System\vlFvwNE.exe
  2⤵
  PID:9700
- C:\Windows\System\iNlZGjQ.exe
  C:\Windows\System\iNlZGjQ.exe
  2⤵
  PID:9716
- C:\Windows\System\OmIncwI.exe
  C:\Windows\System\OmIncwI.exe
  2⤵
  PID:9736
- C:\Windows\System\pHuRywF.exe
  C:\Windows\System\pHuRywF.exe
  2⤵
  PID:9756
- C:\Windows\System\oILjNxy.exe
  C:\Windows\System\oILjNxy.exe
  2⤵
  PID:9772
- C:\Windows\System\TILHHta.exe
  C:\Windows\System\TILHHta.exe
  2⤵
  PID:9788
- C:\Windows\System\goaJtgC.exe
  C:\Windows\System\goaJtgC.exe
  2⤵
  PID:9804
- C:\Windows\System\cRufaYM.exe
  C:\Windows\System\cRufaYM.exe
  2⤵
  PID:9820
- C:\Windows\System\nQjaFeW.exe
  C:\Windows\System\nQjaFeW.exe
  2⤵
  PID:9836
- C:\Windows\System\JDosMlD.exe
  C:\Windows\System\JDosMlD.exe
  2⤵
  PID:9928
- C:\Windows\System\MZPjjVe.exe
  C:\Windows\System\MZPjjVe.exe
  2⤵
  PID:9944
- C:\Windows\System\nbjiiIt.exe
  C:\Windows\System\nbjiiIt.exe
  2⤵
  PID:9960
- C:\Windows\System\IklAboT.exe
  C:\Windows\System\IklAboT.exe
  2⤵
  PID:9980
- C:\Windows\System\ROWNlpi.exe
  C:\Windows\System\ROWNlpi.exe
  2⤵
  PID:9996
- C:\Windows\System\QioRaic.exe
  C:\Windows\System\QioRaic.exe
  2⤵
  PID:10016
- C:\Windows\System\ooUmLeQ.exe
  C:\Windows\System\ooUmLeQ.exe
  2⤵
  PID:10032
- C:\Windows\System\uQcaNFP.exe
  C:\Windows\System\uQcaNFP.exe
  2⤵
  PID:10048
- C:\Windows\System\xEpLVSc.exe
  C:\Windows\System\xEpLVSc.exe
  2⤵
  PID:10064
- C:\Windows\System\YfXmCjy.exe
  C:\Windows\System\YfXmCjy.exe
  2⤵
  PID:10080
- C:\Windows\System\BKDrTbS.exe
  C:\Windows\System\BKDrTbS.exe
  2⤵
  PID:10096
- C:\Windows\System\QrLCleR.exe
  C:\Windows\System\QrLCleR.exe
  2⤵
  PID:10112
- C:\Windows\System\goWdBOO.exe
  C:\Windows\System\goWdBOO.exe
  2⤵
  PID:10128
- C:\Windows\System\UXYmJHD.exe
  C:\Windows\System\UXYmJHD.exe
  2⤵
  PID:10144
- C:\Windows\System\DYiGjfd.exe
  C:\Windows\System\DYiGjfd.exe
  2⤵
  PID:10164
- C:\Windows\System\TXRVQKz.exe
  C:\Windows\System\TXRVQKz.exe
  2⤵
  PID:10180
- C:\Windows\System\cBXXBvB.exe
  C:\Windows\System\cBXXBvB.exe
  2⤵
  PID:10196
- C:\Windows\System\KbwzPlL.exe
  C:\Windows\System\KbwzPlL.exe
  2⤵
  PID:9280
- C:\Windows\System\ftbINkG.exe
  C:\Windows\System\ftbINkG.exe
  2⤵
  PID:9348
- C:\Windows\System\hEXkdbE.exe
  C:\Windows\System\hEXkdbE.exe
  2⤵
  PID:8652
- C:\Windows\System\cuGqhJG.exe
  C:\Windows\System\cuGqhJG.exe
  2⤵
  PID:9152
- C:\Windows\System\uJMjjJg.exe
  C:\Windows\System\uJMjjJg.exe
  2⤵
  PID:9220
- C:\Windows\System\LeINFlr.exe
  C:\Windows\System\LeINFlr.exe
  2⤵
  PID:9296
- C:\Windows\System\kJpCZrr.exe
  C:\Windows\System\kJpCZrr.exe
  2⤵
  PID:9368
- C:\Windows\System\ZHfhwrW.exe
  C:\Windows\System\ZHfhwrW.exe
  2⤵
  PID:9460
- C:\Windows\System\enijTja.exe
  C:\Windows\System\enijTja.exe
  2⤵
  PID:9524
- C:\Windows\System\vSKwTMK.exe
  C:\Windows\System\vSKwTMK.exe
  2⤵
  PID:9564
- C:\Windows\System\OjvPLVc.exe
  C:\Windows\System\OjvPLVc.exe
  2⤵
  PID:9436
- C:\Windows\System\fkUmJST.exe
  C:\Windows\System\fkUmJST.exe
  2⤵
  PID:9420
- C:\Windows\System\RVTCKEg.exe
  C:\Windows\System\RVTCKEg.exe
  2⤵
  PID:9476
- C:\Windows\System\QOAyVlb.exe
  C:\Windows\System\QOAyVlb.exe
  2⤵
  PID:9548
- C:\Windows\System\dcvvPrp.exe
  C:\Windows\System\dcvvPrp.exe
  2⤵
  PID:9636
- C:\Windows\System\gPdoKXt.exe
  C:\Windows\System\gPdoKXt.exe
  2⤵
  PID:9676
- C:\Windows\System\imrdGpZ.exe
  C:\Windows\System\imrdGpZ.exe
  2⤵
  PID:9748
- C:\Windows\System\dWaROVs.exe
  C:\Windows\System\dWaROVs.exe
  2⤵
  PID:9724
- C:\Windows\System\GinQHrV.exe
  C:\Windows\System\GinQHrV.exe
  2⤵
  PID:9620
- C:\Windows\System\HaKVDpI.exe
  C:\Windows\System\HaKVDpI.exe
  2⤵
  PID:9660
- C:\Windows\System\EqolhwG.exe
  C:\Windows\System\EqolhwG.exe
  2⤵
  PID:9812
- C:\Windows\System\nfsylKD.exe
  C:\Windows\System\nfsylKD.exe
  2⤵
  PID:9816
- C:\Windows\System\QavTWOF.exe
  C:\Windows\System\QavTWOF.exe
  2⤵
  PID:9828
- C:\Windows\System\OHciucU.exe
  C:\Windows\System\OHciucU.exe
  2⤵
  PID:9860
- C:\Windows\System\VmCmsGy.exe
  C:\Windows\System\VmCmsGy.exe
  2⤵
  PID:9876
- C:\Windows\System\MNTBCrZ.exe
  C:\Windows\System\MNTBCrZ.exe
  2⤵
  PID:9896
- C:\Windows\System\tcHNRsk.exe
  C:\Windows\System\tcHNRsk.exe
  2⤵
  PID:9912
- C:\Windows\System\OLUqrzk.exe
  C:\Windows\System\OLUqrzk.exe
  2⤵
  PID:9884
- C:\Windows\System\MoJPDQH.exe
  C:\Windows\System\MoJPDQH.exe
  2⤵
  PID:9972
- C:\Windows\System\QbuBNcZ.exe
  C:\Windows\System\QbuBNcZ.exe
  2⤵
  PID:10028
- C:\Windows\System\wNvrLqs.exe
  C:\Windows\System\wNvrLqs.exe
  2⤵
  PID:9940
- C:\Windows\System\KqQCNoc.exe
  C:\Windows\System\KqQCNoc.exe
  2⤵
  PID:10092
- C:\Windows\System\SqXhKcE.exe
  C:\Windows\System\SqXhKcE.exe
  2⤵
  PID:10008
- C:\Windows\System\LabBFpa.exe
  C:\Windows\System\LabBFpa.exe
  2⤵
  PID:10120
- C:\Windows\System\LrpuLUD.exe
  C:\Windows\System\LrpuLUD.exe
  2⤵
  PID:10188
- C:\Windows\System\MPILJPJ.exe
  C:\Windows\System\MPILJPJ.exe
  2⤵
  PID:10176
- C:\Windows\System\cSJTTGb.exe
  C:\Windows\System\cSJTTGb.exe
  2⤵
  PID:10212
- C:\Windows\System\VtRnyuj.exe
  C:\Windows\System\VtRnyuj.exe
  2⤵
  PID:10232
- C:\Windows\System\TmOmSki.exe
  C:\Windows\System\TmOmSki.exe
  2⤵
  PID:8812
- C:\Windows\System\HYpJVUF.exe
  C:\Windows\System\HYpJVUF.exe
  2⤵
  PID:8924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AenzLFv.exe

Filesize
2.1MB

MD5
d9bd19012962938e6b12e2ae3eef7ffa

SHA1
3325d8b54b747ac442b6c9c90b79afd6f35f817b

SHA256
30cabea6b10429fd495cd12a8ec59dcbde916ca3bbcc08fc1abc2db07287e55b

SHA512
ef9ba153a779a1875b739dcdd9fb440732aef3181d139c3bf77467a0f05b93585e3476f05370b23162d8d15c027be46c6bb5c5863788baa91be4853a02d67601

Download Submit
C:\Windows\system\AmILLsg.exe

Filesize
2.1MB

MD5
e227231701ff6c264b1f9d4b21605449

SHA1
d53521ac42d102bcc32417d96cb23d27f3e09120

SHA256
ebb334c36c573463a2858cf113c70caa44928355cb0a663febecc47084230b55

SHA512
a98571647c9053022187617db211a5314161e39a4adfa1680bb87fb74213d0097b7b0a3f27ff96e5379e3db5e72080f6aae892f666fd94a29bbdb0a7593acda1

Download Submit
C:\Windows\system\DFyFIGj.exe

Filesize
2.1MB

MD5
e8e96c10baa133cc865ce3b2d1df112e

SHA1
e3a38fc6d9487043e3cdf3fd25e50fcf999dd0cc

SHA256
4f0d980d36c6c62ea93019ebabd261dc734f4733f36d387610b1c8ae4ddc5017

SHA512
2f25219c9254d090faba19a769d61c0599727031d7633340f9a1d4e6ae67ff896b994eaaa73dea28b7ba5c301bf7bd7bf02f3bac6a67a6886f4edc311998821c

Download Submit
C:\Windows\system\FZZJlqV.exe

Filesize
2.1MB

MD5
486ab2d0e029b76936e0bacf41fe7cba

SHA1
2b84f45cededf7cf9d7f3e1f33f699a042520e53

SHA256
65ef1595f77cddcd11a0086b964fc98db6eec80c6d09627c99688788fc8db874

SHA512
d252d2a67e31790819bfbc69db2688a12e8fc1b79253a163ae2b15f9698848e25edbc1277ebe562c4a9b368de4dc2139ae54fb8b0021b281786f576bbda21802

Download Submit
C:\Windows\system\KmuGruN.exe

Filesize
2.1MB

MD5
28c7b3ea25756d1f25e233eef48f46d1

SHA1
c60eb0409d3a417c4ea7316b1387db8db764ed75

SHA256
26502e223c386f471ebacfbf0046cbb2338fd630ba366a894ead671a61177062

SHA512
ef96c0c20a17e9f61df8dece56eb79a3ab2d399542a14cb8839418edc4295fbf157bcd75cecfb991393b50567d649d592156a29495cbeff799a85c7baee7014f

Download Submit
C:\Windows\system\Kqcfnva.exe

Filesize
2.1MB

MD5
fedc75dfcc847e6c01d48f16708f1d14

SHA1
ed0c78948c5b602ffa8d7797ee4c8985c24c8012

SHA256
d79f2f57f5edea9dca1fb780c30b6e18e6638f1ebcd6ba31659ca7fec2966d4c

SHA512
09ff09c9e5b6c69c2c45fcb3401d622e851067bc6c89379846ec5f73eb62955aa8ca32584385753e7be693c6032be40429ced8bca56c0781744c7686a2cf9265

Download Submit
C:\Windows\system\LNFKvEC.exe

Filesize
2.1MB

MD5
c25a1c5792d091fa819785d0a43e4432

SHA1
210e5469168748a93f10e761cc971d1cec8fde03

SHA256
803466a330fc7f36c3b7e71222c0c41056ce0f7292eb5172b3e1ff815c312296

SHA512
385e41ba0b59df2f9e145192b666f8c542ef98cc1dce09d2ac7cee09e9fcc7c259a38794d88d89bc1adb7fd0b3d22ed5f01fac411c6b7fcc3c5f8f2e2d2cf700

Download Submit
C:\Windows\system\OgrzgTH.exe

Filesize
2.1MB

MD5
315e3fd426e4c069e38df623dc7528c4

SHA1
79aa731fa5358dce122aedf8c31d3ae3b6f39d0b

SHA256
990d81ba37dd9260bfab7a65fd437edfaf97af71fdd6456aef7468e5ebfc10b3

SHA512
46fb2ee1ccf2109cc109f6f26b769e13d015bfcd72ef50dbe83e26a6b3948d63d902647d1c5f1830687b3e0c367ba64913cd7c037d4824b42d44fb79fe031c32

Download Submit
C:\Windows\system\SKjbPeY.exe

Filesize
2.1MB

MD5
b90c4048776c78e03e99d579226e2399

SHA1
7a3111e70230691e135cfec5ff3708d5e6025034

SHA256
f02f5fdccf4f5303954a1515f0a9d1381e82a4b28391dac7c74e0090f83037e0

SHA512
879f24f9796dcbb05f99e0cc7c6e972d9384d7deba2dd3da11259f792a555855183b47b595068b25ed972f3eccb6b7f4ea9e30e3d6222ae9fada197edcdf6615

Download Submit
C:\Windows\system\UOLiNBD.exe

Filesize
2.1MB

MD5
b2abf867cc6d0cfca33add7c9f4a38a1

SHA1
2ec77023a4c7300bc2c7c6e6546a79822df233b4

SHA256
0e8879be9ecc3acada227b2b1951f1373fdcfc48649b80f056953b151718b089

SHA512
c8ed7b151508c52d076b52a85566e0013c6cb832fe5f3529e171270a78f799650c403248561dcab672de4f9ac6a0c46835ab504f7a13362b45936b6da2e40e27

Download Submit
C:\Windows\system\UmXKZTx.exe

Filesize
2.1MB

MD5
750aa132103cef7e13f314ccfac50731

SHA1
136c71a6cb8a500e98dc2c01d844534986976ddc

SHA256
5c54bff4d4efbf0db306564dca3b2dfe5fe7b6545403ada727b352a216e47669

SHA512
7ee00837410a8a24fe21e57068c2f72b19db826a36b5935deb8ce54ccf7e61fb9be096d9e4722bda2ea674f5779425981a56e2919201751642d31f0f11c0343e

Download Submit
C:\Windows\system\WHmVpkL.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\system\YDHCikV.exe

Filesize
2.1MB

MD5
ab0f7bd9f1bb9cda96f3c486eb856dfc

SHA1
d3e6ad02a34d3cedf752f62214169cb1d0f488b4

SHA256
9ac1ed587eb3c3e43f2c40a3ceffe2f9e9124542d6bb23de14d7d41a2bd8403d

SHA512
2c82229d106b8c916ded42d62706889b3de43e25f01ce535aa76bdded74725dba41c049cd594f3a352073808987bbaca7e53d498d1adafc01064c7315bcea2ee

Download Submit
C:\Windows\system\eeHjmDo.exe

Filesize
2.1MB

MD5
5e47cc9144161473492c9de3a190b4de

SHA1
bb9f0c2d8cfd228cc90caa98fd57177541ca381a

SHA256
e3a14bdbf8484e023a63730d30f045f9bafd8f3f705307111d56eff63a5c46fb

SHA512
b314e1f62aebc18678cc3807167563b4fa294375b8258fdb3f5f8466e9cb9ff395628d0bfa61192adb000c0ceefa7f1c43812cfe842f10279e962ec5e4c5def7

Download Submit
C:\Windows\system\fuRzRqC.exe

Filesize
2.1MB

MD5
216e19a1963bf1e0fa8621795f398dcf

SHA1
f2dcca920e6b966fa18694487b8b0b36d572cc24

SHA256
cd47b8fcd65faeb0d5110a33153a4633a36cbd678e4b6d2be05c363ca17641b6

SHA512
4ded5e162a451f47e73d4eff2592360b77e8b960cc1976b3230c7dc8e0252016741ff235563e671be88bfb39a3e0b493344d37514f8398d9db643bd3677cd5a3

Download Submit
C:\Windows\system\hJeDpLr.exe

Filesize
2.1MB

MD5
58aeca42556ecd3cb8f8615f9158f9bb

SHA1
a27a532abb6b7550c3dc2361b0a3c4e44819ad30

SHA256
f69a4801ca3c0d0c138b4a04f8bbb16c45eed17cb36d79f118c608f813ee9725

SHA512
b48a5f8c4375c87bce1a1ddfa963249ecaec48397535150f8ab63d5ef69a8ed98c47f2d86863fe06897c0aa3a778492fabfe3574ee3abd3ae87aeeaa8152ac82

Download Submit
C:\Windows\system\jBjqutv.exe

Filesize
2.1MB

MD5
7f29f8a12645fbc0a6b5b3c9a81c0653

SHA1
584384851db69c40a15dba5eb0261c07fdc0ddc8

SHA256
19abef220c5011d289955f99a57301885c00e813a372209843d52896a663f796

SHA512
b87b53ae1a68fc342fd7b72c03336138a1d6ba191cb530806c55cd3a728e29d95c44c41e8f71f281576e39371b8f2d383447600a7aa7358085463f061a263611

Download Submit
C:\Windows\system\kDIGvCR.exe

Filesize
2.1MB

MD5
7bc94975fe8fabf53317f68a3d95dd98

SHA1
7f1f3ad3119f7781d30dc9bececea202becf082b

SHA256
ce1accb34c35c12dcda7349813e837666dbeb4fd79777ffdd99d9600a557fa68

SHA512
c0746f23079f0d99cf7ee86bf3e8599c9f7980c6b73bb816863efe60e3600f482837efde8bb1fabdbb4b7700bd04b173e3d30a48f26a848ce89d43cad42ab5b5

Download Submit
C:\Windows\system\mnLEVyb.exe

Filesize
2.1MB

MD5
78fedb20cb05f5489b2c1fb8973d1cbc

SHA1
4ace5c3dd8e18d2654a0844d56b820642add2381

SHA256
ac274a3a99b2bac559582f4fb5513f73e395e0084f678c876967f77dcad36af1

SHA512
0131e8deec53b6abb178cd956b97b1a75818594c803503026c0f004763467f1aea406a6d0ad47cec8b7592bef99b0ad0d0f0b0c35e546fe8e8143a73ec1ffc01

Download Submit
C:\Windows\system\rPkgpuk.exe

Filesize
2.1MB

MD5
e20d11d4a8fc1aff2be2541b07566727

SHA1
e98aebf463f763601c0f02bf609a3957debe7250

SHA256
38c6b79e05a00d67baebc6d145356c8fb1183b39f45ab256fcc66446591904e6

SHA512
1e5ea3e28489d37b51af9596723e7971bcf2b8aef4787207ecb6fbc7f239c0249e9dbe71110007a07e13143a09bd6b183cd5d6c90b2183b0f42550859c22911a

Download Submit
C:\Windows\system\rUzpoKP.exe

Filesize
2.1MB

MD5
5736cdbf3ad80ff5fc4ef0354666a594

SHA1
2d574c10cf58a744fb8bd7d1f00b0dd5812670b7

SHA256
8bf0b48b8c6d931192ae1cd015bfeed2b268392d20afe6c3dee293a0659224a0

SHA512
9f5f2421e16f3b79c613c7b16aed424196d3d35f2e3e25524ff8b89a5ff8514a126912c145d69f1e076bab02b28f5e6cfb5dd6d9780b0ff064f42d751f14f262

Download Submit
C:\Windows\system\uwSPdtp.exe

Filesize
2.1MB

MD5
0072727b51be7bfdff8ea59f9da8f1d0

SHA1
7bf4a713a481d3466d5f9b1f335e50a44a95d853

SHA256
d2078c599e1c93ce40ae9611fefc05d800d954dc37f4d754d0b2a4d395fcab58

SHA512
7b429adb02c298a0838c38ad1172ba6e3e5d3a76c94b10ffa1b7d4c610a620ba5805b6ff647886c954a33c362979820e00c64ba00c3a219df2cc762484af0c7c

Download Submit
C:\Windows\system\uwhgouS.exe

Filesize
2.1MB

MD5
b87dfe8c82b3266311608009733a2fef

SHA1
febe31d5b6805b022e73e55152895945ae372891

SHA256
02f321f0e803148398623770c26f5d323ef28579647201f2fc625d982f82fd91

SHA512
cbfa7024b3d0b50ac163d805d72572cff8ee727a919606ad902198e1655e06cfeb28cd9ac516cff21ffb212b916d6b94156c16e09f8fde6f0edb702d912ee268

Download Submit
C:\Windows\system\vHmhlJX.exe

Filesize
2.1MB

MD5
64bc06a223f2765686c2119613327433

SHA1
7a6723e405c4ae4ca2ad704adb302ef75b4b7407

SHA256
e7797f6d29d19765fac2f095640661c556c20dea15c7b93dd9b90709527123d6

SHA512
6e9df1342692caa8bbfdcb10977f6e86b723d38cd9fa0c889eb5a3563fe1259f15297cecbc19bf70609345dc5ad506d0154ac6ba95952516e8f69d19e061f918

Download Submit
C:\Windows\system\wExPEsk.exe

Filesize
2.1MB

MD5
330e5673a6a17e4e76a1334a5007351d

SHA1
f3fba67c142157d5885c29961e19feffcbbc45fa

SHA256
d6b8db106d55df266206249d8fa050e83740614e49606968dcbe59496c27effa

SHA512
5ae3c994c44f50838e6a89e93d79277cb41a2709d5dbb77e82ec64c8bb907bf5625a560664315d885f907acb71013eadb35bd18931c50051d55f8c03c36d0243

Download Submit
C:\Windows\system\xINrMQc.exe

Filesize
2.1MB

MD5
9f0581a811f40e1e377f12f80ce828ee

SHA1
9635f7f9e605ae49a31007507c73fa938f08a5b3

SHA256
fc5e6cd92b7a7851360e7d64706d8f1a6fd0d96ebc94a4d8deebd0cb034920f0

SHA512
4ec8d1a92c3ffdcf61affeb71160fd6b61e9d576639a539b568d67f2c8a74256cce12c32f69b3e5f4540ffa82ccacb3d6652939884bfd0dbbbadf044a881a785

Download Submit
C:\Windows\system\xijCMdM.exe

Filesize
2.1MB

MD5
014f5971e9dd390e785e95cf9f790b6c

SHA1
de34bbb8a909fffa9bdf9826ce67ffb14e61a4f2

SHA256
9c9a6c9864cc951c05379631e70225cacccb9e06c8993b4780b2958789a4f9d1

SHA512
1a3c4e68cb6072a99868270a20b405bd3c2dd1d8bfd724e603b84ecde1d37927422fb99d8bb02aaf15f0c5a36e771b421e7e91ec5f097824125d9baf95c289f3

Download Submit
\Windows\system\AtUDplQ.exe

Filesize
2.1MB

MD5
058726aa2e70a482fb57aa845b26048a

SHA1
aa1fbdf71513794e262a2ed8eb803d00834a623c

SHA256
c839e4ba0e5c600bd3b13fe0424ac9aafeebe58bc3f95ffc88310daeb9b27a7a

SHA512
ff6a3c056744296fb33fcc3fce2764b5d83b9b993d01d6cb4c6c09a37be78c2e0c5ac549e3b9608b0714f73237313ad89fc8f2599104e321bf9bea61cb2ff922

Download Submit
\Windows\system\LCYdMjW.exe

Filesize
2.1MB

MD5
fb4aefb69a2ae65f436bac200775bccb

SHA1
86af79ad029431518ac553053874cf71b42e165c

SHA256
93989102df7f310f731c8e72cb51cd6bd92ad54e6c8c51d29f9978e9e796e254

SHA512
cdf62b127dedbfd3843602b8e2a0c452d9e4368de0b6b5d668f7637253f2364077f52b700c4ecf1d860f42ac9dec162c090dbbceeba5d4fda9a6091c5b014452

Download Submit
\Windows\system\ZrwWwQr.exe

Filesize
2.1MB

MD5
dc257136fa651fe69285b8afb6276969

SHA1
556ad279c0740c90824941058b83c9fd8dd9bc25

SHA256
a218a8463125b0fe8636841bec64c08f13313a371e649939b4f5f92d229eb4c0

SHA512
9b8be16351e31b18b27866d955a1263eff7da616b0f315d65ae0db758be0ad4d277d984f3e93514d17401d83fce19a20b2c7618330c95398ff6a0e9781d01af0

Download Submit
\Windows\system\ZyqAcjP.exe

Filesize
2.1MB

MD5
9528a4c68775eafc049d132512c2dce1

SHA1
827dead409d53be54d6b9e1d1b36749a510f1367

SHA256
96dce391c01cd75072fd070334423e295024d5fcf8e9d7b67963ab0f907f3897

SHA512
7576c0ac8e6cd05685fd967d70fccaea44593f62b2c99f65d29e999a9eb43b841b9ab7e5f23442de211433c10b0990efd1e3e307f5d326d59c36cd26d942e8b7

Download Submit
\Windows\system\dyGGRJg.exe

Filesize
2.1MB

MD5
9521da5535238eccee7ac6b17a29499f

SHA1
0ab14d7a45dd5cc035e763414ea9e8329e686f28

SHA256
655614582055eb304b70a0c3b4bac0fe2268e73ea0262e9218ecafea6e3b2260

SHA512
26cbbccf9c6558ff70741d52aff2a00f76f6de899b78485f81b654477be6a3f418cbdf2c7fbb05c1b1e62bd835ff2e14fea7021f21f972c102cdafb4bb054a1d

Download Submit
\Windows\system\izRPCZk.exe

Filesize
2.1MB

MD5
1ceadb97900107ef5979a70c64e5c9d7

SHA1
c2e4b05da2bd976d093fca2fb1f05df213889982

SHA256
394e992c50a780d5754456f22283c2ac20d3b491ce2a0e2208ff9e156c4973bc

SHA512
f459ebb3e710ed5a479a9ca3e05f088c43d7ad6eb036c70fb37bcf0d63dc816efa917cb253e3842113b3bc59882b57e8597174a8467287640f2afdc458dd9426

Download Submit
memory/1508-237-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/1508-239-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2032-36-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-3928-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-145-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-133-0x0000000003220000-0x0000000003612000-memory.dmp

Filesize
3.9MB

Download
memory/2204-62-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2204-141-0x0000000003220000-0x0000000003612000-memory.dmp

Filesize
3.9MB

Download
memory/2204-140-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2204-139-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2204-13084-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2204-11722-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2204-143-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2204-144-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2204-146-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2204-147-0x0000000003220000-0x0000000003612000-memory.dmp

Filesize
3.9MB

Download
memory/2204-120-0x0000000003220000-0x0000000003612000-memory.dmp

Filesize
3.9MB

Download
memory/2204-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2204-0-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2204-44-0x0000000003220000-0x0000000003612000-memory.dmp

Filesize
3.9MB

Download
memory/2204-142-0x0000000003220000-0x0000000003612000-memory.dmp

Filesize
3.9MB

Download
memory/2204-94-0x0000000003220000-0x0000000003612000-memory.dmp

Filesize
3.9MB

Download
memory/2204-18-0x0000000002C50000-0x0000000003042000-memory.dmp

Filesize
3.9MB

Download
memory/2204-40-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-41-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-3932-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-148-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2540-3934-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2544-3927-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-125-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-69-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2632-3930-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2676-74-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2676-3929-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2808-3931-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-134-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download