xmrig | b12a1472dea61e779faeadc0ea44c70686d2e446a748b636a78f5000cd6b844f

Analysis

max time kernel
148s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
Size

2.0MB
MD5

9dc6108cb8d85578d0e46c16d98d1382
SHA1

f5e683f8a877b6f6409a316e6b426ed30f522cfa
SHA256

b12a1472dea61e779faeadc0ea44c70686d2e446a748b636a78f5000cd6b844f
SHA512

3cd77959f735b5ff628cf020831b88f387af4ffb2b99eee16f4673217c4b63379fb9e64232c405db1f489af6d80dd02b19cb07d261ddd2b30beb434e65e33ec3
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMC:NABq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/1996-233-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2724-207-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2776-202-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2808-200-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2676-198-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2756-245-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2352-227-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2596-225-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2536-222-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2244-216-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2684-212-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2852-9-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2724-4262-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2852-4265-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2676-4264-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/1996-4268-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2596-4269-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2244-4267-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2776-4271-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2536-4288-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2756-4300-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2352-4312-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2684-4307-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2116-4344-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2456	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2852	HJCnfyd.exe
2676	ZOetpDi.exe
2808	KhrhCpC.exe
2776	kNAPUOS.exe
2724	BhOALcN.exe
2684	GFtVXgg.exe
2244	CZztSJn.exe
2536	cWmFWrj.exe
2596	tdDsyyY.exe
2352	xtrZWRU.exe
1996	FSoDkQt.exe
2756	DlhGcso.exe
2760	WnelXRW.exe
2872	IGIgQBB.exe
2400	zTpvFlQ.exe
548	shknFBt.exe
1036	bRwAjcZ.exe
776	GQDHMFl.exe
1772	MVaPSeq.exe
1044	PyBSrrG.exe
2504	PEgKnVW.exe
2748	EmZFFMI.exe
700	NZpgvQa.exe
800	YXIGgLm.exe
2260	qyrCPUU.exe
1172	jZnrbtD.exe
2500	CaKzbuS.exe
2344	nMvVGrZ.exe
1752	SAYqNrc.exe
108	kjSTNWv.exe
1584	RSpfchC.exe
1744	MroVHLE.exe
568	cKjSZVE.exe
1276	QAsEtdw.exe
1796	PMtvJZG.exe
1812	tUNPmIb.exe
1788	yoBKxhC.exe
2056	uBkTzwe.exe
1820	lSDiLqn.exe
888	BpnSUrv.exe
2920	QrRQEhU.exe
1164	HPxBDSj.exe
1832	IeWXkYq.exe
2012	zlpGYrk.exe
904	mfNPUvM.exe
1736	PtOAWJu.exe
2628	CUEzxzu.exe
916	iPTXGXE.exe
2384	juCoZJY.exe
2120	CmdOwRB.exe
2208	ZxVwIHW.exe
860	aOyGvlR.exe
1600	BQpWAOd.exe
2804	qNtOcYb.exe
2632	WgHPnHj.exe
2972	jBZZhVb.exe
2584	WlqqLOJ.exe
2728	dMHNhTW.exe
2988	hSTrQpj.exe
2204	drGQSnG.exe
1244	zUYeohq.exe
2248	IhghOGR.exe
1460	kxNzQNm.exe
788	RCqilhc.exe

Loads dropped DLL 64 IoCs

pid	Process
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-1-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/files/0x000f00000001227e-6.dat	upx
behavioral1/files/0x0036000000016c7a-23.dat	upx
behavioral1/files/0x0007000000004e76-22.dat	upx
behavioral1/files/0x0007000000016d61-38.dat	upx
behavioral1/files/0x0007000000016d71-49.dat	upx
behavioral1/files/0x00050000000186ff-58.dat	upx
behavioral1/files/0x0005000000018739-63.dat	upx
behavioral1/files/0x000500000001873f-68.dat	upx
behavioral1/files/0x000500000001878d-78.dat	upx
behavioral1/files/0x000500000001925d-98.dat	upx
behavioral1/files/0x0005000000019283-120.dat	upx
behavioral1/files/0x000500000001939f-165.dat	upx
behavioral1/memory/1996-233-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2724-207-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2776-202-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2808-200-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2676-198-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2756-245-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2352-227-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2596-225-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2536-222-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2244-216-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2684-212-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x0005000000019462-162.dat	upx
behavioral1/files/0x000500000001943e-152.dat	upx
behavioral1/files/0x0005000000019381-146.dat	upx
behavioral1/files/0x00050000000193b1-143.dat	upx
behavioral1/files/0x0005000000019491-169.dat	upx
behavioral1/files/0x0005000000019457-159.dat	upx
behavioral1/files/0x0005000000019433-150.dat	upx
behavioral1/files/0x00050000000193a5-141.dat	upx
behavioral1/files/0x0036000000016cc3-133.dat	upx
behavioral1/files/0x000500000001933a-125.dat	upx
behavioral1/files/0x0005000000019275-110.dat	upx
behavioral1/files/0x0005000000019277-114.dat	upx
behavioral1/files/0x0005000000019260-103.dat	upx
behavioral1/files/0x000500000001923b-93.dat	upx
behavioral1/files/0x0005000000019228-88.dat	upx
behavioral1/files/0x0006000000018bf0-83.dat	upx
behavioral1/files/0x0005000000018787-73.dat	upx
behavioral1/files/0x00070000000186f1-52.dat	upx
behavioral1/files/0x0008000000016d69-44.dat	upx
behavioral1/files/0x0007000000016d4e-34.dat	upx
behavioral1/files/0x0008000000016d45-29.dat	upx
behavioral1/memory/2852-9-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2724-4262-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2852-4265-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2676-4264-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/1996-4268-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2596-4269-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2244-4267-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2776-4271-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2536-4288-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2756-4300-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2352-4312-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2684-4307-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2116-4344-0x000000013FE80000-0x0000000140272000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gGVpXaR.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\TPtPzJy.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\ekmmRhw.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\erWgTeB.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\dWvlWzi.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\HDRFJlv.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\xeojcTd.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\oiQCQai.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\QDWfjUD.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\qNtOcYb.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\iXuUUpR.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\wxLIjLj.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\EReLYYw.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\hDMEeSF.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\lkeIPJV.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\pHruSng.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\iuvFwtC.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\COCZURJ.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\YciUGyL.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\KVowcDS.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\fncwCYM.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\jaoAYFc.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\hNcKtrj.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\mkzysXZ.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\FsZnIHA.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\LHjvwof.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\jKbFYLB.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\GjagbUD.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\RwHaGZE.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\lpiUykE.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\Bbuvokt.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\mvgGUDF.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\EBmGoOg.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\FqjSboO.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\WqtanPE.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\zpCUYlj.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\fXgEMbb.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\FIlphuH.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\hcvfOzS.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\qlnyadP.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\nyOgWyT.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\lJCtxHW.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\lzpLJMv.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\yUFStGx.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\PcvLRxo.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\ZIWnuNy.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\LsnLOXN.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\XpwLlpT.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\BERwHur.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\lOvltwk.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\ZldzrLf.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\VXIZplY.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\rDFRtfc.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\SbzjCyT.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\NlXWmwd.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\ZVWqAkQ.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\cavDqBi.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\zTkheKF.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\BrwbBJu.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\adOVokK.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\XCaHCZY.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\IeNaPyl.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\ZSAapBO.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
File created	C:\Windows\System\zTNpOQV.exe	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2456	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
Token: SeDebugPrivilege	2456	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2456	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	29
PID 2116 wrote to memory of 2456	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	29
PID 2116 wrote to memory of 2456	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	29
PID 2116 wrote to memory of 2852	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2852	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2852	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	30
PID 2116 wrote to memory of 2808	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2808	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2808	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	31
PID 2116 wrote to memory of 2676	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	32
PID 2116 wrote to memory of 2676	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	32
PID 2116 wrote to memory of 2676	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	32
PID 2116 wrote to memory of 2776	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	33
PID 2116 wrote to memory of 2776	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	33
PID 2116 wrote to memory of 2776	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	33
PID 2116 wrote to memory of 2724	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	34
PID 2116 wrote to memory of 2724	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	34
PID 2116 wrote to memory of 2724	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	34
PID 2116 wrote to memory of 2684	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	35
PID 2116 wrote to memory of 2684	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	35
PID 2116 wrote to memory of 2684	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	35
PID 2116 wrote to memory of 2244	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	36
PID 2116 wrote to memory of 2244	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	36
PID 2116 wrote to memory of 2244	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	36
PID 2116 wrote to memory of 2536	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	37
PID 2116 wrote to memory of 2536	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	37
PID 2116 wrote to memory of 2536	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	37
PID 2116 wrote to memory of 2596	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	38
PID 2116 wrote to memory of 2596	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	38
PID 2116 wrote to memory of 2596	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	38
PID 2116 wrote to memory of 2352	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	39
PID 2116 wrote to memory of 2352	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	39
PID 2116 wrote to memory of 2352	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	39
PID 2116 wrote to memory of 1996	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	40
PID 2116 wrote to memory of 1996	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	40
PID 2116 wrote to memory of 1996	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	40
PID 2116 wrote to memory of 2756	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	41
PID 2116 wrote to memory of 2756	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	41
PID 2116 wrote to memory of 2756	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	41
PID 2116 wrote to memory of 2760	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	42
PID 2116 wrote to memory of 2760	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	42
PID 2116 wrote to memory of 2760	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	42
PID 2116 wrote to memory of 2872	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	43
PID 2116 wrote to memory of 2872	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	43
PID 2116 wrote to memory of 2872	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	43
PID 2116 wrote to memory of 2400	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	44
PID 2116 wrote to memory of 2400	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	44
PID 2116 wrote to memory of 2400	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	44
PID 2116 wrote to memory of 548	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	45
PID 2116 wrote to memory of 548	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	45
PID 2116 wrote to memory of 548	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	45
PID 2116 wrote to memory of 1036	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	46
PID 2116 wrote to memory of 1036	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	46
PID 2116 wrote to memory of 1036	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	46
PID 2116 wrote to memory of 776	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	47
PID 2116 wrote to memory of 776	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	47
PID 2116 wrote to memory of 776	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	47
PID 2116 wrote to memory of 1772	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	48
PID 2116 wrote to memory of 1772	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	48
PID 2116 wrote to memory of 1772	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	48
PID 2116 wrote to memory of 1044	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	49
PID 2116 wrote to memory of 1044	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	49
PID 2116 wrote to memory of 1044	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	49
PID 2116 wrote to memory of 2504	2116	9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9dc6108cb8d85578d0e46c16d98d1382_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\System\HJCnfyd.exe
  C:\Windows\System\HJCnfyd.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\KhrhCpC.exe
  C:\Windows\System\KhrhCpC.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\ZOetpDi.exe
  C:\Windows\System\ZOetpDi.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\kNAPUOS.exe
  C:\Windows\System\kNAPUOS.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\BhOALcN.exe
  C:\Windows\System\BhOALcN.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\GFtVXgg.exe
  C:\Windows\System\GFtVXgg.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\CZztSJn.exe
  C:\Windows\System\CZztSJn.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\cWmFWrj.exe
  C:\Windows\System\cWmFWrj.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\tdDsyyY.exe
  C:\Windows\System\tdDsyyY.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\xtrZWRU.exe
  C:\Windows\System\xtrZWRU.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\FSoDkQt.exe
  C:\Windows\System\FSoDkQt.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\DlhGcso.exe
  C:\Windows\System\DlhGcso.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\WnelXRW.exe
  C:\Windows\System\WnelXRW.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\IGIgQBB.exe
  C:\Windows\System\IGIgQBB.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\zTpvFlQ.exe
  C:\Windows\System\zTpvFlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\shknFBt.exe
  C:\Windows\System\shknFBt.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\bRwAjcZ.exe
  C:\Windows\System\bRwAjcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\GQDHMFl.exe
  C:\Windows\System\GQDHMFl.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\MVaPSeq.exe
  C:\Windows\System\MVaPSeq.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\PyBSrrG.exe
  C:\Windows\System\PyBSrrG.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\PEgKnVW.exe
  C:\Windows\System\PEgKnVW.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\EmZFFMI.exe
  C:\Windows\System\EmZFFMI.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NZpgvQa.exe
  C:\Windows\System\NZpgvQa.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\jZnrbtD.exe
  C:\Windows\System\jZnrbtD.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\YXIGgLm.exe
  C:\Windows\System\YXIGgLm.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\SAYqNrc.exe
  C:\Windows\System\SAYqNrc.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\qyrCPUU.exe
  C:\Windows\System\qyrCPUU.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\RSpfchC.exe
  C:\Windows\System\RSpfchC.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\CaKzbuS.exe
  C:\Windows\System\CaKzbuS.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\MroVHLE.exe
  C:\Windows\System\MroVHLE.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\nMvVGrZ.exe
  C:\Windows\System\nMvVGrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\cKjSZVE.exe
  C:\Windows\System\cKjSZVE.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\kjSTNWv.exe
  C:\Windows\System\kjSTNWv.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\PMtvJZG.exe
  C:\Windows\System\PMtvJZG.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\QAsEtdw.exe
  C:\Windows\System\QAsEtdw.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\tUNPmIb.exe
  C:\Windows\System\tUNPmIb.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\yoBKxhC.exe
  C:\Windows\System\yoBKxhC.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\uBkTzwe.exe
  C:\Windows\System\uBkTzwe.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\lSDiLqn.exe
  C:\Windows\System\lSDiLqn.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\BpnSUrv.exe
  C:\Windows\System\BpnSUrv.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\QrRQEhU.exe
  C:\Windows\System\QrRQEhU.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\iPTXGXE.exe
  C:\Windows\System\iPTXGXE.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\HPxBDSj.exe
  C:\Windows\System\HPxBDSj.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\juCoZJY.exe
  C:\Windows\System\juCoZJY.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\IeWXkYq.exe
  C:\Windows\System\IeWXkYq.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\CmdOwRB.exe
  C:\Windows\System\CmdOwRB.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\zlpGYrk.exe
  C:\Windows\System\zlpGYrk.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\ZxVwIHW.exe
  C:\Windows\System\ZxVwIHW.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\mfNPUvM.exe
  C:\Windows\System\mfNPUvM.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\aOyGvlR.exe
  C:\Windows\System\aOyGvlR.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\PtOAWJu.exe
  C:\Windows\System\PtOAWJu.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\BQpWAOd.exe
  C:\Windows\System\BQpWAOd.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\CUEzxzu.exe
  C:\Windows\System\CUEzxzu.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\qNtOcYb.exe
  C:\Windows\System\qNtOcYb.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\WgHPnHj.exe
  C:\Windows\System\WgHPnHj.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\jBZZhVb.exe
  C:\Windows\System\jBZZhVb.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\WlqqLOJ.exe
  C:\Windows\System\WlqqLOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\hSTrQpj.exe
  C:\Windows\System\hSTrQpj.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\dMHNhTW.exe
  C:\Windows\System\dMHNhTW.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\drGQSnG.exe
  C:\Windows\System\drGQSnG.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\zUYeohq.exe
  C:\Windows\System\zUYeohq.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\IhghOGR.exe
  C:\Windows\System\IhghOGR.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\kxNzQNm.exe
  C:\Windows\System\kxNzQNm.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\cOduvcx.exe
  C:\Windows\System\cOduvcx.exe
  2⤵
  PID:868
- C:\Windows\System\RCqilhc.exe
  C:\Windows\System\RCqilhc.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\uvikprH.exe
  C:\Windows\System\uvikprH.exe
  2⤵
  PID:2524
- C:\Windows\System\NfhHhbH.exe
  C:\Windows\System\NfhHhbH.exe
  2⤵
  PID:2412
- C:\Windows\System\laDSeaI.exe
  C:\Windows\System\laDSeaI.exe
  2⤵
  PID:780
- C:\Windows\System\oeuoYfv.exe
  C:\Windows\System\oeuoYfv.exe
  2⤵
  PID:1732
- C:\Windows\System\SUEjywz.exe
  C:\Windows\System\SUEjywz.exe
  2⤵
  PID:1980
- C:\Windows\System\wpHmJqc.exe
  C:\Windows\System\wpHmJqc.exe
  2⤵
  PID:1516
- C:\Windows\System\TnpluWJ.exe
  C:\Windows\System\TnpluWJ.exe
  2⤵
  PID:1284
- C:\Windows\System\nitpqJt.exe
  C:\Windows\System\nitpqJt.exe
  2⤵
  PID:320
- C:\Windows\System\XqfbbCn.exe
  C:\Windows\System\XqfbbCn.exe
  2⤵
  PID:824
- C:\Windows\System\zEUZWNu.exe
  C:\Windows\System\zEUZWNu.exe
  2⤵
  PID:2476
- C:\Windows\System\DSvsDRP.exe
  C:\Windows\System\DSvsDRP.exe
  2⤵
  PID:592
- C:\Windows\System\ZltYSwX.exe
  C:\Windows\System\ZltYSwX.exe
  2⤵
  PID:848
- C:\Windows\System\ZPkdYTQ.exe
  C:\Windows\System\ZPkdYTQ.exe
  2⤵
  PID:1580
- C:\Windows\System\kBIyTEg.exe
  C:\Windows\System\kBIyTEg.exe
  2⤵
  PID:2176
- C:\Windows\System\GqDlxTO.exe
  C:\Windows\System\GqDlxTO.exe
  2⤵
  PID:1840
- C:\Windows\System\mTBEVgM.exe
  C:\Windows\System\mTBEVgM.exe
  2⤵
  PID:1664
- C:\Windows\System\yXhvMkZ.exe
  C:\Windows\System\yXhvMkZ.exe
  2⤵
  PID:1384
- C:\Windows\System\KuzDJSU.exe
  C:\Windows\System\KuzDJSU.exe
  2⤵
  PID:2100
- C:\Windows\System\OVYPafO.exe
  C:\Windows\System\OVYPafO.exe
  2⤵
  PID:716
- C:\Windows\System\lmTVZIB.exe
  C:\Windows\System\lmTVZIB.exe
  2⤵
  PID:1204
- C:\Windows\System\mmhvQeX.exe
  C:\Windows\System\mmhvQeX.exe
  2⤵
  PID:2004
- C:\Windows\System\hLPOeQj.exe
  C:\Windows\System\hLPOeQj.exe
  2⤵
  PID:2612
- C:\Windows\System\pUdYkys.exe
  C:\Windows\System\pUdYkys.exe
  2⤵
  PID:2300
- C:\Windows\System\EqEHUAP.exe
  C:\Windows\System\EqEHUAP.exe
  2⤵
  PID:1568
- C:\Windows\System\IDRmesu.exe
  C:\Windows\System\IDRmesu.exe
  2⤵
  PID:2796
- C:\Windows\System\UPcisUl.exe
  C:\Windows\System\UPcisUl.exe
  2⤵
  PID:1108
- C:\Windows\System\nAIKfBm.exe
  C:\Windows\System\nAIKfBm.exe
  2⤵
  PID:3040
- C:\Windows\System\YRyjQuC.exe
  C:\Windows\System\YRyjQuC.exe
  2⤵
  PID:1004
- C:\Windows\System\CKHfLcc.exe
  C:\Windows\System\CKHfLcc.exe
  2⤵
  PID:2092
- C:\Windows\System\EHQUwnF.exe
  C:\Windows\System\EHQUwnF.exe
  2⤵
  PID:1724
- C:\Windows\System\paMpGAC.exe
  C:\Windows\System\paMpGAC.exe
  2⤵
  PID:2884
- C:\Windows\System\OletctA.exe
  C:\Windows\System\OletctA.exe
  2⤵
  PID:2644
- C:\Windows\System\YmVVetW.exe
  C:\Windows\System\YmVVetW.exe
  2⤵
  PID:3004
- C:\Windows\System\RPxdmeY.exe
  C:\Windows\System\RPxdmeY.exe
  2⤵
  PID:1304
- C:\Windows\System\BrhgplL.exe
  C:\Windows\System\BrhgplL.exe
  2⤵
  PID:1096
- C:\Windows\System\wkYvnYU.exe
  C:\Windows\System\wkYvnYU.exe
  2⤵
  PID:2780
- C:\Windows\System\vonqfNq.exe
  C:\Windows\System\vonqfNq.exe
  2⤵
  PID:1000
- C:\Windows\System\aMxLZOL.exe
  C:\Windows\System\aMxLZOL.exe
  2⤵
  PID:1052
- C:\Windows\System\xMQpikI.exe
  C:\Windows\System\xMQpikI.exe
  2⤵
  PID:1652
- C:\Windows\System\QyaZXCZ.exe
  C:\Windows\System\QyaZXCZ.exe
  2⤵
  PID:2544
- C:\Windows\System\fbyPrMk.exe
  C:\Windows\System\fbyPrMk.exe
  2⤵
  PID:3060
- C:\Windows\System\ohZMtDm.exe
  C:\Windows\System\ohZMtDm.exe
  2⤵
  PID:2200
- C:\Windows\System\ysqyrtv.exe
  C:\Windows\System\ysqyrtv.exe
  2⤵
  PID:2880
- C:\Windows\System\wMvNUEp.exe
  C:\Windows\System\wMvNUEp.exe
  2⤵
  PID:484
- C:\Windows\System\kxIwfvk.exe
  C:\Windows\System\kxIwfvk.exe
  2⤵
  PID:664
- C:\Windows\System\vWqoHPm.exe
  C:\Windows\System\vWqoHPm.exe
  2⤵
  PID:1612
- C:\Windows\System\SkrssVD.exe
  C:\Windows\System\SkrssVD.exe
  2⤵
  PID:448
- C:\Windows\System\AhzxzoU.exe
  C:\Windows\System\AhzxzoU.exe
  2⤵
  PID:708
- C:\Windows\System\OChhhDA.exe
  C:\Windows\System\OChhhDA.exe
  2⤵
  PID:2376
- C:\Windows\System\erZbcSO.exe
  C:\Windows\System\erZbcSO.exe
  2⤵
  PID:2024
- C:\Windows\System\lDouZXj.exe
  C:\Windows\System\lDouZXj.exe
  2⤵
  PID:556
- C:\Windows\System\XBmEkGq.exe
  C:\Windows\System\XBmEkGq.exe
  2⤵
  PID:2192
- C:\Windows\System\EBmGoOg.exe
  C:\Windows\System\EBmGoOg.exe
  2⤵
  PID:2788
- C:\Windows\System\IcMJOGY.exe
  C:\Windows\System\IcMJOGY.exe
  2⤵
  PID:2648
- C:\Windows\System\uIdpQsC.exe
  C:\Windows\System\uIdpQsC.exe
  2⤵
  PID:2448
- C:\Windows\System\IBdjrGG.exe
  C:\Windows\System\IBdjrGG.exe
  2⤵
  PID:2844
- C:\Windows\System\uEwwMWJ.exe
  C:\Windows\System\uEwwMWJ.exe
  2⤵
  PID:2620
- C:\Windows\System\qIYaujn.exe
  C:\Windows\System\qIYaujn.exe
  2⤵
  PID:2692
- C:\Windows\System\OvMjItF.exe
  C:\Windows\System\OvMjItF.exe
  2⤵
  PID:2600
- C:\Windows\System\mgxpirg.exe
  C:\Windows\System\mgxpirg.exe
  2⤵
  PID:1060
- C:\Windows\System\sGxsCdl.exe
  C:\Windows\System\sGxsCdl.exe
  2⤵
  PID:2512
- C:\Windows\System\psfZbOr.exe
  C:\Windows\System\psfZbOr.exe
  2⤵
  PID:2744
- C:\Windows\System\raRmAPP.exe
  C:\Windows\System\raRmAPP.exe
  2⤵
  PID:2304
- C:\Windows\System\zrbyuuW.exe
  C:\Windows\System\zrbyuuW.exe
  2⤵
  PID:2380
- C:\Windows\System\IifqYYO.exe
  C:\Windows\System\IifqYYO.exe
  2⤵
  PID:2652
- C:\Windows\System\fnHzdCW.exe
  C:\Windows\System\fnHzdCW.exe
  2⤵
  PID:2252
- C:\Windows\System\RBIempZ.exe
  C:\Windows\System\RBIempZ.exe
  2⤵
  PID:1688
- C:\Windows\System\hppemwd.exe
  C:\Windows\System\hppemwd.exe
  2⤵
  PID:2516
- C:\Windows\System\fvDZHeF.exe
  C:\Windows\System\fvDZHeF.exe
  2⤵
  PID:536
- C:\Windows\System\iZzLGRT.exe
  C:\Windows\System\iZzLGRT.exe
  2⤵
  PID:2108
- C:\Windows\System\LKbnpRR.exe
  C:\Windows\System\LKbnpRR.exe
  2⤵
  PID:1148
- C:\Windows\System\heYdgtZ.exe
  C:\Windows\System\heYdgtZ.exe
  2⤵
  PID:1416
- C:\Windows\System\ydmnlwz.exe
  C:\Windows\System\ydmnlwz.exe
  2⤵
  PID:1116
- C:\Windows\System\KxkqUFx.exe
  C:\Windows\System\KxkqUFx.exe
  2⤵
  PID:2388
- C:\Windows\System\Tipecop.exe
  C:\Windows\System\Tipecop.exe
  2⤵
  PID:2936
- C:\Windows\System\SsYqcOV.exe
  C:\Windows\System\SsYqcOV.exe
  2⤵
  PID:1456
- C:\Windows\System\JIBDKEr.exe
  C:\Windows\System\JIBDKEr.exe
  2⤵
  PID:328
- C:\Windows\System\cSxmIAU.exe
  C:\Windows\System\cSxmIAU.exe
  2⤵
  PID:2332
- C:\Windows\System\hgoyNRX.exe
  C:\Windows\System\hgoyNRX.exe
  2⤵
  PID:3020
- C:\Windows\System\FNvoBWW.exe
  C:\Windows\System\FNvoBWW.exe
  2⤵
  PID:3032
- C:\Windows\System\LEeBNUe.exe
  C:\Windows\System\LEeBNUe.exe
  2⤵
  PID:2828
- C:\Windows\System\mRTCxVr.exe
  C:\Windows\System\mRTCxVr.exe
  2⤵
  PID:2636
- C:\Windows\System\SrPWjJN.exe
  C:\Windows\System\SrPWjJN.exe
  2⤵
  PID:2660
- C:\Windows\System\xeojcTd.exe
  C:\Windows\System\xeojcTd.exe
  2⤵
  PID:1032
- C:\Windows\System\QuKZJBV.exe
  C:\Windows\System\QuKZJBV.exe
  2⤵
  PID:1948
- C:\Windows\System\NZGMcpc.exe
  C:\Windows\System\NZGMcpc.exe
  2⤵
  PID:1048
- C:\Windows\System\OxwnWmm.exe
  C:\Windows\System\OxwnWmm.exe
  2⤵
  PID:1180
- C:\Windows\System\MMCNfPs.exe
  C:\Windows\System\MMCNfPs.exe
  2⤵
  PID:3068
- C:\Windows\System\IBAYGAR.exe
  C:\Windows\System\IBAYGAR.exe
  2⤵
  PID:1264
- C:\Windows\System\IeoMdbY.exe
  C:\Windows\System\IeoMdbY.exe
  2⤵
  PID:3084
- C:\Windows\System\iTpRNDB.exe
  C:\Windows\System\iTpRNDB.exe
  2⤵
  PID:3100
- C:\Windows\System\pRwxUmy.exe
  C:\Windows\System\pRwxUmy.exe
  2⤵
  PID:3116
- C:\Windows\System\FwyKtGk.exe
  C:\Windows\System\FwyKtGk.exe
  2⤵
  PID:3132
- C:\Windows\System\mVKAohA.exe
  C:\Windows\System\mVKAohA.exe
  2⤵
  PID:3148
- C:\Windows\System\PhAlXCx.exe
  C:\Windows\System\PhAlXCx.exe
  2⤵
  PID:3164
- C:\Windows\System\oKwLODz.exe
  C:\Windows\System\oKwLODz.exe
  2⤵
  PID:3180
- C:\Windows\System\TTAGSUw.exe
  C:\Windows\System\TTAGSUw.exe
  2⤵
  PID:3196
- C:\Windows\System\ETkdMzJ.exe
  C:\Windows\System\ETkdMzJ.exe
  2⤵
  PID:3212
- C:\Windows\System\WjnXBQa.exe
  C:\Windows\System\WjnXBQa.exe
  2⤵
  PID:3228
- C:\Windows\System\EKbzdZf.exe
  C:\Windows\System\EKbzdZf.exe
  2⤵
  PID:3244
- C:\Windows\System\cGULucu.exe
  C:\Windows\System\cGULucu.exe
  2⤵
  PID:3260
- C:\Windows\System\iiwVVMO.exe
  C:\Windows\System\iiwVVMO.exe
  2⤵
  PID:3276
- C:\Windows\System\PToXcky.exe
  C:\Windows\System\PToXcky.exe
  2⤵
  PID:3292
- C:\Windows\System\IgbWwNA.exe
  C:\Windows\System\IgbWwNA.exe
  2⤵
  PID:3308
- C:\Windows\System\BNxVZJM.exe
  C:\Windows\System\BNxVZJM.exe
  2⤵
  PID:3324
- C:\Windows\System\KQweTDt.exe
  C:\Windows\System\KQweTDt.exe
  2⤵
  PID:3340
- C:\Windows\System\YrXJmPV.exe
  C:\Windows\System\YrXJmPV.exe
  2⤵
  PID:3356
- C:\Windows\System\eskHtwS.exe
  C:\Windows\System\eskHtwS.exe
  2⤵
  PID:3384
- C:\Windows\System\CQLacqS.exe
  C:\Windows\System\CQLacqS.exe
  2⤵
  PID:3400
- C:\Windows\System\bQLedUe.exe
  C:\Windows\System\bQLedUe.exe
  2⤵
  PID:3416
- C:\Windows\System\tFkSMvi.exe
  C:\Windows\System\tFkSMvi.exe
  2⤵
  PID:3432
- C:\Windows\System\fbWTQbM.exe
  C:\Windows\System\fbWTQbM.exe
  2⤵
  PID:3448
- C:\Windows\System\pIcTAsf.exe
  C:\Windows\System\pIcTAsf.exe
  2⤵
  PID:3468
- C:\Windows\System\bGKyefr.exe
  C:\Windows\System\bGKyefr.exe
  2⤵
  PID:3484
- C:\Windows\System\RlRubxv.exe
  C:\Windows\System\RlRubxv.exe
  2⤵
  PID:3500
- C:\Windows\System\mUTDiBO.exe
  C:\Windows\System\mUTDiBO.exe
  2⤵
  PID:3516
- C:\Windows\System\qMUKmyf.exe
  C:\Windows\System\qMUKmyf.exe
  2⤵
  PID:3532
- C:\Windows\System\yTFPWSs.exe
  C:\Windows\System\yTFPWSs.exe
  2⤵
  PID:3548
- C:\Windows\System\wiRwcmH.exe
  C:\Windows\System\wiRwcmH.exe
  2⤵
  PID:3568
- C:\Windows\System\edNqMnn.exe
  C:\Windows\System\edNqMnn.exe
  2⤵
  PID:3584
- C:\Windows\System\JgHLAad.exe
  C:\Windows\System\JgHLAad.exe
  2⤵
  PID:3600
- C:\Windows\System\NpbOHKe.exe
  C:\Windows\System\NpbOHKe.exe
  2⤵
  PID:3620
- C:\Windows\System\yzDzBWw.exe
  C:\Windows\System\yzDzBWw.exe
  2⤵
  PID:3636
- C:\Windows\System\ctdDRNz.exe
  C:\Windows\System\ctdDRNz.exe
  2⤵
  PID:3652
- C:\Windows\System\UyXDDno.exe
  C:\Windows\System\UyXDDno.exe
  2⤵
  PID:3900
- C:\Windows\System\rquXgZg.exe
  C:\Windows\System\rquXgZg.exe
  2⤵
  PID:3924
- C:\Windows\System\EvNwZuT.exe
  C:\Windows\System\EvNwZuT.exe
  2⤵
  PID:3944
- C:\Windows\System\NodjpAj.exe
  C:\Windows\System\NodjpAj.exe
  2⤵
  PID:3960
- C:\Windows\System\MnjuCFy.exe
  C:\Windows\System\MnjuCFy.exe
  2⤵
  PID:3980
- C:\Windows\System\EgcuFlp.exe
  C:\Windows\System\EgcuFlp.exe
  2⤵
  PID:3996
- C:\Windows\System\CYVSoox.exe
  C:\Windows\System\CYVSoox.exe
  2⤵
  PID:4012
- C:\Windows\System\oCHHTOJ.exe
  C:\Windows\System\oCHHTOJ.exe
  2⤵
  PID:4028
- C:\Windows\System\UBocrdC.exe
  C:\Windows\System\UBocrdC.exe
  2⤵
  PID:4048
- C:\Windows\System\QJhQhiS.exe
  C:\Windows\System\QJhQhiS.exe
  2⤵
  PID:4064
- C:\Windows\System\SXtZpTi.exe
  C:\Windows\System\SXtZpTi.exe
  2⤵
  PID:4080
- C:\Windows\System\AnorsDU.exe
  C:\Windows\System\AnorsDU.exe
  2⤵
  PID:1836
- C:\Windows\System\sucXekv.exe
  C:\Windows\System\sucXekv.exe
  2⤵
  PID:1892
- C:\Windows\System\QTixiRV.exe
  C:\Windows\System\QTixiRV.exe
  2⤵
  PID:1520
- C:\Windows\System\kulRftC.exe
  C:\Windows\System\kulRftC.exe
  2⤵
  PID:2764
- C:\Windows\System\BVmHLkY.exe
  C:\Windows\System\BVmHLkY.exe
  2⤵
  PID:1632
- C:\Windows\System\hATpJSB.exe
  C:\Windows\System\hATpJSB.exe
  2⤵
  PID:3124
- C:\Windows\System\tzXrrSC.exe
  C:\Windows\System\tzXrrSC.exe
  2⤵
  PID:3188
- C:\Windows\System\fzZqhff.exe
  C:\Windows\System\fzZqhff.exe
  2⤵
  PID:3252
- C:\Windows\System\MTmcUST.exe
  C:\Windows\System\MTmcUST.exe
  2⤵
  PID:3320
- C:\Windows\System\jXuCKPU.exe
  C:\Windows\System\jXuCKPU.exe
  2⤵
  PID:3396
- C:\Windows\System\IaaHJUT.exe
  C:\Windows\System\IaaHJUT.exe
  2⤵
  PID:3460
- C:\Windows\System\ahcIDML.exe
  C:\Windows\System\ahcIDML.exe
  2⤵
  PID:3524
- C:\Windows\System\anFbbxW.exe
  C:\Windows\System\anFbbxW.exe
  2⤵
  PID:3564
- C:\Windows\System\GxwgPqu.exe
  C:\Windows\System\GxwgPqu.exe
  2⤵
  PID:3660
- C:\Windows\System\dflvkMr.exe
  C:\Windows\System\dflvkMr.exe
  2⤵
  PID:3676
- C:\Windows\System\MDZZoiV.exe
  C:\Windows\System\MDZZoiV.exe
  2⤵
  PID:3680
- C:\Windows\System\MiMwLHP.exe
  C:\Windows\System\MiMwLHP.exe
  2⤵
  PID:3696
- C:\Windows\System\rPfpfYZ.exe
  C:\Windows\System\rPfpfYZ.exe
  2⤵
  PID:3716
- C:\Windows\System\ymHxaCP.exe
  C:\Windows\System\ymHxaCP.exe
  2⤵
  PID:3736
- C:\Windows\System\sBDdEaL.exe
  C:\Windows\System\sBDdEaL.exe
  2⤵
  PID:3752
- C:\Windows\System\wIGylaY.exe
  C:\Windows\System\wIGylaY.exe
  2⤵
  PID:1588
- C:\Windows\System\PTzeuna.exe
  C:\Windows\System\PTzeuna.exe
  2⤵
  PID:2228
- C:\Windows\System\vLlNSMm.exe
  C:\Windows\System\vLlNSMm.exe
  2⤵
  PID:3772
- C:\Windows\System\nRshcld.exe
  C:\Windows\System\nRshcld.exe
  2⤵
  PID:3792
- C:\Windows\System\yHeeiOm.exe
  C:\Windows\System\yHeeiOm.exe
  2⤵
  PID:3808
- C:\Windows\System\cYStfDu.exe
  C:\Windows\System\cYStfDu.exe
  2⤵
  PID:3824
- C:\Windows\System\eVXvygP.exe
  C:\Windows\System\eVXvygP.exe
  2⤵
  PID:3840
- C:\Windows\System\zWdhgRD.exe
  C:\Windows\System\zWdhgRD.exe
  2⤵
  PID:1596
- C:\Windows\System\OKkxizY.exe
  C:\Windows\System\OKkxizY.exe
  2⤵
  PID:2532
- C:\Windows\System\xQNEisx.exe
  C:\Windows\System\xQNEisx.exe
  2⤵
  PID:1984
- C:\Windows\System\GzcTLXQ.exe
  C:\Windows\System\GzcTLXQ.exe
  2⤵
  PID:3080
- C:\Windows\System\LtjYxYF.exe
  C:\Windows\System\LtjYxYF.exe
  2⤵
  PID:3144
- C:\Windows\System\USesXKj.exe
  C:\Windows\System\USesXKj.exe
  2⤵
  PID:3208
- C:\Windows\System\ikSJiWN.exe
  C:\Windows\System\ikSJiWN.exe
  2⤵
  PID:3272
- C:\Windows\System\LVmHFna.exe
  C:\Windows\System\LVmHFna.exe
  2⤵
  PID:3376
- C:\Windows\System\PwxgYeW.exe
  C:\Windows\System\PwxgYeW.exe
  2⤵
  PID:3444
- C:\Windows\System\aKfimwg.exe
  C:\Windows\System\aKfimwg.exe
  2⤵
  PID:3540
- C:\Windows\System\BmklvPn.exe
  C:\Windows\System\BmklvPn.exe
  2⤵
  PID:3612
- C:\Windows\System\oYatpvy.exe
  C:\Windows\System\oYatpvy.exe
  2⤵
  PID:2960
- C:\Windows\System\SLIzMER.exe
  C:\Windows\System\SLIzMER.exe
  2⤵
  PID:3220
- C:\Windows\System\uVlbDsn.exe
  C:\Windows\System\uVlbDsn.exe
  2⤵
  PID:3496
- C:\Windows\System\NLKTztI.exe
  C:\Windows\System\NLKTztI.exe
  2⤵
  PID:4024
- C:\Windows\System\uMrHPAu.exe
  C:\Windows\System\uMrHPAu.exe
  2⤵
  PID:2468
- C:\Windows\System\ZfqvTRD.exe
  C:\Windows\System\ZfqvTRD.exe
  2⤵
  PID:3724
- C:\Windows\System\WwnhVbs.exe
  C:\Windows\System\WwnhVbs.exe
  2⤵
  PID:1804
- C:\Windows\System\wHuPOUV.exe
  C:\Windows\System\wHuPOUV.exe
  2⤵
  PID:2540
- C:\Windows\System\BbfrFQf.exe
  C:\Windows\System\BbfrFQf.exe
  2⤵
  PID:3820
- C:\Windows\System\rRolUAc.exe
  C:\Windows\System\rRolUAc.exe
  2⤵
  PID:1448
- C:\Windows\System\lpDRUKO.exe
  C:\Windows\System\lpDRUKO.exe
  2⤵
  PID:3268
- C:\Windows\System\SCtKFFF.exe
  C:\Windows\System\SCtKFFF.exe
  2⤵
  PID:572
- C:\Windows\System\OVWtotG.exe
  C:\Windows\System\OVWtotG.exe
  2⤵
  PID:3284
- C:\Windows\System\DDgXbgm.exe
  C:\Windows\System\DDgXbgm.exe
  2⤵
  PID:3456
- C:\Windows\System\cQwjsOv.exe
  C:\Windows\System\cQwjsOv.exe
  2⤵
  PID:3076
- C:\Windows\System\pOmreGi.exe
  C:\Windows\System\pOmreGi.exe
  2⤵
  PID:3332
- C:\Windows\System\grNGPlH.exe
  C:\Windows\System\grNGPlH.exe
  2⤵
  PID:3372
- C:\Windows\System\QOsRisw.exe
  C:\Windows\System\QOsRisw.exe
  2⤵
  PID:2604
- C:\Windows\System\TxsEJsU.exe
  C:\Windows\System\TxsEJsU.exe
  2⤵
  PID:3440
- C:\Windows\System\HOrVFCP.exe
  C:\Windows\System\HOrVFCP.exe
  2⤵
  PID:3576
- C:\Windows\System\zPloFky.exe
  C:\Windows\System\zPloFky.exe
  2⤵
  PID:3892
- C:\Windows\System\LjIoMeR.exe
  C:\Windows\System\LjIoMeR.exe
  2⤵
  PID:1544
- C:\Windows\System\mVAKhvq.exe
  C:\Windows\System\mVAKhvq.exe
  2⤵
  PID:3920
- C:\Windows\System\iPCDkXe.exe
  C:\Windows\System\iPCDkXe.exe
  2⤵
  PID:1616
- C:\Windows\System\TArjXkA.exe
  C:\Windows\System\TArjXkA.exe
  2⤵
  PID:3972
- C:\Windows\System\HZhJRhX.exe
  C:\Windows\System\HZhJRhX.exe
  2⤵
  PID:4044
- C:\Windows\System\WKuRuWq.exe
  C:\Windows\System\WKuRuWq.exe
  2⤵
  PID:2044
- C:\Windows\System\QIlhExF.exe
  C:\Windows\System\QIlhExF.exe
  2⤵
  PID:3632
- C:\Windows\System\PLDbElD.exe
  C:\Windows\System\PLDbElD.exe
  2⤵
  PID:3352
- C:\Windows\System\YuJxojj.exe
  C:\Windows\System\YuJxojj.exe
  2⤵
  PID:3628
- C:\Windows\System\ajjGyFR.exe
  C:\Windows\System\ajjGyFR.exe
  2⤵
  PID:3648
- C:\Windows\System\acvFLxy.exe
  C:\Windows\System\acvFLxy.exe
  2⤵
  PID:2172
- C:\Windows\System\hLOUAab.exe
  C:\Windows\System\hLOUAab.exe
  2⤵
  PID:1524
- C:\Windows\System\IhsRpAP.exe
  C:\Windows\System\IhsRpAP.exe
  2⤵
  PID:2488
- C:\Windows\System\rZDiUvr.exe
  C:\Windows\System\rZDiUvr.exe
  2⤵
  PID:3204
- C:\Windows\System\lzOprSk.exe
  C:\Windows\System\lzOprSk.exe
  2⤵
  PID:3156
- C:\Windows\System\UEYrBGo.exe
  C:\Windows\System\UEYrBGo.exe
  2⤵
  PID:3688
- C:\Windows\System\pfeglYc.exe
  C:\Windows\System\pfeglYc.exe
  2⤵
  PID:3760
- C:\Windows\System\SCpbdXo.exe
  C:\Windows\System\SCpbdXo.exe
  2⤵
  PID:3800
- C:\Windows\System\sALgUEC.exe
  C:\Windows\System\sALgUEC.exe
  2⤵
  PID:908
- C:\Windows\System\Wsivqpa.exe
  C:\Windows\System\Wsivqpa.exe
  2⤵
  PID:3908
- C:\Windows\System\JjdNZOB.exe
  C:\Windows\System\JjdNZOB.exe
  2⤵
  PID:4076
- C:\Windows\System\QTovqBG.exe
  C:\Windows\System\QTovqBG.exe
  2⤵
  PID:3428
- C:\Windows\System\TsVBfju.exe
  C:\Windows\System\TsVBfju.exe
  2⤵
  PID:3836
- C:\Windows\System\GsZVoFf.exe
  C:\Windows\System\GsZVoFf.exe
  2⤵
  PID:2908
- C:\Windows\System\HKCCSbQ.exe
  C:\Windows\System\HKCCSbQ.exe
  2⤵
  PID:1040
- C:\Windows\System\EzfaKVS.exe
  C:\Windows\System\EzfaKVS.exe
  2⤵
  PID:3672
- C:\Windows\System\ShJeolY.exe
  C:\Windows\System\ShJeolY.exe
  2⤵
  PID:3412
- C:\Windows\System\NcuKnaX.exe
  C:\Windows\System\NcuKnaX.exe
  2⤵
  PID:2000
- C:\Windows\System\mjaLZLz.exe
  C:\Windows\System\mjaLZLz.exe
  2⤵
  PID:1704
- C:\Windows\System\MTimIvg.exe
  C:\Windows\System\MTimIvg.exe
  2⤵
  PID:3748
- C:\Windows\System\kkLMUaC.exe
  C:\Windows\System\kkLMUaC.exe
  2⤵
  PID:3364
- C:\Windows\System\OJdIQxG.exe
  C:\Windows\System\OJdIQxG.exe
  2⤵
  PID:3140
- C:\Windows\System\bVMFZTg.exe
  C:\Windows\System\bVMFZTg.exe
  2⤵
  PID:2060
- C:\Windows\System\DvZGMIF.exe
  C:\Windows\System\DvZGMIF.exe
  2⤵
  PID:3768
- C:\Windows\System\qmMlJaG.exe
  C:\Windows\System\qmMlJaG.exe
  2⤵
  PID:3240
- C:\Windows\System\DIWREkt.exe
  C:\Windows\System\DIWREkt.exe
  2⤵
  PID:3728
- C:\Windows\System\RMRfDYV.exe
  C:\Windows\System\RMRfDYV.exe
  2⤵
  PID:4036
- C:\Windows\System\QXquBAc.exe
  C:\Windows\System\QXquBAc.exe
  2⤵
  PID:4020
- C:\Windows\System\RdTVQCA.exe
  C:\Windows\System\RdTVQCA.exe
  2⤵
  PID:3732
- C:\Windows\System\JwfinDE.exe
  C:\Windows\System\JwfinDE.exe
  2⤵
  PID:3512
- C:\Windows\System\laxUBnW.exe
  C:\Windows\System\laxUBnW.exe
  2⤵
  PID:3316
- C:\Windows\System\ZZOlPzL.exe
  C:\Windows\System\ZZOlPzL.exe
  2⤵
  PID:4008
- C:\Windows\System\DQiYcFA.exe
  C:\Windows\System\DQiYcFA.exe
  2⤵
  PID:3956
- C:\Windows\System\VktAPXB.exe
  C:\Windows\System\VktAPXB.exe
  2⤵
  PID:1824
- C:\Windows\System\FvArwJK.exe
  C:\Windows\System\FvArwJK.exe
  2⤵
  PID:4112
- C:\Windows\System\BiGelSI.exe
  C:\Windows\System\BiGelSI.exe
  2⤵
  PID:4128
- C:\Windows\System\EwjyeJK.exe
  C:\Windows\System\EwjyeJK.exe
  2⤵
  PID:4144
- C:\Windows\System\fDOWGIZ.exe
  C:\Windows\System\fDOWGIZ.exe
  2⤵
  PID:4164
- C:\Windows\System\sxFZayu.exe
  C:\Windows\System\sxFZayu.exe
  2⤵
  PID:4208
- C:\Windows\System\RVeVAVH.exe
  C:\Windows\System\RVeVAVH.exe
  2⤵
  PID:4224
- C:\Windows\System\uaqpwDX.exe
  C:\Windows\System\uaqpwDX.exe
  2⤵
  PID:4240
- C:\Windows\System\rSTrSzx.exe
  C:\Windows\System\rSTrSzx.exe
  2⤵
  PID:4256
- C:\Windows\System\tZFFgCf.exe
  C:\Windows\System\tZFFgCf.exe
  2⤵
  PID:4272
- C:\Windows\System\zlpEiTA.exe
  C:\Windows\System\zlpEiTA.exe
  2⤵
  PID:4292
- C:\Windows\System\dlLfydv.exe
  C:\Windows\System\dlLfydv.exe
  2⤵
  PID:4308
- C:\Windows\System\FSwmtbf.exe
  C:\Windows\System\FSwmtbf.exe
  2⤵
  PID:4328
- C:\Windows\System\sSZIcLb.exe
  C:\Windows\System\sSZIcLb.exe
  2⤵
  PID:4344
- C:\Windows\System\mxPbkXg.exe
  C:\Windows\System\mxPbkXg.exe
  2⤵
  PID:4388
- C:\Windows\System\BGKowHX.exe
  C:\Windows\System\BGKowHX.exe
  2⤵
  PID:4404
- C:\Windows\System\eYKyBLS.exe
  C:\Windows\System\eYKyBLS.exe
  2⤵
  PID:4420
- C:\Windows\System\uyOQbSG.exe
  C:\Windows\System\uyOQbSG.exe
  2⤵
  PID:4436
- C:\Windows\System\BZgOgik.exe
  C:\Windows\System\BZgOgik.exe
  2⤵
  PID:4452
- C:\Windows\System\bKaGwjm.exe
  C:\Windows\System\bKaGwjm.exe
  2⤵
  PID:4472
- C:\Windows\System\vDcEJuQ.exe
  C:\Windows\System\vDcEJuQ.exe
  2⤵
  PID:4488
- C:\Windows\System\IKMxmhD.exe
  C:\Windows\System\IKMxmhD.exe
  2⤵
  PID:4504
- C:\Windows\System\BFMNvYw.exe
  C:\Windows\System\BFMNvYw.exe
  2⤵
  PID:4520
- C:\Windows\System\bEBXclO.exe
  C:\Windows\System\bEBXclO.exe
  2⤵
  PID:4536
- C:\Windows\System\xPHyeEJ.exe
  C:\Windows\System\xPHyeEJ.exe
  2⤵
  PID:4552
- C:\Windows\System\jhhzlei.exe
  C:\Windows\System\jhhzlei.exe
  2⤵
  PID:4568
- C:\Windows\System\EVsQTvH.exe
  C:\Windows\System\EVsQTvH.exe
  2⤵
  PID:4588
- C:\Windows\System\FbRVGFJ.exe
  C:\Windows\System\FbRVGFJ.exe
  2⤵
  PID:4640
- C:\Windows\System\xwUISMR.exe
  C:\Windows\System\xwUISMR.exe
  2⤵
  PID:4664
- C:\Windows\System\NZPJjrz.exe
  C:\Windows\System\NZPJjrz.exe
  2⤵
  PID:4684
- C:\Windows\System\ybkwFuy.exe
  C:\Windows\System\ybkwFuy.exe
  2⤵
  PID:4708
- C:\Windows\System\mwvAnyC.exe
  C:\Windows\System\mwvAnyC.exe
  2⤵
  PID:4724
- C:\Windows\System\ybiurXE.exe
  C:\Windows\System\ybiurXE.exe
  2⤵
  PID:4740
- C:\Windows\System\OLbGtME.exe
  C:\Windows\System\OLbGtME.exe
  2⤵
  PID:4756
- C:\Windows\System\quMQKPW.exe
  C:\Windows\System\quMQKPW.exe
  2⤵
  PID:4772
- C:\Windows\System\BQQkkcE.exe
  C:\Windows\System\BQQkkcE.exe
  2⤵
  PID:4788
- C:\Windows\System\iUBuxUC.exe
  C:\Windows\System\iUBuxUC.exe
  2⤵
  PID:4808
- C:\Windows\System\OtOPQjE.exe
  C:\Windows\System\OtOPQjE.exe
  2⤵
  PID:4828
- C:\Windows\System\cKgFsFM.exe
  C:\Windows\System\cKgFsFM.exe
  2⤵
  PID:4844
- C:\Windows\System\nqwUkoh.exe
  C:\Windows\System\nqwUkoh.exe
  2⤵
  PID:4860
- C:\Windows\System\KdJXunD.exe
  C:\Windows\System\KdJXunD.exe
  2⤵
  PID:4876
- C:\Windows\System\LQlhbyO.exe
  C:\Windows\System\LQlhbyO.exe
  2⤵
  PID:4912
- C:\Windows\System\ZFVnLoM.exe
  C:\Windows\System\ZFVnLoM.exe
  2⤵
  PID:4928
- C:\Windows\System\lyenwah.exe
  C:\Windows\System\lyenwah.exe
  2⤵
  PID:4976
- C:\Windows\System\MELXBLB.exe
  C:\Windows\System\MELXBLB.exe
  2⤵
  PID:5004
- C:\Windows\System\SzqjZJR.exe
  C:\Windows\System\SzqjZJR.exe
  2⤵
  PID:5020
- C:\Windows\System\DxLBYgy.exe
  C:\Windows\System\DxLBYgy.exe
  2⤵
  PID:5036
- C:\Windows\System\oOzPxgp.exe
  C:\Windows\System\oOzPxgp.exe
  2⤵
  PID:5060
- C:\Windows\System\LxXkmkY.exe
  C:\Windows\System\LxXkmkY.exe
  2⤵
  PID:5080
- C:\Windows\System\DukMSgp.exe
  C:\Windows\System\DukMSgp.exe
  2⤵
  PID:5096
- C:\Windows\System\mjLWceK.exe
  C:\Windows\System\mjLWceK.exe
  2⤵
  PID:5112
- C:\Windows\System\NFfkxUX.exe
  C:\Windows\System\NFfkxUX.exe
  2⤵
  PID:4104
- C:\Windows\System\vKiraJr.exe
  C:\Windows\System\vKiraJr.exe
  2⤵
  PID:4152
- C:\Windows\System\tnxphnk.exe
  C:\Windows\System\tnxphnk.exe
  2⤵
  PID:2656
- C:\Windows\System\xuMqeAI.exe
  C:\Windows\System\xuMqeAI.exe
  2⤵
  PID:4184
- C:\Windows\System\onfUlxD.exe
  C:\Windows\System\onfUlxD.exe
  2⤵
  PID:4204
- C:\Windows\System\HdsRrXy.exe
  C:\Windows\System\HdsRrXy.exe
  2⤵
  PID:4236
- C:\Windows\System\ZtixBDT.exe
  C:\Windows\System\ZtixBDT.exe
  2⤵
  PID:4336
- C:\Windows\System\hNwtUUt.exe
  C:\Windows\System\hNwtUUt.exe
  2⤵
  PID:4280
- C:\Windows\System\ifzzymo.exe
  C:\Windows\System\ifzzymo.exe
  2⤵
  PID:4324
- C:\Windows\System\ywnZpue.exe
  C:\Windows\System\ywnZpue.exe
  2⤵
  PID:4364
- C:\Windows\System\UnFYXCt.exe
  C:\Windows\System\UnFYXCt.exe
  2⤵
  PID:4372
- C:\Windows\System\VGMidiz.exe
  C:\Windows\System\VGMidiz.exe
  2⤵
  PID:4396
- C:\Windows\System\mpRRTJf.exe
  C:\Windows\System\mpRRTJf.exe
  2⤵
  PID:4400
- C:\Windows\System\WsWsnhT.exe
  C:\Windows\System\WsWsnhT.exe
  2⤵
  PID:4528
- C:\Windows\System\yRKBMOU.exe
  C:\Windows\System\yRKBMOU.exe
  2⤵
  PID:4548
- C:\Windows\System\xLIHYSR.exe
  C:\Windows\System\xLIHYSR.exe
  2⤵
  PID:4544
- C:\Windows\System\FvXnVex.exe
  C:\Windows\System\FvXnVex.exe
  2⤵
  PID:4632
- C:\Windows\System\CXVccke.exe
  C:\Windows\System\CXVccke.exe
  2⤵
  PID:4656
- C:\Windows\System\ZqdrzCj.exe
  C:\Windows\System\ZqdrzCj.exe
  2⤵
  PID:4680
- C:\Windows\System\ipRAbPj.exe
  C:\Windows\System\ipRAbPj.exe
  2⤵
  PID:4700
- C:\Windows\System\VorAgcU.exe
  C:\Windows\System\VorAgcU.exe
  2⤵
  PID:4784
- C:\Windows\System\agIrFce.exe
  C:\Windows\System\agIrFce.exe
  2⤵
  PID:4856
- C:\Windows\System\VvucAjm.exe
  C:\Windows\System\VvucAjm.exe
  2⤵
  PID:4804
- C:\Windows\System\FsQcilu.exe
  C:\Windows\System\FsQcilu.exe
  2⤵
  PID:4780
- C:\Windows\System\PGoWjDC.exe
  C:\Windows\System\PGoWjDC.exe
  2⤵
  PID:4884
- C:\Windows\System\WcltXpB.exe
  C:\Windows\System\WcltXpB.exe
  2⤵
  PID:4908
- C:\Windows\System\UhcyjUz.exe
  C:\Windows\System\UhcyjUz.exe
  2⤵
  PID:4732
- C:\Windows\System\qbEYnwr.exe
  C:\Windows\System\qbEYnwr.exe
  2⤵
  PID:4936
- C:\Windows\System\KxMxMFw.exe
  C:\Windows\System\KxMxMFw.exe
  2⤵
  PID:4948
- C:\Windows\System\YlgSNyE.exe
  C:\Windows\System\YlgSNyE.exe
  2⤵
  PID:4968
- C:\Windows\System\Rdfqpjl.exe
  C:\Windows\System\Rdfqpjl.exe
  2⤵
  PID:4992
- C:\Windows\System\HVyBtlK.exe
  C:\Windows\System\HVyBtlK.exe
  2⤵
  PID:5028
- C:\Windows\System\CAjaPrF.exe
  C:\Windows\System\CAjaPrF.exe
  2⤵
  PID:5048
- C:\Windows\System\qRrOxIP.exe
  C:\Windows\System\qRrOxIP.exe
  2⤵
  PID:5088
- C:\Windows\System\pYpEixx.exe
  C:\Windows\System\pYpEixx.exe
  2⤵
  PID:4320
- C:\Windows\System\DznxpsY.exe
  C:\Windows\System\DznxpsY.exe
  2⤵
  PID:4180
- C:\Windows\System\dZCgZqw.exe
  C:\Windows\System\dZCgZqw.exe
  2⤵
  PID:4220
- C:\Windows\System\IuUpcOB.exe
  C:\Windows\System\IuUpcOB.exe
  2⤵
  PID:4444
- C:\Windows\System\IzMsNvO.exe
  C:\Windows\System\IzMsNvO.exe
  2⤵
  PID:4516
- C:\Windows\System\nwQPRyP.exe
  C:\Windows\System\nwQPRyP.exe
  2⤵
  PID:4380
- C:\Windows\System\OVlUUNN.exe
  C:\Windows\System\OVlUUNN.exe
  2⤵
  PID:4496
- C:\Windows\System\BDgfNjg.exe
  C:\Windows\System\BDgfNjg.exe
  2⤵
  PID:4512
- C:\Windows\System\aoyhsJV.exe
  C:\Windows\System\aoyhsJV.exe
  2⤵
  PID:4288
- C:\Windows\System\vBfsZfh.exe
  C:\Windows\System\vBfsZfh.exe
  2⤵
  PID:4628
- C:\Windows\System\vzlliBx.exe
  C:\Windows\System\vzlliBx.exe
  2⤵
  PID:4720
- C:\Windows\System\XvAkAOU.exe
  C:\Windows\System\XvAkAOU.exe
  2⤵
  PID:4840
- C:\Windows\System\yEValNe.exe
  C:\Windows\System\yEValNe.exe
  2⤵
  PID:4944
- C:\Windows\System\dyrSHXh.exe
  C:\Windows\System\dyrSHXh.exe
  2⤵
  PID:5052
- C:\Windows\System\foKMZaG.exe
  C:\Windows\System\foKMZaG.exe
  2⤵
  PID:5104
- C:\Windows\System\Txeolml.exe
  C:\Windows\System\Txeolml.exe
  2⤵
  PID:4140
- C:\Windows\System\qGioSzE.exe
  C:\Windows\System\qGioSzE.exe
  2⤵
  PID:4736
- C:\Windows\System\sZuVDSE.exe
  C:\Windows\System\sZuVDSE.exe
  2⤵
  PID:4920
- C:\Windows\System\FIlphuH.exe
  C:\Windows\System\FIlphuH.exe
  2⤵
  PID:5068
- C:\Windows\System\jdcrAPc.exe
  C:\Windows\System\jdcrAPc.exe
  2⤵
  PID:4960
- C:\Windows\System\EzLqqlI.exe
  C:\Windows\System\EzLqqlI.exe
  2⤵
  PID:4188
- C:\Windows\System\xBDzaZG.exe
  C:\Windows\System\xBDzaZG.exe
  2⤵
  PID:4316
- C:\Windows\System\uWLIZVQ.exe
  C:\Windows\System\uWLIZVQ.exe
  2⤵
  PID:4480
- C:\Windows\System\EpDMPFM.exe
  C:\Windows\System\EpDMPFM.exe
  2⤵
  PID:4468
- C:\Windows\System\wknNXNw.exe
  C:\Windows\System\wknNXNw.exe
  2⤵
  PID:4768
- C:\Windows\System\ZAmKFHr.exe
  C:\Windows\System\ZAmKFHr.exe
  2⤵
  PID:4696
- C:\Windows\System\TPvdsal.exe
  C:\Windows\System\TPvdsal.exe
  2⤵
  PID:4904
- C:\Windows\System\tGqTyRb.exe
  C:\Windows\System\tGqTyRb.exe
  2⤵
  PID:2856
- C:\Windows\System\qztPoaN.exe
  C:\Windows\System\qztPoaN.exe
  2⤵
  PID:5124
- C:\Windows\System\AaJDyuy.exe
  C:\Windows\System\AaJDyuy.exe
  2⤵
  PID:5140
- C:\Windows\System\lsCkGSs.exe
  C:\Windows\System\lsCkGSs.exe
  2⤵
  PID:5156
- C:\Windows\System\fNKRtoR.exe
  C:\Windows\System\fNKRtoR.exe
  2⤵
  PID:5172
- C:\Windows\System\StaCysk.exe
  C:\Windows\System\StaCysk.exe
  2⤵
  PID:5192
- C:\Windows\System\KzHwMcA.exe
  C:\Windows\System\KzHwMcA.exe
  2⤵
  PID:5208
- C:\Windows\System\VYAvIij.exe
  C:\Windows\System\VYAvIij.exe
  2⤵
  PID:5228
- C:\Windows\System\YNMUjfB.exe
  C:\Windows\System\YNMUjfB.exe
  2⤵
  PID:5244
- C:\Windows\System\jvyBQqJ.exe
  C:\Windows\System\jvyBQqJ.exe
  2⤵
  PID:5260
- C:\Windows\System\KFmdOeV.exe
  C:\Windows\System\KFmdOeV.exe
  2⤵
  PID:5276
- C:\Windows\System\NcyrIOM.exe
  C:\Windows\System\NcyrIOM.exe
  2⤵
  PID:5292
- C:\Windows\System\VNaRUlO.exe
  C:\Windows\System\VNaRUlO.exe
  2⤵
  PID:5308
- C:\Windows\System\HImdXDD.exe
  C:\Windows\System\HImdXDD.exe
  2⤵
  PID:5324
- C:\Windows\System\ExFGqgU.exe
  C:\Windows\System\ExFGqgU.exe
  2⤵
  PID:5340
- C:\Windows\System\NqutsHe.exe
  C:\Windows\System\NqutsHe.exe
  2⤵
  PID:5356
- C:\Windows\System\vMsZVpZ.exe
  C:\Windows\System\vMsZVpZ.exe
  2⤵
  PID:5372
- C:\Windows\System\pgkWpKj.exe
  C:\Windows\System\pgkWpKj.exe
  2⤵
  PID:5388
- C:\Windows\System\gLMzSTJ.exe
  C:\Windows\System\gLMzSTJ.exe
  2⤵
  PID:5404
- C:\Windows\System\ZTiLUxl.exe
  C:\Windows\System\ZTiLUxl.exe
  2⤵
  PID:5420
- C:\Windows\System\oZLlmvA.exe
  C:\Windows\System\oZLlmvA.exe
  2⤵
  PID:5436
- C:\Windows\System\BTdWqjw.exe
  C:\Windows\System\BTdWqjw.exe
  2⤵
  PID:5456
- C:\Windows\System\Kuayukg.exe
  C:\Windows\System\Kuayukg.exe
  2⤵
  PID:5472
- C:\Windows\System\jmVXinL.exe
  C:\Windows\System\jmVXinL.exe
  2⤵
  PID:5488
- C:\Windows\System\ZflgDHa.exe
  C:\Windows\System\ZflgDHa.exe
  2⤵
  PID:5504
- C:\Windows\System\LjLtQor.exe
  C:\Windows\System\LjLtQor.exe
  2⤵
  PID:5520
- C:\Windows\System\cqZpoFv.exe
  C:\Windows\System\cqZpoFv.exe
  2⤵
  PID:5536
- C:\Windows\System\fpTIYaS.exe
  C:\Windows\System\fpTIYaS.exe
  2⤵
  PID:5552
- C:\Windows\System\ecZAovE.exe
  C:\Windows\System\ecZAovE.exe
  2⤵
  PID:5568
- C:\Windows\System\dggQfTy.exe
  C:\Windows\System\dggQfTy.exe
  2⤵
  PID:5584
- C:\Windows\System\grdJSAW.exe
  C:\Windows\System\grdJSAW.exe
  2⤵
  PID:5600
- C:\Windows\System\XsqzdBv.exe
  C:\Windows\System\XsqzdBv.exe
  2⤵
  PID:5616
- C:\Windows\System\eGoXavB.exe
  C:\Windows\System\eGoXavB.exe
  2⤵
  PID:5632
- C:\Windows\System\DAsjOoF.exe
  C:\Windows\System\DAsjOoF.exe
  2⤵
  PID:5648
- C:\Windows\System\FYQQtKM.exe
  C:\Windows\System\FYQQtKM.exe
  2⤵
  PID:5664
- C:\Windows\System\WUYlPeh.exe
  C:\Windows\System\WUYlPeh.exe
  2⤵
  PID:5680
- C:\Windows\System\vxUcZxv.exe
  C:\Windows\System\vxUcZxv.exe
  2⤵
  PID:5696
- C:\Windows\System\WqbXBXF.exe
  C:\Windows\System\WqbXBXF.exe
  2⤵
  PID:5712
- C:\Windows\System\KKxFbQU.exe
  C:\Windows\System\KKxFbQU.exe
  2⤵
  PID:5728
- C:\Windows\System\qWHhFwm.exe
  C:\Windows\System\qWHhFwm.exe
  2⤵
  PID:5744
- C:\Windows\System\nwmOIBQ.exe
  C:\Windows\System\nwmOIBQ.exe
  2⤵
  PID:5760
- C:\Windows\System\beCkFIU.exe
  C:\Windows\System\beCkFIU.exe
  2⤵
  PID:5776
- C:\Windows\System\pzBPqyD.exe
  C:\Windows\System\pzBPqyD.exe
  2⤵
  PID:5792
- C:\Windows\System\YwjSmsu.exe
  C:\Windows\System\YwjSmsu.exe
  2⤵
  PID:5808
- C:\Windows\System\nXrJTuB.exe
  C:\Windows\System\nXrJTuB.exe
  2⤵
  PID:5824
- C:\Windows\System\HmOvIwH.exe
  C:\Windows\System\HmOvIwH.exe
  2⤵
  PID:5840
- C:\Windows\System\DwRzULQ.exe
  C:\Windows\System\DwRzULQ.exe
  2⤵
  PID:5856
- C:\Windows\System\oGkOyur.exe
  C:\Windows\System\oGkOyur.exe
  2⤵
  PID:5876
- C:\Windows\System\MaOPHbe.exe
  C:\Windows\System\MaOPHbe.exe
  2⤵
  PID:5892
- C:\Windows\System\EqycCpC.exe
  C:\Windows\System\EqycCpC.exe
  2⤵
  PID:5912
- C:\Windows\System\NaDyCpP.exe
  C:\Windows\System\NaDyCpP.exe
  2⤵
  PID:5928
- C:\Windows\System\nFnkSEk.exe
  C:\Windows\System\nFnkSEk.exe
  2⤵
  PID:5944
- C:\Windows\System\ZwpQeQO.exe
  C:\Windows\System\ZwpQeQO.exe
  2⤵
  PID:5960
- C:\Windows\System\yGHhaFu.exe
  C:\Windows\System\yGHhaFu.exe
  2⤵
  PID:5980
- C:\Windows\System\LsTcTTi.exe
  C:\Windows\System\LsTcTTi.exe
  2⤵
  PID:5996
- C:\Windows\System\gJUOMuN.exe
  C:\Windows\System\gJUOMuN.exe
  2⤵
  PID:6020
- C:\Windows\System\ktgJxEw.exe
  C:\Windows\System\ktgJxEw.exe
  2⤵
  PID:6036
- C:\Windows\System\LARPYjg.exe
  C:\Windows\System\LARPYjg.exe
  2⤵
  PID:6052
- C:\Windows\System\WaSpUgu.exe
  C:\Windows\System\WaSpUgu.exe
  2⤵
  PID:6068
- C:\Windows\System\lDuTOfZ.exe
  C:\Windows\System\lDuTOfZ.exe
  2⤵
  PID:6084
- C:\Windows\System\LAngsjf.exe
  C:\Windows\System\LAngsjf.exe
  2⤵
  PID:6100
- C:\Windows\System\PIRzDDr.exe
  C:\Windows\System\PIRzDDr.exe
  2⤵
  PID:6116
- C:\Windows\System\MJldedp.exe
  C:\Windows\System\MJldedp.exe
  2⤵
  PID:6132
- C:\Windows\System\yUQrhQw.exe
  C:\Windows\System\yUQrhQw.exe
  2⤵
  PID:4200
- C:\Windows\System\PeCudjm.exe
  C:\Windows\System\PeCudjm.exe
  2⤵
  PID:5152
- C:\Windows\System\TFcFZrC.exe
  C:\Windows\System\TFcFZrC.exe
  2⤵
  PID:4428
- C:\Windows\System\nlIYCDB.exe
  C:\Windows\System\nlIYCDB.exe
  2⤵
  PID:5220
- C:\Windows\System\GIZWUgr.exe
  C:\Windows\System\GIZWUgr.exe
  2⤵
  PID:5252
- C:\Windows\System\ttluLjb.exe
  C:\Windows\System\ttluLjb.exe
  2⤵
  PID:4560
- C:\Windows\System\XThfCnq.exe
  C:\Windows\System\XThfCnq.exe
  2⤵
  PID:4816
- C:\Windows\System\JZNdSMM.exe
  C:\Windows\System\JZNdSMM.exe
  2⤵
  PID:4900
- C:\Windows\System\PoSatpb.exe
  C:\Windows\System\PoSatpb.exe
  2⤵
  PID:4604
- C:\Windows\System\JtgNGRA.exe
  C:\Windows\System\JtgNGRA.exe
  2⤵
  PID:4964
- C:\Windows\System\EjuMmVZ.exe
  C:\Windows\System\EjuMmVZ.exe
  2⤵
  PID:5164
- C:\Windows\System\KipRydw.exe
  C:\Windows\System\KipRydw.exe
  2⤵
  PID:5236
- C:\Windows\System\SxwOCZy.exe
  C:\Windows\System\SxwOCZy.exe
  2⤵
  PID:4460
- C:\Windows\System\ydBUvXo.exe
  C:\Windows\System\ydBUvXo.exe
  2⤵
  PID:5480
- C:\Windows\System\eAdPqZB.exe
  C:\Windows\System\eAdPqZB.exe
  2⤵
  PID:5512
- C:\Windows\System\xFFwvKi.exe
  C:\Windows\System\xFFwvKi.exe
  2⤵
  PID:5548
- C:\Windows\System\EPPbsmE.exe
  C:\Windows\System\EPPbsmE.exe
  2⤵
  PID:5468
- C:\Windows\System\YrPfuLB.exe
  C:\Windows\System\YrPfuLB.exe
  2⤵
  PID:5564
- C:\Windows\System\XlsOZyv.exe
  C:\Windows\System\XlsOZyv.exe
  2⤵
  PID:5644
- C:\Windows\System\zTkheKF.exe
  C:\Windows\System\zTkheKF.exe
  2⤵
  PID:5704
- C:\Windows\System\yhUSoZD.exe
  C:\Windows\System\yhUSoZD.exe
  2⤵
  PID:5656
- C:\Windows\System\LdIItfX.exe
  C:\Windows\System\LdIItfX.exe
  2⤵
  PID:5688
- C:\Windows\System\RQLOvFp.exe
  C:\Windows\System\RQLOvFp.exe
  2⤵
  PID:5592
- C:\Windows\System\TMXTtAC.exe
  C:\Windows\System\TMXTtAC.exe
  2⤵
  PID:5772
- C:\Windows\System\KrJyXLe.exe
  C:\Windows\System\KrJyXLe.exe
  2⤵
  PID:5864
- C:\Windows\System\IswmuXC.exe
  C:\Windows\System\IswmuXC.exe
  2⤵
  PID:5904
- C:\Windows\System\DIWAtEJ.exe
  C:\Windows\System\DIWAtEJ.exe
  2⤵
  PID:5756
- C:\Windows\System\bpjCRvr.exe
  C:\Windows\System\bpjCRvr.exe
  2⤵
  PID:5852
- C:\Windows\System\UtWpJYb.exe
  C:\Windows\System\UtWpJYb.exe
  2⤵
  PID:6004
- C:\Windows\System\risFKJt.exe
  C:\Windows\System\risFKJt.exe
  2⤵
  PID:6044
- C:\Windows\System\XqkTbvA.exe
  C:\Windows\System\XqkTbvA.exe
  2⤵
  PID:6112
- C:\Windows\System\kFVQGYz.exe
  C:\Windows\System\kFVQGYz.exe
  2⤵
  PID:5108
- C:\Windows\System\oHGplLy.exe
  C:\Windows\System\oHGplLy.exe
  2⤵
  PID:5848
- C:\Windows\System\IuYQWWh.exe
  C:\Windows\System\IuYQWWh.exe
  2⤵
  PID:5920
- C:\Windows\System\zqvWklv.exe
  C:\Windows\System\zqvWklv.exe
  2⤵
  PID:5988
- C:\Windows\System\sPojKJx.exe
  C:\Windows\System\sPojKJx.exe
  2⤵
  PID:5216
- C:\Windows\System\ppYKGiz.exe
  C:\Windows\System\ppYKGiz.exe
  2⤵
  PID:4264
- C:\Windows\System\CqRQSON.exe
  C:\Windows\System\CqRQSON.exe
  2⤵
  PID:6096
- C:\Windows\System\cXzORDl.exe
  C:\Windows\System\cXzORDl.exe
  2⤵
  PID:2948
- C:\Windows\System\cDfXlsp.exe
  C:\Windows\System\cDfXlsp.exe
  2⤵
  PID:5132
- C:\Windows\System\oGeHXPG.exe
  C:\Windows\System\oGeHXPG.exe
  2⤵
  PID:4852
- C:\Windows\System\mGyziZy.exe
  C:\Windows\System\mGyziZy.exe
  2⤵
  PID:5200
- C:\Windows\System\VrXSyZS.exe
  C:\Windows\System\VrXSyZS.exe
  2⤵
  PID:4800
- C:\Windows\System\sBfnBIR.exe
  C:\Windows\System\sBfnBIR.exe
  2⤵
  PID:5268
- C:\Windows\System\IkRngrt.exe
  C:\Windows\System\IkRngrt.exe
  2⤵
  PID:5320
- C:\Windows\System\jihCqIz.exe
  C:\Windows\System\jihCqIz.exe
  2⤵
  PID:1564
- C:\Windows\System\gUrJFlI.exe
  C:\Windows\System\gUrJFlI.exe
  2⤵
  PID:5416
- C:\Windows\System\FpnNcDp.exe
  C:\Windows\System\FpnNcDp.exe
  2⤵
  PID:5364
- C:\Windows\System\JJwUJAI.exe
  C:\Windows\System\JJwUJAI.exe
  2⤵
  PID:5528
- C:\Windows\System\dJqvlNA.exe
  C:\Windows\System\dJqvlNA.exe
  2⤵
  PID:5428
- C:\Windows\System\RSGZTEf.exe
  C:\Windows\System\RSGZTEf.exe
  2⤵
  PID:5740
- C:\Windows\System\MGHeLhz.exe
  C:\Windows\System\MGHeLhz.exe
  2⤵
  PID:5832
- C:\Windows\System\VreOglY.exe
  C:\Windows\System\VreOglY.exe
  2⤵
  PID:5940
- C:\Windows\System\SVIyCpz.exe
  C:\Windows\System\SVIyCpz.exe
  2⤵
  PID:6076
- C:\Windows\System\SLyDwgg.exe
  C:\Windows\System\SLyDwgg.exe
  2⤵
  PID:4596
- C:\Windows\System\TSneWMh.exe
  C:\Windows\System\TSneWMh.exe
  2⤵
  PID:5820
- C:\Windows\System\rjksunR.exe
  C:\Windows\System\rjksunR.exe
  2⤵
  PID:4040
- C:\Windows\System\hJaXrHj.exe
  C:\Windows\System\hJaXrHj.exe
  2⤵
  PID:6124
- C:\Windows\System\sqCmGqw.exe
  C:\Windows\System\sqCmGqw.exe
  2⤵
  PID:5900
- C:\Windows\System\jKfefQB.exe
  C:\Windows\System\jKfefQB.exe
  2⤵
  PID:5560
- C:\Windows\System\qaoejli.exe
  C:\Windows\System\qaoejli.exe
  2⤵
  PID:4624
- C:\Windows\System\QRxOiwE.exe
  C:\Windows\System\QRxOiwE.exe
  2⤵
  PID:5272
- C:\Windows\System\nIhuVql.exe
  C:\Windows\System\nIhuVql.exe
  2⤵
  PID:5148
- C:\Windows\System\hvmQUHM.exe
  C:\Windows\System\hvmQUHM.exe
  2⤵
  PID:5316
- C:\Windows\System\VxfqcVW.exe
  C:\Windows\System\VxfqcVW.exe
  2⤵
  PID:5496
- C:\Windows\System\hmOeOCf.exe
  C:\Windows\System\hmOeOCf.exe
  2⤵
  PID:5936
- C:\Windows\System\quDuzvc.exe
  C:\Windows\System\quDuzvc.exe
  2⤵
  PID:5368
- C:\Windows\System\RMoigLY.exe
  C:\Windows\System\RMoigLY.exe
  2⤵
  PID:5348
- C:\Windows\System\mmTPBRE.exe
  C:\Windows\System\mmTPBRE.exe
  2⤵
  PID:6080
- C:\Windows\System\lLIViCH.exe
  C:\Windows\System\lLIViCH.exe
  2⤵
  PID:5288
- C:\Windows\System\UcttfgH.exe
  C:\Windows\System\UcttfgH.exe
  2⤵
  PID:4352
- C:\Windows\System\xJekhIz.exe
  C:\Windows\System\xJekhIz.exe
  2⤵
  PID:5956
- C:\Windows\System\RgJegSN.exe
  C:\Windows\System\RgJegSN.exe
  2⤵
  PID:5660
- C:\Windows\System\GJuqHpy.exe
  C:\Windows\System\GJuqHpy.exe
  2⤵
  PID:4464
- C:\Windows\System\CpUSQPS.exe
  C:\Windows\System\CpUSQPS.exe
  2⤵
  PID:5640
- C:\Windows\System\bSiOQZS.exe
  C:\Windows\System\bSiOQZS.exe
  2⤵
  PID:6152
- C:\Windows\System\hFlEUcF.exe
  C:\Windows\System\hFlEUcF.exe
  2⤵
  PID:6168
- C:\Windows\System\dSSyeVK.exe
  C:\Windows\System\dSSyeVK.exe
  2⤵
  PID:6184
- C:\Windows\System\VkVdusu.exe
  C:\Windows\System\VkVdusu.exe
  2⤵
  PID:6200
- C:\Windows\System\gKUhlsW.exe
  C:\Windows\System\gKUhlsW.exe
  2⤵
  PID:6216
- C:\Windows\System\vbKddHB.exe
  C:\Windows\System\vbKddHB.exe
  2⤵
  PID:6232
- C:\Windows\System\VSLxQuM.exe
  C:\Windows\System\VSLxQuM.exe
  2⤵
  PID:6248
- C:\Windows\System\PkIAits.exe
  C:\Windows\System\PkIAits.exe
  2⤵
  PID:6264
- C:\Windows\System\fXZjsXH.exe
  C:\Windows\System\fXZjsXH.exe
  2⤵
  PID:6284
- C:\Windows\System\RgNPTMR.exe
  C:\Windows\System\RgNPTMR.exe
  2⤵
  PID:6300
- C:\Windows\System\VPAqrVj.exe
  C:\Windows\System\VPAqrVj.exe
  2⤵
  PID:6316
- C:\Windows\System\aMnOOpU.exe
  C:\Windows\System\aMnOOpU.exe
  2⤵
  PID:6332
- C:\Windows\System\GZTqFNF.exe
  C:\Windows\System\GZTqFNF.exe
  2⤵
  PID:6348
- C:\Windows\System\xcBjJtM.exe
  C:\Windows\System\xcBjJtM.exe
  2⤵
  PID:6364
- C:\Windows\System\vSQgERM.exe
  C:\Windows\System\vSQgERM.exe
  2⤵
  PID:6380
- C:\Windows\System\tTAvFUQ.exe
  C:\Windows\System\tTAvFUQ.exe
  2⤵
  PID:6396
- C:\Windows\System\CWWkTea.exe
  C:\Windows\System\CWWkTea.exe
  2⤵
  PID:6412
- C:\Windows\System\kXcJqya.exe
  C:\Windows\System\kXcJqya.exe
  2⤵
  PID:6428
- C:\Windows\System\PVqAoGi.exe
  C:\Windows\System\PVqAoGi.exe
  2⤵
  PID:6444
- C:\Windows\System\cIaKwZa.exe
  C:\Windows\System\cIaKwZa.exe
  2⤵
  PID:6460
- C:\Windows\System\PQAVJUx.exe
  C:\Windows\System\PQAVJUx.exe
  2⤵
  PID:6476
- C:\Windows\System\NVDNrSk.exe
  C:\Windows\System\NVDNrSk.exe
  2⤵
  PID:6492
- C:\Windows\System\Oddjond.exe
  C:\Windows\System\Oddjond.exe
  2⤵
  PID:6508
- C:\Windows\System\adRAOBh.exe
  C:\Windows\System\adRAOBh.exe
  2⤵
  PID:6524
- C:\Windows\System\OdggpVJ.exe
  C:\Windows\System\OdggpVJ.exe
  2⤵
  PID:6540
- C:\Windows\System\yYsqipq.exe
  C:\Windows\System\yYsqipq.exe
  2⤵
  PID:6556
- C:\Windows\System\LhdWKHT.exe
  C:\Windows\System\LhdWKHT.exe
  2⤵
  PID:6572
- C:\Windows\System\NQzrQZw.exe
  C:\Windows\System\NQzrQZw.exe
  2⤵
  PID:6588
- C:\Windows\System\IaDcIHU.exe
  C:\Windows\System\IaDcIHU.exe
  2⤵
  PID:6604
- C:\Windows\System\yCdRrsS.exe
  C:\Windows\System\yCdRrsS.exe
  2⤵
  PID:6620
- C:\Windows\System\pHisqAU.exe
  C:\Windows\System\pHisqAU.exe
  2⤵
  PID:6636
- C:\Windows\System\ltXLqRF.exe
  C:\Windows\System\ltXLqRF.exe
  2⤵
  PID:6652
- C:\Windows\System\XnaIiIv.exe
  C:\Windows\System\XnaIiIv.exe
  2⤵
  PID:6684
- C:\Windows\System\GvOKqCY.exe
  C:\Windows\System\GvOKqCY.exe
  2⤵
  PID:6700
- C:\Windows\System\phCZNCB.exe
  C:\Windows\System\phCZNCB.exe
  2⤵
  PID:6716
- C:\Windows\System\dqWvVjZ.exe
  C:\Windows\System\dqWvVjZ.exe
  2⤵
  PID:6732
- C:\Windows\System\NQYZfCn.exe
  C:\Windows\System\NQYZfCn.exe
  2⤵
  PID:6748
- C:\Windows\System\yTViNbl.exe
  C:\Windows\System\yTViNbl.exe
  2⤵
  PID:6764
- C:\Windows\System\LwLbUlN.exe
  C:\Windows\System\LwLbUlN.exe
  2⤵
  PID:6820
- C:\Windows\System\EDtILsY.exe
  C:\Windows\System\EDtILsY.exe
  2⤵
  PID:6840
- C:\Windows\System\sKByKPX.exe
  C:\Windows\System\sKByKPX.exe
  2⤵
  PID:6856
- C:\Windows\System\afJCJqx.exe
  C:\Windows\System\afJCJqx.exe
  2⤵
  PID:7120
- C:\Windows\System\cjaozte.exe
  C:\Windows\System\cjaozte.exe
  2⤵
  PID:7136
- C:\Windows\System\bDKFAJZ.exe
  C:\Windows\System\bDKFAJZ.exe
  2⤵
  PID:7152
- C:\Windows\System\ZNqapkp.exe
  C:\Windows\System\ZNqapkp.exe
  2⤵
  PID:4752
- C:\Windows\System\BolaBhd.exe
  C:\Windows\System\BolaBhd.exe
  2⤵
  PID:5136
- C:\Windows\System\WIwVMIB.exe
  C:\Windows\System\WIwVMIB.exe
  2⤵
  PID:6164
- C:\Windows\System\IiObNAm.exe
  C:\Windows\System\IiObNAm.exe
  2⤵
  PID:6812
- C:\Windows\System\EiUBlqc.exe
  C:\Windows\System\EiUBlqc.exe
  2⤵
  PID:6876
- C:\Windows\System\wXyWZaJ.exe
  C:\Windows\System\wXyWZaJ.exe
  2⤵
  PID:6892
- C:\Windows\System\SfPngJa.exe
  C:\Windows\System\SfPngJa.exe
  2⤵
  PID:6908
- C:\Windows\System\iYFqKfi.exe
  C:\Windows\System\iYFqKfi.exe
  2⤵
  PID:6924
- C:\Windows\System\JHudaoA.exe
  C:\Windows\System\JHudaoA.exe
  2⤵
  PID:6776
- C:\Windows\System\YJexJXj.exe
  C:\Windows\System\YJexJXj.exe
  2⤵
  PID:6784
- C:\Windows\System\QxkyNHI.exe
  C:\Windows\System\QxkyNHI.exe
  2⤵
  PID:6948
- C:\Windows\System\TTZxtjH.exe
  C:\Windows\System\TTZxtjH.exe
  2⤵
  PID:6960
- C:\Windows\System\QrpNBoR.exe
  C:\Windows\System\QrpNBoR.exe
  2⤵
  PID:6976
- C:\Windows\System\UaLCHtl.exe
  C:\Windows\System\UaLCHtl.exe
  2⤵
  PID:6992
- C:\Windows\System\IjxPwhs.exe
  C:\Windows\System\IjxPwhs.exe
  2⤵
  PID:7012
- C:\Windows\System\axmwDOw.exe
  C:\Windows\System\axmwDOw.exe
  2⤵
  PID:7028
- C:\Windows\System\YGCmXTi.exe
  C:\Windows\System\YGCmXTi.exe
  2⤵
  PID:7048
- C:\Windows\System\PoSDNYu.exe
  C:\Windows\System\PoSDNYu.exe
  2⤵
  PID:7064
- C:\Windows\System\bERQyWX.exe
  C:\Windows\System\bERQyWX.exe
  2⤵
  PID:7084
- C:\Windows\System\XYGavFg.exe
  C:\Windows\System\XYGavFg.exe
  2⤵
  PID:7100
- C:\Windows\System\EVkjIII.exe
  C:\Windows\System\EVkjIII.exe
  2⤵
  PID:5816
- C:\Windows\System\rOWUqqp.exe
  C:\Windows\System\rOWUqqp.exe
  2⤵
  PID:6256
- C:\Windows\System\GMPDwLx.exe
  C:\Windows\System\GMPDwLx.exe
  2⤵
  PID:6296
- C:\Windows\System\priYRxZ.exe
  C:\Windows\System\priYRxZ.exe
  2⤵
  PID:6328
- C:\Windows\System\VaCJvhm.exe
  C:\Windows\System\VaCJvhm.exe
  2⤵
  PID:5888
- C:\Windows\System\GrZDZpJ.exe
  C:\Windows\System\GrZDZpJ.exe
  2⤵
  PID:4300
- C:\Windows\System\GoUDpyH.exe
  C:\Windows\System\GoUDpyH.exe
  2⤵
  PID:6240
- C:\Windows\System\AMPRnAv.exe
  C:\Windows\System\AMPRnAv.exe
  2⤵
  PID:6276
- C:\Windows\System\vucKEZM.exe
  C:\Windows\System\vucKEZM.exe
  2⤵
  PID:6516
- C:\Windows\System\rhOLLCl.exe
  C:\Windows\System\rhOLLCl.exe
  2⤵
  PID:6272
- C:\Windows\System\dSIvmAA.exe
  C:\Windows\System\dSIvmAA.exe
  2⤵
  PID:6520
- C:\Windows\System\SwDaTvu.exe
  C:\Windows\System\SwDaTvu.exe
  2⤵
  PID:6500
- C:\Windows\System\gKGzIle.exe
  C:\Windows\System\gKGzIle.exe
  2⤵
  PID:6552
- C:\Windows\System\slLUCgW.exe
  C:\Windows\System\slLUCgW.exe
  2⤵
  PID:6532
- C:\Windows\System\CjaTvZu.exe
  C:\Windows\System\CjaTvZu.exe
  2⤵
  PID:6564
- C:\Windows\System\FYaESwV.exe
  C:\Windows\System\FYaESwV.exe
  2⤵
  PID:6628
- C:\Windows\System\RcGDEHE.exe
  C:\Windows\System\RcGDEHE.exe
  2⤵
  PID:6660
- C:\Windows\System\KatXzXd.exe
  C:\Windows\System\KatXzXd.exe
  2⤵
  PID:6696
- C:\Windows\System\RiwymWR.exe
  C:\Windows\System\RiwymWR.exe
  2⤵
  PID:6756
- C:\Windows\System\pheKrRG.exe
  C:\Windows\System\pheKrRG.exe
  2⤵
  PID:6984
- C:\Windows\System\vRmylfr.exe
  C:\Windows\System\vRmylfr.exe
  2⤵
  PID:6852
- C:\Windows\System\arVcAPc.exe
  C:\Windows\System\arVcAPc.exe
  2⤵
  PID:7024
- C:\Windows\System\FNkVohr.exe
  C:\Windows\System\FNkVohr.exe
  2⤵
  PID:6968
- C:\Windows\System\ahvVbdR.exe
  C:\Windows\System\ahvVbdR.exe
  2⤵
  PID:7004
- C:\Windows\System\JcatjvE.exe
  C:\Windows\System\JcatjvE.exe
  2⤵
  PID:7080
- C:\Windows\System\ZsidtTh.exe
  C:\Windows\System\ZsidtTh.exe
  2⤵
  PID:7144
- C:\Windows\System\vRwobDy.exe
  C:\Windows\System\vRwobDy.exe
  2⤵
  PID:7128
- C:\Windows\System\nVxwtMn.exe
  C:\Windows\System\nVxwtMn.exe
  2⤵
  PID:5836
- C:\Windows\System\yujfGyg.exe
  C:\Windows\System\yujfGyg.exe
  2⤵
  PID:6456
- C:\Windows\System\gGWUqbR.exe
  C:\Windows\System\gGWUqbR.exe
  2⤵
  PID:6344
- C:\Windows\System\ccbCQUE.exe
  C:\Windows\System\ccbCQUE.exe
  2⤵
  PID:6424
- C:\Windows\System\uBOLbgC.exe
  C:\Windows\System\uBOLbgC.exe
  2⤵
  PID:6680
- C:\Windows\System\ekmmRhw.exe
  C:\Windows\System\ekmmRhw.exe
  2⤵
  PID:6488
- C:\Windows\System\XHSrFUV.exe
  C:\Windows\System\XHSrFUV.exe
  2⤵
  PID:6616
- C:\Windows\System\lDGbUsV.exe
  C:\Windows\System\lDGbUsV.exe
  2⤵
  PID:6536
- C:\Windows\System\HfhHzLw.exe
  C:\Windows\System\HfhHzLw.exe
  2⤵
  PID:5448
- C:\Windows\System\noAMPFy.exe
  C:\Windows\System\noAMPFy.exe
  2⤵
  PID:6864
- C:\Windows\System\DFHxQFl.exe
  C:\Windows\System\DFHxQFl.exe
  2⤵
  PID:6804
- C:\Windows\System\QyMUGil.exe
  C:\Windows\System\QyMUGil.exe
  2⤵
  PID:6988
- C:\Windows\System\tiAPsub.exe
  C:\Windows\System\tiAPsub.exe
  2⤵
  PID:6972
- C:\Windows\System\kppjzya.exe
  C:\Windows\System\kppjzya.exe
  2⤵
  PID:6780
- C:\Windows\System\kpTqfiU.exe
  C:\Windows\System\kpTqfiU.exe
  2⤵
  PID:7076
- C:\Windows\System\RLScAxi.exe
  C:\Windows\System\RLScAxi.exe
  2⤵
  PID:7096
- C:\Windows\System\neWAnXN.exe
  C:\Windows\System\neWAnXN.exe
  2⤵
  PID:5544
- C:\Windows\System\KZxttoC.exe
  C:\Windows\System\KZxttoC.exe
  2⤵
  PID:6160
- C:\Windows\System\MYzqrNT.exe
  C:\Windows\System\MYzqrNT.exe
  2⤵
  PID:5184
- C:\Windows\System\LbYxebL.exe
  C:\Windows\System\LbYxebL.exe
  2⤵
  PID:6324
- C:\Windows\System\JvtQrZt.exe
  C:\Windows\System\JvtQrZt.exe
  2⤵
  PID:6360
- C:\Windows\System\VJCYIeV.exe
  C:\Windows\System\VJCYIeV.exe
  2⤵
  PID:6580
- C:\Windows\System\SJbyyQR.exe
  C:\Windows\System\SJbyyQR.exe
  2⤵
  PID:6472
- C:\Windows\System\rXEuONW.exe
  C:\Windows\System\rXEuONW.exe
  2⤵
  PID:6584
- C:\Windows\System\lnLTkdK.exe
  C:\Windows\System\lnLTkdK.exe
  2⤵
  PID:6796
- C:\Windows\System\yNikLhu.exe
  C:\Windows\System\yNikLhu.exe
  2⤵
  PID:6888
- C:\Windows\System\PgfZsHg.exe
  C:\Windows\System\PgfZsHg.exe
  2⤵
  PID:7116
- C:\Windows\System\aIwLWOU.exe
  C:\Windows\System\aIwLWOU.exe
  2⤵
  PID:6484
- C:\Windows\System\ibrXGDv.exe
  C:\Windows\System\ibrXGDv.exe
  2⤵
  PID:6904
- C:\Windows\System\XBUAwOW.exe
  C:\Windows\System\XBUAwOW.exe
  2⤵
  PID:6848
- C:\Windows\System\MHzYFGD.exe
  C:\Windows\System\MHzYFGD.exe
  2⤵
  PID:6064
- C:\Windows\System\wEaAfPG.exe
  C:\Windows\System\wEaAfPG.exe
  2⤵
  PID:6260
- C:\Windows\System\kJgDdaE.exe
  C:\Windows\System\kJgDdaE.exe
  2⤵
  PID:7060
- C:\Windows\System\idKnSeC.exe
  C:\Windows\System\idKnSeC.exe
  2⤵
  PID:6772
- C:\Windows\System\dkrZJrv.exe
  C:\Windows\System\dkrZJrv.exe
  2⤵
  PID:6196
- C:\Windows\System\snNaTFP.exe
  C:\Windows\System\snNaTFP.exe
  2⤵
  PID:6340
- C:\Windows\System\iVPFumT.exe
  C:\Windows\System\iVPFumT.exe
  2⤵
  PID:7164
- C:\Windows\System\VEGluQw.exe
  C:\Windows\System\VEGluQw.exe
  2⤵
  PID:6836
- C:\Windows\System\TdpjloP.exe
  C:\Windows\System\TdpjloP.exe
  2⤵
  PID:6792
- C:\Windows\System\aZjqPcq.exe
  C:\Windows\System\aZjqPcq.exe
  2⤵
  PID:7244
- C:\Windows\System\MeAbSoU.exe
  C:\Windows\System\MeAbSoU.exe
  2⤵
  PID:7260
- C:\Windows\System\QvETtqY.exe
  C:\Windows\System\QvETtqY.exe
  2⤵
  PID:7280
- C:\Windows\System\RbWvXBM.exe
  C:\Windows\System\RbWvXBM.exe
  2⤵
  PID:7296
- C:\Windows\System\MSDWvRR.exe
  C:\Windows\System\MSDWvRR.exe
  2⤵
  PID:7312
- C:\Windows\System\sKNhwXi.exe
  C:\Windows\System\sKNhwXi.exe
  2⤵
  PID:7328
- C:\Windows\System\fdwmylJ.exe
  C:\Windows\System\fdwmylJ.exe
  2⤵
  PID:7344
- C:\Windows\System\WYyyedJ.exe
  C:\Windows\System\WYyyedJ.exe
  2⤵
  PID:7360
- C:\Windows\System\vmiCFur.exe
  C:\Windows\System\vmiCFur.exe
  2⤵
  PID:7376
- C:\Windows\System\rnoUnqA.exe
  C:\Windows\System\rnoUnqA.exe
  2⤵
  PID:7392
- C:\Windows\System\QKoAcZX.exe
  C:\Windows\System\QKoAcZX.exe
  2⤵
  PID:7408
- C:\Windows\System\zplBtNq.exe
  C:\Windows\System\zplBtNq.exe
  2⤵
  PID:7444
- C:\Windows\System\dAoXpGj.exe
  C:\Windows\System\dAoXpGj.exe
  2⤵
  PID:7460
- C:\Windows\System\LuCDeTq.exe
  C:\Windows\System\LuCDeTq.exe
  2⤵
  PID:7476
- C:\Windows\System\MNzOCxV.exe
  C:\Windows\System\MNzOCxV.exe
  2⤵
  PID:7492
- C:\Windows\System\arqzRYG.exe
  C:\Windows\System\arqzRYG.exe
  2⤵
  PID:7508
- C:\Windows\System\RhEbwSx.exe
  C:\Windows\System\RhEbwSx.exe
  2⤵
  PID:7524
- C:\Windows\System\XqOnIiq.exe
  C:\Windows\System\XqOnIiq.exe
  2⤵
  PID:7540
- C:\Windows\System\ifbwlqr.exe
  C:\Windows\System\ifbwlqr.exe
  2⤵
  PID:7556
- C:\Windows\System\cksFGug.exe
  C:\Windows\System\cksFGug.exe
  2⤵
  PID:7572
- C:\Windows\System\PAQFrAA.exe
  C:\Windows\System\PAQFrAA.exe
  2⤵
  PID:7588
- C:\Windows\System\gQAYlxK.exe
  C:\Windows\System\gQAYlxK.exe
  2⤵
  PID:7608
- C:\Windows\System\QidKvCT.exe
  C:\Windows\System\QidKvCT.exe
  2⤵
  PID:7624
- C:\Windows\System\yurOdJG.exe
  C:\Windows\System\yurOdJG.exe
  2⤵
  PID:7640
- C:\Windows\System\APyQoTn.exe
  C:\Windows\System\APyQoTn.exe
  2⤵
  PID:7668
- C:\Windows\System\tdDVrxA.exe
  C:\Windows\System\tdDVrxA.exe
  2⤵
  PID:7688
- C:\Windows\System\uoSFFxB.exe
  C:\Windows\System\uoSFFxB.exe
  2⤵
  PID:7704
- C:\Windows\System\CxYweMD.exe
  C:\Windows\System\CxYweMD.exe
  2⤵
  PID:7720
- C:\Windows\System\HtGRcxc.exe
  C:\Windows\System\HtGRcxc.exe
  2⤵
  PID:7736
- C:\Windows\System\WnwRfYX.exe
  C:\Windows\System\WnwRfYX.exe
  2⤵
  PID:7752
- C:\Windows\System\hRoBmkI.exe
  C:\Windows\System\hRoBmkI.exe
  2⤵
  PID:7768
- C:\Windows\System\aopAHeX.exe
  C:\Windows\System\aopAHeX.exe
  2⤵
  PID:7784
- C:\Windows\System\ouxIjpe.exe
  C:\Windows\System\ouxIjpe.exe
  2⤵
  PID:7896
- C:\Windows\System\oQqmjxK.exe
  C:\Windows\System\oQqmjxK.exe
  2⤵
  PID:7912
- C:\Windows\System\zijdHEr.exe
  C:\Windows\System\zijdHEr.exe
  2⤵
  PID:7928
- C:\Windows\System\ZWecxkr.exe
  C:\Windows\System\ZWecxkr.exe
  2⤵
  PID:7952
- C:\Windows\System\WQXSKBx.exe
  C:\Windows\System\WQXSKBx.exe
  2⤵
  PID:7968
- C:\Windows\System\wPRnZlr.exe
  C:\Windows\System\wPRnZlr.exe
  2⤵
  PID:7984
- C:\Windows\System\wUBNiXI.exe
  C:\Windows\System\wUBNiXI.exe
  2⤵
  PID:8000
- C:\Windows\System\tsxYFSb.exe
  C:\Windows\System\tsxYFSb.exe
  2⤵
  PID:8016
- C:\Windows\System\oAaydtj.exe
  C:\Windows\System\oAaydtj.exe
  2⤵
  PID:8032
- C:\Windows\System\IVogLTk.exe
  C:\Windows\System\IVogLTk.exe
  2⤵
  PID:8048
- C:\Windows\System\hQWfQHs.exe
  C:\Windows\System\hQWfQHs.exe
  2⤵
  PID:8064
- C:\Windows\System\swaujPV.exe
  C:\Windows\System\swaujPV.exe
  2⤵
  PID:8080
- C:\Windows\System\cRxhTnv.exe
  C:\Windows\System\cRxhTnv.exe
  2⤵
  PID:8096
- C:\Windows\System\oGXvCWh.exe
  C:\Windows\System\oGXvCWh.exe
  2⤵
  PID:8112
- C:\Windows\System\uoePSvi.exe
  C:\Windows\System\uoePSvi.exe
  2⤵
  PID:8128
- C:\Windows\System\VxOsUkD.exe
  C:\Windows\System\VxOsUkD.exe
  2⤵
  PID:8148
- C:\Windows\System\iUshYRe.exe
  C:\Windows\System\iUshYRe.exe
  2⤵
  PID:8164
- C:\Windows\System\JOeQgVd.exe
  C:\Windows\System\JOeQgVd.exe
  2⤵
  PID:8180
- C:\Windows\System\CoFCVec.exe
  C:\Windows\System\CoFCVec.exe
  2⤵
  PID:7044
- C:\Windows\System\fMEepAX.exe
  C:\Windows\System\fMEepAX.exe
  2⤵
  PID:6868
- C:\Windows\System\VXkNCzD.exe
  C:\Windows\System\VXkNCzD.exe
  2⤵
  PID:7172
- C:\Windows\System\gYzfMeN.exe
  C:\Windows\System\gYzfMeN.exe
  2⤵
  PID:7192
- C:\Windows\System\OSjQYya.exe
  C:\Windows\System\OSjQYya.exe
  2⤵
  PID:7208
- C:\Windows\System\nyOgWyT.exe
  C:\Windows\System\nyOgWyT.exe
  2⤵
  PID:7224
- C:\Windows\System\HrSXSZN.exe
  C:\Windows\System\HrSXSZN.exe
  2⤵
  PID:7240
- C:\Windows\System\xlvPZwD.exe
  C:\Windows\System\xlvPZwD.exe
  2⤵
  PID:7288
- C:\Windows\System\FagekwX.exe
  C:\Windows\System\FagekwX.exe
  2⤵
  PID:7056
- C:\Windows\System\bzGHGJb.exe
  C:\Windows\System\bzGHGJb.exe
  2⤵
  PID:7384
- C:\Windows\System\xheZDhy.exe
  C:\Windows\System\xheZDhy.exe
  2⤵
  PID:7416
- C:\Windows\System\LHjvwof.exe
  C:\Windows\System\LHjvwof.exe
  2⤵
  PID:7424
- C:\Windows\System\OTCAaqs.exe
  C:\Windows\System\OTCAaqs.exe
  2⤵
  PID:7440
- C:\Windows\System\kFkFfaR.exe
  C:\Windows\System\kFkFfaR.exe
  2⤵
  PID:7468
- C:\Windows\System\bSCozJv.exe
  C:\Windows\System\bSCozJv.exe
  2⤵
  PID:7532
- C:\Windows\System\oproFle.exe
  C:\Windows\System\oproFle.exe
  2⤵
  PID:7596
- C:\Windows\System\peUwHDr.exe
  C:\Windows\System\peUwHDr.exe
  2⤵
  PID:7636
- C:\Windows\System\NWAOyjm.exe
  C:\Windows\System\NWAOyjm.exe
  2⤵
  PID:7712
- C:\Windows\System\CwmOIoO.exe
  C:\Windows\System\CwmOIoO.exe
  2⤵
  PID:7780
- C:\Windows\System\KtOjZlD.exe
  C:\Windows\System\KtOjZlD.exe
  2⤵
  PID:7764
- C:\Windows\System\rUEyyPl.exe
  C:\Windows\System\rUEyyPl.exe
  2⤵
  PID:7700
- C:\Windows\System\IowvWPz.exe
  C:\Windows\System\IowvWPz.exe
  2⤵
  PID:7488
- C:\Windows\System\rtAAwMK.exe
  C:\Windows\System\rtAAwMK.exe
  2⤵
  PID:7552
- C:\Windows\System\YGzusHU.exe
  C:\Windows\System\YGzusHU.exe
  2⤵
  PID:7620
- C:\Windows\System\RzJfTQK.exe
  C:\Windows\System\RzJfTQK.exe
  2⤵
  PID:7660
- C:\Windows\System\CZlHmcF.exe
  C:\Windows\System\CZlHmcF.exe
  2⤵
  PID:7804
- C:\Windows\System\cwLnhxf.exe
  C:\Windows\System\cwLnhxf.exe
  2⤵
  PID:7812
- C:\Windows\System\kumarmN.exe
  C:\Windows\System\kumarmN.exe
  2⤵
  PID:7820
- C:\Windows\System\jWxGHpZ.exe
  C:\Windows\System\jWxGHpZ.exe
  2⤵
  PID:7836
- C:\Windows\System\NWFbTJb.exe
  C:\Windows\System\NWFbTJb.exe
  2⤵
  PID:7872
- C:\Windows\System\XRYLCmy.exe
  C:\Windows\System\XRYLCmy.exe
  2⤵
  PID:7864
- C:\Windows\System\wXzIEZg.exe
  C:\Windows\System\wXzIEZg.exe
  2⤵
  PID:7944
- C:\Windows\System\fDvmJQI.exe
  C:\Windows\System\fDvmJQI.exe
  2⤵
  PID:7980
- C:\Windows\System\lKwqaSQ.exe
  C:\Windows\System\lKwqaSQ.exe
  2⤵
  PID:7892
- C:\Windows\System\GuwRDip.exe
  C:\Windows\System\GuwRDip.exe
  2⤵
  PID:7996
- C:\Windows\System\pbwGEQM.exe
  C:\Windows\System\pbwGEQM.exe
  2⤵
  PID:8044
- C:\Windows\System\rDFRtfc.exe
  C:\Windows\System\rDFRtfc.exe
  2⤵
  PID:8108
- C:\Windows\System\umUqZPN.exe
  C:\Windows\System\umUqZPN.exe
  2⤵
  PID:8172
- C:\Windows\System\YrQetrR.exe
  C:\Windows\System\YrQetrR.exe
  2⤵
  PID:7180
- C:\Windows\System\elXnBnU.exe
  C:\Windows\System\elXnBnU.exe
  2⤵
  PID:7256
- C:\Windows\System\VzUJUXL.exe
  C:\Windows\System\VzUJUXL.exe
  2⤵
  PID:8120
- C:\Windows\System\UkHMYWV.exe
  C:\Windows\System\UkHMYWV.exe
  2⤵
  PID:8024
- C:\Windows\System\PRWUXVv.exe
  C:\Windows\System\PRWUXVv.exe
  2⤵
  PID:7420
- C:\Windows\System\YOCGQSm.exe
  C:\Windows\System\YOCGQSm.exe
  2⤵
  PID:8060
- C:\Windows\System\ZaesaEf.exe
  C:\Windows\System\ZaesaEf.exe
  2⤵
  PID:6800
- C:\Windows\System\OfLjiwC.exe
  C:\Windows\System\OfLjiwC.exe
  2⤵
  PID:7324
- C:\Windows\System\ZnMvmmM.exe
  C:\Windows\System\ZnMvmmM.exe
  2⤵
  PID:7304
- C:\Windows\System\CRDrFAk.exe
  C:\Windows\System\CRDrFAk.exe
  2⤵
  PID:7504
- C:\Windows\System\ullSbbo.exe
  C:\Windows\System\ullSbbo.exe
  2⤵
  PID:7796
- C:\Windows\System\KXrtQIF.exe
  C:\Windows\System\KXrtQIF.exe
  2⤵
  PID:7748
- C:\Windows\System\HKksYef.exe
  C:\Windows\System\HKksYef.exe
  2⤵
  PID:7584
- C:\Windows\System\ZVSvKLp.exe
  C:\Windows\System\ZVSvKLp.exe
  2⤵
  PID:7548
- C:\Windows\System\IqabTly.exe
  C:\Windows\System\IqabTly.exe
  2⤵
  PID:7824
- C:\Windows\System\QuZgrCD.exe
  C:\Windows\System\QuZgrCD.exe
  2⤵
  PID:7652
- C:\Windows\System\tryvmNJ.exe
  C:\Windows\System\tryvmNJ.exe
  2⤵
  PID:7832
- C:\Windows\System\tEjoGVm.exe
  C:\Windows\System\tEjoGVm.exe
  2⤵
  PID:7888
- C:\Windows\System\GUjrwGH.exe
  C:\Windows\System\GUjrwGH.exe
  2⤵
  PID:8140
- C:\Windows\System\XIeqRfu.exe
  C:\Windows\System\XIeqRfu.exe
  2⤵
  PID:7220
- C:\Windows\System\KAblGEP.exe
  C:\Windows\System\KAblGEP.exe
  2⤵
  PID:7992
- C:\Windows\System\uncstzm.exe
  C:\Windows\System\uncstzm.exe
  2⤵
  PID:7340
- C:\Windows\System\rrHjWCq.exe
  C:\Windows\System\rrHjWCq.exe
  2⤵
  PID:7372
- C:\Windows\System\OvpQylN.exe
  C:\Windows\System\OvpQylN.exe
  2⤵
  PID:7432
- C:\Windows\System\vgchihH.exe
  C:\Windows\System\vgchihH.exe
  2⤵
  PID:7308
- C:\Windows\System\lZKtXvc.exe
  C:\Windows\System\lZKtXvc.exe
  2⤵
  PID:7732
- C:\Windows\System\kdLDoCo.exe
  C:\Windows\System\kdLDoCo.exe
  2⤵
  PID:8092
- C:\Windows\System\WDHPFfe.exe
  C:\Windows\System\WDHPFfe.exe
  2⤵
  PID:7728
- C:\Windows\System\rtdTnxO.exe
  C:\Windows\System\rtdTnxO.exe
  2⤵
  PID:7908
- C:\Windows\System\ruiuLFX.exe
  C:\Windows\System\ruiuLFX.exe
  2⤵
  PID:7976
- C:\Windows\System\VYIUvQJ.exe
  C:\Windows\System\VYIUvQJ.exe
  2⤵
  PID:8056
- C:\Windows\System\jaoAYFc.exe
  C:\Windows\System\jaoAYFc.exe
  2⤵
  PID:7680
- C:\Windows\System\HPhNZui.exe
  C:\Windows\System\HPhNZui.exe
  2⤵
  PID:7500
- C:\Windows\System\vFbTrLp.exe
  C:\Windows\System\vFbTrLp.exe
  2⤵
  PID:7924
- C:\Windows\System\WwCMnmS.exe
  C:\Windows\System\WwCMnmS.exe
  2⤵
  PID:7744
- C:\Windows\System\hFVVNHh.exe
  C:\Windows\System\hFVVNHh.exe
  2⤵
  PID:7272
- C:\Windows\System\DLklsDF.exe
  C:\Windows\System\DLklsDF.exe
  2⤵
  PID:8212
- C:\Windows\System\SASLfAh.exe
  C:\Windows\System\SASLfAh.exe
  2⤵
  PID:8228
- C:\Windows\System\EGTgotK.exe
  C:\Windows\System\EGTgotK.exe
  2⤵
  PID:8244
- C:\Windows\System\EjaRajp.exe
  C:\Windows\System\EjaRajp.exe
  2⤵
  PID:8260
- C:\Windows\System\bqIEmaq.exe
  C:\Windows\System\bqIEmaq.exe
  2⤵
  PID:8276
- C:\Windows\System\PMDQqjP.exe
  C:\Windows\System\PMDQqjP.exe
  2⤵
  PID:8292
- C:\Windows\System\UScfFTT.exe
  C:\Windows\System\UScfFTT.exe
  2⤵
  PID:8308
- C:\Windows\System\cBDvlmI.exe
  C:\Windows\System\cBDvlmI.exe
  2⤵
  PID:8324
- C:\Windows\System\DdPnfmC.exe
  C:\Windows\System\DdPnfmC.exe
  2⤵
  PID:8340
- C:\Windows\System\GvSIOrd.exe
  C:\Windows\System\GvSIOrd.exe
  2⤵
  PID:8356
- C:\Windows\System\jqqKRCP.exe
  C:\Windows\System\jqqKRCP.exe
  2⤵
  PID:8372
- C:\Windows\System\QKKLqsm.exe
  C:\Windows\System\QKKLqsm.exe
  2⤵
  PID:8392
- C:\Windows\System\RlIULNP.exe
  C:\Windows\System\RlIULNP.exe
  2⤵
  PID:8408
- C:\Windows\System\lJGIECw.exe
  C:\Windows\System\lJGIECw.exe
  2⤵
  PID:8424
- C:\Windows\System\BOFYzna.exe
  C:\Windows\System\BOFYzna.exe
  2⤵
  PID:8444
- C:\Windows\System\epSKFww.exe
  C:\Windows\System\epSKFww.exe
  2⤵
  PID:8460
- C:\Windows\System\oYEQnBi.exe
  C:\Windows\System\oYEQnBi.exe
  2⤵
  PID:8476
- C:\Windows\System\bclSMJw.exe
  C:\Windows\System\bclSMJw.exe
  2⤵
  PID:8492
- C:\Windows\System\CqErGjt.exe
  C:\Windows\System\CqErGjt.exe
  2⤵
  PID:8508
- C:\Windows\System\ZewcYpq.exe
  C:\Windows\System\ZewcYpq.exe
  2⤵
  PID:8524
- C:\Windows\System\HTnxBCU.exe
  C:\Windows\System\HTnxBCU.exe
  2⤵
  PID:8544
- C:\Windows\System\azqeKiq.exe
  C:\Windows\System\azqeKiq.exe
  2⤵
  PID:8564
- C:\Windows\System\ihLypur.exe
  C:\Windows\System\ihLypur.exe
  2⤵
  PID:8580
- C:\Windows\System\byxvdLG.exe
  C:\Windows\System\byxvdLG.exe
  2⤵
  PID:8596
- C:\Windows\System\dcqZaJR.exe
  C:\Windows\System\dcqZaJR.exe
  2⤵
  PID:8612
- C:\Windows\System\XhvaKLT.exe
  C:\Windows\System\XhvaKLT.exe
  2⤵
  PID:8628
- C:\Windows\System\iAOvYuR.exe
  C:\Windows\System\iAOvYuR.exe
  2⤵
  PID:8644
- C:\Windows\System\XrrVBtk.exe
  C:\Windows\System\XrrVBtk.exe
  2⤵
  PID:8660
- C:\Windows\System\FQMPSWA.exe
  C:\Windows\System\FQMPSWA.exe
  2⤵
  PID:8676
- C:\Windows\System\gtICgDQ.exe
  C:\Windows\System\gtICgDQ.exe
  2⤵
  PID:8692
- C:\Windows\System\FJVpHBG.exe
  C:\Windows\System\FJVpHBG.exe
  2⤵
  PID:8708
- C:\Windows\System\eqrpZmx.exe
  C:\Windows\System\eqrpZmx.exe
  2⤵
  PID:8724
- C:\Windows\System\mBvAzNN.exe
  C:\Windows\System\mBvAzNN.exe
  2⤵
  PID:8740
- C:\Windows\System\ZzXaRZm.exe
  C:\Windows\System\ZzXaRZm.exe
  2⤵
  PID:8756
- C:\Windows\System\AuCTrjV.exe
  C:\Windows\System\AuCTrjV.exe
  2⤵
  PID:8772
- C:\Windows\System\pkosxFC.exe
  C:\Windows\System\pkosxFC.exe
  2⤵
  PID:8788
- C:\Windows\System\LJpgauw.exe
  C:\Windows\System\LJpgauw.exe
  2⤵
  PID:8808
- C:\Windows\System\kVuwhFM.exe
  C:\Windows\System\kVuwhFM.exe
  2⤵
  PID:8824
- C:\Windows\System\KTOUjlv.exe
  C:\Windows\System\KTOUjlv.exe
  2⤵
  PID:8840
- C:\Windows\System\AEEBhiq.exe
  C:\Windows\System\AEEBhiq.exe
  2⤵
  PID:8856
- C:\Windows\System\xrxvIgR.exe
  C:\Windows\System\xrxvIgR.exe
  2⤵
  PID:8872
- C:\Windows\System\gpOVwRP.exe
  C:\Windows\System\gpOVwRP.exe
  2⤵
  PID:8892
- C:\Windows\System\wAtGvZO.exe
  C:\Windows\System\wAtGvZO.exe
  2⤵
  PID:8908
- C:\Windows\System\pskvFhN.exe
  C:\Windows\System\pskvFhN.exe
  2⤵
  PID:8924
- C:\Windows\System\poMfDwM.exe
  C:\Windows\System\poMfDwM.exe
  2⤵
  PID:8940
- C:\Windows\System\izoxSVr.exe
  C:\Windows\System\izoxSVr.exe
  2⤵
  PID:8956
- C:\Windows\System\hVjGMRD.exe
  C:\Windows\System\hVjGMRD.exe
  2⤵
  PID:8972
- C:\Windows\System\SjsfFca.exe
  C:\Windows\System\SjsfFca.exe
  2⤵
  PID:8988
- C:\Windows\System\Xtiynwh.exe
  C:\Windows\System\Xtiynwh.exe
  2⤵
  PID:9004
- C:\Windows\System\mFZgsYY.exe
  C:\Windows\System\mFZgsYY.exe
  2⤵
  PID:9020
- C:\Windows\System\JFVoQnV.exe
  C:\Windows\System\JFVoQnV.exe
  2⤵
  PID:9040
- C:\Windows\System\GWAvjpw.exe
  C:\Windows\System\GWAvjpw.exe
  2⤵
  PID:9056
- C:\Windows\System\XgOlJYq.exe
  C:\Windows\System\XgOlJYq.exe
  2⤵
  PID:9072
- C:\Windows\System\EbTnEiR.exe
  C:\Windows\System\EbTnEiR.exe
  2⤵
  PID:9088
- C:\Windows\System\oLozWGp.exe
  C:\Windows\System\oLozWGp.exe
  2⤵
  PID:9104
- C:\Windows\System\yBHhvPA.exe
  C:\Windows\System\yBHhvPA.exe
  2⤵
  PID:9120
- C:\Windows\System\mvMCXtL.exe
  C:\Windows\System\mvMCXtL.exe
  2⤵
  PID:9136
- C:\Windows\System\pfpgloL.exe
  C:\Windows\System\pfpgloL.exe
  2⤵
  PID:9152
- C:\Windows\System\MJimMIn.exe
  C:\Windows\System\MJimMIn.exe
  2⤵
  PID:9168
- C:\Windows\System\VElJaJd.exe
  C:\Windows\System\VElJaJd.exe
  2⤵
  PID:9184
- C:\Windows\System\ieLtYrL.exe
  C:\Windows\System\ieLtYrL.exe
  2⤵
  PID:9200
- C:\Windows\System\dMdUbgm.exe
  C:\Windows\System\dMdUbgm.exe
  2⤵
  PID:8104
- C:\Windows\System\WgeYWoe.exe
  C:\Windows\System\WgeYWoe.exe
  2⤵
  PID:7400
- C:\Windows\System\wDiRHIr.exe
  C:\Windows\System\wDiRHIr.exe
  2⤵
  PID:7404
- C:\Windows\System\wRQxMnm.exe
  C:\Windows\System\wRQxMnm.exe
  2⤵
  PID:8284
- C:\Windows\System\zlYWyRH.exe
  C:\Windows\System\zlYWyRH.exe
  2⤵
  PID:6916
- C:\Windows\System\xUJwtGs.exe
  C:\Windows\System\xUJwtGs.exe
  2⤵
  PID:8380
- C:\Windows\System\mGyUBcR.exe
  C:\Windows\System\mGyUBcR.exe
  2⤵
  PID:8388
- C:\Windows\System\FrtzFye.exe
  C:\Windows\System\FrtzFye.exe
  2⤵
  PID:7840
- C:\Windows\System\zKMGBrD.exe
  C:\Windows\System\zKMGBrD.exe
  2⤵
  PID:8456
- C:\Windows\System\WkHtzTs.exe
  C:\Windows\System\WkHtzTs.exe
  2⤵
  PID:8300
- C:\Windows\System\kjDMhLg.exe
  C:\Windows\System\kjDMhLg.exe
  2⤵
  PID:8268
- C:\Windows\System\NiBEQtR.exe
  C:\Windows\System\NiBEQtR.exe
  2⤵
  PID:8556
- C:\Windows\System\VROfXED.exe
  C:\Windows\System\VROfXED.exe
  2⤵
  PID:8588
- C:\Windows\System\PsdEZTd.exe
  C:\Windows\System\PsdEZTd.exe
  2⤵
  PID:8368
- C:\Windows\System\qNfpWZW.exe
  C:\Windows\System\qNfpWZW.exe
  2⤵
  PID:8436
- C:\Windows\System\BSEbmWF.exe
  C:\Windows\System\BSEbmWF.exe
  2⤵
  PID:8532
- C:\Windows\System\yDbsVCr.exe
  C:\Windows\System\yDbsVCr.exe
  2⤵
  PID:8652
- C:\Windows\System\vapQTpb.exe
  C:\Windows\System\vapQTpb.exe
  2⤵
  PID:8656
- C:\Windows\System\RUsequu.exe
  C:\Windows\System\RUsequu.exe
  2⤵
  PID:8688
- C:\Windows\System\wwSljXg.exe
  C:\Windows\System\wwSljXg.exe
  2⤵
  PID:8752
- C:\Windows\System\zbfCJfN.exe
  C:\Windows\System\zbfCJfN.exe
  2⤵
  PID:8780
- C:\Windows\System\GCJoLGL.exe
  C:\Windows\System\GCJoLGL.exe
  2⤵
  PID:8668
- C:\Windows\System\wspZiZG.exe
  C:\Windows\System\wspZiZG.exe
  2⤵
  PID:8732
- C:\Windows\System\CflxHxP.exe
  C:\Windows\System\CflxHxP.exe
  2⤵
  PID:8768
- C:\Windows\System\IHFFJEz.exe
  C:\Windows\System\IHFFJEz.exe
  2⤵
  PID:8868
- C:\Windows\System\nQpxVQe.exe
  C:\Windows\System\nQpxVQe.exe
  2⤵
  PID:8884
- C:\Windows\System\wDcuKvb.exe
  C:\Windows\System\wDcuKvb.exe
  2⤵
  PID:8948
- C:\Windows\System\ouxvKBU.exe
  C:\Windows\System\ouxvKBU.exe
  2⤵
  PID:8980
- C:\Windows\System\EMNZQlP.exe
  C:\Windows\System\EMNZQlP.exe
  2⤵
  PID:8964
- C:\Windows\System\ZxpHzON.exe
  C:\Windows\System\ZxpHzON.exe
  2⤵
  PID:8996
- C:\Windows\System\CSGudyw.exe
  C:\Windows\System\CSGudyw.exe
  2⤵
  PID:9028
- C:\Windows\System\hDIjnNQ.exe
  C:\Windows\System\hDIjnNQ.exe
  2⤵
  PID:9036
- C:\Windows\System\jAWRFpe.exe
  C:\Windows\System\jAWRFpe.exe
  2⤵
  PID:9144
- C:\Windows\System\YndqKiC.exe
  C:\Windows\System\YndqKiC.exe
  2⤵
  PID:9132
- C:\Windows\System\dYxHsfQ.exe
  C:\Windows\System\dYxHsfQ.exe
  2⤵
  PID:9176
- C:\Windows\System\GIgleUi.exe
  C:\Windows\System\GIgleUi.exe
  2⤵
  PID:8252
- C:\Windows\System\Xmmgmzj.exe
  C:\Windows\System\Xmmgmzj.exe
  2⤵
  PID:8352
- C:\Windows\System\vqyEvqv.exe
  C:\Windows\System\vqyEvqv.exe
  2⤵
  PID:8236
- C:\Windows\System\qStNYNb.exe
  C:\Windows\System\qStNYNb.exe
  2⤵
  PID:9164
- C:\Windows\System\kRGtRqw.exe
  C:\Windows\System\kRGtRqw.exe
  2⤵
  PID:8220
- C:\Windows\System\qVOunAo.exe
  C:\Windows\System\qVOunAo.exe
  2⤵
  PID:8320
- C:\Windows\System\tVeakWS.exe
  C:\Windows\System\tVeakWS.exe
  2⤵
  PID:8488
- C:\Windows\System\REvHkmm.exe
  C:\Windows\System\REvHkmm.exe
  2⤵
  PID:8520
- C:\Windows\System\TXjimwV.exe
  C:\Windows\System\TXjimwV.exe
  2⤵
  PID:8604
- C:\Windows\System\NrtKdmm.exe
  C:\Windows\System\NrtKdmm.exe
  2⤵
  PID:8620
- C:\Windows\System\AmUiojh.exe
  C:\Windows\System\AmUiojh.exe
  2⤵
  PID:8704
- C:\Windows\System\wtHhjkr.exe
  C:\Windows\System\wtHhjkr.exe
  2⤵
  PID:8720
- C:\Windows\System\yfFdUTQ.exe
  C:\Windows\System\yfFdUTQ.exe
  2⤵
  PID:8748
- C:\Windows\System\jVZDZeQ.exe
  C:\Windows\System\jVZDZeQ.exe
  2⤵
  PID:8816
- C:\Windows\System\usajAzV.exe
  C:\Windows\System\usajAzV.exe
  2⤵
  PID:8952
- C:\Windows\System\iSaBTTq.exe
  C:\Windows\System\iSaBTTq.exe
  2⤵
  PID:9112
- C:\Windows\System\JnOQeAv.exe
  C:\Windows\System\JnOQeAv.exe
  2⤵
  PID:9068
- C:\Windows\System\cFwjzwD.exe
  C:\Windows\System\cFwjzwD.exe
  2⤵
  PID:8468
- C:\Windows\System\uXMSIZP.exe
  C:\Windows\System\uXMSIZP.exe
  2⤵
  PID:8516
- C:\Windows\System\ruJJlhp.exe
  C:\Windows\System\ruJJlhp.exe
  2⤵
  PID:9212
- C:\Windows\System\wXwDLvi.exe
  C:\Windows\System\wXwDLvi.exe
  2⤵
  PID:9196
- C:\Windows\System\khFyiLW.exe
  C:\Windows\System\khFyiLW.exe
  2⤵
  PID:8500
- C:\Windows\System\qbgdYlD.exe
  C:\Windows\System\qbgdYlD.exe
  2⤵
  PID:8572
- C:\Windows\System\CvgUeSI.exe
  C:\Windows\System\CvgUeSI.exe
  2⤵
  PID:8624
- C:\Windows\System\dRjGcyf.exe
  C:\Windows\System\dRjGcyf.exe
  2⤵
  PID:9000
- C:\Windows\System\xJftnSL.exe
  C:\Windows\System\xJftnSL.exe
  2⤵
  PID:8836
- C:\Windows\System\ftsHTdl.exe
  C:\Windows\System\ftsHTdl.exe
  2⤵
  PID:6712
- C:\Windows\System\aoeaZjA.exe
  C:\Windows\System\aoeaZjA.exe
  2⤵
  PID:8420
- C:\Windows\System\rJQgLkO.exe
  C:\Windows\System\rJQgLkO.exe
  2⤵
  PID:9080
- C:\Windows\System\EnnedeS.exe
  C:\Windows\System\EnnedeS.exe
  2⤵
  PID:8452
- C:\Windows\System\DSifpNe.exe
  C:\Windows\System\DSifpNe.exe
  2⤵
  PID:8848
- C:\Windows\System\eJkEjec.exe
  C:\Windows\System\eJkEjec.exe
  2⤵
  PID:9208
- C:\Windows\System\OzMSaUH.exe
  C:\Windows\System\OzMSaUH.exe
  2⤵
  PID:8900
- C:\Windows\System\TNGfNZf.exe
  C:\Windows\System\TNGfNZf.exe
  2⤵
  PID:8316
- C:\Windows\System\PaFgEcF.exe
  C:\Windows\System\PaFgEcF.exe
  2⤵
  PID:8336
- C:\Windows\System\iDyOgZX.exe
  C:\Windows\System\iDyOgZX.exe
  2⤵
  PID:9228
- C:\Windows\System\RSBBRqL.exe
  C:\Windows\System\RSBBRqL.exe
  2⤵
  PID:9244
- C:\Windows\System\XLrMzkH.exe
  C:\Windows\System\XLrMzkH.exe
  2⤵
  PID:9260
- C:\Windows\System\OblOdqq.exe
  C:\Windows\System\OblOdqq.exe
  2⤵
  PID:9276
- C:\Windows\System\AVwqPiU.exe
  C:\Windows\System\AVwqPiU.exe
  2⤵
  PID:9292
- C:\Windows\System\vPsyYez.exe
  C:\Windows\System\vPsyYez.exe
  2⤵
  PID:9308
- C:\Windows\System\NeshdOf.exe
  C:\Windows\System\NeshdOf.exe
  2⤵
  PID:9324
- C:\Windows\System\ndaScdi.exe
  C:\Windows\System\ndaScdi.exe
  2⤵
  PID:9340
- C:\Windows\System\uWnaHaQ.exe
  C:\Windows\System\uWnaHaQ.exe
  2⤵
  PID:9356
- C:\Windows\System\MRTBdKj.exe
  C:\Windows\System\MRTBdKj.exe
  2⤵
  PID:9376
- C:\Windows\System\btprFMh.exe
  C:\Windows\System\btprFMh.exe
  2⤵
  PID:9392
- C:\Windows\System\IkzXTnp.exe
  C:\Windows\System\IkzXTnp.exe
  2⤵
  PID:9408
- C:\Windows\System\RjPeNmD.exe
  C:\Windows\System\RjPeNmD.exe
  2⤵
  PID:9424
- C:\Windows\System\bPAjhPm.exe
  C:\Windows\System\bPAjhPm.exe
  2⤵
  PID:9440
- C:\Windows\System\GIEQaFH.exe
  C:\Windows\System\GIEQaFH.exe
  2⤵
  PID:9456
- C:\Windows\System\GqGyKDh.exe
  C:\Windows\System\GqGyKDh.exe
  2⤵
  PID:9472
- C:\Windows\System\MkiUMIT.exe
  C:\Windows\System\MkiUMIT.exe
  2⤵
  PID:9488
- C:\Windows\System\SYqJGwf.exe
  C:\Windows\System\SYqJGwf.exe
  2⤵
  PID:9504
- C:\Windows\System\GjagbUD.exe
  C:\Windows\System\GjagbUD.exe
  2⤵
  PID:9520
- C:\Windows\System\ShjuOOW.exe
  C:\Windows\System\ShjuOOW.exe
  2⤵
  PID:9536
- C:\Windows\System\qHXwdQA.exe
  C:\Windows\System\qHXwdQA.exe
  2⤵
  PID:9552
- C:\Windows\System\bMippbm.exe
  C:\Windows\System\bMippbm.exe
  2⤵
  PID:9568
- C:\Windows\System\HVezDrg.exe
  C:\Windows\System\HVezDrg.exe
  2⤵
  PID:9584
- C:\Windows\System\FRgXzcL.exe
  C:\Windows\System\FRgXzcL.exe
  2⤵
  PID:9600
- C:\Windows\System\UeMRVmW.exe
  C:\Windows\System\UeMRVmW.exe
  2⤵
  PID:9616
- C:\Windows\System\jszNVjJ.exe
  C:\Windows\System\jszNVjJ.exe
  2⤵
  PID:9632
- C:\Windows\System\pDlJsMQ.exe
  C:\Windows\System\pDlJsMQ.exe
  2⤵
  PID:9648
- C:\Windows\System\pIJPlbv.exe
  C:\Windows\System\pIJPlbv.exe
  2⤵
  PID:9664
- C:\Windows\System\zqHBtCv.exe
  C:\Windows\System\zqHBtCv.exe
  2⤵
  PID:9680
- C:\Windows\System\qkcqHIq.exe
  C:\Windows\System\qkcqHIq.exe
  2⤵
  PID:9696
- C:\Windows\System\LiZJYhN.exe
  C:\Windows\System\LiZJYhN.exe
  2⤵
  PID:9712
- C:\Windows\System\zmMJwQf.exe
  C:\Windows\System\zmMJwQf.exe
  2⤵
  PID:9728
- C:\Windows\System\WiEbPay.exe
  C:\Windows\System\WiEbPay.exe
  2⤵
  PID:9744
- C:\Windows\System\LuasNOO.exe
  C:\Windows\System\LuasNOO.exe
  2⤵
  PID:9760
- C:\Windows\System\kdvAcAr.exe
  C:\Windows\System\kdvAcAr.exe
  2⤵
  PID:9776
- C:\Windows\System\ZmKGYfL.exe
  C:\Windows\System\ZmKGYfL.exe
  2⤵
  PID:9792
- C:\Windows\System\DEPRpDy.exe
  C:\Windows\System\DEPRpDy.exe
  2⤵
  PID:9808
- C:\Windows\System\RAzqCiF.exe
  C:\Windows\System\RAzqCiF.exe
  2⤵
  PID:9824
- C:\Windows\System\BuvtuHP.exe
  C:\Windows\System\BuvtuHP.exe
  2⤵
  PID:9840
- C:\Windows\System\YrNSoOQ.exe
  C:\Windows\System\YrNSoOQ.exe
  2⤵
  PID:9856
- C:\Windows\System\dexNpHz.exe
  C:\Windows\System\dexNpHz.exe
  2⤵
  PID:9872
- C:\Windows\System\aLCKlxG.exe
  C:\Windows\System\aLCKlxG.exe
  2⤵
  PID:9888
- C:\Windows\System\VSzRqUf.exe
  C:\Windows\System\VSzRqUf.exe
  2⤵
  PID:9904
- C:\Windows\System\lhIrAZr.exe
  C:\Windows\System\lhIrAZr.exe
  2⤵
  PID:9920
- C:\Windows\System\ddynMfU.exe
  C:\Windows\System\ddynMfU.exe
  2⤵
  PID:9936
- C:\Windows\System\PcouQfI.exe
  C:\Windows\System\PcouQfI.exe
  2⤵
  PID:9952
- C:\Windows\System\DPfNjfU.exe
  C:\Windows\System\DPfNjfU.exe
  2⤵
  PID:9968
- C:\Windows\System\EcYYmZc.exe
  C:\Windows\System\EcYYmZc.exe
  2⤵
  PID:9984
- C:\Windows\System\LdluTUW.exe
  C:\Windows\System\LdluTUW.exe
  2⤵
  PID:10000
- C:\Windows\System\krMXCii.exe
  C:\Windows\System\krMXCii.exe
  2⤵
  PID:10016
- C:\Windows\System\IeNaPyl.exe
  C:\Windows\System\IeNaPyl.exe
  2⤵
  PID:10032
- C:\Windows\System\SVLFmli.exe
  C:\Windows\System\SVLFmli.exe
  2⤵
  PID:10048
- C:\Windows\System\uRCLUps.exe
  C:\Windows\System\uRCLUps.exe
  2⤵
  PID:10064
- C:\Windows\System\IecSkpv.exe
  C:\Windows\System\IecSkpv.exe
  2⤵
  PID:10080
- C:\Windows\System\fsskCoB.exe
  C:\Windows\System\fsskCoB.exe
  2⤵
  PID:10096
- C:\Windows\System\vRwuJHZ.exe
  C:\Windows\System\vRwuJHZ.exe
  2⤵
  PID:10112
- C:\Windows\System\pdJFXyo.exe
  C:\Windows\System\pdJFXyo.exe
  2⤵
  PID:10128
- C:\Windows\System\GXkyzQJ.exe
  C:\Windows\System\GXkyzQJ.exe
  2⤵
  PID:10144
- C:\Windows\System\GKDoWyh.exe
  C:\Windows\System\GKDoWyh.exe
  2⤵
  PID:10160
- C:\Windows\System\jZFZheE.exe
  C:\Windows\System\jZFZheE.exe
  2⤵
  PID:10176
- C:\Windows\System\VXbVJag.exe
  C:\Windows\System\VXbVJag.exe
  2⤵
  PID:10192
- C:\Windows\System\oHqkJLW.exe
  C:\Windows\System\oHqkJLW.exe
  2⤵
  PID:10208
- C:\Windows\System\MyGDdMT.exe
  C:\Windows\System\MyGDdMT.exe
  2⤵
  PID:10224
- C:\Windows\System\MPdBEkh.exe
  C:\Windows\System\MPdBEkh.exe
  2⤵
  PID:9220
- C:\Windows\System\suKKbVm.exe
  C:\Windows\System\suKKbVm.exe
  2⤵
  PID:9032
- C:\Windows\System\nCUldBd.exe
  C:\Windows\System\nCUldBd.exe
  2⤵
  PID:9252
- C:\Windows\System\TdKnKTd.exe
  C:\Windows\System\TdKnKTd.exe
  2⤵
  PID:9316
- C:\Windows\System\fEWtEpl.exe
  C:\Windows\System\fEWtEpl.exe
  2⤵
  PID:9384
- C:\Windows\System\kfnMPej.exe
  C:\Windows\System\kfnMPej.exe
  2⤵
  PID:9268
- C:\Windows\System\dTcYdEs.exe
  C:\Windows\System\dTcYdEs.exe
  2⤵
  PID:9304
- C:\Windows\System\IQeeOOp.exe
  C:\Windows\System\IQeeOOp.exe
  2⤵
  PID:9368
- C:\Windows\System\geLchin.exe
  C:\Windows\System\geLchin.exe
  2⤵
  PID:9436
- C:\Windows\System\EpzOLyG.exe
  C:\Windows\System\EpzOLyG.exe
  2⤵
  PID:9464
- C:\Windows\System\YeBlxuL.exe
  C:\Windows\System\YeBlxuL.exe
  2⤵
  PID:9512
- C:\Windows\System\gKokrXe.exe
  C:\Windows\System\gKokrXe.exe
  2⤵
  PID:9576
- C:\Windows\System\WMxRsxQ.exe
  C:\Windows\System\WMxRsxQ.exe
  2⤵
  PID:9640
- C:\Windows\System\MRLWnnr.exe
  C:\Windows\System\MRLWnnr.exe
  2⤵
  PID:9704
- C:\Windows\System\TGcqiYC.exe
  C:\Windows\System\TGcqiYC.exe
  2⤵
  PID:9768
- C:\Windows\System\XuEZoLG.exe
  C:\Windows\System\XuEZoLG.exe
  2⤵
  PID:9832
- C:\Windows\System\ZJNcAqq.exe
  C:\Windows\System\ZJNcAqq.exe
  2⤵
  PID:9868
- C:\Windows\System\vRyayrC.exe
  C:\Windows\System\vRyayrC.exe
  2⤵
  PID:9932
- C:\Windows\System\pTuLASA.exe
  C:\Windows\System\pTuLASA.exe
  2⤵
  PID:9996
- C:\Windows\System\ECwsfFb.exe
  C:\Windows\System\ECwsfFb.exe
  2⤵
  PID:9528
- C:\Windows\System\LMECCfk.exe
  C:\Windows\System\LMECCfk.exe
  2⤵
  PID:9560
- C:\Windows\System\geEUZqP.exe
  C:\Windows\System\geEUZqP.exe
  2⤵
  PID:9624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BhOALcN.exe

Filesize
2.0MB

MD5
86d3e05ba8f11390939bbf855c545140

SHA1
babdc793faa0a1296b9b0f37a14aa58ae6a7ab3f

SHA256
f80a3616093e5ba11ed57d5aac491b9681797f9fdadb765e25e7f4b3fc4fea2f

SHA512
e774a5d3ecdb540887422fbf2a3c5e10e68079c8f545580a01f942cce83040f01abd94c63331ab42d8af0390d42dc8ba6ab0ac1f28ef0c7903d19bb5ce441465

Download Submit
C:\Windows\system\CZztSJn.exe

Filesize
2.0MB

MD5
ec53597d114643fc793d85914f476cbe

SHA1
cfbf11a357fcce6d8b855578feea03cac3305782

SHA256
655bf82141122f4aef306346aaaaa5bc93d48189493b342a186fc74eceb3cfdf

SHA512
994f00301606af5f501c592f9a70b984708fa96fbc4ca01c239b19199c0612e9e9a787c48717c3cf1654f1df353f1bb32f22da8414409d91b14001a8dd6f9ddc

Download Submit
C:\Windows\system\CaKzbuS.exe

Filesize
2.0MB

MD5
d32543f8f3804f260104ecad53c347e5

SHA1
534cd6d1a61927471e530d3d2d504e7dd68d688c

SHA256
8bf3f0e22bc166f7b72dbc559ad4cbce04abeff8f2eafdc48bd35ed69d3f4431

SHA512
19afcdb6bf77b0b052d581c59e6fc1b4679217600b5a319ec1ccbe55c93b85f7654a26db6c2ebcb642358622a96fa649639dc9c5afc40c1fd5e28955896b7b01

Download Submit
C:\Windows\system\DlhGcso.exe

Filesize
2.0MB

MD5
794efd2c315d0c3b6119cd155908f269

SHA1
c2ca3cd6e607852773fa9e9727c06b33c0fc0bd7

SHA256
753b276db5f59b9a4d5d5ba3a002a384ec419cadceaa569a7fc2f8843b633f2b

SHA512
e1a2b295e4fcbf30c2b0b1688cfc931521fab68aa8458ae2004a55826dfcd941f5baeccb898cd76333553bb65961f8054e974691802513de7aa24e04a35615ad

Download Submit
C:\Windows\system\EmZFFMI.exe

Filesize
2.0MB

MD5
26ded0335617a339dfacbc33d836e2cc

SHA1
ee3fd201141838b47663b8a12e49fcbd170c5d01

SHA256
965b6abd9e17f52aa0f5174ec1098777332b2b76c1b3d157452e3a1846842480

SHA512
deb36825c90047e9226f5b6480d205594d9a13ff981ba48c7f142543006032e98cdf4257fd85925f65e5afcf05a692584e3190c6f574056acdf919dafa097946

Download Submit
C:\Windows\system\FSoDkQt.exe

Filesize
2.0MB

MD5
3cca6bc279b8ffce1a51b313fe0b0ded

SHA1
25ae4359de2acebbafc1f52d8eba137c298783bc

SHA256
666eed7e89ce13a034f9956ca5e52b665d36c6ee912d92b860628f5775c135d3

SHA512
6b5b7f0fa5546861fc97cff1e775a09ee4cd747db4efea9fe7511673710daf57dc89857c2863e669d446706aa76ed640dbddba927bfd2b89be3251f57634cd3e

Download Submit
C:\Windows\system\GFtVXgg.exe

Filesize
2.0MB

MD5
b2e7ac26cd914c6dfb16c7a8f2f35778

SHA1
760ebacdaaaf26e7bbfba9655aaf88451da2c644

SHA256
d9c4c88c27ab8c48bee36b0da51e767aec3d2f37d8e2daf45189451a3c35bb51

SHA512
eef973384db7b6b609fb21706f2c23e5b712de65fdbc4bc05792c5b0f60f619c80fdb48aad2b159c5a600ec20d5617b8a726a31997a89cf76506b721b3eef3a4

Download Submit
C:\Windows\system\GQDHMFl.exe

Filesize
2.0MB

MD5
04d93cd3563ab674ffe26881b935f79b

SHA1
c6339d9c2ac0c8e20e4abbc30d58126b55d0f09c

SHA256
e23fee518ff4d9a92f924ca70eaf739d27a9cd69775e5a4e07c07dd1332e3d67

SHA512
2c075c8565698f6fb5f82fea5c774433cb1573d1e15546ffd4380063ab4886fbddd2105c3b4696f9fd01980ac2e41fa3dddb754733506e4de466f400f51109c5

Download Submit
C:\Windows\system\HJCnfyd.exe

Filesize
2.0MB

MD5
9426203c0ff97cbc24ab3a66fdf3c50a

SHA1
88f396fc815b3f358755ec7ac8477cf80da76b4f

SHA256
3e1628168c55cff9ee33dab37a771753d480911d93c339fea1a4a186041f03c5

SHA512
20151ae2e665ce5824d01926fb6053c7b8c806b3698a4654554e50b46d768ef60e933bf3c2de262834b7c2c719af84cd9d2618b3397e7269dec8045944e73373

Download Submit
C:\Windows\system\IGIgQBB.exe

Filesize
2.0MB

MD5
2b5f42d9cc4f8feab2f356d4df621550

SHA1
6012da8b4a2315e1100842fd3ec13715055ed1df

SHA256
fa22593edb61457b0c8aac048b3b91c390254b8662915a967b15396bcaa6c096

SHA512
70eb71de2219a7dd56b0ec3af89db8dbbadd781b81d114e184344bd6b07b2a23d91872a56d0f8fba0aa5c60f253a2d09bddff7707b05b606c06ea5f030a5dc6b

Download Submit
C:\Windows\system\KhrhCpC.exe

Filesize
2.0MB

MD5
08c035e687dff1b1853b3d1a83823e1e

SHA1
9a6d22c0ea0779192dbb0c757ecd66dcbc5ece5c

SHA256
a672cc319de34de89dae3b337805909ca9c3e1116d33830aa9c5b6715b0e61a8

SHA512
0f9526cf507a2bc3a0be1f3dcda7fb2cffcec1102342eaa3be4bece8676dedfa42b595c1f2e64672220a194598ec8b1be56f5995d1a95357eefacdddbf5be61c

Download Submit
C:\Windows\system\MVaPSeq.exe

Filesize
2.0MB

MD5
068bbbfcafd6eea24bf5f45b5ca72fed

SHA1
2be4547a06b61ccbb1db634f5a4dddbdfb187292

SHA256
0b2a8a7ca7ddcf767fafa424c9e6b1dc38d65dbc28bc2f50c517923e09992548

SHA512
beb9dc0d2387eea38e1c83b47e7d254e9d3e1de51e56ebe64a595f0622cfb7fcbd9b14f4cbe64a535b8b3c0474202214a69cb32b0dc50adc9c0d2a9d1cce5d9c

Download Submit
C:\Windows\system\NZpgvQa.exe

Filesize
2.0MB

MD5
77f77ecb0f680615b4ab4c45b28dbaeb

SHA1
a3ac1110f3a768dfc5f2e4419ad2dd16bf512dd5

SHA256
66527c170a6154a34c8832ee52431302f43e20fcbcd562248dbdb57d03ee9fdf

SHA512
95aef8bfcc9c9de5d1d413a43e9bddbec29433329a95f7ceb6a0a797166b43f2fdfc6575515366aef3cb8dc52efeb9ca81c633a70317d70679357ad8f55f1fdd

Download Submit
C:\Windows\system\PEgKnVW.exe

Filesize
2.0MB

MD5
9e22b254eaf21c774aa96b2871f96e00

SHA1
d56a0b1b08431578db29e2d9ce69ded2a94449b4

SHA256
e563811ba6fc5522b969ffac3a6cfeaad163e14b5b3a9a236401e590671fea79

SHA512
6583672e4fa5c08d0a59323b5cea602789d2a16c33f6702416d2416fdfca2457915231cd9db30322af28b24da16ae5d2cc3e4b5d752dc53d55f06f9143f0b0c4

Download Submit
C:\Windows\system\PyBSrrG.exe

Filesize
2.0MB

MD5
bbefe6d8b27f6b8166201442f03e5194

SHA1
6ce6e6f9dd55143788b8d8a69188f1c7b08b6c86

SHA256
a898baa09484de925b553a719682aec08b8bb46a73db3a48a0394ec4483914cf

SHA512
5649fcff540286b98aba04b0f6b6d3bfb5348e015d66a20cc5b62e0d85ab72f8e23d13e7166c0abbfa8ece04dc6b5ef6b49f1e1e361654902e68fd7ad30eb37b

Download Submit
C:\Windows\system\SAYqNrc.exe

Filesize
2.0MB

MD5
04b74e2daf12e2505791af236a65bc78

SHA1
3a3be45a8c3a885860f69d84e4536adcdc774e8a

SHA256
e4866385012742da60f8441d82b0c2bcd603a3f9ada6720f41ba8dff34ef34ae

SHA512
9ede741aa4bd2ab5c0e9eba095f831425a9e5dd0148e5137e82ce1bc8fa2eeb6ed8f60a6d1295fa9a04960afcde13922407ffbca1943c68d05c260a3f6242487

Download Submit
C:\Windows\system\WnelXRW.exe

Filesize
2.0MB

MD5
b985b7f80478390718ec716e6c10648e

SHA1
f17825f591a32432547a7e98b2b6ca56f69453c3

SHA256
47d8b34cb1be2313a50dd32df3b20d26ed08e6cc02a3e32cc81e773ec26f4e8b

SHA512
74072e01d1678d01711eaa140edbd0a71f410813785fddf170f83cd05312c8bcd952fd02d65cecf45dbbb726a875ba92802ebc644a4919a27afc54bb54acedf3

Download Submit
C:\Windows\system\YXIGgLm.exe

Filesize
2.0MB

MD5
bd2becf7bb23546bbdb7905de21ce954

SHA1
4a3d7662b3f9b061c4f4f7183b6d56bfba6256c5

SHA256
6d1eb56d96a19a55cc2efa2a969d85465fb24c156a78086725a15e477d4f00fc

SHA512
4058c81bf1036b81288cd5385e68b9e71216301c77fc57328f5283b61570cca4ff7d04d95ad5aa9c2b3b3bb605a8c15bf0b0e3d44c7ba227fd6222eb8429fb0d

Download Submit
C:\Windows\system\ZOetpDi.exe

Filesize
2.0MB

MD5
83c92df5c7024a3144875e8be04ebdf8

SHA1
200f360c8e1bb783ca06751109b0dca148f2d96c

SHA256
3cf2a780b71bc2214b9218ce2ca8dee5ade5192b2453db1e8ad0fbfd8509e0d9

SHA512
bfe099ed171cb185450afaab90f671b6a66afab79364d21a9e296fc4958ddac9cfcb34b29fe3895d9810f082cd46c4681feaf1ea70bf687963fff83a41409807

Download Submit
C:\Windows\system\bRwAjcZ.exe

Filesize
2.0MB

MD5
eea9cca39ee680d3c46210fdd76cd034

SHA1
c39eb35578f4df820e7c022c5adc1c3aef9e8c87

SHA256
694f0422c638a19a75933c3ef6b979def7e434943c4808eb8a5975b438e4b174

SHA512
d60201f95a589d9c68f35d7c49a470476ec109bae8e080ec8f0d93d1b472eef18f5025b63bef16aa8954e2419f1a383d4020c394917a60e550f8fa48a88c116c

Download Submit
C:\Windows\system\cWmFWrj.exe

Filesize
2.0MB

MD5
edf4be8300aaec470ae1dfcf2e0195c1

SHA1
2af5d7a4d75e8923da0996bcf7c8a9b27fa07250

SHA256
60c3a01c6f72345af3c73accdc8248d5a0d56882cfa731ca8771e00c6282b68d

SHA512
2947a0b0deecdcb9eba5363108d165ff87d95fc42ac18295c1de0a1ace613939b4a04f48d93f299ed3e45c79f8a084a308ab643379680f91377abc2b99bb05c9

Download Submit
C:\Windows\system\jZnrbtD.exe

Filesize
2.0MB

MD5
ae1c6cdab5084495aeec6f72ec0bd282

SHA1
fa5a0994ed35e4a8310137aa5565858ad5e21319

SHA256
4d629df1f7ccb8c26c95678d4fcf22e50863d16667145dabe80877d7c823fd23

SHA512
67f9920d191219ffdfb2877cf5a24e6b8fb1def326729e29fb7d6ffb7085fcfa0fdba974d7a830b405634bf377407a7a0de30f741942c05e8ecf3c61979e921a

Download Submit
C:\Windows\system\kNAPUOS.exe

Filesize
2.0MB

MD5
52669104792dbbd52e211eb36f4e2d5e

SHA1
1481660002891ad1282efcb419f7e0d21d2badcf

SHA256
453093fa14fb29b3471531423a986d2dba856a5e87353db2cdcb97a9ecbe75dc

SHA512
875331f420f0f206f2b89891a5aa0322c984ac0ef26a9b91ff5c894cb445f8b4b5199b9e6587a8ed9f7182076b6b921ef99fea209abd7bcc2570d4531afa5443

Download Submit
C:\Windows\system\kjSTNWv.exe

Filesize
2.0MB

MD5
6199fcbbb0957244fa400f63af7717ae

SHA1
574131727ed0614dd047b4bbdecf746d80276502

SHA256
888b0ab4dcae93e54b6666278cd7b84447e9d69586627c9f71e3360c00c52800

SHA512
4ffb7b8f59fcef2e54e2110f966c315a88f98437ca59c62f8c9026fa622f5924c4a371c2540f013f0ca0c38e95c7f14b7217245e43ebd6a8b982b0b07ce7ffb4

Download Submit
C:\Windows\system\nMvVGrZ.exe

Filesize
2.0MB

MD5
928aa0c9311e3f8dbb48a9c4b90dfe3a

SHA1
883a8e4add8df048f202f8bcf82a37c1428d9bd6

SHA256
2223e0440b1d6b804e95622ceeea45f996f14f9ec4d7680509428ed7c5529c13

SHA512
255593c96507b93c7c3dca4374e72271a7565c3a2fdd0603351bbc983394a68c1a23a0f2b84860fb8b7aca76cc34021701481d23bcf1fdd691ab0df299dd310e

Download Submit
C:\Windows\system\qyrCPUU.exe

Filesize
2.0MB

MD5
89df1df2bb350fdbb1324c417b72e55e

SHA1
50a2e1d2d2342f3caace48f1e393b22d922639ea

SHA256
914cbfad8073811c1c1a9f031cfa406d34de6f14c63457ad935de29cd74261d6

SHA512
ce3326d07046b00cfdb73d5bb0d591b211024ca4a7d770a357c4d1a1de2fbbbb2d730041eab97ac0383795dba2e4a67d3eca7ae469a795f09786105d572c9432

Download Submit
C:\Windows\system\rYQIEcJ.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\system\shknFBt.exe

Filesize
2.0MB

MD5
b2ed396a5669067cd8b43d18a0b52d0e

SHA1
251be62e385e56ea11a291798cccef5c834a14e8

SHA256
fdcc3aa67a9e7dfdccc4af5a11e1ec7cadb499b9f344e37029177aa3dec852c0

SHA512
dd70fd4f508614fe18c91d0a6943667870d6c3c50ac391b56cff890d46e0b7dfed39bf187cde2ac74c873a5bc015c87375bc1208b8928272904ad67feb133793

Download Submit
C:\Windows\system\tdDsyyY.exe

Filesize
2.0MB

MD5
d56f8ce100e5b6352dd9f48a783e8070

SHA1
13338d84c0c475b276924c68cfeac03f5b321fbb

SHA256
e9bcff1cf71eb167ba00b4a62f3d50bf842288e8bd031056a99fa03e7752601c

SHA512
a47584d4ca7062ed8fdd4ff653f0de5eb62b876011148fd82226ffc2121412973213df150565803e271fcd8548243496840a0fc1ac842268a333de3338d1efb8

Download Submit
C:\Windows\system\xtrZWRU.exe

Filesize
2.0MB

MD5
3f1b79e3a8ec2c4ee95d7df794b01100

SHA1
af12357d631731943063075aec7f542590560983

SHA256
36b0d8af7b55a1d309f2ec04f6eacc1dad42484c7e3e1eae37ca348bc45abb84

SHA512
62a570663e495bbf7442c43faddea830564b03828a932f361590294ddbb0cec57ac2e331d7cf5a73c76737e3d057d2ae6d3f0046984ac5d0dae5eb252d658222

Download Submit
C:\Windows\system\zTpvFlQ.exe

Filesize
2.0MB

MD5
0216d02ea71078fe38c636369ab55f39

SHA1
5ad26878456d31b9110fb12d5685f1fd54226df4

SHA256
94878fdfd62406f12d6ef5ea88b2078e63fdb5dfafe70d5af3fff31190efc4b9

SHA512
7ac58daeded79da5141375739e18dbd79b1b17bcc90f79436d6e12203b561e15bfb109ea13b640b1428bbfa0fc59156dada706f46a52d431270634c151597d5e

Download Submit
\Windows\system\MroVHLE.exe

Filesize
2.0MB

MD5
79f204ed3506cafa45671e76f0d722f6

SHA1
1268dc05f3387b6227861cd4a7cc93361e6726db

SHA256
541b0684f3783d0c13fea99398804f8ff53d1398e1b7b8eecf60471c363f755b

SHA512
b1c14a7d1a161494ecbd81882c4be7c5ceaf9b6a8eee75bd9bdd04f0e8bf55e397b6baa80929ae3665f6d2b09cbee6c38d9343637da18d9e4a1ef88d132a4275

Download Submit
\Windows\system\RSpfchC.exe

Filesize
2.0MB

MD5
46897541b3d18dc73b26c6a01ad5e8a7

SHA1
5c92ea9f571db61662e9c174eacc49ed114deb84

SHA256
d0b137e5611ce81e3b40a04c0d2d285ccca8308ad188f212d8c1632d72af708d

SHA512
bc8817ef23ec3f985bb36ec0d5e97f06adf6b2a348370c998da7c399a99bfa5727ebb76f35b2c04bec28ddc1ec0253698df456c22718fa314ead6cf980e703c5

Download Submit
\Windows\system\cKjSZVE.exe

Filesize
2.0MB

MD5
a0a36add7eec3c711f1829b932098de9

SHA1
333a132f59424c7ca69370fd0f5a9eb7073679c0

SHA256
d7725902edf9da0ff93a47030c4fcb41a101cf4cc7b1e76882abf202d3e023eb

SHA512
9e6423bccb7a67ce9e8be049c3d420e42aaffc300dcd2c12810863eff0f28d5092e7f0f4e894fab17d60a4771154df831286bb1b15821d6d6e6444e40984bb03

Download Submit
memory/1996-233-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-4268-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-234-0x0000000003750000-0x0000000003B42000-memory.dmp

Filesize
3.9MB

Download
memory/2116-1-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2116-215-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-12638-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-211-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-203-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2116-12105-0x0000000003750000-0x0000000003B42000-memory.dmp

Filesize
3.9MB

Download
memory/2116-223-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2116-12102-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2116-226-0x0000000003750000-0x0000000003B42000-memory.dmp

Filesize
3.9MB

Download
memory/2116-12111-0x0000000003750000-0x0000000003B42000-memory.dmp

Filesize
3.9MB

Download
memory/2116-232-0x0000000003750000-0x0000000003B42000-memory.dmp

Filesize
3.9MB

Download
memory/2116-4344-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2116-17-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-8-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-252-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-201-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2116-218-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2244-216-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-4267-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-227-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2352-4312-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2456-111-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2456-262-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2456-247-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2456-197-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2456-18-0x000007FEF5A5E000-0x000007FEF5A5F000-memory.dmp

Filesize
4KB

Download
memory/2456-106-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2456-199-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/2536-222-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2536-4288-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2596-225-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2596-4269-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2676-4264-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-198-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-4307-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-212-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-4262-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2724-207-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2756-4300-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2756-245-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2776-202-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-4271-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-200-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2852-4265-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-9-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download