xmrig | a16d6ded382da6921e1c1f7eb0ae7f5bedc8de9bae20d85e00687419db782e12

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
Size

1.8MB
MD5

b7533358a79f4b70f1759e094667e087
SHA1

cacb5df01f953118578ec4be3eac73bff129e204
SHA256

a16d6ded382da6921e1c1f7eb0ae7f5bedc8de9bae20d85e00687419db782e12
SHA512

ef3a69ecb1ead3edc9e92cf398da42101f30ce0c3013dad105e71f06c11c9146bd5a3d1d85369008e819033d7ac5ebd24e5e0238efab75b50a8c011f20a6e61d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zc:Lz071uv4BPMkibTIA5lCx7kvRWa4puWp

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-166-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2560-169-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2496-167-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2284-165-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2824-164-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2180-160-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2604-159-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2548-141-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2908-108-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/1996-90-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2824-5152-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2548-5154-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2496-5153-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2908-5173-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2284-5169-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/1996-5202-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2604-5190-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2640-5156-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2560-5199-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1996	zKqhgRC.exe
2908	vULeiMU.exe
2548	hDrtqxs.exe
2604	VeRlFPW.exe
2824	sgDiTEz.exe
2284	vUwZkHI.exe
2640	vMXKlXM.exe
2496	JDnbawu.exe
2560	UpXeSMg.exe
2572	AOIFCJV.exe
2532	iNZEMBo.exe
3052	FcsAqCH.exe
1784	RmZiyoA.exe
1972	NJLMESo.exe
1888	fqchhGi.exe
952	kUJrJpd.exe
1080	KmFxAFB.exe
1772	WElwOMk.exe
2480	xtQiCdU.exe
1436	IlsykuC.exe
2988	ITnmWev.exe
1176	fcTVZiz.exe
2800	nmBgvkj.exe
2888	IpHgkKy.exe
2388	xYZoBGp.exe
2060	mNlniSv.exe
2052	VpQRPnh.exe
2344	HMUEJCZ.exe
1092	TNEjCNS.exe
804	qBlkBFK.exe
2680	XUOnTxj.exe
1380	fFsUQaV.exe
1284	dEeMEOb.exe
2436	pgwdeRi.exe
1400	oOxydXa.exe
1112	SvrIayo.exe
1856	ZLbhPsg.exe
1144	SqxUUch.exe
572	VhurpqB.exe
704	wBrHQJv.exe
1108	UWKHckr.exe
3040	WhfXHuS.exe
1832	GZTaoeZ.exe
2852	QybBrIh.exe
2760	iMWngxr.exe
2848	rTPUUwA.exe
880	ILOjilx.exe
2944	ylVzpim.exe
1840	EfcqDCy.exe
2660	bYlmFmr.exe
2220	hEuGXlx.exe
1612	Rgverje.exe
2804	xUqPhzD.exe
2600	YixOSxP.exe
2700	bkNqMXw.exe
2504	dyKmUDK.exe
2076	ZkMjHSh.exe
2056	pefvCrp.exe
1824	aWsxZJS.exe
2512	dBFwYMb.exe
2340	qKLsaTB.exe
2320	DCzDOyt.exe
1528	ZpBxkSk.exe
2432	UFPtQmD.exe

Loads dropped DLL 64 IoCs

pid	Process
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x000a000000013a21-6.dat	upx
behavioral1/files/0x000d00000001342b-3.dat	upx
behavioral1/files/0x00070000000142b0-21.dat	upx
behavioral1/files/0x000700000001447e-48.dat	upx
behavioral1/files/0x000700000001448a-124.dat	upx
behavioral1/files/0x0006000000015616-158.dat	upx
behavioral1/memory/2640-166-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/files/0x0006000000014825-180.dat	upx
behavioral1/files/0x0006000000014de9-186.dat	upx
behavioral1/files/0x0006000000014b31-184.dat	upx
behavioral1/files/0x0006000000014abe-182.dat	upx
behavioral1/files/0x00060000000146c0-178.dat	upx
behavioral1/files/0x000f000000005578-176.dat	upx
behavioral1/memory/2560-169-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2496-167-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2284-165-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2824-164-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x0006000000015b6f-161.dat	upx
behavioral1/memory/2604-159-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x0006000000015c52-157.dat	upx
behavioral1/files/0x00060000000155ed-122.dat	upx
behavioral1/files/0x0006000000014ef8-121.dat	upx
behavioral1/files/0x0006000000014b70-120.dat	upx
behavioral1/files/0x0006000000014af6-119.dat	upx
behavioral1/files/0x00060000000149f5-118.dat	upx
behavioral1/files/0x00060000000147ea-117.dat	upx
behavioral1/files/0x00070000000146b8-116.dat	upx
behavioral1/files/0x00060000000155f7-114.dat	upx
behavioral1/memory/2548-141-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0006000000014667-113.dat	upx
behavioral1/files/0x000a0000000142c4-62.dat	upx
behavioral1/files/0x0006000000015018-102.dat	upx
behavioral1/files/0x0006000000015c3d-154.dat	upx
behavioral1/files/0x0006000000014539-130.dat	upx
behavioral1/files/0x0006000000015605-126.dat	upx
behavioral1/files/0x00060000000155f3-110.dat	upx
behavioral1/files/0x0006000000015626-148.dat	upx
behavioral1/files/0x00070000000144ac-49.dat	upx
behavioral1/files/0x000a0000000143ec-109.dat	upx
behavioral1/memory/2908-108-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/1996-90-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x0008000000014390-47.dat	upx
behavioral1/files/0x00070000000141e6-30.dat	upx
behavioral1/files/0x00080000000141c0-20.dat	upx
behavioral1/memory/2824-5152-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2548-5154-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2496-5153-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2908-5173-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2284-5169-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/1996-5202-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2604-5190-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2640-5156-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2560-5199-0x000000013F840000-0x000000013FC32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CeAsjBB.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\aAdRjvZ.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\ATHjpvP.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\PALdaVa.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\pgxdzvP.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\lMKKWvm.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\QhgzWuz.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\FRYmxjJ.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\KbKDALt.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\ZBIoNmE.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\HcBJiof.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\ufOuusm.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\fOHoGXs.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\RMLHPAP.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\MWJKNay.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\MrMlXNr.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\bDXXcaO.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\PPXMWjw.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\rxEhTHY.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\LZysbbl.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\ZtnNdCA.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\xTvkzgo.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\WuXmkpU.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\HBlwThh.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\GZFLTuV.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\AGyXhcM.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\wDKbXMg.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\SSNaEtm.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\lTkBjvN.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\GhEhIUI.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\rWcTntv.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\HPVFeBU.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\qGGfNWb.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\XxFiRmL.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\iwacXjX.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\AharMKJ.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\HnUmYvV.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\HilBJBC.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\bwGdNxd.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\gPGgTDt.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\kXfZTOj.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\UBKLYgM.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\sMLksEj.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\TCGTSbv.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\uglXeeo.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\MDtkPjm.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\zLSnURz.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\eoHgPsc.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\CVrxSsU.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\RuAZeKu.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\yPTKvHH.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\nKZnswr.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\ogGcnwF.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\UeRFEYA.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\BQPhzcs.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\FidrMgz.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\JFkkeNX.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\xEjcqRP.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\qPDvxnM.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\KpZlNOE.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\KoAQGPN.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\hOrBskR.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\HuaGusI.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
File created	C:\Windows\System\MaNtIHS.exe	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
Token: SeDebugPrivilege	2368	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2368	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2368	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2368	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2908	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2908	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2908	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	30
PID 2180 wrote to memory of 1996	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	31
PID 2180 wrote to memory of 1996	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	31
PID 2180 wrote to memory of 1996	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2548	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2548	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2548	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2604	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2604	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2604	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2824	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2824	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2824	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2560	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	35
PID 2180 wrote to memory of 2560	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	35
PID 2180 wrote to memory of 2560	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	35
PID 2180 wrote to memory of 2284	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	36
PID 2180 wrote to memory of 2284	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	36
PID 2180 wrote to memory of 2284	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	36
PID 2180 wrote to memory of 2572	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	37
PID 2180 wrote to memory of 2572	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	37
PID 2180 wrote to memory of 2572	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	37
PID 2180 wrote to memory of 2640	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	38
PID 2180 wrote to memory of 2640	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	38
PID 2180 wrote to memory of 2640	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	38
PID 2180 wrote to memory of 2480	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	39
PID 2180 wrote to memory of 2480	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	39
PID 2180 wrote to memory of 2480	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	39
PID 2180 wrote to memory of 2496	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	40
PID 2180 wrote to memory of 2496	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	40
PID 2180 wrote to memory of 2496	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	40
PID 2180 wrote to memory of 1436	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	41
PID 2180 wrote to memory of 1436	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	41
PID 2180 wrote to memory of 1436	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	41
PID 2180 wrote to memory of 2532	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	42
PID 2180 wrote to memory of 2532	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	42
PID 2180 wrote to memory of 2532	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	42
PID 2180 wrote to memory of 2888	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	43
PID 2180 wrote to memory of 2888	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	43
PID 2180 wrote to memory of 2888	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	43
PID 2180 wrote to memory of 3052	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	44
PID 2180 wrote to memory of 3052	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	44
PID 2180 wrote to memory of 3052	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	44
PID 2180 wrote to memory of 2388	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	45
PID 2180 wrote to memory of 2388	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	45
PID 2180 wrote to memory of 2388	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	45
PID 2180 wrote to memory of 1784	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	46
PID 2180 wrote to memory of 1784	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	46
PID 2180 wrote to memory of 1784	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	46
PID 2180 wrote to memory of 2060	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	47
PID 2180 wrote to memory of 2060	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	47
PID 2180 wrote to memory of 2060	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	47
PID 2180 wrote to memory of 1972	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	48
PID 2180 wrote to memory of 1972	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	48
PID 2180 wrote to memory of 1972	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	48
PID 2180 wrote to memory of 2052	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	49
PID 2180 wrote to memory of 2052	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	49
PID 2180 wrote to memory of 2052	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	49
PID 2180 wrote to memory of 1888	2180	b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b7533358a79f4b70f1759e094667e087_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System\vULeiMU.exe
  C:\Windows\System\vULeiMU.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\zKqhgRC.exe
  C:\Windows\System\zKqhgRC.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\hDrtqxs.exe
  C:\Windows\System\hDrtqxs.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\VeRlFPW.exe
  C:\Windows\System\VeRlFPW.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\sgDiTEz.exe
  C:\Windows\System\sgDiTEz.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\UpXeSMg.exe
  C:\Windows\System\UpXeSMg.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\vUwZkHI.exe
  C:\Windows\System\vUwZkHI.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\AOIFCJV.exe
  C:\Windows\System\AOIFCJV.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\vMXKlXM.exe
  C:\Windows\System\vMXKlXM.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\xtQiCdU.exe
  C:\Windows\System\xtQiCdU.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\JDnbawu.exe
  C:\Windows\System\JDnbawu.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\IlsykuC.exe
  C:\Windows\System\IlsykuC.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\iNZEMBo.exe
  C:\Windows\System\iNZEMBo.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\IpHgkKy.exe
  C:\Windows\System\IpHgkKy.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\FcsAqCH.exe
  C:\Windows\System\FcsAqCH.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\xYZoBGp.exe
  C:\Windows\System\xYZoBGp.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\RmZiyoA.exe
  C:\Windows\System\RmZiyoA.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\mNlniSv.exe
  C:\Windows\System\mNlniSv.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\NJLMESo.exe
  C:\Windows\System\NJLMESo.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\VpQRPnh.exe
  C:\Windows\System\VpQRPnh.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\fqchhGi.exe
  C:\Windows\System\fqchhGi.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\HMUEJCZ.exe
  C:\Windows\System\HMUEJCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\kUJrJpd.exe
  C:\Windows\System\kUJrJpd.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\TNEjCNS.exe
  C:\Windows\System\TNEjCNS.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\KmFxAFB.exe
  C:\Windows\System\KmFxAFB.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\qBlkBFK.exe
  C:\Windows\System\qBlkBFK.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\WElwOMk.exe
  C:\Windows\System\WElwOMk.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\XUOnTxj.exe
  C:\Windows\System\XUOnTxj.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ITnmWev.exe
  C:\Windows\System\ITnmWev.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\fFsUQaV.exe
  C:\Windows\System\fFsUQaV.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\fcTVZiz.exe
  C:\Windows\System\fcTVZiz.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\SvrIayo.exe
  C:\Windows\System\SvrIayo.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\nmBgvkj.exe
  C:\Windows\System\nmBgvkj.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ZLbhPsg.exe
  C:\Windows\System\ZLbhPsg.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\dEeMEOb.exe
  C:\Windows\System\dEeMEOb.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\UWKHckr.exe
  C:\Windows\System\UWKHckr.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\pgwdeRi.exe
  C:\Windows\System\pgwdeRi.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\WhfXHuS.exe
  C:\Windows\System\WhfXHuS.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\oOxydXa.exe
  C:\Windows\System\oOxydXa.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\GZTaoeZ.exe
  C:\Windows\System\GZTaoeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\SqxUUch.exe
  C:\Windows\System\SqxUUch.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\QybBrIh.exe
  C:\Windows\System\QybBrIh.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\VhurpqB.exe
  C:\Windows\System\VhurpqB.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\iMWngxr.exe
  C:\Windows\System\iMWngxr.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\wBrHQJv.exe
  C:\Windows\System\wBrHQJv.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\rTPUUwA.exe
  C:\Windows\System\rTPUUwA.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ILOjilx.exe
  C:\Windows\System\ILOjilx.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\ylVzpim.exe
  C:\Windows\System\ylVzpim.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\EfcqDCy.exe
  C:\Windows\System\EfcqDCy.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\bYlmFmr.exe
  C:\Windows\System\bYlmFmr.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\hEuGXlx.exe
  C:\Windows\System\hEuGXlx.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\Rgverje.exe
  C:\Windows\System\Rgverje.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\xUqPhzD.exe
  C:\Windows\System\xUqPhzD.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\YixOSxP.exe
  C:\Windows\System\YixOSxP.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\bkNqMXw.exe
  C:\Windows\System\bkNqMXw.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\dyKmUDK.exe
  C:\Windows\System\dyKmUDK.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ZkMjHSh.exe
  C:\Windows\System\ZkMjHSh.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\pefvCrp.exe
  C:\Windows\System\pefvCrp.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\aWsxZJS.exe
  C:\Windows\System\aWsxZJS.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\dBFwYMb.exe
  C:\Windows\System\dBFwYMb.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\qKLsaTB.exe
  C:\Windows\System\qKLsaTB.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\DCzDOyt.exe
  C:\Windows\System\DCzDOyt.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\ZpBxkSk.exe
  C:\Windows\System\ZpBxkSk.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\UFPtQmD.exe
  C:\Windows\System\UFPtQmD.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\fvDnxUa.exe
  C:\Windows\System\fvDnxUa.exe
  2⤵
  PID:2828
- C:\Windows\System\aIkAnBi.exe
  C:\Windows\System\aIkAnBi.exe
  2⤵
  PID:1884
- C:\Windows\System\UxdOqaN.exe
  C:\Windows\System\UxdOqaN.exe
  2⤵
  PID:1280
- C:\Windows\System\gDhOsSf.exe
  C:\Windows\System\gDhOsSf.exe
  2⤵
  PID:780
- C:\Windows\System\yovvADv.exe
  C:\Windows\System\yovvADv.exe
  2⤵
  PID:2608
- C:\Windows\System\HmJsVbg.exe
  C:\Windows\System\HmJsVbg.exe
  2⤵
  PID:1068
- C:\Windows\System\NIsKZCa.exe
  C:\Windows\System\NIsKZCa.exe
  2⤵
  PID:2000
- C:\Windows\System\zXIOplp.exe
  C:\Windows\System\zXIOplp.exe
  2⤵
  PID:2064
- C:\Windows\System\eeafjyS.exe
  C:\Windows\System\eeafjyS.exe
  2⤵
  PID:2892
- C:\Windows\System\LRHTJzX.exe
  C:\Windows\System\LRHTJzX.exe
  2⤵
  PID:1700
- C:\Windows\System\QXrBTpD.exe
  C:\Windows\System\QXrBTpD.exe
  2⤵
  PID:816
- C:\Windows\System\wFJvDOm.exe
  C:\Windows\System\wFJvDOm.exe
  2⤵
  PID:2308
- C:\Windows\System\DibJgzP.exe
  C:\Windows\System\DibJgzP.exe
  2⤵
  PID:2100
- C:\Windows\System\yoeChie.exe
  C:\Windows\System\yoeChie.exe
  2⤵
  PID:3016
- C:\Windows\System\IJwjDlg.exe
  C:\Windows\System\IJwjDlg.exe
  2⤵
  PID:1728
- C:\Windows\System\jwNsGKX.exe
  C:\Windows\System\jwNsGKX.exe
  2⤵
  PID:380
- C:\Windows\System\JoAwmed.exe
  C:\Windows\System\JoAwmed.exe
  2⤵
  PID:2028
- C:\Windows\System\WMSKHHA.exe
  C:\Windows\System\WMSKHHA.exe
  2⤵
  PID:1060
- C:\Windows\System\WuXmkpU.exe
  C:\Windows\System\WuXmkpU.exe
  2⤵
  PID:2684
- C:\Windows\System\HfnlBFs.exe
  C:\Windows\System\HfnlBFs.exe
  2⤵
  PID:2836
- C:\Windows\System\QkTYCHV.exe
  C:\Windows\System\QkTYCHV.exe
  2⤵
  PID:1848
- C:\Windows\System\XgWnpXy.exe
  C:\Windows\System\XgWnpXy.exe
  2⤵
  PID:2144
- C:\Windows\System\TjxqIPz.exe
  C:\Windows\System\TjxqIPz.exe
  2⤵
  PID:1508
- C:\Windows\System\vHrQedm.exe
  C:\Windows\System\vHrQedm.exe
  2⤵
  PID:2692
- C:\Windows\System\rEgpweY.exe
  C:\Windows\System\rEgpweY.exe
  2⤵
  PID:2976
- C:\Windows\System\mbMBfMy.exe
  C:\Windows\System\mbMBfMy.exe
  2⤵
  PID:1876
- C:\Windows\System\TimuZaD.exe
  C:\Windows\System\TimuZaD.exe
  2⤵
  PID:2300
- C:\Windows\System\sQIaJck.exe
  C:\Windows\System\sQIaJck.exe
  2⤵
  PID:2044
- C:\Windows\System\qeFGQFD.exe
  C:\Windows\System\qeFGQFD.exe
  2⤵
  PID:2260
- C:\Windows\System\iAMAfFn.exe
  C:\Windows\System\iAMAfFn.exe
  2⤵
  PID:2224
- C:\Windows\System\iEPMfnY.exe
  C:\Windows\System\iEPMfnY.exe
  2⤵
  PID:2592
- C:\Windows\System\UzJbYMe.exe
  C:\Windows\System\UzJbYMe.exe
  2⤵
  PID:2584
- C:\Windows\System\eOzmSVD.exe
  C:\Windows\System\eOzmSVD.exe
  2⤵
  PID:2476
- C:\Windows\System\cxThQiP.exe
  C:\Windows\System\cxThQiP.exe
  2⤵
  PID:2752
- C:\Windows\System\vSOiBEL.exe
  C:\Windows\System\vSOiBEL.exe
  2⤵
  PID:1432
- C:\Windows\System\HTsgvse.exe
  C:\Windows\System\HTsgvse.exe
  2⤵
  PID:2172
- C:\Windows\System\AgEpNWr.exe
  C:\Windows\System\AgEpNWr.exe
  2⤵
  PID:1648
- C:\Windows\System\EWuRSJl.exe
  C:\Windows\System\EWuRSJl.exe
  2⤵
  PID:820
- C:\Windows\System\HvkFLcs.exe
  C:\Windows\System\HvkFLcs.exe
  2⤵
  PID:2736
- C:\Windows\System\uydokRU.exe
  C:\Windows\System\uydokRU.exe
  2⤵
  PID:2916
- C:\Windows\System\GKqswdz.exe
  C:\Windows\System\GKqswdz.exe
  2⤵
  PID:1820
- C:\Windows\System\MdelVCV.exe
  C:\Windows\System\MdelVCV.exe
  2⤵
  PID:2748
- C:\Windows\System\lnGYJPM.exe
  C:\Windows\System\lnGYJPM.exe
  2⤵
  PID:592
- C:\Windows\System\LWuquYT.exe
  C:\Windows\System\LWuquYT.exe
  2⤵
  PID:2704
- C:\Windows\System\pIKNpFy.exe
  C:\Windows\System\pIKNpFy.exe
  2⤵
  PID:2448
- C:\Windows\System\topQzjc.exe
  C:\Windows\System\topQzjc.exe
  2⤵
  PID:2624
- C:\Windows\System\pTkOrUs.exe
  C:\Windows\System\pTkOrUs.exe
  2⤵
  PID:1992
- C:\Windows\System\yYhydaa.exe
  C:\Windows\System\yYhydaa.exe
  2⤵
  PID:1660
- C:\Windows\System\kRBYjkS.exe
  C:\Windows\System\kRBYjkS.exe
  2⤵
  PID:2676
- C:\Windows\System\LPxyfUe.exe
  C:\Windows\System\LPxyfUe.exe
  2⤵
  PID:1716
- C:\Windows\System\uukOTFA.exe
  C:\Windows\System\uukOTFA.exe
  2⤵
  PID:2672
- C:\Windows\System\uKXWQWH.exe
  C:\Windows\System\uKXWQWH.exe
  2⤵
  PID:2764
- C:\Windows\System\QctFhzM.exe
  C:\Windows\System\QctFhzM.exe
  2⤵
  PID:2124
- C:\Windows\System\zmrxxOK.exe
  C:\Windows\System\zmrxxOK.exe
  2⤵
  PID:2112
- C:\Windows\System\vZRnYLz.exe
  C:\Windows\System\vZRnYLz.exe
  2⤵
  PID:2492
- C:\Windows\System\etwUJtS.exe
  C:\Windows\System\etwUJtS.exe
  2⤵
  PID:1404
- C:\Windows\System\LMKtEpt.exe
  C:\Windows\System\LMKtEpt.exe
  2⤵
  PID:3084
- C:\Windows\System\PHDQmCj.exe
  C:\Windows\System\PHDQmCj.exe
  2⤵
  PID:3104
- C:\Windows\System\trBmDXm.exe
  C:\Windows\System\trBmDXm.exe
  2⤵
  PID:3120
- C:\Windows\System\buChrRw.exe
  C:\Windows\System\buChrRw.exe
  2⤵
  PID:3136
- C:\Windows\System\cJLxVrE.exe
  C:\Windows\System\cJLxVrE.exe
  2⤵
  PID:3156
- C:\Windows\System\HHrgjTD.exe
  C:\Windows\System\HHrgjTD.exe
  2⤵
  PID:3180
- C:\Windows\System\bELBGAn.exe
  C:\Windows\System\bELBGAn.exe
  2⤵
  PID:3216
- C:\Windows\System\ElmbssD.exe
  C:\Windows\System\ElmbssD.exe
  2⤵
  PID:3232
- C:\Windows\System\RaxEnBM.exe
  C:\Windows\System\RaxEnBM.exe
  2⤵
  PID:3248
- C:\Windows\System\lqqdNJc.exe
  C:\Windows\System\lqqdNJc.exe
  2⤵
  PID:3268
- C:\Windows\System\dwWhkmU.exe
  C:\Windows\System\dwWhkmU.exe
  2⤵
  PID:3284
- C:\Windows\System\ZAdTumd.exe
  C:\Windows\System\ZAdTumd.exe
  2⤵
  PID:3320
- C:\Windows\System\CWjhSkB.exe
  C:\Windows\System\CWjhSkB.exe
  2⤵
  PID:3360
- C:\Windows\System\QDSqLkJ.exe
  C:\Windows\System\QDSqLkJ.exe
  2⤵
  PID:3376
- C:\Windows\System\MmjvtWg.exe
  C:\Windows\System\MmjvtWg.exe
  2⤵
  PID:3392
- C:\Windows\System\aEwWVhs.exe
  C:\Windows\System\aEwWVhs.exe
  2⤵
  PID:3408
- C:\Windows\System\fELdVCV.exe
  C:\Windows\System\fELdVCV.exe
  2⤵
  PID:3424
- C:\Windows\System\yipeWYg.exe
  C:\Windows\System\yipeWYg.exe
  2⤵
  PID:3440
- C:\Windows\System\eTPFSmH.exe
  C:\Windows\System\eTPFSmH.exe
  2⤵
  PID:3456
- C:\Windows\System\JwNXTwm.exe
  C:\Windows\System\JwNXTwm.exe
  2⤵
  PID:3472
- C:\Windows\System\HBlwThh.exe
  C:\Windows\System\HBlwThh.exe
  2⤵
  PID:3488
- C:\Windows\System\JjYvmMj.exe
  C:\Windows\System\JjYvmMj.exe
  2⤵
  PID:3504
- C:\Windows\System\ApAuNyV.exe
  C:\Windows\System\ApAuNyV.exe
  2⤵
  PID:3520
- C:\Windows\System\RWZPdFR.exe
  C:\Windows\System\RWZPdFR.exe
  2⤵
  PID:3536
- C:\Windows\System\oVaPxJE.exe
  C:\Windows\System\oVaPxJE.exe
  2⤵
  PID:3552
- C:\Windows\System\ikoLquP.exe
  C:\Windows\System\ikoLquP.exe
  2⤵
  PID:3568
- C:\Windows\System\XwLGJKe.exe
  C:\Windows\System\XwLGJKe.exe
  2⤵
  PID:3584
- C:\Windows\System\ekAVmIg.exe
  C:\Windows\System\ekAVmIg.exe
  2⤵
  PID:3600
- C:\Windows\System\tmDNRvb.exe
  C:\Windows\System\tmDNRvb.exe
  2⤵
  PID:3620
- C:\Windows\System\sHeqQQT.exe
  C:\Windows\System\sHeqQQT.exe
  2⤵
  PID:3636
- C:\Windows\System\gFYRWhT.exe
  C:\Windows\System\gFYRWhT.exe
  2⤵
  PID:3652
- C:\Windows\System\wnUKLAR.exe
  C:\Windows\System\wnUKLAR.exe
  2⤵
  PID:3668
- C:\Windows\System\FaCQwkw.exe
  C:\Windows\System\FaCQwkw.exe
  2⤵
  PID:3684
- C:\Windows\System\OuQgGOZ.exe
  C:\Windows\System\OuQgGOZ.exe
  2⤵
  PID:3700
- C:\Windows\System\HRHyKYd.exe
  C:\Windows\System\HRHyKYd.exe
  2⤵
  PID:3716
- C:\Windows\System\DLMdOgV.exe
  C:\Windows\System\DLMdOgV.exe
  2⤵
  PID:3732
- C:\Windows\System\AWTwIGC.exe
  C:\Windows\System\AWTwIGC.exe
  2⤵
  PID:3748
- C:\Windows\System\iDLDZcZ.exe
  C:\Windows\System\iDLDZcZ.exe
  2⤵
  PID:3764
- C:\Windows\System\fKaBGpJ.exe
  C:\Windows\System\fKaBGpJ.exe
  2⤵
  PID:3780
- C:\Windows\System\apForKS.exe
  C:\Windows\System\apForKS.exe
  2⤵
  PID:3796
- C:\Windows\System\nUyTcbc.exe
  C:\Windows\System\nUyTcbc.exe
  2⤵
  PID:3812
- C:\Windows\System\joroynV.exe
  C:\Windows\System\joroynV.exe
  2⤵
  PID:3828
- C:\Windows\System\cWeurSt.exe
  C:\Windows\System\cWeurSt.exe
  2⤵
  PID:3844
- C:\Windows\System\ejRJxcW.exe
  C:\Windows\System\ejRJxcW.exe
  2⤵
  PID:3860
- C:\Windows\System\PURPmLX.exe
  C:\Windows\System\PURPmLX.exe
  2⤵
  PID:3876
- C:\Windows\System\cZcMQGM.exe
  C:\Windows\System\cZcMQGM.exe
  2⤵
  PID:3892
- C:\Windows\System\PXCEtTK.exe
  C:\Windows\System\PXCEtTK.exe
  2⤵
  PID:3908
- C:\Windows\System\VNTcQyG.exe
  C:\Windows\System\VNTcQyG.exe
  2⤵
  PID:3924
- C:\Windows\System\QJnfvIC.exe
  C:\Windows\System\QJnfvIC.exe
  2⤵
  PID:3940
- C:\Windows\System\cYZPQvU.exe
  C:\Windows\System\cYZPQvU.exe
  2⤵
  PID:3956
- C:\Windows\System\KPnTSXJ.exe
  C:\Windows\System\KPnTSXJ.exe
  2⤵
  PID:3972
- C:\Windows\System\FfVgTcj.exe
  C:\Windows\System\FfVgTcj.exe
  2⤵
  PID:3988
- C:\Windows\System\GzSNJcU.exe
  C:\Windows\System\GzSNJcU.exe
  2⤵
  PID:4004
- C:\Windows\System\RArjqLV.exe
  C:\Windows\System\RArjqLV.exe
  2⤵
  PID:4020
- C:\Windows\System\EuAVgGL.exe
  C:\Windows\System\EuAVgGL.exe
  2⤵
  PID:4036
- C:\Windows\System\BJGXvck.exe
  C:\Windows\System\BJGXvck.exe
  2⤵
  PID:4052
- C:\Windows\System\NCYXeAa.exe
  C:\Windows\System\NCYXeAa.exe
  2⤵
  PID:4068
- C:\Windows\System\zXVAzZd.exe
  C:\Windows\System\zXVAzZd.exe
  2⤵
  PID:4084
- C:\Windows\System\OpKnBIh.exe
  C:\Windows\System\OpKnBIh.exe
  2⤵
  PID:1692
- C:\Windows\System\wLdqCFq.exe
  C:\Windows\System\wLdqCFq.exe
  2⤵
  PID:632
- C:\Windows\System\yFxxrvc.exe
  C:\Windows\System\yFxxrvc.exe
  2⤵
  PID:1464
- C:\Windows\System\XIVxsIl.exe
  C:\Windows\System\XIVxsIl.exe
  2⤵
  PID:112
- C:\Windows\System\ZRQUoof.exe
  C:\Windows\System\ZRQUoof.exe
  2⤵
  PID:984
- C:\Windows\System\qEzMjGM.exe
  C:\Windows\System\qEzMjGM.exe
  2⤵
  PID:1596
- C:\Windows\System\ioHrqOO.exe
  C:\Windows\System\ioHrqOO.exe
  2⤵
  PID:2500
- C:\Windows\System\pJXmIfb.exe
  C:\Windows\System\pJXmIfb.exe
  2⤵
  PID:2016
- C:\Windows\System\bAWCDcN.exe
  C:\Windows\System\bAWCDcN.exe
  2⤵
  PID:3020
- C:\Windows\System\XvCWqgu.exe
  C:\Windows\System\XvCWqgu.exe
  2⤵
  PID:2932
- C:\Windows\System\pmggteu.exe
  C:\Windows\System\pmggteu.exe
  2⤵
  PID:1672
- C:\Windows\System\wHxqHtt.exe
  C:\Windows\System\wHxqHtt.exe
  2⤵
  PID:1656
- C:\Windows\System\uqDpdKr.exe
  C:\Windows\System\uqDpdKr.exe
  2⤵
  PID:2116
- C:\Windows\System\TJiCGtF.exe
  C:\Windows\System\TJiCGtF.exe
  2⤵
  PID:3096
- C:\Windows\System\YwWWBwX.exe
  C:\Windows\System\YwWWBwX.exe
  2⤵
  PID:3164
- C:\Windows\System\gisVfIJ.exe
  C:\Windows\System\gisVfIJ.exe
  2⤵
  PID:3224
- C:\Windows\System\XkZebla.exe
  C:\Windows\System\XkZebla.exe
  2⤵
  PID:2020
- C:\Windows\System\fIvgAbj.exe
  C:\Windows\System\fIvgAbj.exe
  2⤵
  PID:2248
- C:\Windows\System\XKpWecX.exe
  C:\Windows\System\XKpWecX.exe
  2⤵
  PID:696
- C:\Windows\System\LGtNtZz.exe
  C:\Windows\System\LGtNtZz.exe
  2⤵
  PID:328
- C:\Windows\System\pccIpbH.exe
  C:\Windows\System\pccIpbH.exe
  2⤵
  PID:2664
- C:\Windows\System\VPsTKIx.exe
  C:\Windows\System\VPsTKIx.exe
  2⤵
  PID:3260
- C:\Windows\System\GlODqPc.exe
  C:\Windows\System\GlODqPc.exe
  2⤵
  PID:1168
- C:\Windows\System\zctXgtl.exe
  C:\Windows\System\zctXgtl.exe
  2⤵
  PID:3304
- C:\Windows\System\QFEvqua.exe
  C:\Windows\System\QFEvqua.exe
  2⤵
  PID:360
- C:\Windows\System\sfjoyzS.exe
  C:\Windows\System\sfjoyzS.exe
  2⤵
  PID:840
- C:\Windows\System\QlDBLuK.exe
  C:\Windows\System\QlDBLuK.exe
  2⤵
  PID:3372
- C:\Windows\System\xRpRizA.exe
  C:\Windows\System\xRpRizA.exe
  2⤵
  PID:1152
- C:\Windows\System\qgBtWrL.exe
  C:\Windows\System\qgBtWrL.exe
  2⤵
  PID:3432
- C:\Windows\System\flSHKvk.exe
  C:\Windows\System\flSHKvk.exe
  2⤵
  PID:2668
- C:\Windows\System\USXJkFa.exe
  C:\Windows\System\USXJkFa.exe
  2⤵
  PID:3144
- C:\Windows\System\hBvyeJR.exe
  C:\Windows\System\hBvyeJR.exe
  2⤵
  PID:3188
- C:\Windows\System\sbzJvfu.exe
  C:\Windows\System\sbzJvfu.exe
  2⤵
  PID:3500
- C:\Windows\System\XlwBXNQ.exe
  C:\Windows\System\XlwBXNQ.exe
  2⤵
  PID:3196
- C:\Windows\System\BFvwJKc.exe
  C:\Windows\System\BFvwJKc.exe
  2⤵
  PID:3212
- C:\Windows\System\bloqTHp.exe
  C:\Windows\System\bloqTHp.exe
  2⤵
  PID:3592
- C:\Windows\System\ajmYvFz.exe
  C:\Windows\System\ajmYvFz.exe
  2⤵
  PID:3660
- C:\Windows\System\DrdXKnz.exe
  C:\Windows\System\DrdXKnz.exe
  2⤵
  PID:3696
- C:\Windows\System\tGiEHnN.exe
  C:\Windows\System\tGiEHnN.exe
  2⤵
  PID:2040
- C:\Windows\System\quZSPjv.exe
  C:\Windows\System\quZSPjv.exe
  2⤵
  PID:2336
- C:\Windows\System\bNZhZtx.exe
  C:\Windows\System\bNZhZtx.exe
  2⤵
  PID:2212
- C:\Windows\System\zqPMHBP.exe
  C:\Windows\System\zqPMHBP.exe
  2⤵
  PID:3328
- C:\Windows\System\FMCNxSn.exe
  C:\Windows\System\FMCNxSn.exe
  2⤵
  PID:3344
- C:\Windows\System\EcYXTxT.exe
  C:\Windows\System\EcYXTxT.exe
  2⤵
  PID:1628
- C:\Windows\System\tYrdXMX.exe
  C:\Windows\System\tYrdXMX.exe
  2⤵
  PID:3452
- C:\Windows\System\jxhvkOu.exe
  C:\Windows\System\jxhvkOu.exe
  2⤵
  PID:3080
- C:\Windows\System\hFhlaah.exe
  C:\Windows\System\hFhlaah.exe
  2⤵
  PID:3576
- C:\Windows\System\BggERDt.exe
  C:\Windows\System\BggERDt.exe
  2⤵
  PID:4112
- C:\Windows\System\CGbUPSz.exe
  C:\Windows\System\CGbUPSz.exe
  2⤵
  PID:4128
- C:\Windows\System\YeUaLGv.exe
  C:\Windows\System\YeUaLGv.exe
  2⤵
  PID:4144
- C:\Windows\System\lCyPBfF.exe
  C:\Windows\System\lCyPBfF.exe
  2⤵
  PID:4160
- C:\Windows\System\JJoaGoc.exe
  C:\Windows\System\JJoaGoc.exe
  2⤵
  PID:4176
- C:\Windows\System\tebPDSa.exe
  C:\Windows\System\tebPDSa.exe
  2⤵
  PID:4192
- C:\Windows\System\QwvuvSq.exe
  C:\Windows\System\QwvuvSq.exe
  2⤵
  PID:4208
- C:\Windows\System\LgCnqHC.exe
  C:\Windows\System\LgCnqHC.exe
  2⤵
  PID:4224
- C:\Windows\System\YplrKvK.exe
  C:\Windows\System\YplrKvK.exe
  2⤵
  PID:4240
- C:\Windows\System\aTUwtvF.exe
  C:\Windows\System\aTUwtvF.exe
  2⤵
  PID:4256
- C:\Windows\System\tHnnHGA.exe
  C:\Windows\System\tHnnHGA.exe
  2⤵
  PID:4272
- C:\Windows\System\eQHflmH.exe
  C:\Windows\System\eQHflmH.exe
  2⤵
  PID:4288
- C:\Windows\System\ignPgkz.exe
  C:\Windows\System\ignPgkz.exe
  2⤵
  PID:4304
- C:\Windows\System\FFzYhEj.exe
  C:\Windows\System\FFzYhEj.exe
  2⤵
  PID:4320
- C:\Windows\System\xeLCqGZ.exe
  C:\Windows\System\xeLCqGZ.exe
  2⤵
  PID:4336
- C:\Windows\System\YyeJYAE.exe
  C:\Windows\System\YyeJYAE.exe
  2⤵
  PID:4360
- C:\Windows\System\iNKAUNC.exe
  C:\Windows\System\iNKAUNC.exe
  2⤵
  PID:4424
- C:\Windows\System\PwtjAmB.exe
  C:\Windows\System\PwtjAmB.exe
  2⤵
  PID:4440
- C:\Windows\System\zTKremw.exe
  C:\Windows\System\zTKremw.exe
  2⤵
  PID:4456
- C:\Windows\System\pXyXCCu.exe
  C:\Windows\System\pXyXCCu.exe
  2⤵
  PID:4472
- C:\Windows\System\FGdIbTt.exe
  C:\Windows\System\FGdIbTt.exe
  2⤵
  PID:4488
- C:\Windows\System\YMBZrWD.exe
  C:\Windows\System\YMBZrWD.exe
  2⤵
  PID:4504
- C:\Windows\System\FhmxjuR.exe
  C:\Windows\System\FhmxjuR.exe
  2⤵
  PID:4520
- C:\Windows\System\nmHYXQL.exe
  C:\Windows\System\nmHYXQL.exe
  2⤵
  PID:4536
- C:\Windows\System\SzUPgEK.exe
  C:\Windows\System\SzUPgEK.exe
  2⤵
  PID:4552
- C:\Windows\System\hrVUsJi.exe
  C:\Windows\System\hrVUsJi.exe
  2⤵
  PID:4568
- C:\Windows\System\AvYPlkw.exe
  C:\Windows\System\AvYPlkw.exe
  2⤵
  PID:4584
- C:\Windows\System\GcNmHgH.exe
  C:\Windows\System\GcNmHgH.exe
  2⤵
  PID:4600
- C:\Windows\System\DCdQHxc.exe
  C:\Windows\System\DCdQHxc.exe
  2⤵
  PID:4616
- C:\Windows\System\sYCletv.exe
  C:\Windows\System\sYCletv.exe
  2⤵
  PID:4632
- C:\Windows\System\bXvoiFS.exe
  C:\Windows\System\bXvoiFS.exe
  2⤵
  PID:4648
- C:\Windows\System\WxKEakq.exe
  C:\Windows\System\WxKEakq.exe
  2⤵
  PID:4664
- C:\Windows\System\aHcOQWl.exe
  C:\Windows\System\aHcOQWl.exe
  2⤵
  PID:4680
- C:\Windows\System\UlcdAej.exe
  C:\Windows\System\UlcdAej.exe
  2⤵
  PID:4696
- C:\Windows\System\cHsRyJO.exe
  C:\Windows\System\cHsRyJO.exe
  2⤵
  PID:4712
- C:\Windows\System\vCOJAMm.exe
  C:\Windows\System\vCOJAMm.exe
  2⤵
  PID:4728
- C:\Windows\System\zJmXHHJ.exe
  C:\Windows\System\zJmXHHJ.exe
  2⤵
  PID:4744
- C:\Windows\System\rxcRAtG.exe
  C:\Windows\System\rxcRAtG.exe
  2⤵
  PID:4760
- C:\Windows\System\grmGamZ.exe
  C:\Windows\System\grmGamZ.exe
  2⤵
  PID:4776
- C:\Windows\System\aRhVjZF.exe
  C:\Windows\System\aRhVjZF.exe
  2⤵
  PID:4792
- C:\Windows\System\RvdOkUP.exe
  C:\Windows\System\RvdOkUP.exe
  2⤵
  PID:4808
- C:\Windows\System\uglvoxb.exe
  C:\Windows\System\uglvoxb.exe
  2⤵
  PID:4824
- C:\Windows\System\NsUporM.exe
  C:\Windows\System\NsUporM.exe
  2⤵
  PID:4840
- C:\Windows\System\ruGssVt.exe
  C:\Windows\System\ruGssVt.exe
  2⤵
  PID:4856
- C:\Windows\System\PFAPGPW.exe
  C:\Windows\System\PFAPGPW.exe
  2⤵
  PID:4872
- C:\Windows\System\lCWpSWB.exe
  C:\Windows\System\lCWpSWB.exe
  2⤵
  PID:4888
- C:\Windows\System\wBABkwf.exe
  C:\Windows\System\wBABkwf.exe
  2⤵
  PID:4904
- C:\Windows\System\VWCkHGa.exe
  C:\Windows\System\VWCkHGa.exe
  2⤵
  PID:4920
- C:\Windows\System\tHzbIKJ.exe
  C:\Windows\System\tHzbIKJ.exe
  2⤵
  PID:4936
- C:\Windows\System\wQhevqO.exe
  C:\Windows\System\wQhevqO.exe
  2⤵
  PID:4952
- C:\Windows\System\hViGESK.exe
  C:\Windows\System\hViGESK.exe
  2⤵
  PID:4968
- C:\Windows\System\NaEGgBw.exe
  C:\Windows\System\NaEGgBw.exe
  2⤵
  PID:4984
- C:\Windows\System\gLmNWqX.exe
  C:\Windows\System\gLmNWqX.exe
  2⤵
  PID:5000
- C:\Windows\System\WUHjVhf.exe
  C:\Windows\System\WUHjVhf.exe
  2⤵
  PID:5016
- C:\Windows\System\bwOqDtP.exe
  C:\Windows\System\bwOqDtP.exe
  2⤵
  PID:5032
- C:\Windows\System\TOBIlbK.exe
  C:\Windows\System\TOBIlbK.exe
  2⤵
  PID:5048
- C:\Windows\System\GAqqtXE.exe
  C:\Windows\System\GAqqtXE.exe
  2⤵
  PID:5064
- C:\Windows\System\nOcSJQQ.exe
  C:\Windows\System\nOcSJQQ.exe
  2⤵
  PID:5080
- C:\Windows\System\ZPIDnQp.exe
  C:\Windows\System\ZPIDnQp.exe
  2⤵
  PID:5096
- C:\Windows\System\SapLAGH.exe
  C:\Windows\System\SapLAGH.exe
  2⤵
  PID:5112
- C:\Windows\System\kpEzpAy.exe
  C:\Windows\System\kpEzpAy.exe
  2⤵
  PID:3244
- C:\Windows\System\ZNTNxAq.exe
  C:\Windows\System\ZNTNxAq.exe
  2⤵
  PID:3680
- C:\Windows\System\FRmMfmQ.exe
  C:\Windows\System\FRmMfmQ.exe
  2⤵
  PID:3744
- C:\Windows\System\tqtaHWa.exe
  C:\Windows\System\tqtaHWa.exe
  2⤵
  PID:3820
- C:\Windows\System\jdOzXfE.exe
  C:\Windows\System\jdOzXfE.exe
  2⤵
  PID:596
- C:\Windows\System\TQoxZGb.exe
  C:\Windows\System\TQoxZGb.exe
  2⤵
  PID:4468
- C:\Windows\System\XFOoxhI.exe
  C:\Windows\System\XFOoxhI.exe
  2⤵
  PID:4544
- C:\Windows\System\ntNtCmG.exe
  C:\Windows\System\ntNtCmG.exe
  2⤵
  PID:4560
- C:\Windows\System\onvVcbh.exe
  C:\Windows\System\onvVcbh.exe
  2⤵
  PID:4564
- C:\Windows\System\gleioHF.exe
  C:\Windows\System\gleioHF.exe
  2⤵
  PID:4656
- C:\Windows\System\KRWnPOR.exe
  C:\Windows\System\KRWnPOR.exe
  2⤵
  PID:4788
- C:\Windows\System\QRXzNob.exe
  C:\Windows\System\QRXzNob.exe
  2⤵
  PID:4836
- C:\Windows\System\bOVBUKG.exe
  C:\Windows\System\bOVBUKG.exe
  2⤵
  PID:4612
- C:\Windows\System\NRtsSxM.exe
  C:\Windows\System\NRtsSxM.exe
  2⤵
  PID:4736
- C:\Windows\System\XizykgS.exe
  C:\Windows\System\XizykgS.exe
  2⤵
  PID:4880
- C:\Windows\System\RpZfEzq.exe
  C:\Windows\System\RpZfEzq.exe
  2⤵
  PID:4944
- C:\Windows\System\deVjlCN.exe
  C:\Windows\System\deVjlCN.exe
  2⤵
  PID:5008
- C:\Windows\System\DmJrFjw.exe
  C:\Windows\System\DmJrFjw.exe
  2⤵
  PID:4932
- C:\Windows\System\MdNcXuV.exe
  C:\Windows\System\MdNcXuV.exe
  2⤵
  PID:5076
- C:\Windows\System\cVbkHqZ.exe
  C:\Windows\System\cVbkHqZ.exe
  2⤵
  PID:4964
- C:\Windows\System\tbcTvIK.exe
  C:\Windows\System\tbcTvIK.exe
  2⤵
  PID:3648
- C:\Windows\System\idddJEY.exe
  C:\Windows\System\idddJEY.exe
  2⤵
  PID:3776
- C:\Windows\System\tCeXzYM.exe
  C:\Windows\System\tCeXzYM.exe
  2⤵
  PID:5060
- C:\Windows\System\eGbEXYC.exe
  C:\Windows\System\eGbEXYC.exe
  2⤵
  PID:3612
- C:\Windows\System\BbPIGsu.exe
  C:\Windows\System\BbPIGsu.exe
  2⤵
  PID:3036
- C:\Windows\System\xiwCbVM.exe
  C:\Windows\System\xiwCbVM.exe
  2⤵
  PID:3804
- C:\Windows\System\EvqOwOJ.exe
  C:\Windows\System\EvqOwOJ.exe
  2⤵
  PID:3872
- C:\Windows\System\JXVWTXE.exe
  C:\Windows\System\JXVWTXE.exe
  2⤵
  PID:4352
- C:\Windows\System\IveaBwk.exe
  C:\Windows\System\IveaBwk.exe
  2⤵
  PID:1816
- C:\Windows\System\yrDgncn.exe
  C:\Windows\System\yrDgncn.exe
  2⤵
  PID:4064
- C:\Windows\System\rGJsTZv.exe
  C:\Windows\System\rGJsTZv.exe
  2⤵
  PID:1016
- C:\Windows\System\LbqRDtK.exe
  C:\Windows\System\LbqRDtK.exe
  2⤵
  PID:2904
- C:\Windows\System\rYsKHKD.exe
  C:\Windows\System\rYsKHKD.exe
  2⤵
  PID:1760
- C:\Windows\System\OETxcqv.exe
  C:\Windows\System\OETxcqv.exe
  2⤵
  PID:3128
- C:\Windows\System\JmscHlF.exe
  C:\Windows\System\JmscHlF.exe
  2⤵
  PID:2244
- C:\Windows\System\YJkdoxq.exe
  C:\Windows\System\YJkdoxq.exe
  2⤵
  PID:3368
- C:\Windows\System\MYEKmHz.exe
  C:\Windows\System\MYEKmHz.exe
  2⤵
  PID:3404
- C:\Windows\System\JPIrKwO.exe
  C:\Windows\System\JPIrKwO.exe
  2⤵
  PID:3980
- C:\Windows\System\ZlbqPIS.exe
  C:\Windows\System\ZlbqPIS.exe
  2⤵
  PID:4044
- C:\Windows\System\bXZyjHR.exe
  C:\Windows\System\bXZyjHR.exe
  2⤵
  PID:540
- C:\Windows\System\huWOwLI.exe
  C:\Windows\System\huWOwLI.exe
  2⤵
  PID:2528
- C:\Windows\System\rVSmPRv.exe
  C:\Windows\System\rVSmPRv.exe
  2⤵
  PID:2088
- C:\Windows\System\mxkMKff.exe
  C:\Windows\System\mxkMKff.exe
  2⤵
  PID:4136
- C:\Windows\System\TYBHjoh.exe
  C:\Windows\System\TYBHjoh.exe
  2⤵
  PID:4204
- C:\Windows\System\avqsqTt.exe
  C:\Windows\System\avqsqTt.exe
  2⤵
  PID:4328
- C:\Windows\System\YhrJXrH.exe
  C:\Windows\System\YhrJXrH.exe
  2⤵
  PID:3932
- C:\Windows\System\vpniiYO.exe
  C:\Windows\System\vpniiYO.exe
  2⤵
  PID:4220
- C:\Windows\System\nZqxzsb.exe
  C:\Windows\System\nZqxzsb.exe
  2⤵
  PID:3132
- C:\Windows\System\TZaRSzl.exe
  C:\Windows\System\TZaRSzl.exe
  2⤵
  PID:1488
- C:\Windows\System\mTRQHWE.exe
  C:\Windows\System\mTRQHWE.exe
  2⤵
  PID:3496
- C:\Windows\System\ZiKWjww.exe
  C:\Windows\System\ZiKWjww.exe
  2⤵
  PID:940
- C:\Windows\System\YBMHxgy.exe
  C:\Windows\System\YBMHxgy.exe
  2⤵
  PID:3388
- C:\Windows\System\baviIro.exe
  C:\Windows\System\baviIro.exe
  2⤵
  PID:4284
- C:\Windows\System\DFmdVpn.exe
  C:\Windows\System\DFmdVpn.exe
  2⤵
  PID:4248
- C:\Windows\System\yLrOkZL.exe
  C:\Windows\System\yLrOkZL.exe
  2⤵
  PID:4312
- C:\Windows\System\FvSOvqq.exe
  C:\Windows\System\FvSOvqq.exe
  2⤵
  PID:4448
- C:\Windows\System\OHdZgHq.exe
  C:\Windows\System\OHdZgHq.exe
  2⤵
  PID:4496
- C:\Windows\System\gziqRzN.exe
  C:\Windows\System\gziqRzN.exe
  2⤵
  PID:4532
- C:\Windows\System\urAvFSW.exe
  C:\Windows\System\urAvFSW.exe
  2⤵
  PID:4624
- C:\Windows\System\KVTogJU.exe
  C:\Windows\System\KVTogJU.exe
  2⤵
  PID:4688
- C:\Windows\System\lmUnVzz.exe
  C:\Windows\System\lmUnVzz.exe
  2⤵
  PID:3760
- C:\Windows\System\PJTZvTy.exe
  C:\Windows\System\PJTZvTy.exe
  2⤵
  PID:4640
- C:\Windows\System\dLtKrPI.exe
  C:\Windows\System\dLtKrPI.exe
  2⤵
  PID:4644
- C:\Windows\System\CWJQVwu.exe
  C:\Windows\System\CWJQVwu.exe
  2⤵
  PID:5024
- C:\Windows\System\hUePPTu.exe
  C:\Windows\System\hUePPTu.exe
  2⤵
  PID:5072
- C:\Windows\System\PlqeCRd.exe
  C:\Windows\System\PlqeCRd.exe
  2⤵
  PID:4912
- C:\Windows\System\ZywnbtI.exe
  C:\Windows\System\ZywnbtI.exe
  2⤵
  PID:3676
- C:\Windows\System\vRNgEXx.exe
  C:\Windows\System\vRNgEXx.exe
  2⤵
  PID:4900
- C:\Windows\System\hwAAuSq.exe
  C:\Windows\System\hwAAuSq.exe
  2⤵
  PID:3316
- C:\Windows\System\nXuvkAZ.exe
  C:\Windows\System\nXuvkAZ.exe
  2⤵
  PID:3996
- C:\Windows\System\PWjJeMy.exe
  C:\Windows\System\PWjJeMy.exe
  2⤵
  PID:4060
- C:\Windows\System\NxbxkNe.exe
  C:\Windows\System\NxbxkNe.exe
  2⤵
  PID:3904
- C:\Windows\System\lQRMJDG.exe
  C:\Windows\System\lQRMJDG.exe
  2⤵
  PID:4092
- C:\Windows\System\JeYJVFy.exe
  C:\Windows\System\JeYJVFy.exe
  2⤵
  PID:1348
- C:\Windows\System\InqNgMn.exe
  C:\Windows\System\InqNgMn.exe
  2⤵
  PID:3116
- C:\Windows\System\rCnTXeQ.exe
  C:\Windows\System\rCnTXeQ.exe
  2⤵
  PID:3448
- C:\Windows\System\SxWeNkh.exe
  C:\Windows\System\SxWeNkh.exe
  2⤵
  PID:3788
- C:\Windows\System\BcEdQXZ.exe
  C:\Windows\System\BcEdQXZ.exe
  2⤵
  PID:980
- C:\Windows\System\WMiaksk.exe
  C:\Windows\System\WMiaksk.exe
  2⤵
  PID:3008
- C:\Windows\System\soPtQMz.exe
  C:\Windows\System\soPtQMz.exe
  2⤵
  PID:3916
- C:\Windows\System\CLmLfmg.exe
  C:\Windows\System\CLmLfmg.exe
  2⤵
  PID:1604
- C:\Windows\System\vvJjaXd.exe
  C:\Windows\System\vvJjaXd.exe
  2⤵
  PID:2544
- C:\Windows\System\msEMFKL.exe
  C:\Windows\System\msEMFKL.exe
  2⤵
  PID:1164
- C:\Windows\System\ysmXBYA.exe
  C:\Windows\System\ysmXBYA.exe
  2⤵
  PID:3192
- C:\Windows\System\gLLPrTs.exe
  C:\Windows\System\gLLPrTs.exe
  2⤵
  PID:2808
- C:\Windows\System\GQdFkwh.exe
  C:\Windows\System\GQdFkwh.exe
  2⤵
  PID:2960
- C:\Windows\System\spUnXPA.exe
  C:\Windows\System\spUnXPA.exe
  2⤵
  PID:4108
- C:\Windows\System\ACZXpRW.exe
  C:\Windows\System\ACZXpRW.exe
  2⤵
  PID:5028
- C:\Windows\System\GPsYEpX.exe
  C:\Windows\System\GPsYEpX.exe
  2⤵
  PID:4724
- C:\Windows\System\HbffJiy.exe
  C:\Windows\System\HbffJiy.exe
  2⤵
  PID:4356
- C:\Windows\System\DWasbkb.exe
  C:\Windows\System\DWasbkb.exe
  2⤵
  PID:4152
- C:\Windows\System\JEaRjDD.exe
  C:\Windows\System\JEaRjDD.exe
  2⤵
  PID:4280
- C:\Windows\System\oJYjcHs.exe
  C:\Windows\System\oJYjcHs.exe
  2⤵
  PID:4596
- C:\Windows\System\MgHCAzx.exe
  C:\Windows\System\MgHCAzx.exe
  2⤵
  PID:4672
- C:\Windows\System\ToAxtPO.exe
  C:\Windows\System\ToAxtPO.exe
  2⤵
  PID:4868
- C:\Windows\System\LbNHZBk.exe
  C:\Windows\System\LbNHZBk.exe
  2⤵
  PID:3756
- C:\Windows\System\mRCMWbL.exe
  C:\Windows\System\mRCMWbL.exe
  2⤵
  PID:3964
- C:\Windows\System\Pvbeccd.exe
  C:\Windows\System\Pvbeccd.exe
  2⤵
  PID:3152
- C:\Windows\System\wqGTmjH.exe
  C:\Windows\System\wqGTmjH.exe
  2⤵
  PID:3560
- C:\Windows\System\hENLBHv.exe
  C:\Windows\System\hENLBHv.exe
  2⤵
  PID:3952
- C:\Windows\System\qnIsuTQ.exe
  C:\Windows\System\qnIsuTQ.exe
  2⤵
  PID:1752
- C:\Windows\System\Rrseiww.exe
  C:\Windows\System\Rrseiww.exe
  2⤵
  PID:3888
- C:\Windows\System\FutwVNi.exe
  C:\Windows\System\FutwVNi.exe
  2⤵
  PID:2620
- C:\Windows\System\yqEtcdl.exe
  C:\Windows\System\yqEtcdl.exe
  2⤵
  PID:308
- C:\Windows\System\RXpxBkn.exe
  C:\Windows\System\RXpxBkn.exe
  2⤵
  PID:4076
- C:\Windows\System\NwnDGRT.exe
  C:\Windows\System\NwnDGRT.exe
  2⤵
  PID:1864
- C:\Windows\System\IfyMtvA.exe
  C:\Windows\System\IfyMtvA.exe
  2⤵
  PID:412
- C:\Windows\System\vrdVDoX.exe
  C:\Windows\System\vrdVDoX.exe
  2⤵
  PID:1872
- C:\Windows\System\TNjLVxl.exe
  C:\Windows\System\TNjLVxl.exe
  2⤵
  PID:2428
- C:\Windows\System\xSaGcll.exe
  C:\Windows\System\xSaGcll.exe
  2⤵
  PID:3724
- C:\Windows\System\LthQQPA.exe
  C:\Windows\System\LthQQPA.exe
  2⤵
  PID:4172
- C:\Windows\System\yYPkomb.exe
  C:\Windows\System\yYPkomb.exe
  2⤵
  PID:3400
- C:\Windows\System\BwuLlyU.exe
  C:\Windows\System\BwuLlyU.exe
  2⤵
  PID:4752
- C:\Windows\System\lfikKzT.exe
  C:\Windows\System\lfikKzT.exe
  2⤵
  PID:2280
- C:\Windows\System\hklhhnf.exe
  C:\Windows\System\hklhhnf.exe
  2⤵
  PID:2192
- C:\Windows\System\trsNKbz.exe
  C:\Windows\System\trsNKbz.exe
  2⤵
  PID:5040
- C:\Windows\System\iqfMpLS.exe
  C:\Windows\System\iqfMpLS.exe
  2⤵
  PID:3632
- C:\Windows\System\mYteFrY.exe
  C:\Windows\System\mYteFrY.exe
  2⤵
  PID:4300
- C:\Windows\System\MZLvAgu.exe
  C:\Windows\System\MZLvAgu.exe
  2⤵
  PID:4140
- C:\Windows\System\EuQjIHu.exe
  C:\Windows\System\EuQjIHu.exe
  2⤵
  PID:3264
- C:\Windows\System\SjshGFW.exe
  C:\Windows\System\SjshGFW.exe
  2⤵
  PID:3840
- C:\Windows\System\reUpamj.exe
  C:\Windows\System\reUpamj.exe
  2⤵
  PID:2132
- C:\Windows\System\omfLZxM.exe
  C:\Windows\System\omfLZxM.exe
  2⤵
  PID:3280
- C:\Windows\System\TLbkeIv.exe
  C:\Windows\System\TLbkeIv.exe
  2⤵
  PID:3340
- C:\Windows\System\nSyXTJZ.exe
  C:\Windows\System\nSyXTJZ.exe
  2⤵
  PID:4348
- C:\Windows\System\KcnOSWa.exe
  C:\Windows\System\KcnOSWa.exe
  2⤵
  PID:4720
- C:\Windows\System\irTdHcw.exe
  C:\Windows\System\irTdHcw.exe
  2⤵
  PID:5124
- C:\Windows\System\KSRrTyT.exe
  C:\Windows\System\KSRrTyT.exe
  2⤵
  PID:5140
- C:\Windows\System\UnorwTD.exe
  C:\Windows\System\UnorwTD.exe
  2⤵
  PID:5156
- C:\Windows\System\WYDSnnE.exe
  C:\Windows\System\WYDSnnE.exe
  2⤵
  PID:5172
- C:\Windows\System\ypCQpfU.exe
  C:\Windows\System\ypCQpfU.exe
  2⤵
  PID:5192
- C:\Windows\System\GwXqBKU.exe
  C:\Windows\System\GwXqBKU.exe
  2⤵
  PID:5264
- C:\Windows\System\iDTfaLO.exe
  C:\Windows\System\iDTfaLO.exe
  2⤵
  PID:5280
- C:\Windows\System\DrNsRym.exe
  C:\Windows\System\DrNsRym.exe
  2⤵
  PID:5296
- C:\Windows\System\SzevzVx.exe
  C:\Windows\System\SzevzVx.exe
  2⤵
  PID:5312
- C:\Windows\System\WyzfjGk.exe
  C:\Windows\System\WyzfjGk.exe
  2⤵
  PID:5328
- C:\Windows\System\oMByxsc.exe
  C:\Windows\System\oMByxsc.exe
  2⤵
  PID:5356
- C:\Windows\System\AbYUphH.exe
  C:\Windows\System\AbYUphH.exe
  2⤵
  PID:5376
- C:\Windows\System\dJHSMCT.exe
  C:\Windows\System\dJHSMCT.exe
  2⤵
  PID:5392
- C:\Windows\System\jGifZpe.exe
  C:\Windows\System\jGifZpe.exe
  2⤵
  PID:5408
- C:\Windows\System\gBgorJC.exe
  C:\Windows\System\gBgorJC.exe
  2⤵
  PID:5428
- C:\Windows\System\MfHdEIE.exe
  C:\Windows\System\MfHdEIE.exe
  2⤵
  PID:5444
- C:\Windows\System\SanpTVr.exe
  C:\Windows\System\SanpTVr.exe
  2⤵
  PID:5460
- C:\Windows\System\LoGVZfz.exe
  C:\Windows\System\LoGVZfz.exe
  2⤵
  PID:5476
- C:\Windows\System\oQebUXw.exe
  C:\Windows\System\oQebUXw.exe
  2⤵
  PID:5492
- C:\Windows\System\VPUzlBz.exe
  C:\Windows\System\VPUzlBz.exe
  2⤵
  PID:5512
- C:\Windows\System\hBvVCVU.exe
  C:\Windows\System\hBvVCVU.exe
  2⤵
  PID:5528
- C:\Windows\System\mBIqyor.exe
  C:\Windows\System\mBIqyor.exe
  2⤵
  PID:5544
- C:\Windows\System\KgqJhMB.exe
  C:\Windows\System\KgqJhMB.exe
  2⤵
  PID:5560
- C:\Windows\System\NHmnEXd.exe
  C:\Windows\System\NHmnEXd.exe
  2⤵
  PID:5576
- C:\Windows\System\RqpQnEd.exe
  C:\Windows\System\RqpQnEd.exe
  2⤵
  PID:5596
- C:\Windows\System\pfwrBVb.exe
  C:\Windows\System\pfwrBVb.exe
  2⤵
  PID:5612
- C:\Windows\System\YqoUdUZ.exe
  C:\Windows\System\YqoUdUZ.exe
  2⤵
  PID:5628
- C:\Windows\System\zwYxkrg.exe
  C:\Windows\System\zwYxkrg.exe
  2⤵
  PID:5648
- C:\Windows\System\WWLMAek.exe
  C:\Windows\System\WWLMAek.exe
  2⤵
  PID:5664
- C:\Windows\System\jYdPbMV.exe
  C:\Windows\System\jYdPbMV.exe
  2⤵
  PID:5680
- C:\Windows\System\NTXGwVT.exe
  C:\Windows\System\NTXGwVT.exe
  2⤵
  PID:5696
- C:\Windows\System\IKXWmYn.exe
  C:\Windows\System\IKXWmYn.exe
  2⤵
  PID:5712
- C:\Windows\System\BNmuqma.exe
  C:\Windows\System\BNmuqma.exe
  2⤵
  PID:5728
- C:\Windows\System\fsjLIAg.exe
  C:\Windows\System\fsjLIAg.exe
  2⤵
  PID:5748
- C:\Windows\System\BCHORas.exe
  C:\Windows\System\BCHORas.exe
  2⤵
  PID:5764
- C:\Windows\System\haWLhvf.exe
  C:\Windows\System\haWLhvf.exe
  2⤵
  PID:5780
- C:\Windows\System\CnsLDRL.exe
  C:\Windows\System\CnsLDRL.exe
  2⤵
  PID:5796
- C:\Windows\System\ryoFteQ.exe
  C:\Windows\System\ryoFteQ.exe
  2⤵
  PID:5812
- C:\Windows\System\vIlcHCM.exe
  C:\Windows\System\vIlcHCM.exe
  2⤵
  PID:5828
- C:\Windows\System\JLBAAvd.exe
  C:\Windows\System\JLBAAvd.exe
  2⤵
  PID:5844
- C:\Windows\System\SWGylWX.exe
  C:\Windows\System\SWGylWX.exe
  2⤵
  PID:5864
- C:\Windows\System\FVIjWdN.exe
  C:\Windows\System\FVIjWdN.exe
  2⤵
  PID:5880
- C:\Windows\System\mPHomtL.exe
  C:\Windows\System\mPHomtL.exe
  2⤵
  PID:5896
- C:\Windows\System\lePcwbV.exe
  C:\Windows\System\lePcwbV.exe
  2⤵
  PID:5912
- C:\Windows\System\dCipBWE.exe
  C:\Windows\System\dCipBWE.exe
  2⤵
  PID:5928
- C:\Windows\System\ooDPfSt.exe
  C:\Windows\System\ooDPfSt.exe
  2⤵
  PID:5944
- C:\Windows\System\zzFxKKA.exe
  C:\Windows\System\zzFxKKA.exe
  2⤵
  PID:5960
- C:\Windows\System\BwRdzdu.exe
  C:\Windows\System\BwRdzdu.exe
  2⤵
  PID:5976
- C:\Windows\System\YIuFZqA.exe
  C:\Windows\System\YIuFZqA.exe
  2⤵
  PID:5996
- C:\Windows\System\NgEBjbH.exe
  C:\Windows\System\NgEBjbH.exe
  2⤵
  PID:6012
- C:\Windows\System\gKNdPFw.exe
  C:\Windows\System\gKNdPFw.exe
  2⤵
  PID:6028
- C:\Windows\System\ZrHbKVk.exe
  C:\Windows\System\ZrHbKVk.exe
  2⤵
  PID:6048
- C:\Windows\System\ZXVOwCR.exe
  C:\Windows\System\ZXVOwCR.exe
  2⤵
  PID:6064
- C:\Windows\System\QEwFMPU.exe
  C:\Windows\System\QEwFMPU.exe
  2⤵
  PID:6080
- C:\Windows\System\QHlDcGS.exe
  C:\Windows\System\QHlDcGS.exe
  2⤵
  PID:6100
- C:\Windows\System\lsIhuor.exe
  C:\Windows\System\lsIhuor.exe
  2⤵
  PID:6116
- C:\Windows\System\bSBzkhp.exe
  C:\Windows\System\bSBzkhp.exe
  2⤵
  PID:6136
- C:\Windows\System\LGHrXXx.exe
  C:\Windows\System\LGHrXXx.exe
  2⤵
  PID:4980
- C:\Windows\System\smlxDUW.exe
  C:\Windows\System\smlxDUW.exe
  2⤵
  PID:896
- C:\Windows\System\IcAVKiV.exe
  C:\Windows\System\IcAVKiV.exe
  2⤵
  PID:4452
- C:\Windows\System\XzWIzNY.exe
  C:\Windows\System\XzWIzNY.exe
  2⤵
  PID:760
- C:\Windows\System\NtpJXfe.exe
  C:\Windows\System\NtpJXfe.exe
  2⤵
  PID:4976
- C:\Windows\System\ZrhVqvN.exe
  C:\Windows\System\ZrhVqvN.exe
  2⤵
  PID:2068
- C:\Windows\System\oxfdHDV.exe
  C:\Windows\System\oxfdHDV.exe
  2⤵
  PID:3176
- C:\Windows\System\VChJyFo.exe
  C:\Windows\System\VChJyFo.exe
  2⤵
  PID:4800
- C:\Windows\System\lAnnXXL.exe
  C:\Windows\System\lAnnXXL.exe
  2⤵
  PID:5184
- C:\Windows\System\xFzAohw.exe
  C:\Windows\System\xFzAohw.exe
  2⤵
  PID:5164
- C:\Windows\System\PGbHDON.exe
  C:\Windows\System\PGbHDON.exe
  2⤵
  PID:3204
- C:\Windows\System\mgUfApG.exe
  C:\Windows\System\mgUfApG.exe
  2⤵
  PID:5220
- C:\Windows\System\PyggZiL.exe
  C:\Windows\System\PyggZiL.exe
  2⤵
  PID:5236
- C:\Windows\System\XwPwhcx.exe
  C:\Windows\System\XwPwhcx.exe
  2⤵
  PID:5256
- C:\Windows\System\DAMuvjG.exe
  C:\Windows\System\DAMuvjG.exe
  2⤵
  PID:5320
- C:\Windows\System\GzQcbXg.exe
  C:\Windows\System\GzQcbXg.exe
  2⤵
  PID:5304
- C:\Windows\System\vkXQVjZ.exe
  C:\Windows\System\vkXQVjZ.exe
  2⤵
  PID:5308
- C:\Windows\System\kModCDK.exe
  C:\Windows\System\kModCDK.exe
  2⤵
  PID:5400
- C:\Windows\System\UXbEClV.exe
  C:\Windows\System\UXbEClV.exe
  2⤵
  PID:5468
- C:\Windows\System\exBRIDK.exe
  C:\Windows\System\exBRIDK.exe
  2⤵
  PID:5536
- C:\Windows\System\BFzAahM.exe
  C:\Windows\System\BFzAahM.exe
  2⤵
  PID:5604
- C:\Windows\System\rWGdHiS.exe
  C:\Windows\System\rWGdHiS.exe
  2⤵
  PID:5644
- C:\Windows\System\OcWetUr.exe
  C:\Windows\System\OcWetUr.exe
  2⤵
  PID:5708
- C:\Windows\System\hufoSXi.exe
  C:\Windows\System\hufoSXi.exe
  2⤵
  PID:5772
- C:\Windows\System\SxZcZuK.exe
  C:\Windows\System\SxZcZuK.exe
  2⤵
  PID:5876
- C:\Windows\System\YwkYMsM.exe
  C:\Windows\System\YwkYMsM.exe
  2⤵
  PID:5352
- C:\Windows\System\ImOywcZ.exe
  C:\Windows\System\ImOywcZ.exe
  2⤵
  PID:5936
- C:\Windows\System\DjbdHbH.exe
  C:\Windows\System\DjbdHbH.exe
  2⤵
  PID:5384
- C:\Windows\System\nqsFvZH.exe
  C:\Windows\System\nqsFvZH.exe
  2⤵
  PID:5688
- C:\Windows\System\ImNiRdV.exe
  C:\Windows\System\ImNiRdV.exe
  2⤵
  PID:5856
- C:\Windows\System\oXnrSuv.exe
  C:\Windows\System\oXnrSuv.exe
  2⤵
  PID:6024
- C:\Windows\System\TbVtKRq.exe
  C:\Windows\System\TbVtKRq.exe
  2⤵
  PID:6088
- C:\Windows\System\CWXWbks.exe
  C:\Windows\System\CWXWbks.exe
  2⤵
  PID:3336
- C:\Windows\System\dpjUHPU.exe
  C:\Windows\System\dpjUHPU.exe
  2⤵
  PID:5692
- C:\Windows\System\NboayyL.exe
  C:\Windows\System\NboayyL.exe
  2⤵
  PID:5456
- C:\Windows\System\UYtiiuU.exe
  C:\Windows\System\UYtiiuU.exe
  2⤵
  PID:5620
- C:\Windows\System\aevFWKx.exe
  C:\Windows\System\aevFWKx.exe
  2⤵
  PID:5852
- C:\Windows\System\BaiPvTx.exe
  C:\Windows\System\BaiPvTx.exe
  2⤵
  PID:5956
- C:\Windows\System\JFkkeNX.exe
  C:\Windows\System\JFkkeNX.exe
  2⤵
  PID:6132
- C:\Windows\System\BZHEvGr.exe
  C:\Windows\System\BZHEvGr.exe
  2⤵
  PID:5656
- C:\Windows\System\GKrZcDD.exe
  C:\Windows\System\GKrZcDD.exe
  2⤵
  PID:5240
- C:\Windows\System\vVKkzyV.exe
  C:\Windows\System\vVKkzyV.exe
  2⤵
  PID:5272
- C:\Windows\System\osLrpue.exe
  C:\Windows\System\osLrpue.exe
  2⤵
  PID:5180
- C:\Windows\System\QtPhtCS.exe
  C:\Windows\System\QtPhtCS.exe
  2⤵
  PID:5568
- C:\Windows\System\rIyTJeW.exe
  C:\Windows\System\rIyTJeW.exe
  2⤵
  PID:5704
- C:\Windows\System\MRHCSRm.exe
  C:\Windows\System\MRHCSRm.exe
  2⤵
  PID:5508
- C:\Windows\System\xhvvXeo.exe
  C:\Windows\System\xhvvXeo.exe
  2⤵
  PID:5836
- C:\Windows\System\JBhXNBF.exe
  C:\Windows\System\JBhXNBF.exe
  2⤵
  PID:5740
- C:\Windows\System\MaAqTSv.exe
  C:\Windows\System\MaAqTSv.exe
  2⤵
  PID:6036
- C:\Windows\System\daHfikM.exe
  C:\Windows\System\daHfikM.exe
  2⤵
  PID:6072
- C:\Windows\System\SgdqKGn.exe
  C:\Windows\System\SgdqKGn.exe
  2⤵
  PID:6004
- C:\Windows\System\qzBtrAG.exe
  C:\Windows\System\qzBtrAG.exe
  2⤵
  PID:4184
- C:\Windows\System\mtMxyhf.exe
  C:\Windows\System\mtMxyhf.exe
  2⤵
  PID:5724
- C:\Windows\System\LnkkYml.exe
  C:\Windows\System\LnkkYml.exe
  2⤵
  PID:6060
- C:\Windows\System\iUNRPJe.exe
  C:\Windows\System\iUNRPJe.exe
  2⤵
  PID:5992
- C:\Windows\System\bqFzSHb.exe
  C:\Windows\System\bqFzSHb.exe
  2⤵
  PID:1336
- C:\Windows\System\XqVBfXA.exe
  C:\Windows\System\XqVBfXA.exe
  2⤵
  PID:5792
- C:\Windows\System\BsnnCtk.exe
  C:\Windows\System\BsnnCtk.exe
  2⤵
  PID:5820
- C:\Windows\System\npiTdIs.exe
  C:\Windows\System\npiTdIs.exe
  2⤵
  PID:6128
- C:\Windows\System\lcZRpXS.exe
  C:\Windows\System\lcZRpXS.exe
  2⤵
  PID:5920
- C:\Windows\System\ckBUttK.exe
  C:\Windows\System\ckBUttK.exe
  2⤵
  PID:4516
- C:\Windows\System\JyrRgAl.exe
  C:\Windows\System\JyrRgAl.exe
  2⤵
  PID:1532
- C:\Windows\System\IdIqJlp.exe
  C:\Windows\System\IdIqJlp.exe
  2⤵
  PID:5216
- C:\Windows\System\gPGgTDt.exe
  C:\Windows\System\gPGgTDt.exe
  2⤵
  PID:2728
- C:\Windows\System\hbnlYpP.exe
  C:\Windows\System\hbnlYpP.exe
  2⤵
  PID:5676
- C:\Windows\System\HEVBIZn.exe
  C:\Windows\System\HEVBIZn.exe
  2⤵
  PID:5372
- C:\Windows\System\KdHRerw.exe
  C:\Windows\System\KdHRerw.exe
  2⤵
  PID:4436
- C:\Windows\System\thqLyzf.exe
  C:\Windows\System\thqLyzf.exe
  2⤵
  PID:5984
- C:\Windows\System\hBjZgUG.exe
  C:\Windows\System\hBjZgUG.exe
  2⤵
  PID:6096
- C:\Windows\System\vRBaLsk.exe
  C:\Windows\System\vRBaLsk.exe
  2⤵
  PID:5148
- C:\Windows\System\incqarq.exe
  C:\Windows\System\incqarq.exe
  2⤵
  PID:6008
- C:\Windows\System\SDlodcC.exe
  C:\Windows\System\SDlodcC.exe
  2⤵
  PID:4120
- C:\Windows\System\NPQOoDV.exe
  C:\Windows\System\NPQOoDV.exe
  2⤵
  PID:6112
- C:\Windows\System\feWAFDd.exe
  C:\Windows\System\feWAFDd.exe
  2⤵
  PID:5520
- C:\Windows\System\lvaUrLO.exe
  C:\Windows\System\lvaUrLO.exe
  2⤵
  PID:6156
- C:\Windows\System\pFYRVRK.exe
  C:\Windows\System\pFYRVRK.exe
  2⤵
  PID:6172
- C:\Windows\System\tbTjpOH.exe
  C:\Windows\System\tbTjpOH.exe
  2⤵
  PID:6188
- C:\Windows\System\YyzvoIn.exe
  C:\Windows\System\YyzvoIn.exe
  2⤵
  PID:6204
- C:\Windows\System\WuMLcrJ.exe
  C:\Windows\System\WuMLcrJ.exe
  2⤵
  PID:6324
- C:\Windows\System\jiZGjTU.exe
  C:\Windows\System\jiZGjTU.exe
  2⤵
  PID:6340
- C:\Windows\System\TrzqQWg.exe
  C:\Windows\System\TrzqQWg.exe
  2⤵
  PID:6356
- C:\Windows\System\FHlpKmZ.exe
  C:\Windows\System\FHlpKmZ.exe
  2⤵
  PID:6372
- C:\Windows\System\auhjRSb.exe
  C:\Windows\System\auhjRSb.exe
  2⤵
  PID:6388
- C:\Windows\System\DPXSjPI.exe
  C:\Windows\System\DPXSjPI.exe
  2⤵
  PID:6404
- C:\Windows\System\UTfUTuL.exe
  C:\Windows\System\UTfUTuL.exe
  2⤵
  PID:6420
- C:\Windows\System\IJJjEJl.exe
  C:\Windows\System\IJJjEJl.exe
  2⤵
  PID:6436
- C:\Windows\System\IujCcPY.exe
  C:\Windows\System\IujCcPY.exe
  2⤵
  PID:6452
- C:\Windows\System\dCiYROX.exe
  C:\Windows\System\dCiYROX.exe
  2⤵
  PID:6468
- C:\Windows\System\ETtEeoj.exe
  C:\Windows\System\ETtEeoj.exe
  2⤵
  PID:6484
- C:\Windows\System\amicIrN.exe
  C:\Windows\System\amicIrN.exe
  2⤵
  PID:6500
- C:\Windows\System\xceyfLJ.exe
  C:\Windows\System\xceyfLJ.exe
  2⤵
  PID:6516
- C:\Windows\System\UCXjXgu.exe
  C:\Windows\System\UCXjXgu.exe
  2⤵
  PID:6532
- C:\Windows\System\yabcITn.exe
  C:\Windows\System\yabcITn.exe
  2⤵
  PID:6548
- C:\Windows\System\hZtlaRj.exe
  C:\Windows\System\hZtlaRj.exe
  2⤵
  PID:6564
- C:\Windows\System\GBZdeIM.exe
  C:\Windows\System\GBZdeIM.exe
  2⤵
  PID:6580
- C:\Windows\System\Pijxtvs.exe
  C:\Windows\System\Pijxtvs.exe
  2⤵
  PID:6596
- C:\Windows\System\WtLTOrT.exe
  C:\Windows\System\WtLTOrT.exe
  2⤵
  PID:6612
- C:\Windows\System\PaMUEQv.exe
  C:\Windows\System\PaMUEQv.exe
  2⤵
  PID:6628
- C:\Windows\System\cKacTRi.exe
  C:\Windows\System\cKacTRi.exe
  2⤵
  PID:6644
- C:\Windows\System\pGnbaei.exe
  C:\Windows\System\pGnbaei.exe
  2⤵
  PID:6660
- C:\Windows\System\DIYQhmt.exe
  C:\Windows\System\DIYQhmt.exe
  2⤵
  PID:6676
- C:\Windows\System\pPamKPx.exe
  C:\Windows\System\pPamKPx.exe
  2⤵
  PID:6692
- C:\Windows\System\lGVMkpK.exe
  C:\Windows\System\lGVMkpK.exe
  2⤵
  PID:6708
- C:\Windows\System\aNWpkfY.exe
  C:\Windows\System\aNWpkfY.exe
  2⤵
  PID:6724
- C:\Windows\System\BuntDwN.exe
  C:\Windows\System\BuntDwN.exe
  2⤵
  PID:6740
- C:\Windows\System\CQnHxvf.exe
  C:\Windows\System\CQnHxvf.exe
  2⤵
  PID:6756
- C:\Windows\System\ZNbIBIh.exe
  C:\Windows\System\ZNbIBIh.exe
  2⤵
  PID:6772
- C:\Windows\System\ZEbSdGo.exe
  C:\Windows\System\ZEbSdGo.exe
  2⤵
  PID:6788
- C:\Windows\System\ggDiZzw.exe
  C:\Windows\System\ggDiZzw.exe
  2⤵
  PID:6804
- C:\Windows\System\ATJPXWD.exe
  C:\Windows\System\ATJPXWD.exe
  2⤵
  PID:6820
- C:\Windows\System\wolNQPJ.exe
  C:\Windows\System\wolNQPJ.exe
  2⤵
  PID:6836
- C:\Windows\System\ZAfdVBP.exe
  C:\Windows\System\ZAfdVBP.exe
  2⤵
  PID:6852
- C:\Windows\System\qEhEghE.exe
  C:\Windows\System\qEhEghE.exe
  2⤵
  PID:6868
- C:\Windows\System\ZJqiGwd.exe
  C:\Windows\System\ZJqiGwd.exe
  2⤵
  PID:6884
- C:\Windows\System\QMqknax.exe
  C:\Windows\System\QMqknax.exe
  2⤵
  PID:6900
- C:\Windows\System\SgazeWz.exe
  C:\Windows\System\SgazeWz.exe
  2⤵
  PID:6916
- C:\Windows\System\HJrQloP.exe
  C:\Windows\System\HJrQloP.exe
  2⤵
  PID:6932
- C:\Windows\System\rEDqptt.exe
  C:\Windows\System\rEDqptt.exe
  2⤵
  PID:6948
- C:\Windows\System\SoWMFIU.exe
  C:\Windows\System\SoWMFIU.exe
  2⤵
  PID:6964
- C:\Windows\System\gPDIfgE.exe
  C:\Windows\System\gPDIfgE.exe
  2⤵
  PID:6980
- C:\Windows\System\FRYmxjJ.exe
  C:\Windows\System\FRYmxjJ.exe
  2⤵
  PID:6996
- C:\Windows\System\XUYuIzu.exe
  C:\Windows\System\XUYuIzu.exe
  2⤵
  PID:7012
- C:\Windows\System\vLnnYpa.exe
  C:\Windows\System\vLnnYpa.exe
  2⤵
  PID:7028
- C:\Windows\System\YxeiLQe.exe
  C:\Windows\System\YxeiLQe.exe
  2⤵
  PID:7044
- C:\Windows\System\uLijJkl.exe
  C:\Windows\System\uLijJkl.exe
  2⤵
  PID:7060
- C:\Windows\System\LGNhCum.exe
  C:\Windows\System\LGNhCum.exe
  2⤵
  PID:7076
- C:\Windows\System\qzkJlMh.exe
  C:\Windows\System\qzkJlMh.exe
  2⤵
  PID:7092
- C:\Windows\System\bqRpKOh.exe
  C:\Windows\System\bqRpKOh.exe
  2⤵
  PID:7108
- C:\Windows\System\fFDRKTY.exe
  C:\Windows\System\fFDRKTY.exe
  2⤵
  PID:7124
- C:\Windows\System\wFnBVqU.exe
  C:\Windows\System\wFnBVqU.exe
  2⤵
  PID:7140
- C:\Windows\System\eqhEFxg.exe
  C:\Windows\System\eqhEFxg.exe
  2⤵
  PID:7156
- C:\Windows\System\esvNiUR.exe
  C:\Windows\System\esvNiUR.exe
  2⤵
  PID:5232
- C:\Windows\System\bdTeliy.exe
  C:\Windows\System\bdTeliy.exe
  2⤵
  PID:6056
- C:\Windows\System\NoeQZoS.exe
  C:\Windows\System\NoeQZoS.exe
  2⤵
  PID:5840
- C:\Windows\System\AGmSeXu.exe
  C:\Windows\System\AGmSeXu.exe
  2⤵
  PID:5788
- C:\Windows\System\ckzEIwP.exe
  C:\Windows\System\ckzEIwP.exe
  2⤵
  PID:5524
- C:\Windows\System\fLrMkCa.exe
  C:\Windows\System\fLrMkCa.exe
  2⤵
  PID:2024
- C:\Windows\System\DKXAhDk.exe
  C:\Windows\System\DKXAhDk.exe
  2⤵
  PID:5584
- C:\Windows\System\xcbVvQj.exe
  C:\Windows\System\xcbVvQj.exe
  2⤵
  PID:5592
- C:\Windows\System\QfgAUod.exe
  C:\Windows\System\QfgAUod.exe
  2⤵
  PID:5908
- C:\Windows\System\ejSBNoI.exe
  C:\Windows\System\ejSBNoI.exe
  2⤵
  PID:6200
- C:\Windows\System\MlTFOPr.exe
  C:\Windows\System\MlTFOPr.exe
  2⤵
  PID:6228
- C:\Windows\System\ypBulSO.exe
  C:\Windows\System\ypBulSO.exe
  2⤵
  PID:6244
- C:\Windows\System\CgYMXPM.exe
  C:\Windows\System\CgYMXPM.exe
  2⤵
  PID:6260
- C:\Windows\System\jsNnsBC.exe
  C:\Windows\System\jsNnsBC.exe
  2⤵
  PID:6280
- C:\Windows\System\gdRQOPd.exe
  C:\Windows\System\gdRQOPd.exe
  2⤵
  PID:6296
- C:\Windows\System\hcdfFZq.exe
  C:\Windows\System\hcdfFZq.exe
  2⤵
  PID:6316
- C:\Windows\System\ohadPGI.exe
  C:\Windows\System\ohadPGI.exe
  2⤵
  PID:6348
- C:\Windows\System\tlWhAQv.exe
  C:\Windows\System\tlWhAQv.exe
  2⤵
  PID:6364
- C:\Windows\System\ighkTsy.exe
  C:\Windows\System\ighkTsy.exe
  2⤵
  PID:6448
- C:\Windows\System\GmDoZiY.exe
  C:\Windows\System\GmDoZiY.exe
  2⤵
  PID:6396
- C:\Windows\System\GNHEruj.exe
  C:\Windows\System\GNHEruj.exe
  2⤵
  PID:6540
- C:\Windows\System\WDmnwle.exe
  C:\Windows\System\WDmnwle.exe
  2⤵
  PID:6604
- C:\Windows\System\dQlNszm.exe
  C:\Windows\System\dQlNszm.exe
  2⤵
  PID:6524
- C:\Windows\System\DJhyuQQ.exe
  C:\Windows\System\DJhyuQQ.exe
  2⤵
  PID:6588
- C:\Windows\System\dOUnwcm.exe
  C:\Windows\System\dOUnwcm.exe
  2⤵
  PID:6592
- C:\Windows\System\KFJIBeY.exe
  C:\Windows\System\KFJIBeY.exe
  2⤵
  PID:6496
- C:\Windows\System\uhyWlLE.exe
  C:\Windows\System\uhyWlLE.exe
  2⤵
  PID:6672
- C:\Windows\System\UHQKvVw.exe
  C:\Windows\System\UHQKvVw.exe
  2⤵
  PID:6768
- C:\Windows\System\oZAusLb.exe
  C:\Windows\System\oZAusLb.exe
  2⤵
  PID:6716
- C:\Windows\System\qyXbHYR.exe
  C:\Windows\System\qyXbHYR.exe
  2⤵
  PID:6748
- C:\Windows\System\rXoZoKP.exe
  C:\Windows\System\rXoZoKP.exe
  2⤵
  PID:6844
- C:\Windows\System\ZUvOAuq.exe
  C:\Windows\System\ZUvOAuq.exe
  2⤵
  PID:6896
- C:\Windows\System\rpeeXhr.exe
  C:\Windows\System\rpeeXhr.exe
  2⤵
  PID:6924
- C:\Windows\System\VlHaYme.exe
  C:\Windows\System\VlHaYme.exe
  2⤵
  PID:6944
- C:\Windows\System\sQbbMeg.exe
  C:\Windows\System\sQbbMeg.exe
  2⤵
  PID:7024
- C:\Windows\System\JTznTMP.exe
  C:\Windows\System\JTznTMP.exe
  2⤵
  PID:7088
- C:\Windows\System\RXQHgSW.exe
  C:\Windows\System\RXQHgSW.exe
  2⤵
  PID:7068
- C:\Windows\System\AyoXLdt.exe
  C:\Windows\System\AyoXLdt.exe
  2⤵
  PID:7072
- C:\Windows\System\WJgdbGm.exe
  C:\Windows\System\WJgdbGm.exe
  2⤵
  PID:7132
- C:\Windows\System\EhZhkmR.exe
  C:\Windows\System\EhZhkmR.exe
  2⤵
  PID:7036
- C:\Windows\System\GdbkaZN.exe
  C:\Windows\System\GdbkaZN.exe
  2⤵
  PID:1744
- C:\Windows\System\fUbwEqH.exe
  C:\Windows\System\fUbwEqH.exe
  2⤵
  PID:5212
- C:\Windows\System\EXopxXv.exe
  C:\Windows\System\EXopxXv.exe
  2⤵
  PID:6212
- C:\Windows\System\vkchzMO.exe
  C:\Windows\System\vkchzMO.exe
  2⤵
  PID:6288
- C:\Windows\System\PCITheR.exe
  C:\Windows\System\PCITheR.exe
  2⤵
  PID:6416
- C:\Windows\System\ELPnAPM.exe
  C:\Windows\System\ELPnAPM.exe
  2⤵
  PID:6428
- C:\Windows\System\vqbmNOv.exe
  C:\Windows\System\vqbmNOv.exe
  2⤵
  PID:5500
- C:\Windows\System\pgalxTo.exe
  C:\Windows\System\pgalxTo.exe
  2⤵
  PID:5368
- C:\Windows\System\HLHELLK.exe
  C:\Windows\System\HLHELLK.exe
  2⤵
  PID:7172
- C:\Windows\System\ZnRngRL.exe
  C:\Windows\System\ZnRngRL.exe
  2⤵
  PID:7188
- C:\Windows\System\SJjuGjP.exe
  C:\Windows\System\SJjuGjP.exe
  2⤵
  PID:7204
- C:\Windows\System\lmPBhRx.exe
  C:\Windows\System\lmPBhRx.exe
  2⤵
  PID:7220
- C:\Windows\System\TvIGPTd.exe
  C:\Windows\System\TvIGPTd.exe
  2⤵
  PID:7240
- C:\Windows\System\SlviUFU.exe
  C:\Windows\System\SlviUFU.exe
  2⤵
  PID:7256
- C:\Windows\System\XsCdNhb.exe
  C:\Windows\System\XsCdNhb.exe
  2⤵
  PID:7276
- C:\Windows\System\QonHCiA.exe
  C:\Windows\System\QonHCiA.exe
  2⤵
  PID:7292
- C:\Windows\System\LIrdTIs.exe
  C:\Windows\System\LIrdTIs.exe
  2⤵
  PID:7308
- C:\Windows\System\BGJWqLk.exe
  C:\Windows\System\BGJWqLk.exe
  2⤵
  PID:7328
- C:\Windows\System\wyYLmiD.exe
  C:\Windows\System\wyYLmiD.exe
  2⤵
  PID:7400
- C:\Windows\System\cuBPfvs.exe
  C:\Windows\System\cuBPfvs.exe
  2⤵
  PID:7416
- C:\Windows\System\XMAWkyy.exe
  C:\Windows\System\XMAWkyy.exe
  2⤵
  PID:7436
- C:\Windows\System\lQEjiNb.exe
  C:\Windows\System\lQEjiNb.exe
  2⤵
  PID:7452
- C:\Windows\System\mRcaJoO.exe
  C:\Windows\System\mRcaJoO.exe
  2⤵
  PID:7472
- C:\Windows\System\wlhIYsg.exe
  C:\Windows\System\wlhIYsg.exe
  2⤵
  PID:7488
- C:\Windows\System\LUoVNxt.exe
  C:\Windows\System\LUoVNxt.exe
  2⤵
  PID:7504
- C:\Windows\System\WrxWuxo.exe
  C:\Windows\System\WrxWuxo.exe
  2⤵
  PID:7520
- C:\Windows\System\CwnIZzW.exe
  C:\Windows\System\CwnIZzW.exe
  2⤵
  PID:7536
- C:\Windows\System\WSoLgRY.exe
  C:\Windows\System\WSoLgRY.exe
  2⤵
  PID:7552
- C:\Windows\System\YdIsCRZ.exe
  C:\Windows\System\YdIsCRZ.exe
  2⤵
  PID:7572
- C:\Windows\System\SMeHwoO.exe
  C:\Windows\System\SMeHwoO.exe
  2⤵
  PID:7592
- C:\Windows\System\ItKBIQT.exe
  C:\Windows\System\ItKBIQT.exe
  2⤵
  PID:7608
- C:\Windows\System\jrneyjV.exe
  C:\Windows\System\jrneyjV.exe
  2⤵
  PID:7624
- C:\Windows\System\nWgKonb.exe
  C:\Windows\System\nWgKonb.exe
  2⤵
  PID:7640
- C:\Windows\System\HTCHEHV.exe
  C:\Windows\System\HTCHEHV.exe
  2⤵
  PID:7656
- C:\Windows\System\ENNkRVy.exe
  C:\Windows\System\ENNkRVy.exe
  2⤵
  PID:7672
- C:\Windows\System\kWijVMx.exe
  C:\Windows\System\kWijVMx.exe
  2⤵
  PID:7688
- C:\Windows\System\TxaWTxy.exe
  C:\Windows\System\TxaWTxy.exe
  2⤵
  PID:7704
- C:\Windows\System\zFDGyLD.exe
  C:\Windows\System\zFDGyLD.exe
  2⤵
  PID:7720
- C:\Windows\System\dNIbdFZ.exe
  C:\Windows\System\dNIbdFZ.exe
  2⤵
  PID:7736
- C:\Windows\System\adsDwAJ.exe
  C:\Windows\System\adsDwAJ.exe
  2⤵
  PID:7752
- C:\Windows\System\gwxqtUn.exe
  C:\Windows\System\gwxqtUn.exe
  2⤵
  PID:7768
- C:\Windows\System\oZLWsAz.exe
  C:\Windows\System\oZLWsAz.exe
  2⤵
  PID:7784
- C:\Windows\System\jslPnSi.exe
  C:\Windows\System\jslPnSi.exe
  2⤵
  PID:7800
- C:\Windows\System\rCRoDLO.exe
  C:\Windows\System\rCRoDLO.exe
  2⤵
  PID:7816
- C:\Windows\System\djXzaXl.exe
  C:\Windows\System\djXzaXl.exe
  2⤵
  PID:7832
- C:\Windows\System\jvzcgVZ.exe
  C:\Windows\System\jvzcgVZ.exe
  2⤵
  PID:7848
- C:\Windows\System\eFPlIEx.exe
  C:\Windows\System\eFPlIEx.exe
  2⤵
  PID:7864
- C:\Windows\System\rCSaEal.exe
  C:\Windows\System\rCSaEal.exe
  2⤵
  PID:7880
- C:\Windows\System\OfyinDe.exe
  C:\Windows\System\OfyinDe.exe
  2⤵
  PID:7896
- C:\Windows\System\tXFjNnS.exe
  C:\Windows\System\tXFjNnS.exe
  2⤵
  PID:7912
- C:\Windows\System\nCItFtH.exe
  C:\Windows\System\nCItFtH.exe
  2⤵
  PID:7928
- C:\Windows\System\uLncyJa.exe
  C:\Windows\System\uLncyJa.exe
  2⤵
  PID:7944
- C:\Windows\System\oXEnWQi.exe
  C:\Windows\System\oXEnWQi.exe
  2⤵
  PID:7960
- C:\Windows\System\RwokmpR.exe
  C:\Windows\System\RwokmpR.exe
  2⤵
  PID:7976
- C:\Windows\System\obipwJj.exe
  C:\Windows\System\obipwJj.exe
  2⤵
  PID:7992
- C:\Windows\System\TdizxcP.exe
  C:\Windows\System\TdizxcP.exe
  2⤵
  PID:8008
- C:\Windows\System\EqGKXjv.exe
  C:\Windows\System\EqGKXjv.exe
  2⤵
  PID:8024
- C:\Windows\System\VqpFeAv.exe
  C:\Windows\System\VqpFeAv.exe
  2⤵
  PID:8040
- C:\Windows\System\XDMzPJa.exe
  C:\Windows\System\XDMzPJa.exe
  2⤵
  PID:8056
- C:\Windows\System\cWqjXqX.exe
  C:\Windows\System\cWqjXqX.exe
  2⤵
  PID:8072
- C:\Windows\System\WtpFkSd.exe
  C:\Windows\System\WtpFkSd.exe
  2⤵
  PID:8088
- C:\Windows\System\ugljAVY.exe
  C:\Windows\System\ugljAVY.exe
  2⤵
  PID:8104
- C:\Windows\System\wyHcwRB.exe
  C:\Windows\System\wyHcwRB.exe
  2⤵
  PID:8120
- C:\Windows\System\tEWWkdp.exe
  C:\Windows\System\tEWWkdp.exe
  2⤵
  PID:8136
- C:\Windows\System\vusFuHw.exe
  C:\Windows\System\vusFuHw.exe
  2⤵
  PID:8152
- C:\Windows\System\LXhrXBb.exe
  C:\Windows\System\LXhrXBb.exe
  2⤵
  PID:8168
- C:\Windows\System\MbkOZbZ.exe
  C:\Windows\System\MbkOZbZ.exe
  2⤵
  PID:8184
- C:\Windows\System\tdzfHkJ.exe
  C:\Windows\System\tdzfHkJ.exe
  2⤵
  PID:6912
- C:\Windows\System\GGvtEMt.exe
  C:\Windows\System\GGvtEMt.exe
  2⤵
  PID:6240
- C:\Windows\System\NXNRdFa.exe
  C:\Windows\System\NXNRdFa.exe
  2⤵
  PID:6384
- C:\Windows\System\DfzhEUe.exe
  C:\Windows\System\DfzhEUe.exe
  2⤵
  PID:6400
- C:\Windows\System\XDUTdJY.exe
  C:\Windows\System\XDUTdJY.exe
  2⤵
  PID:6556
- C:\Windows\System\LbNupyE.exe
  C:\Windows\System\LbNupyE.exe
  2⤵
  PID:6732
- C:\Windows\System\sdFRizP.exe
  C:\Windows\System\sdFRizP.exe
  2⤵
  PID:6816
- C:\Windows\System\VsrseFd.exe
  C:\Windows\System\VsrseFd.exe
  2⤵
  PID:6892
- C:\Windows\System\sxRwSqd.exe
  C:\Windows\System\sxRwSqd.exe
  2⤵
  PID:7100
- C:\Windows\System\XrvEnzD.exe
  C:\Windows\System\XrvEnzD.exe
  2⤵
  PID:7008
- C:\Windows\System\zGGspfF.exe
  C:\Windows\System\zGGspfF.exe
  2⤵
  PID:3312
- C:\Windows\System\FqQHzJq.exe
  C:\Windows\System\FqQHzJq.exe
  2⤵
  PID:6252
- C:\Windows\System\LvKbYZz.exe
  C:\Windows\System\LvKbYZz.exe
  2⤵
  PID:6168
- C:\Windows\System\msZmAzk.exe
  C:\Windows\System\msZmAzk.exe
  2⤵
  PID:6268
- C:\Windows\System\KfyKmoU.exe
  C:\Windows\System\KfyKmoU.exe
  2⤵
  PID:7272
- C:\Windows\System\gAoPTGx.exe
  C:\Windows\System\gAoPTGx.exe
  2⤵
  PID:7288
- C:\Windows\System\pejzXMm.exe
  C:\Windows\System\pejzXMm.exe
  2⤵
  PID:7216
- C:\Windows\System\RyIDqMr.exe
  C:\Windows\System\RyIDqMr.exe
  2⤵
  PID:6908
- C:\Windows\System\jlJYvNx.exe
  C:\Windows\System\jlJYvNx.exe
  2⤵
  PID:7148
- C:\Windows\System\jEoKRYx.exe
  C:\Windows\System\jEoKRYx.exe
  2⤵
  PID:6164
- C:\Windows\System\bUkcjtB.exe
  C:\Windows\System\bUkcjtB.exe
  2⤵
  PID:6336
- C:\Windows\System\cxSjtsU.exe
  C:\Windows\System\cxSjtsU.exe
  2⤵
  PID:6220
- C:\Windows\System\HVHHayV.exe
  C:\Windows\System\HVHHayV.exe
  2⤵
  PID:7324
- C:\Windows\System\LRsPHBB.exe
  C:\Windows\System\LRsPHBB.exe
  2⤵
  PID:7448
- C:\Windows\System\Pbrrgbm.exe
  C:\Windows\System\Pbrrgbm.exe
  2⤵
  PID:7212
- C:\Windows\System\pUkHvTA.exe
  C:\Windows\System\pUkHvTA.exe
  2⤵
  PID:7512
- C:\Windows\System\ouqAXKA.exe
  C:\Windows\System\ouqAXKA.exe
  2⤵
  PID:7568
- C:\Windows\System\fUYyPyy.exe
  C:\Windows\System\fUYyPyy.exe
  2⤵
  PID:7496
- C:\Windows\System\yyFrVjA.exe
  C:\Windows\System\yyFrVjA.exe
  2⤵
  PID:7428
- C:\Windows\System\CyyqeZv.exe
  C:\Windows\System\CyyqeZv.exe
  2⤵
  PID:7392
- C:\Windows\System\LRuyvMr.exe
  C:\Windows\System\LRuyvMr.exe
  2⤵
  PID:7460
- C:\Windows\System\DKLuibH.exe
  C:\Windows\System\DKLuibH.exe
  2⤵
  PID:7616
- C:\Windows\System\PrwWqKY.exe
  C:\Windows\System\PrwWqKY.exe
  2⤵
  PID:7648
- C:\Windows\System\VWeIJPr.exe
  C:\Windows\System\VWeIJPr.exe
  2⤵
  PID:7636
- C:\Windows\System\mwZSCYb.exe
  C:\Windows\System\mwZSCYb.exe
  2⤵
  PID:7712
- C:\Windows\System\MSpLEXG.exe
  C:\Windows\System\MSpLEXG.exe
  2⤵
  PID:7700
- C:\Windows\System\FVFLCRa.exe
  C:\Windows\System\FVFLCRa.exe
  2⤵
  PID:7764
- C:\Windows\System\rRxOIBo.exe
  C:\Windows\System\rRxOIBo.exe
  2⤵
  PID:7812
- C:\Windows\System\gRTWoUo.exe
  C:\Windows\System\gRTWoUo.exe
  2⤵
  PID:7792
- C:\Windows\System\vCqohTg.exe
  C:\Windows\System\vCqohTg.exe
  2⤵
  PID:7920
- C:\Windows\System\UTTKLkT.exe
  C:\Windows\System\UTTKLkT.exe
  2⤵
  PID:7872
- C:\Windows\System\iQNHPqz.exe
  C:\Windows\System\iQNHPqz.exe
  2⤵
  PID:7936
- C:\Windows\System\gZtrmse.exe
  C:\Windows\System\gZtrmse.exe
  2⤵
  PID:7968
- C:\Windows\System\oecinTX.exe
  C:\Windows\System\oecinTX.exe
  2⤵
  PID:8032
- C:\Windows\System\dJOvCyC.exe
  C:\Windows\System\dJOvCyC.exe
  2⤵
  PID:8096
- C:\Windows\System\aCQCzmY.exe
  C:\Windows\System\aCQCzmY.exe
  2⤵
  PID:8160
- C:\Windows\System\kUMPgsY.exe
  C:\Windows\System\kUMPgsY.exe
  2⤵
  PID:6276
- C:\Windows\System\XxOmDvx.exe
  C:\Windows\System\XxOmDvx.exe
  2⤵
  PID:6640
- C:\Windows\System\bILZWcD.exe
  C:\Windows\System\bILZWcD.exe
  2⤵
  PID:6940
- C:\Windows\System\sgmBAmm.exe
  C:\Windows\System\sgmBAmm.exe
  2⤵
  PID:6480
- C:\Windows\System\xnanGRk.exe
  C:\Windows\System\xnanGRk.exe
  2⤵
  PID:8052
- C:\Windows\System\PpDewpY.exe
  C:\Windows\System\PpDewpY.exe
  2⤵
  PID:8176
- C:\Windows\System\sFlNqrg.exe
  C:\Windows\System\sFlNqrg.exe
  2⤵
  PID:7984
- C:\Windows\System\YUytzcp.exe
  C:\Windows\System\YUytzcp.exe
  2⤵
  PID:7248
- C:\Windows\System\npGcEzJ.exe
  C:\Windows\System\npGcEzJ.exe
  2⤵
  PID:7232
- C:\Windows\System\lvmFfbS.exe
  C:\Windows\System\lvmFfbS.exe
  2⤵
  PID:7104
- C:\Windows\System\vaxKOQZ.exe
  C:\Windows\System\vaxKOQZ.exe
  2⤵
  PID:8020
- C:\Windows\System\cyIfQGg.exe
  C:\Windows\System\cyIfQGg.exe
  2⤵
  PID:8148
- C:\Windows\System\IfjKfUO.exe
  C:\Windows\System\IfjKfUO.exe
  2⤵
  PID:7084
- C:\Windows\System\wuwrJqZ.exe
  C:\Windows\System\wuwrJqZ.exe
  2⤵
  PID:6780
- C:\Windows\System\zGuEKZy.exe
  C:\Windows\System\zGuEKZy.exe
  2⤵
  PID:7264
- C:\Windows\System\rFdoOAB.exe
  C:\Windows\System\rFdoOAB.exe
  2⤵
  PID:6656
- C:\Windows\System\xJJtiKz.exe
  C:\Windows\System\xJJtiKz.exe
  2⤵
  PID:7548
- C:\Windows\System\zdcAnKB.exe
  C:\Windows\System\zdcAnKB.exe
  2⤵
  PID:7484
- C:\Windows\System\gTHjBfC.exe
  C:\Windows\System\gTHjBfC.exe
  2⤵
  PID:7564
- C:\Windows\System\YqEzXjp.exe
  C:\Windows\System\YqEzXjp.exe
  2⤵
  PID:7684
- C:\Windows\System\KkkhrNG.exe
  C:\Windows\System\KkkhrNG.exe
  2⤵
  PID:7632
- C:\Windows\System\YqOpXnF.exe
  C:\Windows\System\YqOpXnF.exe
  2⤵
  PID:7468
- C:\Windows\System\GJhxiMR.exe
  C:\Windows\System\GJhxiMR.exe
  2⤵
  PID:7860
- C:\Windows\System\ywbiCxp.exe
  C:\Windows\System\ywbiCxp.exe
  2⤵
  PID:7952
- C:\Windows\System\lbNQUWE.exe
  C:\Windows\System\lbNQUWE.exe
  2⤵
  PID:7808
- C:\Windows\System\LpsEPNQ.exe
  C:\Windows\System\LpsEPNQ.exe
  2⤵
  PID:6960
- C:\Windows\System\TFbhJTT.exe
  C:\Windows\System\TFbhJTT.exe
  2⤵
  PID:7120
- C:\Windows\System\cBJCacN.exe
  C:\Windows\System\cBJCacN.exe
  2⤵
  PID:7904
- C:\Windows\System\wwWYnMu.exe
  C:\Windows\System\wwWYnMu.exe
  2⤵
  PID:8128
- C:\Windows\System\YwwKwuJ.exe
  C:\Windows\System\YwwKwuJ.exe
  2⤵
  PID:6512
- C:\Windows\System\AzDQmdS.exe
  C:\Windows\System\AzDQmdS.exe
  2⤵
  PID:8112
- C:\Windows\System\ERYevtw.exe
  C:\Windows\System\ERYevtw.exe
  2⤵
  PID:6848
- C:\Windows\System\cILGtSB.exe
  C:\Windows\System\cILGtSB.exe
  2⤵
  PID:7180
- C:\Windows\System\sDBluMX.exe
  C:\Windows\System\sDBluMX.exe
  2⤵
  PID:6352
- C:\Windows\System\GglkAlW.exe
  C:\Windows\System\GglkAlW.exe
  2⤵
  PID:6668
- C:\Windows\System\RrgYAWu.exe
  C:\Windows\System\RrgYAWu.exe
  2⤵
  PID:6704
- C:\Windows\System\YuHKuAN.exe
  C:\Windows\System\YuHKuAN.exe
  2⤵
  PID:7600
- C:\Windows\System\wquHxtB.exe
  C:\Windows\System\wquHxtB.exe
  2⤵
  PID:7604
- C:\Windows\System\ctpwlfz.exe
  C:\Windows\System\ctpwlfz.exe
  2⤵
  PID:7924
- C:\Windows\System\gPhuGrJ.exe
  C:\Windows\System\gPhuGrJ.exe
  2⤵
  PID:5244
- C:\Windows\System\GSKMRTg.exe
  C:\Windows\System\GSKMRTg.exe
  2⤵
  PID:8144
- C:\Windows\System\HcKMHqK.exe
  C:\Windows\System\HcKMHqK.exe
  2⤵
  PID:7432
- C:\Windows\System\UFvtZcS.exe
  C:\Windows\System\UFvtZcS.exe
  2⤵
  PID:7748
- C:\Windows\System\wavYtHc.exe
  C:\Windows\System\wavYtHc.exe
  2⤵
  PID:7796
- C:\Windows\System\SiWEDax.exe
  C:\Windows\System\SiWEDax.exe
  2⤵
  PID:7480
- C:\Windows\System\wNNXiZW.exe
  C:\Windows\System\wNNXiZW.exe
  2⤵
  PID:6148
- C:\Windows\System\nsWAfQw.exe
  C:\Windows\System\nsWAfQw.exe
  2⤵
  PID:7728
- C:\Windows\System\UTzUmey.exe
  C:\Windows\System\UTzUmey.exe
  2⤵
  PID:7844
- C:\Windows\System\YKHZBda.exe
  C:\Windows\System\YKHZBda.exe
  2⤵
  PID:7760
- C:\Windows\System\SMlxYrb.exe
  C:\Windows\System\SMlxYrb.exe
  2⤵
  PID:7184
- C:\Windows\System\oamrNGl.exe
  C:\Windows\System\oamrNGl.exe
  2⤵
  PID:1564
- C:\Windows\System\xZBronW.exe
  C:\Windows\System\xZBronW.exe
  2⤵
  PID:8208
- C:\Windows\System\JUYhocZ.exe
  C:\Windows\System\JUYhocZ.exe
  2⤵
  PID:8224
- C:\Windows\System\ghRLibL.exe
  C:\Windows\System\ghRLibL.exe
  2⤵
  PID:8240
- C:\Windows\System\FttDEPS.exe
  C:\Windows\System\FttDEPS.exe
  2⤵
  PID:8256
- C:\Windows\System\XemfZCU.exe
  C:\Windows\System\XemfZCU.exe
  2⤵
  PID:8272
- C:\Windows\System\aPenkGl.exe
  C:\Windows\System\aPenkGl.exe
  2⤵
  PID:8288
- C:\Windows\System\IlzgZrV.exe
  C:\Windows\System\IlzgZrV.exe
  2⤵
  PID:8304
- C:\Windows\System\JyOOhPu.exe
  C:\Windows\System\JyOOhPu.exe
  2⤵
  PID:8320
- C:\Windows\System\FQmvoaG.exe
  C:\Windows\System\FQmvoaG.exe
  2⤵
  PID:8336
- C:\Windows\System\ZjTQxeB.exe
  C:\Windows\System\ZjTQxeB.exe
  2⤵
  PID:8352
- C:\Windows\System\MpUbtaj.exe
  C:\Windows\System\MpUbtaj.exe
  2⤵
  PID:8368
- C:\Windows\System\MgJPfqL.exe
  C:\Windows\System\MgJPfqL.exe
  2⤵
  PID:8384
- C:\Windows\System\mRrhdAs.exe
  C:\Windows\System\mRrhdAs.exe
  2⤵
  PID:8400
- C:\Windows\System\uYSWILb.exe
  C:\Windows\System\uYSWILb.exe
  2⤵
  PID:8416
- C:\Windows\System\bwRtnju.exe
  C:\Windows\System\bwRtnju.exe
  2⤵
  PID:8432
- C:\Windows\System\QOgowaj.exe
  C:\Windows\System\QOgowaj.exe
  2⤵
  PID:8448
- C:\Windows\System\nRWepdS.exe
  C:\Windows\System\nRWepdS.exe
  2⤵
  PID:8464
- C:\Windows\System\bLAFUMi.exe
  C:\Windows\System\bLAFUMi.exe
  2⤵
  PID:8480
- C:\Windows\System\bPCCPSa.exe
  C:\Windows\System\bPCCPSa.exe
  2⤵
  PID:8496
- C:\Windows\System\lUdYafG.exe
  C:\Windows\System\lUdYafG.exe
  2⤵
  PID:8512
- C:\Windows\System\MrrayUN.exe
  C:\Windows\System\MrrayUN.exe
  2⤵
  PID:8528
- C:\Windows\System\SvNnmPA.exe
  C:\Windows\System\SvNnmPA.exe
  2⤵
  PID:8544
- C:\Windows\System\goFYRQV.exe
  C:\Windows\System\goFYRQV.exe
  2⤵
  PID:8560
- C:\Windows\System\FeRTKsH.exe
  C:\Windows\System\FeRTKsH.exe
  2⤵
  PID:8576
- C:\Windows\System\cBKRTkU.exe
  C:\Windows\System\cBKRTkU.exe
  2⤵
  PID:8592
- C:\Windows\System\VDOOwSG.exe
  C:\Windows\System\VDOOwSG.exe
  2⤵
  PID:8608
- C:\Windows\System\GZEeSTS.exe
  C:\Windows\System\GZEeSTS.exe
  2⤵
  PID:8624
- C:\Windows\System\eXRhhjk.exe
  C:\Windows\System\eXRhhjk.exe
  2⤵
  PID:8640
- C:\Windows\System\TRzhBpq.exe
  C:\Windows\System\TRzhBpq.exe
  2⤵
  PID:8656
- C:\Windows\System\teUUoso.exe
  C:\Windows\System\teUUoso.exe
  2⤵
  PID:8672
- C:\Windows\System\qIpZuUh.exe
  C:\Windows\System\qIpZuUh.exe
  2⤵
  PID:8688
- C:\Windows\System\hCYKItL.exe
  C:\Windows\System\hCYKItL.exe
  2⤵
  PID:8704
- C:\Windows\System\ehFOJfa.exe
  C:\Windows\System\ehFOJfa.exe
  2⤵
  PID:8720
- C:\Windows\System\DarzkVK.exe
  C:\Windows\System\DarzkVK.exe
  2⤵
  PID:8736
- C:\Windows\System\vNDwRkZ.exe
  C:\Windows\System\vNDwRkZ.exe
  2⤵
  PID:8752
- C:\Windows\System\jCIcehW.exe
  C:\Windows\System\jCIcehW.exe
  2⤵
  PID:8768
- C:\Windows\System\VmSlfHl.exe
  C:\Windows\System\VmSlfHl.exe
  2⤵
  PID:8784
- C:\Windows\System\oLCHdCO.exe
  C:\Windows\System\oLCHdCO.exe
  2⤵
  PID:8800
- C:\Windows\System\FKmXtdH.exe
  C:\Windows\System\FKmXtdH.exe
  2⤵
  PID:8816
- C:\Windows\System\CamBNis.exe
  C:\Windows\System\CamBNis.exe
  2⤵
  PID:8832
- C:\Windows\System\ILOwxaQ.exe
  C:\Windows\System\ILOwxaQ.exe
  2⤵
  PID:8848
- C:\Windows\System\VzjGwMx.exe
  C:\Windows\System\VzjGwMx.exe
  2⤵
  PID:8864
- C:\Windows\System\ZVbtUch.exe
  C:\Windows\System\ZVbtUch.exe
  2⤵
  PID:8880
- C:\Windows\System\WBoETpW.exe
  C:\Windows\System\WBoETpW.exe
  2⤵
  PID:8896
- C:\Windows\System\GzvDYqi.exe
  C:\Windows\System\GzvDYqi.exe
  2⤵
  PID:8912
- C:\Windows\System\FUCFQFu.exe
  C:\Windows\System\FUCFQFu.exe
  2⤵
  PID:8928
- C:\Windows\System\ojKZjGj.exe
  C:\Windows\System\ojKZjGj.exe
  2⤵
  PID:8944
- C:\Windows\System\rCcwfZp.exe
  C:\Windows\System\rCcwfZp.exe
  2⤵
  PID:8960
- C:\Windows\System\iLKuZKI.exe
  C:\Windows\System\iLKuZKI.exe
  2⤵
  PID:8976
- C:\Windows\System\ExGnHTk.exe
  C:\Windows\System\ExGnHTk.exe
  2⤵
  PID:8992
- C:\Windows\System\oQPQcOB.exe
  C:\Windows\System\oQPQcOB.exe
  2⤵
  PID:9008
- C:\Windows\System\HuRozNN.exe
  C:\Windows\System\HuRozNN.exe
  2⤵
  PID:9024
- C:\Windows\System\sHAZGFB.exe
  C:\Windows\System\sHAZGFB.exe
  2⤵
  PID:9040
- C:\Windows\System\mKhRtOD.exe
  C:\Windows\System\mKhRtOD.exe
  2⤵
  PID:9056
- C:\Windows\System\Xzhjozu.exe
  C:\Windows\System\Xzhjozu.exe
  2⤵
  PID:9072
- C:\Windows\System\oVHQoIs.exe
  C:\Windows\System\oVHQoIs.exe
  2⤵
  PID:9088
- C:\Windows\System\JUsASDM.exe
  C:\Windows\System\JUsASDM.exe
  2⤵
  PID:9104
- C:\Windows\System\zmflYKR.exe
  C:\Windows\System\zmflYKR.exe
  2⤵
  PID:9120
- C:\Windows\System\SKJIVpr.exe
  C:\Windows\System\SKJIVpr.exe
  2⤵
  PID:9136
- C:\Windows\System\NdyGyuc.exe
  C:\Windows\System\NdyGyuc.exe
  2⤵
  PID:9152
- C:\Windows\System\hlqkrxA.exe
  C:\Windows\System\hlqkrxA.exe
  2⤵
  PID:9168
- C:\Windows\System\GfAXrrp.exe
  C:\Windows\System\GfAXrrp.exe
  2⤵
  PID:9184
- C:\Windows\System\tgUrYzO.exe
  C:\Windows\System\tgUrYzO.exe
  2⤵
  PID:9204
- C:\Windows\System\SGdLFao.exe
  C:\Windows\System\SGdLFao.exe
  2⤵
  PID:7780
- C:\Windows\System\bgHNysx.exe
  C:\Windows\System\bgHNysx.exe
  2⤵
  PID:7892
- C:\Windows\System\UQsrzXV.exe
  C:\Windows\System\UQsrzXV.exe
  2⤵
  PID:8284
- C:\Windows\System\CrMKAVa.exe
  C:\Windows\System\CrMKAVa.exe
  2⤵
  PID:8312
- C:\Windows\System\LHQbauY.exe
  C:\Windows\System\LHQbauY.exe
  2⤵
  PID:8376
- C:\Windows\System\OVLTMmD.exe
  C:\Windows\System\OVLTMmD.exe
  2⤵
  PID:6492
- C:\Windows\System\KljEbJn.exe
  C:\Windows\System\KljEbJn.exe
  2⤵
  PID:8472
- C:\Windows\System\EERdbmF.exe
  C:\Windows\System\EERdbmF.exe
  2⤵
  PID:8508
- C:\Windows\System\xyFpYqI.exe
  C:\Windows\System\xyFpYqI.exe
  2⤵
  PID:8264
- C:\Windows\System\dLaodKR.exe
  C:\Windows\System\dLaodKR.exe
  2⤵
  PID:8424
- C:\Windows\System\hnCDGYs.exe
  C:\Windows\System\hnCDGYs.exe
  2⤵
  PID:8616
- C:\Windows\System\mHGwEKX.exe
  C:\Windows\System\mHGwEKX.exe
  2⤵
  PID:8776
- C:\Windows\System\lZnTgHq.exe
  C:\Windows\System\lZnTgHq.exe
  2⤵
  PID:8808
- C:\Windows\System\mCPxRcg.exe
  C:\Windows\System\mCPxRcg.exe
  2⤵
  PID:8712
- C:\Windows\System\xMOiLiq.exe
  C:\Windows\System\xMOiLiq.exe
  2⤵
  PID:8892
- C:\Windows\System\fJYmEGl.exe
  C:\Windows\System\fJYmEGl.exe
  2⤵
  PID:8840
- C:\Windows\System\ANJBsEN.exe
  C:\Windows\System\ANJBsEN.exe
  2⤵
  PID:8904
- C:\Windows\System\jAiHrdo.exe
  C:\Windows\System\jAiHrdo.exe
  2⤵
  PID:8972
- C:\Windows\System\iALFLWy.exe
  C:\Windows\System\iALFLWy.exe
  2⤵
  PID:8940
- C:\Windows\System\RsRLGBk.exe
  C:\Windows\System\RsRLGBk.exe
  2⤵
  PID:9016
- C:\Windows\System\RHtuaBR.exe
  C:\Windows\System\RHtuaBR.exe
  2⤵
  PID:9064
- C:\Windows\System\MnolioJ.exe
  C:\Windows\System\MnolioJ.exe
  2⤵
  PID:9096
- C:\Windows\System\TVHmLEX.exe
  C:\Windows\System\TVHmLEX.exe
  2⤵
  PID:9128
- C:\Windows\System\NGUSdYO.exe
  C:\Windows\System\NGUSdYO.exe
  2⤵
  PID:9148
- C:\Windows\System\DcCWLsC.exe
  C:\Windows\System\DcCWLsC.exe
  2⤵
  PID:9192
- C:\Windows\System\ScGvuXM.exe
  C:\Windows\System\ScGvuXM.exe
  2⤵
  PID:8408
- C:\Windows\System\vYRdnTl.exe
  C:\Windows\System\vYRdnTl.exe
  2⤵
  PID:8236
- C:\Windows\System\dgvZyuH.exe
  C:\Windows\System\dgvZyuH.exe
  2⤵
  PID:8360
- C:\Windows\System\UUqPSWv.exe
  C:\Windows\System\UUqPSWv.exe
  2⤵
  PID:8396
- C:\Windows\System\XNioZwF.exe
  C:\Windows\System\XNioZwF.exe
  2⤵
  PID:8604
- C:\Windows\System\Luqfybm.exe
  C:\Windows\System\Luqfybm.exe
  2⤵
  PID:8428
- C:\Windows\System\MInoHlL.exe
  C:\Windows\System\MInoHlL.exe
  2⤵
  PID:8668
- C:\Windows\System\fKdOaaS.exe
  C:\Windows\System\fKdOaaS.exe
  2⤵
  PID:8732
- C:\Windows\System\LAYYfdb.exe
  C:\Windows\System\LAYYfdb.exe
  2⤵
  PID:8792
- C:\Windows\System\XKXLNwk.exe
  C:\Windows\System\XKXLNwk.exe
  2⤵
  PID:8824
- C:\Windows\System\XzzEPOF.exe
  C:\Windows\System\XzzEPOF.exe
  2⤵
  PID:8748
- C:\Windows\System\SCiKBno.exe
  C:\Windows\System\SCiKBno.exe
  2⤵
  PID:8952
- C:\Windows\System\ACuiHxn.exe
  C:\Windows\System\ACuiHxn.exe
  2⤵
  PID:9116
- C:\Windows\System\EObKiEl.exe
  C:\Windows\System\EObKiEl.exe
  2⤵
  PID:9052
- C:\Windows\System\HIYnBEw.exe
  C:\Windows\System\HIYnBEw.exe
  2⤵
  PID:9068
- C:\Windows\System\ARGabMz.exe
  C:\Windows\System\ARGabMz.exe
  2⤵
  PID:8812
- C:\Windows\System\UcFmcic.exe
  C:\Windows\System\UcFmcic.exe
  2⤵
  PID:9084
- C:\Windows\System\xTFGiTe.exe
  C:\Windows\System\xTFGiTe.exe
  2⤵
  PID:9196
- C:\Windows\System\vpJYsLp.exe
  C:\Windows\System\vpJYsLp.exe
  2⤵
  PID:8220
- C:\Windows\System\VWyJMrG.exe
  C:\Windows\System\VWyJMrG.exe
  2⤵
  PID:6180
- C:\Windows\System\byLHbee.exe
  C:\Windows\System\byLHbee.exe
  2⤵
  PID:8476
- C:\Windows\System\CnDZvCz.exe
  C:\Windows\System\CnDZvCz.exe
  2⤵
  PID:8392
- C:\Windows\System\PhPURjh.exe
  C:\Windows\System\PhPURjh.exe
  2⤵
  PID:8588
- C:\Windows\System\Huvuroz.exe
  C:\Windows\System\Huvuroz.exe
  2⤵
  PID:8648
- C:\Windows\System\dZefquo.exe
  C:\Windows\System\dZefquo.exe
  2⤵
  PID:8828
- C:\Windows\System\IApCRot.exe
  C:\Windows\System\IApCRot.exe
  2⤵
  PID:9180
- C:\Windows\System\xpXJDBN.exe
  C:\Windows\System\xpXJDBN.exe
  2⤵
  PID:8248
- C:\Windows\System\XesVBFc.exe
  C:\Windows\System\XesVBFc.exe
  2⤵
  PID:8364
- C:\Windows\System\MXcFKas.exe
  C:\Windows\System\MXcFKas.exe
  2⤵
  PID:7284
- C:\Windows\System\vlCqYRC.exe
  C:\Windows\System\vlCqYRC.exe
  2⤵
  PID:8700
- C:\Windows\System\LsRwmvt.exe
  C:\Windows\System\LsRwmvt.exe
  2⤵
  PID:9032
- C:\Windows\System\oZMqEbh.exe
  C:\Windows\System\oZMqEbh.exe
  2⤵
  PID:8636
- C:\Windows\System\bIooCpd.exe
  C:\Windows\System\bIooCpd.exe
  2⤵
  PID:8780
- C:\Windows\System\wIJJzZP.exe
  C:\Windows\System\wIJJzZP.exe
  2⤵
  PID:8552
- C:\Windows\System\WanhzyZ.exe
  C:\Windows\System\WanhzyZ.exe
  2⤵
  PID:8460
- C:\Windows\System\ORwvbmt.exe
  C:\Windows\System\ORwvbmt.exe
  2⤵
  PID:9224
- C:\Windows\System\jdtiWpI.exe
  C:\Windows\System\jdtiWpI.exe
  2⤵
  PID:9308
- C:\Windows\System\rzTmVzl.exe
  C:\Windows\System\rzTmVzl.exe
  2⤵
  PID:9328
- C:\Windows\System\fwcXOyD.exe
  C:\Windows\System\fwcXOyD.exe
  2⤵
  PID:9344
- C:\Windows\System\nvlITtn.exe
  C:\Windows\System\nvlITtn.exe
  2⤵
  PID:9364
- C:\Windows\System\aNHkUyU.exe
  C:\Windows\System\aNHkUyU.exe
  2⤵
  PID:9380
- C:\Windows\System\SqBuPiJ.exe
  C:\Windows\System\SqBuPiJ.exe
  2⤵
  PID:9404
- C:\Windows\System\JMViirc.exe
  C:\Windows\System\JMViirc.exe
  2⤵
  PID:9420
- C:\Windows\System\jxiMEmy.exe
  C:\Windows\System\jxiMEmy.exe
  2⤵
  PID:9436
- C:\Windows\System\oddFooA.exe
  C:\Windows\System\oddFooA.exe
  2⤵
  PID:9460
- C:\Windows\System\LSXSyIG.exe
  C:\Windows\System\LSXSyIG.exe
  2⤵
  PID:9476
- C:\Windows\System\XJgIuhM.exe
  C:\Windows\System\XJgIuhM.exe
  2⤵
  PID:9496
- C:\Windows\System\FLhdNMl.exe
  C:\Windows\System\FLhdNMl.exe
  2⤵
  PID:9512
- C:\Windows\System\rtZwyYR.exe
  C:\Windows\System\rtZwyYR.exe
  2⤵
  PID:9532
- C:\Windows\System\FIqQlUE.exe
  C:\Windows\System\FIqQlUE.exe
  2⤵
  PID:9556
- C:\Windows\System\JRDNewr.exe
  C:\Windows\System\JRDNewr.exe
  2⤵
  PID:9572
- C:\Windows\System\HGGghCw.exe
  C:\Windows\System\HGGghCw.exe
  2⤵
  PID:9588
- C:\Windows\System\dEzMyMG.exe
  C:\Windows\System\dEzMyMG.exe
  2⤵
  PID:9760
- C:\Windows\System\ZCdeNDi.exe
  C:\Windows\System\ZCdeNDi.exe
  2⤵
  PID:9776
- C:\Windows\System\aDMyvBT.exe
  C:\Windows\System\aDMyvBT.exe
  2⤵
  PID:9796
- C:\Windows\System\IBjohIe.exe
  C:\Windows\System\IBjohIe.exe
  2⤵
  PID:9812
- C:\Windows\System\EzYpDiR.exe
  C:\Windows\System\EzYpDiR.exe
  2⤵
  PID:9828
- C:\Windows\System\AuHWhDF.exe
  C:\Windows\System\AuHWhDF.exe
  2⤵
  PID:9844
- C:\Windows\System\tpqoRUv.exe
  C:\Windows\System\tpqoRUv.exe
  2⤵
  PID:9860
- C:\Windows\System\aYrUNzE.exe
  C:\Windows\System\aYrUNzE.exe
  2⤵
  PID:9876
- C:\Windows\System\QIOrTqf.exe
  C:\Windows\System\QIOrTqf.exe
  2⤵
  PID:9892
- C:\Windows\System\qCjlwif.exe
  C:\Windows\System\qCjlwif.exe
  2⤵
  PID:9908
- C:\Windows\System\HpcqzXm.exe
  C:\Windows\System\HpcqzXm.exe
  2⤵
  PID:9928
- C:\Windows\System\JQjLfKZ.exe
  C:\Windows\System\JQjLfKZ.exe
  2⤵
  PID:9944
- C:\Windows\System\tbJuUnt.exe
  C:\Windows\System\tbJuUnt.exe
  2⤵
  PID:9960
- C:\Windows\System\zaFuvjP.exe
  C:\Windows\System\zaFuvjP.exe
  2⤵
  PID:9980
- C:\Windows\System\plJQGyx.exe
  C:\Windows\System\plJQGyx.exe
  2⤵
  PID:9996
- C:\Windows\System\TkhcISG.exe
  C:\Windows\System\TkhcISG.exe
  2⤵
  PID:10012
- C:\Windows\System\OEiySPm.exe
  C:\Windows\System\OEiySPm.exe
  2⤵
  PID:10028
- C:\Windows\System\qZXqfXs.exe
  C:\Windows\System\qZXqfXs.exe
  2⤵
  PID:10044
- C:\Windows\System\Wxlxhdb.exe
  C:\Windows\System\Wxlxhdb.exe
  2⤵
  PID:10060
- C:\Windows\System\kknBMmP.exe
  C:\Windows\System\kknBMmP.exe
  2⤵
  PID:10076
- C:\Windows\System\FFpzNXJ.exe
  C:\Windows\System\FFpzNXJ.exe
  2⤵
  PID:10092
- C:\Windows\System\HOcKJiQ.exe
  C:\Windows\System\HOcKJiQ.exe
  2⤵
  PID:10108
- C:\Windows\System\ucdotsi.exe
  C:\Windows\System\ucdotsi.exe
  2⤵
  PID:10128
- C:\Windows\System\iBfEVNO.exe
  C:\Windows\System\iBfEVNO.exe
  2⤵
  PID:10144
- C:\Windows\System\CGyEEJn.exe
  C:\Windows\System\CGyEEJn.exe
  2⤵
  PID:10164
- C:\Windows\System\ORWSDmI.exe
  C:\Windows\System\ORWSDmI.exe
  2⤵
  PID:10180
- C:\Windows\System\QMvqbGU.exe
  C:\Windows\System\QMvqbGU.exe
  2⤵
  PID:10196
- C:\Windows\System\JwKmjeS.exe
  C:\Windows\System\JwKmjeS.exe
  2⤵
  PID:10212
- C:\Windows\System\rUmFzGc.exe
  C:\Windows\System\rUmFzGc.exe
  2⤵
  PID:10228
- C:\Windows\System\AxXRJBi.exe
  C:\Windows\System\AxXRJBi.exe
  2⤵
  PID:8872
- C:\Windows\System\jwJEQXu.exe
  C:\Windows\System\jwJEQXu.exe
  2⤵
  PID:9240
- C:\Windows\System\nufxsKY.exe
  C:\Windows\System\nufxsKY.exe
  2⤵
  PID:9200
- C:\Windows\System\wKYhDuZ.exe
  C:\Windows\System\wKYhDuZ.exe
  2⤵
  PID:8328
- C:\Windows\System\udbttjy.exe
  C:\Windows\System\udbttjy.exe
  2⤵
  PID:9244
- C:\Windows\System\fvuAxvD.exe
  C:\Windows\System\fvuAxvD.exe
  2⤵
  PID:9260
- C:\Windows\System\DPgylaj.exe
  C:\Windows\System\DPgylaj.exe
  2⤵
  PID:9272
- C:\Windows\System\BwGBzsc.exe
  C:\Windows\System\BwGBzsc.exe
  2⤵
  PID:9292
- C:\Windows\System\wJpnpZa.exe
  C:\Windows\System\wJpnpZa.exe
  2⤵
  PID:9324
- C:\Windows\System\TodadRi.exe
  C:\Windows\System\TodadRi.exe
  2⤵
  PID:9540
- C:\Windows\System\BNdRSyg.exe
  C:\Windows\System\BNdRSyg.exe
  2⤵
  PID:9468
- C:\Windows\System\DpEHNaZ.exe
  C:\Windows\System\DpEHNaZ.exe
  2⤵
  PID:9396
- C:\Windows\System\PrqPCSu.exe
  C:\Windows\System\PrqPCSu.exe
  2⤵
  PID:9352
- C:\Windows\System\uixXCFm.exe
  C:\Windows\System\uixXCFm.exe
  2⤵
  PID:9580
- C:\Windows\System\PXBzHJV.exe
  C:\Windows\System\PXBzHJV.exe
  2⤵
  PID:9756
- C:\Windows\System\TISkTXO.exe
  C:\Windows\System\TISkTXO.exe
  2⤵
  PID:9656
- C:\Windows\System\tHnjMTc.exe
  C:\Windows\System\tHnjMTc.exe
  2⤵
  PID:9672
- C:\Windows\System\LRgKUlv.exe
  C:\Windows\System\LRgKUlv.exe
  2⤵
  PID:9684
- C:\Windows\System\TIFlNuO.exe
  C:\Windows\System\TIFlNuO.exe
  2⤵
  PID:9712
- C:\Windows\System\wFlDCrj.exe
  C:\Windows\System\wFlDCrj.exe
  2⤵
  PID:8348
- C:\Windows\System\EaJxmjO.exe
  C:\Windows\System\EaJxmjO.exe
  2⤵
  PID:9736
- C:\Windows\System\tCJRVPv.exe
  C:\Windows\System\tCJRVPv.exe
  2⤵
  PID:9596
- C:\Windows\System\sZpgGPD.exe
  C:\Windows\System\sZpgGPD.exe
  2⤵
  PID:9640
- C:\Windows\System\bWWGSRw.exe
  C:\Windows\System\bWWGSRw.exe
  2⤵
  PID:9720
- C:\Windows\System\oeeTazy.exe
  C:\Windows\System\oeeTazy.exe
  2⤵
  PID:9452
- C:\Windows\System\uhtCPig.exe
  C:\Windows\System\uhtCPig.exe
  2⤵
  PID:9524
- C:\Windows\System\sWuAxgc.exe
  C:\Windows\System\sWuAxgc.exe
  2⤵
  PID:9564
- C:\Windows\System\uWIBGiI.exe
  C:\Windows\System\uWIBGiI.exe
  2⤵
  PID:9620
- C:\Windows\System\qaRDNFZ.exe
  C:\Windows\System\qaRDNFZ.exe
  2⤵
  PID:9704
- C:\Windows\System\Szvyimt.exe
  C:\Windows\System\Szvyimt.exe
  2⤵
  PID:9784
- C:\Windows\System\xpaYQxl.exe
  C:\Windows\System\xpaYQxl.exe
  2⤵
  PID:9792
- C:\Windows\System\mrucabx.exe
  C:\Windows\System\mrucabx.exe
  2⤵
  PID:9824
- C:\Windows\System\AGyXhcM.exe
  C:\Windows\System\AGyXhcM.exe
  2⤵
  PID:9940
- C:\Windows\System\CSSXPPA.exe
  C:\Windows\System\CSSXPPA.exe
  2⤵
  PID:9884
- C:\Windows\System\wmlRtJQ.exe
  C:\Windows\System\wmlRtJQ.exe
  2⤵
  PID:10036
- C:\Windows\System\oqYlpXq.exe
  C:\Windows\System\oqYlpXq.exe
  2⤵
  PID:10068
- C:\Windows\System\IIiGnNr.exe
  C:\Windows\System\IIiGnNr.exe
  2⤵
  PID:10104
- C:\Windows\System\NKRoImg.exe
  C:\Windows\System\NKRoImg.exe
  2⤵
  PID:10204
- C:\Windows\System\cuJNUEe.exe
  C:\Windows\System\cuJNUEe.exe
  2⤵
  PID:9924
- C:\Windows\System\QUknYYw.exe
  C:\Windows\System\QUknYYw.exe
  2⤵
  PID:10084
- C:\Windows\System\mGfuDnX.exe
  C:\Windows\System\mGfuDnX.exe
  2⤵
  PID:10088
- C:\Windows\System\aIJxPtf.exe
  C:\Windows\System\aIJxPtf.exe
  2⤵
  PID:10120
- C:\Windows\System\wRnLEHo.exe
  C:\Windows\System\wRnLEHo.exe
  2⤵
  PID:10192
- C:\Windows\System\DiZWTwX.exe
  C:\Windows\System\DiZWTwX.exe
  2⤵
  PID:8556
- C:\Windows\System\OmWNQJg.exe
  C:\Windows\System\OmWNQJg.exe
  2⤵
  PID:8728
- C:\Windows\System\EVQsaFV.exe
  C:\Windows\System\EVQsaFV.exe
  2⤵
  PID:9268
- C:\Windows\System\DgIWIEy.exe
  C:\Windows\System\DgIWIEy.exe
  2⤵
  PID:9472
- C:\Windows\System\xEjcqRP.exe
  C:\Windows\System\xEjcqRP.exe
  2⤵
  PID:9252
- C:\Windows\System\chSdoLr.exe
  C:\Windows\System\chSdoLr.exe
  2⤵
  PID:9356
- C:\Windows\System\gVJbCLH.exe
  C:\Windows\System\gVJbCLH.exe
  2⤵
  PID:9548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOIFCJV.exe

Filesize
1.8MB

MD5
1fa680048e5768b8695b52e746ec68d9

SHA1
9ff377c4901f0eced77104556b42b312b7115830

SHA256
a368e4a152735b9767b9894b19bc2593782004d8173b90163fb1131c303ae60f

SHA512
f5907cca6e1c6311ddc46c411f0f4c7da0193dfc807ddd1c4375a17c9e18803a0d80c12a281a30a8fab3ce9bdba3ed366dd372ea9f75eef6f5ea63df3d38532a

Download Submit
C:\Windows\system\FcsAqCH.exe

Filesize
1.8MB

MD5
6be1874563ee51ecc148fb6f06f96f42

SHA1
cf98384c2c48704e194e21fe9f9d93271bed26ee

SHA256
337106cfea6f79dd401cc42216f0e2349d145f883e52ce5d5c9cb8bdffaebd19

SHA512
a6f15c12942ad943c5b478a3d20080cf555e5ae2f39be1f5dd2c1a6cb9f3c7ef90155519615067bab95e57a68a9ca20273de40a25b750d8d64a845a045891ca7

Download Submit
C:\Windows\system\HMUEJCZ.exe

Filesize
1.8MB

MD5
548d545db65741ee3407d301b7eba5aa

SHA1
6150c149bc08f70c31387be33f8684117600ee3b

SHA256
7453d14d32e0415f8bb0c83ace1958547a7a2352fa71842d6a051d06ddcd2f93

SHA512
68e92abc63a09bd168489a85a15588562d6e76a52ccf4ffa0ab6f0b96757212d9353122bd3f839f7592c94973fa6a1b5472f10b061ffcadd4d4a5edd71825c25

Download Submit
C:\Windows\system\IlsykuC.exe

Filesize
1.8MB

MD5
0ac971dd1eed33a9bc52b0443ede2672

SHA1
ea221ebebc1326ba60c368799f5d09e40bebe02a

SHA256
86e00fdf505831c3c89ee6153c466beab2a74c8ce5adeba3c72825c211707d6d

SHA512
adaf2402b1225af1e47bfc9445c4e761d5252bf95665dcd48682bf78a8695040066bbf2a63feb90cf5fb5dc50511e975cfcf1b7946dcd2c1463fc3a4b7dfda53

Download Submit
C:\Windows\system\IpHgkKy.exe

Filesize
1.8MB

MD5
12712ca2b668da02113a8b0755fcc430

SHA1
7765afff1de36b4e6212723f155a836c8c3918dd

SHA256
ce43e508028152de3bc9bdf367687a29654ea2cae998c659a6fddef14c8c11cf

SHA512
17384faeb1bbe1f46c81d2e7077e24724909be25a2dcbf78df3f4f932c15da3d687031d3ead16e32b02fc6a178aa8f78b963806025c2dddf2760a896d38c1515

Download Submit
C:\Windows\system\JDnbawu.exe

Filesize
1.8MB

MD5
a657b0007682e251a1a408d60a464e0b

SHA1
e0f6b2dd79757e2cfca55f116910aff03fd48d8a

SHA256
069b60f2fa6c467a698d10a1f7b5026dac9b230974363a476e859d54ee584bb6

SHA512
9162139ca6261507e384c3b5de73e5ce0443a219e905fe25f9d9594327975c38fb51b72b38fdeff3279449a8130af02b3a2affa97a5fe104b0d0e248d63b07bc

Download Submit
C:\Windows\system\KmFxAFB.exe

Filesize
1.8MB

MD5
c452c7a46b26457fb7d730a89f4f3422

SHA1
2745c7f1251c356158b20ef4f949b52b814bbcb9

SHA256
992de35b447404f51e45281cb454e86f282fe087c761c92e950565f519cb719a

SHA512
707984308259619b2184926e951b795cbc52cfa4aa0a860ad8eb7492c35b95c52909f4e0cae61deeb5e7f456159fb741279d4c190edd8811f35f8050f8bd179b

Download Submit
C:\Windows\system\NJLMESo.exe

Filesize
1.8MB

MD5
e34407437bec63bd03c2c7f0cd17261e

SHA1
379c95ab4974f8811d963b0fb54b655c8bd8a6b1

SHA256
6e1001b8f61c436969e400d3e4d722e56e688800db3d318dbd378c6aec9f349a

SHA512
5cfb0110601ee4e360e50512ef2a5fd6619220beaa2ee76ac3cfc8c8c137d6e9855199f8738f658f86e28e4c99314fab968e11c8824fd12e18b95f210fe7b77a

Download Submit
C:\Windows\system\RmZiyoA.exe

Filesize
1.8MB

MD5
091785cd91589659c943a6e11e558fbe

SHA1
d798536faa81c39008c2bc379145719ee165feb7

SHA256
e6d6c172c6c4cbf23a2f2066d224c31b846742db571b9d2187ab2a41fdcca302

SHA512
c5884573f9c3477152909b9b8efa62287b4ee5f89e318957a1e3420ca51447d56aab3a7e5b1b61c4091e371c3b9085b1a1b827772b7e7532bb8ff41c7a3cc377

Download Submit
C:\Windows\system\TNEjCNS.exe

Filesize
1.8MB

MD5
20c16a1101cfd77a29f7c9e06ec29ff5

SHA1
55b5eba3c91a570529695c4641ade354a651d0a1

SHA256
531fa64518ee50ec088f4df87b3d03b74687db1f6d64b4a15ebac61b89dbc335

SHA512
1b8026f583c0bed3ffd07dda2113e136d1d5dea89a484da18986d3f93419b33910c8d039c11dfe693aa4152618aecfd70a47006a1291abb8b93fc466a6c90be1

Download Submit
C:\Windows\system\UpXeSMg.exe

Filesize
1.8MB

MD5
24f859931da3efc97b12d20b71983e02

SHA1
52c7d04238b858379226f06fc5e7514dd561251d

SHA256
fce9a33e9525192c0c54d2f02b31204a78e82ada50d429dfd625b178b4909a02

SHA512
9bc60055f960684b2b68fbbc1b1034ac343c30922f305295c4d3ef6b645febd5b98b47d95fae3abe8388045dd2673a97c60298849aaf084641d3e73608a3caa9

Download Submit
C:\Windows\system\VeRlFPW.exe

Filesize
1.8MB

MD5
3a6ab864fcf0534656083bb6e8ad8a91

SHA1
8ddc222f93383b505dc92646216f677f096053b3

SHA256
b3a1deb582b62db4513f24b1661c63dbe20f93069ce54585e2dcbd3e846c38c7

SHA512
44186028bc46df6be1e94d7001e09879043ca249f2b9dabcbb183c3ab4684f24bb44fa5b5b7df68ab17418edbf0f4411e242087ced534ce78615c20e6a37be95

Download Submit
C:\Windows\system\VpQRPnh.exe

Filesize
1.8MB

MD5
847ae429b21f7ee89f9cf4aff1202a2a

SHA1
51c5d0f50ff307fe4093185760c38b13c3f00950

SHA256
4290ac4ed68aa67717d9d099fb391f461c4013e07d4e124ec02e01f65fd4e32a

SHA512
ff35da80f745544ee2bc5d49b55ebebfc8a95301dc2e39322afe06873e41653845b23b9ee90daab6071151abf12b566973b0efb2d7e854410e7da67746eb98de

Download Submit
C:\Windows\system\WElwOMk.exe

Filesize
1.8MB

MD5
b4eb39c26a892d2e04f0cb9f44e4e87e

SHA1
23afc7c203db632b3265f335bd9eeeead653fe18

SHA256
70804caa4e9ad7673bd6f299725b2aa561448cce61185eb9aefb82344ea8f453

SHA512
f116b01c1abfe437e7220d4bc7e038656d33ad1cc250ee990114f62b083e456138c23be8c7238ae9b0fe1e331a6f048ebb443fb7ec7f2915c1932520230a6d10

Download Submit
C:\Windows\system\XKbsMuR.exe

Filesize
8B

MD5
92dce7fd7ec69f225baee909f1f20d27

SHA1
0fe748b20df273698767537e59de10e23a351a61

SHA256
3a8d52b801fd1c8bd120153342611f7386eb5ce0ad255d57304ec96ec9b31a84

SHA512
1e58e425b780ebf633a365e2d3edf8bb342f5bfe09e8d802b0d4dd60a53770b35758c32e598b9a4f78c23d6a0841ec0499f88be809f17838167d0c02b8f0c743

Download Submit
C:\Windows\system\fcTVZiz.exe

Filesize
1.8MB

MD5
c676e8cefc7ac364be0daeaecb87c740

SHA1
00a616621c0e720c6adc2fd988b2c3d96ad7793d

SHA256
f057972da9341cb4e660d80ee49a3842f0a38c2a4db97ce0b9c5be040d59e975

SHA512
2804d13917a1a65e805f8b940ea814a1d5caf895a4df033fb8e22d8dca735157b1fbe9ea4c93f90de3cd5df5f0804451f5f25da39afbefe3c37ddb5819a1442b

Download Submit
C:\Windows\system\fqchhGi.exe

Filesize
1.8MB

MD5
5a5aa19669c3412e33ad411754ce9da9

SHA1
40abdf6df4a599bb8b5621962058f2b9b16a0b32

SHA256
4effd8186772a28aa969dcbf31de7439945ff33edcb623a1a71173af5e42018c

SHA512
1985d0a8a6856b30ea5a86455889a70cb2f07ac62abed3bb758a568fa3ac6db63af4503173ce981a2c282aa156930511390f6483dfbba5a7f8e71cf8a6db2d5f

Download Submit
C:\Windows\system\hDrtqxs.exe

Filesize
1.8MB

MD5
f9704ef06ccb9a128cc2978ecffa1a06

SHA1
63eee4c6758e8b91771e8014e4d9b95ccbfc5a95

SHA256
16f8f7a6175418ca15a7fd3635cb752acd274e113c3818b99201104927875722

SHA512
30c50a2cba3ab113d4cc4e4c3a27672750059a13963c937d9f3ee5bdd88aa163639d4bea522fc6b3047c36af36ab6f92fcaa2b18ee857c2fa684657e43e93871

Download Submit
C:\Windows\system\iNZEMBo.exe

Filesize
1.8MB

MD5
558f4425ec03a13240ba292de729eee1

SHA1
dbc18f9b5c8217415672dea6632c8b9c58ab5589

SHA256
1a6876ffd189592a578218a483f2bd6f3362bc56dbd0483be6c5554621839bfd

SHA512
f0784f8c98ff7e977e46d3f33124750851f9f0d0e3bc1d6a0018f644330fbad5b25526ca26542735b83f24cb2cd649b1e8b0618c602e707ee928044f6c9a6364

Download Submit
C:\Windows\system\kUJrJpd.exe

Filesize
1.8MB

MD5
36b38763536197ef7ed0bc234a468e69

SHA1
499e4453e34d59d1bfac0c07058468a201dcfd1d

SHA256
da4b4005d349f241b5db35734202a8fc3b671b75162d94a6baec3401a6820f7e

SHA512
7c8ffef60a0e9f76b890736f9b02ccec4ed74f60c5d2d03b344a6a7acf03468e793cb1e7f01fb966bc7c007c97bece392ab28f078375b3b155da0486ce58bed9

Download Submit
C:\Windows\system\mNlniSv.exe

Filesize
1.8MB

MD5
28c70d9b1577b0a643078388217f2bfe

SHA1
233df795775c44ba276649d9f375fd9aeb9584cd

SHA256
ba9b59d47157fa6f0143ac85e22ea3bdbb813e050e6a97786da1de7aba051c08

SHA512
32a8b394254b1e3902e5fc80a662e4d054fcdf062ef4fe271ddf89aa3e31d56da6bd45d89cad405aa9d0032890bdd841ced32ed36690500494e75ee1037600c6

Download Submit
C:\Windows\system\nmBgvkj.exe

Filesize
1.8MB

MD5
1772840e78a8f9fb4b4a8db58730c1d6

SHA1
0b77ef87a02b5bd81aa7111bee73d7173f1afc81

SHA256
f1e3f1aa339a138c875fe744aba8215782c342dd9cb466e16019592352e22f3a

SHA512
2e663b2fd9ec1dfc5c8bcf2533bfdda41b40470d6d3574d41456897373f978a76e202e142e5fed32109b1b29990fd1ea3cda50a2e6e8f8baed7de72ec4dc3504

Download Submit
C:\Windows\system\vMXKlXM.exe

Filesize
1.8MB

MD5
dff8979a83c527abc3a9671d58725c8e

SHA1
c72c76b8727c4f6b3db2bf9d8e65007d7fabaeac

SHA256
fd1f051d77ce7476590d51c777f2de23a02203f64861f36a04959a39b266dd05

SHA512
560cfe2ce83995b6d9839760c0558c870aba6e5659504ba8adfbbb61184fce4903df6d59db515c22ca70d633496753c9d7ba218f25b83d7ba7ce5f0a513924e5

Download Submit
C:\Windows\system\vUwZkHI.exe

Filesize
1.8MB

MD5
ec8f33178ac40292d3531a24d6bcf913

SHA1
0c44765121e66f693647491afcf148d30c813f69

SHA256
fb7845a6d25494bb052eed4cd62e232316d74d08cbf1e495129638387f10bc4b

SHA512
c1c6f0d2cacca7d3eaeb1190d67a17c8a671de575f5028f9ec12d718465b1f9dfecd78ee0d4e6511fa347ac7afe30fa41315a6a4ac99e98e75a29e0e3f519d74

Download Submit
C:\Windows\system\xYZoBGp.exe

Filesize
1.8MB

MD5
28ea40a3595afd5dcf391576d16d0b18

SHA1
af0089f4f2cae85dc7ad54304a8494524c698d97

SHA256
1bf1d8a6d5aab1abc21092bcfe86f13dc881605d42c80be84f729c36cf3b3f9a

SHA512
4eb75e1ec60d16b8bb27ce94ae2cb796bcfb91d21359141fc10fc0b1749fb9981fa5b326002bd6cf6dab1af9958032965961237e7b6d5804e0de21ba88d6d85d

Download Submit
C:\Windows\system\xtQiCdU.exe

Filesize
1.8MB

MD5
364a6205c89ace5b2c330123bd0b2011

SHA1
99e566c38f767c20928ef28f959868b1ae571c2a

SHA256
f321764469f98b3cf1a3c0fe89b4c4ad3fcd5f8e2169cf81a74189db5adf490a

SHA512
06277e554b93e8e20c937be11b3f76a98437db2d4ef516b91442ac00cefda8b0873a986763c73f74bae7be4948e1400a6fa7d0b109ea52b04732b6745b080e9f

Download Submit
\Windows\system\ITnmWev.exe

Filesize
1.8MB

MD5
e87e7c04bc9edc7f347f69004cb25746

SHA1
7504936fe171a61f2efa4ab114db68a725e286fc

SHA256
eb3fb926c2dff7ad490ac2a78716f26e56cf88dad4be4032b921c2c20c25d2b1

SHA512
abce8f68b837254da6e452b8b548306303e5aab2727b61f395408c8ae2c7a8c78cc2bf05c4e1d3d5aa8ee682265954d0e347573eb4ebf0d83d94ee6976c526b5

Download Submit
\Windows\system\SvrIayo.exe

Filesize
1.8MB

MD5
09885dd0fe83ffd24af003d60f14f9e7

SHA1
6d52e383fd96989674e4fe4888d276e32003d0ad

SHA256
329eb8741da4dca45ea8dcc79bff0d54d62c77d8a9ec66c13d2fa5a2d7d15f55

SHA512
623daf30c475d71aaa3e94844170d04f7151a92857a74ee995e8d094e5754cae863de12263f0bbbfd7721a5f672900907c24f727708a5a8ebc4b3b66a2d1796d

Download Submit
\Windows\system\XUOnTxj.exe

Filesize
1.8MB

MD5
c9e760bc41c392d72cc705bcd67685bd

SHA1
665eb67b34342453461293c2c5e17bbd7e2f41a7

SHA256
5edde41fddc1597e42b7d481d2eecc3a014c10bab595cca59fb6ddac34ff5d10

SHA512
cded6d576a6fae7909fab49f15caef53502acb6771b1c1f5a3560d9e91381c09337fdd125555fe95ad6de16bbc8dc1ce45ea7a69b3f45f33d38e6b80ce40925d

Download Submit
\Windows\system\ZLbhPsg.exe

Filesize
1.8MB

MD5
ede478a1015304fb2c5934f87a06b03d

SHA1
bcc345beeb3d6958fb0cca3d884d9287aefd95bb

SHA256
1727bc741a57e868b23baf7083a9db4931a7d980562bb5dbe57885985fa5fb63

SHA512
b776aaef1dfbc3231989558bbe452a6b8d51d18a93d63027fd07d92cf4bcf149c0c52b214c73c2acdb8e3b6ebf9a4fd0096bc7034ddd428dd63c98b0f75b3cdd

Download Submit
\Windows\system\dEeMEOb.exe

Filesize
1.8MB

MD5
17fb2f4881d001fb9b91bf0a971f978c

SHA1
e1ea918524cd4eba0c9cb61a5562dc01f140c5d9

SHA256
a8abdf2712b065ca68844d6b4f5d868a759d1cc43ddb1ca5d71cb3c53f4bf5f2

SHA512
f0dc015773c95fd325156fb7dfd8edd2d40e976ffc8064cea9b65b4f7ed894a7858545588fcf41adcd84832616c30c4e4d30a00ffd271de9c422f42a2efef288

Download Submit
\Windows\system\fFsUQaV.exe

Filesize
1.8MB

MD5
cb36aa1a492898101338f31926e2d710

SHA1
fbe52a76e6a32a60411aedda4605368ffbbea72e

SHA256
639eec3ecbe04e725f40e8b26a1761015ea5de6b8be713ae89a4faeee3730b3a

SHA512
d471df6587d0037590d761ed36d1952042911f396ddd47a49a9ec80b59726f7c5433f9d288d8b86d1bf49517cb1d29906f384b9b7264279f1d3426b02f562a62

Download Submit
\Windows\system\qBlkBFK.exe

Filesize
1.8MB

MD5
4c20b9bba89de904c31de42b1a201f68

SHA1
14a8cc5c9355ab2bd965f50e028a10fbfe19758d

SHA256
335f668d7cf2e7f1cef0ba9989d8acdc00fa24d7b36f0b9af317b3e34a136969

SHA512
4cf8fdd75a545299951b0a990e125fa92347045243a2419cedf39a11143da8381eefa3f9c82748b1d14fa7e7b2485f60b8a56db4fd6f6020709d6a6db30d5546

Download Submit
\Windows\system\sgDiTEz.exe

Filesize
1.8MB

MD5
f8e3a68d2fa7af596841fe2b9dbad93f

SHA1
cc05ca6dd509a6894092add1616ca162258d6834

SHA256
cc854f6cb76a00587df275c7db5bc40accd8b4bfff036a3fc7f324cabf36096b

SHA512
493126766e9591d82025a58ed51965f799f3fd583075c28ada86a667daf3ff1e02cbdd2c51aa6118e5f891a49c1a4c23653b036ced4acbe9c761abc432d5186f

Download Submit
\Windows\system\vULeiMU.exe

Filesize
1.8MB

MD5
9d068ec241a2411278e65c49e0b6ca0c

SHA1
82dd822948df030c3346fbb8200976ec46310012

SHA256
50a868fe0afcb3209bdceac13bcb5736bc70485fbc89930df509f88fa0292816

SHA512
4afbf67967f1775f047fab32c24b480f3155d3b60d5a5cee5bf7f202133ad4a5778ee5c8841fb658501e25e57c574afa6aa7033bdfd7e2e16f800e6764ad445a

Download Submit
\Windows\system\zKqhgRC.exe

Filesize
1.8MB

MD5
4bbfc3a7af78523666946b4985e377ec

SHA1
cc750e96e0f90af4729665b786df753f59413058

SHA256
707b6370af22fa1ceb85901e76b359a7e0120cc931c3550b22d64e42fce2e12a

SHA512
3ba8bf545873242fe83c8dd007bb6b75c51829599815337797ac83335a9dc1a6ca7a17885f7e6a8aa6706e50d65f92106452e7f1c0b72c60e9e249fd0d01d2da

Download Submit
memory/1996-90-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/1996-5202-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2180-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-163-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2180-132-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2180-168-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-171-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2180-143-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-160-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2180-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2180-10-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-145-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2180-172-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2180-170-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2180-162-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-165-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2284-5169-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2368-189-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2368-190-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2496-5153-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2496-167-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5154-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2548-141-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2560-169-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2560-5199-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2604-159-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2604-5190-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2640-166-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-5156-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-5152-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-164-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-108-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-5173-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download