xmrig | 6fc4f5169c24e03fef270ca545f7a0648c278312bd5ef5a90034d832ec9b9d28

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
Size

1.8MB
MD5

02f4fae01b12eb37197a3de8c023ca87
SHA1

7106b67f44cdc7ff0179b2fd8cc3a0ae52454478
SHA256

6fc4f5169c24e03fef270ca545f7a0648c278312bd5ef5a90034d832ec9b9d28
SHA512

a76c1c5d8882447727411185fca5152643ac351c0f8011639137c20963dbd122a13b68fd47f40e1d22978ef9b43256a2666ab83f4446ba63a41e37d402a57dbe
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p1HzDgUf:NABf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/1388-20-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2784-52-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2860-149-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2712-154-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2768-160-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2912-165-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2712-5089-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2700-5152-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2892-5132-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2748-5129-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2912-5020-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2492-5016-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2864-5037-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2784-5011-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2524-4745-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2700-152-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2864-151-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2492-150-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2748-145-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2892-119-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2160	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1388	ZVbjKBc.exe
2524	xptYywZ.exe
2784	ECCLRxW.exe
2892	olYCCWl.exe
2748	UFkvaJO.exe
2912	JvQdaDn.exe
2860	fesKTJT.exe
2492	vkuFdsl.exe
2864	JTNkEcq.exe
2700	zkASgRW.exe
2712	ZQzPavo.exe
2768	KPTiNlk.exe
2640	KZGGwCs.exe
1428	RMzegwS.exe
1472	AmWxqYU.exe
1324	aFrlCaN.exe
1788	YpPZIRN.exe
1144	plIQXAp.exe
1940	vnwiyHL.exe
1912	IDQOEXR.exe
1988	ZhrULfj.exe
1620	AIIqdLW.exe
2664	YXZXdHP.exe
1852	AsWRbdU.exe
1628	jhvhDXQ.exe
604	nzeEtsu.exe
292	vONbeeq.exe
1696	vqRFilc.exe
1276	OdzDQJF.exe
1716	yrBsekD.exe
1780	JOKpaPG.exe
2296	wlqNLTo.exe
2344	EZdgQgl.exe
536	idZxxAt.exe
2188	KTXTYIY.exe
2480	UsHmwBk.exe
1936	uGTumJl.exe
468	AZdfwso.exe
2564	mzqeron.exe
984	MPGbvEA.exe
700	pyZLMlE.exe
1972	pInFqrA.exe
688	fkRkjiW.exe
2984	fpFwlIz.exe
2464	WFIqxii.exe
2208	WKfkSvP.exe
2320	VySxhzZ.exe
1560	udIuWab.exe
2388	EoUIgvc.exe
2052	DmwpYjY.exe
2288	EVikQFK.exe
2752	BTgOTpQ.exe
2764	urYZxdN.exe
2592	lGmUDGY.exe
2660	DueVUFg.exe
2756	CwPJejV.exe
1272	dzwmPIz.exe
1760	zUgQRpc.exe
2044	iPpOSjl.exe
1736	Lggffyq.exe
316	YQHeQTL.exe
1844	ohrgNyN.exe
2948	nGRTCnl.exe
2444	gDaVeNM.exe

Loads dropped DLL 64 IoCs

pid	Process
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-1-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x000700000001872e-7.dat	upx
behavioral1/memory/1388-20-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2784-52-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0005000000019611-77.dat	upx
behavioral1/files/0x0005000000019617-93.dat	upx
behavioral1/files/0x0005000000019619-97.dat	upx
behavioral1/files/0x000500000001961f-115.dat	upx
behavioral1/memory/2860-149-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/files/0x0005000000019627-156.dat	upx
behavioral1/memory/2712-154-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2768-160-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2912-165-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x00050000000196b3-177.dat	upx
behavioral1/files/0x0005000000019799-181.dat	upx
behavioral1/files/0x0005000000019847-191.dat	upx
behavioral1/memory/2712-5089-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2700-5152-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2892-5132-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2748-5129-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2912-5020-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2492-5016-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2864-5037-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2784-5011-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2524-4745-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x00050000000196b1-174.dat	upx
behavioral1/files/0x0005000000019803-188.dat	upx
behavioral1/files/0x0005000000019669-168.dat	upx
behavioral1/memory/2700-152-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2864-151-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2492-150-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0005000000019623-136.dat	upx
behavioral1/files/0x0005000000019621-135.dat	upx
behavioral1/files/0x0005000000019624-147.dat	upx
behavioral1/memory/2748-145-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x00070000000186f7-144.dat	upx
behavioral1/files/0x0005000000019625-143.dat	upx
behavioral1/memory/2892-119-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x000500000001961b-104.dat	upx
behavioral1/files/0x000500000001961d-110.dat	upx
behavioral1/files/0x0005000000019615-89.dat	upx
behavioral1/files/0x0005000000019613-84.dat	upx
behavioral1/files/0x000500000001960d-72.dat	upx
behavioral1/files/0x000500000001960f-70.dat	upx
behavioral1/files/0x000700000001902b-36.dat	upx
behavioral1/files/0x0008000000018b00-31.dat	upx
behavioral1/files/0x000500000001960b-67.dat	upx
behavioral1/files/0x000700000001927e-64.dat	upx
behavioral1/files/0x000700000001927c-61.dat	upx
behavioral1/files/0x000f0000000054a8-59.dat	upx
behavioral1/files/0x0008000000018bd2-49.dat	upx
behavioral1/files/0x0007000000018736-18.dat	upx
behavioral1/memory/2524-17-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x00090000000120f8-5.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XjfjUIC.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\fYgVXUG.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\TPkhxnE.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\CmVQBPp.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\IQsMPoU.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\GpfyeSO.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\unRKAkb.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\TZjDRPp.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\LjrFWgr.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\fZfHYxs.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\rDBxIkP.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\EGsKcZX.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\yHYnAhD.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\ZVbjKBc.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\zVoMuym.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\qTNNodw.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\hEyOIra.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\gIanWyn.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\AOSEaAz.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\vqRFilc.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\yrBsekD.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\pyZLMlE.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\MFhaWec.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\FrXrbZD.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\nCKAjhd.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\PnABynR.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\OstfNTt.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\HBLpnGg.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\fBdvJdh.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\inluNWz.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\uRGuqOm.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\LOYwzNN.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\EMSOGAS.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\okyleKT.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\UsHmwBk.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\gzGWhus.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\UtFnwzo.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\yVLckep.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\CuqLUwz.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\Xpabdko.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\DIOQSOr.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\NQYdqrj.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\IjECdPU.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\fSpbkmv.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\VXULFXA.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\XLGuOVm.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\CPkToEI.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\FtJqIkR.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\ZqpugTK.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\uXGDtjq.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\VCMreSl.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\nkYbdRW.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\OdzDQJF.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\QbzIjlz.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\kKIInfG.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\gsqlulP.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\AURRUJc.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\UwTZnOv.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\lDIYWAV.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\GaSHtYB.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\rfjSMba.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\MdGQgNA.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\mtoxnOt.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
File created	C:\Windows\System\vzvtGBJ.exe	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
Token: SeDebugPrivilege	2160	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2160	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	31
PID 2680 wrote to memory of 2160	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	31
PID 2680 wrote to memory of 2160	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	31
PID 2680 wrote to memory of 1388	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	32
PID 2680 wrote to memory of 1388	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	32
PID 2680 wrote to memory of 1388	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	32
PID 2680 wrote to memory of 2524	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	33
PID 2680 wrote to memory of 2524	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	33
PID 2680 wrote to memory of 2524	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	33
PID 2680 wrote to memory of 2784	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	34
PID 2680 wrote to memory of 2784	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	34
PID 2680 wrote to memory of 2784	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	34
PID 2680 wrote to memory of 2892	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	35
PID 2680 wrote to memory of 2892	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	35
PID 2680 wrote to memory of 2892	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	35
PID 2680 wrote to memory of 2912	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	36
PID 2680 wrote to memory of 2912	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	36
PID 2680 wrote to memory of 2912	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	36
PID 2680 wrote to memory of 2748	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	37
PID 2680 wrote to memory of 2748	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	37
PID 2680 wrote to memory of 2748	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	37
PID 2680 wrote to memory of 2492	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	38
PID 2680 wrote to memory of 2492	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	38
PID 2680 wrote to memory of 2492	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	38
PID 2680 wrote to memory of 2860	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	39
PID 2680 wrote to memory of 2860	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	39
PID 2680 wrote to memory of 2860	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	39
PID 2680 wrote to memory of 2864	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	40
PID 2680 wrote to memory of 2864	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	40
PID 2680 wrote to memory of 2864	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	40
PID 2680 wrote to memory of 2700	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	41
PID 2680 wrote to memory of 2700	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	41
PID 2680 wrote to memory of 2700	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	41
PID 2680 wrote to memory of 2768	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	42
PID 2680 wrote to memory of 2768	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	42
PID 2680 wrote to memory of 2768	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	42
PID 2680 wrote to memory of 2712	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	43
PID 2680 wrote to memory of 2712	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	43
PID 2680 wrote to memory of 2712	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	43
PID 2680 wrote to memory of 2640	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	44
PID 2680 wrote to memory of 2640	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	44
PID 2680 wrote to memory of 2640	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	44
PID 2680 wrote to memory of 1428	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	45
PID 2680 wrote to memory of 1428	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	45
PID 2680 wrote to memory of 1428	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	45
PID 2680 wrote to memory of 1472	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	46
PID 2680 wrote to memory of 1472	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	46
PID 2680 wrote to memory of 1472	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	46
PID 2680 wrote to memory of 1324	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	47
PID 2680 wrote to memory of 1324	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	47
PID 2680 wrote to memory of 1324	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	47
PID 2680 wrote to memory of 1788	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	48
PID 2680 wrote to memory of 1788	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	48
PID 2680 wrote to memory of 1788	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	48
PID 2680 wrote to memory of 1144	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	49
PID 2680 wrote to memory of 1144	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	49
PID 2680 wrote to memory of 1144	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	49
PID 2680 wrote to memory of 1940	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	50
PID 2680 wrote to memory of 1940	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	50
PID 2680 wrote to memory of 1940	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	50
PID 2680 wrote to memory of 1912	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	51
PID 2680 wrote to memory of 1912	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	51
PID 2680 wrote to memory of 1912	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	51
PID 2680 wrote to memory of 1988	2680	02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f4fae01b12eb37197a3de8c023ca87_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\System\ZVbjKBc.exe
  C:\Windows\System\ZVbjKBc.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\xptYywZ.exe
  C:\Windows\System\xptYywZ.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ECCLRxW.exe
  C:\Windows\System\ECCLRxW.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\olYCCWl.exe
  C:\Windows\System\olYCCWl.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\JvQdaDn.exe
  C:\Windows\System\JvQdaDn.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\UFkvaJO.exe
  C:\Windows\System\UFkvaJO.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vkuFdsl.exe
  C:\Windows\System\vkuFdsl.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\fesKTJT.exe
  C:\Windows\System\fesKTJT.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\JTNkEcq.exe
  C:\Windows\System\JTNkEcq.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\zkASgRW.exe
  C:\Windows\System\zkASgRW.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\KPTiNlk.exe
  C:\Windows\System\KPTiNlk.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\ZQzPavo.exe
  C:\Windows\System\ZQzPavo.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\KZGGwCs.exe
  C:\Windows\System\KZGGwCs.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\RMzegwS.exe
  C:\Windows\System\RMzegwS.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\AmWxqYU.exe
  C:\Windows\System\AmWxqYU.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\aFrlCaN.exe
  C:\Windows\System\aFrlCaN.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\YpPZIRN.exe
  C:\Windows\System\YpPZIRN.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\plIQXAp.exe
  C:\Windows\System\plIQXAp.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\vnwiyHL.exe
  C:\Windows\System\vnwiyHL.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\IDQOEXR.exe
  C:\Windows\System\IDQOEXR.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\ZhrULfj.exe
  C:\Windows\System\ZhrULfj.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\AsWRbdU.exe
  C:\Windows\System\AsWRbdU.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\AIIqdLW.exe
  C:\Windows\System\AIIqdLW.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\jhvhDXQ.exe
  C:\Windows\System\jhvhDXQ.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\YXZXdHP.exe
  C:\Windows\System\YXZXdHP.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\nzeEtsu.exe
  C:\Windows\System\nzeEtsu.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\vONbeeq.exe
  C:\Windows\System\vONbeeq.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\vqRFilc.exe
  C:\Windows\System\vqRFilc.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\OdzDQJF.exe
  C:\Windows\System\OdzDQJF.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\yrBsekD.exe
  C:\Windows\System\yrBsekD.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\JOKpaPG.exe
  C:\Windows\System\JOKpaPG.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\wlqNLTo.exe
  C:\Windows\System\wlqNLTo.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\EZdgQgl.exe
  C:\Windows\System\EZdgQgl.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\UsHmwBk.exe
  C:\Windows\System\UsHmwBk.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\idZxxAt.exe
  C:\Windows\System\idZxxAt.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\uGTumJl.exe
  C:\Windows\System\uGTumJl.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\KTXTYIY.exe
  C:\Windows\System\KTXTYIY.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\AZdfwso.exe
  C:\Windows\System\AZdfwso.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\mzqeron.exe
  C:\Windows\System\mzqeron.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\MPGbvEA.exe
  C:\Windows\System\MPGbvEA.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\pyZLMlE.exe
  C:\Windows\System\pyZLMlE.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\pInFqrA.exe
  C:\Windows\System\pInFqrA.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\fkRkjiW.exe
  C:\Windows\System\fkRkjiW.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\fpFwlIz.exe
  C:\Windows\System\fpFwlIz.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\WFIqxii.exe
  C:\Windows\System\WFIqxii.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\WKfkSvP.exe
  C:\Windows\System\WKfkSvP.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\VySxhzZ.exe
  C:\Windows\System\VySxhzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\udIuWab.exe
  C:\Windows\System\udIuWab.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\EoUIgvc.exe
  C:\Windows\System\EoUIgvc.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\DmwpYjY.exe
  C:\Windows\System\DmwpYjY.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\EVikQFK.exe
  C:\Windows\System\EVikQFK.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\BTgOTpQ.exe
  C:\Windows\System\BTgOTpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\urYZxdN.exe
  C:\Windows\System\urYZxdN.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\lGmUDGY.exe
  C:\Windows\System\lGmUDGY.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\DueVUFg.exe
  C:\Windows\System\DueVUFg.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\CwPJejV.exe
  C:\Windows\System\CwPJejV.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\dzwmPIz.exe
  C:\Windows\System\dzwmPIz.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\zUgQRpc.exe
  C:\Windows\System\zUgQRpc.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\iPpOSjl.exe
  C:\Windows\System\iPpOSjl.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\Lggffyq.exe
  C:\Windows\System\Lggffyq.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\YQHeQTL.exe
  C:\Windows\System\YQHeQTL.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\ohrgNyN.exe
  C:\Windows\System\ohrgNyN.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\nGRTCnl.exe
  C:\Windows\System\nGRTCnl.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\gDaVeNM.exe
  C:\Windows\System\gDaVeNM.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\XLGuOVm.exe
  C:\Windows\System\XLGuOVm.exe
  2⤵
  PID:1044
- C:\Windows\System\hUVHpmk.exe
  C:\Windows\System\hUVHpmk.exe
  2⤵
  PID:2456
- C:\Windows\System\mewPioI.exe
  C:\Windows\System\mewPioI.exe
  2⤵
  PID:1576
- C:\Windows\System\RVdgbZt.exe
  C:\Windows\System\RVdgbZt.exe
  2⤵
  PID:2432
- C:\Windows\System\IQsMPoU.exe
  C:\Windows\System\IQsMPoU.exe
  2⤵
  PID:1944
- C:\Windows\System\EfqZHwT.exe
  C:\Windows\System\EfqZHwT.exe
  2⤵
  PID:568
- C:\Windows\System\fEoedcx.exe
  C:\Windows\System\fEoedcx.exe
  2⤵
  PID:1492
- C:\Windows\System\cImBbIk.exe
  C:\Windows\System\cImBbIk.exe
  2⤵
  PID:2532
- C:\Windows\System\VwlwejU.exe
  C:\Windows\System\VwlwejU.exe
  2⤵
  PID:1632
- C:\Windows\System\NGDgilP.exe
  C:\Windows\System\NGDgilP.exe
  2⤵
  PID:2120
- C:\Windows\System\LGCBVaI.exe
  C:\Windows\System\LGCBVaI.exe
  2⤵
  PID:2196
- C:\Windows\System\FjjKDVy.exe
  C:\Windows\System\FjjKDVy.exe
  2⤵
  PID:1588
- C:\Windows\System\jDPSYXQ.exe
  C:\Windows\System\jDPSYXQ.exe
  2⤵
  PID:2876
- C:\Windows\System\FcxoDZt.exe
  C:\Windows\System\FcxoDZt.exe
  2⤵
  PID:1424
- C:\Windows\System\UHgVKtR.exe
  C:\Windows\System\UHgVKtR.exe
  2⤵
  PID:1816
- C:\Windows\System\sTngYgz.exe
  C:\Windows\System\sTngYgz.exe
  2⤵
  PID:2644
- C:\Windows\System\LqGKSgY.exe
  C:\Windows\System\LqGKSgY.exe
  2⤵
  PID:2216
- C:\Windows\System\Tqaslzm.exe
  C:\Windows\System\Tqaslzm.exe
  2⤵
  PID:3060
- C:\Windows\System\IjupbZY.exe
  C:\Windows\System\IjupbZY.exe
  2⤵
  PID:1860
- C:\Windows\System\xoNZxCd.exe
  C:\Windows\System\xoNZxCd.exe
  2⤵
  PID:1752
- C:\Windows\System\dvTfyTF.exe
  C:\Windows\System\dvTfyTF.exe
  2⤵
  PID:1624
- C:\Windows\System\xtciyrS.exe
  C:\Windows\System\xtciyrS.exe
  2⤵
  PID:836
- C:\Windows\System\XMEWNiU.exe
  C:\Windows\System\XMEWNiU.exe
  2⤵
  PID:1212
- C:\Windows\System\ekScyPv.exe
  C:\Windows\System\ekScyPv.exe
  2⤵
  PID:2996
- C:\Windows\System\GpfyeSO.exe
  C:\Windows\System\GpfyeSO.exe
  2⤵
  PID:1348
- C:\Windows\System\UFonWeW.exe
  C:\Windows\System\UFonWeW.exe
  2⤵
  PID:2796
- C:\Windows\System\TrzeRty.exe
  C:\Windows\System\TrzeRty.exe
  2⤵
  PID:2528
- C:\Windows\System\NODDeaI.exe
  C:\Windows\System\NODDeaI.exe
  2⤵
  PID:1688
- C:\Windows\System\lpxLmvL.exe
  C:\Windows\System\lpxLmvL.exe
  2⤵
  PID:2080
- C:\Windows\System\NIQdEkx.exe
  C:\Windows\System\NIQdEkx.exe
  2⤵
  PID:876
- C:\Windows\System\aIEfgFE.exe
  C:\Windows\System\aIEfgFE.exe
  2⤵
  PID:2508
- C:\Windows\System\DIOQSOr.exe
  C:\Windows\System\DIOQSOr.exe
  2⤵
  PID:2672
- C:\Windows\System\HjvxSvU.exe
  C:\Windows\System\HjvxSvU.exe
  2⤵
  PID:2340
- C:\Windows\System\Wezcert.exe
  C:\Windows\System\Wezcert.exe
  2⤵
  PID:1796
- C:\Windows\System\yQYBMLE.exe
  C:\Windows\System\yQYBMLE.exe
  2⤵
  PID:1948
- C:\Windows\System\EHjzSvW.exe
  C:\Windows\System\EHjzSvW.exe
  2⤵
  PID:2324
- C:\Windows\System\JINPKqR.exe
  C:\Windows\System\JINPKqR.exe
  2⤵
  PID:1256
- C:\Windows\System\krOwbZF.exe
  C:\Windows\System\krOwbZF.exe
  2⤵
  PID:2924
- C:\Windows\System\BWuGvQx.exe
  C:\Windows\System\BWuGvQx.exe
  2⤵
  PID:1772
- C:\Windows\System\HfAZOWi.exe
  C:\Windows\System\HfAZOWi.exe
  2⤵
  PID:2616
- C:\Windows\System\PmOfJoA.exe
  C:\Windows\System\PmOfJoA.exe
  2⤵
  PID:1200
- C:\Windows\System\CPkToEI.exe
  C:\Windows\System\CPkToEI.exe
  2⤵
  PID:2884
- C:\Windows\System\XjfjUIC.exe
  C:\Windows\System\XjfjUIC.exe
  2⤵
  PID:868
- C:\Windows\System\KPPDVCX.exe
  C:\Windows\System\KPPDVCX.exe
  2⤵
  PID:2240
- C:\Windows\System\ceRxkXf.exe
  C:\Windows\System\ceRxkXf.exe
  2⤵
  PID:2740
- C:\Windows\System\BFWOlAJ.exe
  C:\Windows\System\BFWOlAJ.exe
  2⤵
  PID:2412
- C:\Windows\System\xxrPTKW.exe
  C:\Windows\System\xxrPTKW.exe
  2⤵
  PID:2608
- C:\Windows\System\gLvCwLg.exe
  C:\Windows\System\gLvCwLg.exe
  2⤵
  PID:2604
- C:\Windows\System\VibwkQf.exe
  C:\Windows\System\VibwkQf.exe
  2⤵
  PID:1960
- C:\Windows\System\baRgRtf.exe
  C:\Windows\System\baRgRtf.exe
  2⤵
  PID:2896
- C:\Windows\System\HEQPkqo.exe
  C:\Windows\System\HEQPkqo.exe
  2⤵
  PID:1152
- C:\Windows\System\TybzunU.exe
  C:\Windows\System\TybzunU.exe
  2⤵
  PID:2868
- C:\Windows\System\hCDdNvX.exe
  C:\Windows\System\hCDdNvX.exe
  2⤵
  PID:1804
- C:\Windows\System\LtsDYua.exe
  C:\Windows\System\LtsDYua.exe
  2⤵
  PID:2648
- C:\Windows\System\cSrtPtE.exe
  C:\Windows\System\cSrtPtE.exe
  2⤵
  PID:2704
- C:\Windows\System\SuuAbDB.exe
  C:\Windows\System\SuuAbDB.exe
  2⤵
  PID:2548
- C:\Windows\System\zYjtAPw.exe
  C:\Windows\System\zYjtAPw.exe
  2⤵
  PID:1248
- C:\Windows\System\EiTwiJz.exe
  C:\Windows\System\EiTwiJz.exe
  2⤵
  PID:2272
- C:\Windows\System\diJvXLU.exe
  C:\Windows\System\diJvXLU.exe
  2⤵
  PID:2404
- C:\Windows\System\pjjFSwo.exe
  C:\Windows\System\pjjFSwo.exe
  2⤵
  PID:3076
- C:\Windows\System\hOFWBth.exe
  C:\Windows\System\hOFWBth.exe
  2⤵
  PID:3092
- C:\Windows\System\hBgKGDc.exe
  C:\Windows\System\hBgKGDc.exe
  2⤵
  PID:3108
- C:\Windows\System\ZVXDqBj.exe
  C:\Windows\System\ZVXDqBj.exe
  2⤵
  PID:3124
- C:\Windows\System\WiplWxF.exe
  C:\Windows\System\WiplWxF.exe
  2⤵
  PID:3144
- C:\Windows\System\LjsCOXJ.exe
  C:\Windows\System\LjsCOXJ.exe
  2⤵
  PID:3160
- C:\Windows\System\woyFxzq.exe
  C:\Windows\System\woyFxzq.exe
  2⤵
  PID:3176
- C:\Windows\System\vPQCAyY.exe
  C:\Windows\System\vPQCAyY.exe
  2⤵
  PID:3244
- C:\Windows\System\vcdjVlL.exe
  C:\Windows\System\vcdjVlL.exe
  2⤵
  PID:3264
- C:\Windows\System\OxGpOHs.exe
  C:\Windows\System\OxGpOHs.exe
  2⤵
  PID:3280
- C:\Windows\System\ZTOwUMA.exe
  C:\Windows\System\ZTOwUMA.exe
  2⤵
  PID:3296
- C:\Windows\System\dHhzJtV.exe
  C:\Windows\System\dHhzJtV.exe
  2⤵
  PID:3324
- C:\Windows\System\QawKlWb.exe
  C:\Windows\System\QawKlWb.exe
  2⤵
  PID:3340
- C:\Windows\System\fYgVXUG.exe
  C:\Windows\System\fYgVXUG.exe
  2⤵
  PID:3356
- C:\Windows\System\CiLjQgy.exe
  C:\Windows\System\CiLjQgy.exe
  2⤵
  PID:3372
- C:\Windows\System\HBLpnGg.exe
  C:\Windows\System\HBLpnGg.exe
  2⤵
  PID:3388
- C:\Windows\System\ztKBjbM.exe
  C:\Windows\System\ztKBjbM.exe
  2⤵
  PID:3404
- C:\Windows\System\TiQMdju.exe
  C:\Windows\System\TiQMdju.exe
  2⤵
  PID:3420
- C:\Windows\System\andawCB.exe
  C:\Windows\System\andawCB.exe
  2⤵
  PID:3440
- C:\Windows\System\RMcIGPm.exe
  C:\Windows\System\RMcIGPm.exe
  2⤵
  PID:3456
- C:\Windows\System\eqgtXaT.exe
  C:\Windows\System\eqgtXaT.exe
  2⤵
  PID:3472
- C:\Windows\System\NPJIQDk.exe
  C:\Windows\System\NPJIQDk.exe
  2⤵
  PID:3488
- C:\Windows\System\FpLSwhO.exe
  C:\Windows\System\FpLSwhO.exe
  2⤵
  PID:3504
- C:\Windows\System\lYMiBeU.exe
  C:\Windows\System\lYMiBeU.exe
  2⤵
  PID:3520
- C:\Windows\System\zVoMuym.exe
  C:\Windows\System\zVoMuym.exe
  2⤵
  PID:3536
- C:\Windows\System\AGBfqzi.exe
  C:\Windows\System\AGBfqzi.exe
  2⤵
  PID:3556
- C:\Windows\System\fBdvJdh.exe
  C:\Windows\System\fBdvJdh.exe
  2⤵
  PID:3572
- C:\Windows\System\fIXWnKG.exe
  C:\Windows\System\fIXWnKG.exe
  2⤵
  PID:3588
- C:\Windows\System\MFhaWec.exe
  C:\Windows\System\MFhaWec.exe
  2⤵
  PID:3604
- C:\Windows\System\mNrtepO.exe
  C:\Windows\System\mNrtepO.exe
  2⤵
  PID:3620
- C:\Windows\System\AregQnk.exe
  C:\Windows\System\AregQnk.exe
  2⤵
  PID:3640
- C:\Windows\System\SmRMaXL.exe
  C:\Windows\System\SmRMaXL.exe
  2⤵
  PID:3656
- C:\Windows\System\CNsVtYM.exe
  C:\Windows\System\CNsVtYM.exe
  2⤵
  PID:3672
- C:\Windows\System\LjrFWgr.exe
  C:\Windows\System\LjrFWgr.exe
  2⤵
  PID:3688
- C:\Windows\System\dgWPIGb.exe
  C:\Windows\System\dgWPIGb.exe
  2⤵
  PID:3708
- C:\Windows\System\AYBENVP.exe
  C:\Windows\System\AYBENVP.exe
  2⤵
  PID:3724
- C:\Windows\System\RUrQXvc.exe
  C:\Windows\System\RUrQXvc.exe
  2⤵
  PID:3740
- C:\Windows\System\kdYLHfn.exe
  C:\Windows\System\kdYLHfn.exe
  2⤵
  PID:3756
- C:\Windows\System\QMwNGMs.exe
  C:\Windows\System\QMwNGMs.exe
  2⤵
  PID:3776
- C:\Windows\System\tovrNBN.exe
  C:\Windows\System\tovrNBN.exe
  2⤵
  PID:3792
- C:\Windows\System\nIHcAxD.exe
  C:\Windows\System\nIHcAxD.exe
  2⤵
  PID:3808
- C:\Windows\System\PHpaiPY.exe
  C:\Windows\System\PHpaiPY.exe
  2⤵
  PID:3828
- C:\Windows\System\aZKxecn.exe
  C:\Windows\System\aZKxecn.exe
  2⤵
  PID:3844
- C:\Windows\System\RxYvnaw.exe
  C:\Windows\System\RxYvnaw.exe
  2⤵
  PID:3860
- C:\Windows\System\BImpvEX.exe
  C:\Windows\System\BImpvEX.exe
  2⤵
  PID:3876
- C:\Windows\System\kNeQfFw.exe
  C:\Windows\System\kNeQfFw.exe
  2⤵
  PID:3896
- C:\Windows\System\QbzIjlz.exe
  C:\Windows\System\QbzIjlz.exe
  2⤵
  PID:3912
- C:\Windows\System\HvBFaCJ.exe
  C:\Windows\System\HvBFaCJ.exe
  2⤵
  PID:3928
- C:\Windows\System\bhTrVxb.exe
  C:\Windows\System\bhTrVxb.exe
  2⤵
  PID:3944
- C:\Windows\System\bQmqwvD.exe
  C:\Windows\System\bQmqwvD.exe
  2⤵
  PID:3960
- C:\Windows\System\NQYdqrj.exe
  C:\Windows\System\NQYdqrj.exe
  2⤵
  PID:3980
- C:\Windows\System\TDjtwys.exe
  C:\Windows\System\TDjtwys.exe
  2⤵
  PID:3996
- C:\Windows\System\VbOcECA.exe
  C:\Windows\System\VbOcECA.exe
  2⤵
  PID:4012
- C:\Windows\System\rcQvTqb.exe
  C:\Windows\System\rcQvTqb.exe
  2⤵
  PID:4028
- C:\Windows\System\CXkVWDf.exe
  C:\Windows\System\CXkVWDf.exe
  2⤵
  PID:3192
- C:\Windows\System\KMfrNrV.exe
  C:\Windows\System\KMfrNrV.exe
  2⤵
  PID:3208
- C:\Windows\System\OpZsdlp.exe
  C:\Windows\System\OpZsdlp.exe
  2⤵
  PID:3224
- C:\Windows\System\kJPKODf.exe
  C:\Windows\System\kJPKODf.exe
  2⤵
  PID:3104
- C:\Windows\System\qKkiNrF.exe
  C:\Windows\System\qKkiNrF.exe
  2⤵
  PID:3236
- C:\Windows\System\bqMVWRZ.exe
  C:\Windows\System\bqMVWRZ.exe
  2⤵
  PID:3188
- C:\Windows\System\aRxYeRD.exe
  C:\Windows\System\aRxYeRD.exe
  2⤵
  PID:3316
- C:\Windows\System\psBpQXr.exe
  C:\Windows\System\psBpQXr.exe
  2⤵
  PID:3332
- C:\Windows\System\oxobVEl.exe
  C:\Windows\System\oxobVEl.exe
  2⤵
  PID:3784
- C:\Windows\System\pZyKEWl.exe
  C:\Windows\System\pZyKEWl.exe
  2⤵
  PID:3816
- C:\Windows\System\EWNIeSq.exe
  C:\Windows\System\EWNIeSq.exe
  2⤵
  PID:3432
- C:\Windows\System\FrXrbZD.exe
  C:\Windows\System\FrXrbZD.exe
  2⤵
  PID:3496
- C:\Windows\System\ABLXrRZ.exe
  C:\Windows\System\ABLXrRZ.exe
  2⤵
  PID:3680
- C:\Windows\System\cPTrBPa.exe
  C:\Windows\System\cPTrBPa.exe
  2⤵
  PID:3512
- C:\Windows\System\tfEaEYS.exe
  C:\Windows\System\tfEaEYS.exe
  2⤵
  PID:3548
- C:\Windows\System\JGIdOZE.exe
  C:\Windows\System\JGIdOZE.exe
  2⤵
  PID:3612
- C:\Windows\System\AiTUMoC.exe
  C:\Windows\System\AiTUMoC.exe
  2⤵
  PID:3888
- C:\Windows\System\Eprnwnb.exe
  C:\Windows\System\Eprnwnb.exe
  2⤵
  PID:3992
- C:\Windows\System\IjECdPU.exe
  C:\Windows\System\IjECdPU.exe
  2⤵
  PID:3288
- C:\Windows\System\UwTZnOv.exe
  C:\Windows\System\UwTZnOv.exe
  2⤵
  PID:3704
- C:\Windows\System\HjxzpFW.exe
  C:\Windows\System\HjxzpFW.exe
  2⤵
  PID:3904
- C:\Windows\System\JRNcUDG.exe
  C:\Windows\System\JRNcUDG.exe
  2⤵
  PID:3968
- C:\Windows\System\MyeWYTN.exe
  C:\Windows\System\MyeWYTN.exe
  2⤵
  PID:4036
- C:\Windows\System\qTNNodw.exe
  C:\Windows\System\qTNNodw.exe
  2⤵
  PID:4068
- C:\Windows\System\fGMdlzs.exe
  C:\Windows\System\fGMdlzs.exe
  2⤵
  PID:4084
- C:\Windows\System\jOnLiNB.exe
  C:\Windows\System\jOnLiNB.exe
  2⤵
  PID:2844
- C:\Windows\System\KrvErDG.exe
  C:\Windows\System\KrvErDG.exe
  2⤵
  PID:1484
- C:\Windows\System\fSpbkmv.exe
  C:\Windows\System\fSpbkmv.exe
  2⤵
  PID:3056
- C:\Windows\System\ZVcxihi.exe
  C:\Windows\System\ZVcxihi.exe
  2⤵
  PID:3664
- C:\Windows\System\cIrUNCM.exe
  C:\Windows\System\cIrUNCM.exe
  2⤵
  PID:3800
- C:\Windows\System\TaKYIfO.exe
  C:\Windows\System\TaKYIfO.exe
  2⤵
  PID:2852
- C:\Windows\System\siuqZgA.exe
  C:\Windows\System\siuqZgA.exe
  2⤵
  PID:3872
- C:\Windows\System\CVaKJeo.exe
  C:\Windows\System\CVaKJeo.exe
  2⤵
  PID:3152
- C:\Windows\System\CrbGViK.exe
  C:\Windows\System\CrbGViK.exe
  2⤵
  PID:4052
- C:\Windows\System\jptrTUz.exe
  C:\Windows\System\jptrTUz.exe
  2⤵
  PID:2600
- C:\Windows\System\efKGAFa.exe
  C:\Windows\System\efKGAFa.exe
  2⤵
  PID:3220
- C:\Windows\System\PwxkIUg.exe
  C:\Windows\System\PwxkIUg.exe
  2⤵
  PID:3200
- C:\Windows\System\hflKSzV.exe
  C:\Windows\System\hflKSzV.exe
  2⤵
  PID:3240
- C:\Windows\System\unRKAkb.exe
  C:\Windows\System\unRKAkb.exe
  2⤵
  PID:3252
- C:\Windows\System\sRKtqav.exe
  C:\Windows\System\sRKtqav.exe
  2⤵
  PID:3308
- C:\Windows\System\cDlXLHV.exe
  C:\Windows\System\cDlXLHV.exe
  2⤵
  PID:3428
- C:\Windows\System\RGsUNHM.exe
  C:\Windows\System\RGsUNHM.exe
  2⤵
  PID:3400
- C:\Windows\System\LDfAYed.exe
  C:\Windows\System\LDfAYed.exe
  2⤵
  PID:3484
- C:\Windows\System\FtJqIkR.exe
  C:\Windows\System\FtJqIkR.exe
  2⤵
  PID:3528
- C:\Windows\System\aHfYJIm.exe
  C:\Windows\System\aHfYJIm.exe
  2⤵
  PID:3648
- C:\Windows\System\RQdWeHi.exe
  C:\Windows\System\RQdWeHi.exe
  2⤵
  PID:1252
- C:\Windows\System\MeFONMP.exe
  C:\Windows\System\MeFONMP.exe
  2⤵
  PID:3884
- C:\Windows\System\qaYxBEa.exe
  C:\Windows\System\qaYxBEa.exe
  2⤵
  PID:3952
- C:\Windows\System\JAagrky.exe
  C:\Windows\System\JAagrky.exe
  2⤵
  PID:3936
- C:\Windows\System\XYUjMKZ.exe
  C:\Windows\System\XYUjMKZ.exe
  2⤵
  PID:4108
- C:\Windows\System\dIdlPJa.exe
  C:\Windows\System\dIdlPJa.exe
  2⤵
  PID:4128
- C:\Windows\System\ZqpugTK.exe
  C:\Windows\System\ZqpugTK.exe
  2⤵
  PID:4144
- C:\Windows\System\BagCRfK.exe
  C:\Windows\System\BagCRfK.exe
  2⤵
  PID:4160
- C:\Windows\System\frtkmYH.exe
  C:\Windows\System\frtkmYH.exe
  2⤵
  PID:4176
- C:\Windows\System\jqRwFJK.exe
  C:\Windows\System\jqRwFJK.exe
  2⤵
  PID:4192
- C:\Windows\System\aYJYETJ.exe
  C:\Windows\System\aYJYETJ.exe
  2⤵
  PID:4208
- C:\Windows\System\BLWLUFU.exe
  C:\Windows\System\BLWLUFU.exe
  2⤵
  PID:4224
- C:\Windows\System\nxgceCi.exe
  C:\Windows\System\nxgceCi.exe
  2⤵
  PID:4332
- C:\Windows\System\xeuKBNA.exe
  C:\Windows\System\xeuKBNA.exe
  2⤵
  PID:4352
- C:\Windows\System\xmUdiRV.exe
  C:\Windows\System\xmUdiRV.exe
  2⤵
  PID:4372
- C:\Windows\System\DKwUIey.exe
  C:\Windows\System\DKwUIey.exe
  2⤵
  PID:4388
- C:\Windows\System\PxNWREm.exe
  C:\Windows\System\PxNWREm.exe
  2⤵
  PID:4404
- C:\Windows\System\CrqMaAK.exe
  C:\Windows\System\CrqMaAK.exe
  2⤵
  PID:4420
- C:\Windows\System\bgZfuRs.exe
  C:\Windows\System\bgZfuRs.exe
  2⤵
  PID:4436
- C:\Windows\System\BVGBOMr.exe
  C:\Windows\System\BVGBOMr.exe
  2⤵
  PID:4452
- C:\Windows\System\lJCSISV.exe
  C:\Windows\System\lJCSISV.exe
  2⤵
  PID:4468
- C:\Windows\System\jmGxYCP.exe
  C:\Windows\System\jmGxYCP.exe
  2⤵
  PID:4488
- C:\Windows\System\TmnGFrO.exe
  C:\Windows\System\TmnGFrO.exe
  2⤵
  PID:4512
- C:\Windows\System\vzvtGBJ.exe
  C:\Windows\System\vzvtGBJ.exe
  2⤵
  PID:4528
- C:\Windows\System\QcedwTS.exe
  C:\Windows\System\QcedwTS.exe
  2⤵
  PID:4544
- C:\Windows\System\mOBvbbg.exe
  C:\Windows\System\mOBvbbg.exe
  2⤵
  PID:4564
- C:\Windows\System\qgNcYNa.exe
  C:\Windows\System\qgNcYNa.exe
  2⤵
  PID:4580
- C:\Windows\System\MNlvCCN.exe
  C:\Windows\System\MNlvCCN.exe
  2⤵
  PID:4596
- C:\Windows\System\fZfHYxs.exe
  C:\Windows\System\fZfHYxs.exe
  2⤵
  PID:4616
- C:\Windows\System\kINiclN.exe
  C:\Windows\System\kINiclN.exe
  2⤵
  PID:4640
- C:\Windows\System\pAOisxe.exe
  C:\Windows\System\pAOisxe.exe
  2⤵
  PID:4656
- C:\Windows\System\sjplnDG.exe
  C:\Windows\System\sjplnDG.exe
  2⤵
  PID:4672
- C:\Windows\System\hEyOIra.exe
  C:\Windows\System\hEyOIra.exe
  2⤵
  PID:4688
- C:\Windows\System\mtoxnOt.exe
  C:\Windows\System\mtoxnOt.exe
  2⤵
  PID:4708
- C:\Windows\System\gJrhYwY.exe
  C:\Windows\System\gJrhYwY.exe
  2⤵
  PID:4724
- C:\Windows\System\DYBOgLi.exe
  C:\Windows\System\DYBOgLi.exe
  2⤵
  PID:4740
- C:\Windows\System\YNcelog.exe
  C:\Windows\System\YNcelog.exe
  2⤵
  PID:4756
- C:\Windows\System\qMaRmJP.exe
  C:\Windows\System\qMaRmJP.exe
  2⤵
  PID:4772
- C:\Windows\System\RUCiZHl.exe
  C:\Windows\System\RUCiZHl.exe
  2⤵
  PID:4788
- C:\Windows\System\YJeGOPh.exe
  C:\Windows\System\YJeGOPh.exe
  2⤵
  PID:4804
- C:\Windows\System\SWYBTiX.exe
  C:\Windows\System\SWYBTiX.exe
  2⤵
  PID:4824
- C:\Windows\System\cSGDhYp.exe
  C:\Windows\System\cSGDhYp.exe
  2⤵
  PID:4840
- C:\Windows\System\LdtulrH.exe
  C:\Windows\System\LdtulrH.exe
  2⤵
  PID:4856
- C:\Windows\System\UXtFzNl.exe
  C:\Windows\System\UXtFzNl.exe
  2⤵
  PID:4872
- C:\Windows\System\zUJgPXO.exe
  C:\Windows\System\zUJgPXO.exe
  2⤵
  PID:4956
- C:\Windows\System\DHLvTnq.exe
  C:\Windows\System\DHLvTnq.exe
  2⤵
  PID:4972
- C:\Windows\System\zQPZFwb.exe
  C:\Windows\System\zQPZFwb.exe
  2⤵
  PID:4988
- C:\Windows\System\yKxoXer.exe
  C:\Windows\System\yKxoXer.exe
  2⤵
  PID:5004
- C:\Windows\System\InRgQtb.exe
  C:\Windows\System\InRgQtb.exe
  2⤵
  PID:5020
- C:\Windows\System\MXgxjfv.exe
  C:\Windows\System\MXgxjfv.exe
  2⤵
  PID:5036
- C:\Windows\System\BMJsOCx.exe
  C:\Windows\System\BMJsOCx.exe
  2⤵
  PID:5052
- C:\Windows\System\vlRVnLB.exe
  C:\Windows\System\vlRVnLB.exe
  2⤵
  PID:5068
- C:\Windows\System\uTzHLhz.exe
  C:\Windows\System\uTzHLhz.exe
  2⤵
  PID:5084
- C:\Windows\System\oMtyDCE.exe
  C:\Windows\System\oMtyDCE.exe
  2⤵
  PID:5100
- C:\Windows\System\VwBjYmA.exe
  C:\Windows\System\VwBjYmA.exe
  2⤵
  PID:5116
- C:\Windows\System\RLDJWdY.exe
  C:\Windows\System\RLDJWdY.exe
  2⤵
  PID:4064
- C:\Windows\System\gBZyEpE.exe
  C:\Windows\System\gBZyEpE.exe
  2⤵
  PID:3736
- C:\Windows\System\nCKAjhd.exe
  C:\Windows\System\nCKAjhd.exe
  2⤵
  PID:3600
- C:\Windows\System\rgIMKAw.exe
  C:\Windows\System\rgIMKAw.exe
  2⤵
  PID:4008
- C:\Windows\System\TPkhxnE.exe
  C:\Windows\System\TPkhxnE.exe
  2⤵
  PID:3636
- C:\Windows\System\rTTyZbP.exe
  C:\Windows\System\rTTyZbP.exe
  2⤵
  PID:3120
- C:\Windows\System\DIVWKOr.exe
  C:\Windows\System\DIVWKOr.exe
  2⤵
  PID:1184
- C:\Windows\System\DlxEzfa.exe
  C:\Windows\System\DlxEzfa.exe
  2⤵
  PID:3716
- C:\Windows\System\NFqGFvV.exe
  C:\Windows\System\NFqGFvV.exe
  2⤵
  PID:4100
- C:\Windows\System\bvrsnxu.exe
  C:\Windows\System\bvrsnxu.exe
  2⤵
  PID:4304
- C:\Windows\System\xQnbZDW.exe
  C:\Windows\System\xQnbZDW.exe
  2⤵
  PID:4316
- C:\Windows\System\buKHReq.exe
  C:\Windows\System\buKHReq.exe
  2⤵
  PID:4124
- C:\Windows\System\uVEhOTK.exe
  C:\Windows\System\uVEhOTK.exe
  2⤵
  PID:4080
- C:\Windows\System\FKsJAKH.exe
  C:\Windows\System\FKsJAKH.exe
  2⤵
  PID:3052
- C:\Windows\System\gzGWhus.exe
  C:\Windows\System\gzGWhus.exe
  2⤵
  PID:3364
- C:\Windows\System\yzekjGb.exe
  C:\Windows\System\yzekjGb.exe
  2⤵
  PID:3852
- C:\Windows\System\mbRPbYx.exe
  C:\Windows\System\mbRPbYx.exe
  2⤵
  PID:4328
- C:\Windows\System\vIRyhIG.exe
  C:\Windows\System\vIRyhIG.exe
  2⤵
  PID:4396
- C:\Windows\System\AilYNZg.exe
  C:\Windows\System\AilYNZg.exe
  2⤵
  PID:4344
- C:\Windows\System\heONoWr.exe
  C:\Windows\System\heONoWr.exe
  2⤵
  PID:4348
- C:\Windows\System\RJNwDhI.exe
  C:\Windows\System\RJNwDhI.exe
  2⤵
  PID:4460
- C:\Windows\System\qTgGUSJ.exe
  C:\Windows\System\qTgGUSJ.exe
  2⤵
  PID:4608
- C:\Windows\System\BmTFYaW.exe
  C:\Windows\System\BmTFYaW.exe
  2⤵
  PID:4652
- C:\Windows\System\WerKujO.exe
  C:\Windows\System\WerKujO.exe
  2⤵
  PID:4716
- C:\Windows\System\umHyAjl.exe
  C:\Windows\System\umHyAjl.exe
  2⤵
  PID:4780
- C:\Windows\System\gFOIyOJ.exe
  C:\Windows\System\gFOIyOJ.exe
  2⤵
  PID:4820
- C:\Windows\System\fpPqFSr.exe
  C:\Windows\System\fpPqFSr.exe
  2⤵
  PID:4888
- C:\Windows\System\lYrPdaF.exe
  C:\Windows\System\lYrPdaF.exe
  2⤵
  PID:4480
- C:\Windows\System\gpimbnN.exe
  C:\Windows\System\gpimbnN.exe
  2⤵
  PID:4800
- C:\Windows\System\LPmWZRn.exe
  C:\Windows\System\LPmWZRn.exe
  2⤵
  PID:4700
- C:\Windows\System\BnOyKPY.exe
  C:\Windows\System\BnOyKPY.exe
  2⤵
  PID:4636
- C:\Windows\System\ZwwAGuj.exe
  C:\Windows\System\ZwwAGuj.exe
  2⤵
  PID:4560
- C:\Windows\System\lDIYWAV.exe
  C:\Windows\System\lDIYWAV.exe
  2⤵
  PID:4768
- C:\Windows\System\iKMpqak.exe
  C:\Windows\System\iKMpqak.exe
  2⤵
  PID:4864
- C:\Windows\System\VDeoNnz.exe
  C:\Windows\System\VDeoNnz.exe
  2⤵
  PID:4892
- C:\Windows\System\kKIInfG.exe
  C:\Windows\System\kKIInfG.exe
  2⤵
  PID:4924
- C:\Windows\System\LaTVQzj.exe
  C:\Windows\System\LaTVQzj.exe
  2⤵
  PID:4940
- C:\Windows\System\inluNWz.exe
  C:\Windows\System\inluNWz.exe
  2⤵
  PID:4964
- C:\Windows\System\jREEPqN.exe
  C:\Windows\System\jREEPqN.exe
  2⤵
  PID:5012
- C:\Windows\System\EaawePp.exe
  C:\Windows\System\EaawePp.exe
  2⤵
  PID:5076
- C:\Windows\System\aVCjzfv.exe
  C:\Windows\System\aVCjzfv.exe
  2⤵
  PID:5108
- C:\Windows\System\wEceLIC.exe
  C:\Windows\System\wEceLIC.exe
  2⤵
  PID:2580
- C:\Windows\System\UAZTIfq.exe
  C:\Windows\System\UAZTIfq.exe
  2⤵
  PID:3276
- C:\Windows\System\lzwdDBh.exe
  C:\Windows\System\lzwdDBh.exe
  2⤵
  PID:1712
- C:\Windows\System\pkgWuSj.exe
  C:\Windows\System\pkgWuSj.exe
  2⤵
  PID:4200
- C:\Windows\System\UtFnwzo.exe
  C:\Windows\System\UtFnwzo.exe
  2⤵
  PID:3924
- C:\Windows\System\OYKMeMa.exe
  C:\Windows\System\OYKMeMa.exe
  2⤵
  PID:4232
- C:\Windows\System\WWJFVcZ.exe
  C:\Windows\System\WWJFVcZ.exe
  2⤵
  PID:1336
- C:\Windows\System\qTPtuuV.exe
  C:\Windows\System\qTPtuuV.exe
  2⤵
  PID:4272
- C:\Windows\System\sbtOOyF.exe
  C:\Windows\System\sbtOOyF.exe
  2⤵
  PID:4284
- C:\Windows\System\zkWLkDA.exe
  C:\Windows\System\zkWLkDA.exe
  2⤵
  PID:1532
- C:\Windows\System\hqUGVjX.exe
  C:\Windows\System\hqUGVjX.exe
  2⤵
  PID:4312
- C:\Windows\System\YWnfepY.exe
  C:\Windows\System\YWnfepY.exe
  2⤵
  PID:4116
- C:\Windows\System\GaSHtYB.exe
  C:\Windows\System\GaSHtYB.exe
  2⤵
  PID:3700
- C:\Windows\System\WnGbSxC.exe
  C:\Windows\System\WnGbSxC.exe
  2⤵
  PID:4216
- C:\Windows\System\eWutPOp.exe
  C:\Windows\System\eWutPOp.exe
  2⤵
  PID:4340
- C:\Windows\System\MPKfUXd.exe
  C:\Windows\System\MPKfUXd.exe
  2⤵
  PID:4496
- C:\Windows\System\upBQGLC.exe
  C:\Windows\System\upBQGLC.exe
  2⤵
  PID:3480
- C:\Windows\System\gVPIvyw.exe
  C:\Windows\System\gVPIvyw.exe
  2⤵
  PID:4648
- C:\Windows\System\zRHevFL.exe
  C:\Windows\System\zRHevFL.exe
  2⤵
  PID:4604
- C:\Windows\System\IflVfeM.exe
  C:\Windows\System\IflVfeM.exe
  2⤵
  PID:4704
- C:\Windows\System\OjrTSzG.exe
  C:\Windows\System\OjrTSzG.exe
  2⤵
  PID:4748
- C:\Windows\System\QPEhbOr.exe
  C:\Windows\System\QPEhbOr.exe
  2⤵
  PID:4896
- C:\Windows\System\rqUqJzE.exe
  C:\Windows\System\rqUqJzE.exe
  2⤵
  PID:4952
- C:\Windows\System\IcECcuU.exe
  C:\Windows\System\IcECcuU.exe
  2⤵
  PID:4664
- C:\Windows\System\dLECutp.exe
  C:\Windows\System\dLECutp.exe
  2⤵
  PID:4984
- C:\Windows\System\kubkpZe.exe
  C:\Windows\System\kubkpZe.exe
  2⤵
  PID:3596
- C:\Windows\System\IWwMlym.exe
  C:\Windows\System\IWwMlym.exe
  2⤵
  PID:5032
- C:\Windows\System\rREUkNG.exe
  C:\Windows\System\rREUkNG.exe
  2⤵
  PID:3768
- C:\Windows\System\KFfTvmU.exe
  C:\Windows\System\KFfTvmU.exe
  2⤵
  PID:2248
- C:\Windows\System\AdpMhEN.exe
  C:\Windows\System\AdpMhEN.exe
  2⤵
  PID:3320
- C:\Windows\System\YOlBoda.exe
  C:\Windows\System\YOlBoda.exe
  2⤵
  PID:2744
- C:\Windows\System\iCAYEUt.exe
  C:\Windows\System\iCAYEUt.exe
  2⤵
  PID:3956
- C:\Windows\System\SpEyEcm.exe
  C:\Windows\System\SpEyEcm.exe
  2⤵
  PID:4240
- C:\Windows\System\vASSrCe.exe
  C:\Windows\System\vASSrCe.exe
  2⤵
  PID:4252
- C:\Windows\System\YyrtKZz.exe
  C:\Windows\System\YyrtKZz.exe
  2⤵
  PID:1516
- C:\Windows\System\mEDsehV.exe
  C:\Windows\System\mEDsehV.exe
  2⤵
  PID:3336
- C:\Windows\System\nxCdSlJ.exe
  C:\Windows\System\nxCdSlJ.exe
  2⤵
  PID:4416
- C:\Windows\System\IZdrLYg.exe
  C:\Windows\System\IZdrLYg.exe
  2⤵
  PID:4368
- C:\Windows\System\HBztEtS.exe
  C:\Windows\System\HBztEtS.exe
  2⤵
  PID:4812
- C:\Windows\System\hKQAVaR.exe
  C:\Windows\System\hKQAVaR.exe
  2⤵
  PID:4572
- C:\Windows\System\RArTjoT.exe
  C:\Windows\System\RArTjoT.exe
  2⤵
  PID:4852
- C:\Windows\System\VKxPecY.exe
  C:\Windows\System\VKxPecY.exe
  2⤵
  PID:4732
- C:\Windows\System\mDGaUqN.exe
  C:\Windows\System\mDGaUqN.exe
  2⤵
  PID:4980
- C:\Windows\System\dlRrwXT.exe
  C:\Windows\System\dlRrwXT.exe
  2⤵
  PID:4868
- C:\Windows\System\xSkSXQo.exe
  C:\Windows\System\xSkSXQo.exe
  2⤵
  PID:4524
- C:\Windows\System\mBrFsVY.exe
  C:\Windows\System\mBrFsVY.exe
  2⤵
  PID:5044
- C:\Windows\System\LQaNbMR.exe
  C:\Windows\System\LQaNbMR.exe
  2⤵
  PID:1304
- C:\Windows\System\cGRxFxN.exe
  C:\Windows\System\cGRxFxN.exe
  2⤵
  PID:3088
- C:\Windows\System\XVpOaOJ.exe
  C:\Windows\System\XVpOaOJ.exe
  2⤵
  PID:4048
- C:\Windows\System\ngkqGvK.exe
  C:\Windows\System\ngkqGvK.exe
  2⤵
  PID:2980
- C:\Windows\System\oPBXLLP.exe
  C:\Windows\System\oPBXLLP.exe
  2⤵
  PID:2264
- C:\Windows\System\uRGuqOm.exe
  C:\Windows\System\uRGuqOm.exe
  2⤵
  PID:3684
- C:\Windows\System\BrmNTPg.exe
  C:\Windows\System\BrmNTPg.exe
  2⤵
  PID:4264
- C:\Windows\System\JXQbfpX.exe
  C:\Windows\System\JXQbfpX.exe
  2⤵
  PID:4276
- C:\Windows\System\rDBxIkP.exe
  C:\Windows\System\rDBxIkP.exe
  2⤵
  PID:4324
- C:\Windows\System\hKMflYW.exe
  C:\Windows\System\hKMflYW.exe
  2⤵
  PID:3788
- C:\Windows\System\mTcODam.exe
  C:\Windows\System\mTcODam.exe
  2⤵
  PID:2540
- C:\Windows\System\seYMZvB.exe
  C:\Windows\System\seYMZvB.exe
  2⤵
  PID:5064
- C:\Windows\System\jwiECqq.exe
  C:\Windows\System\jwiECqq.exe
  2⤵
  PID:4836
- C:\Windows\System\mQZiUDc.exe
  C:\Windows\System\mQZiUDc.exe
  2⤵
  PID:5112
- C:\Windows\System\DuvEQPc.exe
  C:\Windows\System\DuvEQPc.exe
  2⤵
  PID:1680
- C:\Windows\System\CoOLkwC.exe
  C:\Windows\System\CoOLkwC.exe
  2⤵
  PID:3840
- C:\Windows\System\rxqXJNG.exe
  C:\Windows\System\rxqXJNG.exe
  2⤵
  PID:4296
- C:\Windows\System\FSNVeQq.exe
  C:\Windows\System\FSNVeQq.exe
  2⤵
  PID:4448
- C:\Windows\System\xMwqRGr.exe
  C:\Windows\System\xMwqRGr.exe
  2⤵
  PID:3468
- C:\Windows\System\dkSfGYe.exe
  C:\Windows\System\dkSfGYe.exe
  2⤵
  PID:4040
- C:\Windows\System\cjBtdzu.exe
  C:\Windows\System\cjBtdzu.exe
  2⤵
  PID:4380
- C:\Windows\System\QtLIlnw.exe
  C:\Windows\System\QtLIlnw.exe
  2⤵
  PID:4576
- C:\Windows\System\wnDadiG.exe
  C:\Windows\System\wnDadiG.exe
  2⤵
  PID:4292
- C:\Windows\System\nABvdJi.exe
  C:\Windows\System\nABvdJi.exe
  2⤵
  PID:5140
- C:\Windows\System\XkUnDQY.exe
  C:\Windows\System\XkUnDQY.exe
  2⤵
  PID:5156
- C:\Windows\System\FkZQdPd.exe
  C:\Windows\System\FkZQdPd.exe
  2⤵
  PID:5172
- C:\Windows\System\xyJkxHA.exe
  C:\Windows\System\xyJkxHA.exe
  2⤵
  PID:5188
- C:\Windows\System\ebyEEKu.exe
  C:\Windows\System\ebyEEKu.exe
  2⤵
  PID:5208
- C:\Windows\System\JDpLpAg.exe
  C:\Windows\System\JDpLpAg.exe
  2⤵
  PID:5224
- C:\Windows\System\sdBzTBC.exe
  C:\Windows\System\sdBzTBC.exe
  2⤵
  PID:5240
- C:\Windows\System\VahTNQq.exe
  C:\Windows\System\VahTNQq.exe
  2⤵
  PID:5260
- C:\Windows\System\aGvOVwm.exe
  C:\Windows\System\aGvOVwm.exe
  2⤵
  PID:5276
- C:\Windows\System\hmCQzCS.exe
  C:\Windows\System\hmCQzCS.exe
  2⤵
  PID:5296
- C:\Windows\System\EGsKcZX.exe
  C:\Windows\System\EGsKcZX.exe
  2⤵
  PID:5312
- C:\Windows\System\eCXwFVu.exe
  C:\Windows\System\eCXwFVu.exe
  2⤵
  PID:5380
- C:\Windows\System\QNyZdEq.exe
  C:\Windows\System\QNyZdEq.exe
  2⤵
  PID:5400
- C:\Windows\System\LOYwzNN.exe
  C:\Windows\System\LOYwzNN.exe
  2⤵
  PID:5416
- C:\Windows\System\geRslAC.exe
  C:\Windows\System\geRslAC.exe
  2⤵
  PID:5432
- C:\Windows\System\yJIdvVV.exe
  C:\Windows\System\yJIdvVV.exe
  2⤵
  PID:5448
- C:\Windows\System\ggtMDLm.exe
  C:\Windows\System\ggtMDLm.exe
  2⤵
  PID:5464
- C:\Windows\System\cConsrw.exe
  C:\Windows\System\cConsrw.exe
  2⤵
  PID:5480
- C:\Windows\System\hRvDeNW.exe
  C:\Windows\System\hRvDeNW.exe
  2⤵
  PID:5496
- C:\Windows\System\EDxzjVB.exe
  C:\Windows\System\EDxzjVB.exe
  2⤵
  PID:5512
- C:\Windows\System\BjBrvFB.exe
  C:\Windows\System\BjBrvFB.exe
  2⤵
  PID:5528
- C:\Windows\System\qvXQoql.exe
  C:\Windows\System\qvXQoql.exe
  2⤵
  PID:5544
- C:\Windows\System\WgNmEfX.exe
  C:\Windows\System\WgNmEfX.exe
  2⤵
  PID:5560
- C:\Windows\System\vwgNWMt.exe
  C:\Windows\System\vwgNWMt.exe
  2⤵
  PID:5576
- C:\Windows\System\TUgnyKI.exe
  C:\Windows\System\TUgnyKI.exe
  2⤵
  PID:5592
- C:\Windows\System\RkBMSDl.exe
  C:\Windows\System\RkBMSDl.exe
  2⤵
  PID:5608
- C:\Windows\System\AHsOQlp.exe
  C:\Windows\System\AHsOQlp.exe
  2⤵
  PID:5628
- C:\Windows\System\fGzwMxf.exe
  C:\Windows\System\fGzwMxf.exe
  2⤵
  PID:5644
- C:\Windows\System\EMSOGAS.exe
  C:\Windows\System\EMSOGAS.exe
  2⤵
  PID:5660
- C:\Windows\System\goGHuew.exe
  C:\Windows\System\goGHuew.exe
  2⤵
  PID:5676
- C:\Windows\System\yfrttGX.exe
  C:\Windows\System\yfrttGX.exe
  2⤵
  PID:5692
- C:\Windows\System\pFYDxbY.exe
  C:\Windows\System\pFYDxbY.exe
  2⤵
  PID:5708
- C:\Windows\System\ySzdVvI.exe
  C:\Windows\System\ySzdVvI.exe
  2⤵
  PID:5732
- C:\Windows\System\zDFsiyY.exe
  C:\Windows\System\zDFsiyY.exe
  2⤵
  PID:5748
- C:\Windows\System\CNaCnxl.exe
  C:\Windows\System\CNaCnxl.exe
  2⤵
  PID:5768
- C:\Windows\System\YTgsauE.exe
  C:\Windows\System\YTgsauE.exe
  2⤵
  PID:5784
- C:\Windows\System\mcecyGD.exe
  C:\Windows\System\mcecyGD.exe
  2⤵
  PID:5804
- C:\Windows\System\ZzlbUnQ.exe
  C:\Windows\System\ZzlbUnQ.exe
  2⤵
  PID:5820
- C:\Windows\System\NJmoyUg.exe
  C:\Windows\System\NJmoyUg.exe
  2⤵
  PID:5836
- C:\Windows\System\kfVMEmZ.exe
  C:\Windows\System\kfVMEmZ.exe
  2⤵
  PID:5852
- C:\Windows\System\NoCwOAP.exe
  C:\Windows\System\NoCwOAP.exe
  2⤵
  PID:5868
- C:\Windows\System\sGmeioP.exe
  C:\Windows\System\sGmeioP.exe
  2⤵
  PID:5884
- C:\Windows\System\OORglkq.exe
  C:\Windows\System\OORglkq.exe
  2⤵
  PID:5900
- C:\Windows\System\EkbBSfJ.exe
  C:\Windows\System\EkbBSfJ.exe
  2⤵
  PID:5924
- C:\Windows\System\TYdYdWk.exe
  C:\Windows\System\TYdYdWk.exe
  2⤵
  PID:5956
- C:\Windows\System\lBpnxqu.exe
  C:\Windows\System\lBpnxqu.exe
  2⤵
  PID:5988
- C:\Windows\System\sDCbDwx.exe
  C:\Windows\System\sDCbDwx.exe
  2⤵
  PID:6004
- C:\Windows\System\KvISXEk.exe
  C:\Windows\System\KvISXEk.exe
  2⤵
  PID:6024
- C:\Windows\System\KedQFUu.exe
  C:\Windows\System\KedQFUu.exe
  2⤵
  PID:6044
- C:\Windows\System\YvHXTay.exe
  C:\Windows\System\YvHXTay.exe
  2⤵
  PID:6060
- C:\Windows\System\ftbqFlY.exe
  C:\Windows\System\ftbqFlY.exe
  2⤵
  PID:6076
- C:\Windows\System\rfjSMba.exe
  C:\Windows\System\rfjSMba.exe
  2⤵
  PID:6096
- C:\Windows\System\TmCFLyi.exe
  C:\Windows\System\TmCFLyi.exe
  2⤵
  PID:6112
- C:\Windows\System\dxWAdTb.exe
  C:\Windows\System\dxWAdTb.exe
  2⤵
  PID:4816
- C:\Windows\System\dcUtByE.exe
  C:\Windows\System\dcUtByE.exe
  2⤵
  PID:840
- C:\Windows\System\RlafIOD.exe
  C:\Windows\System\RlafIOD.exe
  2⤵
  PID:5204
- C:\Windows\System\okyleKT.exe
  C:\Windows\System\okyleKT.exe
  2⤵
  PID:5288
- C:\Windows\System\KuLhCeC.exe
  C:\Windows\System\KuLhCeC.exe
  2⤵
  PID:3172
- C:\Windows\System\TZjDRPp.exe
  C:\Windows\System\TZjDRPp.exe
  2⤵
  PID:5340
- C:\Windows\System\LWfnTRM.exe
  C:\Windows\System\LWfnTRM.exe
  2⤵
  PID:4920
- C:\Windows\System\KBYgqLF.exe
  C:\Windows\System\KBYgqLF.exe
  2⤵
  PID:5180
- C:\Windows\System\sXvuDuX.exe
  C:\Windows\System\sXvuDuX.exe
  2⤵
  PID:5256
- C:\Windows\System\xnupeEH.exe
  C:\Windows\System\xnupeEH.exe
  2⤵
  PID:5368
- C:\Windows\System\vtpMrcT.exe
  C:\Windows\System\vtpMrcT.exe
  2⤵
  PID:5320
- C:\Windows\System\uXGDtjq.exe
  C:\Windows\System\uXGDtjq.exe
  2⤵
  PID:5348
- C:\Windows\System\PHMLODZ.exe
  C:\Windows\System\PHMLODZ.exe
  2⤵
  PID:5272
- C:\Windows\System\eEXwpJu.exe
  C:\Windows\System\eEXwpJu.exe
  2⤵
  PID:5396
- C:\Windows\System\CpbJvyr.exe
  C:\Windows\System\CpbJvyr.exe
  2⤵
  PID:5504
- C:\Windows\System\ArXgmnD.exe
  C:\Windows\System\ArXgmnD.exe
  2⤵
  PID:5568
- C:\Windows\System\HCFkZpd.exe
  C:\Windows\System\HCFkZpd.exe
  2⤵
  PID:5636
- C:\Windows\System\gWIZiMn.exe
  C:\Windows\System\gWIZiMn.exe
  2⤵
  PID:5424
- C:\Windows\System\fwIWLjK.exe
  C:\Windows\System\fwIWLjK.exe
  2⤵
  PID:5492
- C:\Windows\System\gjDKTIz.exe
  C:\Windows\System\gjDKTIz.exe
  2⤵
  PID:5584
- C:\Windows\System\IrWcZaZ.exe
  C:\Windows\System\IrWcZaZ.exe
  2⤵
  PID:5624
- C:\Windows\System\iZaxkxK.exe
  C:\Windows\System\iZaxkxK.exe
  2⤵
  PID:3048
- C:\Windows\System\gmhAWYT.exe
  C:\Windows\System\gmhAWYT.exe
  2⤵
  PID:5688
- C:\Windows\System\MdGQgNA.exe
  C:\Windows\System\MdGQgNA.exe
  2⤵
  PID:5796
- C:\Windows\System\BmICKOM.exe
  C:\Windows\System\BmICKOM.exe
  2⤵
  PID:5908
- C:\Windows\System\gPupkab.exe
  C:\Windows\System\gPupkab.exe
  2⤵
  PID:5912
- C:\Windows\System\hElFSpl.exe
  C:\Windows\System\hElFSpl.exe
  2⤵
  PID:5972
- C:\Windows\System\bwJgitZ.exe
  C:\Windows\System\bwJgitZ.exe
  2⤵
  PID:5940
- C:\Windows\System\CzcvFBC.exe
  C:\Windows\System\CzcvFBC.exe
  2⤵
  PID:5980
- C:\Windows\System\EdddvFY.exe
  C:\Windows\System\EdddvFY.exe
  2⤵
  PID:6056
- C:\Windows\System\IPpzEfH.exe
  C:\Windows\System\IPpzEfH.exe
  2⤵
  PID:6012
- C:\Windows\System\CenPQDo.exe
  C:\Windows\System\CenPQDo.exe
  2⤵
  PID:6120
- C:\Windows\System\CMcMevI.exe
  C:\Windows\System\CMcMevI.exe
  2⤵
  PID:6140
- C:\Windows\System\AUWyLwW.exe
  C:\Windows\System\AUWyLwW.exe
  2⤵
  PID:3940
- C:\Windows\System\txxxQxc.exe
  C:\Windows\System\txxxQxc.exe
  2⤵
  PID:3976
- C:\Windows\System\TbJKMBr.exe
  C:\Windows\System\TbJKMBr.exe
  2⤵
  PID:4936
- C:\Windows\System\yDHICjC.exe
  C:\Windows\System\yDHICjC.exe
  2⤵
  PID:6040
- C:\Windows\System\AqHcHUj.exe
  C:\Windows\System\AqHcHUj.exe
  2⤵
  PID:6104
- C:\Windows\System\mCqqLmF.exe
  C:\Windows\System\mCqqLmF.exe
  2⤵
  PID:5196
- C:\Windows\System\gOCZPFI.exe
  C:\Windows\System\gOCZPFI.exe
  2⤵
  PID:5128
- C:\Windows\System\NNIdxDn.exe
  C:\Windows\System\NNIdxDn.exe
  2⤵
  PID:2824
- C:\Windows\System\eUPIwGH.exe
  C:\Windows\System\eUPIwGH.exe
  2⤵
  PID:5344
- C:\Windows\System\inKsOUz.exe
  C:\Windows\System\inKsOUz.exe
  2⤵
  PID:5376
- C:\Windows\System\SGoeGnN.exe
  C:\Windows\System\SGoeGnN.exe
  2⤵
  PID:5604
- C:\Windows\System\jbLlOXl.exe
  C:\Windows\System\jbLlOXl.exe
  2⤵
  PID:5640
- C:\Windows\System\gaHXAFG.exe
  C:\Windows\System\gaHXAFG.exe
  2⤵
  PID:5620
- C:\Windows\System\FxMCrZV.exe
  C:\Windows\System\FxMCrZV.exe
  2⤵
  PID:5672
- C:\Windows\System\GuHSafN.exe
  C:\Windows\System\GuHSafN.exe
  2⤵
  PID:5828
- C:\Windows\System\yqacTir.exe
  C:\Windows\System\yqacTir.exe
  2⤵
  PID:5964
- C:\Windows\System\kisTNdU.exe
  C:\Windows\System\kisTNdU.exe
  2⤵
  PID:5728
- C:\Windows\System\aAjobvI.exe
  C:\Windows\System\aAjobvI.exe
  2⤵
  PID:5792
- C:\Windows\System\qdnAYVT.exe
  C:\Windows\System\qdnAYVT.exe
  2⤵
  PID:5780
- C:\Windows\System\QJudaAg.exe
  C:\Windows\System\QJudaAg.exe
  2⤵
  PID:5876
- C:\Windows\System\fwwENkT.exe
  C:\Windows\System\fwwENkT.exe
  2⤵
  PID:5880
- C:\Windows\System\OeoLmNK.exe
  C:\Windows\System\OeoLmNK.exe
  2⤵
  PID:4168
- C:\Windows\System\mNAZVpd.exe
  C:\Windows\System\mNAZVpd.exe
  2⤵
  PID:2060
- C:\Windows\System\LfMkLuh.exe
  C:\Windows\System\LfMkLuh.exe
  2⤵
  PID:3228
- C:\Windows\System\OaHvtGv.exe
  C:\Windows\System\OaHvtGv.exe
  2⤵
  PID:2964
- C:\Windows\System\LVlpkAy.exe
  C:\Windows\System\LVlpkAy.exe
  2⤵
  PID:5352
- C:\Windows\System\VggqGVi.exe
  C:\Windows\System\VggqGVi.exe
  2⤵
  PID:5164
- C:\Windows\System\hgefdmD.exe
  C:\Windows\System\hgefdmD.exe
  2⤵
  PID:4204
- C:\Windows\System\aeRKwEG.exe
  C:\Windows\System\aeRKwEG.exe
  2⤵
  PID:5388
- C:\Windows\System\HOkjRFt.exe
  C:\Windows\System\HOkjRFt.exe
  2⤵
  PID:5600
- C:\Windows\System\dTEUWIZ.exe
  C:\Windows\System\dTEUWIZ.exe
  2⤵
  PID:5304
- C:\Windows\System\zVJcvcY.exe
  C:\Windows\System\zVJcvcY.exe
  2⤵
  PID:5292
- C:\Windows\System\DVDVwgD.exe
  C:\Windows\System\DVDVwgD.exe
  2⤵
  PID:5540
- C:\Windows\System\yiisaVt.exe
  C:\Windows\System\yiisaVt.exe
  2⤵
  PID:5460
- C:\Windows\System\rmpUnqM.exe
  C:\Windows\System\rmpUnqM.exe
  2⤵
  PID:5184
- C:\Windows\System\goAJVSE.exe
  C:\Windows\System\goAJVSE.exe
  2⤵
  PID:5916
- C:\Windows\System\OgXiIKY.exe
  C:\Windows\System\OgXiIKY.exe
  2⤵
  PID:5848
- C:\Windows\System\WcgbAVq.exe
  C:\Windows\System\WcgbAVq.exe
  2⤵
  PID:4140
- C:\Windows\System\ibnQQWr.exe
  C:\Windows\System\ibnQQWr.exe
  2⤵
  PID:6108
- C:\Windows\System\iOFqtSe.exe
  C:\Windows\System\iOFqtSe.exe
  2⤵
  PID:5812
- C:\Windows\System\byDLAAw.exe
  C:\Windows\System\byDLAAw.exe
  2⤵
  PID:5936
- C:\Windows\System\GxkDnpb.exe
  C:\Windows\System\GxkDnpb.exe
  2⤵
  PID:5216
- C:\Windows\System\KFOaQNr.exe
  C:\Windows\System\KFOaQNr.exe
  2⤵
  PID:6092
- C:\Windows\System\jQpNCBV.exe
  C:\Windows\System\jQpNCBV.exe
  2⤵
  PID:6148
- C:\Windows\System\JnPTYrn.exe
  C:\Windows\System\JnPTYrn.exe
  2⤵
  PID:6176
- C:\Windows\System\yHYnAhD.exe
  C:\Windows\System\yHYnAhD.exe
  2⤵
  PID:6196
- C:\Windows\System\ndhmKwF.exe
  C:\Windows\System\ndhmKwF.exe
  2⤵
  PID:6212
- C:\Windows\System\SxgZQUa.exe
  C:\Windows\System\SxgZQUa.exe
  2⤵
  PID:6228
- C:\Windows\System\fYIZHOS.exe
  C:\Windows\System\fYIZHOS.exe
  2⤵
  PID:6252
- C:\Windows\System\VCMreSl.exe
  C:\Windows\System\VCMreSl.exe
  2⤵
  PID:6268
- C:\Windows\System\noiKhZp.exe
  C:\Windows\System\noiKhZp.exe
  2⤵
  PID:6284
- C:\Windows\System\yNWuMxP.exe
  C:\Windows\System\yNWuMxP.exe
  2⤵
  PID:6304
- C:\Windows\System\VfWEYxe.exe
  C:\Windows\System\VfWEYxe.exe
  2⤵
  PID:6320
- C:\Windows\System\jmpRUsc.exe
  C:\Windows\System\jmpRUsc.exe
  2⤵
  PID:6336
- C:\Windows\System\DnHmFeM.exe
  C:\Windows\System\DnHmFeM.exe
  2⤵
  PID:6352
- C:\Windows\System\YtasqIc.exe
  C:\Windows\System\YtasqIc.exe
  2⤵
  PID:6368
- C:\Windows\System\LsnfNry.exe
  C:\Windows\System\LsnfNry.exe
  2⤵
  PID:6384
- C:\Windows\System\wkQLmpl.exe
  C:\Windows\System\wkQLmpl.exe
  2⤵
  PID:6400
- C:\Windows\System\PgsjtUF.exe
  C:\Windows\System\PgsjtUF.exe
  2⤵
  PID:6416
- C:\Windows\System\fopIbPS.exe
  C:\Windows\System\fopIbPS.exe
  2⤵
  PID:6436
- C:\Windows\System\AsiKYKK.exe
  C:\Windows\System\AsiKYKK.exe
  2⤵
  PID:6452
- C:\Windows\System\yVLckep.exe
  C:\Windows\System\yVLckep.exe
  2⤵
  PID:6468
- C:\Windows\System\yxulaNs.exe
  C:\Windows\System\yxulaNs.exe
  2⤵
  PID:6484
- C:\Windows\System\YbMsISU.exe
  C:\Windows\System\YbMsISU.exe
  2⤵
  PID:6500
- C:\Windows\System\qtscLLA.exe
  C:\Windows\System\qtscLLA.exe
  2⤵
  PID:6516
- C:\Windows\System\OajwGyF.exe
  C:\Windows\System\OajwGyF.exe
  2⤵
  PID:6532
- C:\Windows\System\ZpGlFSD.exe
  C:\Windows\System\ZpGlFSD.exe
  2⤵
  PID:6548
- C:\Windows\System\GDgPYfp.exe
  C:\Windows\System\GDgPYfp.exe
  2⤵
  PID:6568
- C:\Windows\System\atFjlYc.exe
  C:\Windows\System\atFjlYc.exe
  2⤵
  PID:6584
- C:\Windows\System\DZCdftP.exe
  C:\Windows\System\DZCdftP.exe
  2⤵
  PID:6600
- C:\Windows\System\QNrixut.exe
  C:\Windows\System\QNrixut.exe
  2⤵
  PID:6628
- C:\Windows\System\LaJkhex.exe
  C:\Windows\System\LaJkhex.exe
  2⤵
  PID:6656
- C:\Windows\System\hZbpumC.exe
  C:\Windows\System\hZbpumC.exe
  2⤵
  PID:6672
- C:\Windows\System\XJymllI.exe
  C:\Windows\System\XJymllI.exe
  2⤵
  PID:6688
- C:\Windows\System\rCncaNC.exe
  C:\Windows\System\rCncaNC.exe
  2⤵
  PID:6708
- C:\Windows\System\rVKwLvQ.exe
  C:\Windows\System\rVKwLvQ.exe
  2⤵
  PID:6724
- C:\Windows\System\TnydwHY.exe
  C:\Windows\System\TnydwHY.exe
  2⤵
  PID:6740
- C:\Windows\System\baegRtP.exe
  C:\Windows\System\baegRtP.exe
  2⤵
  PID:6756
- C:\Windows\System\CmVQBPp.exe
  C:\Windows\System\CmVQBPp.exe
  2⤵
  PID:6772
- C:\Windows\System\gsqlulP.exe
  C:\Windows\System\gsqlulP.exe
  2⤵
  PID:6788
- C:\Windows\System\XZeEbcG.exe
  C:\Windows\System\XZeEbcG.exe
  2⤵
  PID:6804
- C:\Windows\System\YntmLTu.exe
  C:\Windows\System\YntmLTu.exe
  2⤵
  PID:6824
- C:\Windows\System\kWDYKrf.exe
  C:\Windows\System\kWDYKrf.exe
  2⤵
  PID:6840
- C:\Windows\System\wWvfwiX.exe
  C:\Windows\System\wWvfwiX.exe
  2⤵
  PID:6856
- C:\Windows\System\hhFLktt.exe
  C:\Windows\System\hhFLktt.exe
  2⤵
  PID:6872
- C:\Windows\System\KrTttAM.exe
  C:\Windows\System\KrTttAM.exe
  2⤵
  PID:6892
- C:\Windows\System\izHfzXo.exe
  C:\Windows\System\izHfzXo.exe
  2⤵
  PID:6908
- C:\Windows\System\bvtgAnZ.exe
  C:\Windows\System\bvtgAnZ.exe
  2⤵
  PID:6928
- C:\Windows\System\zexdAer.exe
  C:\Windows\System\zexdAer.exe
  2⤵
  PID:6944
- C:\Windows\System\sTUWgbG.exe
  C:\Windows\System\sTUWgbG.exe
  2⤵
  PID:6960
- C:\Windows\System\qBOLqjD.exe
  C:\Windows\System\qBOLqjD.exe
  2⤵
  PID:6976
- C:\Windows\System\CruaYaD.exe
  C:\Windows\System\CruaYaD.exe
  2⤵
  PID:6992
- C:\Windows\System\PnABynR.exe
  C:\Windows\System\PnABynR.exe
  2⤵
  PID:7008
- C:\Windows\System\nkYbdRW.exe
  C:\Windows\System\nkYbdRW.exe
  2⤵
  PID:7024
- C:\Windows\System\jNgqDZT.exe
  C:\Windows\System\jNgqDZT.exe
  2⤵
  PID:7040
- C:\Windows\System\kIKwxTK.exe
  C:\Windows\System\kIKwxTK.exe
  2⤵
  PID:7056
- C:\Windows\System\lqkIdac.exe
  C:\Windows\System\lqkIdac.exe
  2⤵
  PID:7116
- C:\Windows\System\nIScVva.exe
  C:\Windows\System\nIScVva.exe
  2⤵
  PID:7132
- C:\Windows\System\gvLnovT.exe
  C:\Windows\System\gvLnovT.exe
  2⤵
  PID:5668
- C:\Windows\System\CirXWRJ.exe
  C:\Windows\System\CirXWRJ.exe
  2⤵
  PID:5684
- C:\Windows\System\SjSwaas.exe
  C:\Windows\System\SjSwaas.exe
  2⤵
  PID:6088
- C:\Windows\System\rVYkqOR.exe
  C:\Windows\System\rVYkqOR.exe
  2⤵
  PID:2820
- C:\Windows\System\qHSDTAH.exe
  C:\Windows\System\qHSDTAH.exe
  2⤵
  PID:6220
- C:\Windows\System\JktiqXF.exe
  C:\Windows\System\JktiqXF.exe
  2⤵
  PID:6296
- C:\Windows\System\UuYjIvw.exe
  C:\Windows\System\UuYjIvw.exe
  2⤵
  PID:6364
- C:\Windows\System\MmIZEpq.exe
  C:\Windows\System\MmIZEpq.exe
  2⤵
  PID:6428
- C:\Windows\System\NWVSSRN.exe
  C:\Windows\System\NWVSSRN.exe
  2⤵
  PID:6496
- C:\Windows\System\PqjRBjz.exe
  C:\Windows\System\PqjRBjz.exe
  2⤵
  PID:6432
- C:\Windows\System\RdpvCnp.exe
  C:\Windows\System\RdpvCnp.exe
  2⤵
  PID:6316
- C:\Windows\System\zgzwimT.exe
  C:\Windows\System\zgzwimT.exe
  2⤵
  PID:5760
- C:\Windows\System\UjIKHQX.exe
  C:\Windows\System\UjIKHQX.exe
  2⤵
  PID:1740
- C:\Windows\System\LbNzjwJ.exe
  C:\Windows\System\LbNzjwJ.exe
  2⤵
  PID:6160
- C:\Windows\System\ObQAhbI.exe
  C:\Windows\System\ObQAhbI.exe
  2⤵
  PID:6164
- C:\Windows\System\nBAXrgH.exe
  C:\Windows\System\nBAXrgH.exe
  2⤵
  PID:6248
- C:\Windows\System\JdLyrEA.exe
  C:\Windows\System\JdLyrEA.exe
  2⤵
  PID:6348
- C:\Windows\System\sgUrZXk.exe
  C:\Windows\System\sgUrZXk.exe
  2⤵
  PID:6412
- C:\Windows\System\SIlEfTa.exe
  C:\Windows\System\SIlEfTa.exe
  2⤵
  PID:6480
- C:\Windows\System\rtgJJCO.exe
  C:\Windows\System\rtgJJCO.exe
  2⤵
  PID:6540
- C:\Windows\System\iywFoBT.exe
  C:\Windows\System\iywFoBT.exe
  2⤵
  PID:6580
- C:\Windows\System\ZSOTdcM.exe
  C:\Windows\System\ZSOTdcM.exe
  2⤵
  PID:6732
- C:\Windows\System\uGZQjnI.exe
  C:\Windows\System\uGZQjnI.exe
  2⤵
  PID:6668
- C:\Windows\System\CuqLUwz.exe
  C:\Windows\System\CuqLUwz.exe
  2⤵
  PID:6616
- C:\Windows\System\YvBPPYK.exe
  C:\Windows\System\YvBPPYK.exe
  2⤵
  PID:6780
- C:\Windows\System\PzjYbNS.exe
  C:\Windows\System\PzjYbNS.exe
  2⤵
  PID:6848
- C:\Windows\System\WqBoYYN.exe
  C:\Windows\System\WqBoYYN.exe
  2⤵
  PID:6920
- C:\Windows\System\anZZJqk.exe
  C:\Windows\System\anZZJqk.exe
  2⤵
  PID:6984
- C:\Windows\System\tqOCBqv.exe
  C:\Windows\System\tqOCBqv.exe
  2⤵
  PID:6752
- C:\Windows\System\LazMSZs.exe
  C:\Windows\System\LazMSZs.exe
  2⤵
  PID:6644
- C:\Windows\System\cUWkAOo.exe
  C:\Windows\System\cUWkAOo.exe
  2⤵
  PID:6716
- C:\Windows\System\qhmFHFV.exe
  C:\Windows\System\qhmFHFV.exe
  2⤵
  PID:6916
- C:\Windows\System\QtRUZTw.exe
  C:\Windows\System\QtRUZTw.exe
  2⤵
  PID:2228
- C:\Windows\System\BRLErdU.exe
  C:\Windows\System\BRLErdU.exe
  2⤵
  PID:6868
- C:\Windows\System\taZlPJf.exe
  C:\Windows\System\taZlPJf.exe
  2⤵
  PID:5552
- C:\Windows\System\JbSXBlS.exe
  C:\Windows\System\JbSXBlS.exe
  2⤵
  PID:6836
- C:\Windows\System\oVQJZZs.exe
  C:\Windows\System\oVQJZZs.exe
  2⤵
  PID:7004
- C:\Windows\System\YqQOMCd.exe
  C:\Windows\System\YqQOMCd.exe
  2⤵
  PID:7076
- C:\Windows\System\AURRUJc.exe
  C:\Windows\System\AURRUJc.exe
  2⤵
  PID:7084
- C:\Windows\System\Xpabdko.exe
  C:\Windows\System\Xpabdko.exe
  2⤵
  PID:7096
- C:\Windows\System\KYxhHnc.exe
  C:\Windows\System\KYxhHnc.exe
  2⤵
  PID:7068
- C:\Windows\System\jfOhPSu.exe
  C:\Windows\System\jfOhPSu.exe
  2⤵
  PID:7148
- C:\Windows\System\AvUStxe.exe
  C:\Windows\System\AvUStxe.exe
  2⤵
  PID:6072
- C:\Windows\System\TbTpGqm.exe
  C:\Windows\System\TbTpGqm.exe
  2⤵
  PID:5520
- C:\Windows\System\VXULFXA.exe
  C:\Windows\System\VXULFXA.exe
  2⤵
  PID:5472
- C:\Windows\System\fdkylCo.exe
  C:\Windows\System\fdkylCo.exe
  2⤵
  PID:5536
- C:\Windows\System\KIIIZTH.exe
  C:\Windows\System\KIIIZTH.exe
  2⤵
  PID:6260
- C:\Windows\System\mbvCoLn.exe
  C:\Windows\System\mbvCoLn.exe
  2⤵
  PID:6328
- C:\Windows\System\EZhsEJE.exe
  C:\Windows\System\EZhsEJE.exe
  2⤵
  PID:5724
- C:\Windows\System\YzFKEHR.exe
  C:\Windows\System\YzFKEHR.exe
  2⤵
  PID:2304
- C:\Windows\System\MORLQfQ.exe
  C:\Windows\System\MORLQfQ.exe
  2⤵
  PID:6380
- C:\Windows\System\HrRorgG.exe
  C:\Windows\System\HrRorgG.exe
  2⤵
  PID:5932
- C:\Windows\System\IWaESoS.exe
  C:\Windows\System\IWaESoS.exe
  2⤵
  PID:6312
- C:\Windows\System\FfltlNF.exe
  C:\Windows\System\FfltlNF.exe
  2⤵
  PID:6564
- C:\Windows\System\YPkhahX.exe
  C:\Windows\System\YPkhahX.exe
  2⤵
  PID:6492
- C:\Windows\System\oHfdsCW.exe
  C:\Windows\System\oHfdsCW.exe
  2⤵
  PID:6168
- C:\Windows\System\ppmlfts.exe
  C:\Windows\System\ppmlfts.exe
  2⤵
  PID:6620
- C:\Windows\System\yKFmYgG.exe
  C:\Windows\System\yKFmYgG.exe
  2⤵
  PID:6956
- C:\Windows\System\WaftRsU.exe
  C:\Windows\System\WaftRsU.exe
  2⤵
  PID:6696
- C:\Windows\System\OBCgRBn.exe
  C:\Windows\System\OBCgRBn.exe
  2⤵
  PID:6888
- C:\Windows\System\MgASBCU.exe
  C:\Windows\System\MgASBCU.exe
  2⤵
  PID:6884
- C:\Windows\System\GCyRDHd.exe
  C:\Windows\System\GCyRDHd.exe
  2⤵
  PID:7048
- C:\Windows\System\vZEFPGI.exe
  C:\Windows\System\vZEFPGI.exe
  2⤵
  PID:7000
- C:\Windows\System\nMniWsi.exe
  C:\Windows\System\nMniWsi.exe
  2⤵
  PID:7036
- C:\Windows\System\uYnOESK.exe
  C:\Windows\System\uYnOESK.exe
  2⤵
  PID:7104
- C:\Windows\System\sCtbMfZ.exe
  C:\Windows\System\sCtbMfZ.exe
  2⤵
  PID:7092
- C:\Windows\System\IIMqAMF.exe
  C:\Windows\System\IIMqAMF.exe
  2⤵
  PID:324
- C:\Windows\System\qRvsehY.exe
  C:\Windows\System\qRvsehY.exe
  2⤵
  PID:6292
- C:\Windows\System\qDabchN.exe
  C:\Windows\System\qDabchN.exe
  2⤵
  PID:6240
- C:\Windows\System\aWfjrhI.exe
  C:\Windows\System\aWfjrhI.exe
  2⤵
  PID:6184
- C:\Windows\System\tnmuGGX.exe
  C:\Windows\System\tnmuGGX.exe
  2⤵
  PID:6332
- C:\Windows\System\CcwFjYD.exe
  C:\Windows\System\CcwFjYD.exe
  2⤵
  PID:5132
- C:\Windows\System\QemeYyT.exe
  C:\Windows\System\QemeYyT.exe
  2⤵
  PID:5860
- C:\Windows\System\OstfNTt.exe
  C:\Windows\System\OstfNTt.exe
  2⤵
  PID:5248
- C:\Windows\System\AbyHksD.exe
  C:\Windows\System\AbyHksD.exe
  2⤵
  PID:6952
- C:\Windows\System\WQKaCEw.exe
  C:\Windows\System\WQKaCEw.exe
  2⤵
  PID:6624
- C:\Windows\System\KqrZefP.exe
  C:\Windows\System\KqrZefP.exe
  2⤵
  PID:6652
- C:\Windows\System\JwEoRec.exe
  C:\Windows\System\JwEoRec.exe
  2⤵
  PID:6904
- C:\Windows\System\IPJRkQQ.exe
  C:\Windows\System\IPJRkQQ.exe
  2⤵
  PID:7072
- C:\Windows\System\AOSEaAz.exe
  C:\Windows\System\AOSEaAz.exe
  2⤵
  PID:6424
- C:\Windows\System\fQfGxfD.exe
  C:\Windows\System\fQfGxfD.exe
  2⤵
  PID:6236
- C:\Windows\System\dQOaYsz.exe
  C:\Windows\System\dQOaYsz.exe
  2⤵
  PID:6192
- C:\Windows\System\gIanWyn.exe
  C:\Windows\System\gIanWyn.exe
  2⤵
  PID:6736
- C:\Windows\System\RetOlFY.exe
  C:\Windows\System\RetOlFY.exe
  2⤵
  PID:6408
- C:\Windows\System\JlyLsco.exe
  C:\Windows\System\JlyLsco.exe
  2⤵
  PID:6032
- C:\Windows\System\DoeuAEJ.exe
  C:\Windows\System\DoeuAEJ.exe
  2⤵
  PID:7176
- C:\Windows\System\VeQEkGE.exe
  C:\Windows\System\VeQEkGE.exe
  2⤵
  PID:7192
- C:\Windows\System\QcmNweA.exe
  C:\Windows\System\QcmNweA.exe
  2⤵
  PID:7208
- C:\Windows\System\zBBvxqc.exe
  C:\Windows\System\zBBvxqc.exe
  2⤵
  PID:7224
- C:\Windows\System\TXJlQFc.exe
  C:\Windows\System\TXJlQFc.exe
  2⤵
  PID:7240
- C:\Windows\System\lbPukfJ.exe
  C:\Windows\System\lbPukfJ.exe
  2⤵
  PID:7264
- C:\Windows\System\PEtCgTL.exe
  C:\Windows\System\PEtCgTL.exe
  2⤵
  PID:7280
- C:\Windows\System\gEOlSVx.exe
  C:\Windows\System\gEOlSVx.exe
  2⤵
  PID:7296
- C:\Windows\System\ksUpvyx.exe
  C:\Windows\System\ksUpvyx.exe
  2⤵
  PID:7312
- C:\Windows\System\xXyaXdr.exe
  C:\Windows\System\xXyaXdr.exe
  2⤵
  PID:7328
- C:\Windows\System\fRJkhwA.exe
  C:\Windows\System\fRJkhwA.exe
  2⤵
  PID:7348
- C:\Windows\System\xJKvCmF.exe
  C:\Windows\System\xJKvCmF.exe
  2⤵
  PID:7364
- C:\Windows\System\xbWcUPB.exe
  C:\Windows\System\xbWcUPB.exe
  2⤵
  PID:7384
- C:\Windows\System\qXUcdLu.exe
  C:\Windows\System\qXUcdLu.exe
  2⤵
  PID:7400
- C:\Windows\System\wlTmEqS.exe
  C:\Windows\System\wlTmEqS.exe
  2⤵
  PID:7416
- C:\Windows\System\keqfXIC.exe
  C:\Windows\System\keqfXIC.exe
  2⤵
  PID:7432
- C:\Windows\System\mNelmmk.exe
  C:\Windows\System\mNelmmk.exe
  2⤵
  PID:7464
- C:\Windows\System\eoXXpWA.exe
  C:\Windows\System\eoXXpWA.exe
  2⤵
  PID:7480
- C:\Windows\System\fhCyLHO.exe
  C:\Windows\System\fhCyLHO.exe
  2⤵
  PID:7500
- C:\Windows\System\viGTvbu.exe
  C:\Windows\System\viGTvbu.exe
  2⤵
  PID:7516
- C:\Windows\System\OqDYjcf.exe
  C:\Windows\System\OqDYjcf.exe
  2⤵
  PID:7532
- C:\Windows\System\DCdMFQV.exe
  C:\Windows\System\DCdMFQV.exe
  2⤵
  PID:7548
- C:\Windows\System\pTvLrVa.exe
  C:\Windows\System\pTvLrVa.exe
  2⤵
  PID:7564
- C:\Windows\System\hJgYOKt.exe
  C:\Windows\System\hJgYOKt.exe
  2⤵
  PID:7580
- C:\Windows\System\tOlQPcR.exe
  C:\Windows\System\tOlQPcR.exe
  2⤵
  PID:7600
- C:\Windows\System\IpMGmxn.exe
  C:\Windows\System\IpMGmxn.exe
  2⤵
  PID:7616
- C:\Windows\System\LUfEUVy.exe
  C:\Windows\System\LUfEUVy.exe
  2⤵
  PID:7632
- C:\Windows\System\KwTAhNh.exe
  C:\Windows\System\KwTAhNh.exe
  2⤵
  PID:7648
- C:\Windows\System\rizQVEu.exe
  C:\Windows\System\rizQVEu.exe
  2⤵
  PID:7668
- C:\Windows\System\mxAemfH.exe
  C:\Windows\System\mxAemfH.exe
  2⤵
  PID:7684
- C:\Windows\System\WyCLWZt.exe
  C:\Windows\System\WyCLWZt.exe
  2⤵
  PID:7700
- C:\Windows\System\rPTrgFD.exe
  C:\Windows\System\rPTrgFD.exe
  2⤵
  PID:7720
- C:\Windows\System\YNEhpka.exe
  C:\Windows\System\YNEhpka.exe
  2⤵
  PID:7736
- C:\Windows\System\MZfXFsg.exe
  C:\Windows\System\MZfXFsg.exe
  2⤵
  PID:7752
- C:\Windows\System\wkzjfPU.exe
  C:\Windows\System\wkzjfPU.exe
  2⤵
  PID:7768
- C:\Windows\System\pNubSdx.exe
  C:\Windows\System\pNubSdx.exe
  2⤵
  PID:7796
- C:\Windows\System\uLuVPCX.exe
  C:\Windows\System\uLuVPCX.exe
  2⤵
  PID:7812
- C:\Windows\System\iJAxfKE.exe
  C:\Windows\System\iJAxfKE.exe
  2⤵
  PID:7828
- C:\Windows\System\iKsdJjc.exe
  C:\Windows\System\iKsdJjc.exe
  2⤵
  PID:7844
- C:\Windows\System\xwQEdZP.exe
  C:\Windows\System\xwQEdZP.exe
  2⤵
  PID:7860
- C:\Windows\System\efdFAUB.exe
  C:\Windows\System\efdFAUB.exe
  2⤵
  PID:7876
- C:\Windows\System\wxOJXmq.exe
  C:\Windows\System\wxOJXmq.exe
  2⤵
  PID:7892
- C:\Windows\System\HUkqJMs.exe
  C:\Windows\System\HUkqJMs.exe
  2⤵
  PID:7908
- C:\Windows\System\qLqRBhZ.exe
  C:\Windows\System\qLqRBhZ.exe
  2⤵
  PID:7928
- C:\Windows\System\dbdaPJr.exe
  C:\Windows\System\dbdaPJr.exe
  2⤵
  PID:7944
- C:\Windows\System\Mostyfu.exe
  C:\Windows\System\Mostyfu.exe
  2⤵
  PID:7960
- C:\Windows\System\HwERXIk.exe
  C:\Windows\System\HwERXIk.exe
  2⤵
  PID:7976
- C:\Windows\System\NpWFaxj.exe
  C:\Windows\System\NpWFaxj.exe
  2⤵
  PID:7992
- C:\Windows\System\hOVMjVF.exe
  C:\Windows\System\hOVMjVF.exe
  2⤵
  PID:8008
- C:\Windows\System\BCgrJfp.exe
  C:\Windows\System\BCgrJfp.exe
  2⤵
  PID:8028
- C:\Windows\System\oMNHAqa.exe
  C:\Windows\System\oMNHAqa.exe
  2⤵
  PID:8044
- C:\Windows\System\edGqKVG.exe
  C:\Windows\System\edGqKVG.exe
  2⤵
  PID:8060
- C:\Windows\System\VoYjrzd.exe
  C:\Windows\System\VoYjrzd.exe
  2⤵
  PID:8080
- C:\Windows\System\fvOvuSv.exe
  C:\Windows\System\fvOvuSv.exe
  2⤵
  PID:8096
- C:\Windows\System\efConqy.exe
  C:\Windows\System\efConqy.exe
  2⤵
  PID:8112
- C:\Windows\System\TjfZGOO.exe
  C:\Windows\System\TjfZGOO.exe
  2⤵
  PID:8128
- C:\Windows\System\OIrFHsv.exe
  C:\Windows\System\OIrFHsv.exe
  2⤵
  PID:8144
- C:\Windows\System\uNnDKnH.exe
  C:\Windows\System\uNnDKnH.exe
  2⤵
  PID:8160
- C:\Windows\System\ZLvruoC.exe
  C:\Windows\System\ZLvruoC.exe
  2⤵
  PID:8176
- C:\Windows\System\wmhKhwv.exe
  C:\Windows\System\wmhKhwv.exe
  2⤵
  PID:6608
- C:\Windows\System\KZgCsEN.exe
  C:\Windows\System\KZgCsEN.exe
  2⤵
  PID:7200
- C:\Windows\System\xneLUqE.exe
  C:\Windows\System\xneLUqE.exe
  2⤵
  PID:1364
- C:\Windows\System\drVqxkj.exe
  C:\Windows\System\drVqxkj.exe
  2⤵
  PID:7064
- C:\Windows\System\bCwzWyE.exe
  C:\Windows\System\bCwzWyE.exe
  2⤵
  PID:7220
- C:\Windows\System\vgwUyGK.exe
  C:\Windows\System\vgwUyGK.exe
  2⤵
  PID:6684
- C:\Windows\System\nrIZNIL.exe
  C:\Windows\System\nrIZNIL.exe
  2⤵
  PID:7252
- C:\Windows\System\yXSOZTD.exe
  C:\Windows\System\yXSOZTD.exe
  2⤵
  PID:7304
- C:\Windows\System\ICoLTMa.exe
  C:\Windows\System\ICoLTMa.exe
  2⤵
  PID:7372
- C:\Windows\System\bNMdDQA.exe
  C:\Windows\System\bNMdDQA.exe
  2⤵
  PID:7440
- C:\Windows\System\esjUgYN.exe
  C:\Windows\System\esjUgYN.exe
  2⤵
  PID:7292
- C:\Windows\System\SAfjUpD.exe
  C:\Windows\System\SAfjUpD.exe
  2⤵
  PID:7360
- C:\Windows\System\LeDKFMC.exe
  C:\Windows\System\LeDKFMC.exe
  2⤵
  PID:7428
- C:\Windows\System\jUkNYrL.exe
  C:\Windows\System\jUkNYrL.exe
  2⤵
  PID:7444
- C:\Windows\System\uQRGQCZ.exe
  C:\Windows\System\uQRGQCZ.exe
  2⤵
  PID:7528
- C:\Windows\System\qRpNUZN.exe
  C:\Windows\System\qRpNUZN.exe
  2⤵
  PID:7592
- C:\Windows\System\QNeCNKX.exe
  C:\Windows\System\QNeCNKX.exe
  2⤵
  PID:7656
- C:\Windows\System\sHmpGUA.exe
  C:\Windows\System\sHmpGUA.exe
  2⤵
  PID:7696
- C:\Windows\System\VjGqnWG.exe
  C:\Windows\System\VjGqnWG.exe
  2⤵
  PID:7472
- C:\Windows\System\amIZqIO.exe
  C:\Windows\System\amIZqIO.exe
  2⤵
  PID:7540
- C:\Windows\System\fUtWylP.exe
  C:\Windows\System\fUtWylP.exe
  2⤵
  PID:7608
- C:\Windows\System\VzfIEYR.exe
  C:\Windows\System\VzfIEYR.exe
  2⤵
  PID:7680
- C:\Windows\System\plhWnLb.exe
  C:\Windows\System\plhWnLb.exe
  2⤵
  PID:7748
- C:\Windows\System\mDbfTlj.exe
  C:\Windows\System\mDbfTlj.exe
  2⤵
  PID:7784
- C:\Windows\System\RbJxGgS.exe
  C:\Windows\System\RbJxGgS.exe
  2⤵
  PID:7808
- C:\Windows\System\orUVilq.exe
  C:\Windows\System\orUVilq.exe
  2⤵
  PID:7900
- C:\Windows\System\EkkawxQ.exe
  C:\Windows\System\EkkawxQ.exe
  2⤵
  PID:7968
- C:\Windows\System\wdddfsG.exe
  C:\Windows\System\wdddfsG.exe
  2⤵
  PID:7856
- C:\Windows\System\LAAnGXa.exe
  C:\Windows\System\LAAnGXa.exe
  2⤵
  PID:7788
- C:\Windows\System\IxVRRyb.exe
  C:\Windows\System\IxVRRyb.exe
  2⤵
  PID:8004
- C:\Windows\System\KrbhsSx.exe
  C:\Windows\System\KrbhsSx.exe
  2⤵
  PID:8036
- C:\Windows\System\wqrlhrI.exe
  C:\Windows\System\wqrlhrI.exe
  2⤵
  PID:8072
- C:\Windows\System\peqAGbP.exe
  C:\Windows\System\peqAGbP.exe
  2⤵
  PID:8104
- C:\Windows\System\eyaAAUd.exe
  C:\Windows\System\eyaAAUd.exe
  2⤵
  PID:7984
- C:\Windows\System\hIlONHT.exe
  C:\Windows\System\hIlONHT.exe
  2⤵
  PID:8016
- C:\Windows\System\vNhBczc.exe
  C:\Windows\System\vNhBczc.exe
  2⤵
  PID:7172
- C:\Windows\System\RIzgWoS.exe
  C:\Windows\System\RIzgWoS.exe
  2⤵
  PID:8124
- C:\Windows\System\BTdaVwk.exe
  C:\Windows\System\BTdaVwk.exe
  2⤵
  PID:1320
- C:\Windows\System\hwfohGx.exe
  C:\Windows\System\hwfohGx.exe
  2⤵
  PID:7204
- C:\Windows\System\rGjaLgU.exe
  C:\Windows\System\rGjaLgU.exe
  2⤵
  PID:7272
- C:\Windows\System\qLThyeo.exe
  C:\Windows\System\qLThyeo.exe
  2⤵
  PID:5392
- C:\Windows\System\WVnqLfz.exe
  C:\Windows\System\WVnqLfz.exe
  2⤵
  PID:7340
- C:\Windows\System\QLMdkpN.exe
  C:\Windows\System\QLMdkpN.exe
  2⤵
  PID:7380
- C:\Windows\System\PFnqAWy.exe
  C:\Windows\System\PFnqAWy.exe
  2⤵
  PID:7456
- C:\Windows\System\GeVjrgF.exe
  C:\Windows\System\GeVjrgF.exe
  2⤵
  PID:7664
- C:\Windows\System\XjKqpOJ.exe
  C:\Windows\System\XjKqpOJ.exe
  2⤵
  PID:7496
- C:\Windows\System\lGoyNxr.exe
  C:\Windows\System\lGoyNxr.exe
  2⤵
  PID:7676
- C:\Windows\System\PNvoSfQ.exe
  C:\Windows\System\PNvoSfQ.exe
  2⤵
  PID:7732
- C:\Windows\System\EOLxopR.exe
  C:\Windows\System\EOLxopR.exe
  2⤵
  PID:7492
- C:\Windows\System\SNletFI.exe
  C:\Windows\System\SNletFI.exe
  2⤵
  PID:7576
- C:\Windows\System\hkvYrjc.exe
  C:\Windows\System\hkvYrjc.exe
  2⤵
  PID:7868
- C:\Windows\System\BOoifJM.exe
  C:\Windows\System\BOoifJM.exe
  2⤵
  PID:8068
- C:\Windows\System\EcHCmIu.exe
  C:\Windows\System\EcHCmIu.exe
  2⤵
  PID:5756
- C:\Windows\System\FKFVDBh.exe
  C:\Windows\System\FKFVDBh.exe
  2⤵
  PID:8184
- C:\Windows\System\JdvpGnF.exe
  C:\Windows\System\JdvpGnF.exe
  2⤵
  PID:7356
- C:\Windows\System\usmzWjN.exe
  C:\Windows\System\usmzWjN.exe
  2⤵
  PID:7460
- C:\Windows\System\VjsCfcG.exe
  C:\Windows\System\VjsCfcG.exe
  2⤵
  PID:7644
- C:\Windows\System\YhDOelP.exe
  C:\Windows\System\YhDOelP.exe
  2⤵
  PID:7924
- C:\Windows\System\YjVXgpK.exe
  C:\Windows\System\YjVXgpK.exe
  2⤵
  PID:7716
- C:\Windows\System\ZBSejuY.exe
  C:\Windows\System\ZBSejuY.exe
  2⤵
  PID:7216
- C:\Windows\System\vlLDcjw.exe
  C:\Windows\System\vlLDcjw.exe
  2⤵
  PID:8156
- C:\Windows\System\jTQzhnD.exe
  C:\Windows\System\jTQzhnD.exe
  2⤵
  PID:7764
- C:\Windows\System\kjlItGR.exe
  C:\Windows\System\kjlItGR.exe
  2⤵
  PID:7804
- C:\Windows\System\mSmJMDD.exe
  C:\Windows\System\mSmJMDD.exe
  2⤵
  PID:8188
- C:\Windows\System\akOqWmf.exe
  C:\Windows\System\akOqWmf.exe
  2⤵
  PID:7236
- C:\Windows\System\fUnRpru.exe
  C:\Windows\System\fUnRpru.exe
  2⤵
  PID:7508
- C:\Windows\System\GBwTrrq.exe
  C:\Windows\System\GBwTrrq.exe
  2⤵
  PID:7276
- C:\Windows\System\zjbzZVj.exe
  C:\Windows\System\zjbzZVj.exe
  2⤵
  PID:6764
- C:\Windows\System\QtwJhfm.exe
  C:\Windows\System\QtwJhfm.exe
  2⤵
  PID:7780
- C:\Windows\System\hPAvoRE.exe
  C:\Windows\System\hPAvoRE.exe
  2⤵
  PID:7936
- C:\Windows\System\lVUQhZl.exe
  C:\Windows\System\lVUQhZl.exe
  2⤵
  PID:7628
- C:\Windows\System\HYyQczR.exe
  C:\Windows\System\HYyQczR.exe
  2⤵
  PID:8204
- C:\Windows\System\ruZTYAg.exe
  C:\Windows\System\ruZTYAg.exe
  2⤵
  PID:8224
- C:\Windows\System\mLYfoHT.exe
  C:\Windows\System\mLYfoHT.exe
  2⤵
  PID:8240
- C:\Windows\System\NPaCzJC.exe
  C:\Windows\System\NPaCzJC.exe
  2⤵
  PID:8256
- C:\Windows\System\uLccPYz.exe
  C:\Windows\System\uLccPYz.exe
  2⤵
  PID:8272
- C:\Windows\System\yGgFCTx.exe
  C:\Windows\System\yGgFCTx.exe
  2⤵
  PID:8288
- C:\Windows\System\XcXudmR.exe
  C:\Windows\System\XcXudmR.exe
  2⤵
  PID:8304
- C:\Windows\System\rVCMOiJ.exe
  C:\Windows\System\rVCMOiJ.exe
  2⤵
  PID:8320
- C:\Windows\System\WYJEdid.exe
  C:\Windows\System\WYJEdid.exe
  2⤵
  PID:8336
- C:\Windows\System\lPZhdbN.exe
  C:\Windows\System\lPZhdbN.exe
  2⤵
  PID:8352
- C:\Windows\System\ubGkDED.exe
  C:\Windows\System\ubGkDED.exe
  2⤵
  PID:8368
- C:\Windows\System\JKWhwXC.exe
  C:\Windows\System\JKWhwXC.exe
  2⤵
  PID:8384
- C:\Windows\System\kJLAgLn.exe
  C:\Windows\System\kJLAgLn.exe
  2⤵
  PID:8404
- C:\Windows\System\psUYTyy.exe
  C:\Windows\System\psUYTyy.exe
  2⤵
  PID:8420
- C:\Windows\System\CQOiCEK.exe
  C:\Windows\System\CQOiCEK.exe
  2⤵
  PID:8436
- C:\Windows\System\KjMonXI.exe
  C:\Windows\System\KjMonXI.exe
  2⤵
  PID:8452
- C:\Windows\System\iCdGEqX.exe
  C:\Windows\System\iCdGEqX.exe
  2⤵
  PID:8468
- C:\Windows\System\trLbZyq.exe
  C:\Windows\System\trLbZyq.exe
  2⤵
  PID:8484
- C:\Windows\System\DQZZSZQ.exe
  C:\Windows\System\DQZZSZQ.exe
  2⤵
  PID:8500
- C:\Windows\System\OJqQMjp.exe
  C:\Windows\System\OJqQMjp.exe
  2⤵
  PID:8516
- C:\Windows\System\xHacPRC.exe
  C:\Windows\System\xHacPRC.exe
  2⤵
  PID:8532
- C:\Windows\System\KokJmwQ.exe
  C:\Windows\System\KokJmwQ.exe
  2⤵
  PID:8548
- C:\Windows\System\YYDnLyR.exe
  C:\Windows\System\YYDnLyR.exe
  2⤵
  PID:8568
- C:\Windows\System\wGkDwOe.exe
  C:\Windows\System\wGkDwOe.exe
  2⤵
  PID:8584
- C:\Windows\System\YiLvLjd.exe
  C:\Windows\System\YiLvLjd.exe
  2⤵
  PID:8600
- C:\Windows\System\uHZlGtS.exe
  C:\Windows\System\uHZlGtS.exe
  2⤵
  PID:8620
- C:\Windows\System\dTFCETn.exe
  C:\Windows\System\dTFCETn.exe
  2⤵
  PID:8636
- C:\Windows\System\pqdendz.exe
  C:\Windows\System\pqdendz.exe
  2⤵
  PID:8652
- C:\Windows\System\VGDQqPQ.exe
  C:\Windows\System\VGDQqPQ.exe
  2⤵
  PID:8668
- C:\Windows\System\qHNDrjM.exe
  C:\Windows\System\qHNDrjM.exe
  2⤵
  PID:8688
- C:\Windows\System\TMNrppe.exe
  C:\Windows\System\TMNrppe.exe
  2⤵
  PID:8704
- C:\Windows\System\AMnqgmQ.exe
  C:\Windows\System\AMnqgmQ.exe
  2⤵
  PID:8720
- C:\Windows\System\GJIgskU.exe
  C:\Windows\System\GJIgskU.exe
  2⤵
  PID:8736
- C:\Windows\System\WtsbNJP.exe
  C:\Windows\System\WtsbNJP.exe
  2⤵
  PID:8752
- C:\Windows\System\FExtUvl.exe
  C:\Windows\System\FExtUvl.exe
  2⤵
  PID:8768
- C:\Windows\System\cAntpFi.exe
  C:\Windows\System\cAntpFi.exe
  2⤵
  PID:8784
- C:\Windows\System\vguvDaN.exe
  C:\Windows\System\vguvDaN.exe
  2⤵
  PID:8800
- C:\Windows\System\akHeaxC.exe
  C:\Windows\System\akHeaxC.exe
  2⤵
  PID:8816
- C:\Windows\System\iTmixCF.exe
  C:\Windows\System\iTmixCF.exe
  2⤵
  PID:8832
- C:\Windows\System\NtHBkXr.exe
  C:\Windows\System\NtHBkXr.exe
  2⤵
  PID:8848
- C:\Windows\System\uAloEuY.exe
  C:\Windows\System\uAloEuY.exe
  2⤵
  PID:8864
- C:\Windows\System\XsfIQDy.exe
  C:\Windows\System\XsfIQDy.exe
  2⤵
  PID:8880
- C:\Windows\System\iBZcQVw.exe
  C:\Windows\System\iBZcQVw.exe
  2⤵
  PID:8896
- C:\Windows\System\oSkLYIH.exe
  C:\Windows\System\oSkLYIH.exe
  2⤵
  PID:8912
- C:\Windows\System\VDavWOO.exe
  C:\Windows\System\VDavWOO.exe
  2⤵
  PID:8928
- C:\Windows\System\TgZUknJ.exe
  C:\Windows\System\TgZUknJ.exe
  2⤵
  PID:8944
- C:\Windows\System\rszlSHT.exe
  C:\Windows\System\rszlSHT.exe
  2⤵
  PID:8960
- C:\Windows\System\FWmWZDM.exe
  C:\Windows\System\FWmWZDM.exe
  2⤵
  PID:8976
- C:\Windows\System\XdIpesh.exe
  C:\Windows\System\XdIpesh.exe
  2⤵
  PID:8992
- C:\Windows\System\WZFeIYK.exe
  C:\Windows\System\WZFeIYK.exe
  2⤵
  PID:9008
- C:\Windows\System\yXribHU.exe
  C:\Windows\System\yXribHU.exe
  2⤵
  PID:9024
- C:\Windows\System\DCqblaz.exe
  C:\Windows\System\DCqblaz.exe
  2⤵
  PID:9040
- C:\Windows\System\MngdvEb.exe
  C:\Windows\System\MngdvEb.exe
  2⤵
  PID:9056
- C:\Windows\System\HQcAMPY.exe
  C:\Windows\System\HQcAMPY.exe
  2⤵
  PID:9072
- C:\Windows\System\DVzpesU.exe
  C:\Windows\System\DVzpesU.exe
  2⤵
  PID:9088
- C:\Windows\System\dzYPlIB.exe
  C:\Windows\System\dzYPlIB.exe
  2⤵
  PID:9112
- C:\Windows\System\umAhbmz.exe
  C:\Windows\System\umAhbmz.exe
  2⤵
  PID:9128
- C:\Windows\System\NAGveMs.exe
  C:\Windows\System\NAGveMs.exe
  2⤵
  PID:9144
- C:\Windows\System\vjzSpml.exe
  C:\Windows\System\vjzSpml.exe
  2⤵
  PID:9160
- C:\Windows\System\unCvkJd.exe
  C:\Windows\System\unCvkJd.exe
  2⤵
  PID:9176
- C:\Windows\System\qaooxbj.exe
  C:\Windows\System\qaooxbj.exe
  2⤵
  PID:9192
- C:\Windows\System\WIbVaPs.exe
  C:\Windows\System\WIbVaPs.exe
  2⤵
  PID:9208
- C:\Windows\System\kCPytVP.exe
  C:\Windows\System\kCPytVP.exe
  2⤵
  PID:7588
- C:\Windows\System\GbgGixN.exe
  C:\Windows\System\GbgGixN.exe
  2⤵
  PID:7916
- C:\Windows\System\YqwhgqF.exe
  C:\Windows\System\YqwhgqF.exe
  2⤵
  PID:7016
- C:\Windows\System\nRlvVRo.exe
  C:\Windows\System\nRlvVRo.exe
  2⤵
  PID:8300
- C:\Windows\System\ZycPScJ.exe
  C:\Windows\System\ZycPScJ.exe
  2⤵
  PID:8252
- C:\Windows\System\FaAoWcM.exe
  C:\Windows\System\FaAoWcM.exe
  2⤵
  PID:8312
- C:\Windows\System\gFoBitA.exe
  C:\Windows\System\gFoBitA.exe
  2⤵
  PID:8344
- C:\Windows\System\wMSOcgr.exe
  C:\Windows\System\wMSOcgr.exe
  2⤵
  PID:8392
- C:\Windows\System\NbgHdOo.exe
  C:\Windows\System\NbgHdOo.exe
  2⤵
  PID:8212
- C:\Windows\System\zYjpqCc.exe
  C:\Windows\System\zYjpqCc.exe
  2⤵
  PID:8432
- C:\Windows\System\ZDqRwOA.exe
  C:\Windows\System\ZDqRwOA.exe
  2⤵
  PID:8496
- C:\Windows\System\rcatMtQ.exe
  C:\Windows\System\rcatMtQ.exe
  2⤵
  PID:8560
- C:\Windows\System\llHGEkT.exe
  C:\Windows\System\llHGEkT.exe
  2⤵
  PID:8596
- C:\Windows\System\DwRIIAb.exe
  C:\Windows\System\DwRIIAb.exe
  2⤵
  PID:8480
- C:\Windows\System\VUlrVvg.exe
  C:\Windows\System\VUlrVvg.exe
  2⤵
  PID:8632
- C:\Windows\System\YUsLNmI.exe
  C:\Windows\System\YUsLNmI.exe
  2⤵
  PID:8576
- C:\Windows\System\NkIWgIs.exe
  C:\Windows\System\NkIWgIs.exe
  2⤵
  PID:8764
- C:\Windows\System\UqkUleI.exe
  C:\Windows\System\UqkUleI.exe
  2⤵
  PID:8644
- C:\Windows\System\ASoTDCV.exe
  C:\Windows\System\ASoTDCV.exe
  2⤵
  PID:8684
- C:\Windows\System\jiLJMRy.exe
  C:\Windows\System\jiLJMRy.exe
  2⤵
  PID:8612
- C:\Windows\System\tfYqwwM.exe
  C:\Windows\System\tfYqwwM.exe
  2⤵
  PID:8824
- C:\Windows\System\tZiuHiR.exe
  C:\Windows\System\tZiuHiR.exe
  2⤵
  PID:8780
- C:\Windows\System\bExeDrs.exe
  C:\Windows\System\bExeDrs.exe
  2⤵
  PID:8924
- C:\Windows\System\AWOFhcK.exe
  C:\Windows\System\AWOFhcK.exe
  2⤵
  PID:8888
- C:\Windows\System\TiAJEIM.exe
  C:\Windows\System\TiAJEIM.exe
  2⤵
  PID:8956
- C:\Windows\System\BuJzVOa.exe
  C:\Windows\System\BuJzVOa.exe
  2⤵
  PID:9020
- C:\Windows\System\cqFQgPQ.exe
  C:\Windows\System\cqFQgPQ.exe
  2⤵
  PID:8872
- C:\Windows\System\IPelKQV.exe
  C:\Windows\System\IPelKQV.exe
  2⤵
  PID:8876
- C:\Windows\System\ndZaTFb.exe
  C:\Windows\System\ndZaTFb.exe
  2⤵
  PID:9004
- C:\Windows\System\nPrugwc.exe
  C:\Windows\System\nPrugwc.exe
  2⤵
  PID:9064
- C:\Windows\System\pLAjrjx.exe
  C:\Windows\System\pLAjrjx.exe
  2⤵
  PID:9096
- C:\Windows\System\vrLwwAp.exe
  C:\Windows\System\vrLwwAp.exe
  2⤵
  PID:9152
- C:\Windows\System\MAbAAkx.exe
  C:\Windows\System\MAbAAkx.exe
  2⤵
  PID:9188
- C:\Windows\System\MqAHUWa.exe
  C:\Windows\System\MqAHUWa.exe
  2⤵
  PID:8220
- C:\Windows\System\tmOcXXe.exe
  C:\Windows\System\tmOcXXe.exe
  2⤵
  PID:8328
- C:\Windows\System\CeDRAci.exe
  C:\Windows\System\CeDRAci.exe
  2⤵
  PID:8360
- C:\Windows\System\YQwenaK.exe
  C:\Windows\System\YQwenaK.exe
  2⤵
  PID:8508
- C:\Windows\System\pwchius.exe
  C:\Windows\System\pwchius.exe
  2⤵
  PID:8728
- C:\Windows\System\sWrxyzd.exe
  C:\Windows\System\sWrxyzd.exe
  2⤵
  PID:8628
- C:\Windows\System\uMOabqt.exe
  C:\Windows\System\uMOabqt.exe
  2⤵
  PID:8664
- C:\Windows\System\LKRLFaT.exe
  C:\Windows\System\LKRLFaT.exe
  2⤵
  PID:8284
- C:\Windows\System\Rsuvtgp.exe
  C:\Windows\System\Rsuvtgp.exe
  2⤵
  PID:8792
- C:\Windows\System\tQBSnTS.exe
  C:\Windows\System\tQBSnTS.exe
  2⤵
  PID:8416
- C:\Windows\System\MROHmqk.exe
  C:\Windows\System\MROHmqk.exe
  2⤵
  PID:8680
- C:\Windows\System\GRjJIcy.exe
  C:\Windows\System\GRjJIcy.exe
  2⤵
  PID:8748
- C:\Windows\System\VkpGsuq.exe
  C:\Windows\System\VkpGsuq.exe
  2⤵
  PID:8968
- C:\Windows\System\mkDUtVH.exe
  C:\Windows\System\mkDUtVH.exe
  2⤵
  PID:9068
- C:\Windows\System\xpDVPoG.exe
  C:\Windows\System\xpDVPoG.exe
  2⤵
  PID:8988
- C:\Windows\System\HSUbCWp.exe
  C:\Windows\System\HSUbCWp.exe
  2⤵
  PID:9084
- C:\Windows\System\YMWFRaR.exe
  C:\Windows\System\YMWFRaR.exe
  2⤵
  PID:8196
- C:\Windows\System\XcPdcoZ.exe
  C:\Windows\System\XcPdcoZ.exe
  2⤵
  PID:9172
- C:\Windows\System\ghpqVim.exe
  C:\Windows\System\ghpqVim.exe
  2⤵
  PID:8268
- C:\Windows\System\XHAdFIk.exe
  C:\Windows\System\XHAdFIk.exe
  2⤵
  PID:8396
- C:\Windows\System\UcuPZnA.exe
  C:\Windows\System\UcuPZnA.exe
  2⤵
  PID:8444
- C:\Windows\System\dcZPSmr.exe
  C:\Windows\System\dcZPSmr.exe
  2⤵
  PID:8592
- C:\Windows\System\bgxzlvj.exe
  C:\Windows\System\bgxzlvj.exe
  2⤵
  PID:9232
- C:\Windows\System\kHRTzaO.exe
  C:\Windows\System\kHRTzaO.exe
  2⤵
  PID:9248
- C:\Windows\System\mvbAMAw.exe
  C:\Windows\System\mvbAMAw.exe
  2⤵
  PID:9272
- C:\Windows\System\ufQmszG.exe
  C:\Windows\System\ufQmszG.exe
  2⤵
  PID:9300
- C:\Windows\System\TMcviAZ.exe
  C:\Windows\System\TMcviAZ.exe
  2⤵
  PID:9324
- C:\Windows\System\HYcheHn.exe
  C:\Windows\System\HYcheHn.exe
  2⤵
  PID:9340
- C:\Windows\System\fflLudR.exe
  C:\Windows\System\fflLudR.exe
  2⤵
  PID:9356
- C:\Windows\System\bYQNojI.exe
  C:\Windows\System\bYQNojI.exe
  2⤵
  PID:9376
- C:\Windows\System\DUIHZKf.exe
  C:\Windows\System\DUIHZKf.exe
  2⤵
  PID:9392
- C:\Windows\System\hDVlSCS.exe
  C:\Windows\System\hDVlSCS.exe
  2⤵
  PID:9408
- C:\Windows\System\IMiddNI.exe
  C:\Windows\System\IMiddNI.exe
  2⤵
  PID:9428
- C:\Windows\System\xFCUSpE.exe
  C:\Windows\System\xFCUSpE.exe
  2⤵
  PID:9444
- C:\Windows\System\cHXjlmb.exe
  C:\Windows\System\cHXjlmb.exe
  2⤵
  PID:9460
- C:\Windows\System\cLlxmZp.exe
  C:\Windows\System\cLlxmZp.exe
  2⤵
  PID:9480
- C:\Windows\System\DvJGxQK.exe
  C:\Windows\System\DvJGxQK.exe
  2⤵
  PID:9496
- C:\Windows\System\ozqeQGO.exe
  C:\Windows\System\ozqeQGO.exe
  2⤵
  PID:9512
- C:\Windows\System\CStBXEv.exe
  C:\Windows\System\CStBXEv.exe
  2⤵
  PID:9532
- C:\Windows\System\QmUwpns.exe
  C:\Windows\System\QmUwpns.exe
  2⤵
  PID:9548
- C:\Windows\System\rskUIQW.exe
  C:\Windows\System\rskUIQW.exe
  2⤵
  PID:9564
- C:\Windows\System\YrIwJVp.exe
  C:\Windows\System\YrIwJVp.exe
  2⤵
  PID:9584
- C:\Windows\System\eFeUPkM.exe
  C:\Windows\System\eFeUPkM.exe
  2⤵
  PID:9600
- C:\Windows\System\KwVukeP.exe
  C:\Windows\System\KwVukeP.exe
  2⤵
  PID:9628
- C:\Windows\System\GyfDcTs.exe
  C:\Windows\System\GyfDcTs.exe
  2⤵
  PID:9652
- C:\Windows\System\XWWuOJL.exe
  C:\Windows\System\XWWuOJL.exe
  2⤵
  PID:9668
- C:\Windows\System\qWhRChA.exe
  C:\Windows\System\qWhRChA.exe
  2⤵
  PID:9684
- C:\Windows\System\tHgRllG.exe
  C:\Windows\System\tHgRllG.exe
  2⤵
  PID:9700
- C:\Windows\System\JCBawJH.exe
  C:\Windows\System\JCBawJH.exe
  2⤵
  PID:9716
- C:\Windows\System\XnvHLVe.exe
  C:\Windows\System\XnvHLVe.exe
  2⤵
  PID:9732
- C:\Windows\System\eYuYbRj.exe
  C:\Windows\System\eYuYbRj.exe
  2⤵
  PID:9832
- C:\Windows\System\qvryzbH.exe
  C:\Windows\System\qvryzbH.exe
  2⤵
  PID:9848
- C:\Windows\System\HlFJRaz.exe
  C:\Windows\System\HlFJRaz.exe
  2⤵
  PID:9864
- C:\Windows\System\jRvsWyi.exe
  C:\Windows\System\jRvsWyi.exe
  2⤵
  PID:9888
- C:\Windows\System\NYgedbS.exe
  C:\Windows\System\NYgedbS.exe
  2⤵
  PID:9908
- C:\Windows\System\WbQroys.exe
  C:\Windows\System\WbQroys.exe
  2⤵
  PID:9928
- C:\Windows\System\FfPRMwU.exe
  C:\Windows\System\FfPRMwU.exe
  2⤵
  PID:9956
- C:\Windows\System\oEDjSaS.exe
  C:\Windows\System\oEDjSaS.exe
  2⤵
  PID:9972
- C:\Windows\System\EeZemZt.exe
  C:\Windows\System\EeZemZt.exe
  2⤵
  PID:9988
- C:\Windows\System\wkmAqWT.exe
  C:\Windows\System\wkmAqWT.exe
  2⤵
  PID:10004
- C:\Windows\System\vPIeZQS.exe
  C:\Windows\System\vPIeZQS.exe
  2⤵
  PID:10020
- C:\Windows\System\nnLrExO.exe
  C:\Windows\System\nnLrExO.exe
  2⤵
  PID:10036
- C:\Windows\System\cQSTsJg.exe
  C:\Windows\System\cQSTsJg.exe
  2⤵
  PID:10052
- C:\Windows\System\FrMpvgJ.exe
  C:\Windows\System\FrMpvgJ.exe
  2⤵
  PID:10068
- C:\Windows\System\LAyVVNe.exe
  C:\Windows\System\LAyVVNe.exe
  2⤵
  PID:10084
- C:\Windows\System\THQWsJe.exe
  C:\Windows\System\THQWsJe.exe
  2⤵
  PID:10100
- C:\Windows\System\JSFMawL.exe
  C:\Windows\System\JSFMawL.exe
  2⤵
  PID:10128
- C:\Windows\System\SxjdccS.exe
  C:\Windows\System\SxjdccS.exe
  2⤵
  PID:10144
- C:\Windows\System\ErfqOUG.exe
  C:\Windows\System\ErfqOUG.exe
  2⤵
  PID:10160
- C:\Windows\System\SjaSodx.exe
  C:\Windows\System\SjaSodx.exe
  2⤵
  PID:10188
- C:\Windows\System\qBNshWe.exe
  C:\Windows\System\qBNshWe.exe
  2⤵
  PID:10204
- C:\Windows\System\FLOEdEZ.exe
  C:\Windows\System\FLOEdEZ.exe
  2⤵
  PID:10220
- C:\Windows\System\ptOnPwC.exe
  C:\Windows\System\ptOnPwC.exe
  2⤵
  PID:10236
- C:\Windows\System\wotTVou.exe
  C:\Windows\System\wotTVou.exe
  2⤵
  PID:9228
- C:\Windows\System\ORfbxVS.exe
  C:\Windows\System\ORfbxVS.exe
  2⤵
  PID:9268
- C:\Windows\System\qjtEmSb.exe
  C:\Windows\System\qjtEmSb.exe
  2⤵
  PID:8696
- C:\Windows\System\nxzdIRS.exe
  C:\Windows\System\nxzdIRS.exe
  2⤵
  PID:8920
- C:\Windows\System\xnjhkxe.exe
  C:\Windows\System\xnjhkxe.exe
  2⤵
  PID:9000
- C:\Windows\System\qvikoFW.exe
  C:\Windows\System\qvikoFW.exe
  2⤵
  PID:8856
- C:\Windows\System\kfMIFKo.exe
  C:\Windows\System\kfMIFKo.exe
  2⤵
  PID:9120
- C:\Windows\System\TqPDvox.exe
  C:\Windows\System\TqPDvox.exe
  2⤵
  PID:8492
- C:\Windows\System\HcOEPGj.exe
  C:\Windows\System\HcOEPGj.exe
  2⤵
  PID:9288
- C:\Windows\System\ktPLdtE.exe
  C:\Windows\System\ktPLdtE.exe
  2⤵
  PID:9332
- C:\Windows\System\FbZiFIe.exe
  C:\Windows\System\FbZiFIe.exe
  2⤵
  PID:9368
- C:\Windows\System\WBgsKKy.exe
  C:\Windows\System\WBgsKKy.exe
  2⤵
  PID:9436
- C:\Windows\System\IrYihtH.exe
  C:\Windows\System\IrYihtH.exe
  2⤵
  PID:9508
- C:\Windows\System\zlwIAqU.exe
  C:\Windows\System\zlwIAqU.exe
  2⤵
  PID:9608
- C:\Windows\System\yDeZkMk.exe
  C:\Windows\System\yDeZkMk.exe
  2⤵
  PID:9624
- C:\Windows\System\DFIfDEe.exe
  C:\Windows\System\DFIfDEe.exe
  2⤵
  PID:9320
- C:\Windows\System\mxIqnHL.exe
  C:\Windows\System\mxIqnHL.exe
  2⤵
  PID:9528
- C:\Windows\System\KnNoeOs.exe
  C:\Windows\System\KnNoeOs.exe
  2⤵
  PID:9640
- C:\Windows\System\LWZvUMv.exe
  C:\Windows\System\LWZvUMv.exe
  2⤵
  PID:9728
- C:\Windows\System\hXIDbld.exe
  C:\Windows\System\hXIDbld.exe
  2⤵
  PID:9456
- C:\Windows\System\tebDXfK.exe
  C:\Windows\System\tebDXfK.exe
  2⤵
  PID:9524
- C:\Windows\System\sOZshlC.exe
  C:\Windows\System\sOZshlC.exe
  2⤵
  PID:9712
- C:\Windows\System\UQFMPgi.exe
  C:\Windows\System\UQFMPgi.exe
  2⤵
  PID:9384
- C:\Windows\System\YhUjlAq.exe
  C:\Windows\System\YhUjlAq.exe
  2⤵
  PID:9680
- C:\Windows\System\JRYdyeG.exe
  C:\Windows\System\JRYdyeG.exe
  2⤵
  PID:9752
- C:\Windows\System\EhAwaBU.exe
  C:\Windows\System\EhAwaBU.exe
  2⤵
  PID:9768
- C:\Windows\System\OVmuQps.exe
  C:\Windows\System\OVmuQps.exe
  2⤵
  PID:9784
- C:\Windows\System\LYwhzJh.exe
  C:\Windows\System\LYwhzJh.exe
  2⤵
  PID:9808
- C:\Windows\System\ePfciZZ.exe
  C:\Windows\System\ePfciZZ.exe
  2⤵
  PID:9816
- C:\Windows\System\rtATpQy.exe
  C:\Windows\System\rtATpQy.exe
  2⤵
  PID:9856
- C:\Windows\System\pDTVMpo.exe
  C:\Windows\System\pDTVMpo.exe
  2⤵
  PID:9916
- C:\Windows\System\OBHMfWO.exe
  C:\Windows\System\OBHMfWO.exe
  2⤵
  PID:9880
- C:\Windows\System\WwTynDl.exe
  C:\Windows\System\WwTynDl.exe
  2⤵
  PID:9996
- C:\Windows\System\QkpMxJs.exe
  C:\Windows\System\QkpMxJs.exe
  2⤵
  PID:10000
- C:\Windows\System\wALMdfp.exe
  C:\Windows\System\wALMdfp.exe
  2⤵
  PID:10096
- C:\Windows\System\zivWAvP.exe
  C:\Windows\System\zivWAvP.exe
  2⤵
  PID:10172
- C:\Windows\System\DjRpHbt.exe
  C:\Windows\System\DjRpHbt.exe
  2⤵
  PID:10180
- C:\Windows\System\nNytDDD.exe
  C:\Windows\System\nNytDDD.exe
  2⤵
  PID:9944
- C:\Windows\System\HizEVYB.exe
  C:\Windows\System\HizEVYB.exe
  2⤵
  PID:9980
- C:\Windows\System\yIizQWk.exe
  C:\Windows\System\yIizQWk.exe
  2⤵
  PID:10112
- C:\Windows\System\BxGshIp.exe
  C:\Windows\System\BxGshIp.exe
  2⤵
  PID:9224
- C:\Windows\System\itsOZeV.exe
  C:\Windows\System\itsOZeV.exe
  2⤵
  PID:8860
- C:\Windows\System\XcegYIx.exe
  C:\Windows\System\XcegYIx.exe
  2⤵
  PID:10216
- C:\Windows\System\qwnHTHF.exe
  C:\Windows\System\qwnHTHF.exe
  2⤵
  PID:9372
- C:\Windows\System\xwIfVpk.exe
  C:\Windows\System\xwIfVpk.exe
  2⤵
  PID:8812
- C:\Windows\System\bcSOfqd.exe
  C:\Windows\System\bcSOfqd.exe
  2⤵
  PID:9404
- C:\Windows\System\sPCBtlF.exe
  C:\Windows\System\sPCBtlF.exe
  2⤵
  PID:8840
- C:\Windows\System\OGRaNmx.exe
  C:\Windows\System\OGRaNmx.exe
  2⤵
  PID:9476
- C:\Windows\System\LGFMlUr.exe
  C:\Windows\System\LGFMlUr.exe
  2⤵
  PID:9616
- C:\Windows\System\GVECRKx.exe
  C:\Windows\System\GVECRKx.exe
  2⤵
  PID:9620
- C:\Windows\System\CBXloGg.exe
  C:\Windows\System\CBXloGg.exe
  2⤵
  PID:9520
- C:\Windows\System\ZqkyWdQ.exe
  C:\Windows\System\ZqkyWdQ.exe
  2⤵
  PID:9544
- C:\Windows\System\iycycIo.exe
  C:\Windows\System\iycycIo.exe
  2⤵
  PID:9744
- C:\Windows\System\FehBRNW.exe
  C:\Windows\System\FehBRNW.exe
  2⤵
  PID:9800
- C:\Windows\System\hdcnKgN.exe
  C:\Windows\System\hdcnKgN.exe
  2⤵
  PID:9844
- C:\Windows\System\FIEGgct.exe
  C:\Windows\System\FIEGgct.exe
  2⤵
  PID:9676
- C:\Windows\System\tCrWrmZ.exe
  C:\Windows\System\tCrWrmZ.exe
  2⤵
  PID:9968
- C:\Windows\System\JNhCYOA.exe
  C:\Windows\System\JNhCYOA.exe
  2⤵
  PID:10092
- C:\Windows\System\ULejWeY.exe
  C:\Windows\System\ULejWeY.exe
  2⤵
  PID:9900
- C:\Windows\System\MmiCqIC.exe
  C:\Windows\System\MmiCqIC.exe
  2⤵
  PID:9948
- C:\Windows\System\SPNAycO.exe
  C:\Windows\System\SPNAycO.exe
  2⤵
  PID:10140
- C:\Windows\System\xzgNyNv.exe
  C:\Windows\System\xzgNyNv.exe
  2⤵
  PID:10064
- C:\Windows\System\xkSpAqn.exe
  C:\Windows\System\xkSpAqn.exe
  2⤵
  PID:10016
- C:\Windows\System\ESasnbe.exe
  C:\Windows\System\ESasnbe.exe
  2⤵
  PID:10076
- C:\Windows\System\auZVvAK.exe
  C:\Windows\System\auZVvAK.exe
  2⤵
  PID:9052
- C:\Windows\System\SEzzbyc.exe
  C:\Windows\System\SEzzbyc.exe
  2⤵
  PID:9280
- C:\Windows\System\ddvlaHC.exe
  C:\Windows\System\ddvlaHC.exe
  2⤵
  PID:8972
- C:\Windows\System\PplIwNf.exe
  C:\Windows\System\PplIwNf.exe
  2⤵
  PID:9292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AIIqdLW.exe

Filesize
1.8MB

MD5
8887dee8bceb0f10ddaa6f6d3360b7bf

SHA1
7b305d1e08ad8e04bafb40cd5a989d4a6638ceec

SHA256
a665aa289c06bf539613a0f4ca7c7663e77dd10d377aba12d7019b99781d7e1d

SHA512
663e5db809b734fbd65f8ef09e3f38f0751c78231f8b3798151ce42565a4bc83cdf80c4a67ec8c762e42509c3240afc919f2e484625030a5cc47ba728424108b

Download Submit
C:\Windows\system\AmWxqYU.exe

Filesize
1.8MB

MD5
bacc719c19234c500c770d8d20b2e28d

SHA1
a8771ee728dff01a7048803fb58d3777c3862831

SHA256
6fb3b9d71f5df736843c2c277fb0f3fcc738773320782bc94735f8b997fb7ca2

SHA512
14fad1e02807f815478658097236b99b13b1501eff382f284836ddcb0b7e6df30d23cdbf9071744d90192edb59406aea412998a69e11cb76effe0dd650bef43c

Download Submit
C:\Windows\system\AsWRbdU.exe

Filesize
1.8MB

MD5
6cd97e1b112c1ccb8284a069e79b0eb2

SHA1
4cc06147728585eb1edb16df752816cb34a9a02e

SHA256
1c407539fb9d75ebd32463be754de92a070f7212fdf0486be7b90bafb8419094

SHA512
3fdf5395467fd33d3d05aa39de5479f186135fd573bde8a24033517b8c1f51bb5701ba15f432629fb0ba8124ff8c5ea056d64f6a7fba4ce3ef5c0a8b2ae0dd68

Download Submit
C:\Windows\system\ECCLRxW.exe

Filesize
1.8MB

MD5
e600704528fb25b3ff37fe5449af1403

SHA1
e1caa3dd571944df20d062a76dbf92936a0f3419

SHA256
a628429572842cecf360309ef38189aea64f4b582411a37a90800667d30ad66b

SHA512
b764417538bcbce227e156353dca02905fcce663f855c06235dca7837d37d290fce5b1698f1383abcba362197d7c51b80f7120d2f971574bf40c3c7728883982

Download Submit
C:\Windows\system\IDQOEXR.exe

Filesize
1.8MB

MD5
afbeef7ccf7e6334c6507c46a41981e5

SHA1
a6935c96eda5b8c41a97625d9a4689fa3dde9481

SHA256
86e9a5a1ba1b005a0230bf5278457be0c5ec7b209da931aee26cc8673af11104

SHA512
115a567ddbb4322bf32fc0cb7101332e481a3427b8a78b749cd1b0e8c1dcbd1ff835cc5c85878c0270d0972977f7eaa152d13041bd2119a6d9b916a6b006b183

Download Submit
C:\Windows\system\JOKpaPG.exe

Filesize
1.8MB

MD5
5aafa5097e53fd959782f0579c2c4648

SHA1
475eb04833974d3e1084e6d7f72938414acb1968

SHA256
8c94a83ef66c3d3423118a04326f9ab6bd436f3764b74ffc74c61dad78b1dd07

SHA512
557d43de273bee5572fbe6ff5157add03c7b684027734362322db90ca2b5fc6a9443597ff917c5a333dcd2c5adab2ab16c6761971c374c1e0310d78b2b8d77d1

Download Submit
C:\Windows\system\JTNkEcq.exe

Filesize
1.8MB

MD5
8d105476bac07a0b094dbfd816201624

SHA1
40d124dd33ae7e4c4381d79b0bfcfaead45e1443

SHA256
97d2cf2845627a9ec4d82f3827d8bc18e817385347e6d2e5fd02edf98a3a6c23

SHA512
4f0659fea9a11fffec104761fb01ebb357bcefd2dc841302998dff448d9f07b7b9884f6fbbbdaed7e9dfe84ac58ea6491edddc4d8ab3f0449290520262ff3ed7

Download Submit
C:\Windows\system\JvQdaDn.exe

Filesize
1.8MB

MD5
b3bd15cbe72aae567c6afe8ea6a0cbc8

SHA1
61b3a9aee5573b408bd727341bd9211423965692

SHA256
2e61595f239aea75235a06246e2be067957d7b69d18db94f7a61a739bb43667c

SHA512
e9eb022a2fa2b26d44f941464946100876591e35284764351a8cadb1a879fd38728b453d3ec2d7e2bf34eae45ea1592e2f26bbbc63ce55e7f6c2e0a6f5a3a0bf

Download Submit
C:\Windows\system\KPTiNlk.exe

Filesize
1.8MB

MD5
57f7f407e43810d3904bd1f2db59f10e

SHA1
1ff5c318315814e87c16691d419de17ca119ffd9

SHA256
cf33b85c62530834b5b667482d1c9816532753c3e13a40dd3da172a200a912f8

SHA512
bfc7427f6615455e6597589b8944252bbdf510fb4c346db9a16156f3fe7716cb376a67a22533d59834159df7fe241ba4042380ea9de47da9be3709a5f9aa2dd1

Download Submit
C:\Windows\system\OdzDQJF.exe

Filesize
1.8MB

MD5
5c05feb0366686ffdb8c6e6b0c28a35c

SHA1
a3dd357d691e73b5a1fdf9b38d6be1260f713a2e

SHA256
5a9d88d2dc6b0cdee321a6092e1484d112583730d22dc9ea1c3eed0daa0e81e1

SHA512
5d31b41121a05b24051d8a959d5aedcea782dc7ba8ac1f71db100459efcc6b9abfe7af49efaa56ac4abfea731f5eb8cae8ee37bc07e39c763f6467934fa7cd75

Download Submit
C:\Windows\system\RMzegwS.exe

Filesize
1.8MB

MD5
20b5880fded8fc224dd4be2e82fe2f73

SHA1
7d867da3cd7c1e6283c913ebf5ee7503de1e8bc1

SHA256
aa50e35a6ae1eba63b5ef8bad835525abcf72908abb7eee568028ce1ab0b8c96

SHA512
54a51f78396d29b261b1d70b8274c6c0328aac7ca6a1d20bd0287d5a60bd9cd4569abbf86f2892f59391be1c7717ead35c5c55eb629857e7e9cc6e8b86c6914a

Download Submit
C:\Windows\system\UFkvaJO.exe

Filesize
1.8MB

MD5
2e4b574c798472908cb205ad81dc662b

SHA1
01f689a3d797d5840315646aeb4f5665104e61ec

SHA256
a07bc8baa5cc7e69fbbac15509b99d174f42b6ecd9187841e869c1a0aee89885

SHA512
1471edfa984615deafd09da2c6db4f58d70c40ae8f1019958949b5cbdd81cf7ddb74319517a569e9f22f647b4ca7d8daed48800643f630209e070cccfd0ebfe1

Download Submit
C:\Windows\system\YXZXdHP.exe

Filesize
1.8MB

MD5
4ae6de2f8e4c5ca86d40ca7ad90a5589

SHA1
03cce6cca633993eb3c21131ed3eee461c79a83a

SHA256
368ac89716c44853341b5badbc11d9b6093c6ad5ac7cf833a1a3e8614544ee21

SHA512
eed0cb6a7275fa43059d3be7d9188e36047f4832c5fa38f3913cf9c9cc17060ea6cfebc5e01c9b5633d8085623f32a4f4270e4725f1e37566ff71ace9dc385f6

Download Submit
C:\Windows\system\ZQzPavo.exe

Filesize
1.8MB

MD5
6616ecbd9583c5f7caa909683582d122

SHA1
09ac30ed31e669c598a5ec283db8f73b5fd291d0

SHA256
c2676a53dc4409bf9007c2c34edb97a2d94def124532c1600c80996a77bd8a86

SHA512
1b402ec4014ec4793efb6fa87e3fef1cea8f020e2ae518bce4baa07aef91014c26951d7c826f45a324a1ab9b50fcb947196795052f999b5fd330590b57199caf

Download Submit
C:\Windows\system\ZVbjKBc.exe

Filesize
1.8MB

MD5
25ad48e210192a59a7cc8bb6b55fa143

SHA1
018c3b9702b3576f4109027ac7e9cf61be8b2823

SHA256
95b6ea511c7fcc57652bd3a44cddf701b7478d2d7da08605319b768c2129a546

SHA512
e1ab7bb0532fb0db3761d566cf33172e23a100d67b93633411e0b2a0eb16f1ba12d23d5b953d0208d3c840f4d205177c09e6a0aed2040b5f564e27882bfb1538

Download Submit
C:\Windows\system\ZhrULfj.exe

Filesize
1.8MB

MD5
a7837be430412924a8d9a3375a1784d9

SHA1
878e0d442acd355d6b5a19e63ca847ce64f8f3dc

SHA256
c015e3bb160d5b9f391d3c825aa4ae23b924df60f2730a0aa6c3a0f4e5045576

SHA512
a61a99731f8c255a6eb619b21587d88052d6de0f58806622fce06de4368837a9c52a9f2d24822c1756769560041a0a9fab1608d36ca893d792e16c1faad7056a

Download Submit
C:\Windows\system\aFrlCaN.exe

Filesize
1.8MB

MD5
b95a6c4cb1801de555511c2ce9fb6259

SHA1
5f7c41ebbfccf810872f78b0573d871b13d6f64a

SHA256
aa22303547ad60e4499fb2d181935ec8405b7bf5eb545aaccf8aa5ed63d119e2

SHA512
7de53993db12bc38ee5d2d3f81100e0e37aea947c4a106109413c30f5f24397bc41c5618a558891f5822af17038b17f29204be3503886f9f4456311dcc0360da

Download Submit
C:\Windows\system\fesKTJT.exe

Filesize
1.8MB

MD5
815712c9bab925b710d1d94253468746

SHA1
ca6b625ba14db5ac64a3568e33790d95d968225a

SHA256
ca8e8b9a81398d2d748180751f14bdaa62a46809b5f6ddb6d0a2ef251c9ba9aa

SHA512
e0153beff1b74be1997ed580bebb99f54a226fc10057dafa9c09817cb9e233eb5960c9a6ea97a2ee0c874cedebd84c96cb55528a5bc4342db611086afcc07314

Download Submit
C:\Windows\system\jhvhDXQ.exe

Filesize
1.8MB

MD5
e996e402ba5c284ea48799ac3746f655

SHA1
4d375acea2cb25114c00b85b89c8bc36fee63a28

SHA256
2750023fb2484923d6b831206ee93e2b126467e359e0b7bfc7a4b310d5c16464

SHA512
8e80e0570ad0ca0080fafd5e63a78d860172a63257bb720dbec5c52af4b732824e63741e9f7ed53545a0fdeb71a44e3e026a0cf2b5a3a72734d6eee14a5910c1

Download Submit
C:\Windows\system\olYCCWl.exe

Filesize
1.8MB

MD5
949bc20024bdc1f18fabdf5b16dde9fe

SHA1
4f24d63004aaf988e5d8d5d4033b4c9ebe523c69

SHA256
6d7dbaf1b96bf15b5fa55d48be1dc09e641fd4f5823e42b231c3211ebb10503b

SHA512
f7961c6448675dd2d71180cfcb7aa5d50c558bdab0d0c0a15d6cfbe88f58451752772d328133d66039eac5133c9baebce22baf24bc90a1a02fbc00dd8a91b04e

Download Submit
C:\Windows\system\plIQXAp.exe

Filesize
1.8MB

MD5
888a7a8177febbbb191825c3705c9d6a

SHA1
98379f8f3102fe775b59709913ae3e64d7d6e2de

SHA256
9c83ebd3a9d496fa21760c3cac4ee964995a669611809f91eab35f5cc2667a10

SHA512
a435663da2adfbecda1eb52c33aa80b981e3e398d6509e26fd21ef9b1a7da7776d3cded23f375d8aca0805d9da210c2dbdf3d69fe1b38ec2eb845deafefa3f10

Download Submit
C:\Windows\system\vONbeeq.exe

Filesize
1.8MB

MD5
7b489dcec271cfd924fe6b66ec4061b5

SHA1
5e90760f8832e33c392b4b571ed47611df3bb9fd

SHA256
34c6b97ce5bd4fb407738f79da1549aef5720f6a88bfea69538ea23530936e42

SHA512
3f753c08756b59a9812b560699264350fa41b3aedd7afafff6cc60a1801c7b1a7d734705170571065f62ebce67fbfd9d602d459110420f00339261202af8c054

Download Submit
C:\Windows\system\vnwiyHL.exe

Filesize
1.8MB

MD5
693ed3410e9c303076438b4e88f470e9

SHA1
d3d7004c0965b8d84707522404f65045feeb2a32

SHA256
18ec5323625f8d0739aa2e46ce9c4244a059fcc0fcd531837bc376eda872b7aa

SHA512
d1119a20228f0ad32b9cb14c4d3a610598a5d07317783da64b651ef02ed83ac41535afe882aa9d7a97c8005e1b465e54b6852079727c93b09c01631c2d2269f1

Download Submit
C:\Windows\system\vqRFilc.exe

Filesize
1.8MB

MD5
185e28f2bd52816a292283987ab3b368

SHA1
3c3fc26dd89631be5ce2af9428ea955bc1f12c22

SHA256
da1258aa09d5336f18d7c120e154018efe909d65f8639f35983fcbe7c2bfbbf8

SHA512
972dc77d5a29f4e012562b7c375cc68651fef5888f758af053396923f2f9c5ef519ec702b2945c03f135b160c630e0d707f97685dbac684fe828374a96c1471d

Download Submit
C:\Windows\system\yavauUn.exe

Filesize
8B

MD5
1855a32bc20d82a1da2b5edf8967f4e6

SHA1
25928e56f89ec28b56047592b93000c1d36e2a23

SHA256
197265335822dae03e837ac88a16d32bf68b201da4bc921af00edba259c1267c

SHA512
6ba43273aa11ef21001bd21641b2cb12d306e904aaff29ff56a8c7b3eadaaec0f04afabf47cd7eb2a1a7b9c79f098b4d11d9a442d2048486e96355d7914a5e67

Download Submit
C:\Windows\system\zkASgRW.exe

Filesize
1.8MB

MD5
a5c509bf2670029491d15293e7f8b1ca

SHA1
0d2714b35e76e336f3940174e22a5e946b4e5b0b

SHA256
03b52fe6518e344f42cda2bbd0d06986010053b2b29b767c45a17881b2cba85d

SHA512
126634eae8bdf4bd92b18b409e91e66e19f3549eb4c906029a2956ed7534dc491802b075fb719796906c692aa61c05c5303a8c1a012f8e2538519acced02e32c

Download Submit
\Windows\system\KZGGwCs.exe

Filesize
1.8MB

MD5
859a6241efa1448947c277789f387bf9

SHA1
5c3f293859916538f1caaee95ec3aaa594d6914e

SHA256
be13fc6692f9e8f7cf51d1e2ae60140596a692055e52d036640d75bc9421cf3c

SHA512
085226fef0613b530a8e03a59b51c25736118eb38a46281fbaf4fb3435825433201b2c0fd1cd26c573671cb3b64faa5c5206d29a1bade60aa330433a527178c2

Download Submit
\Windows\system\YpPZIRN.exe

Filesize
1.8MB

MD5
126d327f290a3021a70574ca3036a77b

SHA1
2ad102d54d133ecabc868c1f13b06a59d49fccd1

SHA256
7f6318b17debf2befa29fc3a5e720ef27409c0fb3f63cd3afa30023c8b4ce910

SHA512
4ed7c1bece3fc7ef9ecf507c85669e4710921384aaefcaa80bb69ad0b006900eb69100822c4b7a4ba10e637c265439fff6b2f17881b6b8d1f8cd4cfc66db9807

Download Submit
\Windows\system\nzeEtsu.exe

Filesize
1.8MB

MD5
217c20298a656801ee56e3e7a7a85e12

SHA1
35f31118ace759b0abe5dab09df7b0aeac84f6e3

SHA256
3c209096646af8cbdc4735ad64395f1fd33e05a890589f021069e58a3764d650

SHA512
7d1abfc91ae3dd87568c9ec199b2b3c2447e1098cfa45d07e33c715bc5b6e65e2e5ac2f37daa0b539605be10d167c30cba83f58b1d49b4c3b8269d38cd30224e

Download Submit
\Windows\system\vkuFdsl.exe

Filesize
1.8MB

MD5
b75b380950076054a9507187a1086196

SHA1
74d20afedd4ecf000050dca445ffd0b186753fce

SHA256
d16ee3f65a65576f8e737576366674f6b72460cb3f422419bd58d920c126f2f8

SHA512
fd753f73e575ceffed7e123500ce3e895e52636edc03f103f363e9ce351911079422de92dbbe432399c6f04e3ad90ecbd0efbe3b29c94012ab381a0d7a2ecbf1

Download Submit
\Windows\system\wlqNLTo.exe

Filesize
1.8MB

MD5
2f85712f89cb68f6b99c8fa6d1339b22

SHA1
c305e4a3e4b25ce197a1e78130beb8edeeafd004

SHA256
c2d1969b17fa3140d34986882dd80c66c4cddbd174ececb253fd227c8e243a6c

SHA512
062dee0a8f9ceb28b865ae4c8f3a8f4121d3f9e486c45369432a7c0a2871d1acae1fee5ec590c7064816b2113fdb53edf52f77ec300162e447d53d771b908b18

Download Submit
\Windows\system\xptYywZ.exe

Filesize
1.8MB

MD5
1a357c6bc539ba5644883572750cef0f

SHA1
72132cb9b0b66cb25ea09fc843e23f51bc8e0e2e

SHA256
530bf7f8d2e6b9d6d0c8d95179fd134528701c432b4e15e44c78b8065fe1a8c3

SHA512
b95d3babb081e7e5382863b58b9be09636511de25a2cd8c16b7a0c9d82c9be05b68dbe569e36f32f56f0a2c90b461ee280ce3ca40bdbaf4508ad88df88879c3f

Download Submit
\Windows\system\yrBsekD.exe

Filesize
1.8MB

MD5
b9142c9c2d780e7995f390839ed7a8c1

SHA1
87ce1b57dea9e780c4c0de0779dd600406fb24e5

SHA256
a69d64593bfda94b9a5320c3a504a5ef98164c0049cf278acc728754e75c8492

SHA512
b38c76f83dd1d6cb3a443b69f7f22b4b8dfc1b889caa76f9e11c4c0ad694f156c9430bfb77524a8ca6db05f99cae7b0c84a22c688a6ee0b89b7cbbcd0767a208

Download Submit
memory/1388-20-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2160-258-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2160-162-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2160-113-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2160-75-0x000007FEF5C4E000-0x000007FEF5C4F000-memory.dmp

Filesize
4KB

Download
memory/2160-109-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2160-55-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2160-118-0x000007FEF5990000-0x000007FEF632D000-memory.dmp

Filesize
9.6MB

Download
memory/2492-150-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2492-5016-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2524-17-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2524-4745-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2680-126-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-163-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2680-34-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2680-12-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2680-164-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-42-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2680-76-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2680-134-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2680-148-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-142-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2680-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2680-1-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-58-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2700-152-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-5152-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5089-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-154-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-145-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2748-5129-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2768-160-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-52-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2784-5011-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2860-149-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2864-5037-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2864-151-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2892-5132-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2892-119-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2912-165-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2912-5020-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download