xmrig | 9fedc3fdefc12f1afaf2fe8c75393b7d79e5be9a0dc556289dbe5fc9d58d3bc2

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
Size

2.3MB
MD5

03429db33dc123b2d1b04e2e440157b2
SHA1

3aa4b42ae8c94993dac92c10cba1a547e7ef54e6
SHA256

9fedc3fdefc12f1afaf2fe8c75393b7d79e5be9a0dc556289dbe5fc9d58d3bc2
SHA512

86c594138e9eba543efa3533f36c2bcfb85279af0422a462a6765105b92e5f760e2d24e16a2a889810a8805e90dd2db6b5508ff7bb5de4bb9374ee6306de95cd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9JpWaiH:NAB5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2384-19-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/3064-21-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2852-20-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2728-70-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig
behavioral1/memory/3016-111-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/1644-110-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2604-105-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2628-104-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2608-102-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2852-3654-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2728-3659-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig
behavioral1/memory/2604-3665-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/2628-3635-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/1644-3637-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/3064-3632-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2384	blvauKU.exe
2852	ayGCwSQ.exe
3064	GfcycqQ.exe
2728	IbPCPmM.exe
2608	NJkUJWN.exe
2628	KCbVXum.exe
2604	wzpGdjJ.exe
1644	QGGEPiR.exe
3016	FxHuuKV.exe
1968	qwxSSpM.exe
1580	gLQxpuK.exe
584	LJVCauD.exe
2876	BJAvZYr.exe
1568	rHUvhzU.exe
2648	NLPoZGr.exe
2216	JhYjndj.exe
2304	VFPiCLu.exe
2672	tjJFkxb.exe
1976	hUZwmJM.exe
3012	YYGWuWp.exe
2168	ZyMeAQy.exe
1276	yLiBUeW.exe
324	nqgxycv.exe
1600	tQZzTUE.exe
1248	jahXUCq.exe
2116	vDaHxhG.exe
2172	VTGXsZN.exe
2912	BNSOrJY.exe
2400	kjTFvRN.exe
1256	bemBgRs.exe
2320	JIFIvNJ.exe
872	stiPpap.exe
952	CsZDzsh.exe
1980	nXhHfiY.exe
1720	hJLfYxH.exe
3028	nVfFVEZ.exe
3036	aMMxgZd.exe
784	SvZYnbq.exe
880	IrqwzxW.exe
3052	QOvBaqM.exe
2568	QhjOphO.exe
2976	QNgfOoE.exe
1864	RJlyypq.exe
888	TNAbeYD.exe
3048	wvkeAtI.exe
1520	lbhpWKG.exe
2572	fpvaKCK.exe
2092	FHLfrJk.exe
2708	tUGyRhl.exe
2864	gFHpJsk.exe
2732	VxvmOlf.exe
2784	puGfVRm.exe
2676	XyHxMjd.exe
2132	vPLMSdz.exe
2504	fYqyHVc.exe
1636	HWFVolf.exe
2740	XTtJEkV.exe
2632	zmcUkrt.exe
1776	JyTGwCJ.exe
840	iUFlKvi.exe
2476	rVXcFuI.exe
2212	nMrmLmN.exe
2872	PiaUlCx.exe
3008	KhlTCOI.exe

Loads dropped DLL 64 IoCs

pid	Process
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2068-0-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x00090000000120fe-5.dat	upx
behavioral1/memory/2384-19-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x000700000001921e-31.dat	upx
behavioral1/memory/3064-21-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2852-20-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/files/0x00070000000191c6-16.dat	upx
behavioral1/files/0x00080000000190d2-8.dat	upx
behavioral1/memory/2728-70-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/files/0x000500000001a425-68.dat	upx
behavioral1/files/0x000500000001a41b-61.dat	upx
behavioral1/files/0x000700000001945d-55.dat	upx
behavioral1/files/0x0006000000019255-54.dat	upx
behavioral1/files/0x0007000000004e74-34.dat	upx
behavioral1/files/0x000500000001a481-88.dat	upx
behavioral1/files/0x000500000001a419-58.dat	upx
behavioral1/files/0x000500000001a423-155.dat	upx
behavioral1/files/0x000500000001a4b9-183.dat	upx
behavioral1/files/0x000500000001a4be-192.dat	upx
behavioral1/files/0x0008000000018f45-187.dat	upx
behavioral1/files/0x000500000001a4b3-152.dat	upx
behavioral1/files/0x000500000001a4aa-143.dat	upx
behavioral1/files/0x000500000001a4a8-134.dat	upx
behavioral1/files/0x0007000000019276-126.dat	upx
behavioral1/files/0x000500000001a4a4-171.dat	upx
behavioral1/files/0x000500000001a498-117.dat	upx
behavioral1/files/0x000500000001a473-81.dat	upx
behavioral1/files/0x000500000001a426-162.dat	upx
behavioral1/files/0x000500000001a4b5-160.dat	upx
behavioral1/files/0x000500000001a4ac-150.dat	upx
behavioral1/files/0x000500000001a4a9-141.dat	upx
behavioral1/files/0x000500000001a4a6-133.dat	upx
behavioral1/files/0x000500000001a4a2-122.dat	upx
behavioral1/files/0x000700000001924b-38.dat	upx
behavioral1/memory/3016-111-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/1644-110-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2604-105-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/2628-104-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2608-102-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x000500000001a486-98.dat	upx
behavioral1/files/0x000500000001a475-96.dat	upx
behavioral1/files/0x000500000001a452-95.dat	upx
behavioral1/memory/2852-3654-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2728-3659-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/memory/2604-3665-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/2628-3635-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/1644-3637-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/3064-3632-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NTFgREp.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\jnQGccl.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\OHnHhPD.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\iqkKrER.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\XvWDJtO.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\rMvsAiB.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\RnUxvvF.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\fEFSPrr.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\jufqdyl.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\tqDvDpG.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\pstWarN.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\zdHHZHf.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\sQmzLiR.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\RSWNxRu.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\HvHcBif.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\wQTEDbX.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\pQEpJvN.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\tISmybG.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ATZKbGx.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ZVvQnIB.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\UEKjLUW.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\MoINjej.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\gGcsPuI.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ECrmSgf.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\JrYRLfT.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\UvxpmEh.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\xJntBPO.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\bSoJCiX.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\HWFVolf.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ZNdxuXX.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\KyZYvou.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ovqrVrk.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\GScsmle.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ltSffLZ.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ZsVEquh.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\jRVoZHH.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\ilgBwjV.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\FDhDRWZ.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\jYJyBkR.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\rrPsvVx.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\YqFQLMx.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\OaFzAUM.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\CPVbflS.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\CNVQJFv.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\uUbpzNK.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\EAUauQL.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\NPSjvog.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\flsRdEs.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\MlJmcrH.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\FcogKWA.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\dVSPuCK.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\TPhenPm.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\OIoxvlT.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\NgKZTeC.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\TSSwIkx.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\LQjxfqi.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\vfPOjJC.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\RkYsMld.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\YFTxFpe.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\HFQdSgT.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\XXxzhnQ.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\MjhbIrJ.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\UNYNGGu.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
File created	C:\Windows\System\rLCtwQV.exe	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
Token: SeDebugPrivilege	2404	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2404	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2404	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2404	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2384	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2384	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2384	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2852	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2852	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2852	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	33
PID 2068 wrote to memory of 3064	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	34
PID 2068 wrote to memory of 3064	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	34
PID 2068 wrote to memory of 3064	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	34
PID 2068 wrote to memory of 2728	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	35
PID 2068 wrote to memory of 2728	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	35
PID 2068 wrote to memory of 2728	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	35
PID 2068 wrote to memory of 2608	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	36
PID 2068 wrote to memory of 2608	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	36
PID 2068 wrote to memory of 2608	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	36
PID 2068 wrote to memory of 2876	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2876	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2876	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2628	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2628	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2628	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2648	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2648	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2648	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2604	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	40
PID 2068 wrote to memory of 2604	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	40
PID 2068 wrote to memory of 2604	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	40
PID 2068 wrote to memory of 2672	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	41
PID 2068 wrote to memory of 2672	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	41
PID 2068 wrote to memory of 2672	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	41
PID 2068 wrote to memory of 1644	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	42
PID 2068 wrote to memory of 1644	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	42
PID 2068 wrote to memory of 1644	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	42
PID 2068 wrote to memory of 3012	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	43
PID 2068 wrote to memory of 3012	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	43
PID 2068 wrote to memory of 3012	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	43
PID 2068 wrote to memory of 3016	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	44
PID 2068 wrote to memory of 3016	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	44
PID 2068 wrote to memory of 3016	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	44
PID 2068 wrote to memory of 1276	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	45
PID 2068 wrote to memory of 1276	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	45
PID 2068 wrote to memory of 1276	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	45
PID 2068 wrote to memory of 1968	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1968	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1968	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	46
PID 2068 wrote to memory of 324	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	47
PID 2068 wrote to memory of 324	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	47
PID 2068 wrote to memory of 324	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	47
PID 2068 wrote to memory of 1580	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1580	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1580	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1600	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	49
PID 2068 wrote to memory of 1600	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	49
PID 2068 wrote to memory of 1600	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	49
PID 2068 wrote to memory of 584	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	50
PID 2068 wrote to memory of 584	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	50
PID 2068 wrote to memory of 584	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	50
PID 2068 wrote to memory of 1248	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	51
PID 2068 wrote to memory of 1248	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	51
PID 2068 wrote to memory of 1248	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	51
PID 2068 wrote to memory of 1568	2068	03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03429db33dc123b2d1b04e2e440157b2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\System\blvauKU.exe
  C:\Windows\System\blvauKU.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ayGCwSQ.exe
  C:\Windows\System\ayGCwSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\GfcycqQ.exe
  C:\Windows\System\GfcycqQ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\IbPCPmM.exe
  C:\Windows\System\IbPCPmM.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\NJkUJWN.exe
  C:\Windows\System\NJkUJWN.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\BJAvZYr.exe
  C:\Windows\System\BJAvZYr.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\KCbVXum.exe
  C:\Windows\System\KCbVXum.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\NLPoZGr.exe
  C:\Windows\System\NLPoZGr.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\wzpGdjJ.exe
  C:\Windows\System\wzpGdjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\tjJFkxb.exe
  C:\Windows\System\tjJFkxb.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\QGGEPiR.exe
  C:\Windows\System\QGGEPiR.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\YYGWuWp.exe
  C:\Windows\System\YYGWuWp.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\FxHuuKV.exe
  C:\Windows\System\FxHuuKV.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\yLiBUeW.exe
  C:\Windows\System\yLiBUeW.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\qwxSSpM.exe
  C:\Windows\System\qwxSSpM.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\nqgxycv.exe
  C:\Windows\System\nqgxycv.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\gLQxpuK.exe
  C:\Windows\System\gLQxpuK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\tQZzTUE.exe
  C:\Windows\System\tQZzTUE.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\LJVCauD.exe
  C:\Windows\System\LJVCauD.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\jahXUCq.exe
  C:\Windows\System\jahXUCq.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\rHUvhzU.exe
  C:\Windows\System\rHUvhzU.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\vDaHxhG.exe
  C:\Windows\System\vDaHxhG.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\JhYjndj.exe
  C:\Windows\System\JhYjndj.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\VTGXsZN.exe
  C:\Windows\System\VTGXsZN.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\VFPiCLu.exe
  C:\Windows\System\VFPiCLu.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\BNSOrJY.exe
  C:\Windows\System\BNSOrJY.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\hUZwmJM.exe
  C:\Windows\System\hUZwmJM.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\kjTFvRN.exe
  C:\Windows\System\kjTFvRN.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ZyMeAQy.exe
  C:\Windows\System\ZyMeAQy.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\bemBgRs.exe
  C:\Windows\System\bemBgRs.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\JIFIvNJ.exe
  C:\Windows\System\JIFIvNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\stiPpap.exe
  C:\Windows\System\stiPpap.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\CsZDzsh.exe
  C:\Windows\System\CsZDzsh.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\nXhHfiY.exe
  C:\Windows\System\nXhHfiY.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\hJLfYxH.exe
  C:\Windows\System\hJLfYxH.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\nVfFVEZ.exe
  C:\Windows\System\nVfFVEZ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\aMMxgZd.exe
  C:\Windows\System\aMMxgZd.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\SvZYnbq.exe
  C:\Windows\System\SvZYnbq.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\IrqwzxW.exe
  C:\Windows\System\IrqwzxW.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\QOvBaqM.exe
  C:\Windows\System\QOvBaqM.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\QhjOphO.exe
  C:\Windows\System\QhjOphO.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\QNgfOoE.exe
  C:\Windows\System\QNgfOoE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\RJlyypq.exe
  C:\Windows\System\RJlyypq.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\TNAbeYD.exe
  C:\Windows\System\TNAbeYD.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\wvkeAtI.exe
  C:\Windows\System\wvkeAtI.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\lbhpWKG.exe
  C:\Windows\System\lbhpWKG.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\fpvaKCK.exe
  C:\Windows\System\fpvaKCK.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\FHLfrJk.exe
  C:\Windows\System\FHLfrJk.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\tUGyRhl.exe
  C:\Windows\System\tUGyRhl.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\gFHpJsk.exe
  C:\Windows\System\gFHpJsk.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\VxvmOlf.exe
  C:\Windows\System\VxvmOlf.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\puGfVRm.exe
  C:\Windows\System\puGfVRm.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\XyHxMjd.exe
  C:\Windows\System\XyHxMjd.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\vPLMSdz.exe
  C:\Windows\System\vPLMSdz.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\fYqyHVc.exe
  C:\Windows\System\fYqyHVc.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\HWFVolf.exe
  C:\Windows\System\HWFVolf.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\XTtJEkV.exe
  C:\Windows\System\XTtJEkV.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\zmcUkrt.exe
  C:\Windows\System\zmcUkrt.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\JyTGwCJ.exe
  C:\Windows\System\JyTGwCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\iUFlKvi.exe
  C:\Windows\System\iUFlKvi.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\rVXcFuI.exe
  C:\Windows\System\rVXcFuI.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\nMrmLmN.exe
  C:\Windows\System\nMrmLmN.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\PiaUlCx.exe
  C:\Windows\System\PiaUlCx.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\KhlTCOI.exe
  C:\Windows\System\KhlTCOI.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\HfsNZtA.exe
  C:\Windows\System\HfsNZtA.exe
  2⤵
  PID:1364
- C:\Windows\System\VeyIJCm.exe
  C:\Windows\System\VeyIJCm.exe
  2⤵
  PID:2644
- C:\Windows\System\JZaVeUj.exe
  C:\Windows\System\JZaVeUj.exe
  2⤵
  PID:788
- C:\Windows\System\wDjuZHT.exe
  C:\Windows\System\wDjuZHT.exe
  2⤵
  PID:1660
- C:\Windows\System\XAnBYFZ.exe
  C:\Windows\System\XAnBYFZ.exe
  2⤵
  PID:1712
- C:\Windows\System\VRWXbSm.exe
  C:\Windows\System\VRWXbSm.exe
  2⤵
  PID:1296
- C:\Windows\System\OOZDXBD.exe
  C:\Windows\System\OOZDXBD.exe
  2⤵
  PID:600
- C:\Windows\System\jFfgQke.exe
  C:\Windows\System\jFfgQke.exe
  2⤵
  PID:2884
- C:\Windows\System\lvfIPuN.exe
  C:\Windows\System\lvfIPuN.exe
  2⤵
  PID:2996
- C:\Windows\System\VxNjEdv.exe
  C:\Windows\System\VxNjEdv.exe
  2⤵
  PID:2208
- C:\Windows\System\TqxbirQ.exe
  C:\Windows\System\TqxbirQ.exe
  2⤵
  PID:1576
- C:\Windows\System\HBtgsoZ.exe
  C:\Windows\System\HBtgsoZ.exe
  2⤵
  PID:960
- C:\Windows\System\OLGuEhg.exe
  C:\Windows\System\OLGuEhg.exe
  2⤵
  PID:1124
- C:\Windows\System\zwxHrYB.exe
  C:\Windows\System\zwxHrYB.exe
  2⤵
  PID:2128
- C:\Windows\System\SkjWHfL.exe
  C:\Windows\System\SkjWHfL.exe
  2⤵
  PID:860
- C:\Windows\System\XbgrzAI.exe
  C:\Windows\System\XbgrzAI.exe
  2⤵
  PID:2980
- C:\Windows\System\WOWPUUA.exe
  C:\Windows\System\WOWPUUA.exe
  2⤵
  PID:1536
- C:\Windows\System\LLkuYms.exe
  C:\Windows\System\LLkuYms.exe
  2⤵
  PID:2204
- C:\Windows\System\nJPgGDP.exe
  C:\Windows\System\nJPgGDP.exe
  2⤵
  PID:2972
- C:\Windows\System\PzxsndF.exe
  C:\Windows\System\PzxsndF.exe
  2⤵
  PID:2260
- C:\Windows\System\joIVeIx.exe
  C:\Windows\System\joIVeIx.exe
  2⤵
  PID:2160
- C:\Windows\System\qYWeyes.exe
  C:\Windows\System\qYWeyes.exe
  2⤵
  PID:3056
- C:\Windows\System\kfRZbQf.exe
  C:\Windows\System\kfRZbQf.exe
  2⤵
  PID:1896
- C:\Windows\System\mkAAexP.exe
  C:\Windows\System\mkAAexP.exe
  2⤵
  PID:896
- C:\Windows\System\yHQEPTh.exe
  C:\Windows\System\yHQEPTh.exe
  2⤵
  PID:1928
- C:\Windows\System\abOWfcT.exe
  C:\Windows\System\abOWfcT.exe
  2⤵
  PID:2780
- C:\Windows\System\IIwdppK.exe
  C:\Windows\System\IIwdppK.exe
  2⤵
  PID:1532
- C:\Windows\System\zhhsRIl.exe
  C:\Windows\System\zhhsRIl.exe
  2⤵
  PID:2408
- C:\Windows\System\JQBwqYb.exe
  C:\Windows\System\JQBwqYb.exe
  2⤵
  PID:2748
- C:\Windows\System\LZUjTAa.exe
  C:\Windows\System\LZUjTAa.exe
  2⤵
  PID:1836
- C:\Windows\System\bRIeSWD.exe
  C:\Windows\System\bRIeSWD.exe
  2⤵
  PID:2752
- C:\Windows\System\mIzVxnD.exe
  C:\Windows\System\mIzVxnD.exe
  2⤵
  PID:2664
- C:\Windows\System\cNjVavE.exe
  C:\Windows\System\cNjVavE.exe
  2⤵
  PID:1728
- C:\Windows\System\pQEpJvN.exe
  C:\Windows\System\pQEpJvN.exe
  2⤵
  PID:1940
- C:\Windows\System\EQzjjDx.exe
  C:\Windows\System\EQzjjDx.exe
  2⤵
  PID:2472
- C:\Windows\System\mMgVLJK.exe
  C:\Windows\System\mMgVLJK.exe
  2⤵
  PID:264
- C:\Windows\System\yVCNqRy.exe
  C:\Windows\System\yVCNqRy.exe
  2⤵
  PID:816
- C:\Windows\System\NywEoCg.exe
  C:\Windows\System\NywEoCg.exe
  2⤵
  PID:2512
- C:\Windows\System\VUQwJrU.exe
  C:\Windows\System\VUQwJrU.exe
  2⤵
  PID:3060
- C:\Windows\System\doVFamG.exe
  C:\Windows\System\doVFamG.exe
  2⤵
  PID:2192
- C:\Windows\System\mmpNgbi.exe
  C:\Windows\System\mmpNgbi.exe
  2⤵
  PID:1672
- C:\Windows\System\iRhUNUF.exe
  C:\Windows\System\iRhUNUF.exe
  2⤵
  PID:1120
- C:\Windows\System\uXNATWG.exe
  C:\Windows\System\uXNATWG.exe
  2⤵
  PID:236
- C:\Windows\System\UsyDShL.exe
  C:\Windows\System\UsyDShL.exe
  2⤵
  PID:3044
- C:\Windows\System\BiRTLih.exe
  C:\Windows\System\BiRTLih.exe
  2⤵
  PID:1740
- C:\Windows\System\fNrRHax.exe
  C:\Windows\System\fNrRHax.exe
  2⤵
  PID:2920
- C:\Windows\System\SNOdTNQ.exe
  C:\Windows\System\SNOdTNQ.exe
  2⤵
  PID:1528
- C:\Windows\System\TSakHJG.exe
  C:\Windows\System\TSakHJG.exe
  2⤵
  PID:1704
- C:\Windows\System\ySNgTzK.exe
  C:\Windows\System\ySNgTzK.exe
  2⤵
  PID:2236
- C:\Windows\System\ltUFPbA.exe
  C:\Windows\System\ltUFPbA.exe
  2⤵
  PID:1020
- C:\Windows\System\RavpCoC.exe
  C:\Windows\System\RavpCoC.exe
  2⤵
  PID:280
- C:\Windows\System\hzigIcz.exe
  C:\Windows\System\hzigIcz.exe
  2⤵
  PID:1436
- C:\Windows\System\BprqsmA.exe
  C:\Windows\System\BprqsmA.exe
  2⤵
  PID:2636
- C:\Windows\System\MjJjObT.exe
  C:\Windows\System\MjJjObT.exe
  2⤵
  PID:1992
- C:\Windows\System\gPKiNjp.exe
  C:\Windows\System\gPKiNjp.exe
  2⤵
  PID:2868
- C:\Windows\System\kgpnzrc.exe
  C:\Windows\System\kgpnzrc.exe
  2⤵
  PID:1068
- C:\Windows\System\lWNITrk.exe
  C:\Windows\System\lWNITrk.exe
  2⤵
  PID:2844
- C:\Windows\System\NiUETeS.exe
  C:\Windows\System\NiUETeS.exe
  2⤵
  PID:3088
- C:\Windows\System\CpaqVWp.exe
  C:\Windows\System\CpaqVWp.exe
  2⤵
  PID:3104
- C:\Windows\System\ismSSXN.exe
  C:\Windows\System\ismSSXN.exe
  2⤵
  PID:3120
- C:\Windows\System\aDaLXMB.exe
  C:\Windows\System\aDaLXMB.exe
  2⤵
  PID:3136
- C:\Windows\System\sIUeozj.exe
  C:\Windows\System\sIUeozj.exe
  2⤵
  PID:3152
- C:\Windows\System\RTvWlNF.exe
  C:\Windows\System\RTvWlNF.exe
  2⤵
  PID:3168
- C:\Windows\System\OHlMJTz.exe
  C:\Windows\System\OHlMJTz.exe
  2⤵
  PID:3184
- C:\Windows\System\EgLPcst.exe
  C:\Windows\System\EgLPcst.exe
  2⤵
  PID:3200
- C:\Windows\System\bYgnwhG.exe
  C:\Windows\System\bYgnwhG.exe
  2⤵
  PID:3216
- C:\Windows\System\ExteScQ.exe
  C:\Windows\System\ExteScQ.exe
  2⤵
  PID:3244
- C:\Windows\System\htCmXpu.exe
  C:\Windows\System\htCmXpu.exe
  2⤵
  PID:3260
- C:\Windows\System\loSMtYT.exe
  C:\Windows\System\loSMtYT.exe
  2⤵
  PID:3276
- C:\Windows\System\GIXvYFz.exe
  C:\Windows\System\GIXvYFz.exe
  2⤵
  PID:3292
- C:\Windows\System\QRyZMSt.exe
  C:\Windows\System\QRyZMSt.exe
  2⤵
  PID:3440
- C:\Windows\System\MAfplWj.exe
  C:\Windows\System\MAfplWj.exe
  2⤵
  PID:3460
- C:\Windows\System\pOQaIPK.exe
  C:\Windows\System\pOQaIPK.exe
  2⤵
  PID:3476
- C:\Windows\System\KEanxNJ.exe
  C:\Windows\System\KEanxNJ.exe
  2⤵
  PID:3492
- C:\Windows\System\uvdMeAl.exe
  C:\Windows\System\uvdMeAl.exe
  2⤵
  PID:3508
- C:\Windows\System\kVbXVfV.exe
  C:\Windows\System\kVbXVfV.exe
  2⤵
  PID:3524
- C:\Windows\System\KrVpEbR.exe
  C:\Windows\System\KrVpEbR.exe
  2⤵
  PID:3540
- C:\Windows\System\qYvVWEM.exe
  C:\Windows\System\qYvVWEM.exe
  2⤵
  PID:3556
- C:\Windows\System\cETBnPb.exe
  C:\Windows\System\cETBnPb.exe
  2⤵
  PID:3572
- C:\Windows\System\SoTmiXX.exe
  C:\Windows\System\SoTmiXX.exe
  2⤵
  PID:3588
- C:\Windows\System\dsTwiGX.exe
  C:\Windows\System\dsTwiGX.exe
  2⤵
  PID:3604
- C:\Windows\System\MYjLyPD.exe
  C:\Windows\System\MYjLyPD.exe
  2⤵
  PID:3620
- C:\Windows\System\TriozrJ.exe
  C:\Windows\System\TriozrJ.exe
  2⤵
  PID:3636
- C:\Windows\System\FNfVmUM.exe
  C:\Windows\System\FNfVmUM.exe
  2⤵
  PID:3652
- C:\Windows\System\mWghVvJ.exe
  C:\Windows\System\mWghVvJ.exe
  2⤵
  PID:3668
- C:\Windows\System\djZhitG.exe
  C:\Windows\System\djZhitG.exe
  2⤵
  PID:3684
- C:\Windows\System\WAonDZE.exe
  C:\Windows\System\WAonDZE.exe
  2⤵
  PID:3700
- C:\Windows\System\zqDXaEL.exe
  C:\Windows\System\zqDXaEL.exe
  2⤵
  PID:3716
- C:\Windows\System\AUzucEI.exe
  C:\Windows\System\AUzucEI.exe
  2⤵
  PID:3732
- C:\Windows\System\ySGZNjZ.exe
  C:\Windows\System\ySGZNjZ.exe
  2⤵
  PID:3748
- C:\Windows\System\rFPIhwL.exe
  C:\Windows\System\rFPIhwL.exe
  2⤵
  PID:3764
- C:\Windows\System\YvZfqrs.exe
  C:\Windows\System\YvZfqrs.exe
  2⤵
  PID:3784
- C:\Windows\System\sTjMlMq.exe
  C:\Windows\System\sTjMlMq.exe
  2⤵
  PID:3840
- C:\Windows\System\VuEOKcI.exe
  C:\Windows\System\VuEOKcI.exe
  2⤵
  PID:3860
- C:\Windows\System\jdKIVpp.exe
  C:\Windows\System\jdKIVpp.exe
  2⤵
  PID:3876
- C:\Windows\System\DEstynU.exe
  C:\Windows\System\DEstynU.exe
  2⤵
  PID:3892
- C:\Windows\System\YqkwVfT.exe
  C:\Windows\System\YqkwVfT.exe
  2⤵
  PID:3908
- C:\Windows\System\zuceRwF.exe
  C:\Windows\System\zuceRwF.exe
  2⤵
  PID:3924
- C:\Windows\System\jRghIFK.exe
  C:\Windows\System\jRghIFK.exe
  2⤵
  PID:3944
- C:\Windows\System\qigphEX.exe
  C:\Windows\System\qigphEX.exe
  2⤵
  PID:3960
- C:\Windows\System\ZjavBXe.exe
  C:\Windows\System\ZjavBXe.exe
  2⤵
  PID:3976
- C:\Windows\System\RtHwWqT.exe
  C:\Windows\System\RtHwWqT.exe
  2⤵
  PID:3992
- C:\Windows\System\ApEIzOC.exe
  C:\Windows\System\ApEIzOC.exe
  2⤵
  PID:4008
- C:\Windows\System\LkkAcQj.exe
  C:\Windows\System\LkkAcQj.exe
  2⤵
  PID:4024
- C:\Windows\System\GjBFzOP.exe
  C:\Windows\System\GjBFzOP.exe
  2⤵
  PID:4044
- C:\Windows\System\IeevRnY.exe
  C:\Windows\System\IeevRnY.exe
  2⤵
  PID:4060
- C:\Windows\System\qvZvCqw.exe
  C:\Windows\System\qvZvCqw.exe
  2⤵
  PID:4076
- C:\Windows\System\ONbUpac.exe
  C:\Windows\System\ONbUpac.exe
  2⤵
  PID:4092
- C:\Windows\System\tqDvDpG.exe
  C:\Windows\System\tqDvDpG.exe
  2⤵
  PID:2856
- C:\Windows\System\iXYhchJ.exe
  C:\Windows\System\iXYhchJ.exe
  2⤵
  PID:444
- C:\Windows\System\uUbpzNK.exe
  C:\Windows\System\uUbpzNK.exe
  2⤵
  PID:836
- C:\Windows\System\IOTmUse.exe
  C:\Windows\System\IOTmUse.exe
  2⤵
  PID:316
- C:\Windows\System\InURkOD.exe
  C:\Windows\System\InURkOD.exe
  2⤵
  PID:1180
- C:\Windows\System\aPNjuFm.exe
  C:\Windows\System\aPNjuFm.exe
  2⤵
  PID:372
- C:\Windows\System\ZYQOVtk.exe
  C:\Windows\System\ZYQOVtk.exe
  2⤵
  PID:760
- C:\Windows\System\CYKRPsV.exe
  C:\Windows\System\CYKRPsV.exe
  2⤵
  PID:2388
- C:\Windows\System\yGjVeFV.exe
  C:\Windows\System\yGjVeFV.exe
  2⤵
  PID:3180
- C:\Windows\System\HmpDKuE.exe
  C:\Windows\System\HmpDKuE.exe
  2⤵
  PID:3284
- C:\Windows\System\SShKXCG.exe
  C:\Windows\System\SShKXCG.exe
  2⤵
  PID:3352
- C:\Windows\System\cCaHsPI.exe
  C:\Windows\System\cCaHsPI.exe
  2⤵
  PID:3364
- C:\Windows\System\AxQoeGY.exe
  C:\Windows\System\AxQoeGY.exe
  2⤵
  PID:1652
- C:\Windows\System\HcFSccV.exe
  C:\Windows\System\HcFSccV.exe
  2⤵
  PID:2300
- C:\Windows\System\ioxkdkv.exe
  C:\Windows\System\ioxkdkv.exe
  2⤵
  PID:2768
- C:\Windows\System\wHWjBtq.exe
  C:\Windows\System\wHWjBtq.exe
  2⤵
  PID:2112
- C:\Windows\System\ZXiUDOE.exe
  C:\Windows\System\ZXiUDOE.exe
  2⤵
  PID:2816
- C:\Windows\System\rzYCURS.exe
  C:\Windows\System\rzYCURS.exe
  2⤵
  PID:3160
- C:\Windows\System\sHONMwt.exe
  C:\Windows\System\sHONMwt.exe
  2⤵
  PID:3224
- C:\Windows\System\VmrngHR.exe
  C:\Windows\System\VmrngHR.exe
  2⤵
  PID:3240
- C:\Windows\System\HsBeLkG.exe
  C:\Windows\System\HsBeLkG.exe
  2⤵
  PID:3308
- C:\Windows\System\wGmJgkx.exe
  C:\Windows\System\wGmJgkx.exe
  2⤵
  PID:3332
- C:\Windows\System\jDYdsnJ.exe
  C:\Windows\System\jDYdsnJ.exe
  2⤵
  PID:3376
- C:\Windows\System\lyDyJlu.exe
  C:\Windows\System\lyDyJlu.exe
  2⤵
  PID:3448
- C:\Windows\System\SgSWDGo.exe
  C:\Windows\System\SgSWDGo.exe
  2⤵
  PID:3404
- C:\Windows\System\uqnTxdU.exe
  C:\Windows\System\uqnTxdU.exe
  2⤵
  PID:3676
- C:\Windows\System\XQWILvw.exe
  C:\Windows\System\XQWILvw.exe
  2⤵
  PID:3740
- C:\Windows\System\pQJVTqP.exe
  C:\Windows\System\pQJVTqP.exe
  2⤵
  PID:3776
- C:\Windows\System\FxAINJD.exe
  C:\Windows\System\FxAINJD.exe
  2⤵
  PID:3760
- C:\Windows\System\BYcZgUa.exe
  C:\Windows\System\BYcZgUa.exe
  2⤵
  PID:2820
- C:\Windows\System\IhxLPvt.exe
  C:\Windows\System\IhxLPvt.exe
  2⤵
  PID:3800
- C:\Windows\System\TYfmyLr.exe
  C:\Windows\System\TYfmyLr.exe
  2⤵
  PID:3804
- C:\Windows\System\CIBZdEY.exe
  C:\Windows\System\CIBZdEY.exe
  2⤵
  PID:1988
- C:\Windows\System\KDnsYos.exe
  C:\Windows\System\KDnsYos.exe
  2⤵
  PID:3884
- C:\Windows\System\zKmFXjv.exe
  C:\Windows\System\zKmFXjv.exe
  2⤵
  PID:3952
- C:\Windows\System\hzgIqCh.exe
  C:\Windows\System\hzgIqCh.exe
  2⤵
  PID:3984
- C:\Windows\System\GNnevyS.exe
  C:\Windows\System\GNnevyS.exe
  2⤵
  PID:4052
- C:\Windows\System\UKrqmLw.exe
  C:\Windows\System\UKrqmLw.exe
  2⤵
  PID:336
- C:\Windows\System\aBZDXma.exe
  C:\Windows\System\aBZDXma.exe
  2⤵
  PID:2896
- C:\Windows\System\BFYawUA.exe
  C:\Windows\System\BFYawUA.exe
  2⤵
  PID:2656
- C:\Windows\System\RxtbieM.exe
  C:\Windows\System\RxtbieM.exe
  2⤵
  PID:4004
- C:\Windows\System\LmnISIJ.exe
  C:\Windows\System\LmnISIJ.exe
  2⤵
  PID:3940
- C:\Windows\System\EMOJTyO.exe
  C:\Windows\System\EMOJTyO.exe
  2⤵
  PID:4072
- C:\Windows\System\LJXgwLC.exe
  C:\Windows\System\LJXgwLC.exe
  2⤵
  PID:1572
- C:\Windows\System\sQJcdqk.exe
  C:\Windows\System\sQJcdqk.exe
  2⤵
  PID:2220
- C:\Windows\System\NaTuYAm.exe
  C:\Windows\System\NaTuYAm.exe
  2⤵
  PID:1700
- C:\Windows\System\drmuDiG.exe
  C:\Windows\System\drmuDiG.exe
  2⤵
  PID:2232
- C:\Windows\System\uYoazbp.exe
  C:\Windows\System\uYoazbp.exe
  2⤵
  PID:1784
- C:\Windows\System\bvZahmQ.exe
  C:\Windows\System\bvZahmQ.exe
  2⤵
  PID:3128
- C:\Windows\System\hHjIkQH.exe
  C:\Windows\System\hHjIkQH.exe
  2⤵
  PID:3316
- C:\Windows\System\Fknnklj.exe
  C:\Windows\System\Fknnklj.exe
  2⤵
  PID:564
- C:\Windows\System\sBeANDf.exe
  C:\Windows\System\sBeANDf.exe
  2⤵
  PID:3472
- C:\Windows\System\OirOXIK.exe
  C:\Windows\System\OirOXIK.exe
  2⤵
  PID:3568
- C:\Windows\System\sZsMuMb.exe
  C:\Windows\System\sZsMuMb.exe
  2⤵
  PID:3176
- C:\Windows\System\lexFOKJ.exe
  C:\Windows\System\lexFOKJ.exe
  2⤵
  PID:3368
- C:\Windows\System\FnSFGwa.exe
  C:\Windows\System\FnSFGwa.exe
  2⤵
  PID:3644
- C:\Windows\System\ALiQOAo.exe
  C:\Windows\System\ALiQOAo.exe
  2⤵
  PID:3628
- C:\Windows\System\ryUsfqW.exe
  C:\Windows\System\ryUsfqW.exe
  2⤵
  PID:3400
- C:\Windows\System\UdPgpGh.exe
  C:\Windows\System\UdPgpGh.exe
  2⤵
  PID:3340
- C:\Windows\System\MoINjej.exe
  C:\Windows\System\MoINjej.exe
  2⤵
  PID:1916
- C:\Windows\System\TzYhGWI.exe
  C:\Windows\System\TzYhGWI.exe
  2⤵
  PID:3300
- C:\Windows\System\KxcAyeL.exe
  C:\Windows\System\KxcAyeL.exe
  2⤵
  PID:3192
- C:\Windows\System\aPSZKBm.exe
  C:\Windows\System\aPSZKBm.exe
  2⤵
  PID:3696
- C:\Windows\System\dCKVQhS.exe
  C:\Windows\System\dCKVQhS.exe
  2⤵
  PID:916
- C:\Windows\System\wsFkpAF.exe
  C:\Windows\System\wsFkpAF.exe
  2⤵
  PID:2824
- C:\Windows\System\jnQGccl.exe
  C:\Windows\System\jnQGccl.exe
  2⤵
  PID:3756
- C:\Windows\System\gGcsPuI.exe
  C:\Windows\System\gGcsPuI.exe
  2⤵
  PID:1640
- C:\Windows\System\tgEDnmZ.exe
  C:\Windows\System\tgEDnmZ.exe
  2⤵
  PID:3828
- C:\Windows\System\MAIXGqw.exe
  C:\Windows\System\MAIXGqw.exe
  2⤵
  PID:3904
- C:\Windows\System\udscSXD.exe
  C:\Windows\System\udscSXD.exe
  2⤵
  PID:3956
- C:\Windows\System\gDeOtyk.exe
  C:\Windows\System\gDeOtyk.exe
  2⤵
  PID:4084
- C:\Windows\System\gUYOBFL.exe
  C:\Windows\System\gUYOBFL.exe
  2⤵
  PID:1480
- C:\Windows\System\zoNipYR.exe
  C:\Windows\System\zoNipYR.exe
  2⤵
  PID:480
- C:\Windows\System\jkfqGCu.exe
  C:\Windows\System\jkfqGCu.exe
  2⤵
  PID:2760
- C:\Windows\System\VQyHpyY.exe
  C:\Windows\System\VQyHpyY.exe
  2⤵
  PID:1268
- C:\Windows\System\MmgJDXK.exe
  C:\Windows\System\MmgJDXK.exe
  2⤵
  PID:3236
- C:\Windows\System\xmuAtbR.exe
  C:\Windows\System\xmuAtbR.exe
  2⤵
  PID:3428
- C:\Windows\System\BSKRipX.exe
  C:\Windows\System\BSKRipX.exe
  2⤵
  PID:3452
- C:\Windows\System\uxptWCM.exe
  C:\Windows\System\uxptWCM.exe
  2⤵
  PID:4020
- C:\Windows\System\HFYvcMm.exe
  C:\Windows\System\HFYvcMm.exe
  2⤵
  PID:3084
- C:\Windows\System\EcfHoyt.exe
  C:\Windows\System\EcfHoyt.exe
  2⤵
  PID:2620
- C:\Windows\System\naGDYdl.exe
  C:\Windows\System\naGDYdl.exe
  2⤵
  PID:2032
- C:\Windows\System\PGNgWKK.exe
  C:\Windows\System\PGNgWKK.exe
  2⤵
  PID:4032
- C:\Windows\System\nHqdBiY.exe
  C:\Windows\System\nHqdBiY.exe
  2⤵
  PID:3900
- C:\Windows\System\aKARyli.exe
  C:\Windows\System\aKARyli.exe
  2⤵
  PID:2624
- C:\Windows\System\dhsWbeg.exe
  C:\Windows\System\dhsWbeg.exe
  2⤵
  PID:624
- C:\Windows\System\eTfmuBT.exe
  C:\Windows\System\eTfmuBT.exe
  2⤵
  PID:3916
- C:\Windows\System\bbWpTvg.exe
  C:\Windows\System\bbWpTvg.exe
  2⤵
  PID:3616
- C:\Windows\System\afyXeKB.exe
  C:\Windows\System\afyXeKB.exe
  2⤵
  PID:3392
- C:\Windows\System\slMKfFn.exe
  C:\Windows\System\slMKfFn.exe
  2⤵
  PID:2352
- C:\Windows\System\CZSvPma.exe
  C:\Windows\System\CZSvPma.exe
  2⤵
  PID:2024
- C:\Windows\System\EyaSKcU.exe
  C:\Windows\System\EyaSKcU.exe
  2⤵
  PID:2756
- C:\Windows\System\VdjNAeO.exe
  C:\Windows\System\VdjNAeO.exe
  2⤵
  PID:4088
- C:\Windows\System\OgOIzWv.exe
  C:\Windows\System\OgOIzWv.exe
  2⤵
  PID:2860
- C:\Windows\System\IOipHoV.exe
  C:\Windows\System\IOipHoV.exe
  2⤵
  PID:2688
- C:\Windows\System\NiugUIj.exe
  C:\Windows\System\NiugUIj.exe
  2⤵
  PID:3148
- C:\Windows\System\oliayyM.exe
  C:\Windows\System\oliayyM.exe
  2⤵
  PID:3584
- C:\Windows\System\IkUofxw.exe
  C:\Windows\System\IkUofxw.exe
  2⤵
  PID:3632
- C:\Windows\System\vQdAokx.exe
  C:\Windows\System\vQdAokx.exe
  2⤵
  PID:1664
- C:\Windows\System\BxpIkna.exe
  C:\Windows\System\BxpIkna.exe
  2⤵
  PID:3856
- C:\Windows\System\wNcAjCB.exe
  C:\Windows\System\wNcAjCB.exe
  2⤵
  PID:3796
- C:\Windows\System\VgNrLlS.exe
  C:\Windows\System\VgNrLlS.exe
  2⤵
  PID:3872
- C:\Windows\System\vcLjiyF.exe
  C:\Windows\System\vcLjiyF.exe
  2⤵
  PID:2176
- C:\Windows\System\wqSzkvZ.exe
  C:\Windows\System\wqSzkvZ.exe
  2⤵
  PID:3692
- C:\Windows\System\eMjTChR.exe
  C:\Windows\System\eMjTChR.exe
  2⤵
  PID:340
- C:\Windows\System\RwjHuhk.exe
  C:\Windows\System\RwjHuhk.exe
  2⤵
  PID:2244
- C:\Windows\System\qibLMwr.exe
  C:\Windows\System\qibLMwr.exe
  2⤵
  PID:3548
- C:\Windows\System\mXCOudh.exe
  C:\Windows\System\mXCOudh.exe
  2⤵
  PID:3820
- C:\Windows\System\RcRtJFZ.exe
  C:\Windows\System\RcRtJFZ.exe
  2⤵
  PID:3348
- C:\Windows\System\OKPdvEg.exe
  C:\Windows\System\OKPdvEg.exe
  2⤵
  PID:2928
- C:\Windows\System\GANssdK.exe
  C:\Windows\System\GANssdK.exe
  2⤵
  PID:2316
- C:\Windows\System\JIsykIR.exe
  C:\Windows\System\JIsykIR.exe
  2⤵
  PID:3660
- C:\Windows\System\qjRruuj.exe
  C:\Windows\System\qjRruuj.exe
  2⤵
  PID:3416
- C:\Windows\System\VjqFzuK.exe
  C:\Windows\System\VjqFzuK.exe
  2⤵
  PID:1428
- C:\Windows\System\ArYgppd.exe
  C:\Windows\System\ArYgppd.exe
  2⤵
  PID:3536
- C:\Windows\System\pNhNxyu.exe
  C:\Windows\System\pNhNxyu.exe
  2⤵
  PID:3436
- C:\Windows\System\VJtVxvY.exe
  C:\Windows\System\VJtVxvY.exe
  2⤵
  PID:4108
- C:\Windows\System\HBTnSWv.exe
  C:\Windows\System\HBTnSWv.exe
  2⤵
  PID:4124
- C:\Windows\System\APvxzUh.exe
  C:\Windows\System\APvxzUh.exe
  2⤵
  PID:4140
- C:\Windows\System\TTqadpR.exe
  C:\Windows\System\TTqadpR.exe
  2⤵
  PID:4196
- C:\Windows\System\TzgMfsW.exe
  C:\Windows\System\TzgMfsW.exe
  2⤵
  PID:4212
- C:\Windows\System\eEcJyPJ.exe
  C:\Windows\System\eEcJyPJ.exe
  2⤵
  PID:4232
- C:\Windows\System\YCccksN.exe
  C:\Windows\System\YCccksN.exe
  2⤵
  PID:4248
- C:\Windows\System\iuNRQwC.exe
  C:\Windows\System\iuNRQwC.exe
  2⤵
  PID:4264
- C:\Windows\System\XcLAujr.exe
  C:\Windows\System\XcLAujr.exe
  2⤵
  PID:4280
- C:\Windows\System\mFvygrR.exe
  C:\Windows\System\mFvygrR.exe
  2⤵
  PID:4300
- C:\Windows\System\COBGvpE.exe
  C:\Windows\System\COBGvpE.exe
  2⤵
  PID:4320
- C:\Windows\System\AmMYJVa.exe
  C:\Windows\System\AmMYJVa.exe
  2⤵
  PID:4364
- C:\Windows\System\OLCyTIl.exe
  C:\Windows\System\OLCyTIl.exe
  2⤵
  PID:4384
- C:\Windows\System\EPbkiZI.exe
  C:\Windows\System\EPbkiZI.exe
  2⤵
  PID:4400
- C:\Windows\System\RGZWkPv.exe
  C:\Windows\System\RGZWkPv.exe
  2⤵
  PID:4416
- C:\Windows\System\iPwRfAf.exe
  C:\Windows\System\iPwRfAf.exe
  2⤵
  PID:4436
- C:\Windows\System\KsbetoW.exe
  C:\Windows\System\KsbetoW.exe
  2⤵
  PID:4452
- C:\Windows\System\nLcEmGD.exe
  C:\Windows\System\nLcEmGD.exe
  2⤵
  PID:4468
- C:\Windows\System\wjlnPjG.exe
  C:\Windows\System\wjlnPjG.exe
  2⤵
  PID:4536
- C:\Windows\System\gzuRaxs.exe
  C:\Windows\System\gzuRaxs.exe
  2⤵
  PID:4592
- C:\Windows\System\ZNdxuXX.exe
  C:\Windows\System\ZNdxuXX.exe
  2⤵
  PID:4620
- C:\Windows\System\HoebivT.exe
  C:\Windows\System\HoebivT.exe
  2⤵
  PID:4636
- C:\Windows\System\HnSqvaS.exe
  C:\Windows\System\HnSqvaS.exe
  2⤵
  PID:4652
- C:\Windows\System\bzWgDVm.exe
  C:\Windows\System\bzWgDVm.exe
  2⤵
  PID:4668
- C:\Windows\System\mGwTFhc.exe
  C:\Windows\System\mGwTFhc.exe
  2⤵
  PID:4692
- C:\Windows\System\aHqcYjX.exe
  C:\Windows\System\aHqcYjX.exe
  2⤵
  PID:4716
- C:\Windows\System\ffRMOoA.exe
  C:\Windows\System\ffRMOoA.exe
  2⤵
  PID:4732
- C:\Windows\System\OVkgLVR.exe
  C:\Windows\System\OVkgLVR.exe
  2⤵
  PID:4756
- C:\Windows\System\lzTvwFh.exe
  C:\Windows\System\lzTvwFh.exe
  2⤵
  PID:4792
- C:\Windows\System\eYlWReo.exe
  C:\Windows\System\eYlWReo.exe
  2⤵
  PID:4808
- C:\Windows\System\pugIdUp.exe
  C:\Windows\System\pugIdUp.exe
  2⤵
  PID:4824
- C:\Windows\System\RWJznxS.exe
  C:\Windows\System\RWJznxS.exe
  2⤵
  PID:4840
- C:\Windows\System\jjHPeJf.exe
  C:\Windows\System\jjHPeJf.exe
  2⤵
  PID:4860
- C:\Windows\System\OEsVUEN.exe
  C:\Windows\System\OEsVUEN.exe
  2⤵
  PID:4876
- C:\Windows\System\ULpOSeY.exe
  C:\Windows\System\ULpOSeY.exe
  2⤵
  PID:4892
- C:\Windows\System\HqjvNHa.exe
  C:\Windows\System\HqjvNHa.exe
  2⤵
  PID:4908
- C:\Windows\System\tfPsqhn.exe
  C:\Windows\System\tfPsqhn.exe
  2⤵
  PID:4928
- C:\Windows\System\jmckSxz.exe
  C:\Windows\System\jmckSxz.exe
  2⤵
  PID:4944
- C:\Windows\System\GfpDpcL.exe
  C:\Windows\System\GfpDpcL.exe
  2⤵
  PID:4960
- C:\Windows\System\ovjMGku.exe
  C:\Windows\System\ovjMGku.exe
  2⤵
  PID:5036
- C:\Windows\System\kLKQHPI.exe
  C:\Windows\System\kLKQHPI.exe
  2⤵
  PID:5056
- C:\Windows\System\LAMTMws.exe
  C:\Windows\System\LAMTMws.exe
  2⤵
  PID:5080
- C:\Windows\System\mUHAwPj.exe
  C:\Windows\System\mUHAwPj.exe
  2⤵
  PID:5096
- C:\Windows\System\wNfgIbX.exe
  C:\Windows\System\wNfgIbX.exe
  2⤵
  PID:5112
- C:\Windows\System\HmAJMhl.exe
  C:\Windows\System\HmAJMhl.exe
  2⤵
  PID:3836
- C:\Windows\System\bRsoOUK.exe
  C:\Windows\System\bRsoOUK.exe
  2⤵
  PID:3144
- C:\Windows\System\NFjOQFk.exe
  C:\Windows\System\NFjOQFk.exe
  2⤵
  PID:2788
- C:\Windows\System\yweiZJz.exe
  C:\Windows\System\yweiZJz.exe
  2⤵
  PID:4132
- C:\Windows\System\gVljTkT.exe
  C:\Windows\System\gVljTkT.exe
  2⤵
  PID:4172
- C:\Windows\System\cBiGKCo.exe
  C:\Windows\System\cBiGKCo.exe
  2⤵
  PID:4192
- C:\Windows\System\GfhAYZL.exe
  C:\Windows\System\GfhAYZL.exe
  2⤵
  PID:4316
- C:\Windows\System\Obwhsgl.exe
  C:\Windows\System\Obwhsgl.exe
  2⤵
  PID:4224
- C:\Windows\System\LNRDlOh.exe
  C:\Windows\System\LNRDlOh.exe
  2⤵
  PID:4296
- C:\Windows\System\fKOOZBj.exe
  C:\Windows\System\fKOOZBj.exe
  2⤵
  PID:4356
- C:\Windows\System\ybvhZVb.exe
  C:\Windows\System\ybvhZVb.exe
  2⤵
  PID:4372
- C:\Windows\System\NqKcSZH.exe
  C:\Windows\System\NqKcSZH.exe
  2⤵
  PID:4412
- C:\Windows\System\UqPivtr.exe
  C:\Windows\System\UqPivtr.exe
  2⤵
  PID:4392
- C:\Windows\System\YnorgBF.exe
  C:\Windows\System\YnorgBF.exe
  2⤵
  PID:4460
- C:\Windows\System\jbmcgvE.exe
  C:\Windows\System\jbmcgvE.exe
  2⤵
  PID:4496
- C:\Windows\System\XfTQTRl.exe
  C:\Windows\System\XfTQTRl.exe
  2⤵
  PID:4492
- C:\Windows\System\JOVNnyn.exe
  C:\Windows\System\JOVNnyn.exe
  2⤵
  PID:4512
- C:\Windows\System\mEwsJYS.exe
  C:\Windows\System\mEwsJYS.exe
  2⤵
  PID:4528
- C:\Windows\System\YXnnvnC.exe
  C:\Windows\System\YXnnvnC.exe
  2⤵
  PID:4576
- C:\Windows\System\WnZEXND.exe
  C:\Windows\System\WnZEXND.exe
  2⤵
  PID:4568
- C:\Windows\System\mLzoZxP.exe
  C:\Windows\System\mLzoZxP.exe
  2⤵
  PID:4676
- C:\Windows\System\wpOrYeE.exe
  C:\Windows\System\wpOrYeE.exe
  2⤵
  PID:4704
- C:\Windows\System\ySrtYiQ.exe
  C:\Windows\System\ySrtYiQ.exe
  2⤵
  PID:4728
- C:\Windows\System\NRUnxMF.exe
  C:\Windows\System\NRUnxMF.exe
  2⤵
  PID:4768
- C:\Windows\System\kCaVnjO.exe
  C:\Windows\System\kCaVnjO.exe
  2⤵
  PID:4832
- C:\Windows\System\diclGtd.exe
  C:\Windows\System\diclGtd.exe
  2⤵
  PID:4836
- C:\Windows\System\cxBVWwa.exe
  C:\Windows\System\cxBVWwa.exe
  2⤵
  PID:4888
- C:\Windows\System\jwVlyrB.exe
  C:\Windows\System\jwVlyrB.exe
  2⤵
  PID:4980
- C:\Windows\System\AxSJTcn.exe
  C:\Windows\System\AxSJTcn.exe
  2⤵
  PID:4996
- C:\Windows\System\lIhAkNo.exe
  C:\Windows\System\lIhAkNo.exe
  2⤵
  PID:4700
- C:\Windows\System\BIdPVSH.exe
  C:\Windows\System\BIdPVSH.exe
  2⤵
  PID:5076
- C:\Windows\System\zyomKOy.exe
  C:\Windows\System\zyomKOy.exe
  2⤵
  PID:5108
- C:\Windows\System\uOHTHdr.exe
  C:\Windows\System\uOHTHdr.exe
  2⤵
  PID:3552
- C:\Windows\System\hwIoJgQ.exe
  C:\Windows\System\hwIoJgQ.exe
  2⤵
  PID:4148
- C:\Windows\System\dSzHWgz.exe
  C:\Windows\System\dSzHWgz.exe
  2⤵
  PID:3968
- C:\Windows\System\huGHciG.exe
  C:\Windows\System\huGHciG.exe
  2⤵
  PID:4168
- C:\Windows\System\mtLXpjk.exe
  C:\Windows\System\mtLXpjk.exe
  2⤵
  PID:4276
- C:\Windows\System\RoLbVBY.exe
  C:\Windows\System\RoLbVBY.exe
  2⤵
  PID:4288
- C:\Windows\System\uNYJUrG.exe
  C:\Windows\System\uNYJUrG.exe
  2⤵
  PID:4352
- C:\Windows\System\sPxnBpV.exe
  C:\Windows\System\sPxnBpV.exe
  2⤵
  PID:4548
- C:\Windows\System\RuJBZOG.exe
  C:\Windows\System\RuJBZOG.exe
  2⤵
  PID:4476
- C:\Windows\System\NURcjOm.exe
  C:\Windows\System\NURcjOm.exe
  2⤵
  PID:4348
- C:\Windows\System\mqZItEC.exe
  C:\Windows\System\mqZItEC.exe
  2⤵
  PID:4480
- C:\Windows\System\QTlRxkE.exe
  C:\Windows\System\QTlRxkE.exe
  2⤵
  PID:4360
- C:\Windows\System\bXSnnpX.exe
  C:\Windows\System\bXSnnpX.exe
  2⤵
  PID:4660
- C:\Windows\System\JenMgjx.exe
  C:\Windows\System\JenMgjx.exe
  2⤵
  PID:4580
- C:\Windows\System\hQMehFa.exe
  C:\Windows\System\hQMehFa.exe
  2⤵
  PID:4648
- C:\Windows\System\AgNXsYo.exe
  C:\Windows\System\AgNXsYo.exe
  2⤵
  PID:4764
- C:\Windows\System\pkjYrTV.exe
  C:\Windows\System\pkjYrTV.exe
  2⤵
  PID:4788
- C:\Windows\System\mdEdXlO.exe
  C:\Windows\System\mdEdXlO.exe
  2⤵
  PID:4188
- C:\Windows\System\vJLBiBX.exe
  C:\Windows\System\vJLBiBX.exe
  2⤵
  PID:4936
- C:\Windows\System\xnnCBYl.exe
  C:\Windows\System\xnnCBYl.exe
  2⤵
  PID:4952
- C:\Windows\System\zVjfbFV.exe
  C:\Windows\System\zVjfbFV.exe
  2⤵
  PID:4916
- C:\Windows\System\QhdSvkB.exe
  C:\Windows\System\QhdSvkB.exe
  2⤵
  PID:4816
- C:\Windows\System\lBWWnNy.exe
  C:\Windows\System\lBWWnNy.exe
  2⤵
  PID:5068
- C:\Windows\System\POMTYaz.exe
  C:\Windows\System\POMTYaz.exe
  2⤵
  PID:4100
- C:\Windows\System\ZCKEqwK.exe
  C:\Windows\System\ZCKEqwK.exe
  2⤵
  PID:4312
- C:\Windows\System\fSgXQOj.exe
  C:\Windows\System\fSgXQOj.exe
  2⤵
  PID:4504
- C:\Windows\System\GrAJYGn.exe
  C:\Windows\System\GrAJYGn.exe
  2⤵
  PID:4344
- C:\Windows\System\ZyGeFZB.exe
  C:\Windows\System\ZyGeFZB.exe
  2⤵
  PID:5092
- C:\Windows\System\vyxIunl.exe
  C:\Windows\System\vyxIunl.exe
  2⤵
  PID:4992
- C:\Windows\System\oBrwKtc.exe
  C:\Windows\System\oBrwKtc.exe
  2⤵
  PID:4532
- C:\Windows\System\tkjjceG.exe
  C:\Windows\System\tkjjceG.exe
  2⤵
  PID:4688
- C:\Windows\System\PNBzamn.exe
  C:\Windows\System\PNBzamn.exe
  2⤵
  PID:4748
- C:\Windows\System\ovYsxpa.exe
  C:\Windows\System\ovYsxpa.exe
  2⤵
  PID:4484
- C:\Windows\System\TRXsdwE.exe
  C:\Windows\System\TRXsdwE.exe
  2⤵
  PID:4804
- C:\Windows\System\nLqWhBK.exe
  C:\Windows\System\nLqWhBK.exe
  2⤵
  PID:4968
- C:\Windows\System\QSNUegI.exe
  C:\Windows\System\QSNUegI.exe
  2⤵
  PID:4340
- C:\Windows\System\UGPxbiF.exe
  C:\Windows\System\UGPxbiF.exe
  2⤵
  PID:1912
- C:\Windows\System\izrjOnc.exe
  C:\Windows\System\izrjOnc.exe
  2⤵
  PID:4272
- C:\Windows\System\WwKKFZZ.exe
  C:\Windows\System\WwKKFZZ.exe
  2⤵
  PID:4680
- C:\Windows\System\oGjqeYw.exe
  C:\Windows\System\oGjqeYw.exe
  2⤵
  PID:5044
- C:\Windows\System\yJfSEty.exe
  C:\Windows\System\yJfSEty.exe
  2⤵
  PID:4920
- C:\Windows\System\KIQdzuH.exe
  C:\Windows\System\KIQdzuH.exe
  2⤵
  PID:4292
- C:\Windows\System\puNMjwi.exe
  C:\Windows\System\puNMjwi.exe
  2⤵
  PID:4988
- C:\Windows\System\eLcOFXR.exe
  C:\Windows\System\eLcOFXR.exe
  2⤵
  PID:4572
- C:\Windows\System\DGGNYoT.exe
  C:\Windows\System\DGGNYoT.exe
  2⤵
  PID:4608
- C:\Windows\System\BNlPvQE.exe
  C:\Windows\System\BNlPvQE.exe
  2⤵
  PID:4152
- C:\Windows\System\aVErMPu.exe
  C:\Windows\System\aVErMPu.exe
  2⤵
  PID:5132
- C:\Windows\System\FebxVNv.exe
  C:\Windows\System\FebxVNv.exe
  2⤵
  PID:5148
- C:\Windows\System\RQMsIOX.exe
  C:\Windows\System\RQMsIOX.exe
  2⤵
  PID:5164
- C:\Windows\System\cRxrWof.exe
  C:\Windows\System\cRxrWof.exe
  2⤵
  PID:5180
- C:\Windows\System\gjLDSDR.exe
  C:\Windows\System\gjLDSDR.exe
  2⤵
  PID:5196
- C:\Windows\System\pAVLBio.exe
  C:\Windows\System\pAVLBio.exe
  2⤵
  PID:5212
- C:\Windows\System\qVdtPKF.exe
  C:\Windows\System\qVdtPKF.exe
  2⤵
  PID:5228
- C:\Windows\System\BOSaYoc.exe
  C:\Windows\System\BOSaYoc.exe
  2⤵
  PID:5244
- C:\Windows\System\RlpSQWA.exe
  C:\Windows\System\RlpSQWA.exe
  2⤵
  PID:5260
- C:\Windows\System\PAdyDrv.exe
  C:\Windows\System\PAdyDrv.exe
  2⤵
  PID:5276
- C:\Windows\System\HZrabjf.exe
  C:\Windows\System\HZrabjf.exe
  2⤵
  PID:5292
- C:\Windows\System\KoveTEi.exe
  C:\Windows\System\KoveTEi.exe
  2⤵
  PID:5308
- C:\Windows\System\MtGEezh.exe
  C:\Windows\System\MtGEezh.exe
  2⤵
  PID:5324
- C:\Windows\System\CBUGQCY.exe
  C:\Windows\System\CBUGQCY.exe
  2⤵
  PID:5340
- C:\Windows\System\NTChhgR.exe
  C:\Windows\System\NTChhgR.exe
  2⤵
  PID:5356
- C:\Windows\System\wMgYNhB.exe
  C:\Windows\System\wMgYNhB.exe
  2⤵
  PID:5372
- C:\Windows\System\KyZYvou.exe
  C:\Windows\System\KyZYvou.exe
  2⤵
  PID:5388
- C:\Windows\System\VDEddmJ.exe
  C:\Windows\System\VDEddmJ.exe
  2⤵
  PID:5420
- C:\Windows\System\AszAeAk.exe
  C:\Windows\System\AszAeAk.exe
  2⤵
  PID:5436
- C:\Windows\System\cXcYodM.exe
  C:\Windows\System\cXcYodM.exe
  2⤵
  PID:5452
- C:\Windows\System\InCKurO.exe
  C:\Windows\System\InCKurO.exe
  2⤵
  PID:5468
- C:\Windows\System\ecrxsCB.exe
  C:\Windows\System\ecrxsCB.exe
  2⤵
  PID:5484
- C:\Windows\System\ZbjpqKJ.exe
  C:\Windows\System\ZbjpqKJ.exe
  2⤵
  PID:5500
- C:\Windows\System\vOWVCTo.exe
  C:\Windows\System\vOWVCTo.exe
  2⤵
  PID:5516
- C:\Windows\System\Oeuatvi.exe
  C:\Windows\System\Oeuatvi.exe
  2⤵
  PID:5532
- C:\Windows\System\IoMixJt.exe
  C:\Windows\System\IoMixJt.exe
  2⤵
  PID:5548
- C:\Windows\System\amfgfld.exe
  C:\Windows\System\amfgfld.exe
  2⤵
  PID:5564
- C:\Windows\System\qLiJvVG.exe
  C:\Windows\System\qLiJvVG.exe
  2⤵
  PID:5580
- C:\Windows\System\BpdlAxs.exe
  C:\Windows\System\BpdlAxs.exe
  2⤵
  PID:5596
- C:\Windows\System\tOylHAm.exe
  C:\Windows\System\tOylHAm.exe
  2⤵
  PID:5612
- C:\Windows\System\LxVtiHN.exe
  C:\Windows\System\LxVtiHN.exe
  2⤵
  PID:5628
- C:\Windows\System\cOVHmLy.exe
  C:\Windows\System\cOVHmLy.exe
  2⤵
  PID:5644
- C:\Windows\System\xfOveQo.exe
  C:\Windows\System\xfOveQo.exe
  2⤵
  PID:5660
- C:\Windows\System\REIwmCm.exe
  C:\Windows\System\REIwmCm.exe
  2⤵
  PID:5792
- C:\Windows\System\mIBhyee.exe
  C:\Windows\System\mIBhyee.exe
  2⤵
  PID:5824
- C:\Windows\System\glKYUhR.exe
  C:\Windows\System\glKYUhR.exe
  2⤵
  PID:5884
- C:\Windows\System\NEPFYRY.exe
  C:\Windows\System\NEPFYRY.exe
  2⤵
  PID:6040
- C:\Windows\System\uUfJKZp.exe
  C:\Windows\System\uUfJKZp.exe
  2⤵
  PID:6056
- C:\Windows\System\nAAVOkX.exe
  C:\Windows\System\nAAVOkX.exe
  2⤵
  PID:6072
- C:\Windows\System\lOLePIk.exe
  C:\Windows\System\lOLePIk.exe
  2⤵
  PID:6088
- C:\Windows\System\ybmPPlg.exe
  C:\Windows\System\ybmPPlg.exe
  2⤵
  PID:6104
- C:\Windows\System\bXrNUAP.exe
  C:\Windows\System\bXrNUAP.exe
  2⤵
  PID:6124
- C:\Windows\System\nYgZChJ.exe
  C:\Windows\System\nYgZChJ.exe
  2⤵
  PID:1060
- C:\Windows\System\ZYWeizY.exe
  C:\Windows\System\ZYWeizY.exe
  2⤵
  PID:5144
- C:\Windows\System\ivclVLS.exe
  C:\Windows\System\ivclVLS.exe
  2⤵
  PID:4848
- C:\Windows\System\gNQEFfF.exe
  C:\Windows\System\gNQEFfF.exe
  2⤵
  PID:5128
- C:\Windows\System\dPOPACI.exe
  C:\Windows\System\dPOPACI.exe
  2⤵
  PID:5204
- C:\Windows\System\hgegKdy.exe
  C:\Windows\System\hgegKdy.exe
  2⤵
  PID:5236
- C:\Windows\System\LYKmvjK.exe
  C:\Windows\System\LYKmvjK.exe
  2⤵
  PID:5252
- C:\Windows\System\JWUIqTR.exe
  C:\Windows\System\JWUIqTR.exe
  2⤵
  PID:5332
- C:\Windows\System\HGHDySp.exe
  C:\Windows\System\HGHDySp.exe
  2⤵
  PID:5288
- C:\Windows\System\lMMgbyn.exe
  C:\Windows\System\lMMgbyn.exe
  2⤵
  PID:5364
- C:\Windows\System\UfRoAIS.exe
  C:\Windows\System\UfRoAIS.exe
  2⤵
  PID:5412
- C:\Windows\System\jUjuagm.exe
  C:\Windows\System\jUjuagm.exe
  2⤵
  PID:5384
- C:\Windows\System\TECYeWx.exe
  C:\Windows\System\TECYeWx.exe
  2⤵
  PID:5480
- C:\Windows\System\ESRyHmI.exe
  C:\Windows\System\ESRyHmI.exe
  2⤵
  PID:5544
- C:\Windows\System\ANFrumb.exe
  C:\Windows\System\ANFrumb.exe
  2⤵
  PID:5604
- C:\Windows\System\yxDEprh.exe
  C:\Windows\System\yxDEprh.exe
  2⤵
  PID:5460
- C:\Windows\System\ucbijhM.exe
  C:\Windows\System\ucbijhM.exe
  2⤵
  PID:5528
- C:\Windows\System\YsFbVcL.exe
  C:\Windows\System\YsFbVcL.exe
  2⤵
  PID:5620
- C:\Windows\System\nCnWzTv.exe
  C:\Windows\System\nCnWzTv.exe
  2⤵
  PID:5656
- C:\Windows\System\NwgRpGz.exe
  C:\Windows\System\NwgRpGz.exe
  2⤵
  PID:5752
- C:\Windows\System\lOxyBaL.exe
  C:\Windows\System\lOxyBaL.exe
  2⤵
  PID:5764
- C:\Windows\System\FjzZwni.exe
  C:\Windows\System\FjzZwni.exe
  2⤵
  PID:5776
- C:\Windows\System\XTCGckF.exe
  C:\Windows\System\XTCGckF.exe
  2⤵
  PID:5812
- C:\Windows\System\iHADMZc.exe
  C:\Windows\System\iHADMZc.exe
  2⤵
  PID:4900
- C:\Windows\System\bStTpXR.exe
  C:\Windows\System\bStTpXR.exe
  2⤵
  PID:5872
- C:\Windows\System\AVwGUkY.exe
  C:\Windows\System\AVwGUkY.exe
  2⤵
  PID:5896
- C:\Windows\System\XBzOETz.exe
  C:\Windows\System\XBzOETz.exe
  2⤵
  PID:5900
- C:\Windows\System\tISmybG.exe
  C:\Windows\System\tISmybG.exe
  2⤵
  PID:5924
- C:\Windows\System\WhABvei.exe
  C:\Windows\System\WhABvei.exe
  2⤵
  PID:5952
- C:\Windows\System\ykSKNdq.exe
  C:\Windows\System\ykSKNdq.exe
  2⤵
  PID:5964
- C:\Windows\System\ViOecKF.exe
  C:\Windows\System\ViOecKF.exe
  2⤵
  PID:5984
- C:\Windows\System\wMkDnVM.exe
  C:\Windows\System\wMkDnVM.exe
  2⤵
  PID:6004
- C:\Windows\System\QDHemNB.exe
  C:\Windows\System\QDHemNB.exe
  2⤵
  PID:6012
- C:\Windows\System\JQAXPgD.exe
  C:\Windows\System\JQAXPgD.exe
  2⤵
  PID:6028
- C:\Windows\System\oOwFYOr.exe
  C:\Windows\System\oOwFYOr.exe
  2⤵
  PID:6064
- C:\Windows\System\aWOmhTM.exe
  C:\Windows\System\aWOmhTM.exe
  2⤵
  PID:6096
- C:\Windows\System\pqbftXG.exe
  C:\Windows\System\pqbftXG.exe
  2⤵
  PID:6136
- C:\Windows\System\eFPjspo.exe
  C:\Windows\System\eFPjspo.exe
  2⤵
  PID:5140
- C:\Windows\System\gYzGcHC.exe
  C:\Windows\System\gYzGcHC.exe
  2⤵
  PID:5224
- C:\Windows\System\QYVbllT.exe
  C:\Windows\System\QYVbllT.exe
  2⤵
  PID:5540
- C:\Windows\System\oRJxYgr.exe
  C:\Windows\System\oRJxYgr.exe
  2⤵
  PID:5380
- C:\Windows\System\laLASrh.exe
  C:\Windows\System\laLASrh.exe
  2⤵
  PID:5492
- C:\Windows\System\vtZEwCs.exe
  C:\Windows\System\vtZEwCs.exe
  2⤵
  PID:5188
- C:\Windows\System\oRefsjZ.exe
  C:\Windows\System\oRefsjZ.exe
  2⤵
  PID:5636
- C:\Windows\System\oOsCBsc.exe
  C:\Windows\System\oOsCBsc.exe
  2⤵
  PID:5272
- C:\Windows\System\xKnhtpb.exe
  C:\Windows\System\xKnhtpb.exe
  2⤵
  PID:5672
- C:\Windows\System\nWHsqtL.exe
  C:\Windows\System\nWHsqtL.exe
  2⤵
  PID:5416
- C:\Windows\System\XqzDLsX.exe
  C:\Windows\System\XqzDLsX.exe
  2⤵
  PID:5680
- C:\Windows\System\ZsVEquh.exe
  C:\Windows\System\ZsVEquh.exe
  2⤵
  PID:5696
- C:\Windows\System\EiWRzKr.exe
  C:\Windows\System\EiWRzKr.exe
  2⤵
  PID:5716
- C:\Windows\System\LFxglNw.exe
  C:\Windows\System\LFxglNw.exe
  2⤵
  PID:5732
- C:\Windows\System\dUeJIFV.exe
  C:\Windows\System\dUeJIFV.exe
  2⤵
  PID:5748
- C:\Windows\System\fBByqJd.exe
  C:\Windows\System\fBByqJd.exe
  2⤵
  PID:5808
- C:\Windows\System\icUclxl.exe
  C:\Windows\System\icUclxl.exe
  2⤵
  PID:5804
- C:\Windows\System\zCXsQzr.exe
  C:\Windows\System\zCXsQzr.exe
  2⤵
  PID:5868
- C:\Windows\System\rSvMOiO.exe
  C:\Windows\System\rSvMOiO.exe
  2⤵
  PID:5880
- C:\Windows\System\RDmmxCQ.exe
  C:\Windows\System\RDmmxCQ.exe
  2⤵
  PID:5728
- C:\Windows\System\HkerhOs.exe
  C:\Windows\System\HkerhOs.exe
  2⤵
  PID:5336
- C:\Windows\System\CAnfMxv.exe
  C:\Windows\System\CAnfMxv.exe
  2⤵
  PID:5268
- C:\Windows\System\toGVjXp.exe
  C:\Windows\System\toGVjXp.exe
  2⤵
  PID:4464
- C:\Windows\System\ToJlntT.exe
  C:\Windows\System\ToJlntT.exe
  2⤵
  PID:6052
- C:\Windows\System\hlJjBjl.exe
  C:\Windows\System\hlJjBjl.exe
  2⤵
  PID:6008
- C:\Windows\System\iUwMuZj.exe
  C:\Windows\System\iUwMuZj.exe
  2⤵
  PID:5740
- C:\Windows\System\iShZXCJ.exe
  C:\Windows\System\iShZXCJ.exe
  2⤵
  PID:5772
- C:\Windows\System\CulKJft.exe
  C:\Windows\System\CulKJft.exe
  2⤵
  PID:5928
- C:\Windows\System\BCeRouW.exe
  C:\Windows\System\BCeRouW.exe
  2⤵
  PID:6020
- C:\Windows\System\Nlskzbv.exe
  C:\Windows\System\Nlskzbv.exe
  2⤵
  PID:5352
- C:\Windows\System\VbZTMnJ.exe
  C:\Windows\System\VbZTMnJ.exe
  2⤵
  PID:5904
- C:\Windows\System\LIikvRe.exe
  C:\Windows\System\LIikvRe.exe
  2⤵
  PID:5876
- C:\Windows\System\lDtFoUj.exe
  C:\Windows\System\lDtFoUj.exe
  2⤵
  PID:5976
- C:\Windows\System\GWvKLEG.exe
  C:\Windows\System\GWvKLEG.exe
  2⤵
  PID:5712
- C:\Windows\System\YZPzPsu.exe
  C:\Windows\System\YZPzPsu.exe
  2⤵
  PID:5192
- C:\Windows\System\LpkWGEX.exe
  C:\Windows\System\LpkWGEX.exe
  2⤵
  PID:5936
- C:\Windows\System\cCdohsX.exe
  C:\Windows\System\cCdohsX.exe
  2⤵
  PID:5688
- C:\Windows\System\BDsRciF.exe
  C:\Windows\System\BDsRciF.exe
  2⤵
  PID:5432
- C:\Windows\System\FcogKWA.exe
  C:\Windows\System\FcogKWA.exe
  2⤵
  PID:1496
- C:\Windows\System\hctqiGA.exe
  C:\Windows\System\hctqiGA.exe
  2⤵
  PID:5652
- C:\Windows\System\VqjLGZK.exe
  C:\Windows\System\VqjLGZK.exe
  2⤵
  PID:5524
- C:\Windows\System\MxDJiYG.exe
  C:\Windows\System\MxDJiYG.exe
  2⤵
  PID:5992
- C:\Windows\System\jCDhVCx.exe
  C:\Windows\System\jCDhVCx.exe
  2⤵
  PID:6148
- C:\Windows\System\kaZmBqy.exe
  C:\Windows\System\kaZmBqy.exe
  2⤵
  PID:6164
- C:\Windows\System\jQsqHLc.exe
  C:\Windows\System\jQsqHLc.exe
  2⤵
  PID:6180
- C:\Windows\System\xvZWlBv.exe
  C:\Windows\System\xvZWlBv.exe
  2⤵
  PID:6196
- C:\Windows\System\BXAvYJL.exe
  C:\Windows\System\BXAvYJL.exe
  2⤵
  PID:6212
- C:\Windows\System\bsZxFHw.exe
  C:\Windows\System\bsZxFHw.exe
  2⤵
  PID:6228
- C:\Windows\System\RfyhChD.exe
  C:\Windows\System\RfyhChD.exe
  2⤵
  PID:6248
- C:\Windows\System\ZXmVDio.exe
  C:\Windows\System\ZXmVDio.exe
  2⤵
  PID:6264
- C:\Windows\System\jRVoZHH.exe
  C:\Windows\System\jRVoZHH.exe
  2⤵
  PID:6280
- C:\Windows\System\vSSyZWP.exe
  C:\Windows\System\vSSyZWP.exe
  2⤵
  PID:6344
- C:\Windows\System\qAWZJaN.exe
  C:\Windows\System\qAWZJaN.exe
  2⤵
  PID:6360
- C:\Windows\System\qAYveaM.exe
  C:\Windows\System\qAYveaM.exe
  2⤵
  PID:6376
- C:\Windows\System\KDHpGKF.exe
  C:\Windows\System\KDHpGKF.exe
  2⤵
  PID:6396
- C:\Windows\System\OhTiFmd.exe
  C:\Windows\System\OhTiFmd.exe
  2⤵
  PID:6412
- C:\Windows\System\bMilTmW.exe
  C:\Windows\System\bMilTmW.exe
  2⤵
  PID:6428
- C:\Windows\System\Mrunjby.exe
  C:\Windows\System\Mrunjby.exe
  2⤵
  PID:6448
- C:\Windows\System\VxfqcWj.exe
  C:\Windows\System\VxfqcWj.exe
  2⤵
  PID:6464
- C:\Windows\System\SItXdjj.exe
  C:\Windows\System\SItXdjj.exe
  2⤵
  PID:6484
- C:\Windows\System\BcAkjqh.exe
  C:\Windows\System\BcAkjqh.exe
  2⤵
  PID:6500
- C:\Windows\System\jUfVbDQ.exe
  C:\Windows\System\jUfVbDQ.exe
  2⤵
  PID:6516
- C:\Windows\System\XlWXyNQ.exe
  C:\Windows\System\XlWXyNQ.exe
  2⤵
  PID:6532
- C:\Windows\System\AWMnzxt.exe
  C:\Windows\System\AWMnzxt.exe
  2⤵
  PID:6548
- C:\Windows\System\dfzLBje.exe
  C:\Windows\System\dfzLBje.exe
  2⤵
  PID:6572
- C:\Windows\System\gkgvSnn.exe
  C:\Windows\System\gkgvSnn.exe
  2⤵
  PID:6588
- C:\Windows\System\xPmcXDr.exe
  C:\Windows\System\xPmcXDr.exe
  2⤵
  PID:6604
- C:\Windows\System\ZxayPMe.exe
  C:\Windows\System\ZxayPMe.exe
  2⤵
  PID:6620
- C:\Windows\System\DPhkcxP.exe
  C:\Windows\System\DPhkcxP.exe
  2⤵
  PID:6640
- C:\Windows\System\KktXjEA.exe
  C:\Windows\System\KktXjEA.exe
  2⤵
  PID:6664
- C:\Windows\System\oBpBDhq.exe
  C:\Windows\System\oBpBDhq.exe
  2⤵
  PID:6748
- C:\Windows\System\HyJZGGS.exe
  C:\Windows\System\HyJZGGS.exe
  2⤵
  PID:6764
- C:\Windows\System\qyzfllM.exe
  C:\Windows\System\qyzfllM.exe
  2⤵
  PID:6780
- C:\Windows\System\NFqKSnJ.exe
  C:\Windows\System\NFqKSnJ.exe
  2⤵
  PID:6796
- C:\Windows\System\iusXThh.exe
  C:\Windows\System\iusXThh.exe
  2⤵
  PID:6812
- C:\Windows\System\VilogPu.exe
  C:\Windows\System\VilogPu.exe
  2⤵
  PID:6828
- C:\Windows\System\MjEiioE.exe
  C:\Windows\System\MjEiioE.exe
  2⤵
  PID:6844
- C:\Windows\System\FLWBcpc.exe
  C:\Windows\System\FLWBcpc.exe
  2⤵
  PID:6864
- C:\Windows\System\uxVCUnl.exe
  C:\Windows\System\uxVCUnl.exe
  2⤵
  PID:6880
- C:\Windows\System\TBFclmA.exe
  C:\Windows\System\TBFclmA.exe
  2⤵
  PID:6896
- C:\Windows\System\IOzTGjP.exe
  C:\Windows\System\IOzTGjP.exe
  2⤵
  PID:6912
- C:\Windows\System\KsmGloz.exe
  C:\Windows\System\KsmGloz.exe
  2⤵
  PID:6940
- C:\Windows\System\HkqSgGc.exe
  C:\Windows\System\HkqSgGc.exe
  2⤵
  PID:6956
- C:\Windows\System\JlRvTvi.exe
  C:\Windows\System\JlRvTvi.exe
  2⤵
  PID:6972
- C:\Windows\System\bnNuSAU.exe
  C:\Windows\System\bnNuSAU.exe
  2⤵
  PID:6988
- C:\Windows\System\aZpTiXl.exe
  C:\Windows\System\aZpTiXl.exe
  2⤵
  PID:7004
- C:\Windows\System\xzIAfXC.exe
  C:\Windows\System\xzIAfXC.exe
  2⤵
  PID:7024
- C:\Windows\System\rNOYFit.exe
  C:\Windows\System\rNOYFit.exe
  2⤵
  PID:7040
- C:\Windows\System\KtUXQld.exe
  C:\Windows\System\KtUXQld.exe
  2⤵
  PID:7076
- C:\Windows\System\HllAlzH.exe
  C:\Windows\System\HllAlzH.exe
  2⤵
  PID:7092
- C:\Windows\System\BSJjnWK.exe
  C:\Windows\System\BSJjnWK.exe
  2⤵
  PID:7108
- C:\Windows\System\ffNWUyy.exe
  C:\Windows\System\ffNWUyy.exe
  2⤵
  PID:7128
- C:\Windows\System\mYFoKKU.exe
  C:\Windows\System\mYFoKKU.exe
  2⤵
  PID:7144
- C:\Windows\System\oAFMLqv.exe
  C:\Windows\System\oAFMLqv.exe
  2⤵
  PID:4164
- C:\Windows\System\IsQFmni.exe
  C:\Windows\System\IsQFmni.exe
  2⤵
  PID:5944
- C:\Windows\System\xPInHOD.exe
  C:\Windows\System\xPInHOD.exe
  2⤵
  PID:5972
- C:\Windows\System\FgONbGL.exe
  C:\Windows\System\FgONbGL.exe
  2⤵
  PID:6188
- C:\Windows\System\qMbFhTH.exe
  C:\Windows\System\qMbFhTH.exe
  2⤵
  PID:6324
- C:\Windows\System\lQngGPh.exe
  C:\Windows\System\lQngGPh.exe
  2⤵
  PID:6312
- C:\Windows\System\JngFikL.exe
  C:\Windows\System\JngFikL.exe
  2⤵
  PID:6300
- C:\Windows\System\CLHUrvz.exe
  C:\Windows\System\CLHUrvz.exe
  2⤵
  PID:6256
- C:\Windows\System\GVdvOLW.exe
  C:\Windows\System\GVdvOLW.exe
  2⤵
  PID:6208
- C:\Windows\System\McAypEP.exe
  C:\Windows\System\McAypEP.exe
  2⤵
  PID:6024
- C:\Windows\System\wgNezQd.exe
  C:\Windows\System\wgNezQd.exe
  2⤵
  PID:5428
- C:\Windows\System\bzeGfzy.exe
  C:\Windows\System\bzeGfzy.exe
  2⤵
  PID:5856
- C:\Windows\System\KcgjKXq.exe
  C:\Windows\System\KcgjKXq.exe
  2⤵
  PID:6240
- C:\Windows\System\cIDfIPr.exe
  C:\Windows\System\cIDfIPr.exe
  2⤵
  PID:6356
- C:\Windows\System\HkWCrNp.exe
  C:\Windows\System\HkWCrNp.exe
  2⤵
  PID:6424
- C:\Windows\System\bLOltIG.exe
  C:\Windows\System\bLOltIG.exe
  2⤵
  PID:6492
- C:\Windows\System\nRwIxGi.exe
  C:\Windows\System\nRwIxGi.exe
  2⤵
  PID:6564
- C:\Windows\System\LKqWCKT.exe
  C:\Windows\System\LKqWCKT.exe
  2⤵
  PID:6636
- C:\Windows\System\cfWfeIB.exe
  C:\Windows\System\cfWfeIB.exe
  2⤵
  PID:6436
- C:\Windows\System\VEtDOiK.exe
  C:\Windows\System\VEtDOiK.exe
  2⤵
  PID:6368
- C:\Windows\System\FDIxddo.exe
  C:\Windows\System\FDIxddo.exe
  2⤵
  PID:6508
- C:\Windows\System\HHLGvsp.exe
  C:\Windows\System\HHLGvsp.exe
  2⤵
  PID:6648
- C:\Windows\System\UyMBZtl.exe
  C:\Windows\System\UyMBZtl.exe
  2⤵
  PID:6556
- C:\Windows\System\yeapFtE.exe
  C:\Windows\System\yeapFtE.exe
  2⤵
  PID:6512
- C:\Windows\System\YEdSnoT.exe
  C:\Windows\System\YEdSnoT.exe
  2⤵
  PID:6700
- C:\Windows\System\eGqZemk.exe
  C:\Windows\System\eGqZemk.exe
  2⤵
  PID:6716
- C:\Windows\System\xvvWwQn.exe
  C:\Windows\System\xvvWwQn.exe
  2⤵
  PID:6732
- C:\Windows\System\nULxnOq.exe
  C:\Windows\System\nULxnOq.exe
  2⤵
  PID:6756
- C:\Windows\System\siUwqqg.exe
  C:\Windows\System\siUwqqg.exe
  2⤵
  PID:6808
- C:\Windows\System\GbLjnmh.exe
  C:\Windows\System\GbLjnmh.exe
  2⤵
  PID:6772
- C:\Windows\System\WJWEsXS.exe
  C:\Windows\System\WJWEsXS.exe
  2⤵
  PID:6924
- C:\Windows\System\HyOZqMc.exe
  C:\Windows\System\HyOZqMc.exe
  2⤵
  PID:6852
- C:\Windows\System\GUquAYX.exe
  C:\Windows\System\GUquAYX.exe
  2⤵
  PID:6820
- C:\Windows\System\HAUXSIR.exe
  C:\Windows\System\HAUXSIR.exe
  2⤵
  PID:6932
- C:\Windows\System\UzyxHWj.exe
  C:\Windows\System\UzyxHWj.exe
  2⤵
  PID:7064
- C:\Windows\System\uqASrBr.exe
  C:\Windows\System\uqASrBr.exe
  2⤵
  PID:7032
- C:\Windows\System\BHTtaMo.exe
  C:\Windows\System\BHTtaMo.exe
  2⤵
  PID:7072
- C:\Windows\System\rkoajUl.exe
  C:\Windows\System\rkoajUl.exe
  2⤵
  PID:7136
- C:\Windows\System\rBNXgqW.exe
  C:\Windows\System\rBNXgqW.exe
  2⤵
  PID:6160
- C:\Windows\System\jcRVxNO.exe
  C:\Windows\System\jcRVxNO.exe
  2⤵
  PID:7152
- C:\Windows\System\dZqRQsf.exe
  C:\Windows\System\dZqRQsf.exe
  2⤵
  PID:7164
- C:\Windows\System\qEtwOIY.exe
  C:\Windows\System\qEtwOIY.exe
  2⤵
  PID:5404
- C:\Windows\System\trPWlOf.exe
  C:\Windows\System\trPWlOf.exe
  2⤵
  PID:6340
- C:\Windows\System\bANIKUA.exe
  C:\Windows\System\bANIKUA.exe
  2⤵
  PID:5768
- C:\Windows\System\mwQAKbn.exe
  C:\Windows\System\mwQAKbn.exe
  2⤵
  PID:6568
- C:\Windows\System\hSppESU.exe
  C:\Windows\System\hSppESU.exe
  2⤵
  PID:6372
- C:\Windows\System\YjPYNGH.exe
  C:\Windows\System\YjPYNGH.exe
  2⤵
  PID:6684
- C:\Windows\System\FPJjGvK.exe
  C:\Windows\System\FPJjGvK.exe
  2⤵
  PID:6740
- C:\Windows\System\biswoTm.exe
  C:\Windows\System\biswoTm.exe
  2⤵
  PID:6876
- C:\Windows\System\hSCLJPx.exe
  C:\Windows\System\hSCLJPx.exe
  2⤵
  PID:5256
- C:\Windows\System\qPGFICC.exe
  C:\Windows\System\qPGFICC.exe
  2⤵
  PID:6480
- C:\Windows\System\yGSdlzY.exe
  C:\Windows\System\yGSdlzY.exe
  2⤵
  PID:6696
- C:\Windows\System\HOoHNFs.exe
  C:\Windows\System\HOoHNFs.exe
  2⤵
  PID:5676
- C:\Windows\System\grTVXZW.exe
  C:\Windows\System\grTVXZW.exe
  2⤵
  PID:6888
- C:\Windows\System\ferEkhh.exe
  C:\Windows\System\ferEkhh.exe
  2⤵
  PID:7012
- C:\Windows\System\OcfVabt.exe
  C:\Windows\System\OcfVabt.exe
  2⤵
  PID:7056
- C:\Windows\System\TgmZtJm.exe
  C:\Windows\System\TgmZtJm.exe
  2⤵
  PID:7052
- C:\Windows\System\fhAUrfc.exe
  C:\Windows\System\fhAUrfc.exe
  2⤵
  PID:6968
- C:\Windows\System\CjdcxWj.exe
  C:\Windows\System\CjdcxWj.exe
  2⤵
  PID:7124
- C:\Windows\System\BKoVtHc.exe
  C:\Windows\System\BKoVtHc.exe
  2⤵
  PID:6220
- C:\Windows\System\SIcRQer.exe
  C:\Windows\System\SIcRQer.exe
  2⤵
  PID:7084
- C:\Windows\System\UWxHgOB.exe
  C:\Windows\System\UWxHgOB.exe
  2⤵
  PID:6292
- C:\Windows\System\aavzSKX.exe
  C:\Windows\System\aavzSKX.exe
  2⤵
  PID:6632
- C:\Windows\System\BcXvfwP.exe
  C:\Windows\System\BcXvfwP.exe
  2⤵
  PID:6628
- C:\Windows\System\LITLxZu.exe
  C:\Windows\System\LITLxZu.exe
  2⤵
  PID:6204
- C:\Windows\System\csSYldD.exe
  C:\Windows\System\csSYldD.exe
  2⤵
  PID:6236
- C:\Windows\System\WXyMuzq.exe
  C:\Windows\System\WXyMuzq.exe
  2⤵
  PID:6724
- C:\Windows\System\VSqTcEp.exe
  C:\Windows\System\VSqTcEp.exe
  2⤵
  PID:6352
- C:\Windows\System\ohatQvx.exe
  C:\Windows\System\ohatQvx.exe
  2⤵
  PID:7120
- C:\Windows\System\uRzwfGD.exe
  C:\Windows\System\uRzwfGD.exe
  2⤵
  PID:6612
- C:\Windows\System\sQfgGkz.exe
  C:\Windows\System\sQfgGkz.exe
  2⤵
  PID:6116
- C:\Windows\System\cLBpUYQ.exe
  C:\Windows\System\cLBpUYQ.exe
  2⤵
  PID:7160
- C:\Windows\System\eAaMqkm.exe
  C:\Windows\System\eAaMqkm.exe
  2⤵
  PID:6904
- C:\Windows\System\kDChIAb.exe
  C:\Windows\System\kDChIAb.exe
  2⤵
  PID:6392
- C:\Windows\System\yahUumV.exe
  C:\Windows\System\yahUumV.exe
  2⤵
  PID:6860
- C:\Windows\System\rRWUCYy.exe
  C:\Windows\System\rRWUCYy.exe
  2⤵
  PID:5640
- C:\Windows\System\tyTdynH.exe
  C:\Windows\System\tyTdynH.exe
  2⤵
  PID:6676
- C:\Windows\System\QPkIIvA.exe
  C:\Windows\System\QPkIIvA.exe
  2⤵
  PID:7060
- C:\Windows\System\YkeqAMM.exe
  C:\Windows\System\YkeqAMM.exe
  2⤵
  PID:7176
- C:\Windows\System\BBGhyRU.exe
  C:\Windows\System\BBGhyRU.exe
  2⤵
  PID:7192
- C:\Windows\System\BUYcuyr.exe
  C:\Windows\System\BUYcuyr.exe
  2⤵
  PID:7208
- C:\Windows\System\bMahkkP.exe
  C:\Windows\System\bMahkkP.exe
  2⤵
  PID:7224
- C:\Windows\System\hbPypbo.exe
  C:\Windows\System\hbPypbo.exe
  2⤵
  PID:7244
- C:\Windows\System\NGGojuI.exe
  C:\Windows\System\NGGojuI.exe
  2⤵
  PID:7260
- C:\Windows\System\vNGlUFZ.exe
  C:\Windows\System\vNGlUFZ.exe
  2⤵
  PID:7276
- C:\Windows\System\cLNDLpG.exe
  C:\Windows\System\cLNDLpG.exe
  2⤵
  PID:7300
- C:\Windows\System\PhehZiN.exe
  C:\Windows\System\PhehZiN.exe
  2⤵
  PID:7316
- C:\Windows\System\HLVUugL.exe
  C:\Windows\System\HLVUugL.exe
  2⤵
  PID:7332
- C:\Windows\System\KZgjtuF.exe
  C:\Windows\System\KZgjtuF.exe
  2⤵
  PID:7348
- C:\Windows\System\rzfYqGc.exe
  C:\Windows\System\rzfYqGc.exe
  2⤵
  PID:7364
- C:\Windows\System\kyMrAWk.exe
  C:\Windows\System\kyMrAWk.exe
  2⤵
  PID:7380
- C:\Windows\System\WepgpJA.exe
  C:\Windows\System\WepgpJA.exe
  2⤵
  PID:7396
- C:\Windows\System\tBRxFNL.exe
  C:\Windows\System\tBRxFNL.exe
  2⤵
  PID:7416
- C:\Windows\System\vfPOjJC.exe
  C:\Windows\System\vfPOjJC.exe
  2⤵
  PID:7432
- C:\Windows\System\jExtOzm.exe
  C:\Windows\System\jExtOzm.exe
  2⤵
  PID:7452
- C:\Windows\System\DYrGRcH.exe
  C:\Windows\System\DYrGRcH.exe
  2⤵
  PID:7468
- C:\Windows\System\EIaiGAN.exe
  C:\Windows\System\EIaiGAN.exe
  2⤵
  PID:7484
- C:\Windows\System\AmRYOdD.exe
  C:\Windows\System\AmRYOdD.exe
  2⤵
  PID:7500
- C:\Windows\System\zNIxoeY.exe
  C:\Windows\System\zNIxoeY.exe
  2⤵
  PID:7516
- C:\Windows\System\QbhHrev.exe
  C:\Windows\System\QbhHrev.exe
  2⤵
  PID:7536
- C:\Windows\System\weNSbDm.exe
  C:\Windows\System\weNSbDm.exe
  2⤵
  PID:7552
- C:\Windows\System\IdnaENH.exe
  C:\Windows\System\IdnaENH.exe
  2⤵
  PID:7568
- C:\Windows\System\ArLEyxO.exe
  C:\Windows\System\ArLEyxO.exe
  2⤵
  PID:7584
- C:\Windows\System\BEPZLLB.exe
  C:\Windows\System\BEPZLLB.exe
  2⤵
  PID:7600
- C:\Windows\System\HKPUnhk.exe
  C:\Windows\System\HKPUnhk.exe
  2⤵
  PID:7616
- C:\Windows\System\RPBeFQq.exe
  C:\Windows\System\RPBeFQq.exe
  2⤵
  PID:7632
- C:\Windows\System\vJixJta.exe
  C:\Windows\System\vJixJta.exe
  2⤵
  PID:7652
- C:\Windows\System\ITvGSvT.exe
  C:\Windows\System\ITvGSvT.exe
  2⤵
  PID:7668
- C:\Windows\System\AKkGmgG.exe
  C:\Windows\System\AKkGmgG.exe
  2⤵
  PID:7684
- C:\Windows\System\DUKFjSH.exe
  C:\Windows\System\DUKFjSH.exe
  2⤵
  PID:7788
- C:\Windows\System\fvQoyiI.exe
  C:\Windows\System\fvQoyiI.exe
  2⤵
  PID:7804
- C:\Windows\System\cPlxobM.exe
  C:\Windows\System\cPlxobM.exe
  2⤵
  PID:7820
- C:\Windows\System\QVeJeZS.exe
  C:\Windows\System\QVeJeZS.exe
  2⤵
  PID:7836
- C:\Windows\System\VhqzZHK.exe
  C:\Windows\System\VhqzZHK.exe
  2⤵
  PID:7856
- C:\Windows\System\ZZUvaVy.exe
  C:\Windows\System\ZZUvaVy.exe
  2⤵
  PID:7884
- C:\Windows\System\LCrolXX.exe
  C:\Windows\System\LCrolXX.exe
  2⤵
  PID:7904
- C:\Windows\System\BSRRxQZ.exe
  C:\Windows\System\BSRRxQZ.exe
  2⤵
  PID:7920
- C:\Windows\System\sYYzsUG.exe
  C:\Windows\System\sYYzsUG.exe
  2⤵
  PID:7936
- C:\Windows\System\LmomOgI.exe
  C:\Windows\System\LmomOgI.exe
  2⤵
  PID:7952
- C:\Windows\System\FxXVPQa.exe
  C:\Windows\System\FxXVPQa.exe
  2⤵
  PID:7968
- C:\Windows\System\fwtJCmh.exe
  C:\Windows\System\fwtJCmh.exe
  2⤵
  PID:7984
- C:\Windows\System\ruHrnkC.exe
  C:\Windows\System\ruHrnkC.exe
  2⤵
  PID:8000
- C:\Windows\System\ITgTGGz.exe
  C:\Windows\System\ITgTGGz.exe
  2⤵
  PID:8016
- C:\Windows\System\NUwFwPh.exe
  C:\Windows\System\NUwFwPh.exe
  2⤵
  PID:8036
- C:\Windows\System\eanKnbM.exe
  C:\Windows\System\eanKnbM.exe
  2⤵
  PID:8056
- C:\Windows\System\acShsFz.exe
  C:\Windows\System\acShsFz.exe
  2⤵
  PID:8072
- C:\Windows\System\ilgBwjV.exe
  C:\Windows\System\ilgBwjV.exe
  2⤵
  PID:8088
- C:\Windows\System\NXHWECz.exe
  C:\Windows\System\NXHWECz.exe
  2⤵
  PID:8104
- C:\Windows\System\RpVfEin.exe
  C:\Windows\System\RpVfEin.exe
  2⤵
  PID:8120
- C:\Windows\System\yIuzPst.exe
  C:\Windows\System\yIuzPst.exe
  2⤵
  PID:8140
- C:\Windows\System\XXxzhnQ.exe
  C:\Windows\System\XXxzhnQ.exe
  2⤵
  PID:8156
- C:\Windows\System\sdwvHgy.exe
  C:\Windows\System\sdwvHgy.exe
  2⤵
  PID:8176
- C:\Windows\System\ANrFSEr.exe
  C:\Windows\System\ANrFSEr.exe
  2⤵
  PID:6476
- C:\Windows\System\vzElJAQ.exe
  C:\Windows\System\vzElJAQ.exe
  2⤵
  PID:6964
- C:\Windows\System\FoxvtGI.exe
  C:\Windows\System\FoxvtGI.exe
  2⤵
  PID:7252
- C:\Windows\System\FXpFFyF.exe
  C:\Windows\System\FXpFFyF.exe
  2⤵
  PID:7328
- C:\Windows\System\aInOLPx.exe
  C:\Windows\System\aInOLPx.exe
  2⤵
  PID:7312
- C:\Windows\System\ihWACgv.exe
  C:\Windows\System\ihWACgv.exe
  2⤵
  PID:6528
- C:\Windows\System\XNSBzXz.exe
  C:\Windows\System\XNSBzXz.exe
  2⤵
  PID:7240
- C:\Windows\System\wVHfSVA.exe
  C:\Windows\System\wVHfSVA.exe
  2⤵
  PID:6656
- C:\Windows\System\GnxzxlM.exe
  C:\Windows\System\GnxzxlM.exe
  2⤵
  PID:7388
- C:\Windows\System\ovqrVrk.exe
  C:\Windows\System\ovqrVrk.exe
  2⤵
  PID:7376
- C:\Windows\System\mEVGpNg.exe
  C:\Windows\System\mEVGpNg.exe
  2⤵
  PID:7408
- C:\Windows\System\taWYiwm.exe
  C:\Windows\System\taWYiwm.exe
  2⤵
  PID:7464
- C:\Windows\System\mRQSFhL.exe
  C:\Windows\System\mRQSFhL.exe
  2⤵
  PID:7476
- C:\Windows\System\kptDGfA.exe
  C:\Windows\System\kptDGfA.exe
  2⤵
  PID:7544
- C:\Windows\System\mRZoZSh.exe
  C:\Windows\System\mRZoZSh.exe
  2⤵
  PID:7592
- C:\Windows\System\wemiGiU.exe
  C:\Windows\System\wemiGiU.exe
  2⤵
  PID:7580
- C:\Windows\System\WHqJKKb.exe
  C:\Windows\System\WHqJKKb.exe
  2⤵
  PID:7612
- C:\Windows\System\fFZCFdh.exe
  C:\Windows\System\fFZCFdh.exe
  2⤵
  PID:7660
- C:\Windows\System\omioUww.exe
  C:\Windows\System\omioUww.exe
  2⤵
  PID:7692
- C:\Windows\System\CrfwhFW.exe
  C:\Windows\System\CrfwhFW.exe
  2⤵
  PID:7700
- C:\Windows\System\ULyONqh.exe
  C:\Windows\System\ULyONqh.exe
  2⤵
  PID:7848
- C:\Windows\System\xwcciIN.exe
  C:\Windows\System\xwcciIN.exe
  2⤵
  PID:7864
- C:\Windows\System\yuVPOab.exe
  C:\Windows\System\yuVPOab.exe
  2⤵
  PID:7828
- C:\Windows\System\SwAdhDU.exe
  C:\Windows\System\SwAdhDU.exe
  2⤵
  PID:7900
- C:\Windows\System\YTVmvGa.exe
  C:\Windows\System\YTVmvGa.exe
  2⤵
  PID:7992
- C:\Windows\System\DbcwlYR.exe
  C:\Windows\System\DbcwlYR.exe
  2⤵
  PID:7964
- C:\Windows\System\qKTmclG.exe
  C:\Windows\System\qKTmclG.exe
  2⤵
  PID:8064
- C:\Windows\System\ApXbTNv.exe
  C:\Windows\System\ApXbTNv.exe
  2⤵
  PID:8136
- C:\Windows\System\imPQfvd.exe
  C:\Windows\System\imPQfvd.exe
  2⤵
  PID:6824
- C:\Windows\System\mblFmmB.exe
  C:\Windows\System\mblFmmB.exe
  2⤵
  PID:8044
- C:\Windows\System\yxPLniH.exe
  C:\Windows\System\yxPLniH.exe
  2⤵
  PID:8080
- C:\Windows\System\VUDuoqJ.exe
  C:\Windows\System\VUDuoqJ.exe
  2⤵
  PID:8116
- C:\Windows\System\pHJMLLR.exe
  C:\Windows\System\pHJMLLR.exe
  2⤵
  PID:7948
- C:\Windows\System\BDGtTMj.exe
  C:\Windows\System\BDGtTMj.exe
  2⤵
  PID:7256
- C:\Windows\System\qBUCHRH.exe
  C:\Windows\System\qBUCHRH.exe
  2⤵
  PID:7292
- C:\Windows\System\kvxGfBx.exe
  C:\Windows\System\kvxGfBx.exe
  2⤵
  PID:6672
- C:\Windows\System\EhBSLQo.exe
  C:\Windows\System\EhBSLQo.exe
  2⤵
  PID:7428
- C:\Windows\System\SoOlMdE.exe
  C:\Windows\System\SoOlMdE.exe
  2⤵
  PID:7448
- C:\Windows\System\cIWyGkY.exe
  C:\Windows\System\cIWyGkY.exe
  2⤵
  PID:7360
- C:\Windows\System\cDRHedE.exe
  C:\Windows\System\cDRHedE.exe
  2⤵
  PID:7204
- C:\Windows\System\PmIIFqF.exe
  C:\Windows\System\PmIIFqF.exe
  2⤵
  PID:7508
- C:\Windows\System\NKkDPNY.exe
  C:\Windows\System\NKkDPNY.exe
  2⤵
  PID:7628
- C:\Windows\System\trcEzjr.exe
  C:\Windows\System\trcEzjr.exe
  2⤵
  PID:7444
- C:\Windows\System\FWEuzsv.exe
  C:\Windows\System\FWEuzsv.exe
  2⤵
  PID:6804
- C:\Windows\System\pecYCqF.exe
  C:\Windows\System\pecYCqF.exe
  2⤵
  PID:7560
- C:\Windows\System\XooQcRz.exe
  C:\Windows\System\XooQcRz.exe
  2⤵
  PID:7712
- C:\Windows\System\kJiENHF.exe
  C:\Windows\System\kJiENHF.exe
  2⤵
  PID:7728
- C:\Windows\System\kYcuXGd.exe
  C:\Windows\System\kYcuXGd.exe
  2⤵
  PID:7752
- C:\Windows\System\tBozJUP.exe
  C:\Windows\System\tBozJUP.exe
  2⤵
  PID:7740
- C:\Windows\System\nGJvWlE.exe
  C:\Windows\System\nGJvWlE.exe
  2⤵
  PID:7812
- C:\Windows\System\AVrHLxx.exe
  C:\Windows\System\AVrHLxx.exe
  2⤵
  PID:7800
- C:\Windows\System\jdmNKZE.exe
  C:\Windows\System\jdmNKZE.exe
  2⤵
  PID:7960
- C:\Windows\System\yJIjFGK.exe
  C:\Windows\System\yJIjFGK.exe
  2⤵
  PID:8132
- C:\Windows\System\lKhfiDh.exe
  C:\Windows\System\lKhfiDh.exe
  2⤵
  PID:8012
- C:\Windows\System\qAToFAR.exe
  C:\Windows\System\qAToFAR.exe
  2⤵
  PID:8068
- C:\Windows\System\MjhbIrJ.exe
  C:\Windows\System\MjhbIrJ.exe
  2⤵
  PID:7980
- C:\Windows\System\UATzJkO.exe
  C:\Windows\System\UATzJkO.exe
  2⤵
  PID:7696
- C:\Windows\System\wjzKYrM.exe
  C:\Windows\System\wjzKYrM.exe
  2⤵
  PID:7236
- C:\Windows\System\snfCaRA.exe
  C:\Windows\System\snfCaRA.exe
  2⤵
  PID:7344
- C:\Windows\System\TqaGstD.exe
  C:\Windows\System\TqaGstD.exe
  2⤵
  PID:7216
- C:\Windows\System\nHcyNnz.exe
  C:\Windows\System\nHcyNnz.exe
  2⤵
  PID:7644
- C:\Windows\System\dKuaIkE.exe
  C:\Windows\System\dKuaIkE.exe
  2⤵
  PID:7708
- C:\Windows\System\LSIsPWR.exe
  C:\Windows\System\LSIsPWR.exe
  2⤵
  PID:5024
- C:\Windows\System\XxSxDAp.exe
  C:\Windows\System\XxSxDAp.exe
  2⤵
  PID:7720
- C:\Windows\System\NMnZQGO.exe
  C:\Windows\System\NMnZQGO.exe
  2⤵
  PID:7532
- C:\Windows\System\QamlxJf.exe
  C:\Windows\System\QamlxJf.exe
  2⤵
  PID:7796
- C:\Windows\System\oLtXssR.exe
  C:\Windows\System\oLtXssR.exe
  2⤵
  PID:7932
- C:\Windows\System\vFHWywH.exe
  C:\Windows\System\vFHWywH.exe
  2⤵
  PID:8112
- C:\Windows\System\dVSPuCK.exe
  C:\Windows\System\dVSPuCK.exe
  2⤵
  PID:8052
- C:\Windows\System\qSJmNCQ.exe
  C:\Windows\System\qSJmNCQ.exe
  2⤵
  PID:7440
- C:\Windows\System\kYczOLY.exe
  C:\Windows\System\kYczOLY.exe
  2⤵
  PID:7576
- C:\Windows\System\MxEFcwU.exe
  C:\Windows\System\MxEFcwU.exe
  2⤵
  PID:7892
- C:\Windows\System\sbFdEvV.exe
  C:\Windows\System\sbFdEvV.exe
  2⤵
  PID:7736
- C:\Windows\System\olFoBuu.exe
  C:\Windows\System\olFoBuu.exe
  2⤵
  PID:7780
- C:\Windows\System\fDOOOKB.exe
  C:\Windows\System\fDOOOKB.exe
  2⤵
  PID:7912
- C:\Windows\System\muXjCTq.exe
  C:\Windows\System\muXjCTq.exe
  2⤵
  PID:7784
- C:\Windows\System\SCFLtrx.exe
  C:\Windows\System\SCFLtrx.exe
  2⤵
  PID:7356
- C:\Windows\System\TaPuMXW.exe
  C:\Windows\System\TaPuMXW.exe
  2⤵
  PID:7460
- C:\Windows\System\bncIbUq.exe
  C:\Windows\System\bncIbUq.exe
  2⤵
  PID:7308
- C:\Windows\System\vKbrLok.exe
  C:\Windows\System\vKbrLok.exe
  2⤵
  PID:8196
- C:\Windows\System\vYYRgNR.exe
  C:\Windows\System\vYYRgNR.exe
  2⤵
  PID:8216
- C:\Windows\System\fbYzUsf.exe
  C:\Windows\System\fbYzUsf.exe
  2⤵
  PID:8232
- C:\Windows\System\OjIQfHN.exe
  C:\Windows\System\OjIQfHN.exe
  2⤵
  PID:8248
- C:\Windows\System\KPXbFEm.exe
  C:\Windows\System\KPXbFEm.exe
  2⤵
  PID:8264
- C:\Windows\System\lTCEypY.exe
  C:\Windows\System\lTCEypY.exe
  2⤵
  PID:8284
- C:\Windows\System\VgfMZAK.exe
  C:\Windows\System\VgfMZAK.exe
  2⤵
  PID:8300
- C:\Windows\System\AHDFmml.exe
  C:\Windows\System\AHDFmml.exe
  2⤵
  PID:8316
- C:\Windows\System\oQfwacn.exe
  C:\Windows\System\oQfwacn.exe
  2⤵
  PID:8332
- C:\Windows\System\lcfzhIW.exe
  C:\Windows\System\lcfzhIW.exe
  2⤵
  PID:8348
- C:\Windows\System\ChKohNL.exe
  C:\Windows\System\ChKohNL.exe
  2⤵
  PID:8364
- C:\Windows\System\jIssCAL.exe
  C:\Windows\System\jIssCAL.exe
  2⤵
  PID:8380
- C:\Windows\System\vNFRynX.exe
  C:\Windows\System\vNFRynX.exe
  2⤵
  PID:8396
- C:\Windows\System\ndsXcVQ.exe
  C:\Windows\System\ndsXcVQ.exe
  2⤵
  PID:8412
- C:\Windows\System\ebICxto.exe
  C:\Windows\System\ebICxto.exe
  2⤵
  PID:8428
- C:\Windows\System\wNjzbwB.exe
  C:\Windows\System\wNjzbwB.exe
  2⤵
  PID:8444
- C:\Windows\System\BHxPEGe.exe
  C:\Windows\System\BHxPEGe.exe
  2⤵
  PID:8460
- C:\Windows\System\fYEWyrE.exe
  C:\Windows\System\fYEWyrE.exe
  2⤵
  PID:8476
- C:\Windows\System\VbWhsfZ.exe
  C:\Windows\System\VbWhsfZ.exe
  2⤵
  PID:8492
- C:\Windows\System\ZqTfgTF.exe
  C:\Windows\System\ZqTfgTF.exe
  2⤵
  PID:8508
- C:\Windows\System\JFNWIgt.exe
  C:\Windows\System\JFNWIgt.exe
  2⤵
  PID:8524
- C:\Windows\System\SQoeNyj.exe
  C:\Windows\System\SQoeNyj.exe
  2⤵
  PID:8544
- C:\Windows\System\FtngezQ.exe
  C:\Windows\System\FtngezQ.exe
  2⤵
  PID:8560
- C:\Windows\System\dBuKhCl.exe
  C:\Windows\System\dBuKhCl.exe
  2⤵
  PID:8576
- C:\Windows\System\owRFRCU.exe
  C:\Windows\System\owRFRCU.exe
  2⤵
  PID:8592
- C:\Windows\System\MmhKQdp.exe
  C:\Windows\System\MmhKQdp.exe
  2⤵
  PID:8608
- C:\Windows\System\GifbJYT.exe
  C:\Windows\System\GifbJYT.exe
  2⤵
  PID:8624
- C:\Windows\System\oJiQwNu.exe
  C:\Windows\System\oJiQwNu.exe
  2⤵
  PID:8640
- C:\Windows\System\XMFcluP.exe
  C:\Windows\System\XMFcluP.exe
  2⤵
  PID:8656
- C:\Windows\System\dIgaTav.exe
  C:\Windows\System\dIgaTav.exe
  2⤵
  PID:8672
- C:\Windows\System\PiimAIt.exe
  C:\Windows\System\PiimAIt.exe
  2⤵
  PID:8688
- C:\Windows\System\aqxbWQX.exe
  C:\Windows\System\aqxbWQX.exe
  2⤵
  PID:8704
- C:\Windows\System\MrBJOgV.exe
  C:\Windows\System\MrBJOgV.exe
  2⤵
  PID:8720
- C:\Windows\System\bwaBNpx.exe
  C:\Windows\System\bwaBNpx.exe
  2⤵
  PID:8740
- C:\Windows\System\uYbmepC.exe
  C:\Windows\System\uYbmepC.exe
  2⤵
  PID:8756
- C:\Windows\System\HQFNkmd.exe
  C:\Windows\System\HQFNkmd.exe
  2⤵
  PID:8776
- C:\Windows\System\OAIsNQa.exe
  C:\Windows\System\OAIsNQa.exe
  2⤵
  PID:8792
- C:\Windows\System\FegwFhf.exe
  C:\Windows\System\FegwFhf.exe
  2⤵
  PID:8808
- C:\Windows\System\kCdjljc.exe
  C:\Windows\System\kCdjljc.exe
  2⤵
  PID:8824
- C:\Windows\System\cpPDehi.exe
  C:\Windows\System\cpPDehi.exe
  2⤵
  PID:8840
- C:\Windows\System\fTaXKlr.exe
  C:\Windows\System\fTaXKlr.exe
  2⤵
  PID:8856
- C:\Windows\System\AdjtWCI.exe
  C:\Windows\System\AdjtWCI.exe
  2⤵
  PID:8892
- C:\Windows\System\ZQdNDsP.exe
  C:\Windows\System\ZQdNDsP.exe
  2⤵
  PID:8908
- C:\Windows\System\zQRrgBr.exe
  C:\Windows\System\zQRrgBr.exe
  2⤵
  PID:8924
- C:\Windows\System\XboVsSE.exe
  C:\Windows\System\XboVsSE.exe
  2⤵
  PID:8940
- C:\Windows\System\ALIzAmV.exe
  C:\Windows\System\ALIzAmV.exe
  2⤵
  PID:8956
- C:\Windows\System\iQvFNJv.exe
  C:\Windows\System\iQvFNJv.exe
  2⤵
  PID:8976
- C:\Windows\System\LdsQmEY.exe
  C:\Windows\System\LdsQmEY.exe
  2⤵
  PID:8992
- C:\Windows\System\NeBlZLT.exe
  C:\Windows\System\NeBlZLT.exe
  2⤵
  PID:9008
- C:\Windows\System\hDKJVqC.exe
  C:\Windows\System\hDKJVqC.exe
  2⤵
  PID:9024
- C:\Windows\System\UKoWWJd.exe
  C:\Windows\System\UKoWWJd.exe
  2⤵
  PID:9040
- C:\Windows\System\VtTfWcn.exe
  C:\Windows\System\VtTfWcn.exe
  2⤵
  PID:9060
- C:\Windows\System\SLVTGgy.exe
  C:\Windows\System\SLVTGgy.exe
  2⤵
  PID:9076
- C:\Windows\System\hnwqScu.exe
  C:\Windows\System\hnwqScu.exe
  2⤵
  PID:9092
- C:\Windows\System\wefhHte.exe
  C:\Windows\System\wefhHte.exe
  2⤵
  PID:9108
- C:\Windows\System\FKKHSvA.exe
  C:\Windows\System\FKKHSvA.exe
  2⤵
  PID:9128
- C:\Windows\System\rfJEbWz.exe
  C:\Windows\System\rfJEbWz.exe
  2⤵
  PID:9148
- C:\Windows\System\cTUXzzY.exe
  C:\Windows\System\cTUXzzY.exe
  2⤵
  PID:9164
- C:\Windows\System\srATmsn.exe
  C:\Windows\System\srATmsn.exe
  2⤵
  PID:9180
- C:\Windows\System\ppCHSZm.exe
  C:\Windows\System\ppCHSZm.exe
  2⤵
  PID:9196
- C:\Windows\System\KmwrSga.exe
  C:\Windows\System\KmwrSga.exe
  2⤵
  PID:9212
- C:\Windows\System\rhTlTZe.exe
  C:\Windows\System\rhTlTZe.exe
  2⤵
  PID:8204
- C:\Windows\System\DVISRBJ.exe
  C:\Windows\System\DVISRBJ.exe
  2⤵
  PID:8256
- C:\Windows\System\fGTWagE.exe
  C:\Windows\System\fGTWagE.exe
  2⤵
  PID:8292
- C:\Windows\System\VgdipSh.exe
  C:\Windows\System\VgdipSh.exe
  2⤵
  PID:8356
- C:\Windows\System\ZsFhNBj.exe
  C:\Windows\System\ZsFhNBj.exe
  2⤵
  PID:8308
- C:\Windows\System\uuxSBGg.exe
  C:\Windows\System\uuxSBGg.exe
  2⤵
  PID:8244
- C:\Windows\System\ZPWzBby.exe
  C:\Windows\System\ZPWzBby.exe
  2⤵
  PID:8436
- C:\Windows\System\kFOfonn.exe
  C:\Windows\System\kFOfonn.exe
  2⤵
  PID:8420
- C:\Windows\System\KvqHNAW.exe
  C:\Windows\System\KvqHNAW.exe
  2⤵
  PID:8516
- C:\Windows\System\rrMAooE.exe
  C:\Windows\System\rrMAooE.exe
  2⤵
  PID:8584
- C:\Windows\System\qmhNYRV.exe
  C:\Windows\System\qmhNYRV.exe
  2⤵
  PID:8620
- C:\Windows\System\jxvitAB.exe
  C:\Windows\System\jxvitAB.exe
  2⤵
  PID:8712
- C:\Windows\System\cVbAWPT.exe
  C:\Windows\System\cVbAWPT.exe
  2⤵
  PID:8532
- C:\Windows\System\psAFeio.exe
  C:\Windows\System\psAFeio.exe
  2⤵
  PID:8572
- C:\Windows\System\xJzdPsI.exe
  C:\Windows\System\xJzdPsI.exe
  2⤵
  PID:8632
- C:\Windows\System\jMOiDKE.exe
  C:\Windows\System\jMOiDKE.exe
  2⤵
  PID:8468
- C:\Windows\System\pZWmgWO.exe
  C:\Windows\System\pZWmgWO.exe
  2⤵
  PID:8440
- C:\Windows\System\ISBfkgI.exe
  C:\Windows\System\ISBfkgI.exe
  2⤵
  PID:8816
- C:\Windows\System\uzPyZOm.exe
  C:\Windows\System\uzPyZOm.exe
  2⤵
  PID:8820
- C:\Windows\System\KTQOAcJ.exe
  C:\Windows\System\KTQOAcJ.exe
  2⤵
  PID:8764
- C:\Windows\System\XcSodFs.exe
  C:\Windows\System\XcSodFs.exe
  2⤵
  PID:8804
- C:\Windows\System\RnDsGhy.exe
  C:\Windows\System\RnDsGhy.exe
  2⤵
  PID:8880
- C:\Windows\System\uddtEJz.exe
  C:\Windows\System\uddtEJz.exe
  2⤵
  PID:8936
- C:\Windows\System\nXzrQBm.exe
  C:\Windows\System\nXzrQBm.exe
  2⤵
  PID:9000
- C:\Windows\System\GJbgcDo.exe
  C:\Windows\System\GJbgcDo.exe
  2⤵
  PID:8888
- C:\Windows\System\BlOLfLX.exe
  C:\Windows\System\BlOLfLX.exe
  2⤵
  PID:8920
- C:\Windows\System\iKuXueY.exe
  C:\Windows\System\iKuXueY.exe
  2⤵
  PID:8984
- C:\Windows\System\DuxOtWu.exe
  C:\Windows\System\DuxOtWu.exe
  2⤵
  PID:9136
- C:\Windows\System\HtyseJq.exe
  C:\Windows\System\HtyseJq.exe
  2⤵
  PID:9048
- C:\Windows\System\YjHBdpe.exe
  C:\Windows\System\YjHBdpe.exe
  2⤵
  PID:9140
- C:\Windows\System\BCHNApd.exe
  C:\Windows\System\BCHNApd.exe
  2⤵
  PID:9204
- C:\Windows\System\zNkFzZn.exe
  C:\Windows\System\zNkFzZn.exe
  2⤵
  PID:8228
- C:\Windows\System\mEgZGpD.exe
  C:\Windows\System\mEgZGpD.exe
  2⤵
  PID:8240
- C:\Windows\System\wDpHzXA.exe
  C:\Windows\System\wDpHzXA.exe
  2⤵
  PID:8556
- C:\Windows\System\wMVMUdz.exe
  C:\Windows\System\wMVMUdz.exe
  2⤵
  PID:9156
- C:\Windows\System\YXYPwpg.exe
  C:\Windows\System\YXYPwpg.exe
  2⤵
  PID:8568
- C:\Windows\System\KqifgDg.exe
  C:\Windows\System\KqifgDg.exe
  2⤵
  PID:8800
- C:\Windows\System\hYKyANR.exe
  C:\Windows\System\hYKyANR.exe
  2⤵
  PID:8736
- C:\Windows\System\oWOzctf.exe
  C:\Windows\System\oWOzctf.exe
  2⤵
  PID:8968
- C:\Windows\System\TKQEksF.exe
  C:\Windows\System\TKQEksF.exe
  2⤵
  PID:9032
- C:\Windows\System\MiAafza.exe
  C:\Windows\System\MiAafza.exe
  2⤵
  PID:8948
- C:\Windows\System\EMwrAjw.exe
  C:\Windows\System\EMwrAjw.exe
  2⤵
  PID:9176
- C:\Windows\System\yEsksGS.exe
  C:\Windows\System\yEsksGS.exe
  2⤵
  PID:8212
- C:\Windows\System\lZkRebg.exe
  C:\Windows\System\lZkRebg.exe
  2⤵
  PID:7876
- C:\Windows\System\lpRmYaX.exe
  C:\Windows\System\lpRmYaX.exe
  2⤵
  PID:8952
- C:\Windows\System\KxnZXYp.exe
  C:\Windows\System\KxnZXYp.exe
  2⤵
  PID:8696
- C:\Windows\System\ctKdQtu.exe
  C:\Windows\System\ctKdQtu.exe
  2⤵
  PID:8552
- C:\Windows\System\csEBQkR.exe
  C:\Windows\System\csEBQkR.exe
  2⤵
  PID:8684
- C:\Windows\System\hTAusdy.exe
  C:\Windows\System\hTAusdy.exe
  2⤵
  PID:8872
- C:\Windows\System\JgkouDX.exe
  C:\Windows\System\JgkouDX.exe
  2⤵
  PID:8636
- C:\Windows\System\jtVxzJK.exe
  C:\Windows\System\jtVxzJK.exe
  2⤵
  PID:9232
- C:\Windows\System\HhkLBNY.exe
  C:\Windows\System\HhkLBNY.exe
  2⤵
  PID:9256
- C:\Windows\System\hszdiSS.exe
  C:\Windows\System\hszdiSS.exe
  2⤵
  PID:9272
- C:\Windows\System\IzrOZhZ.exe
  C:\Windows\System\IzrOZhZ.exe
  2⤵
  PID:9288
- C:\Windows\System\LWkWNVm.exe
  C:\Windows\System\LWkWNVm.exe
  2⤵
  PID:9304
- C:\Windows\System\rwwEuBd.exe
  C:\Windows\System\rwwEuBd.exe
  2⤵
  PID:9320
- C:\Windows\System\zGILxhF.exe
  C:\Windows\System\zGILxhF.exe
  2⤵
  PID:9340
- C:\Windows\System\XNoUMlA.exe
  C:\Windows\System\XNoUMlA.exe
  2⤵
  PID:9356
- C:\Windows\System\yghintn.exe
  C:\Windows\System\yghintn.exe
  2⤵
  PID:9372
- C:\Windows\System\vlTqIcR.exe
  C:\Windows\System\vlTqIcR.exe
  2⤵
  PID:9388
- C:\Windows\System\muaNZwf.exe
  C:\Windows\System\muaNZwf.exe
  2⤵
  PID:9404
- C:\Windows\System\frzRMND.exe
  C:\Windows\System\frzRMND.exe
  2⤵
  PID:9420
- C:\Windows\System\oegfqpU.exe
  C:\Windows\System\oegfqpU.exe
  2⤵
  PID:9436
- C:\Windows\System\WkrqSKG.exe
  C:\Windows\System\WkrqSKG.exe
  2⤵
  PID:9456
- C:\Windows\System\TVRSbVS.exe
  C:\Windows\System\TVRSbVS.exe
  2⤵
  PID:9472
- C:\Windows\System\tHXlFLg.exe
  C:\Windows\System\tHXlFLg.exe
  2⤵
  PID:9488
- C:\Windows\System\SHLizQa.exe
  C:\Windows\System\SHLizQa.exe
  2⤵
  PID:9504
- C:\Windows\System\XaYyJHW.exe
  C:\Windows\System\XaYyJHW.exe
  2⤵
  PID:9520
- C:\Windows\System\BEtZidH.exe
  C:\Windows\System\BEtZidH.exe
  2⤵
  PID:9536
- C:\Windows\System\ZLGQffj.exe
  C:\Windows\System\ZLGQffj.exe
  2⤵
  PID:9552
- C:\Windows\System\XDSXfYE.exe
  C:\Windows\System\XDSXfYE.exe
  2⤵
  PID:9928
- C:\Windows\System\EDzDTTB.exe
  C:\Windows\System\EDzDTTB.exe
  2⤵
  PID:10032
- C:\Windows\System\PZOxySC.exe
  C:\Windows\System\PZOxySC.exe
  2⤵
  PID:10052
- C:\Windows\System\fpUMiRm.exe
  C:\Windows\System\fpUMiRm.exe
  2⤵
  PID:10068
- C:\Windows\System\QdgjHng.exe
  C:\Windows\System\QdgjHng.exe
  2⤵
  PID:10084
- C:\Windows\System\lXTZJrx.exe
  C:\Windows\System\lXTZJrx.exe
  2⤵
  PID:10100
- C:\Windows\System\wYHSzXI.exe
  C:\Windows\System\wYHSzXI.exe
  2⤵
  PID:10124
- C:\Windows\System\sQrpNiX.exe
  C:\Windows\System\sQrpNiX.exe
  2⤵
  PID:10140
- C:\Windows\System\BhhzUlC.exe
  C:\Windows\System\BhhzUlC.exe
  2⤵
  PID:10156
- C:\Windows\System\VHiwlCe.exe
  C:\Windows\System\VHiwlCe.exe
  2⤵
  PID:10176
- C:\Windows\System\dyYedvq.exe
  C:\Windows\System\dyYedvq.exe
  2⤵
  PID:9084
- C:\Windows\System\XAlRrJw.exe
  C:\Windows\System\XAlRrJw.exe
  2⤵
  PID:8616
- C:\Windows\System\fyYzovl.exe
  C:\Windows\System\fyYzovl.exe
  2⤵
  PID:8500
- C:\Windows\System\dEsgren.exe
  C:\Windows\System\dEsgren.exe
  2⤵
  PID:9228
- C:\Windows\System\MbrmskU.exe
  C:\Windows\System\MbrmskU.exe
  2⤵
  PID:8788
- C:\Windows\System\UNYNGGu.exe
  C:\Windows\System\UNYNGGu.exe
  2⤵
  PID:9100
- C:\Windows\System\NQenkNG.exe
  C:\Windows\System\NQenkNG.exe
  2⤵
  PID:9188
- C:\Windows\System\nXIonKU.exe
  C:\Windows\System\nXIonKU.exe
  2⤵
  PID:9244
- C:\Windows\System\jfHUlcc.exe
  C:\Windows\System\jfHUlcc.exe
  2⤵
  PID:9296
- C:\Windows\System\PQcqRUQ.exe
  C:\Windows\System\PQcqRUQ.exe
  2⤵
  PID:9336
- C:\Windows\System\mtQTxWZ.exe
  C:\Windows\System\mtQTxWZ.exe
  2⤵
  PID:9432
- C:\Windows\System\SVxBXBT.exe
  C:\Windows\System\SVxBXBT.exe
  2⤵
  PID:9348
- C:\Windows\System\Mstvcrj.exe
  C:\Windows\System\Mstvcrj.exe
  2⤵
  PID:9412
- C:\Windows\System\wyLyrib.exe
  C:\Windows\System\wyLyrib.exe
  2⤵
  PID:9512
- C:\Windows\System\HHTNjVa.exe
  C:\Windows\System\HHTNjVa.exe
  2⤵
  PID:9528
- C:\Windows\System\EhebgWw.exe
  C:\Windows\System\EhebgWw.exe
  2⤵
  PID:9580
- C:\Windows\System\psIzGzG.exe
  C:\Windows\System\psIzGzG.exe
  2⤵
  PID:9592
- C:\Windows\System\TXkolEz.exe
  C:\Windows\System\TXkolEz.exe
  2⤵
  PID:9600
- C:\Windows\System\trJvAAW.exe
  C:\Windows\System\trJvAAW.exe
  2⤵
  PID:9664
- C:\Windows\System\wlSPeuS.exe
  C:\Windows\System\wlSPeuS.exe
  2⤵
  PID:9660
- C:\Windows\System\TGlhLTE.exe
  C:\Windows\System\TGlhLTE.exe
  2⤵
  PID:9712
- C:\Windows\System\YhxkjMg.exe
  C:\Windows\System\YhxkjMg.exe
  2⤵
  PID:9676
- C:\Windows\System\WaxQgFR.exe
  C:\Windows\System\WaxQgFR.exe
  2⤵
  PID:9764
- C:\Windows\System\xzfYTpx.exe
  C:\Windows\System\xzfYTpx.exe
  2⤵
  PID:9788
- C:\Windows\System\DWFTOQj.exe
  C:\Windows\System\DWFTOQj.exe
  2⤵
  PID:9608
- C:\Windows\System\zydvWFh.exe
  C:\Windows\System\zydvWFh.exe
  2⤵
  PID:9728
- C:\Windows\System\PsaXsWQ.exe
  C:\Windows\System\PsaXsWQ.exe
  2⤵
  PID:9868
- C:\Windows\System\nEbenkE.exe
  C:\Windows\System\nEbenkE.exe
  2⤵
  PID:9896
- C:\Windows\System\UXRYljG.exe
  C:\Windows\System\UXRYljG.exe
  2⤵
  PID:9940
- C:\Windows\System\jLDMxLu.exe
  C:\Windows\System\jLDMxLu.exe
  2⤵
  PID:9924
- C:\Windows\System\zsJCJTb.exe
  C:\Windows\System\zsJCJTb.exe
  2⤵
  PID:9880
- C:\Windows\System\HYTszWD.exe
  C:\Windows\System\HYTszWD.exe
  2⤵
  PID:9856
- C:\Windows\System\aJUMqLO.exe
  C:\Windows\System\aJUMqLO.exe
  2⤵
  PID:9836
- C:\Windows\System\tQnQmWM.exe
  C:\Windows\System\tQnQmWM.exe
  2⤵
  PID:9808
- C:\Windows\System\niWBZuj.exe
  C:\Windows\System\niWBZuj.exe
  2⤵
  PID:8876
- C:\Windows\System\lEIYSuz.exe
  C:\Windows\System\lEIYSuz.exe
  2⤵
  PID:9956
- C:\Windows\System\sZyZDMv.exe
  C:\Windows\System\sZyZDMv.exe
  2⤵
  PID:9972
- C:\Windows\System\TtSQyDo.exe
  C:\Windows\System\TtSQyDo.exe
  2⤵
  PID:9988
- C:\Windows\System\mDceKHR.exe
  C:\Windows\System\mDceKHR.exe
  2⤵
  PID:10004
- C:\Windows\System\ekvhxQh.exe
  C:\Windows\System\ekvhxQh.exe
  2⤵
  PID:10020
- C:\Windows\System\ergfwpG.exe
  C:\Windows\System\ergfwpG.exe
  2⤵
  PID:10064
- C:\Windows\System\DYnPlmj.exe
  C:\Windows\System\DYnPlmj.exe
  2⤵
  PID:10136
- C:\Windows\System\KjVrHek.exe
  C:\Windows\System\KjVrHek.exe
  2⤵
  PID:10076
- C:\Windows\System\RlOWuVV.exe
  C:\Windows\System\RlOWuVV.exe
  2⤵
  PID:8404
- C:\Windows\System\hrmUHCS.exe
  C:\Windows\System\hrmUHCS.exe
  2⤵
  PID:9208
- C:\Windows\System\RkYsMld.exe
  C:\Windows\System\RkYsMld.exe
  2⤵
  PID:9240
- C:\Windows\System\BCJIFGG.exe
  C:\Windows\System\BCJIFGG.exe
  2⤵
  PID:9332
- C:\Windows\System\sOkOpRg.exe
  C:\Windows\System\sOkOpRg.exe
  2⤵
  PID:9444
- C:\Windows\System\idwNMxU.exe
  C:\Windows\System\idwNMxU.exe
  2⤵
  PID:9484
- C:\Windows\System\VJooirf.exe
  C:\Windows\System\VJooirf.exe
  2⤵
  PID:10236
- C:\Windows\System\NlzoeMu.exe
  C:\Windows\System\NlzoeMu.exe
  2⤵
  PID:9396
- C:\Windows\System\EyrFnqR.exe
  C:\Windows\System\EyrFnqR.exe
  2⤵
  PID:9380
- C:\Windows\System\veLRCjb.exe
  C:\Windows\System\veLRCjb.exe
  2⤵
  PID:9596
- C:\Windows\System\jsoPTnt.exe
  C:\Windows\System\jsoPTnt.exe
  2⤵
  PID:10108
- C:\Windows\System\GVUTxba.exe
  C:\Windows\System\GVUTxba.exe
  2⤵
  PID:10184
- C:\Windows\System\NXXLxxH.exe
  C:\Windows\System\NXXLxxH.exe
  2⤵
  PID:10200
- C:\Windows\System\foUNMTp.exe
  C:\Windows\System\foUNMTp.exe
  2⤵
  PID:8344
- C:\Windows\System\wOXEUkZ.exe
  C:\Windows\System\wOXEUkZ.exe
  2⤵
  PID:9612
- C:\Windows\System\ZWQXcRK.exe
  C:\Windows\System\ZWQXcRK.exe
  2⤵
  PID:9544
- C:\Windows\System\jiArnSA.exe
  C:\Windows\System\jiArnSA.exe
  2⤵
  PID:9620
- C:\Windows\System\NfZPkEx.exe
  C:\Windows\System\NfZPkEx.exe
  2⤵
  PID:9688
- C:\Windows\System\nxLbWtN.exe
  C:\Windows\System\nxLbWtN.exe
  2⤵
  PID:9704
- C:\Windows\System\eLOUUvJ.exe
  C:\Windows\System\eLOUUvJ.exe
  2⤵
  PID:9696
- C:\Windows\System\docuewZ.exe
  C:\Windows\System\docuewZ.exe
  2⤵
  PID:9876
- C:\Windows\System\WMsAgWh.exe
  C:\Windows\System\WMsAgWh.exe
  2⤵
  PID:9828
- C:\Windows\System\sZTKBLd.exe
  C:\Windows\System\sZTKBLd.exe
  2⤵
  PID:9948
- C:\Windows\System\ZeuJqeH.exe
  C:\Windows\System\ZeuJqeH.exe
  2⤵
  PID:9748
- C:\Windows\System\JqxbbuE.exe
  C:\Windows\System\JqxbbuE.exe
  2⤵
  PID:9888
- C:\Windows\System\rVaJTYR.exe
  C:\Windows\System\rVaJTYR.exe
  2⤵
  PID:9840
- C:\Windows\System\UUikESV.exe
  C:\Windows\System\UUikESV.exe
  2⤵
  PID:9916
- C:\Windows\System\yChFAZK.exe
  C:\Windows\System\yChFAZK.exe
  2⤵
  PID:9968
- C:\Windows\System\JrMVjZW.exe
  C:\Windows\System\JrMVjZW.exe
  2⤵
  PID:10132
- C:\Windows\System\HmTPDcz.exe
  C:\Windows\System\HmTPDcz.exe
  2⤵
  PID:8372
- C:\Windows\System\PaIJxFh.exe
  C:\Windows\System\PaIJxFh.exe
  2⤵
  PID:10172
- C:\Windows\System\CdxVZdu.exe
  C:\Windows\System\CdxVZdu.exe
  2⤵
  PID:10220
- C:\Windows\System\lKGiCrX.exe
  C:\Windows\System\lKGiCrX.exe
  2⤵
  PID:7768
- C:\Windows\System\eJmhKhF.exe
  C:\Windows\System\eJmhKhF.exe
  2⤵
  PID:9560
- C:\Windows\System\FxzcNti.exe
  C:\Windows\System\FxzcNti.exe
  2⤵
  PID:10048
- C:\Windows\System\TPhenPm.exe
  C:\Windows\System\TPhenPm.exe
  2⤵
  PID:10208
- C:\Windows\System\rkbhRQZ.exe
  C:\Windows\System\rkbhRQZ.exe
  2⤵
  PID:9264
- C:\Windows\System\hNmDsAQ.exe
  C:\Windows\System\hNmDsAQ.exe
  2⤵
  PID:9632
- C:\Windows\System\jepWznf.exe
  C:\Windows\System\jepWznf.exe
  2⤵
  PID:9104
- C:\Windows\System\KLxJCLn.exe
  C:\Windows\System\KLxJCLn.exe
  2⤵
  PID:8748
- C:\Windows\System\wTGVzRu.exe
  C:\Windows\System\wTGVzRu.exe
  2⤵
  PID:9576
- C:\Windows\System\maPkFLE.exe
  C:\Windows\System\maPkFLE.exe
  2⤵
  PID:9716
- C:\Windows\System\avxJMBt.exe
  C:\Windows\System\avxJMBt.exe
  2⤵
  PID:9680
- C:\Windows\System\GKjqfKI.exe
  C:\Windows\System\GKjqfKI.exe
  2⤵
  PID:9784
- C:\Windows\System\JMpMJPC.exe
  C:\Windows\System\JMpMJPC.exe
  2⤵
  PID:9860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GfcycqQ.exe

Filesize
2.3MB

MD5
fb340c9947aff0e371cbb8c0a0680323

SHA1
67eb975e12c2a0f7e0176516182b4ddf80808ca7

SHA256
e99a0d152a629584a2dd70de42e3e90f431f2822b2976aead0e6e2ef858dc8b2

SHA512
aae5aed23fe28366493876ce7453dd44d3fb5654128d26531d02d3bd2c60439cb22ed5f36e6ce5b41d0ce2b08439b804ed25be3c385316fea65f145d288d8ebd

Download Submit
C:\Windows\system\IbPCPmM.exe

Filesize
2.3MB

MD5
2bb9dee40945084bd612d14ebf486c2f

SHA1
1a82770b16d3a10e3f356254794e37c1da9661e5

SHA256
c34d39f3ef679f10a95eb1523bd6a5c5b56ed86ae5bf2f24e64116275346279f

SHA512
8046ee2168b01f8c45d59cec024c901e3226e125124168fb30175709a999d35965abb168924d372b9c30414d3012e89436aaf8b4ddd1b5036669c5e1644fb7c3

Download Submit
C:\Windows\system\JIFIvNJ.exe

Filesize
2.3MB

MD5
780f205729a18b287b7aea8abe8f7d2b

SHA1
07b85aa4879152f1dd6e5b8c07a79bd2636c36f1

SHA256
ff5c04fee8c1d836df72664a4fc598fdda4342f6aac7cb9233ca40fb5baee91d

SHA512
e2509cb4689fb98c5f863b64188c04f2c5e6b7008b19e9f946308c82c2ee649687983814edaab45bac6cfec6cbae3e4dbff10f642f5c1120f4ee7644c16056b3

Download Submit
C:\Windows\system\JhYjndj.exe

Filesize
2.3MB

MD5
54f2ef27a333dd016287673b12dd4a94

SHA1
04e05c3ad4dc4ed823ca45ec0ab73eee8746dc77

SHA256
af89d0112c0290e9f37e46be8ed891769b3324a4219c1bb12fb364efa87dbbe8

SHA512
705c6bf844406364f359c9686a73ecc05dd9a9235e281870c00a3bc17ab238a0be017593bd2a206df6f972eafbb85b7dbdeafa7f8fa1b6d4277cb0fa4bd5928e

Download Submit
C:\Windows\system\KCbVXum.exe

Filesize
2.3MB

MD5
cb940d1b7b1d957b0b6159696e5f45e9

SHA1
4a700890084db7281295b84c9a33f907c7f97947

SHA256
f6f2e4bf247dbeece5271cb1ba4f20006526b6eb5fd24b0e73c014a522e53011

SHA512
574658b3618f06de102a70e883d79613e37341ccf0f90b03fe34745d25595d1bc770fc133382e64f5682b77fef9bda6e9c00a20b044424e13d6134888bb49e46

Download Submit
C:\Windows\system\LJVCauD.exe

Filesize
2.3MB

MD5
6d190afcbe2de24868460a4af7ceccf7

SHA1
4173d188b12e6c3b0c3ba7c9fdc406b096da216e

SHA256
4779b0acda99af996134fe7572b67b5c3ce9b274952eb8d5eb5370ebc9afea5b

SHA512
8780a43c18ad84ef33f2c63d0e80991a0b08f95bd85692a0f426f819045f3cff926f7529a3c9ac59f587e8ae2e7baeaae7f34f44c3b2363adddb271345a569a5

Download Submit
C:\Windows\system\NLPoZGr.exe

Filesize
2.3MB

MD5
021866c94fe7d55ce5f80a0d0832ec49

SHA1
86fc9d011422fe2d21c87a1db5bec0715ce0e3ed

SHA256
61177ed8dae0e517b1024f58a79d8a617c7a19d2e53267c6284d361fbba7e690

SHA512
de2fe388bc5bc2772a3202908e914dd0bfaf3d5b82626780c1090d38c20623438fdfd37039841b51ad79d2990f52949c0d1485c104a98fcbabda5eee18954645

Download Submit
C:\Windows\system\VFPiCLu.exe

Filesize
2.3MB

MD5
dc40cf773e4c0d97d147d48084b4eafa

SHA1
8bc6fb4b02178303caa39d87a0d797cfa7d34a25

SHA256
0692ee609a140d92237526e1b1bce7a5652baaf0f125be909e72e766b0948964

SHA512
6ca7f0294c42bec922561f8743b82279146f3a44de9c8cb02cf38650ef8397aa96ed4f5207040d7b35d9b05dd9a86d45562c5a7c25d8c146ed7a3a0d8358c880

Download Submit
C:\Windows\system\YYGWuWp.exe

Filesize
2.3MB

MD5
b09158f62a4d6c4870a25393efeb3224

SHA1
38489c881d54433c142376b76b79efd95ca53f28

SHA256
03b59f0baee53db4a795d2ffa6041f501197dba53d205f675c8a569423c03baf

SHA512
15b03e49f70aacdbbe19935691cd24e193c1938f092edf48c1fca5fa4a2b781c7d5a50a58a6720a080ff0be84f8b3b273e814f48fcddfc74c377cdfb5160e8ae

Download Submit
C:\Windows\system\ZyMeAQy.exe

Filesize
2.3MB

MD5
dd7a1d9ac4e55e864ecf33b26bc11ec0

SHA1
8cbbf3024567cf2fc320036760742c92a2a30831

SHA256
b1b8dd2bf48018f03993f94b1a07bc89ef83b1187cab2708528ae06e45499dbe

SHA512
d91b95cda15fdf520cb025f15acb3f76c25884091db4f4bb36a7b97f5c9892b0daa4582cf8558c763fbf762992a0d65181ce527fc0d25fac0eb57ce6ce503d8f

Download Submit
C:\Windows\system\ayGCwSQ.exe

Filesize
2.3MB

MD5
19d179cf206287955bc13664199e2bc5

SHA1
9538390370de9a1f9f0beb722503f1e2b38c4ea8

SHA256
da0ed058c797d7c0902db2faaaf87a00eae1e53e8c97e73c8ebf7922d06b1c2e

SHA512
fdfb4031a59b7e51607f527c428c4ce5524147153a0fc7ccbb564e705ad6b53f29366b461973d3869dcb44d3fd124ae830ce323df8e733842e05be1102390172

Download Submit
C:\Windows\system\bemBgRs.exe

Filesize
2.3MB

MD5
8bbf71caf5dcbaa1b18d546bb8907334

SHA1
54ac74da663a6a9936d4d1e5eacf224827e1fe4b

SHA256
dfd23d1c6e25ecc5e5123078d731490766d4327b043bf596e0bc1354cfa01965

SHA512
2aca00e80958a2db8b1b5807294f9bbc33647bf4e6d94625dc9ff753b9ad6d0483d152acdef213b45bfa527b91729efa6a461860c8922f666bf7ee6e8e0562df

Download Submit
C:\Windows\system\blvauKU.exe

Filesize
2.3MB

MD5
5456370da885d478e0f432041c1a2a5d

SHA1
dbaac2d07b44adda369d35b8fd35aef79b9dcac3

SHA256
9e6c1973a822cf73582e6efcab440aa2df9eb040d668043c20c591b8b9596e73

SHA512
d7e0992a69bd0c9cb1beeff155fd62820ddc694446b9177d8c00f54d7e250704526ad1eb28ae444757bdda17eb3bc86a5b0c03261c235ff5b2dad6e17b35ea1f

Download Submit
C:\Windows\system\gLQxpuK.exe

Filesize
2.3MB

MD5
0715a6fe6634495eef547f8c594b2737

SHA1
0bcfdf1f53bdda90763eba4edded7c156969dbbf

SHA256
adaa69a252aed522b4bdd5236d8844eeb86ba2537ceb67dc9ebcf77b238e7f34

SHA512
4faa7f0e423e141b05d59dfa1ce7978dfb4bc97f712fc2235b49f83f94ac3070b576d6af314efb16f91f00d5172b4348f0a3df61449a65a7051d38d70196f546

Download Submit
C:\Windows\system\hUZwmJM.exe

Filesize
2.3MB

MD5
3e908c5fdfdd4f9128daffc480bfa905

SHA1
c08c7ea18653d9db46531e32a5ea9d2590e4c94d

SHA256
923e285f9c3e8739bed6669c02b4df1f479089813b9303e595cd978693f3fca5

SHA512
2ec2f025aab2040f3b2b70b512abebc4c69de6781bb1e62c843c150421b6ab21775d1a5633532be6fa50b7ffde20f0e7e3769436616c88e5f09206fbbd54a5cc

Download Submit
C:\Windows\system\qwxSSpM.exe

Filesize
2.3MB

MD5
51b1fc45fe1515e054fbec0638e70d91

SHA1
1c61122e5fb605f9978148f21bef95255ad36198

SHA256
57970a906786c85515aef6bd36b58a4c7a052129c0144143568e697dd5789014

SHA512
fb0dedca8e28d1215eeb66d70d431547267e29f7108bd1600d583ee6a24bd4ea6345cb1317406ad5040957684f8a50eee1fdaeb3ebb567db64a5a6492b42e5fb

Download Submit
C:\Windows\system\rHUvhzU.exe

Filesize
2.3MB

MD5
105bb2b6d41269c914bf6b127169a1a7

SHA1
9803c5d3cff26b34d5531b570c4e4b5d2ba65fcd

SHA256
2cf9a547c7f8a41bbbd82c225ca7ad978907e5df14c0fe939bd604095807c328

SHA512
08d66bb59e630960e5280fab7eb3e16ee2450d11adcbd4e7b618800f9cace65aa2bb7e063fbbd8e3311035170865e6905a679da58fe6b2bba07d8871cb6e9905

Download Submit
C:\Windows\system\stiPpap.exe

Filesize
2.3MB

MD5
ab314a4fb78a7cfc9495305e3e7d495e

SHA1
960b2c09b1a2a5b47c684f98e0f9b920ebf86b6c

SHA256
b3b3e462a83cd4559e8dd6cc3f5a9daa581832844667d6f666443dd4326a9e13

SHA512
3bb667c8744a00a89f9e8a08bcb2972e570c5e0bf7063a0843c2832c6d8e80010c1908734bcb633d6c3050b2b9bb0067513876748b6770eabea711f28499f026

Download Submit
C:\Windows\system\vDaHxhG.exe

Filesize
2.3MB

MD5
2582387ce1ce83d483c95c9558a86ec9

SHA1
c57609650940c5f0b0b9753de2c5252081640636

SHA256
23fe5b576c7c8cfaf630a05c030fae5bb4910c85f408347f737f00ef3fafec2d

SHA512
3ddeda210fabe9f208cb147247429afaf60f0e7092d9296e903b708614a481f16ae96b87a3485f9ee9ce9199cb5a6b0916d74170f7e282cf37e9eafbbee5771e

Download Submit
C:\Windows\system\wzpGdjJ.exe

Filesize
2.3MB

MD5
f54a44a60041637ad6306f47b6f18744

SHA1
d44dc7efd01d5e5bc3162cf5ceae91481985944a

SHA256
8a054e0511d01c46a2c34b3bc3a7cda3d6078e8b0786f8d5b1527b246a8a54a6

SHA512
e9824ec57f2d6c51c2b0be8e7d72b9627fc197c01b97f17f82b7e2a35921d77deaa1919cbc2f3c124490da21e9406631692b4b6fc7a4e195a96368c910d1f828

Download Submit
C:\Windows\system\yLiBUeW.exe

Filesize
2.3MB

MD5
cb4d75350d4cdc93c6167af19da57f06

SHA1
de7281e95e38861f78a07c1899552ad1ecb7f27c

SHA256
10c923a1f4ff3774468c171abbb8fa434c5e89c862e3b051fd311054c4a6d16f

SHA512
07e1274640759e4681707db056636e38fe5caaa0a758561f468bae873fc28e956e88c86010e1c5be5494fb7ddadcd390d64006cdb08da667365b751a73d27dea

Download Submit
\Windows\system\BJAvZYr.exe

Filesize
2.3MB

MD5
592447269c65a8a255a5b343607b23db

SHA1
965a2963f8443b65849f230b1ba4b9039e4c61c3

SHA256
c9691a5e2f040ba88f013cb5b76fc7490fc26e6d27b2cbabc8fec9489dbcaf0d

SHA512
c8623e817364201bfe9ae73d52b98f8815200d086cae2d5188bd479e0cb57d2bcf0e29d2757afd2d76e7be810bf57cd5f7ffe1633ce3beb559010007091f44f9

Download Submit
\Windows\system\BNSOrJY.exe

Filesize
2.3MB

MD5
6d53135b9cede82b215e6b14443661cd

SHA1
95ce3305c313e195c75125680d9c56f2fdbacbc1

SHA256
7f6eb4c2ca5deafa47f079b9630d01d806267bd679218356883f3ef3c7838bf4

SHA512
4574f90564a1286faa4f1f035c3d0633fc6d5fe980d9573975e304cf96dff6a4c3e096b5b316bef893cf0e1a8381ddf43aa770e95d2d0b4c31a2a6ed99f34b2a

Download Submit
\Windows\system\FxHuuKV.exe

Filesize
2.3MB

MD5
240c639fddac3802713e2b9c2292b64e

SHA1
d1604046aa515b09b8fdc073a98e4b3372f5de21

SHA256
de1d6418347f50cd64e55f7cc719470a88fac18540d3dda1e9de1c4e7fc07cf1

SHA512
7a88a6e4a6d9a85eb889b4a8b4b02f43d99fb11462e612a6f9313db18c67b8fe49e337994a9f2c49249b3edc9e12c8a7bb11e7d47d02d79d0cc1cd577e01f78e

Download Submit
\Windows\system\NJkUJWN.exe

Filesize
2.3MB

MD5
1a478e4812981320abe4f7db62ae34a0

SHA1
4f4bf625ba6ac995b8b9669497d675f2843901b6

SHA256
3d5ba5e3a3a46aac0ba8079e1e408f48b91cb5002df8f837d096e9ea5e57d78c

SHA512
aed1930cf4d7f5a54738e8ae22733397896278c28c378b07c498fd4a8fb1594354aba213b9c74a766175ee0884b3777cd4f660f0b450812150eff0a9fef54340

Download Submit
\Windows\system\QGGEPiR.exe

Filesize
2.3MB

MD5
e6c8baef5cd04c286c635c5fd3a161fc

SHA1
e8b6e5345771aedffa890b2657ad71db6e476d92

SHA256
ae05ee75dc44101051d2900ddbce1a6ad9870b5cf779ece6ed752af494514c49

SHA512
e66421fed947082d20bcb12a180b75fd6f8134801abdae5b7a9b305e54bd9b91ec55154127cd031db3d6da3c292da4a2631062a7b4530011fbb7545251fe5a9a

Download Submit
\Windows\system\VTGXsZN.exe

Filesize
2.3MB

MD5
c90f2962eee16bc96d9806859ccf03ba

SHA1
2b9ac26529c1a3cf83b79e6ae16f28e683eafab1

SHA256
3a477ba57f75d695723ef4469cad246312205bbe491bc6836f8e3405c2fb4f8a

SHA512
678bdb63a8ccc6ee1c291816cee9846701deb35a18b27a2030bcc5a37b136bba5c71f9e02ade5a59a147f098f6e9302e44795e2f0907f7b911dc8c088fe39d37

Download Submit
\Windows\system\jahXUCq.exe

Filesize
2.3MB

MD5
5a54810261ac98f8bd21ba5ec0f69328

SHA1
c2104ae1d708f2b7aa8b72c3662c330ab40b918b

SHA256
01bf6bde2686f6a222aea927782aab10d7e7092f291d226207c94128b70787ca

SHA512
2ff166018124035039f17c49653a6bfec92c1b79191e934023c775a55f5b7e79247b3b1425b8e44c8e4a095967a154ceddf2d3ad1af75d7fc23653c9b7df9b10

Download Submit
\Windows\system\kjTFvRN.exe

Filesize
2.3MB

MD5
286cf24a90b8b13be99ac8ab724eccd0

SHA1
ede55aadfaed0d6d7d1d3b9b60d048919cdefe5b

SHA256
cb3a2071f953bb5c8ac1571da432e1bf1baeb0812de719b57f7513807f038f2a

SHA512
3d113f37e70d8fdcd748c482295ee50031cddf0486561f533a7ec6f28cda7d39479210e24b1d3c3b39da4e7a42f1da000120ca831372ca6c0b64922fc66ab4c2

Download Submit
\Windows\system\nqgxycv.exe

Filesize
2.3MB

MD5
117dbe7ce44c62071c91ad486f0640eb

SHA1
4814841ab517af7cfe1304727fb65c8267c314ef

SHA256
6f1e5100c041fb8430821688fffc87568ae690367c57d45e18d75e257f447a23

SHA512
aab69cd93606fb7be6b6c66f5c84b09ebe089bb185d24fac10e21d93e771c1189c14f7f9ed7633f942f959bb431a6a35514e20585298259a5042400d7307d3c0

Download Submit
\Windows\system\tQZzTUE.exe

Filesize
2.3MB

MD5
4463db82c98f2ffb0ed7ac5b90e5ca87

SHA1
9fd6a669ef3976c027e926193a224f46cc6b1e76

SHA256
e4f6df1c4f5be6175145fcb6636747b2b141c446e651caf03509dccd80cbde68

SHA512
b4df2646bd532a64e6d8e055d8ccbe71ecf1c32b3f1217f9d4dc29c10d11c05403e4b69481fb7f5ce0828dfdc6fbfe24d1a91341c0070247a9c03c7b09d318e4

Download Submit
\Windows\system\tjJFkxb.exe

Filesize
2.3MB

MD5
74f8bce194de79985854ff7f5d8759b4

SHA1
e5c17928f437b5d0987c6e7ab8015a9c981cef51

SHA256
9c7b34b45daf3b47abc2cef612765725c935752918844dfef0c1ffc5b18c3902

SHA512
885e30613a30b75148abe8468f808ce97f9352e7666a5e01fab63b4dd7db09f98d720fa864b14a9e22c7c3e9cf06541e41b1540b2f3ebe1c02d8a34047e33ee7

Download Submit
memory/1644-3637-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1644-110-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2068-112-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2068-101-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2068-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2068-11-0x0000000002DF0000-0x00000000031E2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-51-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2068-103-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-106-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-107-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-108-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2068-109-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-22-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-115-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2068-114-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-0-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2384-19-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-32-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2404-488-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2404-91-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2404-40-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/2404-42-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2404-27-0x000007FEF63EE000-0x000007FEF63EF000-memory.dmp

Filesize
4KB

Download
memory/2404-33-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2404-113-0x000007FEF6130000-0x000007FEF6ACD000-memory.dmp

Filesize
9.6MB

Download
memory/2604-3665-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2604-105-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2608-102-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2628-104-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-3635-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-70-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2728-3659-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2852-20-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-3654-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-111-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/3064-21-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-3632-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download