xmrig | 9dd6c34a29142519adc9e07c022125b3c2909e69d3e2662541400db5de385aca

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
Size

2.2MB
MD5

ce68a7722aa136f070e0247a8d75417d
SHA1

6f07f4e98eccc4f3352d5a20b8b2d020936604bb
SHA256

9dd6c34a29142519adc9e07c022125b3c2909e69d3e2662541400db5de385aca
SHA512

862d454d8b08e12d2b7e516422cb7e7685e6e4107da8f8c7fbd8b2ae72848ffe4fe52af2dcd1ca1c7c77528a8f4b9d79812e39f7f3542c450371c3f7890b8014
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9g:NABp

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2816-15-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2708-143-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2968-156-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2216-161-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2420-158-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/1780-155-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/1840-154-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2584-151-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2352-149-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2548-147-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2732-145-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/1780-5906-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2732-5905-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2584-6046-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2708-6048-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2548-6051-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2816-6049-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2420-6073-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/1840-6072-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2216-6084-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2352-6083-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2816	yskYalh.exe
2216	aMJzIaO.exe
2708	TLDEEfa.exe
2732	jQMZMoU.exe
2548	SRQQYGF.exe
2352	FONupTL.exe
2584	MlzFRJy.exe
1840	LguVgtS.exe
1780	jJlHbKK.exe
2968	wKLsVOV.exe
2420	HpYviWO.exe
2384	EuAJDdI.exe
2364	iVCoDTe.exe
2104	rHjJamW.exe
1204	fABDShf.exe
1620	TVQUrLi.exe
1248	asrpSKs.exe
1096	UqGUUQJ.exe
2596	KKZPPev.exe
2628	bDbpNik.exe
1104	PXabxfH.exe
796	TdoNDfw.exe
740	aHaDSqb.exe
2904	zbpTosF.exe
356	Eobztkl.exe
996	HATOFAN.exe
3056	JzkDQNM.exe
1668	mPMmMEe.exe
1536	SPSeBIe.exe
1520	bIALLNL.exe
108	Rpaekxe.exe
1752	AXlgnPk.exe
2948	aEiBCPY.exe
2172	fOIwUxU.exe
1816	KffPoHR.exe
2456	RLBteGU.exe
1052	MYfuuYK.exe
2276	kETESBN.exe
2804	WtmnWKC.exe
1548	KoNqSwx.exe
2568	RxbkOEx.exe
2204	vbUFBVN.exe
2992	PPzNYrw.exe
2100	gIbolzH.exe
1720	wsRYeOu.exe
2480	YnCPwFl.exe
2508	azPyrBG.exe
2468	VmKFSkz.exe
2856	bUmyafw.exe
2528	UfZnVsL.exe
2796	xAykjql.exe
1480	FWWmPMr.exe
808	hKvFxWW.exe
1268	CcrpXIJ.exe
2120	mahFlHC.exe
400	TyZUEYe.exe
2492	pAjAlLr.exe
2912	oCDoGdb.exe
2164	XrbyRht.exe
1836	axMqsqE.exe
2512	SxtOFTr.exe
2368	LMeOttr.exe
2260	eQIWrNq.exe
1580	WsoGRpU.exe

Loads dropped DLL 64 IoCs

pid	Process
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-0-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x000b000000012282-6.dat	upx
behavioral1/files/0x0007000000019266-13.dat	upx
behavioral1/memory/2816-15-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-23.dat	upx
behavioral1/files/0x0006000000019356-28.dat	upx
behavioral1/files/0x000800000001928c-27.dat	upx
behavioral1/files/0x000600000001936b-36.dat	upx
behavioral1/files/0x000600000001937b-43.dat	upx
behavioral1/files/0x0007000000019397-53.dat	upx
behavioral1/files/0x000500000001963a-62.dat	upx
behavioral1/files/0x0032000000019256-68.dat	upx
behavioral1/files/0x000500000001963b-74.dat	upx
behavioral1/files/0x0005000000019a62-83.dat	upx
behavioral1/files/0x0005000000019f47-122.dat	upx
behavioral1/files/0x000500000001a059-131.dat	upx
behavioral1/memory/2708-143-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2968-156-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2216-161-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x000500000001a063-133.dat	upx
behavioral1/files/0x0005000000019f5e-124.dat	upx
behavioral1/files/0x000500000001a09a-165.dat	upx
behavioral1/files/0x000500000001a31e-177.dat	upx
behavioral1/files/0x0005000000019d7b-118.dat	upx
behavioral1/files/0x0005000000019c76-108.dat	upx
behavioral1/memory/2420-158-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/1780-155-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/1840-154-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2584-151-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2352-149-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2548-147-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2732-145-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x0005000000019cad-112.dat	upx
behavioral1/files/0x0005000000019c74-104.dat	upx
behavioral1/files/0x0005000000019c5b-98.dat	upx
behavioral1/files/0x0005000000019aff-93.dat	upx
behavioral1/files/0x0005000000019afd-89.dat	upx
behavioral1/files/0x00050000000197aa-78.dat	upx
behavioral1/files/0x0005000000019632-57.dat	upx
behavioral1/files/0x000500000001a433-192.dat	upx
behavioral1/files/0x000500000001a429-185.dat	upx
behavioral1/files/0x00070000000193a5-51.dat	upx
behavioral1/files/0x000500000001a431-187.dat	upx
behavioral1/files/0x000500000001a427-180.dat	upx
behavioral1/files/0x000500000001a2ed-172.dat	upx
behavioral1/memory/1780-5906-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2732-5905-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2584-6046-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2708-6048-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2548-6051-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2816-6049-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2420-6073-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/1840-6072-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2216-6084-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2352-6083-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ArVsFTt.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\GGPwePN.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\nhjjDpQ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\IEAPPlB.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\BkXbRPf.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\rNhwsZu.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\rCSXqfM.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\vylEtVW.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\iDqRQQA.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\cIFdlpr.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\lXhYYTK.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\UXSAgNW.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\ayIAnxx.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\GYnbcwv.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\nYjPAAo.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\QZQuTEh.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\ZWDxabg.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\HJKBYfh.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\CTsXDbB.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\rBKeJkJ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\EzjNBcz.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\ZBrutGD.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\hlDPOtH.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\zssePog.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\QUqgRxK.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\KolSkDs.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\wHPkVQU.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\zHtsfmr.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\wBpxLQx.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\yANSWUM.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\ZXnwVOr.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\LqagDHM.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\aiLsTHW.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\koeySnP.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\IVgppKG.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\RufrSDQ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\NbJCIDF.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\UjRUbdR.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\CRKclZw.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\tofxSxr.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\npyVMXC.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\ovwyZLH.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\GzEdzgC.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\eEnVAra.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\eeQclpx.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\wDvNzcN.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\uTFEWXi.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\lzUcGIA.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\eOAODRX.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\RsTiwKX.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\BXYPqjL.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\FlaQLqI.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\hHxDAVz.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\dKAdaqn.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\tiqhXev.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\gHUbKWz.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\FcImdSa.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\XQapfZZ.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\JEcTltF.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\aicjpDX.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\jWkrhfx.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\AdIMYhw.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\zpiRMcf.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
File created	C:\Windows\System\blgNRoX.exe	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2780	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
Token: SeDebugPrivilege	2780	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2780	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	32
PID 2224 wrote to memory of 2780	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	32
PID 2224 wrote to memory of 2780	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	32
PID 2224 wrote to memory of 2816	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	33
PID 2224 wrote to memory of 2816	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	33
PID 2224 wrote to memory of 2816	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	33
PID 2224 wrote to memory of 2216	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	34
PID 2224 wrote to memory of 2216	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	34
PID 2224 wrote to memory of 2216	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	34
PID 2224 wrote to memory of 2708	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	35
PID 2224 wrote to memory of 2708	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	35
PID 2224 wrote to memory of 2708	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	35
PID 2224 wrote to memory of 2732	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	36
PID 2224 wrote to memory of 2732	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	36
PID 2224 wrote to memory of 2732	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	36
PID 2224 wrote to memory of 2548	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	37
PID 2224 wrote to memory of 2548	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	37
PID 2224 wrote to memory of 2548	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	37
PID 2224 wrote to memory of 2352	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	38
PID 2224 wrote to memory of 2352	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	38
PID 2224 wrote to memory of 2352	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	38
PID 2224 wrote to memory of 2584	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	39
PID 2224 wrote to memory of 2584	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	39
PID 2224 wrote to memory of 2584	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	39
PID 2224 wrote to memory of 1780	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	40
PID 2224 wrote to memory of 1780	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	40
PID 2224 wrote to memory of 1780	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	40
PID 2224 wrote to memory of 1840	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	41
PID 2224 wrote to memory of 1840	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	41
PID 2224 wrote to memory of 1840	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	41
PID 2224 wrote to memory of 2968	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	42
PID 2224 wrote to memory of 2968	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	42
PID 2224 wrote to memory of 2968	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	42
PID 2224 wrote to memory of 2420	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	43
PID 2224 wrote to memory of 2420	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	43
PID 2224 wrote to memory of 2420	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	43
PID 2224 wrote to memory of 2364	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	44
PID 2224 wrote to memory of 2364	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	44
PID 2224 wrote to memory of 2364	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	44
PID 2224 wrote to memory of 2384	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	45
PID 2224 wrote to memory of 2384	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	45
PID 2224 wrote to memory of 2384	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	45
PID 2224 wrote to memory of 2104	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	46
PID 2224 wrote to memory of 2104	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	46
PID 2224 wrote to memory of 2104	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	46
PID 2224 wrote to memory of 1204	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	47
PID 2224 wrote to memory of 1204	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	47
PID 2224 wrote to memory of 1204	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	47
PID 2224 wrote to memory of 1620	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	48
PID 2224 wrote to memory of 1620	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	48
PID 2224 wrote to memory of 1620	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	48
PID 2224 wrote to memory of 1248	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	49
PID 2224 wrote to memory of 1248	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	49
PID 2224 wrote to memory of 1248	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	49
PID 2224 wrote to memory of 1096	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	50
PID 2224 wrote to memory of 1096	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	50
PID 2224 wrote to memory of 1096	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	50
PID 2224 wrote to memory of 2596	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	51
PID 2224 wrote to memory of 2596	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	51
PID 2224 wrote to memory of 2596	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	51
PID 2224 wrote to memory of 2628	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	52
PID 2224 wrote to memory of 2628	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	52
PID 2224 wrote to memory of 2628	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	52
PID 2224 wrote to memory of 1104	2224	ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe	53

C:\Users\Admin\AppData\Local\Temp\ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce68a7722aa136f070e0247a8d75417d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System\yskYalh.exe
  C:\Windows\System\yskYalh.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\aMJzIaO.exe
  C:\Windows\System\aMJzIaO.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\TLDEEfa.exe
  C:\Windows\System\TLDEEfa.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\jQMZMoU.exe
  C:\Windows\System\jQMZMoU.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\SRQQYGF.exe
  C:\Windows\System\SRQQYGF.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\FONupTL.exe
  C:\Windows\System\FONupTL.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\MlzFRJy.exe
  C:\Windows\System\MlzFRJy.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\jJlHbKK.exe
  C:\Windows\System\jJlHbKK.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\LguVgtS.exe
  C:\Windows\System\LguVgtS.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\wKLsVOV.exe
  C:\Windows\System\wKLsVOV.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\HpYviWO.exe
  C:\Windows\System\HpYviWO.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\iVCoDTe.exe
  C:\Windows\System\iVCoDTe.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\EuAJDdI.exe
  C:\Windows\System\EuAJDdI.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\rHjJamW.exe
  C:\Windows\System\rHjJamW.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\fABDShf.exe
  C:\Windows\System\fABDShf.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\TVQUrLi.exe
  C:\Windows\System\TVQUrLi.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\asrpSKs.exe
  C:\Windows\System\asrpSKs.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\UqGUUQJ.exe
  C:\Windows\System\UqGUUQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\KKZPPev.exe
  C:\Windows\System\KKZPPev.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\bDbpNik.exe
  C:\Windows\System\bDbpNik.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\PXabxfH.exe
  C:\Windows\System\PXabxfH.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\TdoNDfw.exe
  C:\Windows\System\TdoNDfw.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\aHaDSqb.exe
  C:\Windows\System\aHaDSqb.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\Eobztkl.exe
  C:\Windows\System\Eobztkl.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\zbpTosF.exe
  C:\Windows\System\zbpTosF.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\JzkDQNM.exe
  C:\Windows\System\JzkDQNM.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\HATOFAN.exe
  C:\Windows\System\HATOFAN.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\mPMmMEe.exe
  C:\Windows\System\mPMmMEe.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\SPSeBIe.exe
  C:\Windows\System\SPSeBIe.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\PPzNYrw.exe
  C:\Windows\System\PPzNYrw.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\bIALLNL.exe
  C:\Windows\System\bIALLNL.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\gIbolzH.exe
  C:\Windows\System\gIbolzH.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\Rpaekxe.exe
  C:\Windows\System\Rpaekxe.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\wsRYeOu.exe
  C:\Windows\System\wsRYeOu.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\AXlgnPk.exe
  C:\Windows\System\AXlgnPk.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\YnCPwFl.exe
  C:\Windows\System\YnCPwFl.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\aEiBCPY.exe
  C:\Windows\System\aEiBCPY.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\azPyrBG.exe
  C:\Windows\System\azPyrBG.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\fOIwUxU.exe
  C:\Windows\System\fOIwUxU.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\VmKFSkz.exe
  C:\Windows\System\VmKFSkz.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\KffPoHR.exe
  C:\Windows\System\KffPoHR.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\bUmyafw.exe
  C:\Windows\System\bUmyafw.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\RLBteGU.exe
  C:\Windows\System\RLBteGU.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\dGEVoli.exe
  C:\Windows\System\dGEVoli.exe
  2⤵
  PID:2292
- C:\Windows\System\MYfuuYK.exe
  C:\Windows\System\MYfuuYK.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\Pwabuwq.exe
  C:\Windows\System\Pwabuwq.exe
  2⤵
  PID:1788
- C:\Windows\System\kETESBN.exe
  C:\Windows\System\kETESBN.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\fAFjMFg.exe
  C:\Windows\System\fAFjMFg.exe
  2⤵
  PID:2784
- C:\Windows\System\WtmnWKC.exe
  C:\Windows\System\WtmnWKC.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\rofrWKE.exe
  C:\Windows\System\rofrWKE.exe
  2⤵
  PID:1584
- C:\Windows\System\KoNqSwx.exe
  C:\Windows\System\KoNqSwx.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\WBoMpkP.exe
  C:\Windows\System\WBoMpkP.exe
  2⤵
  PID:880
- C:\Windows\System\RxbkOEx.exe
  C:\Windows\System\RxbkOEx.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ZLHRYbn.exe
  C:\Windows\System\ZLHRYbn.exe
  2⤵
  PID:2840
- C:\Windows\System\vbUFBVN.exe
  C:\Windows\System\vbUFBVN.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\IKpYYqZ.exe
  C:\Windows\System\IKpYYqZ.exe
  2⤵
  PID:2592
- C:\Windows\System\UfZnVsL.exe
  C:\Windows\System\UfZnVsL.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\RfVNkDa.exe
  C:\Windows\System\RfVNkDa.exe
  2⤵
  PID:1880
- C:\Windows\System\xAykjql.exe
  C:\Windows\System\xAykjql.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\dxljCkJ.exe
  C:\Windows\System\dxljCkJ.exe
  2⤵
  PID:2380
- C:\Windows\System\FWWmPMr.exe
  C:\Windows\System\FWWmPMr.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\NnQWaBQ.exe
  C:\Windows\System\NnQWaBQ.exe
  2⤵
  PID:2372
- C:\Windows\System\hKvFxWW.exe
  C:\Windows\System\hKvFxWW.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\SiHLaQU.exe
  C:\Windows\System\SiHLaQU.exe
  2⤵
  PID:620
- C:\Windows\System\CcrpXIJ.exe
  C:\Windows\System\CcrpXIJ.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\nwovtbV.exe
  C:\Windows\System\nwovtbV.exe
  2⤵
  PID:1908
- C:\Windows\System\mahFlHC.exe
  C:\Windows\System\mahFlHC.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\FFUGnRB.exe
  C:\Windows\System\FFUGnRB.exe
  2⤵
  PID:1796
- C:\Windows\System\TyZUEYe.exe
  C:\Windows\System\TyZUEYe.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\ikvPbfJ.exe
  C:\Windows\System\ikvPbfJ.exe
  2⤵
  PID:2720
- C:\Windows\System\pAjAlLr.exe
  C:\Windows\System\pAjAlLr.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ekOQLPh.exe
  C:\Windows\System\ekOQLPh.exe
  2⤵
  PID:2652
- C:\Windows\System\oCDoGdb.exe
  C:\Windows\System\oCDoGdb.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\hHzgZxB.exe
  C:\Windows\System\hHzgZxB.exe
  2⤵
  PID:2428
- C:\Windows\System\XrbyRht.exe
  C:\Windows\System\XrbyRht.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\etPaGav.exe
  C:\Windows\System\etPaGav.exe
  2⤵
  PID:1056
- C:\Windows\System\axMqsqE.exe
  C:\Windows\System\axMqsqE.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\XxyDoTZ.exe
  C:\Windows\System\XxyDoTZ.exe
  2⤵
  PID:536
- C:\Windows\System\SxtOFTr.exe
  C:\Windows\System\SxtOFTr.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\hJoBDwj.exe
  C:\Windows\System\hJoBDwj.exe
  2⤵
  PID:2268
- C:\Windows\System\LMeOttr.exe
  C:\Windows\System\LMeOttr.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\XzwnOnG.exe
  C:\Windows\System\XzwnOnG.exe
  2⤵
  PID:2392
- C:\Windows\System\eQIWrNq.exe
  C:\Windows\System\eQIWrNq.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\TTijBli.exe
  C:\Windows\System\TTijBli.exe
  2⤵
  PID:2600
- C:\Windows\System\WsoGRpU.exe
  C:\Windows\System\WsoGRpU.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\USaxYsd.exe
  C:\Windows\System\USaxYsd.exe
  2⤵
  PID:2764
- C:\Windows\System\YTPqyaX.exe
  C:\Windows\System\YTPqyaX.exe
  2⤵
  PID:668
- C:\Windows\System\JEgwqlt.exe
  C:\Windows\System\JEgwqlt.exe
  2⤵
  PID:2748
- C:\Windows\System\ohDneJS.exe
  C:\Windows\System\ohDneJS.exe
  2⤵
  PID:2252
- C:\Windows\System\aywgqZC.exe
  C:\Windows\System\aywgqZC.exe
  2⤵
  PID:1864
- C:\Windows\System\asZqyxn.exe
  C:\Windows\System\asZqyxn.exe
  2⤵
  PID:3080
- C:\Windows\System\oXqnLRT.exe
  C:\Windows\System\oXqnLRT.exe
  2⤵
  PID:3096
- C:\Windows\System\aeRDblS.exe
  C:\Windows\System\aeRDblS.exe
  2⤵
  PID:3112
- C:\Windows\System\wWDjBhW.exe
  C:\Windows\System\wWDjBhW.exe
  2⤵
  PID:3128
- C:\Windows\System\OSwaAXO.exe
  C:\Windows\System\OSwaAXO.exe
  2⤵
  PID:3144
- C:\Windows\System\cTtMpwd.exe
  C:\Windows\System\cTtMpwd.exe
  2⤵
  PID:3160
- C:\Windows\System\vXgnAri.exe
  C:\Windows\System\vXgnAri.exe
  2⤵
  PID:3180
- C:\Windows\System\nPUcgMN.exe
  C:\Windows\System\nPUcgMN.exe
  2⤵
  PID:3196
- C:\Windows\System\qJSCcPs.exe
  C:\Windows\System\qJSCcPs.exe
  2⤵
  PID:3212
- C:\Windows\System\kypZmti.exe
  C:\Windows\System\kypZmti.exe
  2⤵
  PID:3228
- C:\Windows\System\ZiYtEQv.exe
  C:\Windows\System\ZiYtEQv.exe
  2⤵
  PID:3244
- C:\Windows\System\mnDCstv.exe
  C:\Windows\System\mnDCstv.exe
  2⤵
  PID:3260
- C:\Windows\System\NwlVBkP.exe
  C:\Windows\System\NwlVBkP.exe
  2⤵
  PID:3292
- C:\Windows\System\XgDQXAK.exe
  C:\Windows\System\XgDQXAK.exe
  2⤵
  PID:3308
- C:\Windows\System\KcMFnUM.exe
  C:\Windows\System\KcMFnUM.exe
  2⤵
  PID:3324
- C:\Windows\System\mKcKQPG.exe
  C:\Windows\System\mKcKQPG.exe
  2⤵
  PID:3340
- C:\Windows\System\yqtUnDK.exe
  C:\Windows\System\yqtUnDK.exe
  2⤵
  PID:3356
- C:\Windows\System\OxxYBdh.exe
  C:\Windows\System\OxxYBdh.exe
  2⤵
  PID:3376
- C:\Windows\System\lObEbMS.exe
  C:\Windows\System\lObEbMS.exe
  2⤵
  PID:3392
- C:\Windows\System\jCFPsem.exe
  C:\Windows\System\jCFPsem.exe
  2⤵
  PID:3408
- C:\Windows\System\ZvBQESx.exe
  C:\Windows\System\ZvBQESx.exe
  2⤵
  PID:3424
- C:\Windows\System\mJWvzoz.exe
  C:\Windows\System\mJWvzoz.exe
  2⤵
  PID:3440
- C:\Windows\System\dwUohQZ.exe
  C:\Windows\System\dwUohQZ.exe
  2⤵
  PID:3456
- C:\Windows\System\VTREVBl.exe
  C:\Windows\System\VTREVBl.exe
  2⤵
  PID:3476
- C:\Windows\System\OJXTKnt.exe
  C:\Windows\System\OJXTKnt.exe
  2⤵
  PID:3492
- C:\Windows\System\sRxTgHk.exe
  C:\Windows\System\sRxTgHk.exe
  2⤵
  PID:3508
- C:\Windows\System\eTUagAV.exe
  C:\Windows\System\eTUagAV.exe
  2⤵
  PID:3524
- C:\Windows\System\gHvJLCz.exe
  C:\Windows\System\gHvJLCz.exe
  2⤵
  PID:3540
- C:\Windows\System\dPiehSj.exe
  C:\Windows\System\dPiehSj.exe
  2⤵
  PID:3556
- C:\Windows\System\hBMKFru.exe
  C:\Windows\System\hBMKFru.exe
  2⤵
  PID:3576
- C:\Windows\System\eNolMSu.exe
  C:\Windows\System\eNolMSu.exe
  2⤵
  PID:3592
- C:\Windows\System\UzjtrWC.exe
  C:\Windows\System\UzjtrWC.exe
  2⤵
  PID:3652
- C:\Windows\System\GoiLSNO.exe
  C:\Windows\System\GoiLSNO.exe
  2⤵
  PID:3668
- C:\Windows\System\bVAfOaU.exe
  C:\Windows\System\bVAfOaU.exe
  2⤵
  PID:3684
- C:\Windows\System\fUdMdlI.exe
  C:\Windows\System\fUdMdlI.exe
  2⤵
  PID:3700
- C:\Windows\System\GqECggg.exe
  C:\Windows\System\GqECggg.exe
  2⤵
  PID:3716
- C:\Windows\System\eNxoinw.exe
  C:\Windows\System\eNxoinw.exe
  2⤵
  PID:3732
- C:\Windows\System\OWPGMDQ.exe
  C:\Windows\System\OWPGMDQ.exe
  2⤵
  PID:3748
- C:\Windows\System\fkbDToM.exe
  C:\Windows\System\fkbDToM.exe
  2⤵
  PID:3764
- C:\Windows\System\RlCZyYK.exe
  C:\Windows\System\RlCZyYK.exe
  2⤵
  PID:3784
- C:\Windows\System\ckZFqTH.exe
  C:\Windows\System\ckZFqTH.exe
  2⤵
  PID:3800
- C:\Windows\System\SCRtcEF.exe
  C:\Windows\System\SCRtcEF.exe
  2⤵
  PID:3816
- C:\Windows\System\PtdvsXP.exe
  C:\Windows\System\PtdvsXP.exe
  2⤵
  PID:3832
- C:\Windows\System\wpiozJP.exe
  C:\Windows\System\wpiozJP.exe
  2⤵
  PID:3848
- C:\Windows\System\WeoIPfr.exe
  C:\Windows\System\WeoIPfr.exe
  2⤵
  PID:3864
- C:\Windows\System\YRvQIeS.exe
  C:\Windows\System\YRvQIeS.exe
  2⤵
  PID:3880
- C:\Windows\System\QyScrSM.exe
  C:\Windows\System\QyScrSM.exe
  2⤵
  PID:3900
- C:\Windows\System\lKTnMLJ.exe
  C:\Windows\System\lKTnMLJ.exe
  2⤵
  PID:3916
- C:\Windows\System\FDkkngy.exe
  C:\Windows\System\FDkkngy.exe
  2⤵
  PID:3932
- C:\Windows\System\HoikkfE.exe
  C:\Windows\System\HoikkfE.exe
  2⤵
  PID:3948
- C:\Windows\System\BSgWtCE.exe
  C:\Windows\System\BSgWtCE.exe
  2⤵
  PID:3964
- C:\Windows\System\riRKoFO.exe
  C:\Windows\System\riRKoFO.exe
  2⤵
  PID:3980
- C:\Windows\System\RqOyCqC.exe
  C:\Windows\System\RqOyCqC.exe
  2⤵
  PID:4000
- C:\Windows\System\JKwljJJ.exe
  C:\Windows\System\JKwljJJ.exe
  2⤵
  PID:4016
- C:\Windows\System\sMfqXdm.exe
  C:\Windows\System\sMfqXdm.exe
  2⤵
  PID:4032
- C:\Windows\System\AZlBNBn.exe
  C:\Windows\System\AZlBNBn.exe
  2⤵
  PID:4048
- C:\Windows\System\pTCcXki.exe
  C:\Windows\System\pTCcXki.exe
  2⤵
  PID:4064
- C:\Windows\System\WxljKGy.exe
  C:\Windows\System\WxljKGy.exe
  2⤵
  PID:4080
- C:\Windows\System\MGiXxoS.exe
  C:\Windows\System\MGiXxoS.exe
  2⤵
  PID:1728
- C:\Windows\System\KkhROOl.exe
  C:\Windows\System\KkhROOl.exe
  2⤵
  PID:2056
- C:\Windows\System\eeRBnbP.exe
  C:\Windows\System\eeRBnbP.exe
  2⤵
  PID:2208
- C:\Windows\System\SNLroFP.exe
  C:\Windows\System\SNLroFP.exe
  2⤵
  PID:2084
- C:\Windows\System\yDqLicK.exe
  C:\Windows\System\yDqLicK.exe
  2⤵
  PID:2404
- C:\Windows\System\JefLsVZ.exe
  C:\Windows\System\JefLsVZ.exe
  2⤵
  PID:776
- C:\Windows\System\chSYXxC.exe
  C:\Windows\System\chSYXxC.exe
  2⤵
  PID:2768
- C:\Windows\System\uzmJgTU.exe
  C:\Windows\System\uzmJgTU.exe
  2⤵
  PID:2612
- C:\Windows\System\UnEuZuQ.exe
  C:\Windows\System\UnEuZuQ.exe
  2⤵
  PID:1712
- C:\Windows\System\NUgioBH.exe
  C:\Windows\System\NUgioBH.exe
  2⤵
  PID:2476
- C:\Windows\System\lHdMQOA.exe
  C:\Windows\System\lHdMQOA.exe
  2⤵
  PID:3604
- C:\Windows\System\xomyClD.exe
  C:\Windows\System\xomyClD.exe
  2⤵
  PID:3712
- C:\Windows\System\mBqVfOV.exe
  C:\Windows\System\mBqVfOV.exe
  2⤵
  PID:3776
- C:\Windows\System\xnGEpky.exe
  C:\Windows\System\xnGEpky.exe
  2⤵
  PID:3840
- C:\Windows\System\nNbHNXa.exe
  C:\Windows\System\nNbHNXa.exe
  2⤵
  PID:3908
- C:\Windows\System\zdMXuiB.exe
  C:\Windows\System\zdMXuiB.exe
  2⤵
  PID:3972
- C:\Windows\System\Keefycz.exe
  C:\Windows\System\Keefycz.exe
  2⤵
  PID:4012
- C:\Windows\System\NXQILqk.exe
  C:\Windows\System\NXQILqk.exe
  2⤵
  PID:1044
- C:\Windows\System\yHezwtU.exe
  C:\Windows\System\yHezwtU.exe
  2⤵
  PID:2960
- C:\Windows\System\AoLNnfz.exe
  C:\Windows\System\AoLNnfz.exe
  2⤵
  PID:3076
- C:\Windows\System\bBbjZaa.exe
  C:\Windows\System\bBbjZaa.exe
  2⤵
  PID:3140
- C:\Windows\System\qeNYubm.exe
  C:\Windows\System\qeNYubm.exe
  2⤵
  PID:3204
- C:\Windows\System\duAtPfK.exe
  C:\Windows\System\duAtPfK.exe
  2⤵
  PID:4108
- C:\Windows\System\PwdEzvn.exe
  C:\Windows\System\PwdEzvn.exe
  2⤵
  PID:4124
- C:\Windows\System\nZOWHUT.exe
  C:\Windows\System\nZOWHUT.exe
  2⤵
  PID:4140
- C:\Windows\System\bTagFMt.exe
  C:\Windows\System\bTagFMt.exe
  2⤵
  PID:4156
- C:\Windows\System\eygwQcf.exe
  C:\Windows\System\eygwQcf.exe
  2⤵
  PID:4172
- C:\Windows\System\XDjeBmM.exe
  C:\Windows\System\XDjeBmM.exe
  2⤵
  PID:4188
- C:\Windows\System\shTtNwG.exe
  C:\Windows\System\shTtNwG.exe
  2⤵
  PID:4204
- C:\Windows\System\OwGXzWH.exe
  C:\Windows\System\OwGXzWH.exe
  2⤵
  PID:4220
- C:\Windows\System\nPghSem.exe
  C:\Windows\System\nPghSem.exe
  2⤵
  PID:4236
- C:\Windows\System\danHAeB.exe
  C:\Windows\System\danHAeB.exe
  2⤵
  PID:4252
- C:\Windows\System\MmHjOsZ.exe
  C:\Windows\System\MmHjOsZ.exe
  2⤵
  PID:4284
- C:\Windows\System\kSVKUYS.exe
  C:\Windows\System\kSVKUYS.exe
  2⤵
  PID:4300
- C:\Windows\System\zWNUQhh.exe
  C:\Windows\System\zWNUQhh.exe
  2⤵
  PID:4316
- C:\Windows\System\cVrzDkI.exe
  C:\Windows\System\cVrzDkI.exe
  2⤵
  PID:4332
- C:\Windows\System\kqwHdFw.exe
  C:\Windows\System\kqwHdFw.exe
  2⤵
  PID:4348
- C:\Windows\System\QrIHnQU.exe
  C:\Windows\System\QrIHnQU.exe
  2⤵
  PID:4364
- C:\Windows\System\BadhhDg.exe
  C:\Windows\System\BadhhDg.exe
  2⤵
  PID:4380
- C:\Windows\System\ZlNXBNO.exe
  C:\Windows\System\ZlNXBNO.exe
  2⤵
  PID:4396
- C:\Windows\System\AjTVDmn.exe
  C:\Windows\System\AjTVDmn.exe
  2⤵
  PID:4412
- C:\Windows\System\rIubhIn.exe
  C:\Windows\System\rIubhIn.exe
  2⤵
  PID:4428
- C:\Windows\System\jQlbMhl.exe
  C:\Windows\System\jQlbMhl.exe
  2⤵
  PID:4444
- C:\Windows\System\hcikfhF.exe
  C:\Windows\System\hcikfhF.exe
  2⤵
  PID:4460
- C:\Windows\System\YgJhcOr.exe
  C:\Windows\System\YgJhcOr.exe
  2⤵
  PID:4476
- C:\Windows\System\WZUhspH.exe
  C:\Windows\System\WZUhspH.exe
  2⤵
  PID:4492
- C:\Windows\System\AbtATep.exe
  C:\Windows\System\AbtATep.exe
  2⤵
  PID:4508
- C:\Windows\System\EODbnYI.exe
  C:\Windows\System\EODbnYI.exe
  2⤵
  PID:4524
- C:\Windows\System\ldUoYsS.exe
  C:\Windows\System\ldUoYsS.exe
  2⤵
  PID:4540
- C:\Windows\System\JDOmRRn.exe
  C:\Windows\System\JDOmRRn.exe
  2⤵
  PID:4560
- C:\Windows\System\whyQrtC.exe
  C:\Windows\System\whyQrtC.exe
  2⤵
  PID:4576
- C:\Windows\System\DwXGNSj.exe
  C:\Windows\System\DwXGNSj.exe
  2⤵
  PID:4592
- C:\Windows\System\JTtttVL.exe
  C:\Windows\System\JTtttVL.exe
  2⤵
  PID:4608
- C:\Windows\System\qOawQZb.exe
  C:\Windows\System\qOawQZb.exe
  2⤵
  PID:4624
- C:\Windows\System\KYZQGqM.exe
  C:\Windows\System\KYZQGqM.exe
  2⤵
  PID:4640
- C:\Windows\System\QCqGTeE.exe
  C:\Windows\System\QCqGTeE.exe
  2⤵
  PID:4656
- C:\Windows\System\LjTsiBu.exe
  C:\Windows\System\LjTsiBu.exe
  2⤵
  PID:4676
- C:\Windows\System\vjiZioK.exe
  C:\Windows\System\vjiZioK.exe
  2⤵
  PID:4692
- C:\Windows\System\AjomKDI.exe
  C:\Windows\System\AjomKDI.exe
  2⤵
  PID:4708
- C:\Windows\System\IluzwBI.exe
  C:\Windows\System\IluzwBI.exe
  2⤵
  PID:4724
- C:\Windows\System\xgwUvgX.exe
  C:\Windows\System\xgwUvgX.exe
  2⤵
  PID:4740
- C:\Windows\System\jIqNcqS.exe
  C:\Windows\System\jIqNcqS.exe
  2⤵
  PID:4756
- C:\Windows\System\FlaQLqI.exe
  C:\Windows\System\FlaQLqI.exe
  2⤵
  PID:4772
- C:\Windows\System\GsJLGUC.exe
  C:\Windows\System\GsJLGUC.exe
  2⤵
  PID:4788
- C:\Windows\System\LOPbZZx.exe
  C:\Windows\System\LOPbZZx.exe
  2⤵
  PID:4804
- C:\Windows\System\TRlyKOE.exe
  C:\Windows\System\TRlyKOE.exe
  2⤵
  PID:4820
- C:\Windows\System\ptNmjnd.exe
  C:\Windows\System\ptNmjnd.exe
  2⤵
  PID:5024
- C:\Windows\System\gAKNCqV.exe
  C:\Windows\System\gAKNCqV.exe
  2⤵
  PID:5040
- C:\Windows\System\UsHkohu.exe
  C:\Windows\System\UsHkohu.exe
  2⤵
  PID:5056
- C:\Windows\System\PwmJqJt.exe
  C:\Windows\System\PwmJqJt.exe
  2⤵
  PID:5072
- C:\Windows\System\srXpcRn.exe
  C:\Windows\System\srXpcRn.exe
  2⤵
  PID:5088
- C:\Windows\System\YWPQjjf.exe
  C:\Windows\System\YWPQjjf.exe
  2⤵
  PID:5108
- C:\Windows\System\cdhALXT.exe
  C:\Windows\System\cdhALXT.exe
  2⤵
  PID:1504
- C:\Windows\System\TaOCeyb.exe
  C:\Windows\System\TaOCeyb.exe
  2⤵
  PID:2676
- C:\Windows\System\AoEUykR.exe
  C:\Windows\System\AoEUykR.exe
  2⤵
  PID:1896
- C:\Windows\System\hCOvqpi.exe
  C:\Windows\System\hCOvqpi.exe
  2⤵
  PID:3812
- C:\Windows\System\FWyEfzv.exe
  C:\Windows\System\FWyEfzv.exe
  2⤵
  PID:4076
- C:\Windows\System\phgtvJY.exe
  C:\Windows\System\phgtvJY.exe
  2⤵
  PID:3272
- C:\Windows\System\uHyXaqV.exe
  C:\Windows\System\uHyXaqV.exe
  2⤵
  PID:236
- C:\Windows\System\PPVixRQ.exe
  C:\Windows\System\PPVixRQ.exe
  2⤵
  PID:3176
- C:\Windows\System\VbSsswN.exe
  C:\Windows\System\VbSsswN.exe
  2⤵
  PID:4152
- C:\Windows\System\IaymoYE.exe
  C:\Windows\System\IaymoYE.exe
  2⤵
  PID:4216
- C:\Windows\System\EMtBqQx.exe
  C:\Windows\System\EMtBqQx.exe
  2⤵
  PID:4296
- C:\Windows\System\upykEWN.exe
  C:\Windows\System\upykEWN.exe
  2⤵
  PID:4360
- C:\Windows\System\zZvGUlT.exe
  C:\Windows\System\zZvGUlT.exe
  2⤵
  PID:1092
- C:\Windows\System\lXhYYTK.exe
  C:\Windows\System\lXhYYTK.exe
  2⤵
  PID:1680
- C:\Windows\System\npyVMXC.exe
  C:\Windows\System\npyVMXC.exe
  2⤵
  PID:4456
- C:\Windows\System\YSRdQWV.exe
  C:\Windows\System\YSRdQWV.exe
  2⤵
  PID:4520
- C:\Windows\System\QGdRtrh.exe
  C:\Windows\System\QGdRtrh.exe
  2⤵
  PID:4584
- C:\Windows\System\HkXRMJT.exe
  C:\Windows\System\HkXRMJT.exe
  2⤵
  PID:4648
- C:\Windows\System\Mdtxnfl.exe
  C:\Windows\System\Mdtxnfl.exe
  2⤵
  PID:4716
- C:\Windows\System\mTTwUkF.exe
  C:\Windows\System\mTTwUkF.exe
  2⤵
  PID:4752
- C:\Windows\System\Hvfrttz.exe
  C:\Windows\System\Hvfrttz.exe
  2⤵
  PID:3320
- C:\Windows\System\YqGoSgf.exe
  C:\Windows\System\YqGoSgf.exe
  2⤵
  PID:3416
- C:\Windows\System\XrAHicg.exe
  C:\Windows\System\XrAHicg.exe
  2⤵
  PID:3472
- C:\Windows\System\XWifDYk.exe
  C:\Windows\System\XWifDYk.exe
  2⤵
  PID:3520
- C:\Windows\System\dCJDlkP.exe
  C:\Windows\System\dCJDlkP.exe
  2⤵
  PID:3588
- C:\Windows\System\fpHPEvR.exe
  C:\Windows\System\fpHPEvR.exe
  2⤵
  PID:3696
- C:\Windows\System\qpBrFFF.exe
  C:\Windows\System\qpBrFFF.exe
  2⤵
  PID:3760
- C:\Windows\System\ljuqhsr.exe
  C:\Windows\System\ljuqhsr.exe
  2⤵
  PID:3828
- C:\Windows\System\pMhCYml.exe
  C:\Windows\System\pMhCYml.exe
  2⤵
  PID:3892
- C:\Windows\System\WCQUzxa.exe
  C:\Windows\System\WCQUzxa.exe
  2⤵
  PID:3956
- C:\Windows\System\SFLhQFD.exe
  C:\Windows\System\SFLhQFD.exe
  2⤵
  PID:3996
- C:\Windows\System\LgiYhCP.exe
  C:\Windows\System\LgiYhCP.exe
  2⤵
  PID:2136
- C:\Windows\System\whUYxeu.exe
  C:\Windows\System\whUYxeu.exe
  2⤵
  PID:988
- C:\Windows\System\QtMRPaQ.exe
  C:\Windows\System\QtMRPaQ.exe
  2⤵
  PID:4780
- C:\Windows\System\suyjNpO.exe
  C:\Windows\System\suyjNpO.exe
  2⤵
  PID:4056
- C:\Windows\System\CXDkdnT.exe
  C:\Windows\System\CXDkdnT.exe
  2⤵
  PID:4092
- C:\Windows\System\VrPEsKo.exe
  C:\Windows\System\VrPEsKo.exe
  2⤵
  PID:2520
- C:\Windows\System\ZipICFy.exe
  C:\Windows\System\ZipICFy.exe
  2⤵
  PID:1952
- C:\Windows\System\SzFFURl.exe
  C:\Windows\System\SzFFURl.exe
  2⤵
  PID:2128
- C:\Windows\System\yuWfACW.exe
  C:\Windows\System\yuWfACW.exe
  2⤵
  PID:5096
- C:\Windows\System\doWQIee.exe
  C:\Windows\System\doWQIee.exe
  2⤵
  PID:5128
- C:\Windows\System\fXPRNuG.exe
  C:\Windows\System\fXPRNuG.exe
  2⤵
  PID:5144
- C:\Windows\System\NGWYRdA.exe
  C:\Windows\System\NGWYRdA.exe
  2⤵
  PID:5160
- C:\Windows\System\BshfVhp.exe
  C:\Windows\System\BshfVhp.exe
  2⤵
  PID:5176
- C:\Windows\System\evRKCWC.exe
  C:\Windows\System\evRKCWC.exe
  2⤵
  PID:5192
- C:\Windows\System\GgYkwiS.exe
  C:\Windows\System\GgYkwiS.exe
  2⤵
  PID:5208
- C:\Windows\System\cTYMdAg.exe
  C:\Windows\System\cTYMdAg.exe
  2⤵
  PID:5224
- C:\Windows\System\pkyqNGe.exe
  C:\Windows\System\pkyqNGe.exe
  2⤵
  PID:5240
- C:\Windows\System\uLwtjAp.exe
  C:\Windows\System\uLwtjAp.exe
  2⤵
  PID:5256
- C:\Windows\System\kUoVqSW.exe
  C:\Windows\System\kUoVqSW.exe
  2⤵
  PID:5272
- C:\Windows\System\Msjzbtd.exe
  C:\Windows\System\Msjzbtd.exe
  2⤵
  PID:5288
- C:\Windows\System\AWfokFA.exe
  C:\Windows\System\AWfokFA.exe
  2⤵
  PID:5304
- C:\Windows\System\Grbutsv.exe
  C:\Windows\System\Grbutsv.exe
  2⤵
  PID:5320
- C:\Windows\System\kytwGvu.exe
  C:\Windows\System\kytwGvu.exe
  2⤵
  PID:5336
- C:\Windows\System\oLaPDMy.exe
  C:\Windows\System\oLaPDMy.exe
  2⤵
  PID:5352
- C:\Windows\System\mxTbrIV.exe
  C:\Windows\System\mxTbrIV.exe
  2⤵
  PID:5368
- C:\Windows\System\ZnXCBHl.exe
  C:\Windows\System\ZnXCBHl.exe
  2⤵
  PID:5384
- C:\Windows\System\huXIJcK.exe
  C:\Windows\System\huXIJcK.exe
  2⤵
  PID:5400
- C:\Windows\System\TANTdHf.exe
  C:\Windows\System\TANTdHf.exe
  2⤵
  PID:5416
- C:\Windows\System\gJraMOp.exe
  C:\Windows\System\gJraMOp.exe
  2⤵
  PID:5432
- C:\Windows\System\ZRhBIPU.exe
  C:\Windows\System\ZRhBIPU.exe
  2⤵
  PID:5448
- C:\Windows\System\uPTRcdm.exe
  C:\Windows\System\uPTRcdm.exe
  2⤵
  PID:5464
- C:\Windows\System\acCphRQ.exe
  C:\Windows\System\acCphRQ.exe
  2⤵
  PID:5480
- C:\Windows\System\GFFDVNa.exe
  C:\Windows\System\GFFDVNa.exe
  2⤵
  PID:5496
- C:\Windows\System\qdKpRrD.exe
  C:\Windows\System\qdKpRrD.exe
  2⤵
  PID:5512
- C:\Windows\System\ALpmxBC.exe
  C:\Windows\System\ALpmxBC.exe
  2⤵
  PID:5528
- C:\Windows\System\AITYmmp.exe
  C:\Windows\System\AITYmmp.exe
  2⤵
  PID:5544
- C:\Windows\System\DitLvMH.exe
  C:\Windows\System\DitLvMH.exe
  2⤵
  PID:5560
- C:\Windows\System\MrIPGBM.exe
  C:\Windows\System\MrIPGBM.exe
  2⤵
  PID:5576
- C:\Windows\System\DpsadJD.exe
  C:\Windows\System\DpsadJD.exe
  2⤵
  PID:5592
- C:\Windows\System\nClhrVl.exe
  C:\Windows\System\nClhrVl.exe
  2⤵
  PID:5608
- C:\Windows\System\vRHWJGq.exe
  C:\Windows\System\vRHWJGq.exe
  2⤵
  PID:5624
- C:\Windows\System\uiqfTTz.exe
  C:\Windows\System\uiqfTTz.exe
  2⤵
  PID:5640
- C:\Windows\System\MomhnIb.exe
  C:\Windows\System\MomhnIb.exe
  2⤵
  PID:5656
- C:\Windows\System\FupAVUY.exe
  C:\Windows\System\FupAVUY.exe
  2⤵
  PID:5672
- C:\Windows\System\zglOZJU.exe
  C:\Windows\System\zglOZJU.exe
  2⤵
  PID:5688
- C:\Windows\System\UZgOeDw.exe
  C:\Windows\System\UZgOeDw.exe
  2⤵
  PID:5704
- C:\Windows\System\yptDGqc.exe
  C:\Windows\System\yptDGqc.exe
  2⤵
  PID:5720
- C:\Windows\System\mUcMJnU.exe
  C:\Windows\System\mUcMJnU.exe
  2⤵
  PID:5736
- C:\Windows\System\dwezHnd.exe
  C:\Windows\System\dwezHnd.exe
  2⤵
  PID:5752
- C:\Windows\System\iQGUWqk.exe
  C:\Windows\System\iQGUWqk.exe
  2⤵
  PID:5768
- C:\Windows\System\UAJDVvM.exe
  C:\Windows\System\UAJDVvM.exe
  2⤵
  PID:5784
- C:\Windows\System\lPTODde.exe
  C:\Windows\System\lPTODde.exe
  2⤵
  PID:5800
- C:\Windows\System\gpqcCyI.exe
  C:\Windows\System\gpqcCyI.exe
  2⤵
  PID:5816
- C:\Windows\System\qotBeUf.exe
  C:\Windows\System\qotBeUf.exe
  2⤵
  PID:5832
- C:\Windows\System\EKlxthH.exe
  C:\Windows\System\EKlxthH.exe
  2⤵
  PID:5848
- C:\Windows\System\cFwPmqD.exe
  C:\Windows\System\cFwPmqD.exe
  2⤵
  PID:5864
- C:\Windows\System\NiqkkDn.exe
  C:\Windows\System\NiqkkDn.exe
  2⤵
  PID:5880
- C:\Windows\System\oFblDvx.exe
  C:\Windows\System\oFblDvx.exe
  2⤵
  PID:5896
- C:\Windows\System\zvHBBrr.exe
  C:\Windows\System\zvHBBrr.exe
  2⤵
  PID:5912
- C:\Windows\System\BLOiEmU.exe
  C:\Windows\System\BLOiEmU.exe
  2⤵
  PID:5928
- C:\Windows\System\cKPoHjH.exe
  C:\Windows\System\cKPoHjH.exe
  2⤵
  PID:5944
- C:\Windows\System\DIvSplp.exe
  C:\Windows\System\DIvSplp.exe
  2⤵
  PID:5960
- C:\Windows\System\LKXYTji.exe
  C:\Windows\System\LKXYTji.exe
  2⤵
  PID:5976
- C:\Windows\System\NOcxXqD.exe
  C:\Windows\System\NOcxXqD.exe
  2⤵
  PID:5992
- C:\Windows\System\lPhivYX.exe
  C:\Windows\System\lPhivYX.exe
  2⤵
  PID:6008
- C:\Windows\System\hrMmzab.exe
  C:\Windows\System\hrMmzab.exe
  2⤵
  PID:6024
- C:\Windows\System\ubojgSx.exe
  C:\Windows\System\ubojgSx.exe
  2⤵
  PID:6040
- C:\Windows\System\ehYAYDt.exe
  C:\Windows\System\ehYAYDt.exe
  2⤵
  PID:6056
- C:\Windows\System\wQIzIlS.exe
  C:\Windows\System\wQIzIlS.exe
  2⤵
  PID:6072
- C:\Windows\System\GGPwePN.exe
  C:\Windows\System\GGPwePN.exe
  2⤵
  PID:6088
- C:\Windows\System\WoNisVV.exe
  C:\Windows\System\WoNisVV.exe
  2⤵
  PID:6104
- C:\Windows\System\elHtiMh.exe
  C:\Windows\System\elHtiMh.exe
  2⤵
  PID:6120
- C:\Windows\System\IqHrzdP.exe
  C:\Windows\System\IqHrzdP.exe
  2⤵
  PID:6136
- C:\Windows\System\gfLvJvv.exe
  C:\Windows\System\gfLvJvv.exe
  2⤵
  PID:448
- C:\Windows\System\UYFYTpl.exe
  C:\Windows\System\UYFYTpl.exe
  2⤵
  PID:2160
- C:\Windows\System\jEOmiCV.exe
  C:\Windows\System\jEOmiCV.exe
  2⤵
  PID:580
- C:\Windows\System\NeLqWAp.exe
  C:\Windows\System\NeLqWAp.exe
  2⤵
  PID:3088
- C:\Windows\System\zOfIBQQ.exe
  C:\Windows\System\zOfIBQQ.exe
  2⤵
  PID:3152
- C:\Windows\System\UzhWQzS.exe
  C:\Windows\System\UzhWQzS.exe
  2⤵
  PID:3220
- C:\Windows\System\hQDZABc.exe
  C:\Windows\System\hQDZABc.exe
  2⤵
  PID:3300
- C:\Windows\System\eWkNpwY.exe
  C:\Windows\System\eWkNpwY.exe
  2⤵
  PID:3364
- C:\Windows\System\QodxIbB.exe
  C:\Windows\System\QodxIbB.exe
  2⤵
  PID:3404
- C:\Windows\System\IIHtQBV.exe
  C:\Windows\System\IIHtQBV.exe
  2⤵
  PID:3468
- C:\Windows\System\TEgJGJq.exe
  C:\Windows\System\TEgJGJq.exe
  2⤵
  PID:2096
- C:\Windows\System\OYwUxom.exe
  C:\Windows\System\OYwUxom.exe
  2⤵
  PID:3572
- C:\Windows\System\veHBKSD.exe
  C:\Windows\System\veHBKSD.exe
  2⤵
  PID:3616
- C:\Windows\System\gVAyJcv.exe
  C:\Windows\System\gVAyJcv.exe
  2⤵
  PID:2820
- C:\Windows\System\swJIslW.exe
  C:\Windows\System\swJIslW.exe
  2⤵
  PID:2744
- C:\Windows\System\SvWlLuP.exe
  C:\Windows\System\SvWlLuP.exe
  2⤵
  PID:2936
- C:\Windows\System\FSqDyIP.exe
  C:\Windows\System\FSqDyIP.exe
  2⤵
  PID:3240
- C:\Windows\System\uGFGSID.exe
  C:\Windows\System\uGFGSID.exe
  2⤵
  PID:5424
- C:\Windows\System\KCfYpuc.exe
  C:\Windows\System\KCfYpuc.exe
  2⤵
  PID:4356
- C:\Windows\System\yfclSte.exe
  C:\Windows\System\yfclSte.exe
  2⤵
  PID:4516
- C:\Windows\System\rSEoWGq.exe
  C:\Windows\System\rSEoWGq.exe
  2⤵
  PID:2028
- C:\Windows\System\cwYAuMB.exe
  C:\Windows\System\cwYAuMB.exe
  2⤵
  PID:3516
- C:\Windows\System\eKlkqwf.exe
  C:\Windows\System\eKlkqwf.exe
  2⤵
  PID:3824
- C:\Windows\System\EsQDcYM.exe
  C:\Windows\System\EsQDcYM.exe
  2⤵
  PID:1596
- C:\Windows\System\XHZwrPs.exe
  C:\Windows\System\XHZwrPs.exe
  2⤵
  PID:5036
- C:\Windows\System\BUBWbtx.exe
  C:\Windows\System\BUBWbtx.exe
  2⤵
  PID:5068
- C:\Windows\System\XMcxUDE.exe
  C:\Windows\System\XMcxUDE.exe
  2⤵
  PID:5172
- C:\Windows\System\rUclMgY.exe
  C:\Windows\System\rUclMgY.exe
  2⤵
  PID:5236
- C:\Windows\System\YoCLjts.exe
  C:\Windows\System\YoCLjts.exe
  2⤵
  PID:5300
- C:\Windows\System\jHLpHdA.exe
  C:\Windows\System\jHLpHdA.exe
  2⤵
  PID:5364
- C:\Windows\System\SHfHwHG.exe
  C:\Windows\System\SHfHwHG.exe
  2⤵
  PID:5456
- C:\Windows\System\PCyybgj.exe
  C:\Windows\System\PCyybgj.exe
  2⤵
  PID:5552
- C:\Windows\System\GPlNRmf.exe
  C:\Windows\System\GPlNRmf.exe
  2⤵
  PID:5584
- C:\Windows\System\QnXQoSN.exe
  C:\Windows\System\QnXQoSN.exe
  2⤵
  PID:3636
- C:\Windows\System\XzmAnSH.exe
  C:\Windows\System\XzmAnSH.exe
  2⤵
  PID:2340
- C:\Windows\System\iRWbekA.exe
  C:\Windows\System\iRWbekA.exe
  2⤵
  PID:6148
- C:\Windows\System\NEGqKSD.exe
  C:\Windows\System\NEGqKSD.exe
  2⤵
  PID:6164
- C:\Windows\System\NWXRcxG.exe
  C:\Windows\System\NWXRcxG.exe
  2⤵
  PID:6180
- C:\Windows\System\oeIVCuL.exe
  C:\Windows\System\oeIVCuL.exe
  2⤵
  PID:6196
- C:\Windows\System\yCpFoKh.exe
  C:\Windows\System\yCpFoKh.exe
  2⤵
  PID:6212
- C:\Windows\System\XQapfZZ.exe
  C:\Windows\System\XQapfZZ.exe
  2⤵
  PID:6228
- C:\Windows\System\ogFChTE.exe
  C:\Windows\System\ogFChTE.exe
  2⤵
  PID:6244
- C:\Windows\System\DhmolvF.exe
  C:\Windows\System\DhmolvF.exe
  2⤵
  PID:6260
- C:\Windows\System\LgdftrA.exe
  C:\Windows\System\LgdftrA.exe
  2⤵
  PID:6276
- C:\Windows\System\VdLIRUy.exe
  C:\Windows\System\VdLIRUy.exe
  2⤵
  PID:6292
- C:\Windows\System\rIrHoRN.exe
  C:\Windows\System\rIrHoRN.exe
  2⤵
  PID:6308
- C:\Windows\System\ggSmbTv.exe
  C:\Windows\System\ggSmbTv.exe
  2⤵
  PID:6324
- C:\Windows\System\blbNrbo.exe
  C:\Windows\System\blbNrbo.exe
  2⤵
  PID:6340
- C:\Windows\System\ohjdSCV.exe
  C:\Windows\System\ohjdSCV.exe
  2⤵
  PID:6356
- C:\Windows\System\jasXxdE.exe
  C:\Windows\System\jasXxdE.exe
  2⤵
  PID:6752
- C:\Windows\System\zlgSxWz.exe
  C:\Windows\System\zlgSxWz.exe
  2⤵
  PID:6796
- C:\Windows\System\eLnhlXZ.exe
  C:\Windows\System\eLnhlXZ.exe
  2⤵
  PID:6816
- C:\Windows\System\FJGygWc.exe
  C:\Windows\System\FJGygWc.exe
  2⤵
  PID:6832
- C:\Windows\System\NsqTLjP.exe
  C:\Windows\System\NsqTLjP.exe
  2⤵
  PID:6852
- C:\Windows\System\KpUKWvs.exe
  C:\Windows\System\KpUKWvs.exe
  2⤵
  PID:6868
- C:\Windows\System\DNcIwkn.exe
  C:\Windows\System\DNcIwkn.exe
  2⤵
  PID:6884
- C:\Windows\System\gwPbCmo.exe
  C:\Windows\System\gwPbCmo.exe
  2⤵
  PID:6900
- C:\Windows\System\DIpmPbB.exe
  C:\Windows\System\DIpmPbB.exe
  2⤵
  PID:6916
- C:\Windows\System\TeXplGg.exe
  C:\Windows\System\TeXplGg.exe
  2⤵
  PID:6936
- C:\Windows\System\pCQNLGS.exe
  C:\Windows\System\pCQNLGS.exe
  2⤵
  PID:6952
- C:\Windows\System\UpcgFWp.exe
  C:\Windows\System\UpcgFWp.exe
  2⤵
  PID:6968
- C:\Windows\System\ZAAneBa.exe
  C:\Windows\System\ZAAneBa.exe
  2⤵
  PID:6984
- C:\Windows\System\cNMDvSn.exe
  C:\Windows\System\cNMDvSn.exe
  2⤵
  PID:7000
- C:\Windows\System\CJtIZSA.exe
  C:\Windows\System\CJtIZSA.exe
  2⤵
  PID:7016
- C:\Windows\System\AlDoVwB.exe
  C:\Windows\System\AlDoVwB.exe
  2⤵
  PID:7032
- C:\Windows\System\SwkHzeb.exe
  C:\Windows\System\SwkHzeb.exe
  2⤵
  PID:7048
- C:\Windows\System\FtYgUdW.exe
  C:\Windows\System\FtYgUdW.exe
  2⤵
  PID:7064
- C:\Windows\System\DNZNDmh.exe
  C:\Windows\System\DNZNDmh.exe
  2⤵
  PID:7080
- C:\Windows\System\QGRzOcF.exe
  C:\Windows\System\QGRzOcF.exe
  2⤵
  PID:7096
- C:\Windows\System\UQlrhoP.exe
  C:\Windows\System\UQlrhoP.exe
  2⤵
  PID:7112
- C:\Windows\System\oeRuTqt.exe
  C:\Windows\System\oeRuTqt.exe
  2⤵
  PID:7128
- C:\Windows\System\gALGnvy.exe
  C:\Windows\System\gALGnvy.exe
  2⤵
  PID:7144
- C:\Windows\System\IDVEWWu.exe
  C:\Windows\System\IDVEWWu.exe
  2⤵
  PID:7160
- C:\Windows\System\xwTmYJn.exe
  C:\Windows\System\xwTmYJn.exe
  2⤵
  PID:5652
- C:\Windows\System\fbZTQPJ.exe
  C:\Windows\System\fbZTQPJ.exe
  2⤵
  PID:2184
- C:\Windows\System\PAoqWvE.exe
  C:\Windows\System\PAoqWvE.exe
  2⤵
  PID:5840
- C:\Windows\System\YwkQQNR.exe
  C:\Windows\System\YwkQQNR.exe
  2⤵
  PID:6268
- C:\Windows\System\GFyiIJZ.exe
  C:\Windows\System\GFyiIJZ.exe
  2⤵
  PID:6336
- C:\Windows\System\TeDAcXz.exe
  C:\Windows\System\TeDAcXz.exe
  2⤵
  PID:3108
- C:\Windows\System\GsamJGh.exe
  C:\Windows\System\GsamJGh.exe
  2⤵
  PID:4228
- C:\Windows\System\HzsfCJB.exe
  C:\Windows\System\HzsfCJB.exe
  2⤵
  PID:4276
- C:\Windows\System\wSRBMRY.exe
  C:\Windows\System\wSRBMRY.exe
  2⤵
  PID:4344
- C:\Windows\System\JgWazSQ.exe
  C:\Windows\System\JgWazSQ.exe
  2⤵
  PID:4408
- C:\Windows\System\HLozkYA.exe
  C:\Windows\System\HLozkYA.exe
  2⤵
  PID:4500
- C:\Windows\System\VyLSrXb.exe
  C:\Windows\System\VyLSrXb.exe
  2⤵
  PID:4632
- C:\Windows\System\biAmgqs.exe
  C:\Windows\System\biAmgqs.exe
  2⤵
  PID:4672
- C:\Windows\System\pdDJvLr.exe
  C:\Windows\System\pdDJvLr.exe
  2⤵
  PID:4764
- C:\Windows\System\rDVAGpZ.exe
  C:\Windows\System\rDVAGpZ.exe
  2⤵
  PID:5744
- C:\Windows\System\pmUnSaX.exe
  C:\Windows\System\pmUnSaX.exe
  2⤵
  PID:3488
- C:\Windows\System\rZTvXLO.exe
  C:\Windows\System\rZTvXLO.exe
  2⤵
  PID:5064
- C:\Windows\System\HEFTgFS.exe
  C:\Windows\System\HEFTgFS.exe
  2⤵
  PID:5360
- C:\Windows\System\FrJaVfz.exe
  C:\Windows\System\FrJaVfz.exe
  2⤵
  PID:1032
- C:\Windows\System\jRdHSDk.exe
  C:\Windows\System\jRdHSDk.exe
  2⤵
  PID:5748
- C:\Windows\System\RRiHZUR.exe
  C:\Windows\System\RRiHZUR.exe
  2⤵
  PID:5940
- C:\Windows\System\IaMGyVU.exe
  C:\Windows\System\IaMGyVU.exe
  2⤵
  PID:6004
- C:\Windows\System\XLmTIsD.exe
  C:\Windows\System\XLmTIsD.exe
  2⤵
  PID:6068
- C:\Windows\System\bBDGElv.exe
  C:\Windows\System\bBDGElv.exe
  2⤵
  PID:6132
- C:\Windows\System\gwFAsJG.exe
  C:\Windows\System\gwFAsJG.exe
  2⤵
  PID:2024
- C:\Windows\System\NQkYqWx.exe
  C:\Windows\System\NQkYqWx.exe
  2⤵
  PID:3436
- C:\Windows\System\XvvrHyZ.exe
  C:\Windows\System\XvvrHyZ.exe
  2⤵
  PID:3628
- C:\Windows\System\KvJDIiW.exe
  C:\Windows\System\KvJDIiW.exe
  2⤵
  PID:4568
- C:\Windows\System\WQRhCQO.exe
  C:\Windows\System\WQRhCQO.exe
  2⤵
  PID:4168
- C:\Windows\System\cFclDRD.exe
  C:\Windows\System\cFclDRD.exe
  2⤵
  PID:4132
- C:\Windows\System\PXEYvyH.exe
  C:\Windows\System\PXEYvyH.exe
  2⤵
  PID:4932
- C:\Windows\System\iuatAbS.exe
  C:\Windows\System\iuatAbS.exe
  2⤵
  PID:4948
- C:\Windows\System\xbCmagA.exe
  C:\Windows\System\xbCmagA.exe
  2⤵
  PID:4964
- C:\Windows\System\YvKuCUk.exe
  C:\Windows\System\YvKuCUk.exe
  2⤵
  PID:4976
- C:\Windows\System\NYeYcUl.exe
  C:\Windows\System\NYeYcUl.exe
  2⤵
  PID:4996
- C:\Windows\System\sxPEPDp.exe
  C:\Windows\System\sxPEPDp.exe
  2⤵
  PID:5012
- C:\Windows\System\kcgFnaP.exe
  C:\Windows\System\kcgFnaP.exe
  2⤵
  PID:5084
- C:\Windows\System\SdcfvMh.exe
  C:\Windows\System\SdcfvMh.exe
  2⤵
  PID:1648
- C:\Windows\System\lMqzEFZ.exe
  C:\Windows\System\lMqzEFZ.exe
  2⤵
  PID:4072
- C:\Windows\System\jCLhkMq.exe
  C:\Windows\System\jCLhkMq.exe
  2⤵
  PID:780
- C:\Windows\System\vrKzTNw.exe
  C:\Windows\System\vrKzTNw.exe
  2⤵
  PID:4452
- C:\Windows\System\arISUrx.exe
  C:\Windows\System\arISUrx.exe
  2⤵
  PID:4688
- C:\Windows\System\aWDMbyn.exe
  C:\Windows\System\aWDMbyn.exe
  2⤵
  PID:3584
- C:\Windows\System\wRrPSgS.exe
  C:\Windows\System\wRrPSgS.exe
  2⤵
  PID:3888
- C:\Windows\System\yfzoIAV.exe
  C:\Windows\System\yfzoIAV.exe
  2⤵
  PID:2008
- C:\Windows\System\yugbFcK.exe
  C:\Windows\System\yugbFcK.exe
  2⤵
  PID:1916
- C:\Windows\System\igZnyyR.exe
  C:\Windows\System\igZnyyR.exe
  2⤵
  PID:5124
- C:\Windows\System\SOdncFP.exe
  C:\Windows\System\SOdncFP.exe
  2⤵
  PID:5764
- C:\Windows\System\psTeoFw.exe
  C:\Windows\System\psTeoFw.exe
  2⤵
  PID:1116
- C:\Windows\System\Rcvisbu.exe
  C:\Windows\System\Rcvisbu.exe
  2⤵
  PID:1508
- C:\Windows\System\xDHxGCI.exe
  C:\Windows\System\xDHxGCI.exe
  2⤵
  PID:832
- C:\Windows\System\VbypXPw.exe
  C:\Windows\System\VbypXPw.exe
  2⤵
  PID:4836
- C:\Windows\System\KWauAYo.exe
  C:\Windows\System\KWauAYo.exe
  2⤵
  PID:4848
- C:\Windows\System\tKtcckt.exe
  C:\Windows\System\tKtcckt.exe
  2⤵
  PID:4864
- C:\Windows\System\wczVsFP.exe
  C:\Windows\System\wczVsFP.exe
  2⤵
  PID:4880
- C:\Windows\System\KILEGcV.exe
  C:\Windows\System\KILEGcV.exe
  2⤵
  PID:4896
- C:\Windows\System\QkkIyIX.exe
  C:\Windows\System\QkkIyIX.exe
  2⤵
  PID:4912
- C:\Windows\System\bZKeBRp.exe
  C:\Windows\System\bZKeBRp.exe
  2⤵
  PID:5920
- C:\Windows\System\vqFlhIH.exe
  C:\Windows\System\vqFlhIH.exe
  2⤵
  PID:5988
- C:\Windows\System\dlpSJpt.exe
  C:\Windows\System\dlpSJpt.exe
  2⤵
  PID:2664
- C:\Windows\System\LncrBda.exe
  C:\Windows\System\LncrBda.exe
  2⤵
  PID:3252
- C:\Windows\System\tenZLnk.exe
  C:\Windows\System\tenZLnk.exe
  2⤵
  PID:812
- C:\Windows\System\ttfzPwe.exe
  C:\Windows\System\ttfzPwe.exe
  2⤵
  PID:4212
- C:\Windows\System\KbFBTIQ.exe
  C:\Windows\System\KbFBTIQ.exe
  2⤵
  PID:1224
- C:\Windows\System\ZncwzXr.exe
  C:\Windows\System\ZncwzXr.exe
  2⤵
  PID:5296
- C:\Windows\System\DTbewGI.exe
  C:\Windows\System\DTbewGI.exe
  2⤵
  PID:5556
- C:\Windows\System\VFbHnSw.exe
  C:\Windows\System\VFbHnSw.exe
  2⤵
  PID:6160
- C:\Windows\System\uaaMhmj.exe
  C:\Windows\System\uaaMhmj.exe
  2⤵
  PID:6224
- C:\Windows\System\RPPZzBw.exe
  C:\Windows\System\RPPZzBw.exe
  2⤵
  PID:6316
- C:\Windows\System\YuxDZPl.exe
  C:\Windows\System\YuxDZPl.exe
  2⤵
  PID:6112
- C:\Windows\System\iJfZOvZ.exe
  C:\Windows\System\iJfZOvZ.exe
  2⤵
  PID:5156
- C:\Windows\System\LaxaTlN.exe
  C:\Windows\System\LaxaTlN.exe
  2⤵
  PID:5344
- C:\Windows\System\euJwpHA.exe
  C:\Windows\System\euJwpHA.exe
  2⤵
  PID:6116
- C:\Windows\System\ESulfMs.exe
  C:\Windows\System\ESulfMs.exe
  2⤵
  PID:5252
- C:\Windows\System\OwPDGfv.exe
  C:\Windows\System\OwPDGfv.exe
  2⤵
  PID:2896
- C:\Windows\System\gqNORyv.exe
  C:\Windows\System\gqNORyv.exe
  2⤵
  PID:3288
- C:\Windows\System\BWTbTlp.exe
  C:\Windows\System\BWTbTlp.exe
  2⤵
  PID:6080
- C:\Windows\System\FqcZoCP.exe
  C:\Windows\System\FqcZoCP.exe
  2⤵
  PID:5632
- C:\Windows\System\NRKdlTV.exe
  C:\Windows\System\NRKdlTV.exe
  2⤵
  PID:5828
- C:\Windows\System\GbiTUJi.exe
  C:\Windows\System\GbiTUJi.exe
  2⤵
  PID:5280
- C:\Windows\System\tBNVVWL.exe
  C:\Windows\System\tBNVVWL.exe
  2⤵
  PID:1136
- C:\Windows\System\WzMtaZT.exe
  C:\Windows\System\WzMtaZT.exe
  2⤵
  PID:5052
- C:\Windows\System\RkqBSRT.exe
  C:\Windows\System\RkqBSRT.exe
  2⤵
  PID:5444
- C:\Windows\System\uhxtbyS.exe
  C:\Windows\System\uhxtbyS.exe
  2⤵
  PID:2932
- C:\Windows\System\duPgPrD.exe
  C:\Windows\System\duPgPrD.exe
  2⤵
  PID:3608
- C:\Windows\System\fGEtLzr.exe
  C:\Windows\System\fGEtLzr.exe
  2⤵
  PID:1028
- C:\Windows\System\zAchzJy.exe
  C:\Windows\System\zAchzJy.exe
  2⤵
  PID:4008
- C:\Windows\System\PxYZHvR.exe
  C:\Windows\System\PxYZHvR.exe
  2⤵
  PID:3872
- C:\Windows\System\MSXBJbr.exe
  C:\Windows\System\MSXBJbr.exe
  2⤵
  PID:6288
- C:\Windows\System\TQHJMrG.exe
  C:\Windows\System\TQHJMrG.exe
  2⤵
  PID:5668
- C:\Windows\System\fLPZQoz.exe
  C:\Windows\System\fLPZQoz.exe
  2⤵
  PID:2956
- C:\Windows\System\gypEQZf.exe
  C:\Windows\System\gypEQZf.exe
  2⤵
  PID:1040
- C:\Windows\System\OfqUpiH.exe
  C:\Windows\System\OfqUpiH.exe
  2⤵
  PID:2196
- C:\Windows\System\Chmvxjk.exe
  C:\Windows\System\Chmvxjk.exe
  2⤵
  PID:6428
- C:\Windows\System\xsZLkAZ.exe
  C:\Windows\System\xsZLkAZ.exe
  2⤵
  PID:6732
- C:\Windows\System\nlRfGtF.exe
  C:\Windows\System\nlRfGtF.exe
  2⤵
  PID:6456
- C:\Windows\System\mfYSiXS.exe
  C:\Windows\System\mfYSiXS.exe
  2⤵
  PID:6472
- C:\Windows\System\eMzKdSv.exe
  C:\Windows\System\eMzKdSv.exe
  2⤵
  PID:6488
- C:\Windows\System\MPGxfkf.exe
  C:\Windows\System\MPGxfkf.exe
  2⤵
  PID:6508
- C:\Windows\System\sRbMKuW.exe
  C:\Windows\System\sRbMKuW.exe
  2⤵
  PID:6524
- C:\Windows\System\PNhByqT.exe
  C:\Windows\System\PNhByqT.exe
  2⤵
  PID:6540
- C:\Windows\System\SIFvoFb.exe
  C:\Windows\System\SIFvoFb.exe
  2⤵
  PID:6556
- C:\Windows\System\EDRKTVJ.exe
  C:\Windows\System\EDRKTVJ.exe
  2⤵
  PID:6572
- C:\Windows\System\FJSyzqY.exe
  C:\Windows\System\FJSyzqY.exe
  2⤵
  PID:6588
- C:\Windows\System\zFOCfnL.exe
  C:\Windows\System\zFOCfnL.exe
  2⤵
  PID:6604
- C:\Windows\System\lEUjJZR.exe
  C:\Windows\System\lEUjJZR.exe
  2⤵
  PID:6620
- C:\Windows\System\TGlFVVD.exe
  C:\Windows\System\TGlFVVD.exe
  2⤵
  PID:6636
- C:\Windows\System\qYlRlnQ.exe
  C:\Windows\System\qYlRlnQ.exe
  2⤵
  PID:6652
- C:\Windows\System\lcQTMUU.exe
  C:\Windows\System\lcQTMUU.exe
  2⤵
  PID:6668
- C:\Windows\System\fIyOwMe.exe
  C:\Windows\System\fIyOwMe.exe
  2⤵
  PID:6684
- C:\Windows\System\EiTLHBn.exe
  C:\Windows\System\EiTLHBn.exe
  2⤵
  PID:6704
- C:\Windows\System\hWPRDYv.exe
  C:\Windows\System\hWPRDYv.exe
  2⤵
  PID:6720
- C:\Windows\System\bMuKjqr.exe
  C:\Windows\System\bMuKjqr.exe
  2⤵
  PID:6740
- C:\Windows\System\DFsZSqb.exe
  C:\Windows\System\DFsZSqb.exe
  2⤵
  PID:6744
- C:\Windows\System\Sctctfu.exe
  C:\Windows\System\Sctctfu.exe
  2⤵
  PID:6416
- C:\Windows\System\jFpSAhK.exe
  C:\Windows\System\jFpSAhK.exe
  2⤵
  PID:6776
- C:\Windows\System\mSfEaTH.exe
  C:\Windows\System\mSfEaTH.exe
  2⤵
  PID:6808
- C:\Windows\System\XpAYGap.exe
  C:\Windows\System\XpAYGap.exe
  2⤵
  PID:6844
- C:\Windows\System\ebLPOtW.exe
  C:\Windows\System\ebLPOtW.exe
  2⤵
  PID:6864
- C:\Windows\System\bsqbvIV.exe
  C:\Windows\System\bsqbvIV.exe
  2⤵
  PID:6908
- C:\Windows\System\iXuJCYn.exe
  C:\Windows\System\iXuJCYn.exe
  2⤵
  PID:6932
- C:\Windows\System\ZJmSMPI.exe
  C:\Windows\System\ZJmSMPI.exe
  2⤵
  PID:6976
- C:\Windows\System\xpERmtq.exe
  C:\Windows\System\xpERmtq.exe
  2⤵
  PID:7012
- C:\Windows\System\SfayKQd.exe
  C:\Windows\System\SfayKQd.exe
  2⤵
  PID:7044
- C:\Windows\System\rkKpGJZ.exe
  C:\Windows\System\rkKpGJZ.exe
  2⤵
  PID:6992
- C:\Windows\System\QHzDSXg.exe
  C:\Windows\System\QHzDSXg.exe
  2⤵
  PID:7104
- C:\Windows\System\zWppBzd.exe
  C:\Windows\System\zWppBzd.exe
  2⤵
  PID:7140
- C:\Windows\System\yyncJSP.exe
  C:\Windows\System\yyncJSP.exe
  2⤵
  PID:7152
- C:\Windows\System\iODqvvE.exe
  C:\Windows\System\iODqvvE.exe
  2⤵
  PID:5680
- C:\Windows\System\yCXuSrR.exe
  C:\Windows\System\yCXuSrR.exe
  2⤵
  PID:5812
- C:\Windows\System\atxikkA.exe
  C:\Windows\System\atxikkA.exe
  2⤵
  PID:6332
- C:\Windows\System\fsSFPkM.exe
  C:\Windows\System\fsSFPkM.exe
  2⤵
  PID:4200
- C:\Windows\System\vHbevME.exe
  C:\Windows\System\vHbevME.exe
  2⤵
  PID:4268
- C:\Windows\System\PPVcVss.exe
  C:\Windows\System\PPVcVss.exe
  2⤵
  PID:4468
- C:\Windows\System\GSVkwVx.exe
  C:\Windows\System\GSVkwVx.exe
  2⤵
  PID:4668
- C:\Windows\System\NemrsRB.exe
  C:\Windows\System\NemrsRB.exe
  2⤵
  PID:4664
- C:\Windows\System\wJDlgbu.exe
  C:\Windows\System\wJDlgbu.exe
  2⤵
  PID:2488
- C:\Windows\System\XjXUuLy.exe
  C:\Windows\System\XjXUuLy.exe
  2⤵
  PID:4572
- C:\Windows\System\qzNyoCb.exe
  C:\Windows\System\qzNyoCb.exe
  2⤵
  PID:2256
- C:\Windows\System\WlnlKfm.exe
  C:\Windows\System\WlnlKfm.exe
  2⤵
  PID:5716
- C:\Windows\System\xwRmRKL.exe
  C:\Windows\System\xwRmRKL.exe
  2⤵
  PID:6036
- C:\Windows\System\sdcjusB.exe
  C:\Windows\System\sdcjusB.exe
  2⤵
  PID:6128
- C:\Windows\System\UitDnnc.exe
  C:\Windows\System\UitDnnc.exe
  2⤵
  PID:3332
- C:\Windows\System\QVjKPgv.exe
  C:\Windows\System\QVjKPgv.exe
  2⤵
  PID:3624
- C:\Windows\System\XRJcRgX.exe
  C:\Windows\System\XRJcRgX.exe
  2⤵
  PID:4800
- C:\Windows\System\euwrjiw.exe
  C:\Windows\System\euwrjiw.exe
  2⤵
  PID:2112
- C:\Windows\System\LjuITXE.exe
  C:\Windows\System\LjuITXE.exe
  2⤵
  PID:1364
- C:\Windows\System\mUHmyDA.exe
  C:\Windows\System\mUHmyDA.exe
  2⤵
  PID:4956
- C:\Windows\System\cYAnBin.exe
  C:\Windows\System\cYAnBin.exe
  2⤵
  PID:4988
- C:\Windows\System\xgjVpNI.exe
  C:\Windows\System\xgjVpNI.exe
  2⤵
  PID:4120
- C:\Windows\System\IMuXjME.exe
  C:\Windows\System\IMuXjME.exe
  2⤵
  PID:3452
- C:\Windows\System\smIfaxc.exe
  C:\Windows\System\smIfaxc.exe
  2⤵
  PID:2756
- C:\Windows\System\AjQWVRq.exe
  C:\Windows\System\AjQWVRq.exe
  2⤵
  PID:1344
- C:\Windows\System\JYjHYSO.exe
  C:\Windows\System\JYjHYSO.exe
  2⤵
  PID:5700
- C:\Windows\System\QtBReBn.exe
  C:\Windows\System\QtBReBn.exe
  2⤵
  PID:1876
- C:\Windows\System\hIniehU.exe
  C:\Windows\System\hIniehU.exe
  2⤵
  PID:2576
- C:\Windows\System\TAOajcx.exe
  C:\Windows\System\TAOajcx.exe
  2⤵
  PID:4900
- C:\Windows\System\KrEwiNf.exe
  C:\Windows\System\KrEwiNf.exe
  2⤵
  PID:3124
- C:\Windows\System\vpzTboe.exe
  C:\Windows\System\vpzTboe.exe
  2⤵
  PID:4704
- C:\Windows\System\eqPMcyx.exe
  C:\Windows\System\eqPMcyx.exe
  2⤵
  PID:5004
- C:\Windows\System\bqrCfos.exe
  C:\Windows\System\bqrCfos.exe
  2⤵
  PID:4292
- C:\Windows\System\UoVGKKk.exe
  C:\Windows\System\UoVGKKk.exe
  2⤵
  PID:3756
- C:\Windows\System\uXuHWYv.exe
  C:\Windows\System\uXuHWYv.exe
  2⤵
  PID:5760
- C:\Windows\System\csNVocO.exe
  C:\Windows\System\csNVocO.exe
  2⤵
  PID:2544
- C:\Windows\System\DzoABlE.exe
  C:\Windows\System\DzoABlE.exe
  2⤵
  PID:4856
- C:\Windows\System\EMByxpH.exe
  C:\Windows\System\EMByxpH.exe
  2⤵
  PID:4920
- C:\Windows\System\utGikXM.exe
  C:\Windows\System\utGikXM.exe
  2⤵
  PID:4620
- C:\Windows\System\gCojukE.exe
  C:\Windows\System\gCojukE.exe
  2⤵
  PID:5428
- C:\Windows\System\DWmvFCV.exe
  C:\Windows\System\DWmvFCV.exe
  2⤵
  PID:2560
- C:\Windows\System\RtupZxJ.exe
  C:\Windows\System\RtupZxJ.exe
  2⤵
  PID:5220
- C:\Windows\System\XoDmTLz.exe
  C:\Windows\System\XoDmTLz.exe
  2⤵
  PID:5184
- C:\Windows\System\YYjLzlJ.exe
  C:\Windows\System\YYjLzlJ.exe
  2⤵
  PID:6156
- C:\Windows\System\izImtks.exe
  C:\Windows\System\izImtks.exe
  2⤵
  PID:5952
- C:\Windows\System\HbgccAS.exe
  C:\Windows\System\HbgccAS.exe
  2⤵
  PID:5664
- C:\Windows\System\vvOvWCr.exe
  C:\Windows\System\vvOvWCr.exe
  2⤵
  PID:5508
- C:\Windows\System\jbfNteE.exe
  C:\Windows\System\jbfNteE.exe
  2⤵
  PID:3796
- C:\Windows\System\FUCTMkA.exe
  C:\Windows\System\FUCTMkA.exe
  2⤵
  PID:584
- C:\Windows\System\FenkpKj.exe
  C:\Windows\System\FenkpKj.exe
  2⤵
  PID:4748
- C:\Windows\System\JkjNcna.exe
  C:\Windows\System\JkjNcna.exe
  2⤵
  PID:5892
- C:\Windows\System\MGhcOhA.exe
  C:\Windows\System\MGhcOhA.exe
  2⤵
  PID:3772
- C:\Windows\System\TTjYgpn.exe
  C:\Windows\System\TTjYgpn.exe
  2⤵
  PID:6220
- C:\Windows\System\kSDygfG.exe
  C:\Windows\System\kSDygfG.exe
  2⤵
  PID:6468
- C:\Windows\System\JlQFGzA.exe
  C:\Windows\System\JlQFGzA.exe
  2⤵
  PID:3504
- C:\Windows\System\yznQcEj.exe
  C:\Windows\System\yznQcEj.exe
  2⤵
  PID:6480
- C:\Windows\System\YuRitWq.exe
  C:\Windows\System\YuRitWq.exe
  2⤵
  PID:6516
- C:\Windows\System\vZLtpbt.exe
  C:\Windows\System\vZLtpbt.exe
  2⤵
  PID:6532
- C:\Windows\System\SVrjjHO.exe
  C:\Windows\System\SVrjjHO.exe
  2⤵
  PID:6548
- C:\Windows\System\kdsGNlH.exe
  C:\Windows\System\kdsGNlH.exe
  2⤵
  PID:6628
- C:\Windows\System\Gakaysi.exe
  C:\Windows\System\Gakaysi.exe
  2⤵
  PID:6664
- C:\Windows\System\xaOvyHZ.exe
  C:\Windows\System\xaOvyHZ.exe
  2⤵
  PID:6580
- C:\Windows\System\wKjLqjA.exe
  C:\Windows\System\wKjLqjA.exe
  2⤵
  PID:6712
- C:\Windows\System\EVAaODn.exe
  C:\Windows\System\EVAaODn.exe
  2⤵
  PID:6680
- C:\Windows\System\LdmJeBX.exe
  C:\Windows\System\LdmJeBX.exe
  2⤵
  PID:2632
- C:\Windows\System\GEcyumO.exe
  C:\Windows\System\GEcyumO.exe
  2⤵
  PID:6788
- C:\Windows\System\xhGUNmm.exe
  C:\Windows\System\xhGUNmm.exe
  2⤵
  PID:6840
- C:\Windows\System\FZSGcwY.exe
  C:\Windows\System\FZSGcwY.exe
  2⤵
  PID:6948
- C:\Windows\System\vByyugC.exe
  C:\Windows\System\vByyugC.exe
  2⤵
  PID:7056
- C:\Windows\System\watMekU.exe
  C:\Windows\System\watMekU.exe
  2⤵
  PID:3052
- C:\Windows\System\rioAsqX.exe
  C:\Windows\System\rioAsqX.exe
  2⤵
  PID:4312
- C:\Windows\System\lbFDpAb.exe
  C:\Windows\System\lbFDpAb.exe
  2⤵
  PID:5232
- C:\Windows\System\vEiFONk.exe
  C:\Windows\System\vEiFONk.exe
  2⤵
  PID:1640
- C:\Windows\System\iwJYmcL.exe
  C:\Windows\System\iwJYmcL.exe
  2⤵
  PID:4488
- C:\Windows\System\xMeEDUM.exe
  C:\Windows\System\xMeEDUM.exe
  2⤵
  PID:3944
- C:\Windows\System\pouqxhM.exe
  C:\Windows\System\pouqxhM.exe
  2⤵
  PID:6980
- C:\Windows\System\LoDvUkF.exe
  C:\Windows\System\LoDvUkF.exe
  2⤵
  PID:4404
- C:\Windows\System\EiPAHaV.exe
  C:\Windows\System\EiPAHaV.exe
  2⤵
  PID:932
- C:\Windows\System\Ggwqrdm.exe
  C:\Windows\System\Ggwqrdm.exe
  2⤵
  PID:7028
- C:\Windows\System\RiDkemI.exe
  C:\Windows\System\RiDkemI.exe
  2⤵
  PID:4164
- C:\Windows\System\xhuTLPu.exe
  C:\Windows\System\xhuTLPu.exe
  2⤵
  PID:7136
- C:\Windows\System\KExzxhc.exe
  C:\Windows\System\KExzxhc.exe
  2⤵
  PID:3388
- C:\Windows\System\EvNEotC.exe
  C:\Windows\System\EvNEotC.exe
  2⤵
  PID:2064
- C:\Windows\System\usuJnKx.exe
  C:\Windows\System\usuJnKx.exe
  2⤵
  PID:6236
- C:\Windows\System\IMUYncY.exe
  C:\Windows\System\IMUYncY.exe
  2⤵
  PID:5984
- C:\Windows\System\cjFdnaV.exe
  C:\Windows\System\cjFdnaV.exe
  2⤵
  PID:4940
- C:\Windows\System\cUCeuJO.exe
  C:\Windows\System\cUCeuJO.exe
  2⤵
  PID:1532
- C:\Windows\System\ENvbtuI.exe
  C:\Windows\System\ENvbtuI.exe
  2⤵
  PID:3532
- C:\Windows\System\gYREqRd.exe
  C:\Windows\System\gYREqRd.exe
  2⤵
  PID:5732
- C:\Windows\System\zwVFSCN.exe
  C:\Windows\System\zwVFSCN.exe
  2⤵
  PID:1636
- C:\Windows\System\rYsxTyf.exe
  C:\Windows\System\rYsxTyf.exe
  2⤵
  PID:5316
- C:\Windows\System\bOuRSKw.exe
  C:\Windows\System\bOuRSKw.exe
  2⤵
  PID:980
- C:\Windows\System\HrFCyWg.exe
  C:\Windows\System\HrFCyWg.exe
  2⤵
  PID:3384
- C:\Windows\System\YvdEcbG.exe
  C:\Windows\System\YvdEcbG.exe
  2⤵
  PID:2532
- C:\Windows\System\UBGcdxq.exe
  C:\Windows\System\UBGcdxq.exe
  2⤵
  PID:2884
- C:\Windows\System\AIYMFcC.exe
  C:\Windows\System\AIYMFcC.exe
  2⤵
  PID:2124
- C:\Windows\System\UcLfnKZ.exe
  C:\Windows\System\UcLfnKZ.exe
  2⤵
  PID:1996
- C:\Windows\System\GNQmFrk.exe
  C:\Windows\System\GNQmFrk.exe
  2⤵
  PID:5536
- C:\Windows\System\egxpdkX.exe
  C:\Windows\System\egxpdkX.exe
  2⤵
  PID:5440
- C:\Windows\System\frwjgXe.exe
  C:\Windows\System\frwjgXe.exe
  2⤵
  PID:5152
- C:\Windows\System\PMbNdoy.exe
  C:\Windows\System\PMbNdoy.exe
  2⤵
  PID:1860
- C:\Windows\System\gukXmVM.exe
  C:\Windows\System\gukXmVM.exe
  2⤵
  PID:6568
- C:\Windows\System\FPsWsua.exe
  C:\Windows\System\FPsWsua.exe
  2⤵
  PID:6612
- C:\Windows\System\lFxmxyM.exe
  C:\Windows\System\lFxmxyM.exe
  2⤵
  PID:6436
- C:\Windows\System\bHPAyqP.exe
  C:\Windows\System\bHPAyqP.exe
  2⤵
  PID:6772
- C:\Windows\System\EWwDqPQ.exe
  C:\Windows\System\EWwDqPQ.exe
  2⤵
  PID:6440
- C:\Windows\System\pQYNqZZ.exe
  C:\Windows\System\pQYNqZZ.exe
  2⤵
  PID:7124
- C:\Windows\System\DKHWnDA.exe
  C:\Windows\System\DKHWnDA.exe
  2⤵
  PID:3648
- C:\Windows\System\xzXLuTy.exe
  C:\Windows\System\xzXLuTy.exe
  2⤵
  PID:5972
- C:\Windows\System\EYdUjwY.exe
  C:\Windows\System\EYdUjwY.exe
  2⤵
  PID:6876
- C:\Windows\System\Ooqkfcz.exe
  C:\Windows\System\Ooqkfcz.exe
  2⤵
  PID:4472
- C:\Windows\System\PCHoMET.exe
  C:\Windows\System\PCHoMET.exe
  2⤵
  PID:3120
- C:\Windows\System\XfAojAF.exe
  C:\Windows\System\XfAojAF.exe
  2⤵
  PID:3372
- C:\Windows\System\zmTsfgi.exe
  C:\Windows\System\zmTsfgi.exe
  2⤵
  PID:3280
- C:\Windows\System\PpXJbaS.exe
  C:\Windows\System\PpXJbaS.exe
  2⤵
  PID:2848
- C:\Windows\System\WIeTSyc.exe
  C:\Windows\System\WIeTSyc.exe
  2⤵
  PID:6564
- C:\Windows\System\nZTTLnR.exe
  C:\Windows\System\nZTTLnR.exe
  2⤵
  PID:6792
- C:\Windows\System\zwpvqgU.exe
  C:\Windows\System\zwpvqgU.exe
  2⤵
  PID:7040
- C:\Windows\System\XbqZUOZ.exe
  C:\Windows\System\XbqZUOZ.exe
  2⤵
  PID:6208
- C:\Windows\System\bCoEhHx.exe
  C:\Windows\System\bCoEhHx.exe
  2⤵
  PID:5080
- C:\Windows\System\ndUJypR.exe
  C:\Windows\System\ndUJypR.exe
  2⤵
  PID:6928
- C:\Windows\System\xhpmYYq.exe
  C:\Windows\System\xhpmYYq.exe
  2⤵
  PID:3992
- C:\Windows\System\MzAnZXv.exe
  C:\Windows\System\MzAnZXv.exe
  2⤵
  PID:5572
- C:\Windows\System\tDffabU.exe
  C:\Windows\System\tDffabU.exe
  2⤵
  PID:5600
- C:\Windows\System\aNACzIH.exe
  C:\Windows\System\aNACzIH.exe
  2⤵
  PID:5568
- C:\Windows\System\YLFihOj.exe
  C:\Windows\System\YLFihOj.exe
  2⤵
  PID:6676
- C:\Windows\System\uKuqEhx.exe
  C:\Windows\System\uKuqEhx.exe
  2⤵
  PID:2792
- C:\Windows\System\ZXVPssF.exe
  C:\Windows\System\ZXVPssF.exe
  2⤵
  PID:7076
- C:\Windows\System\wDvNzcN.exe
  C:\Windows\System\wDvNzcN.exe
  2⤵
  PID:4892
- C:\Windows\System\biyXkqK.exe
  C:\Windows\System\biyXkqK.exe
  2⤵
  PID:1892
- C:\Windows\System\ygaVvbd.exe
  C:\Windows\System\ygaVvbd.exe
  2⤵
  PID:6256
- C:\Windows\System\TuAUbOb.exe
  C:\Windows\System\TuAUbOb.exe
  2⤵
  PID:6000
- C:\Windows\System\doEpiHE.exe
  C:\Windows\System\doEpiHE.exe
  2⤵
  PID:6896
- C:\Windows\System\fjbKTUu.exe
  C:\Windows\System\fjbKTUu.exe
  2⤵
  PID:6452
- C:\Windows\System\PRVoDsp.exe
  C:\Windows\System\PRVoDsp.exe
  2⤵
  PID:2712
- C:\Windows\System\EzMBGEa.exe
  C:\Windows\System\EzMBGEa.exe
  2⤵
  PID:3808
- C:\Windows\System\ReGrxFd.exe
  C:\Windows\System\ReGrxFd.exe
  2⤵
  PID:5728
- C:\Windows\System\KUYxhXE.exe
  C:\Windows\System\KUYxhXE.exe
  2⤵
  PID:7180
- C:\Windows\System\SjzQxty.exe
  C:\Windows\System\SjzQxty.exe
  2⤵
  PID:7196
- C:\Windows\System\Tvibixt.exe
  C:\Windows\System\Tvibixt.exe
  2⤵
  PID:7212
- C:\Windows\System\bZLPKBh.exe
  C:\Windows\System\bZLPKBh.exe
  2⤵
  PID:7228
- C:\Windows\System\nUxTpXl.exe
  C:\Windows\System\nUxTpXl.exe
  2⤵
  PID:7244
- C:\Windows\System\RhNltED.exe
  C:\Windows\System\RhNltED.exe
  2⤵
  PID:7264
- C:\Windows\System\EnvRoIT.exe
  C:\Windows\System\EnvRoIT.exe
  2⤵
  PID:7280
- C:\Windows\System\HowKEDI.exe
  C:\Windows\System\HowKEDI.exe
  2⤵
  PID:7296
- C:\Windows\System\GuTbmme.exe
  C:\Windows\System\GuTbmme.exe
  2⤵
  PID:7312
- C:\Windows\System\elTQtqm.exe
  C:\Windows\System\elTQtqm.exe
  2⤵
  PID:7328
- C:\Windows\System\yGqALmZ.exe
  C:\Windows\System\yGqALmZ.exe
  2⤵
  PID:7344
- C:\Windows\System\vWDlOqa.exe
  C:\Windows\System\vWDlOqa.exe
  2⤵
  PID:7360
- C:\Windows\System\OwrTxyE.exe
  C:\Windows\System\OwrTxyE.exe
  2⤵
  PID:7376
- C:\Windows\System\NMmpHTK.exe
  C:\Windows\System\NMmpHTK.exe
  2⤵
  PID:7392
- C:\Windows\System\qiyGYHB.exe
  C:\Windows\System\qiyGYHB.exe
  2⤵
  PID:7412
- C:\Windows\System\kwvLiTO.exe
  C:\Windows\System\kwvLiTO.exe
  2⤵
  PID:7428
- C:\Windows\System\yHjgqUw.exe
  C:\Windows\System\yHjgqUw.exe
  2⤵
  PID:7444
- C:\Windows\System\pMJfdXZ.exe
  C:\Windows\System\pMJfdXZ.exe
  2⤵
  PID:7460
- C:\Windows\System\MQRwFxb.exe
  C:\Windows\System\MQRwFxb.exe
  2⤵
  PID:7476
- C:\Windows\System\EQXZRjQ.exe
  C:\Windows\System\EQXZRjQ.exe
  2⤵
  PID:7492
- C:\Windows\System\NJVqaQK.exe
  C:\Windows\System\NJVqaQK.exe
  2⤵
  PID:7508
- C:\Windows\System\eduxkQF.exe
  C:\Windows\System\eduxkQF.exe
  2⤵
  PID:7528
- C:\Windows\System\zssePog.exe
  C:\Windows\System\zssePog.exe
  2⤵
  PID:7544
- C:\Windows\System\JaABVCs.exe
  C:\Windows\System\JaABVCs.exe
  2⤵
  PID:7564
- C:\Windows\System\khhLyic.exe
  C:\Windows\System\khhLyic.exe
  2⤵
  PID:7580
- C:\Windows\System\kIipFrJ.exe
  C:\Windows\System\kIipFrJ.exe
  2⤵
  PID:7596
- C:\Windows\System\DSclGPl.exe
  C:\Windows\System\DSclGPl.exe
  2⤵
  PID:7616
- C:\Windows\System\gRVVwHV.exe
  C:\Windows\System\gRVVwHV.exe
  2⤵
  PID:7632
- C:\Windows\System\ahmLnEO.exe
  C:\Windows\System\ahmLnEO.exe
  2⤵
  PID:7652
- C:\Windows\System\rZvuhbk.exe
  C:\Windows\System\rZvuhbk.exe
  2⤵
  PID:7668
- C:\Windows\System\BFVcsHK.exe
  C:\Windows\System\BFVcsHK.exe
  2⤵
  PID:7684
- C:\Windows\System\AnWGMhv.exe
  C:\Windows\System\AnWGMhv.exe
  2⤵
  PID:7700
- C:\Windows\System\HqQGOnT.exe
  C:\Windows\System\HqQGOnT.exe
  2⤵
  PID:7716
- C:\Windows\System\BxESdeA.exe
  C:\Windows\System\BxESdeA.exe
  2⤵
  PID:7732
- C:\Windows\System\FtsuFgf.exe
  C:\Windows\System\FtsuFgf.exe
  2⤵
  PID:7748
- C:\Windows\System\SNYKWOM.exe
  C:\Windows\System\SNYKWOM.exe
  2⤵
  PID:7764
- C:\Windows\System\wvkfnzL.exe
  C:\Windows\System\wvkfnzL.exe
  2⤵
  PID:7784
- C:\Windows\System\dVgdaJm.exe
  C:\Windows\System\dVgdaJm.exe
  2⤵
  PID:7800
- C:\Windows\System\JWeyHKC.exe
  C:\Windows\System\JWeyHKC.exe
  2⤵
  PID:7816
- C:\Windows\System\JiKuRZI.exe
  C:\Windows\System\JiKuRZI.exe
  2⤵
  PID:7832
- C:\Windows\System\JeDMqXc.exe
  C:\Windows\System\JeDMqXc.exe
  2⤵
  PID:7848
- C:\Windows\System\SXLYuRM.exe
  C:\Windows\System\SXLYuRM.exe
  2⤵
  PID:7864
- C:\Windows\System\Acwipdw.exe
  C:\Windows\System\Acwipdw.exe
  2⤵
  PID:7880
- C:\Windows\System\FKhZthv.exe
  C:\Windows\System\FKhZthv.exe
  2⤵
  PID:7896
- C:\Windows\System\XUCyAMj.exe
  C:\Windows\System\XUCyAMj.exe
  2⤵
  PID:7912
- C:\Windows\System\yAZYAzp.exe
  C:\Windows\System\yAZYAzp.exe
  2⤵
  PID:7928
- C:\Windows\System\KAwSaOd.exe
  C:\Windows\System\KAwSaOd.exe
  2⤵
  PID:7944
- C:\Windows\System\BjNrdBu.exe
  C:\Windows\System\BjNrdBu.exe
  2⤵
  PID:7960
- C:\Windows\System\QcMnhLq.exe
  C:\Windows\System\QcMnhLq.exe
  2⤵
  PID:7976
- C:\Windows\System\RjtrPsJ.exe
  C:\Windows\System\RjtrPsJ.exe
  2⤵
  PID:7992
- C:\Windows\System\XpIRCPR.exe
  C:\Windows\System\XpIRCPR.exe
  2⤵
  PID:8008
- C:\Windows\System\piMIkyy.exe
  C:\Windows\System\piMIkyy.exe
  2⤵
  PID:8024
- C:\Windows\System\iBGgRpq.exe
  C:\Windows\System\iBGgRpq.exe
  2⤵
  PID:8040
- C:\Windows\System\UOLuNNS.exe
  C:\Windows\System\UOLuNNS.exe
  2⤵
  PID:8056
- C:\Windows\System\DmULuVE.exe
  C:\Windows\System\DmULuVE.exe
  2⤵
  PID:8072
- C:\Windows\System\ZFJRCgH.exe
  C:\Windows\System\ZFJRCgH.exe
  2⤵
  PID:8088
- C:\Windows\System\bYZAIUV.exe
  C:\Windows\System\bYZAIUV.exe
  2⤵
  PID:8104
- C:\Windows\System\FoRgowl.exe
  C:\Windows\System\FoRgowl.exe
  2⤵
  PID:8120
- C:\Windows\System\JvymAyW.exe
  C:\Windows\System\JvymAyW.exe
  2⤵
  PID:8136
- C:\Windows\System\mQqupVM.exe
  C:\Windows\System\mQqupVM.exe
  2⤵
  PID:8152
- C:\Windows\System\tBtooLc.exe
  C:\Windows\System\tBtooLc.exe
  2⤵
  PID:8168
- C:\Windows\System\IhadnHW.exe
  C:\Windows\System\IhadnHW.exe
  2⤵
  PID:8184
- C:\Windows\System\gICqzOi.exe
  C:\Windows\System\gICqzOi.exe
  2⤵
  PID:4272
- C:\Windows\System\fcvJyap.exe
  C:\Windows\System\fcvJyap.exe
  2⤵
  PID:7092
- C:\Windows\System\JwJexHI.exe
  C:\Windows\System\JwJexHI.exe
  2⤵
  PID:1744
- C:\Windows\System\KfujknG.exe
  C:\Windows\System\KfujknG.exe
  2⤵
  PID:6520
- C:\Windows\System\yxwttWe.exe
  C:\Windows\System\yxwttWe.exe
  2⤵
  PID:7192
- C:\Windows\System\dTfONOf.exe
  C:\Windows\System\dTfONOf.exe
  2⤵
  PID:7288
- C:\Windows\System\UXKWLwG.exe
  C:\Windows\System\UXKWLwG.exe
  2⤵
  PID:7320
- C:\Windows\System\YJbRZtM.exe
  C:\Windows\System\YJbRZtM.exe
  2⤵
  PID:7236
- C:\Windows\System\RfZYnlL.exe
  C:\Windows\System\RfZYnlL.exe
  2⤵
  PID:7304
- C:\Windows\System\JHrriJh.exe
  C:\Windows\System\JHrriJh.exe
  2⤵
  PID:7368
- C:\Windows\System\ngXrgoM.exe
  C:\Windows\System\ngXrgoM.exe
  2⤵
  PID:7436
- C:\Windows\System\XQQqrzC.exe
  C:\Windows\System\XQQqrzC.exe
  2⤵
  PID:7500
- C:\Windows\System\SNbjcQg.exe
  C:\Windows\System\SNbjcQg.exe
  2⤵
  PID:7572
- C:\Windows\System\QRdMNPd.exe
  C:\Windows\System\QRdMNPd.exe
  2⤵
  PID:7604
- C:\Windows\System\OnTIviz.exe
  C:\Windows\System\OnTIviz.exe
  2⤵
  PID:7388
- C:\Windows\System\ePMJvvG.exe
  C:\Windows\System\ePMJvvG.exe
  2⤵
  PID:7608
- C:\Windows\System\CUIEzkY.exe
  C:\Windows\System\CUIEzkY.exe
  2⤵
  PID:7648
- C:\Windows\System\doLCAjT.exe
  C:\Windows\System\doLCAjT.exe
  2⤵
  PID:7452
- C:\Windows\System\QybHYIN.exe
  C:\Windows\System\QybHYIN.exe
  2⤵
  PID:7552
- C:\Windows\System\FnNfHfE.exe
  C:\Windows\System\FnNfHfE.exe
  2⤵
  PID:7740
- C:\Windows\System\eZGwSma.exe
  C:\Windows\System\eZGwSma.exe
  2⤵
  PID:7772
- C:\Windows\System\MOIvQPO.exe
  C:\Windows\System\MOIvQPO.exe
  2⤵
  PID:7812
- C:\Windows\System\LkwXfNY.exe
  C:\Windows\System\LkwXfNY.exe
  2⤵
  PID:7840
- C:\Windows\System\wwbrqQE.exe
  C:\Windows\System\wwbrqQE.exe
  2⤵
  PID:7728
- C:\Windows\System\xibbxtb.exe
  C:\Windows\System\xibbxtb.exe
  2⤵
  PID:6768
- C:\Windows\System\eECwVvn.exe
  C:\Windows\System\eECwVvn.exe
  2⤵
  PID:7756
- C:\Windows\System\GROplfW.exe
  C:\Windows\System\GROplfW.exe
  2⤵
  PID:7888
- C:\Windows\System\RIzXEif.exe
  C:\Windows\System\RIzXEif.exe
  2⤵
  PID:7940
- C:\Windows\System\PJOMmlP.exe
  C:\Windows\System\PJOMmlP.exe
  2⤵
  PID:7924
- C:\Windows\System\npickCt.exe
  C:\Windows\System\npickCt.exe
  2⤵
  PID:7988
- C:\Windows\System\XOYpMQp.exe
  C:\Windows\System\XOYpMQp.exe
  2⤵
  PID:8048
- C:\Windows\System\myjwlRI.exe
  C:\Windows\System\myjwlRI.exe
  2⤵
  PID:8036
- C:\Windows\System\iXpIkTM.exe
  C:\Windows\System\iXpIkTM.exe
  2⤵
  PID:8084
- C:\Windows\System\YPuMwBz.exe
  C:\Windows\System\YPuMwBz.exe
  2⤵
  PID:8176
- C:\Windows\System\bOZCAcw.exe
  C:\Windows\System\bOZCAcw.exe
  2⤵
  PID:8128
- C:\Windows\System\TUHjzDI.exe
  C:\Windows\System\TUHjzDI.exe
  2⤵
  PID:8164
- C:\Windows\System\QXCyBCN.exe
  C:\Windows\System\QXCyBCN.exe
  2⤵
  PID:6716
- C:\Windows\System\xkiozdQ.exe
  C:\Windows\System\xkiozdQ.exe
  2⤵
  PID:3008
- C:\Windows\System\eULEnif.exe
  C:\Windows\System\eULEnif.exe
  2⤵
  PID:7204
- C:\Windows\System\opOzfaQ.exe
  C:\Windows\System\opOzfaQ.exe
  2⤵
  PID:7468
- C:\Windows\System\BwszqnT.exe
  C:\Windows\System\BwszqnT.exe
  2⤵
  PID:7272
- C:\Windows\System\zteNsMn.exe
  C:\Windows\System\zteNsMn.exe
  2⤵
  PID:7536
- C:\Windows\System\bVVNoQW.exe
  C:\Windows\System\bVVNoQW.exe
  2⤵
  PID:7612
- C:\Windows\System\EwuxCIj.exe
  C:\Windows\System\EwuxCIj.exe
  2⤵
  PID:7592
- C:\Windows\System\yhYCRuC.exe
  C:\Windows\System\yhYCRuC.exe
  2⤵
  PID:7576
- C:\Windows\System\ozDZwqr.exe
  C:\Windows\System\ozDZwqr.exe
  2⤵
  PID:7676
- C:\Windows\System\WhacmEo.exe
  C:\Windows\System\WhacmEo.exe
  2⤵
  PID:7660
- C:\Windows\System\RZOZqWw.exe
  C:\Windows\System\RZOZqWw.exe
  2⤵
  PID:7856
- C:\Windows\System\jPXTfdW.exe
  C:\Windows\System\jPXTfdW.exe
  2⤵
  PID:8000
- C:\Windows\System\MhDvOgq.exe
  C:\Windows\System\MhDvOgq.exe
  2⤵
  PID:8020
- C:\Windows\System\DXQBsvZ.exe
  C:\Windows\System\DXQBsvZ.exe
  2⤵
  PID:7780
- C:\Windows\System\QUFhoYJ.exe
  C:\Windows\System\QUFhoYJ.exe
  2⤵
  PID:7952
- C:\Windows\System\taxjMhx.exe
  C:\Windows\System\taxjMhx.exe
  2⤵
  PID:8180
- C:\Windows\System\KtbJdBK.exe
  C:\Windows\System\KtbJdBK.exe
  2⤵
  PID:8116
- C:\Windows\System\FhvMdku.exe
  C:\Windows\System\FhvMdku.exe
  2⤵
  PID:7176
- C:\Windows\System\upxKouq.exe
  C:\Windows\System\upxKouq.exe
  2⤵
  PID:4980
- C:\Windows\System\IWLlUBD.exe
  C:\Windows\System\IWLlUBD.exe
  2⤵
  PID:7520
- C:\Windows\System\PPIijDH.exe
  C:\Windows\System\PPIijDH.exe
  2⤵
  PID:7384
- C:\Windows\System\vuhymzD.exe
  C:\Windows\System\vuhymzD.exe
  2⤵
  PID:7972
- C:\Windows\System\HBQmuhb.exe
  C:\Windows\System\HBQmuhb.exe
  2⤵
  PID:7356
- C:\Windows\System\vLmKjnH.exe
  C:\Windows\System\vLmKjnH.exe
  2⤵
  PID:7336
- C:\Windows\System\MLKyxId.exe
  C:\Windows\System\MLKyxId.exe
  2⤵
  PID:7828
- C:\Windows\System\clezxeU.exe
  C:\Windows\System\clezxeU.exe
  2⤵
  PID:1544
- C:\Windows\System\RUZSOki.exe
  C:\Windows\System\RUZSOki.exe
  2⤵
  PID:7936
- C:\Windows\System\bGSKtlv.exe
  C:\Windows\System\bGSKtlv.exe
  2⤵
  PID:4260
- C:\Windows\System\aixjSFA.exe
  C:\Windows\System\aixjSFA.exe
  2⤵
  PID:7824
- C:\Windows\System\tsOEgVb.exe
  C:\Windows\System\tsOEgVb.exe
  2⤵
  PID:7696
- C:\Windows\System\rEJlrAH.exe
  C:\Windows\System\rEJlrAH.exe
  2⤵
  PID:7876
- C:\Windows\System\xPrXClp.exe
  C:\Windows\System\xPrXClp.exe
  2⤵
  PID:8208
- C:\Windows\System\qjZwQOl.exe
  C:\Windows\System\qjZwQOl.exe
  2⤵
  PID:8224
- C:\Windows\System\zBPDVFJ.exe
  C:\Windows\System\zBPDVFJ.exe
  2⤵
  PID:8240
- C:\Windows\System\DhyBQkQ.exe
  C:\Windows\System\DhyBQkQ.exe
  2⤵
  PID:8256
- C:\Windows\System\UYvuvzQ.exe
  C:\Windows\System\UYvuvzQ.exe
  2⤵
  PID:8272
- C:\Windows\System\fxfEXVu.exe
  C:\Windows\System\fxfEXVu.exe
  2⤵
  PID:8288
- C:\Windows\System\bFHApgx.exe
  C:\Windows\System\bFHApgx.exe
  2⤵
  PID:8304
- C:\Windows\System\KhkGYUs.exe
  C:\Windows\System\KhkGYUs.exe
  2⤵
  PID:8320
- C:\Windows\System\KXhsgnS.exe
  C:\Windows\System\KXhsgnS.exe
  2⤵
  PID:8336
- C:\Windows\System\DdPxbtd.exe
  C:\Windows\System\DdPxbtd.exe
  2⤵
  PID:8352
- C:\Windows\System\IPHrViU.exe
  C:\Windows\System\IPHrViU.exe
  2⤵
  PID:8368
- C:\Windows\System\HaPWMhV.exe
  C:\Windows\System\HaPWMhV.exe
  2⤵
  PID:8384
- C:\Windows\System\QksQacr.exe
  C:\Windows\System\QksQacr.exe
  2⤵
  PID:8400
- C:\Windows\System\tozakwr.exe
  C:\Windows\System\tozakwr.exe
  2⤵
  PID:8416
- C:\Windows\System\jVELBpC.exe
  C:\Windows\System\jVELBpC.exe
  2⤵
  PID:8432
- C:\Windows\System\aHUCwfI.exe
  C:\Windows\System\aHUCwfI.exe
  2⤵
  PID:8448
- C:\Windows\System\UmEZEoj.exe
  C:\Windows\System\UmEZEoj.exe
  2⤵
  PID:8464
- C:\Windows\System\uFRfjcc.exe
  C:\Windows\System\uFRfjcc.exe
  2⤵
  PID:8480
- C:\Windows\System\MhPGVmf.exe
  C:\Windows\System\MhPGVmf.exe
  2⤵
  PID:8496
- C:\Windows\System\OvluqyZ.exe
  C:\Windows\System\OvluqyZ.exe
  2⤵
  PID:8512
- C:\Windows\System\dxByvNs.exe
  C:\Windows\System\dxByvNs.exe
  2⤵
  PID:8528
- C:\Windows\System\bZSrHyW.exe
  C:\Windows\System\bZSrHyW.exe
  2⤵
  PID:8544
- C:\Windows\System\pIZzzNw.exe
  C:\Windows\System\pIZzzNw.exe
  2⤵
  PID:8568
- C:\Windows\System\TfHJYNj.exe
  C:\Windows\System\TfHJYNj.exe
  2⤵
  PID:8584
- C:\Windows\System\zHEbchU.exe
  C:\Windows\System\zHEbchU.exe
  2⤵
  PID:8600
- C:\Windows\System\BqWFAYD.exe
  C:\Windows\System\BqWFAYD.exe
  2⤵
  PID:8616
- C:\Windows\System\WRMmVml.exe
  C:\Windows\System\WRMmVml.exe
  2⤵
  PID:8632
- C:\Windows\System\hiUZXBI.exe
  C:\Windows\System\hiUZXBI.exe
  2⤵
  PID:8648
- C:\Windows\System\qSzvrjQ.exe
  C:\Windows\System\qSzvrjQ.exe
  2⤵
  PID:8664
- C:\Windows\System\hGXPfSS.exe
  C:\Windows\System\hGXPfSS.exe
  2⤵
  PID:8680
- C:\Windows\System\zmHqkWc.exe
  C:\Windows\System\zmHqkWc.exe
  2⤵
  PID:8696
- C:\Windows\System\IYJhSwx.exe
  C:\Windows\System\IYJhSwx.exe
  2⤵
  PID:8712
- C:\Windows\System\DdJSXWu.exe
  C:\Windows\System\DdJSXWu.exe
  2⤵
  PID:8728
- C:\Windows\System\HJKBYfh.exe
  C:\Windows\System\HJKBYfh.exe
  2⤵
  PID:8744
- C:\Windows\System\yGNQbpM.exe
  C:\Windows\System\yGNQbpM.exe
  2⤵
  PID:8760
- C:\Windows\System\jJOmWqy.exe
  C:\Windows\System\jJOmWqy.exe
  2⤵
  PID:8780
- C:\Windows\System\LMJKpYY.exe
  C:\Windows\System\LMJKpYY.exe
  2⤵
  PID:8796
- C:\Windows\System\eTKAKkd.exe
  C:\Windows\System\eTKAKkd.exe
  2⤵
  PID:8812
- C:\Windows\System\WwMeQPG.exe
  C:\Windows\System\WwMeQPG.exe
  2⤵
  PID:8828
- C:\Windows\System\AWrVeDj.exe
  C:\Windows\System\AWrVeDj.exe
  2⤵
  PID:8844
- C:\Windows\System\oNZXEQs.exe
  C:\Windows\System\oNZXEQs.exe
  2⤵
  PID:8860
- C:\Windows\System\qbMMnbv.exe
  C:\Windows\System\qbMMnbv.exe
  2⤵
  PID:8876
- C:\Windows\System\kcxZUUJ.exe
  C:\Windows\System\kcxZUUJ.exe
  2⤵
  PID:8892
- C:\Windows\System\wqnKfnb.exe
  C:\Windows\System\wqnKfnb.exe
  2⤵
  PID:8912
- C:\Windows\System\aQyDFDU.exe
  C:\Windows\System\aQyDFDU.exe
  2⤵
  PID:8940
- C:\Windows\System\iSWTpsS.exe
  C:\Windows\System\iSWTpsS.exe
  2⤵
  PID:8956
- C:\Windows\System\ZFeLWJX.exe
  C:\Windows\System\ZFeLWJX.exe
  2⤵
  PID:8972
- C:\Windows\System\BDIRGDt.exe
  C:\Windows\System\BDIRGDt.exe
  2⤵
  PID:8988
- C:\Windows\System\DyDaHUU.exe
  C:\Windows\System\DyDaHUU.exe
  2⤵
  PID:9004
- C:\Windows\System\FmBtmfP.exe
  C:\Windows\System\FmBtmfP.exe
  2⤵
  PID:9020
- C:\Windows\System\DTDLlvP.exe
  C:\Windows\System\DTDLlvP.exe
  2⤵
  PID:9036
- C:\Windows\System\JEcTltF.exe
  C:\Windows\System\JEcTltF.exe
  2⤵
  PID:9052
- C:\Windows\System\TYRuCJM.exe
  C:\Windows\System\TYRuCJM.exe
  2⤵
  PID:9068
- C:\Windows\System\ggcLWbj.exe
  C:\Windows\System\ggcLWbj.exe
  2⤵
  PID:9084
- C:\Windows\System\AfitngF.exe
  C:\Windows\System\AfitngF.exe
  2⤵
  PID:9100
- C:\Windows\System\OZaPDFt.exe
  C:\Windows\System\OZaPDFt.exe
  2⤵
  PID:9116
- C:\Windows\System\JHjJYhc.exe
  C:\Windows\System\JHjJYhc.exe
  2⤵
  PID:9136
- C:\Windows\System\lTOdhhr.exe
  C:\Windows\System\lTOdhhr.exe
  2⤵
  PID:9152
- C:\Windows\System\OSuubRU.exe
  C:\Windows\System\OSuubRU.exe
  2⤵
  PID:9168
- C:\Windows\System\OWchDfp.exe
  C:\Windows\System\OWchDfp.exe
  2⤵
  PID:9184
- C:\Windows\System\wujsuvi.exe
  C:\Windows\System\wujsuvi.exe
  2⤵
  PID:9200
- C:\Windows\System\JfZbQtP.exe
  C:\Windows\System\JfZbQtP.exe
  2⤵
  PID:7224
- C:\Windows\System\sjFnNYV.exe
  C:\Windows\System\sjFnNYV.exe
  2⤵
  PID:7340
- C:\Windows\System\GTjhWwM.exe
  C:\Windows\System\GTjhWwM.exe
  2⤵
  PID:8204
- C:\Windows\System\wtnvVhA.exe
  C:\Windows\System\wtnvVhA.exe
  2⤵
  PID:8268
- C:\Windows\System\kVvIQas.exe
  C:\Windows\System\kVvIQas.exe
  2⤵
  PID:8332
- C:\Windows\System\kQjurBY.exe
  C:\Windows\System\kQjurBY.exe
  2⤵
  PID:4928
- C:\Windows\System\XpGyQAS.exe
  C:\Windows\System\XpGyQAS.exe
  2⤵
  PID:7484
- C:\Windows\System\uOzuGDL.exe
  C:\Windows\System\uOzuGDL.exe
  2⤵
  PID:8252
- C:\Windows\System\SXstNKB.exe
  C:\Windows\System\SXstNKB.exe
  2⤵
  PID:8316
- C:\Windows\System\YaZOgxh.exe
  C:\Windows\System\YaZOgxh.exe
  2⤵
  PID:8396
- C:\Windows\System\TcQuqgm.exe
  C:\Windows\System\TcQuqgm.exe
  2⤵
  PID:8488
- C:\Windows\System\mJQdaoL.exe
  C:\Windows\System\mJQdaoL.exe
  2⤵
  PID:8524
- C:\Windows\System\QQTJWBG.exe
  C:\Windows\System\QQTJWBG.exe
  2⤵
  PID:8592
- C:\Windows\System\spedvie.exe
  C:\Windows\System\spedvie.exe
  2⤵
  PID:8476
- C:\Windows\System\EZTcXcW.exe
  C:\Windows\System\EZTcXcW.exe
  2⤵
  PID:8628
- C:\Windows\System\JyozOYg.exe
  C:\Windows\System\JyozOYg.exe
  2⤵
  PID:8576
- C:\Windows\System\ePdynDa.exe
  C:\Windows\System\ePdynDa.exe
  2⤵
  PID:8640
- C:\Windows\System\SPqIrgK.exe
  C:\Windows\System\SPqIrgK.exe
  2⤵
  PID:8644
- C:\Windows\System\iVbAqiF.exe
  C:\Windows\System\iVbAqiF.exe
  2⤵
  PID:8724
- C:\Windows\System\OCnqlAD.exe
  C:\Windows\System\OCnqlAD.exe
  2⤵
  PID:8704
- C:\Windows\System\qLkKuEQ.exe
  C:\Windows\System\qLkKuEQ.exe
  2⤵
  PID:8736
- C:\Windows\System\mvsswuT.exe
  C:\Windows\System\mvsswuT.exe
  2⤵
  PID:8820
- C:\Windows\System\VqdNECy.exe
  C:\Windows\System\VqdNECy.exe
  2⤵
  PID:8884
- C:\Windows\System\KezoKlx.exe
  C:\Windows\System\KezoKlx.exe
  2⤵
  PID:8808
- C:\Windows\System\JyaTLLb.exe
  C:\Windows\System\JyaTLLb.exe
  2⤵
  PID:8868
- C:\Windows\System\nbFmOdl.exe
  C:\Windows\System\nbFmOdl.exe
  2⤵
  PID:8928
- C:\Windows\System\DzfZQzY.exe
  C:\Windows\System\DzfZQzY.exe
  2⤵
  PID:8984
- C:\Windows\System\UobLkPo.exe
  C:\Windows\System\UobLkPo.exe
  2⤵
  PID:8932
- C:\Windows\System\INttAJh.exe
  C:\Windows\System\INttAJh.exe
  2⤵
  PID:8964
- C:\Windows\System\SxAeWJi.exe
  C:\Windows\System\SxAeWJi.exe
  2⤵
  PID:9112
- C:\Windows\System\AvWMPbm.exe
  C:\Windows\System\AvWMPbm.exe
  2⤵
  PID:9180
- C:\Windows\System\QHJJSzd.exe
  C:\Windows\System\QHJJSzd.exe
  2⤵
  PID:9212
- C:\Windows\System\yGwyItQ.exe
  C:\Windows\System\yGwyItQ.exe
  2⤵
  PID:9064
- C:\Windows\System\yprjWTg.exe
  C:\Windows\System\yprjWTg.exe
  2⤵
  PID:8200
- C:\Windows\System\GyWjloI.exe
  C:\Windows\System\GyWjloI.exe
  2⤵
  PID:9160
- C:\Windows\System\uGCEMTb.exe
  C:\Windows\System\uGCEMTb.exe
  2⤵
  PID:8132
- C:\Windows\System\mANkOdf.exe
  C:\Windows\System\mANkOdf.exe
  2⤵
  PID:7744
- C:\Windows\System\ZSnvrru.exe
  C:\Windows\System\ZSnvrru.exe
  2⤵
  PID:8284
- C:\Windows\System\GBfJQHe.exe
  C:\Windows\System\GBfJQHe.exe
  2⤵
  PID:8428
- C:\Windows\System\QCucAxz.exe
  C:\Windows\System\QCucAxz.exe
  2⤵
  PID:8520
- C:\Windows\System\EZwUGiu.exe
  C:\Windows\System\EZwUGiu.exe
  2⤵
  PID:8460
- C:\Windows\System\gPAgSrS.exe
  C:\Windows\System\gPAgSrS.exe
  2⤵
  PID:8504
- C:\Windows\System\axsYOlg.exe
  C:\Windows\System\axsYOlg.exe
  2⤵
  PID:8580
- C:\Windows\System\PgGwZUx.exe
  C:\Windows\System\PgGwZUx.exe
  2⤵
  PID:8776
- C:\Windows\System\SAYxmAF.exe
  C:\Windows\System\SAYxmAF.exe
  2⤵
  PID:8856
- C:\Windows\System\XdkArXY.exe
  C:\Windows\System\XdkArXY.exe
  2⤵
  PID:9080
- C:\Windows\System\LCuvlJU.exe
  C:\Windows\System\LCuvlJU.exe
  2⤵
  PID:8996
- C:\Windows\System\DWrFGpv.exe
  C:\Windows\System\DWrFGpv.exe
  2⤵
  PID:8900
- C:\Windows\System\BvfIaBl.exe
  C:\Windows\System\BvfIaBl.exe
  2⤵
  PID:8740
- C:\Windows\System\QPsORJx.exe
  C:\Windows\System\QPsORJx.exe
  2⤵
  PID:8676
- C:\Windows\System\sTmIkfT.exe
  C:\Windows\System\sTmIkfT.exe
  2⤵
  PID:9176
- C:\Windows\System\RnryBNa.exe
  C:\Windows\System\RnryBNa.exe
  2⤵
  PID:9060
- C:\Windows\System\aMqjXFO.exe
  C:\Windows\System\aMqjXFO.exe
  2⤵
  PID:8220
- C:\Windows\System\DmWsNFy.exe
  C:\Windows\System\DmWsNFy.exe
  2⤵
  PID:9124
- C:\Windows\System\jOIoMBj.exe
  C:\Windows\System\jOIoMBj.exe
  2⤵
  PID:8440
- C:\Windows\System\IgaZloq.exe
  C:\Windows\System\IgaZloq.exe
  2⤵
  PID:8556
- C:\Windows\System\iNtpzYe.exe
  C:\Windows\System\iNtpzYe.exe
  2⤵
  PID:8840
- C:\Windows\System\IzlkVzN.exe
  C:\Windows\System\IzlkVzN.exe
  2⤵
  PID:8688
- C:\Windows\System\XKWCRxh.exe
  C:\Windows\System\XKWCRxh.exe
  2⤵
  PID:8804
- C:\Windows\System\LzxigJX.exe
  C:\Windows\System\LzxigJX.exe
  2⤵
  PID:8756
- C:\Windows\System\DIcKFXC.exe
  C:\Windows\System\DIcKFXC.exe
  2⤵
  PID:9016
- C:\Windows\System\qFVDcbS.exe
  C:\Windows\System\qFVDcbS.exe
  2⤵
  PID:8344
- C:\Windows\System\ncxzOXz.exe
  C:\Windows\System\ncxzOXz.exe
  2⤵
  PID:8364
- C:\Windows\System\qgyJElR.exe
  C:\Windows\System\qgyJElR.exe
  2⤵
  PID:8772
- C:\Windows\System\HoBvYHI.exe
  C:\Windows\System\HoBvYHI.exe
  2⤵
  PID:9132
- C:\Windows\System\YOtWciq.exe
  C:\Windows\System\YOtWciq.exe
  2⤵
  PID:8904
- C:\Windows\System\YsEQlBX.exe
  C:\Windows\System\YsEQlBX.exe
  2⤵
  PID:8952
- C:\Windows\System\HabmfYa.exe
  C:\Windows\System\HabmfYa.exe
  2⤵
  PID:8312
- C:\Windows\System\RpYnvyF.exe
  C:\Windows\System\RpYnvyF.exe
  2⤵
  PID:9096
- C:\Windows\System\IQKEplJ.exe
  C:\Windows\System\IQKEplJ.exe
  2⤵
  PID:8908
- C:\Windows\System\yEvgWSg.exe
  C:\Windows\System\yEvgWSg.exe
  2⤵
  PID:9232
- C:\Windows\System\FybBxoK.exe
  C:\Windows\System\FybBxoK.exe
  2⤵
  PID:9248
- C:\Windows\System\stLoSJU.exe
  C:\Windows\System\stLoSJU.exe
  2⤵
  PID:9268
- C:\Windows\System\MjDNugV.exe
  C:\Windows\System\MjDNugV.exe
  2⤵
  PID:9284
- C:\Windows\System\SAOvUIe.exe
  C:\Windows\System\SAOvUIe.exe
  2⤵
  PID:9300
- C:\Windows\System\yWkCmHE.exe
  C:\Windows\System\yWkCmHE.exe
  2⤵
  PID:9316
- C:\Windows\System\LIrklqw.exe
  C:\Windows\System\LIrklqw.exe
  2⤵
  PID:9332
- C:\Windows\System\nUkqiNl.exe
  C:\Windows\System\nUkqiNl.exe
  2⤵
  PID:9348
- C:\Windows\System\JvMhZNH.exe
  C:\Windows\System\JvMhZNH.exe
  2⤵
  PID:9364
- C:\Windows\System\HlrxKUm.exe
  C:\Windows\System\HlrxKUm.exe
  2⤵
  PID:9380
- C:\Windows\System\HygvnfJ.exe
  C:\Windows\System\HygvnfJ.exe
  2⤵
  PID:9396
- C:\Windows\System\VJptUgF.exe
  C:\Windows\System\VJptUgF.exe
  2⤵
  PID:9412
- C:\Windows\System\sQpRJlL.exe
  C:\Windows\System\sQpRJlL.exe
  2⤵
  PID:9428
- C:\Windows\System\wzjQwOT.exe
  C:\Windows\System\wzjQwOT.exe
  2⤵
  PID:9444
- C:\Windows\System\EarrBrF.exe
  C:\Windows\System\EarrBrF.exe
  2⤵
  PID:9460
- C:\Windows\System\bDFZOGk.exe
  C:\Windows\System\bDFZOGk.exe
  2⤵
  PID:9476
- C:\Windows\System\jQVdMPx.exe
  C:\Windows\System\jQVdMPx.exe
  2⤵
  PID:9492
- C:\Windows\System\OlLhAIo.exe
  C:\Windows\System\OlLhAIo.exe
  2⤵
  PID:9508
- C:\Windows\System\LfQnayD.exe
  C:\Windows\System\LfQnayD.exe
  2⤵
  PID:9524
- C:\Windows\System\KZWesyV.exe
  C:\Windows\System\KZWesyV.exe
  2⤵
  PID:9540
- C:\Windows\System\CdNTwBm.exe
  C:\Windows\System\CdNTwBm.exe
  2⤵
  PID:9556
- C:\Windows\System\sugcHCD.exe
  C:\Windows\System\sugcHCD.exe
  2⤵
  PID:9572
- C:\Windows\System\GJwHgTx.exe
  C:\Windows\System\GJwHgTx.exe
  2⤵
  PID:9588
- C:\Windows\System\ljuUIzJ.exe
  C:\Windows\System\ljuUIzJ.exe
  2⤵
  PID:9604
- C:\Windows\System\TTeLRGQ.exe
  C:\Windows\System\TTeLRGQ.exe
  2⤵
  PID:9620
- C:\Windows\System\QFdBSDf.exe
  C:\Windows\System\QFdBSDf.exe
  2⤵
  PID:9636
- C:\Windows\System\ugwvvqR.exe
  C:\Windows\System\ugwvvqR.exe
  2⤵
  PID:9652
- C:\Windows\System\SDjQqxy.exe
  C:\Windows\System\SDjQqxy.exe
  2⤵
  PID:9668
- C:\Windows\System\XSPjZMH.exe
  C:\Windows\System\XSPjZMH.exe
  2⤵
  PID:9684
- C:\Windows\System\ljLeGue.exe
  C:\Windows\System\ljLeGue.exe
  2⤵
  PID:9700
- C:\Windows\System\EckfvKO.exe
  C:\Windows\System\EckfvKO.exe
  2⤵
  PID:9716
- C:\Windows\System\xbPJPQN.exe
  C:\Windows\System\xbPJPQN.exe
  2⤵
  PID:9732
- C:\Windows\System\CQctQGF.exe
  C:\Windows\System\CQctQGF.exe
  2⤵
  PID:9780
- C:\Windows\System\ahZgshD.exe
  C:\Windows\System\ahZgshD.exe
  2⤵
  PID:9812
- C:\Windows\System\jDXkIeK.exe
  C:\Windows\System\jDXkIeK.exe
  2⤵
  PID:9832
- C:\Windows\System\HSSvall.exe
  C:\Windows\System\HSSvall.exe
  2⤵
  PID:9848
- C:\Windows\System\qiQxBPj.exe
  C:\Windows\System\qiQxBPj.exe
  2⤵
  PID:9868
- C:\Windows\System\pjdSwFF.exe
  C:\Windows\System\pjdSwFF.exe
  2⤵
  PID:9888
- C:\Windows\System\BPPSlAA.exe
  C:\Windows\System\BPPSlAA.exe
  2⤵
  PID:9904
- C:\Windows\System\ELFSZSv.exe
  C:\Windows\System\ELFSZSv.exe
  2⤵
  PID:9924
- C:\Windows\System\GqqyqIt.exe
  C:\Windows\System\GqqyqIt.exe
  2⤵
  PID:9940
- C:\Windows\System\viMucur.exe
  C:\Windows\System\viMucur.exe
  2⤵
  PID:9960
- C:\Windows\System\MUoFJRe.exe
  C:\Windows\System\MUoFJRe.exe
  2⤵
  PID:9976
- C:\Windows\System\nhIWjKZ.exe
  C:\Windows\System\nhIWjKZ.exe
  2⤵
  PID:9996
- C:\Windows\System\RCHKDOJ.exe
  C:\Windows\System\RCHKDOJ.exe
  2⤵
  PID:10020
- C:\Windows\System\XCAaZjr.exe
  C:\Windows\System\XCAaZjr.exe
  2⤵
  PID:10036
- C:\Windows\System\lYbXpiZ.exe
  C:\Windows\System\lYbXpiZ.exe
  2⤵
  PID:10052
- C:\Windows\System\EmUsRCB.exe
  C:\Windows\System\EmUsRCB.exe
  2⤵
  PID:10068
- C:\Windows\System\tgFPFfA.exe
  C:\Windows\System\tgFPFfA.exe
  2⤵
  PID:10084
- C:\Windows\System\bOuzvTy.exe
  C:\Windows\System\bOuzvTy.exe
  2⤵
  PID:10108
- C:\Windows\System\nJPMjfA.exe
  C:\Windows\System\nJPMjfA.exe
  2⤵
  PID:10124
- C:\Windows\System\ZIEUqPN.exe
  C:\Windows\System\ZIEUqPN.exe
  2⤵
  PID:10140
- C:\Windows\System\HQKAvVl.exe
  C:\Windows\System\HQKAvVl.exe
  2⤵
  PID:10164
- C:\Windows\System\CGordHG.exe
  C:\Windows\System\CGordHG.exe
  2⤵
  PID:10180
- C:\Windows\System\MEqNRkO.exe
  C:\Windows\System\MEqNRkO.exe
  2⤵
  PID:10196
- C:\Windows\System\werieBB.exe
  C:\Windows\System\werieBB.exe
  2⤵
  PID:10212
- C:\Windows\System\wSXbbVN.exe
  C:\Windows\System\wSXbbVN.exe
  2⤵
  PID:10228
- C:\Windows\System\DfMxOOK.exe
  C:\Windows\System\DfMxOOK.exe
  2⤵
  PID:9196
- C:\Windows\System\KVfjiDZ.exe
  C:\Windows\System\KVfjiDZ.exe
  2⤵
  PID:9244
- C:\Windows\System\MJZxese.exe
  C:\Windows\System\MJZxese.exe
  2⤵
  PID:9276
- C:\Windows\System\LjMloYH.exe
  C:\Windows\System\LjMloYH.exe
  2⤵
  PID:9308
- C:\Windows\System\mDWTSgX.exe
  C:\Windows\System\mDWTSgX.exe
  2⤵
  PID:9360
- C:\Windows\System\Eaogypa.exe
  C:\Windows\System\Eaogypa.exe
  2⤵
  PID:9420
- C:\Windows\System\dyDFrFr.exe
  C:\Windows\System\dyDFrFr.exe
  2⤵
  PID:9376
- C:\Windows\System\pvmeTyd.exe
  C:\Windows\System\pvmeTyd.exe
  2⤵
  PID:9452
- C:\Windows\System\LwSTRkq.exe
  C:\Windows\System\LwSTRkq.exe
  2⤵
  PID:9516
- C:\Windows\System\rymSBqm.exe
  C:\Windows\System\rymSBqm.exe
  2⤵
  PID:9504
- C:\Windows\System\JHjsltv.exe
  C:\Windows\System\JHjsltv.exe
  2⤵
  PID:9580
- C:\Windows\System\LSUECUj.exe
  C:\Windows\System\LSUECUj.exe
  2⤵
  PID:9600
- C:\Windows\System\rPyQwjY.exe
  C:\Windows\System\rPyQwjY.exe
  2⤵
  PID:9644
- C:\Windows\System\khtaJGM.exe
  C:\Windows\System\khtaJGM.exe
  2⤵
  PID:9664
- C:\Windows\System\budlIIu.exe
  C:\Windows\System\budlIIu.exe
  2⤵
  PID:9724
- C:\Windows\System\iAKkJTY.exe
  C:\Windows\System\iAKkJTY.exe
  2⤵
  PID:9796
- C:\Windows\System\YOdNJbQ.exe
  C:\Windows\System\YOdNJbQ.exe
  2⤵
  PID:9844
- C:\Windows\System\EtcNJRm.exe
  C:\Windows\System\EtcNJRm.exe
  2⤵
  PID:9680
- C:\Windows\System\EmVbjPf.exe
  C:\Windows\System\EmVbjPf.exe
  2⤵
  PID:9948
- C:\Windows\System\VFxkjYm.exe
  C:\Windows\System\VFxkjYm.exe
  2⤵
  PID:9744
- C:\Windows\System\SGVbhFO.exe
  C:\Windows\System\SGVbhFO.exe
  2⤵
  PID:9760
- C:\Windows\System\NaNrhaG.exe
  C:\Windows\System\NaNrhaG.exe
  2⤵
  PID:9820
- C:\Windows\System\aAQBENG.exe
  C:\Windows\System\aAQBENG.exe
  2⤵
  PID:9864
- C:\Windows\System\OSDdaeo.exe
  C:\Windows\System\OSDdaeo.exe
  2⤵
  PID:9968
- C:\Windows\System\kxnIDPk.exe
  C:\Windows\System\kxnIDPk.exe
  2⤵
  PID:10028
- C:\Windows\System\kPHIauL.exe
  C:\Windows\System\kPHIauL.exe
  2⤵
  PID:10008
- C:\Windows\System\hPgGQxY.exe
  C:\Windows\System\hPgGQxY.exe
  2⤵
  PID:10080
- C:\Windows\System\vYWAMSV.exe
  C:\Windows\System\vYWAMSV.exe
  2⤵
  PID:10096
- C:\Windows\System\BfWdjal.exe
  C:\Windows\System\BfWdjal.exe
  2⤵
  PID:10156
- C:\Windows\System\WXREoPG.exe
  C:\Windows\System\WXREoPG.exe
  2⤵
  PID:10188
- C:\Windows\System\KbgVZIg.exe
  C:\Windows\System\KbgVZIg.exe
  2⤵
  PID:9076
- C:\Windows\System\CyublbZ.exe
  C:\Windows\System\CyublbZ.exe
  2⤵
  PID:10136
- C:\Windows\System\SuBweeW.exe
  C:\Windows\System\SuBweeW.exe
  2⤵
  PID:10208
- C:\Windows\System\HfcQkxh.exe
  C:\Windows\System\HfcQkxh.exe
  2⤵
  PID:9436
- C:\Windows\System\KKsSUgE.exe
  C:\Windows\System\KKsSUgE.exe
  2⤵
  PID:9264
- C:\Windows\System\mrSWUkc.exe
  C:\Windows\System\mrSWUkc.exe
  2⤵
  PID:9344
- C:\Windows\System\xgCojLM.exe
  C:\Windows\System\xgCojLM.exe
  2⤵
  PID:9468
- C:\Windows\System\YOdfcjy.exe
  C:\Windows\System\YOdfcjy.exe
  2⤵
  PID:9552
- C:\Windows\System\sSvNIOe.exe
  C:\Windows\System\sSvNIOe.exe
  2⤵
  PID:9472
- C:\Windows\System\hXzilGg.exe
  C:\Windows\System\hXzilGg.exe
  2⤵
  PID:9804
- C:\Windows\System\nhjjDpQ.exe
  C:\Windows\System\nhjjDpQ.exe
  2⤵
  PID:9648
- C:\Windows\System\uELWkoe.exe
  C:\Windows\System\uELWkoe.exe
  2⤵
  PID:9660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EuAJDdI.exe

Filesize
2.2MB

MD5
1a65b78839b7150dab0cd7fbd871b4ae

SHA1
02895ab30755bfa3a8388cc4c6f283555fe8ee08

SHA256
f8b282304c3ef0f803467a843352a68ce015d8cd40105b03721514ed38e2916d

SHA512
03fcafc2bb9c65177d0a746fc07a13de52470b9854e61c0096d8af3335b086ff90735ba4a64d9a932e77bc5e714e7c9022ea05c75daa78cd2572c28024e3f95e

Download Submit
C:\Windows\system\FONupTL.exe

Filesize
2.2MB

MD5
6598789edef4ddd7a67bde6d14e40ec9

SHA1
8808ad4646a6e9e5f3ed20d6a7d4d4124664a951

SHA256
6adfc7677b4d943682111ada9799f2f9506c61c0b100de2f06699d9b85ea1261

SHA512
8a4060dc01acc05ed150fcdff8b675dafe281de1f449c8258bb5115ada8a592a8b770851afd78e70f432d4609799797cffa744ae22b2b7a2f30b5433e7808c3a

Download Submit
C:\Windows\system\HATOFAN.exe

Filesize
2.2MB

MD5
9e2baff51a7c630bc2dbfa7fc0737189

SHA1
b99bd2cd5aa658620d907181d1c92760344751c2

SHA256
6b56575520bb9a182ebec878edea87ae473381dc572137afe7ad86201e8cb8ba

SHA512
77db564892aae372695c88af46416ff9bca38f86f1bc54938a7976a2232a1352b69d54de40f7de895d0464e839351a13fe654b2668d4ab71b1032a9c983dd7f9

Download Submit
C:\Windows\system\HpYviWO.exe

Filesize
2.2MB

MD5
4df37e234fef1f4150901f73dfe97fb0

SHA1
e70dfd6d7c79cb4e0e5c3adeabf50e7a330adb8f

SHA256
45918d495c64dcccabd71cdbd590b7816a9e18600624f245ee799dfb28c887df

SHA512
79c612902a7f8c22bd6614c9acbcd69023af2f8c9fe9bcd5cc726f124a6221846623782b2c100d77545f4415819a3d00ec4a9c7ab27bc3e3a6a057d69a0cc694

Download Submit
C:\Windows\system\KKZPPev.exe

Filesize
2.2MB

MD5
a66b83ebcb9853a60a678d9aa68732c8

SHA1
4c32213073ab72b9025eaca4d2c8fc11437df25b

SHA256
726d7458ac3e9504a1a995a50daa6f5a7e37f020329511ae861f32ce1f8344bc

SHA512
aeda00739a3dd52bb08f397dc7d5d7f3a8c546b89a2a0501372f0b95af46ef9db69e136ab16e28ed4ad1d69f22c575bc159fbb052d382f88ed44d7f698e0e37d

Download Submit
C:\Windows\system\KoUAmrL.exe

Filesize
18B

MD5
12d764af0242c5e9d5789b2b47191cab

SHA1
27c955d8895a3dd74067d2c8c2ddd4db89461025

SHA256
22fad68840942c3468f5bd85214408fef29e825f9fa4402f948647dd9bfcfbbf

SHA512
345f6542208a71772d6f12acd8a7a946bff3a5b0364922fdfdbb97f70b74edd2676762bb63e6f4b3817ce1c84a3d722837cfba2c47e6d30027d13c7c41912d58

Download Submit
C:\Windows\system\LguVgtS.exe

Filesize
2.2MB

MD5
3de0eaac28b84837257946904e935c78

SHA1
90ee4e4ae6abd1b87a4d70c690823c16b2173156

SHA256
1d39be825fa319daf193a615daa3738dbdee6cc4d64d965735c0b72717c22db0

SHA512
c11796106a70f2a295ffe198d793e149276882e9231ee43364c4fccc3bb180c6a55109c02454de5a5b8a30ed03621bf668149b125c0d09ba04ac3206abb5cd2f

Download Submit
C:\Windows\system\MlzFRJy.exe

Filesize
2.2MB

MD5
6289b2460a16f503a0c125b06bc1db55

SHA1
d3a5407c38944a2451e1425c7c6e6a45042ca1d7

SHA256
f302c7954529548acfd53a14c81a425d9a4b4865613c479d3ff52cb9e2e553d3

SHA512
48aa3ef529169bd021af2fc6798c20c411752665c929da94d7eab4e645a0396f9950dadf8c21b9c96b04de1d6c14fa8e1306244a1ee263a481d96dd7566e0d15

Download Submit
C:\Windows\system\PXabxfH.exe

Filesize
2.2MB

MD5
f01f6468d6c9ea32a828e6d5761f0887

SHA1
77f48bb80442e76b6a8f634acca127a46235c1c9

SHA256
13556c707c58e93c52a63ec7d8742e8abefeedbe300d52f67dce7c192576352c

SHA512
4dbc39209080e7b6c3ecef8d16e39095098b2af2743fc966307be0c88c8eceb6495ba2a3e30d5c398bb450b9e25233f5bdd21202e735e8995fef745fa3379f26

Download Submit
C:\Windows\system\Rpaekxe.exe

Filesize
2.2MB

MD5
6531fd1108f7e71a1e5761e2a12a2745

SHA1
ebc3655f4e731aa019b06ba15d747aaafce108e7

SHA256
36bfc12ec068fd0834bdc6d95bb405edcdec4d735ced33416288075550e9b62e

SHA512
c6e855c81bc5e670bb0d1a2f4265c89eaeae423c00186eb3cbd54904fd3841d6403f751c67060b678f63cf97f8504a640de793ce03d7c4ced9533872e6a68d56

Download Submit
C:\Windows\system\SPSeBIe.exe

Filesize
2.2MB

MD5
47eed8633cc90d20f0f549a2a1433afc

SHA1
8a64f85831d009f5f17983f805625422534c7066

SHA256
69fb61f104b46f42ccc28eaccac6c2504f4b868c0a0062f0a146dba11821945e

SHA512
74c89dbea1db39ac3a0be68fc1682a31300a6bfd55e84670dbc005095308ca067f78cb2bafe2831eb114bf8002e54a502c41d53ecb8328c3f175f1c0a360cf09

Download Submit
C:\Windows\system\TLDEEfa.exe

Filesize
2.2MB

MD5
db5cd8e46512d9c82b24f7872057e55b

SHA1
30686384e221e5bdbaa6578efca5aac4ba2fe88e

SHA256
21a477319c53c35efda14c424a573446885c3f447d29be07993c284333216200

SHA512
86c2f83a48e37991f18ce2bd51edb3acfa8956414aed8f31130d2846076cf0ccf575fc2926621e31f6cde9d9cc1550a3de4cfa9a1ec938ae3f58ef740ee4a4b1

Download Submit
C:\Windows\system\TVQUrLi.exe

Filesize
2.2MB

MD5
5509161d411c449b3431ae7353f6e4a9

SHA1
677d2096f6048b7a2631e34664bf1365a84a7bcc

SHA256
7923e009befcf06d0e1177e017caab3f95c8c6a4cd3c26e05ad807ca09a3ffdf

SHA512
186227035fd7452c58f2fc3271e407a0e63455b59619fece7c7ec91379cd3670d291c631ecae3c4398b459ce5b5362f6422fe98a787e756f365991707e0b4ecc

Download Submit
C:\Windows\system\TdoNDfw.exe

Filesize
2.2MB

MD5
068143e44125a545b6a3475524fddf10

SHA1
51216ce36dd94d9f5b305d715727f1e2391dbc7c

SHA256
8ec6d178668eee212fa4ecdd00d9dfcac8c980e9e5f8891b1a174832e9435a15

SHA512
a6485b87e1c51bb0a6711e335548b9de5cadb7ed96a7cba7ac4119323bac745775b72bd2e711a0545692347afcb9f10791b90785d9ecd6279001e143ecb3b92a

Download Submit
C:\Windows\system\UqGUUQJ.exe

Filesize
2.2MB

MD5
d6e35c4419021edd4b5fe26a5a57ab33

SHA1
7136e5dc1578ae994f89c723c76a7dc3d79071a4

SHA256
fe277938a7ff039500a81b021912464c83710072de9d03c21bbb8188b314db2c

SHA512
45ccc67fa407a8e3324abdb8cd3abcf77752cabb7039288a28a929941d69e04cfd60afdc1698de65d3ab90906b8152b181c32c1b977140e6de437ae65afe337e

Download Submit
C:\Windows\system\aHaDSqb.exe

Filesize
2.2MB

MD5
0c922ff76800c8a19a7f5299fd20d670

SHA1
dd1d7ae32b82a400ae1604b929ff48a51e60f354

SHA256
54ae8afce27008dcfd2f86d657e507edecfe98b9b9cb067ff96e694e248eeb5c

SHA512
24539ab3d0625eb3d3fbd6a6c05aebfc6b6fad886a760d59bc3746771e0088dd16736016d77a3ca995337d7f4fc48836bac15b4397de5f46330a959d20d8c5a6

Download Submit
C:\Windows\system\asrpSKs.exe

Filesize
2.2MB

MD5
76146f06b8e7c1130b015996d9f3dddf

SHA1
36f8f5377c2bde06014e3bd63e280df13177b87a

SHA256
9dea12947449bc093a187d7263de71f0034564635095bd1b006dc7646610d0ea

SHA512
24c64c1f93eee33adaf716626e8e07c55a18cfcbb5e9cfa8301122135981d14829f0b4e76341c4cefb5adfcf03355580caeaa5a227c2c750da9780d4dc09f014

Download Submit
C:\Windows\system\bDbpNik.exe

Filesize
2.2MB

MD5
76c174c987cc34c130d6cbfcb3713ff1

SHA1
d9fe1f215151f6ee29fe504b874eccb77d5ba47c

SHA256
de21a2a095fa696d5cef4baac022e64fd7319595a2a4dd0ea25b99e53e10a111

SHA512
28463dc3d85bf53237bcb460f1484e3c1229ca23cfedba405f5e64af10a844bb4894c361833543a12960814da5515c291677faf6d5e26e202b1ab09675a40492

Download Submit
C:\Windows\system\bIALLNL.exe

Filesize
2.2MB

MD5
5dba3395d147eae792f6524dc008c708

SHA1
cebe88aca8218ae3426b86a7a30b2791dfe4ccd3

SHA256
201e3c8ebdb1b071ec73ca70d4d96cf66b5520d9ee9759697ff7a33aabfe11e4

SHA512
fa96752972ae54c924ee7a5cdb90b652fa5788f7f0ccf895e36ffd41827658d5ab382b84af017d9185a19ac8479bdd1e396571ade9f5d6be0079187133bb1c95

Download Submit
C:\Windows\system\fABDShf.exe

Filesize
2.2MB

MD5
01e02a92985cb72fa9e8b4a9ca68a8b0

SHA1
0449df0764f381123558d71e2205b297414e371d

SHA256
31d6579836009cd5e6d9487353be1c2f2f5292f9e52a576a3ef305acda5095f5

SHA512
4bf55e1ceded20da0b82c6a016fa83de9ee37deddebbf2671f89d3aaca3233b9b685fe14df568194aae6beab9ee6ad3141f4272140f9168036280af34ae4c84b

Download Submit
C:\Windows\system\iVCoDTe.exe

Filesize
2.2MB

MD5
1c0cd88a087b9a90d17b22dffa958518

SHA1
5ea0731a17a13a0d52d490ff8ac47188c81f9bd5

SHA256
12cb17e41ad3618f082b6abceafe5ce03a750d86bcc875f565a09cc9d8143683

SHA512
e7c7714e1f1094f67578f6c088cb99334201746cfc8e3580a008a5bfcf2aa80206cdacb58766f1183af819f37e6f625005b949b9a6ecf554a7f23f77fb037dbc

Download Submit
C:\Windows\system\jJlHbKK.exe

Filesize
2.2MB

MD5
2a04d6482f0efda1967d13f928a56272

SHA1
a5a0e1f77b5a0b70e99149f76f3bbcb4748dbee7

SHA256
a304792c53e3c0a1f775c7035205735ca8ea2f90f8f91f7b93b28cc50f7486ff

SHA512
97613648decb50afb78f3839fd88cc499a2dd1f33760fa0c8d8284126d4c85cc9377cf1de551f848779598eab8449e9f5b8f018f07805b6082432ec4cf5fc493

Download Submit
C:\Windows\system\jQMZMoU.exe

Filesize
2.2MB

MD5
fe402464803b41d43db43fe1457f28aa

SHA1
63c05dd1dd8f34cc26766a8efe9f00705f30cec9

SHA256
792b104bc8f1aceebc9d38cd3199f7671eeeca83ae1ba36174964ba7407ff686

SHA512
5ec6db36c48bf50191bfe64deb48249c403fd5d04e29fc9ff8c34be3ac9db62d0f1f79c119a4cfc794a886bc438ba610e8ded012ec70bfc3bc32eee7a76feb1c

Download Submit
C:\Windows\system\mPMmMEe.exe

Filesize
2.2MB

MD5
c7059650eaca47e32081f03195a67f20

SHA1
f036c91811c62a4fe890b497703efd8c0927f783

SHA256
390494423ba01c13005580ca8a446f98aff833729a96144de0b9c413699f97fc

SHA512
b43781d8ffef0304e77205160bfe784757d5f9a361ded1ad577cf58582d9aef67a5a537c3c3d468bae91502c985f1dc3fa3fbda409844f1f967fa9ae9b9a289a

Download Submit
C:\Windows\system\rHjJamW.exe

Filesize
2.2MB

MD5
5a49b963279f8ae6050973ce6d4c87f5

SHA1
4f4b0f2eb822bbdbed9263bc3f0e6e00708864d0

SHA256
9aaed95499232a9c572c7222b5f08f9c885e2a375cddeaf4c38b9f09effecaeb

SHA512
43b2f9cc5898aeeea7eb2992fdfde0fa8f92c0b42155ab084acdb0a8362a3e831d94ea21c38d6feb86c01043fd3056faa3f45df31079f27067f10c94ace830cd

Download Submit
C:\Windows\system\tyOroFw.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\wKLsVOV.exe

Filesize
2.2MB

MD5
dff5dcc68caa0588be077329e32def31

SHA1
c14375019f9baeaef066c4f6e6537a7655f0d835

SHA256
10ea2e0c3d35db135c7c9ae2c475111a7a8259845f4965afdf141ff54074624f

SHA512
0ec687baaf306f4dd9e72e411adbe8dd8f7025e2c311cbe52fd3e232cbd417a339ded1a0a8aac067b76907cf750dc973c9c82f64b80dc555a978d166c96dd06c

Download Submit
C:\Windows\system\yskYalh.exe

Filesize
2.2MB

MD5
d7f9b28418d58922bb60d1993929b37f

SHA1
a206fa5898e59b8589f8b10f08fa0c4151ff7943

SHA256
7350d0866230225c72de325f92fe66d19c1a491c58df3ee891bdef284b5f51e5

SHA512
a34add2e6d0e1a42421a8717d6c943f42490deff2557d543bb120a38935b6bf522079b29f60d9c95a4350821e812813dd3709691c37a0a3fbf91fdfafbc6c16e

Download Submit
C:\Windows\system\zbpTosF.exe

Filesize
2.2MB

MD5
aee5a3a0f811ee9bf9920f9b9a174de5

SHA1
383103606756d8b67e981da7359d9c2fb306a1d8

SHA256
b01769ff0e261098b7d1ae8367320e8a76c8e52f6b1cb2da83c6402eecf836b2

SHA512
d714d6d7486581624df0ae8c0ac5eeeab30f15f9b66f35533c3dd06905fa18b4cc6a0292bf2b55c6dd2df1c6132f73319ee367c00625850b4ee0f099021d11a4

Download Submit
\Windows\system\Eobztkl.exe

Filesize
2.2MB

MD5
d0e7e17890ef7c3f9a3b8a941bf057ab

SHA1
cfef2c9e014dbf3ed44fb5d3ccaec15bc4e9869c

SHA256
d8f22ff97673933cde041f77695f3f5cc654e7c08c5616207bac1497b06bb31b

SHA512
29e51fca3b50e37d51028cf5e36841fcee16ed1330bdc375985de8fbb2d3f0c6d1783f905bc619d8ab6e1665acab995934ae0f89512d53b74d67402796cb93dd

Download Submit
\Windows\system\JzkDQNM.exe

Filesize
2.2MB

MD5
1a930a006b8474eeedaa6560f950c583

SHA1
a8229b0db603ff5d8b5bca3eb27b9bfc5df21ec6

SHA256
ac3b84c0507589231f263f739d28447fd43055556eeb7638d60069d34a8bb6fb

SHA512
a86d02346a8033a0f5d2ef4a9ac3ebd9f1dd773cb1d107dc9f54fcb46473335a664030a25b3e765f0682981fde8760ebb3dae4a4487a46a4c5a59bbf153b39a5

Download Submit
\Windows\system\PPzNYrw.exe

Filesize
2.2MB

MD5
9ce14bc1c93ccc9242a3692596a73b8b

SHA1
c1e878481aa0c95009e06a1ce5749d25ebe08e46

SHA256
f872644a8d0350fc2cc39be0489371518e57390f3dc464f3112c563f9e8e72ef

SHA512
1ea4dd39103258be689fbad7502787bd1049432977e4d6c0f9bf446681e4e9610d62153b9a81c22ad8f54ecce662c62f72680d0d6403aadc78972f8c08dd5e56

Download Submit
\Windows\system\SRQQYGF.exe

Filesize
2.2MB

MD5
06eb25d6a7f1d9257076eaf6c34682f3

SHA1
5d68c001532b74cb146eab599c10fd9d7ac247c7

SHA256
3ecd265a54d76668d77a9b8d69fe4840fd5fac6f5ae2c0a65353eb1b23743299

SHA512
e306474e90c1b9d3dd80eb7f81fca992fd83c8161e90c7faecbb4f68edab48df68babf2fec5ead6de32a0b3234587aaafec849c51d897db5789a913a5437e0b3

Download Submit
\Windows\system\aMJzIaO.exe

Filesize
2.2MB

MD5
c0ae3e604f4e02cf4adf46d5eb3802b9

SHA1
ba59ca6c42d037368cc677cf334412727811aa87

SHA256
d7a9862408f3e6ed18fe4dd20815a710986c4752230004f06905f9b423a6f39e

SHA512
0b9e68c5b783a938d9c32d2b1b38f68329116b1f51edc7299f05d77f6d59a4f5fc542f284382b71a48e87c11cab8f43e6c9abdfe43893ff607aa463224908854

Download Submit
\Windows\system\gIbolzH.exe

Filesize
2.2MB

MD5
9beb296299797eec9d9a53e4117e4d7a

SHA1
93bc21b444baa3299bd18a299d8c7f90a1df532b

SHA256
f11b846e2da74b24b98614dc06c6301de2b6b222db6ea4f5947fc250cca45fa9

SHA512
6d8d944d34c7b8a0c020ae98fe8e56d234763afdcec1c10cbd9861056f89fe8cba8691be84bd41b5e4c8bed3fe2dcee05c661fe71949b686ea640624d126b579

Download Submit
memory/1780-5906-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-155-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-6072-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-154-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-6084-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2216-161-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2224-153-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-159-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2224-150-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2224-13653-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-146-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-13432-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-144-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-13339-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2224-0-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2224-157-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2224-8-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-18-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2224-160-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-164-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-13236-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2224-12792-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-152-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2224-148-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-6083-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-149-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-158-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2420-6073-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2548-6051-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2548-147-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2584-6046-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2584-151-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2708-143-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2708-6048-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2732-5905-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-145-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-142-0x000007FEF4E60000-0x000007FEF57FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-19-0x000007FEF511E000-0x000007FEF511F000-memory.dmp

Filesize
4KB

Download
memory/2780-138-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2780-128-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2780-140-0x000007FEF4E60000-0x000007FEF57FD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-2489-0x000007FEF4E60000-0x000007FEF57FD000-memory.dmp

Filesize
9.6MB

Download
memory/2816-15-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-6049-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-156-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download