xmrig | 3d9c9a03529af4963eef1ce5fede07c44f9425abb91ccf15f046b2d0363dca78

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
Size

2.1MB
MD5

09e32f1ce2e5a213385f52e1c1c137e4
SHA1

118538d9caae6b823b046aea544b8a87aee9d27c
SHA256

3d9c9a03529af4963eef1ce5fede07c44f9425abb91ccf15f046b2d0363dca78
SHA512

9704eb3d766bf4ae03fd729bdcc022bcab5db292094a4541ee6f1281151c27314ac6f820f998b23dc12805f04d4b0e91d44390631becaa289d84e16f7a297eec
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafnmo5mYN/:NABM

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2560-9-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2528-145-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2848-157-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/592-160-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2876-158-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2340-151-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2468-149-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2736-147-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2848-2775-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2564-3256-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2736-3258-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2340-3257-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/592-3757-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2560-3770-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2468-3781-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2528-3875-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2876-3934-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2560	OeLzSzn.exe
2564	bHEudyn.exe
2528	eogOkCb.exe
2736	kbDeqeZ.exe
2468	pkfYaEK.exe
2340	KnrgVxc.exe
2848	FEVQrJJ.exe
2876	kVStJfj.exe
592	yCkVlci.exe
2396	PHtkMmS.exe
1264	BSmOjkb.exe
1384	dhipmmu.exe
2500	ohOfyVR.exe
2452	ZBnJaVP.exe
1680	MyABMJb.exe
596	EEzftFL.exe
1988	xAojgfQ.exe
1960	oFCwRsp.exe
2472	QYzaxsz.exe
1136	TNyQmjk.exe
976	drelZyy.exe
1636	aZnTxqT.exe
1120	DbaKirq.exe
2672	GcrgcMB.exe
2976	tLNElGj.exe
3024	blbrhrn.exe
2304	nqGDPDl.exe
2384	jXcGZpf.exe
980	IzZMjlh.exe
1628	kdIvIwM.exe
1544	QgbqqNV.exe
2244	ZEkKkBn.exe
1944	ILiHalD.exe
1924	pBMZDlW.exe
2044	JZKjtAf.exe
1100	OaXtAcH.exe
1768	IHuegJn.exe
1676	MCCHGtD.exe
3044	IiLBNPT.exe
2292	qGoRips.exe
1772	hfIbfdV.exe
1700	ZLAdnWw.exe
2888	FzspXfb.exe
2752	HXXsUJX.exe
1692	YGYzePN.exe
1708	RMLvCXJ.exe
2544	dVmYunX.exe
1248	HtcYHum.exe
528	eygbcqJ.exe
488	wfzSwXC.exe
1668	mrjZhbL.exe
1588	VlIClJx.exe
1140	XDPPoyi.exe
1168	gWDzeyV.exe
772	XuVkbLT.exe
580	hrWUkZw.exe
1480	WsDGfmD.exe
1060	IQtlEqg.exe
2036	xQQicHW.exe
1108	VFFqTza.exe
1604	cqhtgCd.exe
1956	ZFnOtWd.exe
2612	jzzYEwC.exe
2904	eXCPYBr.exe

Loads dropped DLL 64 IoCs

pid	Process
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2656-1-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x000e000000014698-3.dat	upx
behavioral1/memory/2560-9-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/files/0x002a000000014b6d-10.dat	upx
behavioral1/memory/2564-19-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/files/0x0008000000014fe1-12.dat	upx
behavioral1/files/0x000f0000000006fd-29.dat	upx
behavioral1/files/0x00070000000155d4-36.dat	upx
behavioral1/files/0x0006000000016cf0-46.dat	upx
behavioral1/files/0x0008000000015364-34.dat	upx
behavioral1/files/0x0013000000014c67-57.dat	upx
behavioral1/files/0x0006000000016d24-63.dat	upx
behavioral1/files/0x0006000000016d4f-77.dat	upx
behavioral1/files/0x0006000000016d84-84.dat	upx
behavioral1/files/0x0006000000016e56-93.dat	upx
behavioral1/files/0x0006000000017090-107.dat	upx
behavioral1/files/0x0006000000018ae2-125.dat	upx
behavioral1/files/0x0006000000018b15-133.dat	upx
behavioral1/files/0x0006000000018b37-143.dat	upx
behavioral1/memory/2528-145-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2848-157-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/592-160-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0006000000018ba2-190.dat	upx
behavioral1/files/0x0006000000016d01-53.dat	upx
behavioral1/files/0x0006000000018d06-193.dat	upx
behavioral1/files/0x0006000000016d89-188.dat	upx
behavioral1/files/0x0006000000018b96-185.dat	upx
behavioral1/files/0x0006000000018b6a-177.dat	upx
behavioral1/files/0x0006000000016d55-170.dat	upx
behavioral1/files/0x0006000000016d4a-168.dat	upx
behavioral1/files/0x0006000000018b42-162.dat	upx
behavioral1/files/0x0006000000016d36-139.dat	upx
behavioral1/files/0x0006000000018b33-137.dat	upx
behavioral1/files/0x0006000000018ae8-127.dat	upx
behavioral1/files/0x00050000000186a0-119.dat	upx
behavioral1/files/0x000500000001868c-109.dat	upx
behavioral1/files/0x0006000000016d11-104.dat	upx
behavioral1/files/0x000600000001704f-96.dat	upx
behavioral1/files/0x0006000000016d41-76.dat	upx
behavioral1/files/0x0006000000018b73-182.dat	upx
behavioral1/files/0x0006000000018b4a-175.dat	upx
behavioral1/memory/2876-158-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2340-151-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2468-149-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2736-147-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x0005000000018698-115.dat	upx
behavioral1/files/0x0007000000015cb9-40.dat	upx
behavioral1/memory/2848-2775-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2564-3256-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2736-3258-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2340-3257-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/592-3757-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2560-3770-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2468-3781-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2528-3875-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2876-3934-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NtlnvyT.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\mebPXDj.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\TAOTUPx.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\ofSoYIa.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\rAJQKHB.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\OVAzpxq.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\VAZbFjp.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\YXweZOZ.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\RSQfqYo.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\urkJigK.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\oBMHzYp.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\VmoLNzD.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\LqhKfel.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\VTBxrUD.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\PWMVDck.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\zIQjlWi.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\cZPGLJh.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\HlHqiQS.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\cqhtgCd.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\JmmZMsb.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\TRTpsRW.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\tgRqNmq.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\IaUIfBp.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\loUGYEN.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\dAFlqBb.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\pIybSuT.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\aSNsupv.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\exLRCZx.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\CtfFSfi.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\nvNdvJH.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\HOEMHgO.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\azoFCZd.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\pDXKhfE.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\RuANLIv.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\bbUCtYk.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\VdALZSA.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\JAfRvCQ.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\YZYrJnv.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\SkazSvI.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\lBiCxOf.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\mNdAXdT.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\BBDyXhe.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\mGeKJzw.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\copvowJ.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\WfJUVWB.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\tWxuPOO.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\emBrzEt.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\ZGwfCrX.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\GMkKhXM.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\atHXhnS.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\RUoMjPo.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\UEfqNFn.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\LgOMpbg.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\CEtZStR.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\NwgspIW.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\bOHDdRi.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\lNAzVPb.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\MrkwAUp.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\JsSfEyS.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\COimipb.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\Urrlnfw.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\iEmSCte.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\QyKzlIH.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
File created	C:\Windows\System\eXvbgZe.exe	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2504	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
Token: SeDebugPrivilege	2504	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2504	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	29
PID 2656 wrote to memory of 2504	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	29
PID 2656 wrote to memory of 2504	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	29
PID 2656 wrote to memory of 2560	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2560	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2560	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	30
PID 2656 wrote to memory of 2564	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	31
PID 2656 wrote to memory of 2564	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	31
PID 2656 wrote to memory of 2564	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	31
PID 2656 wrote to memory of 2528	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	32
PID 2656 wrote to memory of 2528	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	32
PID 2656 wrote to memory of 2528	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	32
PID 2656 wrote to memory of 2736	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	33
PID 2656 wrote to memory of 2736	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	33
PID 2656 wrote to memory of 2736	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	33
PID 2656 wrote to memory of 2468	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	34
PID 2656 wrote to memory of 2468	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	34
PID 2656 wrote to memory of 2468	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	34
PID 2656 wrote to memory of 2340	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	35
PID 2656 wrote to memory of 2340	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	35
PID 2656 wrote to memory of 2340	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	35
PID 2656 wrote to memory of 2876	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	36
PID 2656 wrote to memory of 2876	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	36
PID 2656 wrote to memory of 2876	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	36
PID 2656 wrote to memory of 2848	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	37
PID 2656 wrote to memory of 2848	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	37
PID 2656 wrote to memory of 2848	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	37
PID 2656 wrote to memory of 592	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	38
PID 2656 wrote to memory of 592	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	38
PID 2656 wrote to memory of 592	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	38
PID 2656 wrote to memory of 2396	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	39
PID 2656 wrote to memory of 2396	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	39
PID 2656 wrote to memory of 2396	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	39
PID 2656 wrote to memory of 596	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	40
PID 2656 wrote to memory of 596	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	40
PID 2656 wrote to memory of 596	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	40
PID 2656 wrote to memory of 1264	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	41
PID 2656 wrote to memory of 1264	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	41
PID 2656 wrote to memory of 1264	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	41
PID 2656 wrote to memory of 976	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	42
PID 2656 wrote to memory of 976	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	42
PID 2656 wrote to memory of 976	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	42
PID 2656 wrote to memory of 1384	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	43
PID 2656 wrote to memory of 1384	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	43
PID 2656 wrote to memory of 1384	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	43
PID 2656 wrote to memory of 1120	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	44
PID 2656 wrote to memory of 1120	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	44
PID 2656 wrote to memory of 1120	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	44
PID 2656 wrote to memory of 2500	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	45
PID 2656 wrote to memory of 2500	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	45
PID 2656 wrote to memory of 2500	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	45
PID 2656 wrote to memory of 2672	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	46
PID 2656 wrote to memory of 2672	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	46
PID 2656 wrote to memory of 2672	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	46
PID 2656 wrote to memory of 2452	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	47
PID 2656 wrote to memory of 2452	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	47
PID 2656 wrote to memory of 2452	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	47
PID 2656 wrote to memory of 2304	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	48
PID 2656 wrote to memory of 2304	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	48
PID 2656 wrote to memory of 2304	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	48
PID 2656 wrote to memory of 1680	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	49
PID 2656 wrote to memory of 1680	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	49
PID 2656 wrote to memory of 1680	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	49
PID 2656 wrote to memory of 1944	2656	09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09e32f1ce2e5a213385f52e1c1c137e4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\System\OeLzSzn.exe
  C:\Windows\System\OeLzSzn.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\bHEudyn.exe
  C:\Windows\System\bHEudyn.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\eogOkCb.exe
  C:\Windows\System\eogOkCb.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\kbDeqeZ.exe
  C:\Windows\System\kbDeqeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\pkfYaEK.exe
  C:\Windows\System\pkfYaEK.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\KnrgVxc.exe
  C:\Windows\System\KnrgVxc.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\kVStJfj.exe
  C:\Windows\System\kVStJfj.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\FEVQrJJ.exe
  C:\Windows\System\FEVQrJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\yCkVlci.exe
  C:\Windows\System\yCkVlci.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\PHtkMmS.exe
  C:\Windows\System\PHtkMmS.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\EEzftFL.exe
  C:\Windows\System\EEzftFL.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\BSmOjkb.exe
  C:\Windows\System\BSmOjkb.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\drelZyy.exe
  C:\Windows\System\drelZyy.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\dhipmmu.exe
  C:\Windows\System\dhipmmu.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\DbaKirq.exe
  C:\Windows\System\DbaKirq.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\ohOfyVR.exe
  C:\Windows\System\ohOfyVR.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\GcrgcMB.exe
  C:\Windows\System\GcrgcMB.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ZBnJaVP.exe
  C:\Windows\System\ZBnJaVP.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\nqGDPDl.exe
  C:\Windows\System\nqGDPDl.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\MyABMJb.exe
  C:\Windows\System\MyABMJb.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ILiHalD.exe
  C:\Windows\System\ILiHalD.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\xAojgfQ.exe
  C:\Windows\System\xAojgfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\pBMZDlW.exe
  C:\Windows\System\pBMZDlW.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\oFCwRsp.exe
  C:\Windows\System\oFCwRsp.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\JZKjtAf.exe
  C:\Windows\System\JZKjtAf.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\QYzaxsz.exe
  C:\Windows\System\QYzaxsz.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\OaXtAcH.exe
  C:\Windows\System\OaXtAcH.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\TNyQmjk.exe
  C:\Windows\System\TNyQmjk.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\IHuegJn.exe
  C:\Windows\System\IHuegJn.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\aZnTxqT.exe
  C:\Windows\System\aZnTxqT.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\IiLBNPT.exe
  C:\Windows\System\IiLBNPT.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\tLNElGj.exe
  C:\Windows\System\tLNElGj.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\YGYzePN.exe
  C:\Windows\System\YGYzePN.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\blbrhrn.exe
  C:\Windows\System\blbrhrn.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\HtcYHum.exe
  C:\Windows\System\HtcYHum.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\jXcGZpf.exe
  C:\Windows\System\jXcGZpf.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\mrjZhbL.exe
  C:\Windows\System\mrjZhbL.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\IzZMjlh.exe
  C:\Windows\System\IzZMjlh.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\gWDzeyV.exe
  C:\Windows\System\gWDzeyV.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\kdIvIwM.exe
  C:\Windows\System\kdIvIwM.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\HwaEdvq.exe
  C:\Windows\System\HwaEdvq.exe
  2⤵
  PID:2060
- C:\Windows\System\QgbqqNV.exe
  C:\Windows\System\QgbqqNV.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\LPiytlx.exe
  C:\Windows\System\LPiytlx.exe
  2⤵
  PID:2132
- C:\Windows\System\ZEkKkBn.exe
  C:\Windows\System\ZEkKkBn.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\AGFKBzW.exe
  C:\Windows\System\AGFKBzW.exe
  2⤵
  PID:2400
- C:\Windows\System\MCCHGtD.exe
  C:\Windows\System\MCCHGtD.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\wMOhKsI.exe
  C:\Windows\System\wMOhKsI.exe
  2⤵
  PID:2296
- C:\Windows\System\qGoRips.exe
  C:\Windows\System\qGoRips.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\yzyJjUl.exe
  C:\Windows\System\yzyJjUl.exe
  2⤵
  PID:1572
- C:\Windows\System\hfIbfdV.exe
  C:\Windows\System\hfIbfdV.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\tFViBCo.exe
  C:\Windows\System\tFViBCo.exe
  2⤵
  PID:2116
- C:\Windows\System\ZLAdnWw.exe
  C:\Windows\System\ZLAdnWw.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\PmXhwdo.exe
  C:\Windows\System\PmXhwdo.exe
  2⤵
  PID:2264
- C:\Windows\System\FzspXfb.exe
  C:\Windows\System\FzspXfb.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\FhGejRE.exe
  C:\Windows\System\FhGejRE.exe
  2⤵
  PID:1736
- C:\Windows\System\HXXsUJX.exe
  C:\Windows\System\HXXsUJX.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\QFPuZGC.exe
  C:\Windows\System\QFPuZGC.exe
  2⤵
  PID:1584
- C:\Windows\System\RMLvCXJ.exe
  C:\Windows\System\RMLvCXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ecAvXRc.exe
  C:\Windows\System\ecAvXRc.exe
  2⤵
  PID:2552
- C:\Windows\System\dVmYunX.exe
  C:\Windows\System\dVmYunX.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\XHMbewu.exe
  C:\Windows\System\XHMbewu.exe
  2⤵
  PID:2844
- C:\Windows\System\eygbcqJ.exe
  C:\Windows\System\eygbcqJ.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\insZUUQ.exe
  C:\Windows\System\insZUUQ.exe
  2⤵
  PID:2412
- C:\Windows\System\wfzSwXC.exe
  C:\Windows\System\wfzSwXC.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\aZDfixM.exe
  C:\Windows\System\aZDfixM.exe
  2⤵
  PID:2728
- C:\Windows\System\VlIClJx.exe
  C:\Windows\System\VlIClJx.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\xlCduOc.exe
  C:\Windows\System\xlCduOc.exe
  2⤵
  PID:3032
- C:\Windows\System\XDPPoyi.exe
  C:\Windows\System\XDPPoyi.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\LjBcPhO.exe
  C:\Windows\System\LjBcPhO.exe
  2⤵
  PID:2072
- C:\Windows\System\XuVkbLT.exe
  C:\Windows\System\XuVkbLT.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\zptxQzr.exe
  C:\Windows\System\zptxQzr.exe
  2⤵
  PID:2776
- C:\Windows\System\hrWUkZw.exe
  C:\Windows\System\hrWUkZw.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\mvubexd.exe
  C:\Windows\System\mvubexd.exe
  2⤵
  PID:2972
- C:\Windows\System\WsDGfmD.exe
  C:\Windows\System\WsDGfmD.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\yHhKxdw.exe
  C:\Windows\System\yHhKxdw.exe
  2⤵
  PID:1048
- C:\Windows\System\IQtlEqg.exe
  C:\Windows\System\IQtlEqg.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\xrzBjiE.exe
  C:\Windows\System\xrzBjiE.exe
  2⤵
  PID:616
- C:\Windows\System\xQQicHW.exe
  C:\Windows\System\xQQicHW.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\zztqssq.exe
  C:\Windows\System\zztqssq.exe
  2⤵
  PID:2168
- C:\Windows\System\VFFqTza.exe
  C:\Windows\System\VFFqTza.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\wAtgddo.exe
  C:\Windows\System\wAtgddo.exe
  2⤵
  PID:696
- C:\Windows\System\cqhtgCd.exe
  C:\Windows\System\cqhtgCd.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\JURvizU.exe
  C:\Windows\System\JURvizU.exe
  2⤵
  PID:2932
- C:\Windows\System\ZFnOtWd.exe
  C:\Windows\System\ZFnOtWd.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\TEjCUmV.exe
  C:\Windows\System\TEjCUmV.exe
  2⤵
  PID:1992
- C:\Windows\System\jzzYEwC.exe
  C:\Windows\System\jzzYEwC.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\mayLkxZ.exe
  C:\Windows\System\mayLkxZ.exe
  2⤵
  PID:884
- C:\Windows\System\eXCPYBr.exe
  C:\Windows\System\eXCPYBr.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\TMwbVRt.exe
  C:\Windows\System\TMwbVRt.exe
  2⤵
  PID:2336
- C:\Windows\System\OFIFwDo.exe
  C:\Windows\System\OFIFwDo.exe
  2⤵
  PID:2112
- C:\Windows\System\fVVQYLR.exe
  C:\Windows\System\fVVQYLR.exe
  2⤵
  PID:2416
- C:\Windows\System\YFktFmR.exe
  C:\Windows\System\YFktFmR.exe
  2⤵
  PID:3076
- C:\Windows\System\ZOClkKt.exe
  C:\Windows\System\ZOClkKt.exe
  2⤵
  PID:3092
- C:\Windows\System\IuJyyPb.exe
  C:\Windows\System\IuJyyPb.exe
  2⤵
  PID:3112
- C:\Windows\System\NLQhRvW.exe
  C:\Windows\System\NLQhRvW.exe
  2⤵
  PID:3128
- C:\Windows\System\TQGubwK.exe
  C:\Windows\System\TQGubwK.exe
  2⤵
  PID:3148
- C:\Windows\System\BkwCaZp.exe
  C:\Windows\System\BkwCaZp.exe
  2⤵
  PID:3164
- C:\Windows\System\XTzUPse.exe
  C:\Windows\System\XTzUPse.exe
  2⤵
  PID:3184
- C:\Windows\System\ruubUbU.exe
  C:\Windows\System\ruubUbU.exe
  2⤵
  PID:3200
- C:\Windows\System\CzjXXhs.exe
  C:\Windows\System\CzjXXhs.exe
  2⤵
  PID:3220
- C:\Windows\System\DIgcSje.exe
  C:\Windows\System\DIgcSje.exe
  2⤵
  PID:3240
- C:\Windows\System\appEnPY.exe
  C:\Windows\System\appEnPY.exe
  2⤵
  PID:3256
- C:\Windows\System\dbbpwQK.exe
  C:\Windows\System\dbbpwQK.exe
  2⤵
  PID:3272
- C:\Windows\System\VYlAcsn.exe
  C:\Windows\System\VYlAcsn.exe
  2⤵
  PID:3292
- C:\Windows\System\ZXBzVDu.exe
  C:\Windows\System\ZXBzVDu.exe
  2⤵
  PID:3308
- C:\Windows\System\ngmSjBE.exe
  C:\Windows\System\ngmSjBE.exe
  2⤵
  PID:3324
- C:\Windows\System\QMhYlNt.exe
  C:\Windows\System\QMhYlNt.exe
  2⤵
  PID:3344
- C:\Windows\System\Xjfubha.exe
  C:\Windows\System\Xjfubha.exe
  2⤵
  PID:3360
- C:\Windows\System\aivfRIx.exe
  C:\Windows\System\aivfRIx.exe
  2⤵
  PID:3376
- C:\Windows\System\yPNicgN.exe
  C:\Windows\System\yPNicgN.exe
  2⤵
  PID:3392
- C:\Windows\System\wfcZJlb.exe
  C:\Windows\System\wfcZJlb.exe
  2⤵
  PID:3544
- C:\Windows\System\vTVLmOb.exe
  C:\Windows\System\vTVLmOb.exe
  2⤵
  PID:3564
- C:\Windows\System\oGoJhlI.exe
  C:\Windows\System\oGoJhlI.exe
  2⤵
  PID:3580
- C:\Windows\System\uEbbcvY.exe
  C:\Windows\System\uEbbcvY.exe
  2⤵
  PID:3604
- C:\Windows\System\ZGwfCrX.exe
  C:\Windows\System\ZGwfCrX.exe
  2⤵
  PID:3620
- C:\Windows\System\XdKMRLL.exe
  C:\Windows\System\XdKMRLL.exe
  2⤵
  PID:3636
- C:\Windows\System\plZyKlF.exe
  C:\Windows\System\plZyKlF.exe
  2⤵
  PID:3660
- C:\Windows\System\YFyJzsN.exe
  C:\Windows\System\YFyJzsN.exe
  2⤵
  PID:3680
- C:\Windows\System\EENtQPp.exe
  C:\Windows\System\EENtQPp.exe
  2⤵
  PID:3696
- C:\Windows\System\qNLomfV.exe
  C:\Windows\System\qNLomfV.exe
  2⤵
  PID:3712
- C:\Windows\System\YdFnkyO.exe
  C:\Windows\System\YdFnkyO.exe
  2⤵
  PID:3728
- C:\Windows\System\DYHUOdh.exe
  C:\Windows\System\DYHUOdh.exe
  2⤵
  PID:3744
- C:\Windows\System\pVohKjZ.exe
  C:\Windows\System\pVohKjZ.exe
  2⤵
  PID:3760
- C:\Windows\System\hFpKVcF.exe
  C:\Windows\System\hFpKVcF.exe
  2⤵
  PID:3776
- C:\Windows\System\meAHQPN.exe
  C:\Windows\System\meAHQPN.exe
  2⤵
  PID:3792
- C:\Windows\System\yJWYMAb.exe
  C:\Windows\System\yJWYMAb.exe
  2⤵
  PID:3808
- C:\Windows\System\ImNNawq.exe
  C:\Windows\System\ImNNawq.exe
  2⤵
  PID:3824
- C:\Windows\System\hXBuiBc.exe
  C:\Windows\System\hXBuiBc.exe
  2⤵
  PID:3840
- C:\Windows\System\bbBRUXj.exe
  C:\Windows\System\bbBRUXj.exe
  2⤵
  PID:3856
- C:\Windows\System\lbHUmbR.exe
  C:\Windows\System\lbHUmbR.exe
  2⤵
  PID:3872
- C:\Windows\System\CRIYmZr.exe
  C:\Windows\System\CRIYmZr.exe
  2⤵
  PID:3888
- C:\Windows\System\yewYLuP.exe
  C:\Windows\System\yewYLuP.exe
  2⤵
  PID:3904
- C:\Windows\System\HxIKVsD.exe
  C:\Windows\System\HxIKVsD.exe
  2⤵
  PID:3920
- C:\Windows\System\VDLLTOO.exe
  C:\Windows\System\VDLLTOO.exe
  2⤵
  PID:3936
- C:\Windows\System\artMRra.exe
  C:\Windows\System\artMRra.exe
  2⤵
  PID:3952
- C:\Windows\System\YCjteTQ.exe
  C:\Windows\System\YCjteTQ.exe
  2⤵
  PID:3968
- C:\Windows\System\WrGoqbH.exe
  C:\Windows\System\WrGoqbH.exe
  2⤵
  PID:3984
- C:\Windows\System\seYJYZF.exe
  C:\Windows\System\seYJYZF.exe
  2⤵
  PID:4028
- C:\Windows\System\bCKbdcz.exe
  C:\Windows\System\bCKbdcz.exe
  2⤵
  PID:4056
- C:\Windows\System\cserfdx.exe
  C:\Windows\System\cserfdx.exe
  2⤵
  PID:4072
- C:\Windows\System\fYEGpcN.exe
  C:\Windows\System\fYEGpcN.exe
  2⤵
  PID:4088
- C:\Windows\System\BGYqlnC.exe
  C:\Windows\System\BGYqlnC.exe
  2⤵
  PID:1760
- C:\Windows\System\UhyVBBR.exe
  C:\Windows\System\UhyVBBR.exe
  2⤵
  PID:648
- C:\Windows\System\dpPqIeg.exe
  C:\Windows\System\dpPqIeg.exe
  2⤵
  PID:2448
- C:\Windows\System\CKGYRmf.exe
  C:\Windows\System\CKGYRmf.exe
  2⤵
  PID:3124
- C:\Windows\System\CfsGHuI.exe
  C:\Windows\System\CfsGHuI.exe
  2⤵
  PID:2676
- C:\Windows\System\GdvQRFw.exe
  C:\Windows\System\GdvQRFw.exe
  2⤵
  PID:3300
- C:\Windows\System\rSNxITb.exe
  C:\Windows\System\rSNxITb.exe
  2⤵
  PID:3368
- C:\Windows\System\oQraLGU.exe
  C:\Windows\System\oQraLGU.exe
  2⤵
  PID:3064
- C:\Windows\System\ztREqxE.exe
  C:\Windows\System\ztREqxE.exe
  2⤵
  PID:3336
- C:\Windows\System\XGyUsFY.exe
  C:\Windows\System\XGyUsFY.exe
  2⤵
  PID:2588
- C:\Windows\System\LNmYoxa.exe
  C:\Windows\System\LNmYoxa.exe
  2⤵
  PID:1068
- C:\Windows\System\JBHmXTL.exe
  C:\Windows\System\JBHmXTL.exe
  2⤵
  PID:2364
- C:\Windows\System\HXWIbbL.exe
  C:\Windows\System\HXWIbbL.exe
  2⤵
  PID:3424
- C:\Windows\System\CwCxrwc.exe
  C:\Windows\System\CwCxrwc.exe
  2⤵
  PID:3444
- C:\Windows\System\azoFCZd.exe
  C:\Windows\System\azoFCZd.exe
  2⤵
  PID:3460
- C:\Windows\System\iauGcep.exe
  C:\Windows\System\iauGcep.exe
  2⤵
  PID:2276
- C:\Windows\System\LaEMCzH.exe
  C:\Windows\System\LaEMCzH.exe
  2⤵
  PID:1648
- C:\Windows\System\LRjJnDo.exe
  C:\Windows\System\LRjJnDo.exe
  2⤵
  PID:2100
- C:\Windows\System\HiGQBte.exe
  C:\Windows\System\HiGQBte.exe
  2⤵
  PID:2952
- C:\Windows\System\SRAtGjk.exe
  C:\Windows\System\SRAtGjk.exe
  2⤵
  PID:2936
- C:\Windows\System\gluSiLH.exe
  C:\Windows\System\gluSiLH.exe
  2⤵
  PID:1892
- C:\Windows\System\eCgwFLc.exe
  C:\Windows\System\eCgwFLc.exe
  2⤵
  PID:1812
- C:\Windows\System\thKEQZp.exe
  C:\Windows\System\thKEQZp.exe
  2⤵
  PID:1268
- C:\Windows\System\jsUgUtu.exe
  C:\Windows\System\jsUgUtu.exe
  2⤵
  PID:2088
- C:\Windows\System\ZhHqQmi.exe
  C:\Windows\System\ZhHqQmi.exe
  2⤵
  PID:3508
- C:\Windows\System\HacZpym.exe
  C:\Windows\System\HacZpym.exe
  2⤵
  PID:3516
- C:\Windows\System\CrFOcvE.exe
  C:\Windows\System\CrFOcvE.exe
  2⤵
  PID:2792
- C:\Windows\System\kcuBYiy.exe
  C:\Windows\System\kcuBYiy.exe
  2⤵
  PID:2352
- C:\Windows\System\UnmQLSK.exe
  C:\Windows\System\UnmQLSK.exe
  2⤵
  PID:3540
- C:\Windows\System\cRArmXu.exe
  C:\Windows\System\cRArmXu.exe
  2⤵
  PID:3388
- C:\Windows\System\pkQSlON.exe
  C:\Windows\System\pkQSlON.exe
  2⤵
  PID:1564
- C:\Windows\System\qTzRacG.exe
  C:\Windows\System\qTzRacG.exe
  2⤵
  PID:1980
- C:\Windows\System\tyyrcaK.exe
  C:\Windows\System\tyyrcaK.exe
  2⤵
  PID:1928
- C:\Windows\System\FsvXIue.exe
  C:\Windows\System\FsvXIue.exe
  2⤵
  PID:2804
- C:\Windows\System\iRdVkxA.exe
  C:\Windows\System\iRdVkxA.exe
  2⤵
  PID:2624
- C:\Windows\System\OTrcqPO.exe
  C:\Windows\System\OTrcqPO.exe
  2⤵
  PID:2032
- C:\Windows\System\VexJtvc.exe
  C:\Windows\System\VexJtvc.exe
  2⤵
  PID:2140
- C:\Windows\System\XESEACk.exe
  C:\Windows\System\XESEACk.exe
  2⤵
  PID:776
- C:\Windows\System\ptCzmYk.exe
  C:\Windows\System\ptCzmYk.exe
  2⤵
  PID:1124
- C:\Windows\System\RnPpScn.exe
  C:\Windows\System\RnPpScn.exe
  2⤵
  PID:2488
- C:\Windows\System\oOiUrmC.exe
  C:\Windows\System\oOiUrmC.exe
  2⤵
  PID:1624
- C:\Windows\System\AUeDfFN.exe
  C:\Windows\System\AUeDfFN.exe
  2⤵
  PID:2912
- C:\Windows\System\kvWRQPB.exe
  C:\Windows\System\kvWRQPB.exe
  2⤵
  PID:1716
- C:\Windows\System\NjNbCRy.exe
  C:\Windows\System\NjNbCRy.exe
  2⤵
  PID:340
- C:\Windows\System\PfSJKlP.exe
  C:\Windows\System\PfSJKlP.exe
  2⤵
  PID:3100
- C:\Windows\System\YyDpbjr.exe
  C:\Windows\System\YyDpbjr.exe
  2⤵
  PID:3140
- C:\Windows\System\JgFkZFM.exe
  C:\Windows\System\JgFkZFM.exe
  2⤵
  PID:3208
- C:\Windows\System\YCMhTHt.exe
  C:\Windows\System\YCMhTHt.exe
  2⤵
  PID:3252
- C:\Windows\System\jVWvvfo.exe
  C:\Windows\System\jVWvvfo.exe
  2⤵
  PID:3316
- C:\Windows\System\GQyxqAE.exe
  C:\Windows\System\GQyxqAE.exe
  2⤵
  PID:3652
- C:\Windows\System\BfkvQML.exe
  C:\Windows\System\BfkvQML.exe
  2⤵
  PID:3692
- C:\Windows\System\ZapjlpT.exe
  C:\Windows\System\ZapjlpT.exe
  2⤵
  PID:3752
- C:\Windows\System\sJKTLbX.exe
  C:\Windows\System\sJKTLbX.exe
  2⤵
  PID:3916
- C:\Windows\System\vFdlqtf.exe
  C:\Windows\System\vFdlqtf.exe
  2⤵
  PID:4024
- C:\Windows\System\hLWHqbQ.exe
  C:\Windows\System\hLWHqbQ.exe
  2⤵
  PID:4080
- C:\Windows\System\zIBIEJa.exe
  C:\Windows\System\zIBIEJa.exe
  2⤵
  PID:3120
- C:\Windows\System\YCUNecE.exe
  C:\Windows\System\YCUNecE.exe
  2⤵
  PID:3232
- C:\Windows\System\OXXCpro.exe
  C:\Windows\System\OXXCpro.exe
  2⤵
  PID:1984
- C:\Windows\System\ihoDVjF.exe
  C:\Windows\System\ihoDVjF.exe
  2⤵
  PID:2948
- C:\Windows\System\vxIwAZA.exe
  C:\Windows\System\vxIwAZA.exe
  2⤵
  PID:3436
- C:\Windows\System\VDmBRZt.exe
  C:\Windows\System\VDmBRZt.exe
  2⤵
  PID:2180
- C:\Windows\System\WhDlHhb.exe
  C:\Windows\System\WhDlHhb.exe
  2⤵
  PID:3500
- C:\Windows\System\MrkwAUp.exe
  C:\Windows\System\MrkwAUp.exe
  2⤵
  PID:3052
- C:\Windows\System\RgVZwYD.exe
  C:\Windows\System\RgVZwYD.exe
  2⤵
  PID:3352
- C:\Windows\System\eKqBNUq.exe
  C:\Windows\System\eKqBNUq.exe
  2⤵
  PID:1328
- C:\Windows\System\VdALZSA.exe
  C:\Windows\System\VdALZSA.exe
  2⤵
  PID:636
- C:\Windows\System\YIVnOgX.exe
  C:\Windows\System\YIVnOgX.exe
  2⤵
  PID:844
- C:\Windows\System\JSsjLrN.exe
  C:\Windows\System\JSsjLrN.exe
  2⤵
  PID:3004
- C:\Windows\System\rAJQKHB.exe
  C:\Windows\System\rAJQKHB.exe
  2⤵
  PID:3216
- C:\Windows\System\CudqddO.exe
  C:\Windows\System\CudqddO.exe
  2⤵
  PID:3644
- C:\Windows\System\yKAPulN.exe
  C:\Windows\System\yKAPulN.exe
  2⤵
  PID:3976
- C:\Windows\System\kdTfzci.exe
  C:\Windows\System\kdTfzci.exe
  2⤵
  PID:3600
- C:\Windows\System\jgAPHfZ.exe
  C:\Windows\System\jgAPHfZ.exe
  2⤵
  PID:3740
- C:\Windows\System\WgUvTFm.exe
  C:\Windows\System\WgUvTFm.exe
  2⤵
  PID:4108
- C:\Windows\System\iHFxZKj.exe
  C:\Windows\System\iHFxZKj.exe
  2⤵
  PID:4124
- C:\Windows\System\UwEcohR.exe
  C:\Windows\System\UwEcohR.exe
  2⤵
  PID:4140
- C:\Windows\System\uIjMsGc.exe
  C:\Windows\System\uIjMsGc.exe
  2⤵
  PID:4160
- C:\Windows\System\DUvPoXp.exe
  C:\Windows\System\DUvPoXp.exe
  2⤵
  PID:4176
- C:\Windows\System\Frtgyki.exe
  C:\Windows\System\Frtgyki.exe
  2⤵
  PID:4192
- C:\Windows\System\ZVuoVUC.exe
  C:\Windows\System\ZVuoVUC.exe
  2⤵
  PID:4208
- C:\Windows\System\mHxNgMH.exe
  C:\Windows\System\mHxNgMH.exe
  2⤵
  PID:4224
- C:\Windows\System\pqHIJTx.exe
  C:\Windows\System\pqHIJTx.exe
  2⤵
  PID:4240
- C:\Windows\System\ycyUMrY.exe
  C:\Windows\System\ycyUMrY.exe
  2⤵
  PID:4384
- C:\Windows\System\gjziEpH.exe
  C:\Windows\System\gjziEpH.exe
  2⤵
  PID:4436
- C:\Windows\System\BvdhRYR.exe
  C:\Windows\System\BvdhRYR.exe
  2⤵
  PID:4468
- C:\Windows\System\IvFFDpZ.exe
  C:\Windows\System\IvFFDpZ.exe
  2⤵
  PID:4484
- C:\Windows\System\ddArwyN.exe
  C:\Windows\System\ddArwyN.exe
  2⤵
  PID:4508
- C:\Windows\System\aRYqfNM.exe
  C:\Windows\System\aRYqfNM.exe
  2⤵
  PID:4524
- C:\Windows\System\IHaERox.exe
  C:\Windows\System\IHaERox.exe
  2⤵
  PID:4544
- C:\Windows\System\ZvLVhQT.exe
  C:\Windows\System\ZvLVhQT.exe
  2⤵
  PID:4560
- C:\Windows\System\omOVZAn.exe
  C:\Windows\System\omOVZAn.exe
  2⤵
  PID:4576
- C:\Windows\System\HiojCaC.exe
  C:\Windows\System\HiojCaC.exe
  2⤵
  PID:4596
- C:\Windows\System\omQKZSN.exe
  C:\Windows\System\omQKZSN.exe
  2⤵
  PID:4616
- C:\Windows\System\HeLMoGp.exe
  C:\Windows\System\HeLMoGp.exe
  2⤵
  PID:4632
- C:\Windows\System\HoXBCvz.exe
  C:\Windows\System\HoXBCvz.exe
  2⤵
  PID:4648
- C:\Windows\System\oAEwHJh.exe
  C:\Windows\System\oAEwHJh.exe
  2⤵
  PID:4664
- C:\Windows\System\lrsYrRM.exe
  C:\Windows\System\lrsYrRM.exe
  2⤵
  PID:4680
- C:\Windows\System\rDAJRPx.exe
  C:\Windows\System\rDAJRPx.exe
  2⤵
  PID:4696
- C:\Windows\System\ILNlmaa.exe
  C:\Windows\System\ILNlmaa.exe
  2⤵
  PID:4720
- C:\Windows\System\RSQfqYo.exe
  C:\Windows\System\RSQfqYo.exe
  2⤵
  PID:4736
- C:\Windows\System\jLeHuqG.exe
  C:\Windows\System\jLeHuqG.exe
  2⤵
  PID:4752
- C:\Windows\System\otAfyrr.exe
  C:\Windows\System\otAfyrr.exe
  2⤵
  PID:4768
- C:\Windows\System\cYoRhZm.exe
  C:\Windows\System\cYoRhZm.exe
  2⤵
  PID:4784
- C:\Windows\System\EqZIGtc.exe
  C:\Windows\System\EqZIGtc.exe
  2⤵
  PID:4804
- C:\Windows\System\cYovlfc.exe
  C:\Windows\System\cYovlfc.exe
  2⤵
  PID:4820
- C:\Windows\System\grwFpTp.exe
  C:\Windows\System\grwFpTp.exe
  2⤵
  PID:4836
- C:\Windows\System\NtlnvyT.exe
  C:\Windows\System\NtlnvyT.exe
  2⤵
  PID:4852
- C:\Windows\System\HsnPGJR.exe
  C:\Windows\System\HsnPGJR.exe
  2⤵
  PID:4868
- C:\Windows\System\titceba.exe
  C:\Windows\System\titceba.exe
  2⤵
  PID:4884
- C:\Windows\System\VchBLJu.exe
  C:\Windows\System\VchBLJu.exe
  2⤵
  PID:4900
- C:\Windows\System\uSkcdmu.exe
  C:\Windows\System\uSkcdmu.exe
  2⤵
  PID:4916
- C:\Windows\System\UpjLqac.exe
  C:\Windows\System\UpjLqac.exe
  2⤵
  PID:4932
- C:\Windows\System\VIweceq.exe
  C:\Windows\System\VIweceq.exe
  2⤵
  PID:4968
- C:\Windows\System\NvhsxYZ.exe
  C:\Windows\System\NvhsxYZ.exe
  2⤵
  PID:4992
- C:\Windows\System\bylJUCj.exe
  C:\Windows\System\bylJUCj.exe
  2⤵
  PID:5024
- C:\Windows\System\jceEkMC.exe
  C:\Windows\System\jceEkMC.exe
  2⤵
  PID:5040
- C:\Windows\System\qExiFtC.exe
  C:\Windows\System\qExiFtC.exe
  2⤵
  PID:5060
- C:\Windows\System\BqGbuwd.exe
  C:\Windows\System\BqGbuwd.exe
  2⤵
  PID:5076
- C:\Windows\System\BqbWPLI.exe
  C:\Windows\System\BqbWPLI.exe
  2⤵
  PID:5092
- C:\Windows\System\JPDYvxT.exe
  C:\Windows\System\JPDYvxT.exe
  2⤵
  PID:5108
- C:\Windows\System\UPaCcOC.exe
  C:\Windows\System\UPaCcOC.exe
  2⤵
  PID:3356
- C:\Windows\System\nprzAvC.exe
  C:\Windows\System\nprzAvC.exe
  2⤵
  PID:3612
- C:\Windows\System\asYLQpE.exe
  C:\Windows\System\asYLQpE.exe
  2⤵
  PID:3428
- C:\Windows\System\RYvPZOW.exe
  C:\Windows\System\RYvPZOW.exe
  2⤵
  PID:3896
- C:\Windows\System\QBKLWoL.exe
  C:\Windows\System\QBKLWoL.exe
  2⤵
  PID:4012
- C:\Windows\System\vwUoVwZ.exe
  C:\Windows\System\vwUoVwZ.exe
  2⤵
  PID:4168
- C:\Windows\System\FXfhost.exe
  C:\Windows\System\FXfhost.exe
  2⤵
  PID:4232
- C:\Windows\System\cFRZvGe.exe
  C:\Windows\System\cFRZvGe.exe
  2⤵
  PID:1416
- C:\Windows\System\AgREjZx.exe
  C:\Windows\System\AgREjZx.exe
  2⤵
  PID:3556
- C:\Windows\System\zrjpDwq.exe
  C:\Windows\System\zrjpDwq.exe
  2⤵
  PID:2640
- C:\Windows\System\lMrukhk.exe
  C:\Windows\System\lMrukhk.exe
  2⤵
  PID:3672
- C:\Windows\System\QgfQUdD.exe
  C:\Windows\System\QgfQUdD.exe
  2⤵
  PID:4400
- C:\Windows\System\XeHvyDI.exe
  C:\Windows\System\XeHvyDI.exe
  2⤵
  PID:4420
- C:\Windows\System\sMXhOIV.exe
  C:\Windows\System\sMXhOIV.exe
  2⤵
  PID:4476
- C:\Windows\System\BYENray.exe
  C:\Windows\System\BYENray.exe
  2⤵
  PID:4552
- C:\Windows\System\PaadLzp.exe
  C:\Windows\System\PaadLzp.exe
  2⤵
  PID:4592
- C:\Windows\System\TGoFOQS.exe
  C:\Windows\System\TGoFOQS.exe
  2⤵
  PID:3832
- C:\Windows\System\AzXClxU.exe
  C:\Windows\System\AzXClxU.exe
  2⤵
  PID:4588
- C:\Windows\System\sdgUCeK.exe
  C:\Windows\System\sdgUCeK.exe
  2⤵
  PID:4660
- C:\Windows\System\kGCtwOy.exe
  C:\Windows\System\kGCtwOy.exe
  2⤵
  PID:4004
- C:\Windows\System\cWgGUse.exe
  C:\Windows\System\cWgGUse.exe
  2⤵
  PID:4068
- C:\Windows\System\ELHehtr.exe
  C:\Windows\System\ELHehtr.exe
  2⤵
  PID:3196
- C:\Windows\System\IBMixLh.exe
  C:\Windows\System\IBMixLh.exe
  2⤵
  PID:4292
- C:\Windows\System\KRdrWvx.exe
  C:\Windows\System\KRdrWvx.exe
  2⤵
  PID:1964
- C:\Windows\System\KLvVNdC.exe
  C:\Windows\System\KLvVNdC.exe
  2⤵
  PID:1052
- C:\Windows\System\FpxzpHz.exe
  C:\Windows\System\FpxzpHz.exe
  2⤵
  PID:3476
- C:\Windows\System\kyCQwEg.exe
  C:\Windows\System\kyCQwEg.exe
  2⤵
  PID:4304
- C:\Windows\System\fEvzlUC.exe
  C:\Windows\System\fEvzlUC.exe
  2⤵
  PID:4792
- C:\Windows\System\EyDmNnS.exe
  C:\Windows\System\EyDmNnS.exe
  2⤵
  PID:4892
- C:\Windows\System\HXBweko.exe
  C:\Windows\System\HXBweko.exe
  2⤵
  PID:5100
- C:\Windows\System\pjXBWCB.exe
  C:\Windows\System\pjXBWCB.exe
  2⤵
  PID:1548
- C:\Windows\System\zSPcLIz.exe
  C:\Windows\System\zSPcLIz.exe
  2⤵
  PID:4132
- C:\Windows\System\UXXRonq.exe
  C:\Windows\System\UXXRonq.exe
  2⤵
  PID:4312
- C:\Windows\System\cyoQfqL.exe
  C:\Windows\System\cyoQfqL.exe
  2⤵
  PID:1748
- C:\Windows\System\uOFRKfD.exe
  C:\Windows\System\uOFRKfD.exe
  2⤵
  PID:1420
- C:\Windows\System\vrwUuGZ.exe
  C:\Windows\System\vrwUuGZ.exe
  2⤵
  PID:1972
- C:\Windows\System\XyfWvnt.exe
  C:\Windows\System\XyfWvnt.exe
  2⤵
  PID:2324
- C:\Windows\System\YzxlqIy.exe
  C:\Windows\System\YzxlqIy.exe
  2⤵
  PID:2444
- C:\Windows\System\PFsTehp.exe
  C:\Windows\System\PFsTehp.exe
  2⤵
  PID:2648
- C:\Windows\System\ZYkYxUi.exe
  C:\Windows\System\ZYkYxUi.exe
  2⤵
  PID:2524
- C:\Windows\System\huYYJwZ.exe
  C:\Windows\System\huYYJwZ.exe
  2⤵
  PID:4584
- C:\Windows\System\BlyOlhn.exe
  C:\Windows\System\BlyOlhn.exe
  2⤵
  PID:3264
- C:\Windows\System\UNcihRe.exe
  C:\Windows\System\UNcihRe.exe
  2⤵
  PID:4732
- C:\Windows\System\FgOgAem.exe
  C:\Windows\System\FgOgAem.exe
  2⤵
  PID:3900
- C:\Windows\System\QIMzhOG.exe
  C:\Windows\System\QIMzhOG.exe
  2⤵
  PID:4728
- C:\Windows\System\AfKrBGj.exe
  C:\Windows\System\AfKrBGj.exe
  2⤵
  PID:4448
- C:\Windows\System\sNImTrX.exe
  C:\Windows\System\sNImTrX.exe
  2⤵
  PID:4116
- C:\Windows\System\mFaxSUB.exe
  C:\Windows\System\mFaxSUB.exe
  2⤵
  PID:4184
- C:\Windows\System\xFzhalE.exe
  C:\Windows\System\xFzhalE.exe
  2⤵
  PID:4252
- C:\Windows\System\qQsReNV.exe
  C:\Windows\System\qQsReNV.exe
  2⤵
  PID:1428
- C:\Windows\System\IXcvzXb.exe
  C:\Windows\System\IXcvzXb.exe
  2⤵
  PID:2000
- C:\Windows\System\VKKxhJI.exe
  C:\Windows\System\VKKxhJI.exe
  2⤵
  PID:3416
- C:\Windows\System\rqvxXTf.exe
  C:\Windows\System\rqvxXTf.exe
  2⤵
  PID:4296
- C:\Windows\System\JBkrZiw.exe
  C:\Windows\System\JBkrZiw.exe
  2⤵
  PID:4676
- C:\Windows\System\fFjkHTk.exe
  C:\Windows\System\fFjkHTk.exe
  2⤵
  PID:3028
- C:\Windows\System\LJuXSnv.exe
  C:\Windows\System\LJuXSnv.exe
  2⤵
  PID:2644
- C:\Windows\System\DdvjFJv.exe
  C:\Windows\System\DdvjFJv.exe
  2⤵
  PID:3180
- C:\Windows\System\RVmduhK.exe
  C:\Windows\System\RVmduhK.exe
  2⤵
  PID:3688
- C:\Windows\System\dinEchK.exe
  C:\Windows\System\dinEchK.exe
  2⤵
  PID:3820
- C:\Windows\System\uQBlemN.exe
  C:\Windows\System\uQBlemN.exe
  2⤵
  PID:3852
- C:\Windows\System\yODjztb.exe
  C:\Windows\System\yODjztb.exe
  2⤵
  PID:4044
- C:\Windows\System\OaGSXxJ.exe
  C:\Windows\System\OaGSXxJ.exe
  2⤵
  PID:2096
- C:\Windows\System\qcMEKzM.exe
  C:\Windows\System\qcMEKzM.exe
  2⤵
  PID:2320
- C:\Windows\System\tSEdeWZ.exe
  C:\Windows\System\tSEdeWZ.exe
  2⤵
  PID:3136
- C:\Windows\System\cjSnsNs.exe
  C:\Windows\System\cjSnsNs.exe
  2⤵
  PID:4336
- C:\Windows\System\QmxsJTM.exe
  C:\Windows\System\QmxsJTM.exe
  2⤵
  PID:4360
- C:\Windows\System\tXHfcdZ.exe
  C:\Windows\System\tXHfcdZ.exe
  2⤵
  PID:4376
- C:\Windows\System\XWvZQcf.exe
  C:\Windows\System\XWvZQcf.exe
  2⤵
  PID:4464
- C:\Windows\System\GObZBgL.exe
  C:\Windows\System\GObZBgL.exe
  2⤵
  PID:4540
- C:\Windows\System\EwwQXpl.exe
  C:\Windows\System\EwwQXpl.exe
  2⤵
  PID:4608
- C:\Windows\System\PWhwXTF.exe
  C:\Windows\System\PWhwXTF.exe
  2⤵
  PID:4780
- C:\Windows\System\PqtyHvD.exe
  C:\Windows\System\PqtyHvD.exe
  2⤵
  PID:4948
- C:\Windows\System\uhNJAmU.exe
  C:\Windows\System\uhNJAmU.exe
  2⤵
  PID:5000
- C:\Windows\System\GgdpMhM.exe
  C:\Windows\System\GgdpMhM.exe
  2⤵
  PID:5048
- C:\Windows\System\RAUhAPn.exe
  C:\Windows\System\RAUhAPn.exe
  2⤵
  PID:3576
- C:\Windows\System\wNQxYiB.exe
  C:\Windows\System\wNQxYiB.exe
  2⤵
  PID:4200
- C:\Windows\System\dbwnXRA.exe
  C:\Windows\System\dbwnXRA.exe
  2⤵
  PID:3552
- C:\Windows\System\Jmopjwe.exe
  C:\Windows\System\Jmopjwe.exe
  2⤵
  PID:4656
- C:\Windows\System\hfzeigz.exe
  C:\Windows\System\hfzeigz.exe
  2⤵
  PID:4064
- C:\Windows\System\wfVsslt.exe
  C:\Windows\System\wfVsslt.exe
  2⤵
  PID:1920
- C:\Windows\System\xmOSciW.exe
  C:\Windows\System\xmOSciW.exe
  2⤵
  PID:1072
- C:\Windows\System\ExsJdhS.exe
  C:\Windows\System\ExsJdhS.exe
  2⤵
  PID:2748
- C:\Windows\System\crKIIci.exe
  C:\Windows\System\crKIIci.exe
  2⤵
  PID:2980
- C:\Windows\System\gBeJGkf.exe
  C:\Windows\System\gBeJGkf.exe
  2⤵
  PID:2120
- C:\Windows\System\FckNWHi.exe
  C:\Windows\System\FckNWHi.exe
  2⤵
  PID:3404
- C:\Windows\System\vKHHvkD.exe
  C:\Windows\System\vKHHvkD.exe
  2⤵
  PID:3884
- C:\Windows\System\YRRrzTB.exe
  C:\Windows\System\YRRrzTB.exe
  2⤵
  PID:3536
- C:\Windows\System\OVAzpxq.exe
  C:\Windows\System\OVAzpxq.exe
  2⤵
  PID:808
- C:\Windows\System\bRrtMCg.exe
  C:\Windows\System\bRrtMCg.exe
  2⤵
  PID:1084
- C:\Windows\System\FphYwoT.exe
  C:\Windows\System\FphYwoT.exe
  2⤵
  PID:300
- C:\Windows\System\lwZyUbV.exe
  C:\Windows\System\lwZyUbV.exe
  2⤵
  PID:2712
- C:\Windows\System\CnEmQnJ.exe
  C:\Windows\System\CnEmQnJ.exe
  2⤵
  PID:2760
- C:\Windows\System\NodPuUD.exe
  C:\Windows\System\NodPuUD.exe
  2⤵
  PID:4432
- C:\Windows\System\KIZXWWE.exe
  C:\Windows\System\KIZXWWE.exe
  2⤵
  PID:4000
- C:\Windows\System\fcHLPLl.exe
  C:\Windows\System\fcHLPLl.exe
  2⤵
  PID:2460
- C:\Windows\System\bPqorsk.exe
  C:\Windows\System\bPqorsk.exe
  2⤵
  PID:3332
- C:\Windows\System\MxihVtc.exe
  C:\Windows\System\MxihVtc.exe
  2⤵
  PID:4532
- C:\Windows\System\YkyOQpO.exe
  C:\Windows\System\YkyOQpO.exe
  2⤵
  PID:4748
- C:\Windows\System\qJJewJQ.exe
  C:\Windows\System\qJJewJQ.exe
  2⤵
  PID:4568
- C:\Windows\System\QKxQVyf.exe
  C:\Windows\System\QKxQVyf.exe
  2⤵
  PID:2692
- C:\Windows\System\YeVnpXX.exe
  C:\Windows\System\YeVnpXX.exe
  2⤵
  PID:2204
- C:\Windows\System\nJjMtYt.exe
  C:\Windows\System\nJjMtYt.exe
  2⤵
  PID:2920
- C:\Windows\System\eBmUcye.exe
  C:\Windows\System\eBmUcye.exe
  2⤵
  PID:2108
- C:\Windows\System\dNAJPqw.exe
  C:\Windows\System\dNAJPqw.exe
  2⤵
  PID:4776
- C:\Windows\System\VAZbFjp.exe
  C:\Windows\System\VAZbFjp.exe
  2⤵
  PID:4940
- C:\Windows\System\gofiLOB.exe
  C:\Windows\System\gofiLOB.exe
  2⤵
  PID:5056
- C:\Windows\System\TLTAkqE.exe
  C:\Windows\System\TLTAkqE.exe
  2⤵
  PID:4844
- C:\Windows\System\tfaoFrn.exe
  C:\Windows\System\tfaoFrn.exe
  2⤵
  PID:4332
- C:\Windows\System\oSsIMRz.exe
  C:\Windows\System\oSsIMRz.exe
  2⤵
  PID:3284
- C:\Windows\System\iZDkFQF.exe
  C:\Windows\System\iZDkFQF.exe
  2⤵
  PID:3172
- C:\Windows\System\gURfUgf.exe
  C:\Windows\System\gURfUgf.exe
  2⤵
  PID:1908
- C:\Windows\System\DdXKvhh.exe
  C:\Windows\System\DdXKvhh.exe
  2⤵
  PID:3788
- C:\Windows\System\DoIhhLR.exe
  C:\Windows\System\DoIhhLR.exe
  2⤵
  PID:4348
- C:\Windows\System\rHmZJsN.exe
  C:\Windows\System\rHmZJsN.exe
  2⤵
  PID:952
- C:\Windows\System\hOybnpI.exe
  C:\Windows\System\hOybnpI.exe
  2⤵
  PID:4500
- C:\Windows\System\POTHXNH.exe
  C:\Windows\System\POTHXNH.exe
  2⤵
  PID:1656
- C:\Windows\System\GyhSxya.exe
  C:\Windows\System\GyhSxya.exe
  2⤵
  PID:4704
- C:\Windows\System\nTSKzku.exe
  C:\Windows\System\nTSKzku.exe
  2⤵
  PID:4964
- C:\Windows\System\pGtnURp.exe
  C:\Windows\System\pGtnURp.exe
  2⤵
  PID:4536
- C:\Windows\System\QJdbyOV.exe
  C:\Windows\System\QJdbyOV.exe
  2⤵
  PID:5088
- C:\Windows\System\ukckLQv.exe
  C:\Windows\System\ukckLQv.exe
  2⤵
  PID:3440
- C:\Windows\System\BBVaGxX.exe
  C:\Windows\System\BBVaGxX.exe
  2⤵
  PID:4120
- C:\Windows\System\QfApcjG.exe
  C:\Windows\System\QfApcjG.exe
  2⤵
  PID:5036
- C:\Windows\System\CexcSFb.exe
  C:\Windows\System\CexcSFb.exe
  2⤵
  PID:4828
- C:\Windows\System\dxBeKIC.exe
  C:\Windows\System\dxBeKIC.exe
  2⤵
  PID:3236
- C:\Windows\System\uDqDpsG.exe
  C:\Windows\System\uDqDpsG.exe
  2⤵
  PID:4976
- C:\Windows\System\XfoBxEw.exe
  C:\Windows\System\XfoBxEw.exe
  2⤵
  PID:804
- C:\Windows\System\QaNHral.exe
  C:\Windows\System\QaNHral.exe
  2⤵
  PID:2008
- C:\Windows\System\FUjafwd.exe
  C:\Windows\System\FUjafwd.exe
  2⤵
  PID:4380
- C:\Windows\System\WAkzRvV.exe
  C:\Windows\System\WAkzRvV.exe
  2⤵
  PID:1976
- C:\Windows\System\aTSJATI.exe
  C:\Windows\System\aTSJATI.exe
  2⤵
  PID:4264
- C:\Windows\System\Kmmbvej.exe
  C:\Windows\System\Kmmbvej.exe
  2⤵
  PID:4148
- C:\Windows\System\vAfZQrk.exe
  C:\Windows\System\vAfZQrk.exe
  2⤵
  PID:5020
- C:\Windows\System\PjkFCwG.exe
  C:\Windows\System\PjkFCwG.exe
  2⤵
  PID:4188
- C:\Windows\System\xTozUCo.exe
  C:\Windows\System\xTozUCo.exe
  2⤵
  PID:4644
- C:\Windows\System\QDQYsRi.exe
  C:\Windows\System\QDQYsRi.exe
  2⤵
  PID:2968
- C:\Windows\System\RDPKQDS.exe
  C:\Windows\System\RDPKQDS.exe
  2⤵
  PID:3668
- C:\Windows\System\lWclMDN.exe
  C:\Windows\System\lWclMDN.exe
  2⤵
  PID:2772
- C:\Windows\System\bhlqDjv.exe
  C:\Windows\System\bhlqDjv.exe
  2⤵
  PID:2508
- C:\Windows\System\ZnHZukK.exe
  C:\Windows\System\ZnHZukK.exe
  2⤵
  PID:3088
- C:\Windows\System\NtlVwMO.exe
  C:\Windows\System\NtlVwMO.exe
  2⤵
  PID:864
- C:\Windows\System\RQtHdHB.exe
  C:\Windows\System\RQtHdHB.exe
  2⤵
  PID:3592
- C:\Windows\System\VBSKwpY.exe
  C:\Windows\System\VBSKwpY.exe
  2⤵
  PID:1664
- C:\Windows\System\DdEkldQ.exe
  C:\Windows\System\DdEkldQ.exe
  2⤵
  PID:3768
- C:\Windows\System\jgyKckj.exe
  C:\Windows\System\jgyKckj.exe
  2⤵
  PID:1088
- C:\Windows\System\sNqGEFj.exe
  C:\Windows\System\sNqGEFj.exe
  2⤵
  PID:2956
- C:\Windows\System\PWMVDck.exe
  C:\Windows\System\PWMVDck.exe
  2⤵
  PID:3108
- C:\Windows\System\RTwkbun.exe
  C:\Windows\System\RTwkbun.exe
  2⤵
  PID:4944
- C:\Windows\System\EdYAkof.exe
  C:\Windows\System\EdYAkof.exe
  2⤵
  PID:4408
- C:\Windows\System\NuvghqN.exe
  C:\Windows\System\NuvghqN.exe
  2⤵
  PID:2664
- C:\Windows\System\sHboLqY.exe
  C:\Windows\System\sHboLqY.exe
  2⤵
  PID:2188
- C:\Windows\System\thaMbhk.exe
  C:\Windows\System\thaMbhk.exe
  2⤵
  PID:684
- C:\Windows\System\shlnyzj.exe
  C:\Windows\System\shlnyzj.exe
  2⤵
  PID:3040
- C:\Windows\System\JpOwZtk.exe
  C:\Windows\System\JpOwZtk.exe
  2⤵
  PID:548
- C:\Windows\System\gOoxZfk.exe
  C:\Windows\System\gOoxZfk.exe
  2⤵
  PID:788
- C:\Windows\System\KkDBqNj.exe
  C:\Windows\System\KkDBqNj.exe
  2⤵
  PID:2012
- C:\Windows\System\uHrmjIL.exe
  C:\Windows\System\uHrmjIL.exe
  2⤵
  PID:4344
- C:\Windows\System\XhZQuvb.exe
  C:\Windows\System\XhZQuvb.exe
  2⤵
  PID:3268
- C:\Windows\System\UuOLXjk.exe
  C:\Windows\System\UuOLXjk.exe
  2⤵
  PID:4104
- C:\Windows\System\RxVgPDb.exe
  C:\Windows\System\RxVgPDb.exe
  2⤵
  PID:3912
- C:\Windows\System\FeqkFMZ.exe
  C:\Windows\System\FeqkFMZ.exe
  2⤵
  PID:1712
- C:\Windows\System\svujHXV.exe
  C:\Windows\System\svujHXV.exe
  2⤵
  PID:1828
- C:\Windows\System\FEQoHIg.exe
  C:\Windows\System\FEQoHIg.exe
  2⤵
  PID:4504
- C:\Windows\System\JHlfqOu.exe
  C:\Windows\System\JHlfqOu.exe
  2⤵
  PID:4328
- C:\Windows\System\ECLBANP.exe
  C:\Windows\System\ECLBANP.exe
  2⤵
  PID:1560
- C:\Windows\System\qDZvQiV.exe
  C:\Windows\System\qDZvQiV.exe
  2⤵
  PID:1852
- C:\Windows\System\nfuVojT.exe
  C:\Windows\System\nfuVojT.exe
  2⤵
  PID:2688
- C:\Windows\System\kqXsalb.exe
  C:\Windows\System\kqXsalb.exe
  2⤵
  PID:1524
- C:\Windows\System\vfIKwKK.exe
  C:\Windows\System\vfIKwKK.exe
  2⤵
  PID:4744
- C:\Windows\System\MSktksu.exe
  C:\Windows\System\MSktksu.exe
  2⤵
  PID:3948
- C:\Windows\System\tBOPgKP.exe
  C:\Windows\System\tBOPgKP.exe
  2⤵
  PID:5128
- C:\Windows\System\mlsExNc.exe
  C:\Windows\System\mlsExNc.exe
  2⤵
  PID:5144
- C:\Windows\System\RsxqbGa.exe
  C:\Windows\System\RsxqbGa.exe
  2⤵
  PID:5160
- C:\Windows\System\HioiFwh.exe
  C:\Windows\System\HioiFwh.exe
  2⤵
  PID:5176
- C:\Windows\System\hYTmnOI.exe
  C:\Windows\System\hYTmnOI.exe
  2⤵
  PID:5192
- C:\Windows\System\qMshNIC.exe
  C:\Windows\System\qMshNIC.exe
  2⤵
  PID:5208
- C:\Windows\System\lFTRTEA.exe
  C:\Windows\System\lFTRTEA.exe
  2⤵
  PID:5224
- C:\Windows\System\ekxcHCA.exe
  C:\Windows\System\ekxcHCA.exe
  2⤵
  PID:5240
- C:\Windows\System\aQchImG.exe
  C:\Windows\System\aQchImG.exe
  2⤵
  PID:5256
- C:\Windows\System\vxygThF.exe
  C:\Windows\System\vxygThF.exe
  2⤵
  PID:5272
- C:\Windows\System\BurADOS.exe
  C:\Windows\System\BurADOS.exe
  2⤵
  PID:5288
- C:\Windows\System\UEfqNFn.exe
  C:\Windows\System\UEfqNFn.exe
  2⤵
  PID:5304
- C:\Windows\System\ExsRfCW.exe
  C:\Windows\System\ExsRfCW.exe
  2⤵
  PID:5320
- C:\Windows\System\ZhjBQXQ.exe
  C:\Windows\System\ZhjBQXQ.exe
  2⤵
  PID:5336
- C:\Windows\System\hhawdrb.exe
  C:\Windows\System\hhawdrb.exe
  2⤵
  PID:5352
- C:\Windows\System\iLFCIyv.exe
  C:\Windows\System\iLFCIyv.exe
  2⤵
  PID:5368
- C:\Windows\System\HjJiJvX.exe
  C:\Windows\System\HjJiJvX.exe
  2⤵
  PID:5384
- C:\Windows\System\quvuuIh.exe
  C:\Windows\System\quvuuIh.exe
  2⤵
  PID:5400
- C:\Windows\System\zDCZSYG.exe
  C:\Windows\System\zDCZSYG.exe
  2⤵
  PID:5416
- C:\Windows\System\VIqsUdt.exe
  C:\Windows\System\VIqsUdt.exe
  2⤵
  PID:5432
- C:\Windows\System\dAFlqBb.exe
  C:\Windows\System\dAFlqBb.exe
  2⤵
  PID:5448
- C:\Windows\System\OdtiwHC.exe
  C:\Windows\System\OdtiwHC.exe
  2⤵
  PID:5464
- C:\Windows\System\Ofipxre.exe
  C:\Windows\System\Ofipxre.exe
  2⤵
  PID:5480
- C:\Windows\System\JNAGkYK.exe
  C:\Windows\System\JNAGkYK.exe
  2⤵
  PID:5496
- C:\Windows\System\CKNwJYE.exe
  C:\Windows\System\CKNwJYE.exe
  2⤵
  PID:5512
- C:\Windows\System\FNibDkb.exe
  C:\Windows\System\FNibDkb.exe
  2⤵
  PID:5528
- C:\Windows\System\CGmlDYO.exe
  C:\Windows\System\CGmlDYO.exe
  2⤵
  PID:5544
- C:\Windows\System\QHXjiRN.exe
  C:\Windows\System\QHXjiRN.exe
  2⤵
  PID:5560
- C:\Windows\System\IqUxoCn.exe
  C:\Windows\System\IqUxoCn.exe
  2⤵
  PID:5576
- C:\Windows\System\UYXTBaL.exe
  C:\Windows\System\UYXTBaL.exe
  2⤵
  PID:5592
- C:\Windows\System\ZojGOoQ.exe
  C:\Windows\System\ZojGOoQ.exe
  2⤵
  PID:5608
- C:\Windows\System\RLAsStf.exe
  C:\Windows\System\RLAsStf.exe
  2⤵
  PID:5624
- C:\Windows\System\MhGUMCi.exe
  C:\Windows\System\MhGUMCi.exe
  2⤵
  PID:5640
- C:\Windows\System\KMwlvWL.exe
  C:\Windows\System\KMwlvWL.exe
  2⤵
  PID:5656
- C:\Windows\System\wulfqWO.exe
  C:\Windows\System\wulfqWO.exe
  2⤵
  PID:5672
- C:\Windows\System\flSlcnp.exe
  C:\Windows\System\flSlcnp.exe
  2⤵
  PID:5688
- C:\Windows\System\nJIdpfY.exe
  C:\Windows\System\nJIdpfY.exe
  2⤵
  PID:5704
- C:\Windows\System\CKOWbww.exe
  C:\Windows\System\CKOWbww.exe
  2⤵
  PID:5720
- C:\Windows\System\FoXeYBi.exe
  C:\Windows\System\FoXeYBi.exe
  2⤵
  PID:5736
- C:\Windows\System\RDmKRqI.exe
  C:\Windows\System\RDmKRqI.exe
  2⤵
  PID:5752
- C:\Windows\System\pIybSuT.exe
  C:\Windows\System\pIybSuT.exe
  2⤵
  PID:5768
- C:\Windows\System\XmjWWwj.exe
  C:\Windows\System\XmjWWwj.exe
  2⤵
  PID:5784
- C:\Windows\System\KXDhXAm.exe
  C:\Windows\System\KXDhXAm.exe
  2⤵
  PID:5800
- C:\Windows\System\RySPQSg.exe
  C:\Windows\System\RySPQSg.exe
  2⤵
  PID:5816
- C:\Windows\System\JgbvNmn.exe
  C:\Windows\System\JgbvNmn.exe
  2⤵
  PID:5832
- C:\Windows\System\TlMrHQs.exe
  C:\Windows\System\TlMrHQs.exe
  2⤵
  PID:5848
- C:\Windows\System\yTclPEN.exe
  C:\Windows\System\yTclPEN.exe
  2⤵
  PID:5864
- C:\Windows\System\CCxIRCQ.exe
  C:\Windows\System\CCxIRCQ.exe
  2⤵
  PID:5880
- C:\Windows\System\WBaxOOQ.exe
  C:\Windows\System\WBaxOOQ.exe
  2⤵
  PID:5896
- C:\Windows\System\uHwneUh.exe
  C:\Windows\System\uHwneUh.exe
  2⤵
  PID:5912
- C:\Windows\System\NWAipFU.exe
  C:\Windows\System\NWAipFU.exe
  2⤵
  PID:5928
- C:\Windows\System\jGZazhC.exe
  C:\Windows\System\jGZazhC.exe
  2⤵
  PID:5944
- C:\Windows\System\PWSfxEb.exe
  C:\Windows\System\PWSfxEb.exe
  2⤵
  PID:5960
- C:\Windows\System\eCnuQnn.exe
  C:\Windows\System\eCnuQnn.exe
  2⤵
  PID:5976
- C:\Windows\System\vRHCIHd.exe
  C:\Windows\System\vRHCIHd.exe
  2⤵
  PID:5992
- C:\Windows\System\NtzjdWY.exe
  C:\Windows\System\NtzjdWY.exe
  2⤵
  PID:6008
- C:\Windows\System\GgjIquA.exe
  C:\Windows\System\GgjIquA.exe
  2⤵
  PID:6024
- C:\Windows\System\HzldWSU.exe
  C:\Windows\System\HzldWSU.exe
  2⤵
  PID:6044
- C:\Windows\System\aGchUZR.exe
  C:\Windows\System\aGchUZR.exe
  2⤵
  PID:6060
- C:\Windows\System\jkqAsPC.exe
  C:\Windows\System\jkqAsPC.exe
  2⤵
  PID:6076
- C:\Windows\System\YzHEYRc.exe
  C:\Windows\System\YzHEYRc.exe
  2⤵
  PID:6092
- C:\Windows\System\xoGklXU.exe
  C:\Windows\System\xoGklXU.exe
  2⤵
  PID:6108
- C:\Windows\System\VJlDBpJ.exe
  C:\Windows\System\VJlDBpJ.exe
  2⤵
  PID:6124
- C:\Windows\System\oJYgXSD.exe
  C:\Windows\System\oJYgXSD.exe
  2⤵
  PID:6140
- C:\Windows\System\ZQVjJbA.exe
  C:\Windows\System\ZQVjJbA.exe
  2⤵
  PID:5136
- C:\Windows\System\oFjLznR.exe
  C:\Windows\System\oFjLznR.exe
  2⤵
  PID:2520
- C:\Windows\System\KBBRTVi.exe
  C:\Windows\System\KBBRTVi.exe
  2⤵
  PID:5204
- C:\Windows\System\iBsVixO.exe
  C:\Windows\System\iBsVixO.exe
  2⤵
  PID:4612
- C:\Windows\System\WccllYE.exe
  C:\Windows\System\WccllYE.exe
  2⤵
  PID:5124
- C:\Windows\System\bfUlAJN.exe
  C:\Windows\System\bfUlAJN.exe
  2⤵
  PID:5188
- C:\Windows\System\kIXsPWg.exe
  C:\Windows\System\kIXsPWg.exe
  2⤵
  PID:5248
- C:\Windows\System\JDmGEtb.exe
  C:\Windows\System\JDmGEtb.exe
  2⤵
  PID:5312
- C:\Windows\System\dfyTZRn.exe
  C:\Windows\System\dfyTZRn.exe
  2⤵
  PID:5268
- C:\Windows\System\uGCkKxT.exe
  C:\Windows\System\uGCkKxT.exe
  2⤵
  PID:5344
- C:\Windows\System\SGIsqhw.exe
  C:\Windows\System\SGIsqhw.exe
  2⤵
  PID:5332
- C:\Windows\System\fCYPAcR.exe
  C:\Windows\System\fCYPAcR.exe
  2⤵
  PID:5412
- C:\Windows\System\jbZuVkb.exe
  C:\Windows\System\jbZuVkb.exe
  2⤵
  PID:5444
- C:\Windows\System\jltcZbw.exe
  C:\Windows\System\jltcZbw.exe
  2⤵
  PID:5456
- C:\Windows\System\WEiHpOn.exe
  C:\Windows\System\WEiHpOn.exe
  2⤵
  PID:5536
- C:\Windows\System\fQbJaPj.exe
  C:\Windows\System\fQbJaPj.exe
  2⤵
  PID:5568
- C:\Windows\System\sbFlHxT.exe
  C:\Windows\System\sbFlHxT.exe
  2⤵
  PID:5520
- C:\Windows\System\CcbIgjW.exe
  C:\Windows\System\CcbIgjW.exe
  2⤵
  PID:5668
- C:\Windows\System\XWfZODo.exe
  C:\Windows\System\XWfZODo.exe
  2⤵
  PID:5728
- C:\Windows\System\uxCSTxi.exe
  C:\Windows\System\uxCSTxi.exe
  2⤵
  PID:5792
- C:\Windows\System\EsYxFeu.exe
  C:\Windows\System\EsYxFeu.exe
  2⤵
  PID:5828
- C:\Windows\System\mEKbJDN.exe
  C:\Windows\System\mEKbJDN.exe
  2⤵
  PID:5648
- C:\Windows\System\MZuzxur.exe
  C:\Windows\System\MZuzxur.exe
  2⤵
  PID:5584
- C:\Windows\System\kQaLxhT.exe
  C:\Windows\System\kQaLxhT.exe
  2⤵
  PID:5716
- C:\Windows\System\QeAgXCe.exe
  C:\Windows\System\QeAgXCe.exe
  2⤵
  PID:5776
- C:\Windows\System\lVzbrmL.exe
  C:\Windows\System\lVzbrmL.exe
  2⤵
  PID:5812
- C:\Windows\System\IMlHTDi.exe
  C:\Windows\System\IMlHTDi.exe
  2⤵
  PID:5892
- C:\Windows\System\xjuOuol.exe
  C:\Windows\System\xjuOuol.exe
  2⤵
  PID:5924
- C:\Windows\System\zTWivNx.exe
  C:\Windows\System\zTWivNx.exe
  2⤵
  PID:5988
- C:\Windows\System\SJCvLxR.exe
  C:\Windows\System\SJCvLxR.exe
  2⤵
  PID:6056
- C:\Windows\System\dSZNrlK.exe
  C:\Windows\System\dSZNrlK.exe
  2⤵
  PID:5936
- C:\Windows\System\WWvWjrL.exe
  C:\Windows\System\WWvWjrL.exe
  2⤵
  PID:6120
- C:\Windows\System\gdyGBWt.exe
  C:\Windows\System\gdyGBWt.exe
  2⤵
  PID:6100
- C:\Windows\System\YLujSEn.exe
  C:\Windows\System\YLujSEn.exe
  2⤵
  PID:1040
- C:\Windows\System\iUpTEaT.exe
  C:\Windows\System\iUpTEaT.exe
  2⤵
  PID:6072
- C:\Windows\System\YcSJTyP.exe
  C:\Windows\System\YcSJTyP.exe
  2⤵
  PID:1580
- C:\Windows\System\IzPPARn.exe
  C:\Windows\System\IzPPARn.exe
  2⤵
  PID:5216
- C:\Windows\System\DMwwKsB.exe
  C:\Windows\System\DMwwKsB.exe
  2⤵
  PID:2080
- C:\Windows\System\UOCUtMu.exe
  C:\Windows\System\UOCUtMu.exe
  2⤵
  PID:5364
- C:\Windows\System\GMkKhXM.exe
  C:\Windows\System\GMkKhXM.exe
  2⤵
  PID:5380
- C:\Windows\System\hLkSumc.exe
  C:\Windows\System\hLkSumc.exe
  2⤵
  PID:5460
- C:\Windows\System\lUcIYbj.exe
  C:\Windows\System\lUcIYbj.exe
  2⤵
  PID:5700
- C:\Windows\System\qKCXWZX.exe
  C:\Windows\System\qKCXWZX.exe
  2⤵
  PID:5316
- C:\Windows\System\cORWTnR.exe
  C:\Windows\System\cORWTnR.exe
  2⤵
  PID:5408
- C:\Windows\System\fzZeuRp.exe
  C:\Windows\System\fzZeuRp.exe
  2⤵
  PID:5636
- C:\Windows\System\TqquvMp.exe
  C:\Windows\System\TqquvMp.exe
  2⤵
  PID:5748
- C:\Windows\System\kPdpPli.exe
  C:\Windows\System\kPdpPli.exe
  2⤵
  PID:5876
- C:\Windows\System\YVuSbaY.exe
  C:\Windows\System\YVuSbaY.exe
  2⤵
  PID:5712
- C:\Windows\System\yTEWUAD.exe
  C:\Windows\System\yTEWUAD.exe
  2⤵
  PID:6020
- C:\Windows\System\zpzsRvy.exe
  C:\Windows\System\zpzsRvy.exe
  2⤵
  PID:6052
- C:\Windows\System\SpVnchW.exe
  C:\Windows\System\SpVnchW.exe
  2⤵
  PID:5968
- C:\Windows\System\erINsRY.exe
  C:\Windows\System\erINsRY.exe
  2⤵
  PID:6040
- C:\Windows\System\BJHuaJa.exe
  C:\Windows\System\BJHuaJa.exe
  2⤵
  PID:6136
- C:\Windows\System\WEtVaqZ.exe
  C:\Windows\System\WEtVaqZ.exe
  2⤵
  PID:5156
- C:\Windows\System\BtvzOGC.exe
  C:\Windows\System\BtvzOGC.exe
  2⤵
  PID:5428
- C:\Windows\System\PBCOyAq.exe
  C:\Windows\System\PBCOyAq.exe
  2⤵
  PID:5492
- C:\Windows\System\KUtsCZL.exe
  C:\Windows\System\KUtsCZL.exe
  2⤵
  PID:5396
- C:\Windows\System\VoYmNOJ.exe
  C:\Windows\System\VoYmNOJ.exe
  2⤵
  PID:5744
- C:\Windows\System\bCBRxfs.exe
  C:\Windows\System\bCBRxfs.exe
  2⤵
  PID:5888
- C:\Windows\System\GyfeBBW.exe
  C:\Windows\System\GyfeBBW.exe
  2⤵
  PID:5940
- C:\Windows\System\apuXSTs.exe
  C:\Windows\System\apuXSTs.exe
  2⤵
  PID:4288
- C:\Windows\System\FNEAKrj.exe
  C:\Windows\System\FNEAKrj.exe
  2⤵
  PID:5172
- C:\Windows\System\fMTfdsh.exe
  C:\Windows\System\fMTfdsh.exe
  2⤵
  PID:5604
- C:\Windows\System\NPBBZQU.exe
  C:\Windows\System\NPBBZQU.exe
  2⤵
  PID:5984
- C:\Windows\System\EifdqvG.exe
  C:\Windows\System\EifdqvG.exe
  2⤵
  PID:5856
- C:\Windows\System\qzoRsJl.exe
  C:\Windows\System\qzoRsJl.exe
  2⤵
  PID:5328
- C:\Windows\System\JnlRQWE.exe
  C:\Windows\System\JnlRQWE.exe
  2⤵
  PID:6152
- C:\Windows\System\YPgKLdx.exe
  C:\Windows\System\YPgKLdx.exe
  2⤵
  PID:6168
- C:\Windows\System\lBiCxOf.exe
  C:\Windows\System\lBiCxOf.exe
  2⤵
  PID:6184
- C:\Windows\System\QPMrTEl.exe
  C:\Windows\System\QPMrTEl.exe
  2⤵
  PID:6200
- C:\Windows\System\rJJKStn.exe
  C:\Windows\System\rJJKStn.exe
  2⤵
  PID:6216
- C:\Windows\System\tVszjkJ.exe
  C:\Windows\System\tVszjkJ.exe
  2⤵
  PID:6232
- C:\Windows\System\KNTfXjx.exe
  C:\Windows\System\KNTfXjx.exe
  2⤵
  PID:6248
- C:\Windows\System\XhMrjVU.exe
  C:\Windows\System\XhMrjVU.exe
  2⤵
  PID:6264
- C:\Windows\System\aSNsupv.exe
  C:\Windows\System\aSNsupv.exe
  2⤵
  PID:6280
- C:\Windows\System\acRxgdN.exe
  C:\Windows\System\acRxgdN.exe
  2⤵
  PID:6296
- C:\Windows\System\zbzfCeD.exe
  C:\Windows\System\zbzfCeD.exe
  2⤵
  PID:6312
- C:\Windows\System\ZyvgcUD.exe
  C:\Windows\System\ZyvgcUD.exe
  2⤵
  PID:6328
- C:\Windows\System\StUeMNy.exe
  C:\Windows\System\StUeMNy.exe
  2⤵
  PID:6344
- C:\Windows\System\JKqvJUG.exe
  C:\Windows\System\JKqvJUG.exe
  2⤵
  PID:6360
- C:\Windows\System\cgVkaNg.exe
  C:\Windows\System\cgVkaNg.exe
  2⤵
  PID:6376
- C:\Windows\System\wxwRQug.exe
  C:\Windows\System\wxwRQug.exe
  2⤵
  PID:6392
- C:\Windows\System\CpgTXvv.exe
  C:\Windows\System\CpgTXvv.exe
  2⤵
  PID:6408
- C:\Windows\System\eaZmWqg.exe
  C:\Windows\System\eaZmWqg.exe
  2⤵
  PID:6424
- C:\Windows\System\TqIrffE.exe
  C:\Windows\System\TqIrffE.exe
  2⤵
  PID:6440
- C:\Windows\System\VgFkzNO.exe
  C:\Windows\System\VgFkzNO.exe
  2⤵
  PID:6456
- C:\Windows\System\mNdAXdT.exe
  C:\Windows\System\mNdAXdT.exe
  2⤵
  PID:6472
- C:\Windows\System\wFaglNj.exe
  C:\Windows\System\wFaglNj.exe
  2⤵
  PID:6488
- C:\Windows\System\WiixlTl.exe
  C:\Windows\System\WiixlTl.exe
  2⤵
  PID:6504
- C:\Windows\System\aDHKpJK.exe
  C:\Windows\System\aDHKpJK.exe
  2⤵
  PID:6520
- C:\Windows\System\gDkSsYI.exe
  C:\Windows\System\gDkSsYI.exe
  2⤵
  PID:6540
- C:\Windows\System\LPJbDCo.exe
  C:\Windows\System\LPJbDCo.exe
  2⤵
  PID:6564
- C:\Windows\System\AGeyMdI.exe
  C:\Windows\System\AGeyMdI.exe
  2⤵
  PID:6580
- C:\Windows\System\XbxYhOw.exe
  C:\Windows\System\XbxYhOw.exe
  2⤵
  PID:6596
- C:\Windows\System\OXEbaGP.exe
  C:\Windows\System\OXEbaGP.exe
  2⤵
  PID:6612
- C:\Windows\System\jfGbLps.exe
  C:\Windows\System\jfGbLps.exe
  2⤵
  PID:6628
- C:\Windows\System\COimipb.exe
  C:\Windows\System\COimipb.exe
  2⤵
  PID:6644
- C:\Windows\System\zABsoiL.exe
  C:\Windows\System\zABsoiL.exe
  2⤵
  PID:6660
- C:\Windows\System\TWBEHtu.exe
  C:\Windows\System\TWBEHtu.exe
  2⤵
  PID:6676
- C:\Windows\System\nOaKbLj.exe
  C:\Windows\System\nOaKbLj.exe
  2⤵
  PID:6692
- C:\Windows\System\roQkKTL.exe
  C:\Windows\System\roQkKTL.exe
  2⤵
  PID:6708
- C:\Windows\System\CJeEteE.exe
  C:\Windows\System\CJeEteE.exe
  2⤵
  PID:6724
- C:\Windows\System\oCnSSqp.exe
  C:\Windows\System\oCnSSqp.exe
  2⤵
  PID:6744
- C:\Windows\System\wafAvDc.exe
  C:\Windows\System\wafAvDc.exe
  2⤵
  PID:6760
- C:\Windows\System\cetiKEn.exe
  C:\Windows\System\cetiKEn.exe
  2⤵
  PID:6776
- C:\Windows\System\cgnIBdm.exe
  C:\Windows\System\cgnIBdm.exe
  2⤵
  PID:6792
- C:\Windows\System\ZYFPGxl.exe
  C:\Windows\System\ZYFPGxl.exe
  2⤵
  PID:6808
- C:\Windows\System\NOYLHPg.exe
  C:\Windows\System\NOYLHPg.exe
  2⤵
  PID:6824
- C:\Windows\System\BLUEihH.exe
  C:\Windows\System\BLUEihH.exe
  2⤵
  PID:6840
- C:\Windows\System\JOPDoGk.exe
  C:\Windows\System\JOPDoGk.exe
  2⤵
  PID:6864
- C:\Windows\System\bloNhCj.exe
  C:\Windows\System\bloNhCj.exe
  2⤵
  PID:6880
- C:\Windows\System\yakggUL.exe
  C:\Windows\System\yakggUL.exe
  2⤵
  PID:6896
- C:\Windows\System\luCobLS.exe
  C:\Windows\System\luCobLS.exe
  2⤵
  PID:6912
- C:\Windows\System\xMLxnrj.exe
  C:\Windows\System\xMLxnrj.exe
  2⤵
  PID:6928
- C:\Windows\System\KwtdvvT.exe
  C:\Windows\System\KwtdvvT.exe
  2⤵
  PID:6944
- C:\Windows\System\XwrJaIz.exe
  C:\Windows\System\XwrJaIz.exe
  2⤵
  PID:6968
- C:\Windows\System\ZqyQFOQ.exe
  C:\Windows\System\ZqyQFOQ.exe
  2⤵
  PID:6984
- C:\Windows\System\opSptfY.exe
  C:\Windows\System\opSptfY.exe
  2⤵
  PID:7000
- C:\Windows\System\oQYAeVa.exe
  C:\Windows\System\oQYAeVa.exe
  2⤵
  PID:7016
- C:\Windows\System\RvbFZfI.exe
  C:\Windows\System\RvbFZfI.exe
  2⤵
  PID:7032
- C:\Windows\System\QkzOnrL.exe
  C:\Windows\System\QkzOnrL.exe
  2⤵
  PID:7048
- C:\Windows\System\EbMyKvG.exe
  C:\Windows\System\EbMyKvG.exe
  2⤵
  PID:7064
- C:\Windows\System\DSuGKrY.exe
  C:\Windows\System\DSuGKrY.exe
  2⤵
  PID:7080
- C:\Windows\System\okjpCmb.exe
  C:\Windows\System\okjpCmb.exe
  2⤵
  PID:7096
- C:\Windows\System\QuDIutY.exe
  C:\Windows\System\QuDIutY.exe
  2⤵
  PID:7112
- C:\Windows\System\HODuSJM.exe
  C:\Windows\System\HODuSJM.exe
  2⤵
  PID:7128
- C:\Windows\System\quDfoIo.exe
  C:\Windows\System\quDfoIo.exe
  2⤵
  PID:7144
- C:\Windows\System\fLveqaM.exe
  C:\Windows\System\fLveqaM.exe
  2⤵
  PID:7160
- C:\Windows\System\mlwnMNC.exe
  C:\Windows\System\mlwnMNC.exe
  2⤵
  PID:5844
- C:\Windows\System\tDWinPl.exe
  C:\Windows\System\tDWinPl.exe
  2⤵
  PID:5488
- C:\Windows\System\fZEPmWg.exe
  C:\Windows\System\fZEPmWg.exe
  2⤵
  PID:6212
- C:\Windows\System\ZVQXOrR.exe
  C:\Windows\System\ZVQXOrR.exe
  2⤵
  PID:6196
- C:\Windows\System\vYdrgUS.exe
  C:\Windows\System\vYdrgUS.exe
  2⤵
  PID:6164
- C:\Windows\System\nDHdeqv.exe
  C:\Windows\System\nDHdeqv.exe
  2⤵
  PID:6320
- C:\Windows\System\fREQkvm.exe
  C:\Windows\System\fREQkvm.exe
  2⤵
  PID:6336
- C:\Windows\System\pcdTNeb.exe
  C:\Windows\System\pcdTNeb.exe
  2⤵
  PID:6340
- C:\Windows\System\CscYyqg.exe
  C:\Windows\System\CscYyqg.exe
  2⤵
  PID:6356
- C:\Windows\System\AGbRDKd.exe
  C:\Windows\System\AGbRDKd.exe
  2⤵
  PID:6404
- C:\Windows\System\cuyeqAE.exe
  C:\Windows\System\cuyeqAE.exe
  2⤵
  PID:6436
- C:\Windows\System\OKZQRYK.exe
  C:\Windows\System\OKZQRYK.exe
  2⤵
  PID:6484
- C:\Windows\System\sFzeBUn.exe
  C:\Windows\System\sFzeBUn.exe
  2⤵
  PID:6500
- C:\Windows\System\RuANLIv.exe
  C:\Windows\System\RuANLIv.exe
  2⤵
  PID:6536
- C:\Windows\System\kYTvNNd.exe
  C:\Windows\System\kYTvNNd.exe
  2⤵
  PID:6560
- C:\Windows\System\QGbBUpS.exe
  C:\Windows\System\QGbBUpS.exe
  2⤵
  PID:6592
- C:\Windows\System\qUcpBAG.exe
  C:\Windows\System\qUcpBAG.exe
  2⤵
  PID:6684
- C:\Windows\System\CTbETdo.exe
  C:\Windows\System\CTbETdo.exe
  2⤵
  PID:6608
- C:\Windows\System\TkMxlmU.exe
  C:\Windows\System\TkMxlmU.exe
  2⤵
  PID:6668
- C:\Windows\System\UYDDvis.exe
  C:\Windows\System\UYDDvis.exe
  2⤵
  PID:6736
- C:\Windows\System\PiKBkMu.exe
  C:\Windows\System\PiKBkMu.exe
  2⤵
  PID:6788
- C:\Windows\System\vshPGpY.exe
  C:\Windows\System\vshPGpY.exe
  2⤵
  PID:6800
- C:\Windows\System\qjYANUq.exe
  C:\Windows\System\qjYANUq.exe
  2⤵
  PID:6820
- C:\Windows\System\dUoUsWH.exe
  C:\Windows\System\dUoUsWH.exe
  2⤵
  PID:6860
- C:\Windows\System\GuIbgCW.exe
  C:\Windows\System\GuIbgCW.exe
  2⤵
  PID:6952
- C:\Windows\System\vUbMebZ.exe
  C:\Windows\System\vUbMebZ.exe
  2⤵
  PID:6872
- C:\Windows\System\nNPCxsI.exe
  C:\Windows\System\nNPCxsI.exe
  2⤵
  PID:6556
- C:\Windows\System\RHzUZJr.exe
  C:\Windows\System\RHzUZJr.exe
  2⤵
  PID:6996
- C:\Windows\System\IccNQdt.exe
  C:\Windows\System\IccNQdt.exe
  2⤵
  PID:7008
- C:\Windows\System\XYrrZdW.exe
  C:\Windows\System\XYrrZdW.exe
  2⤵
  PID:7028
- C:\Windows\System\UexAogE.exe
  C:\Windows\System\UexAogE.exe
  2⤵
  PID:7088
- C:\Windows\System\VyYHdXs.exe
  C:\Windows\System\VyYHdXs.exe
  2⤵
  PID:7120
- C:\Windows\System\PqCjYuV.exe
  C:\Windows\System\PqCjYuV.exe
  2⤵
  PID:5284
- C:\Windows\System\SXbBhlT.exe
  C:\Windows\System\SXbBhlT.exe
  2⤵
  PID:7136
- C:\Windows\System\GMoqjRm.exe
  C:\Windows\System\GMoqjRm.exe
  2⤵
  PID:6176
- C:\Windows\System\RMSsPOY.exe
  C:\Windows\System\RMSsPOY.exe
  2⤵
  PID:6192
- C:\Windows\System\uGWEmBa.exe
  C:\Windows\System\uGWEmBa.exe
  2⤵
  PID:6260
- C:\Windows\System\JXfxVLJ.exe
  C:\Windows\System\JXfxVLJ.exe
  2⤵
  PID:6388
- C:\Windows\System\MplHZEb.exe
  C:\Windows\System\MplHZEb.exe
  2⤵
  PID:6452
- C:\Windows\System\bbUCtYk.exe
  C:\Windows\System\bbUCtYk.exe
  2⤵
  PID:6572
- C:\Windows\System\RpxgnoY.exe
  C:\Windows\System\RpxgnoY.exe
  2⤵
  PID:6716
- C:\Windows\System\PiDYIgx.exe
  C:\Windows\System\PiDYIgx.exe
  2⤵
  PID:6624
- C:\Windows\System\HeXLOrp.exe
  C:\Windows\System\HeXLOrp.exe
  2⤵
  PID:6700
- C:\Windows\System\NCWloCQ.exe
  C:\Windows\System\NCWloCQ.exe
  2⤵
  PID:6636
- C:\Windows\System\MOpdFlB.exe
  C:\Windows\System\MOpdFlB.exe
  2⤵
  PID:6768
- C:\Windows\System\DrMQhzl.exe
  C:\Windows\System\DrMQhzl.exe
  2⤵
  PID:6940
- C:\Windows\System\zCMENMY.exe
  C:\Windows\System\zCMENMY.exe
  2⤵
  PID:7040
- C:\Windows\System\ROIFExq.exe
  C:\Windows\System\ROIFExq.exe
  2⤵
  PID:6920
- C:\Windows\System\GMDQCwg.exe
  C:\Windows\System\GMDQCwg.exe
  2⤵
  PID:6924
- C:\Windows\System\jSkQgCY.exe
  C:\Windows\System\jSkQgCY.exe
  2⤵
  PID:6980
- C:\Windows\System\Zflknuk.exe
  C:\Windows\System\Zflknuk.exe
  2⤵
  PID:7152
- C:\Windows\System\OdBXpkb.exe
  C:\Windows\System\OdBXpkb.exe
  2⤵
  PID:6324
- C:\Windows\System\hBTNEQi.exe
  C:\Windows\System\hBTNEQi.exe
  2⤵
  PID:6228
- C:\Windows\System\NbAWEie.exe
  C:\Windows\System\NbAWEie.exe
  2⤵
  PID:6416
- C:\Windows\System\LpmzZZt.exe
  C:\Windows\System\LpmzZZt.exe
  2⤵
  PID:6672
- C:\Windows\System\kLlKDGm.exe
  C:\Windows\System\kLlKDGm.exe
  2⤵
  PID:6480
- C:\Windows\System\mkFEwnR.exe
  C:\Windows\System\mkFEwnR.exe
  2⤵
  PID:6976
- C:\Windows\System\ABNGKHL.exe
  C:\Windows\System\ABNGKHL.exe
  2⤵
  PID:5860
- C:\Windows\System\lDOlbmD.exe
  C:\Windows\System\lDOlbmD.exe
  2⤵
  PID:7104
- C:\Windows\System\VasJIAF.exe
  C:\Windows\System\VasJIAF.exe
  2⤵
  PID:7060
- C:\Windows\System\HspppHE.exe
  C:\Windows\System\HspppHE.exe
  2⤵
  PID:6400
- C:\Windows\System\QssJcBq.exe
  C:\Windows\System\QssJcBq.exe
  2⤵
  PID:6832
- C:\Windows\System\GetmRrH.exe
  C:\Windows\System\GetmRrH.exe
  2⤵
  PID:6756
- C:\Windows\System\ZVARywY.exe
  C:\Windows\System\ZVARywY.exe
  2⤵
  PID:7184
- C:\Windows\System\CfCbbJo.exe
  C:\Windows\System\CfCbbJo.exe
  2⤵
  PID:7200
- C:\Windows\System\MVuCFSl.exe
  C:\Windows\System\MVuCFSl.exe
  2⤵
  PID:7220
- C:\Windows\System\zjHdQTd.exe
  C:\Windows\System\zjHdQTd.exe
  2⤵
  PID:7236
- C:\Windows\System\gfnCEcL.exe
  C:\Windows\System\gfnCEcL.exe
  2⤵
  PID:7252
- C:\Windows\System\LJDXKeh.exe
  C:\Windows\System\LJDXKeh.exe
  2⤵
  PID:7268
- C:\Windows\System\sumAzOS.exe
  C:\Windows\System\sumAzOS.exe
  2⤵
  PID:7292
- C:\Windows\System\cOxEENk.exe
  C:\Windows\System\cOxEENk.exe
  2⤵
  PID:7308
- C:\Windows\System\uWWqCdE.exe
  C:\Windows\System\uWWqCdE.exe
  2⤵
  PID:7324
- C:\Windows\System\dTFKSTR.exe
  C:\Windows\System\dTFKSTR.exe
  2⤵
  PID:7340
- C:\Windows\System\SVAKKKi.exe
  C:\Windows\System\SVAKKKi.exe
  2⤵
  PID:7360
- C:\Windows\System\lTOhzZr.exe
  C:\Windows\System\lTOhzZr.exe
  2⤵
  PID:7376
- C:\Windows\System\CEtZStR.exe
  C:\Windows\System\CEtZStR.exe
  2⤵
  PID:7392
- C:\Windows\System\VphBLOK.exe
  C:\Windows\System\VphBLOK.exe
  2⤵
  PID:7408
- C:\Windows\System\jDsAGdA.exe
  C:\Windows\System\jDsAGdA.exe
  2⤵
  PID:7424
- C:\Windows\System\OSAslgw.exe
  C:\Windows\System\OSAslgw.exe
  2⤵
  PID:7440
- C:\Windows\System\zpidJmM.exe
  C:\Windows\System\zpidJmM.exe
  2⤵
  PID:7456
- C:\Windows\System\TJoPUgO.exe
  C:\Windows\System\TJoPUgO.exe
  2⤵
  PID:7476
- C:\Windows\System\QgDjRhF.exe
  C:\Windows\System\QgDjRhF.exe
  2⤵
  PID:7492
- C:\Windows\System\MjUpDHr.exe
  C:\Windows\System\MjUpDHr.exe
  2⤵
  PID:7508
- C:\Windows\System\NZZVInJ.exe
  C:\Windows\System\NZZVInJ.exe
  2⤵
  PID:7524
- C:\Windows\System\AwqJgJA.exe
  C:\Windows\System\AwqJgJA.exe
  2⤵
  PID:7540
- C:\Windows\System\bsXWubk.exe
  C:\Windows\System\bsXWubk.exe
  2⤵
  PID:7556
- C:\Windows\System\lXyrtoy.exe
  C:\Windows\System\lXyrtoy.exe
  2⤵
  PID:7572
- C:\Windows\System\atHXhnS.exe
  C:\Windows\System\atHXhnS.exe
  2⤵
  PID:7588
- C:\Windows\System\MWJmjzU.exe
  C:\Windows\System\MWJmjzU.exe
  2⤵
  PID:7604
- C:\Windows\System\lniZlqI.exe
  C:\Windows\System\lniZlqI.exe
  2⤵
  PID:7644
- C:\Windows\System\RrtPPhx.exe
  C:\Windows\System\RrtPPhx.exe
  2⤵
  PID:7660
- C:\Windows\System\BrRzHvB.exe
  C:\Windows\System\BrRzHvB.exe
  2⤵
  PID:7680
- C:\Windows\System\qTDUKFj.exe
  C:\Windows\System\qTDUKFj.exe
  2⤵
  PID:7696
- C:\Windows\System\JCkKkmR.exe
  C:\Windows\System\JCkKkmR.exe
  2⤵
  PID:7712
- C:\Windows\System\mrPUBut.exe
  C:\Windows\System\mrPUBut.exe
  2⤵
  PID:7728
- C:\Windows\System\brbOdVn.exe
  C:\Windows\System\brbOdVn.exe
  2⤵
  PID:7748
- C:\Windows\System\rnFaHZe.exe
  C:\Windows\System\rnFaHZe.exe
  2⤵
  PID:7768
- C:\Windows\System\lUWhkvC.exe
  C:\Windows\System\lUWhkvC.exe
  2⤵
  PID:7784
- C:\Windows\System\Urrlnfw.exe
  C:\Windows\System\Urrlnfw.exe
  2⤵
  PID:7800
- C:\Windows\System\SDZDAjj.exe
  C:\Windows\System\SDZDAjj.exe
  2⤵
  PID:7816
- C:\Windows\System\GKeYJMU.exe
  C:\Windows\System\GKeYJMU.exe
  2⤵
  PID:7836
- C:\Windows\System\GNYnuab.exe
  C:\Windows\System\GNYnuab.exe
  2⤵
  PID:7852
- C:\Windows\System\VBpvbKW.exe
  C:\Windows\System\VBpvbKW.exe
  2⤵
  PID:7868
- C:\Windows\System\yprHERc.exe
  C:\Windows\System\yprHERc.exe
  2⤵
  PID:7884
- C:\Windows\System\acKTlrO.exe
  C:\Windows\System\acKTlrO.exe
  2⤵
  PID:7900
- C:\Windows\System\IaRLCyw.exe
  C:\Windows\System\IaRLCyw.exe
  2⤵
  PID:7916
- C:\Windows\System\zZysUvb.exe
  C:\Windows\System\zZysUvb.exe
  2⤵
  PID:7932
- C:\Windows\System\gaskeqa.exe
  C:\Windows\System\gaskeqa.exe
  2⤵
  PID:7948
- C:\Windows\System\fzHlKFC.exe
  C:\Windows\System\fzHlKFC.exe
  2⤵
  PID:7964
- C:\Windows\System\DjJHbqo.exe
  C:\Windows\System\DjJHbqo.exe
  2⤵
  PID:7984
- C:\Windows\System\bISGkSZ.exe
  C:\Windows\System\bISGkSZ.exe
  2⤵
  PID:8000
- C:\Windows\System\xECpXut.exe
  C:\Windows\System\xECpXut.exe
  2⤵
  PID:8016
- C:\Windows\System\fTgMWgb.exe
  C:\Windows\System\fTgMWgb.exe
  2⤵
  PID:8032
- C:\Windows\System\OeomTNE.exe
  C:\Windows\System\OeomTNE.exe
  2⤵
  PID:8048
- C:\Windows\System\DeJJEMY.exe
  C:\Windows\System\DeJJEMY.exe
  2⤵
  PID:8072
- C:\Windows\System\hDfdUnC.exe
  C:\Windows\System\hDfdUnC.exe
  2⤵
  PID:8088
- C:\Windows\System\qKOhIpk.exe
  C:\Windows\System\qKOhIpk.exe
  2⤵
  PID:8104
- C:\Windows\System\ldAowcg.exe
  C:\Windows\System\ldAowcg.exe
  2⤵
  PID:8120
- C:\Windows\System\sAbaqsg.exe
  C:\Windows\System\sAbaqsg.exe
  2⤵
  PID:8144
- C:\Windows\System\XFpzjtv.exe
  C:\Windows\System\XFpzjtv.exe
  2⤵
  PID:8160
- C:\Windows\System\BcKUyNY.exe
  C:\Windows\System\BcKUyNY.exe
  2⤵
  PID:8176
- C:\Windows\System\Qxhdhkw.exe
  C:\Windows\System\Qxhdhkw.exe
  2⤵
  PID:7176
- C:\Windows\System\GXGtiiT.exe
  C:\Windows\System\GXGtiiT.exe
  2⤵
  PID:7212
- C:\Windows\System\BBDyXhe.exe
  C:\Windows\System\BBDyXhe.exe
  2⤵
  PID:7248
- C:\Windows\System\bNZtXNX.exe
  C:\Windows\System\bNZtXNX.exe
  2⤵
  PID:6908
- C:\Windows\System\MyOxGTu.exe
  C:\Windows\System\MyOxGTu.exe
  2⤵
  PID:7228
- C:\Windows\System\jkMcBfp.exe
  C:\Windows\System\jkMcBfp.exe
  2⤵
  PID:7264
- C:\Windows\System\kKqcwWH.exe
  C:\Windows\System\kKqcwWH.exe
  2⤵
  PID:7316
- C:\Windows\System\BaXkGHH.exe
  C:\Windows\System\BaXkGHH.exe
  2⤵
  PID:7348
- C:\Windows\System\llEduEQ.exe
  C:\Windows\System\llEduEQ.exe
  2⤵
  PID:7384
- C:\Windows\System\DOOFyXY.exe
  C:\Windows\System\DOOFyXY.exe
  2⤵
  PID:7420
- C:\Windows\System\imCZsSH.exe
  C:\Windows\System\imCZsSH.exe
  2⤵
  PID:7484
- C:\Windows\System\zVVyXNj.exe
  C:\Windows\System\zVVyXNj.exe
  2⤵
  PID:7472
- C:\Windows\System\cOdJLTY.exe
  C:\Windows\System\cOdJLTY.exe
  2⤵
  PID:7468
- C:\Windows\System\xGcvbMr.exe
  C:\Windows\System\xGcvbMr.exe
  2⤵
  PID:7548
- C:\Windows\System\IhORBYq.exe
  C:\Windows\System\IhORBYq.exe
  2⤵
  PID:7504
- C:\Windows\System\rCdpePo.exe
  C:\Windows\System\rCdpePo.exe
  2⤵
  PID:7612
- C:\Windows\System\ciffDfO.exe
  C:\Windows\System\ciffDfO.exe
  2⤵
  PID:7628
- C:\Windows\System\NTeREcY.exe
  C:\Windows\System\NTeREcY.exe
  2⤵
  PID:7636
- C:\Windows\System\UPJWgUK.exe
  C:\Windows\System\UPJWgUK.exe
  2⤵
  PID:7672
- C:\Windows\System\XnAunoB.exe
  C:\Windows\System\XnAunoB.exe
  2⤵
  PID:7848
- C:\Windows\System\FkJjqFb.exe
  C:\Windows\System\FkJjqFb.exe
  2⤵
  PID:7760
- C:\Windows\System\sJLzsYO.exe
  C:\Windows\System\sJLzsYO.exe
  2⤵
  PID:7824
- C:\Windows\System\HuepVUf.exe
  C:\Windows\System\HuepVUf.exe
  2⤵
  PID:7912
- C:\Windows\System\mGeKJzw.exe
  C:\Windows\System\mGeKJzw.exe
  2⤵
  PID:7892
- C:\Windows\System\QrCZBUN.exe
  C:\Windows\System\QrCZBUN.exe
  2⤵
  PID:7976
- C:\Windows\System\avgauCD.exe
  C:\Windows\System\avgauCD.exe
  2⤵
  PID:8044
- C:\Windows\System\xPbgJjM.exe
  C:\Windows\System\xPbgJjM.exe
  2⤵
  PID:8112
- C:\Windows\System\xEnpaXp.exe
  C:\Windows\System\xEnpaXp.exe
  2⤵
  PID:7924
- C:\Windows\System\yAKfiUq.exe
  C:\Windows\System\yAKfiUq.exe
  2⤵
  PID:7208
- C:\Windows\System\SFdFwrN.exe
  C:\Windows\System\SFdFwrN.exe
  2⤵
  PID:7992
- C:\Windows\System\QwEahEZ.exe
  C:\Windows\System\QwEahEZ.exe
  2⤵
  PID:7960
- C:\Windows\System\BWenAGh.exe
  C:\Windows\System\BWenAGh.exe
  2⤵
  PID:8140
- C:\Windows\System\QPuJnVq.exe
  C:\Windows\System\QPuJnVq.exe
  2⤵
  PID:8064
- C:\Windows\System\pWTCKFY.exe
  C:\Windows\System\pWTCKFY.exe
  2⤵
  PID:8172
- C:\Windows\System\YPfDSTQ.exe
  C:\Windows\System\YPfDSTQ.exe
  2⤵
  PID:8128
- C:\Windows\System\khPVwZA.exe
  C:\Windows\System\khPVwZA.exe
  2⤵
  PID:7332
- C:\Windows\System\KvSDFNh.exe
  C:\Windows\System\KvSDFNh.exe
  2⤵
  PID:7448
- C:\Windows\System\hinUcHx.exe
  C:\Windows\System\hinUcHx.exe
  2⤵
  PID:7232
- C:\Windows\System\KKoMBQr.exe
  C:\Windows\System\KKoMBQr.exe
  2⤵
  PID:7404
- C:\Windows\System\JAfRvCQ.exe
  C:\Windows\System\JAfRvCQ.exe
  2⤵
  PID:7676
- C:\Windows\System\KLSsuJp.exe
  C:\Windows\System\KLSsuJp.exe
  2⤵
  PID:7632
- C:\Windows\System\oJlJoQM.exe
  C:\Windows\System\oJlJoQM.exe
  2⤵
  PID:7756
- C:\Windows\System\RRAciHL.exe
  C:\Windows\System\RRAciHL.exe
  2⤵
  PID:7908
- C:\Windows\System\mRYqrGv.exe
  C:\Windows\System\mRYqrGv.exe
  2⤵
  PID:7780
- C:\Windows\System\hzYOXLz.exe
  C:\Windows\System\hzYOXLz.exe
  2⤵
  PID:7624
- C:\Windows\System\XUyWnVX.exe
  C:\Windows\System\XUyWnVX.exe
  2⤵
  PID:7972
- C:\Windows\System\mebPXDj.exe
  C:\Windows\System\mebPXDj.exe
  2⤵
  PID:7796
- C:\Windows\System\YTymffN.exe
  C:\Windows\System\YTymffN.exe
  2⤵
  PID:8100
- C:\Windows\System\UxxNjJi.exe
  C:\Windows\System\UxxNjJi.exe
  2⤵
  PID:7744
- C:\Windows\System\yLDvdxi.exe
  C:\Windows\System\yLDvdxi.exe
  2⤵
  PID:8152
- C:\Windows\System\FSpAUol.exe
  C:\Windows\System\FSpAUol.exe
  2⤵
  PID:7944
- C:\Windows\System\HqXkmtL.exe
  C:\Windows\System\HqXkmtL.exe
  2⤵
  PID:8156
- C:\Windows\System\RMVLxrv.exe
  C:\Windows\System\RMVLxrv.exe
  2⤵
  PID:8056
- C:\Windows\System\UVRHWIl.exe
  C:\Windows\System\UVRHWIl.exe
  2⤵
  PID:7436
- C:\Windows\System\pXhIAXP.exe
  C:\Windows\System\pXhIAXP.exe
  2⤵
  PID:7740
- C:\Windows\System\KaROrFn.exe
  C:\Windows\System\KaROrFn.exe
  2⤵
  PID:7356
- C:\Windows\System\OPlMMFs.exe
  C:\Windows\System\OPlMMFs.exe
  2⤵
  PID:7452
- C:\Windows\System\XNkaNBt.exe
  C:\Windows\System\XNkaNBt.exe
  2⤵
  PID:7580
- C:\Windows\System\apFAscF.exe
  C:\Windows\System\apFAscF.exe
  2⤵
  PID:8060
- C:\Windows\System\gBGdgqt.exe
  C:\Windows\System\gBGdgqt.exe
  2⤵
  PID:5824
- C:\Windows\System\bvpMkHx.exe
  C:\Windows\System\bvpMkHx.exe
  2⤵
  PID:8196
- C:\Windows\System\MJlEiwb.exe
  C:\Windows\System\MJlEiwb.exe
  2⤵
  PID:8212
- C:\Windows\System\XlnzOVg.exe
  C:\Windows\System\XlnzOVg.exe
  2⤵
  PID:8228
- C:\Windows\System\MMPlYlV.exe
  C:\Windows\System\MMPlYlV.exe
  2⤵
  PID:8244
- C:\Windows\System\RLKiaBs.exe
  C:\Windows\System\RLKiaBs.exe
  2⤵
  PID:8292
- C:\Windows\System\mIemhNo.exe
  C:\Windows\System\mIemhNo.exe
  2⤵
  PID:8308
- C:\Windows\System\LXbJikb.exe
  C:\Windows\System\LXbJikb.exe
  2⤵
  PID:8324
- C:\Windows\System\PbCYAvu.exe
  C:\Windows\System\PbCYAvu.exe
  2⤵
  PID:8340
- C:\Windows\System\KPfvtYr.exe
  C:\Windows\System\KPfvtYr.exe
  2⤵
  PID:8356
- C:\Windows\System\cpFJkbz.exe
  C:\Windows\System\cpFJkbz.exe
  2⤵
  PID:8372
- C:\Windows\System\XEtuopi.exe
  C:\Windows\System\XEtuopi.exe
  2⤵
  PID:8392
- C:\Windows\System\ndzmuvE.exe
  C:\Windows\System\ndzmuvE.exe
  2⤵
  PID:8440
- C:\Windows\System\RXQgFnb.exe
  C:\Windows\System\RXQgFnb.exe
  2⤵
  PID:8456
- C:\Windows\System\QoQKOMR.exe
  C:\Windows\System\QoQKOMR.exe
  2⤵
  PID:8472
- C:\Windows\System\LolGkyk.exe
  C:\Windows\System\LolGkyk.exe
  2⤵
  PID:8488
- C:\Windows\System\HHaIejd.exe
  C:\Windows\System\HHaIejd.exe
  2⤵
  PID:8508
- C:\Windows\System\nSHOVnC.exe
  C:\Windows\System\nSHOVnC.exe
  2⤵
  PID:8532
- C:\Windows\System\DQwaZyw.exe
  C:\Windows\System\DQwaZyw.exe
  2⤵
  PID:8552
- C:\Windows\System\KvjCXwu.exe
  C:\Windows\System\KvjCXwu.exe
  2⤵
  PID:8568
- C:\Windows\System\vegSeJV.exe
  C:\Windows\System\vegSeJV.exe
  2⤵
  PID:8584
- C:\Windows\System\PWHCzAi.exe
  C:\Windows\System\PWHCzAi.exe
  2⤵
  PID:8600
- C:\Windows\System\nQJSKBK.exe
  C:\Windows\System\nQJSKBK.exe
  2⤵
  PID:8616
- C:\Windows\System\VpYJCeo.exe
  C:\Windows\System\VpYJCeo.exe
  2⤵
  PID:8640
- C:\Windows\System\tDtnWmg.exe
  C:\Windows\System\tDtnWmg.exe
  2⤵
  PID:8656
- C:\Windows\System\QQdcbjY.exe
  C:\Windows\System\QQdcbjY.exe
  2⤵
  PID:8676
- C:\Windows\System\InTqhwk.exe
  C:\Windows\System\InTqhwk.exe
  2⤵
  PID:8692
- C:\Windows\System\XRkcrdB.exe
  C:\Windows\System\XRkcrdB.exe
  2⤵
  PID:8708
- C:\Windows\System\UTlaqLE.exe
  C:\Windows\System\UTlaqLE.exe
  2⤵
  PID:8724
- C:\Windows\System\copvowJ.exe
  C:\Windows\System\copvowJ.exe
  2⤵
  PID:8768
- C:\Windows\System\cijUJLN.exe
  C:\Windows\System\cijUJLN.exe
  2⤵
  PID:8784
- C:\Windows\System\vAdULZB.exe
  C:\Windows\System\vAdULZB.exe
  2⤵
  PID:8800
- C:\Windows\System\DSCUaEK.exe
  C:\Windows\System\DSCUaEK.exe
  2⤵
  PID:8820
- C:\Windows\System\HUYpiul.exe
  C:\Windows\System\HUYpiul.exe
  2⤵
  PID:8836
- C:\Windows\System\rdGfpnP.exe
  C:\Windows\System\rdGfpnP.exe
  2⤵
  PID:8852
- C:\Windows\System\GRebrqc.exe
  C:\Windows\System\GRebrqc.exe
  2⤵
  PID:8868
- C:\Windows\System\NWjwAnH.exe
  C:\Windows\System\NWjwAnH.exe
  2⤵
  PID:8884
- C:\Windows\System\LGIkjIg.exe
  C:\Windows\System\LGIkjIg.exe
  2⤵
  PID:8900
- C:\Windows\System\gxkppfc.exe
  C:\Windows\System\gxkppfc.exe
  2⤵
  PID:8944
- C:\Windows\System\FoYgitY.exe
  C:\Windows\System\FoYgitY.exe
  2⤵
  PID:8960
- C:\Windows\System\mMymfys.exe
  C:\Windows\System\mMymfys.exe
  2⤵
  PID:8976
- C:\Windows\System\OxaZWnz.exe
  C:\Windows\System\OxaZWnz.exe
  2⤵
  PID:8992
- C:\Windows\System\YopWWRI.exe
  C:\Windows\System\YopWWRI.exe
  2⤵
  PID:9008
- C:\Windows\System\aHiGHaG.exe
  C:\Windows\System\aHiGHaG.exe
  2⤵
  PID:9028
- C:\Windows\System\OpSWLtM.exe
  C:\Windows\System\OpSWLtM.exe
  2⤵
  PID:9044
- C:\Windows\System\HxIpfUU.exe
  C:\Windows\System\HxIpfUU.exe
  2⤵
  PID:9092
- C:\Windows\System\DvnWiLR.exe
  C:\Windows\System\DvnWiLR.exe
  2⤵
  PID:9112
- C:\Windows\System\zYShNYN.exe
  C:\Windows\System\zYShNYN.exe
  2⤵
  PID:9128
- C:\Windows\System\HSfQjJU.exe
  C:\Windows\System\HSfQjJU.exe
  2⤵
  PID:9144
- C:\Windows\System\DdVuFGd.exe
  C:\Windows\System\DdVuFGd.exe
  2⤵
  PID:9160
- C:\Windows\System\pBpgGQZ.exe
  C:\Windows\System\pBpgGQZ.exe
  2⤵
  PID:9176
- C:\Windows\System\DRxGMMp.exe
  C:\Windows\System\DRxGMMp.exe
  2⤵
  PID:9192
- C:\Windows\System\aiVLKqr.exe
  C:\Windows\System\aiVLKqr.exe
  2⤵
  PID:9208
- C:\Windows\System\qhaWqUU.exe
  C:\Windows\System\qhaWqUU.exe
  2⤵
  PID:8220
- C:\Windows\System\AKYnIpv.exe
  C:\Windows\System\AKYnIpv.exe
  2⤵
  PID:8260
- C:\Windows\System\ZPWJuNm.exe
  C:\Windows\System\ZPWJuNm.exe
  2⤵
  PID:7620
- C:\Windows\System\AQNLIGo.exe
  C:\Windows\System\AQNLIGo.exe
  2⤵
  PID:8012
- C:\Windows\System\WlVstml.exe
  C:\Windows\System\WlVstml.exe
  2⤵
  PID:7520
- C:\Windows\System\egGwjZQ.exe
  C:\Windows\System\egGwjZQ.exe
  2⤵
  PID:7736
- C:\Windows\System\WlNXrpl.exe
  C:\Windows\System\WlNXrpl.exe
  2⤵
  PID:8380
- C:\Windows\System\LdFYYNh.exe
  C:\Windows\System\LdFYYNh.exe
  2⤵
  PID:8288
- C:\Windows\System\abXFxxH.exe
  C:\Windows\System\abXFxxH.exe
  2⤵
  PID:8272
- C:\Windows\System\BRvZHXg.exe
  C:\Windows\System\BRvZHXg.exe
  2⤵
  PID:8364
- C:\Windows\System\FyCVkfb.exe
  C:\Windows\System\FyCVkfb.exe
  2⤵
  PID:7280
- C:\Windows\System\GOXniYG.exe
  C:\Windows\System\GOXniYG.exe
  2⤵
  PID:8084
- C:\Windows\System\PdhgFsH.exe
  C:\Windows\System\PdhgFsH.exe
  2⤵
  PID:8240
- C:\Windows\System\eZollQd.exe
  C:\Windows\System\eZollQd.exe
  2⤵
  PID:8368
- C:\Windows\System\oYuiMoF.exe
  C:\Windows\System\oYuiMoF.exe
  2⤵
  PID:8408
- C:\Windows\System\tYjrvrA.exe
  C:\Windows\System\tYjrvrA.exe
  2⤵
  PID:8432
- C:\Windows\System\yvwjqib.exe
  C:\Windows\System\yvwjqib.exe
  2⤵
  PID:8424
- C:\Windows\System\kVNAkin.exe
  C:\Windows\System\kVNAkin.exe
  2⤵
  PID:8516
- C:\Windows\System\zJugmtL.exe
  C:\Windows\System\zJugmtL.exe
  2⤵
  PID:8436
- C:\Windows\System\ggpyvBE.exe
  C:\Windows\System\ggpyvBE.exe
  2⤵
  PID:8504
- C:\Windows\System\fdUZwGS.exe
  C:\Windows\System\fdUZwGS.exe
  2⤵
  PID:8564
- C:\Windows\System\WHfFxnZ.exe
  C:\Windows\System\WHfFxnZ.exe
  2⤵
  PID:8668
- C:\Windows\System\TAOTUPx.exe
  C:\Windows\System\TAOTUPx.exe
  2⤵
  PID:8540
- C:\Windows\System\zojZCpL.exe
  C:\Windows\System\zojZCpL.exe
  2⤵
  PID:8580
- C:\Windows\System\rANVbRJ.exe
  C:\Windows\System\rANVbRJ.exe
  2⤵
  PID:8648
- C:\Windows\System\RvuTpkb.exe
  C:\Windows\System\RvuTpkb.exe
  2⤵
  PID:8716
- C:\Windows\System\uLrMQtz.exe
  C:\Windows\System\uLrMQtz.exe
  2⤵
  PID:8780
- C:\Windows\System\UfMyPOX.exe
  C:\Windows\System\UfMyPOX.exe
  2⤵
  PID:8744
- C:\Windows\System\RzhtzBP.exe
  C:\Windows\System\RzhtzBP.exe
  2⤵
  PID:8832
- C:\Windows\System\lbOQhtu.exe
  C:\Windows\System\lbOQhtu.exe
  2⤵
  PID:8864
- C:\Windows\System\dXFvHjP.exe
  C:\Windows\System\dXFvHjP.exe
  2⤵
  PID:8812
- C:\Windows\System\xJIbrQb.exe
  C:\Windows\System\xJIbrQb.exe
  2⤵
  PID:8848
- C:\Windows\System\fjJllFK.exe
  C:\Windows\System\fjJllFK.exe
  2⤵
  PID:8912
- C:\Windows\System\QtsgdtR.exe
  C:\Windows\System\QtsgdtR.exe
  2⤵
  PID:8984
- C:\Windows\System\cnHpdxQ.exe
  C:\Windows\System\cnHpdxQ.exe
  2⤵
  PID:8972
- C:\Windows\System\wlkPQUD.exe
  C:\Windows\System\wlkPQUD.exe
  2⤵
  PID:9040
- C:\Windows\System\rdoFlfm.exe
  C:\Windows\System\rdoFlfm.exe
  2⤵
  PID:9016
- C:\Windows\System\nTVklsG.exe
  C:\Windows\System\nTVklsG.exe
  2⤵
  PID:9104
- C:\Windows\System\VGMxAbO.exe
  C:\Windows\System\VGMxAbO.exe
  2⤵
  PID:9168
- C:\Windows\System\ZoXoXCR.exe
  C:\Windows\System\ZoXoXCR.exe
  2⤵
  PID:8252
- C:\Windows\System\QzXzaDA.exe
  C:\Windows\System\QzXzaDA.exe
  2⤵
  PID:8280
- C:\Windows\System\oCGrJjx.exe
  C:\Windows\System\oCGrJjx.exe
  2⤵
  PID:7196
- C:\Windows\System\oGuRqRz.exe
  C:\Windows\System\oGuRqRz.exe
  2⤵
  PID:7568
- C:\Windows\System\dKCyWOv.exe
  C:\Windows\System\dKCyWOv.exe
  2⤵
  PID:8468
- C:\Windows\System\LoaYwru.exe
  C:\Windows\System\LoaYwru.exe
  2⤵
  PID:8068
- C:\Windows\System\lkQrheO.exe
  C:\Windows\System\lkQrheO.exe
  2⤵
  PID:8352
- C:\Windows\System\hxSbYbT.exe
  C:\Windows\System\hxSbYbT.exe
  2⤵
  PID:8304
- C:\Windows\System\vevHuSy.exe
  C:\Windows\System\vevHuSy.exe
  2⤵
  PID:8792
- C:\Windows\System\fDnPqzi.exe
  C:\Windows\System\fDnPqzi.exe
  2⤵
  PID:8548
- C:\Windows\System\GYRyNaW.exe
  C:\Windows\System\GYRyNaW.exe
  2⤵
  PID:8452
- C:\Windows\System\pEACCBb.exe
  C:\Windows\System\pEACCBb.exe
  2⤵
  PID:8652
- C:\Windows\System\RuyVCqZ.exe
  C:\Windows\System\RuyVCqZ.exe
  2⤵
  PID:9072
- C:\Windows\System\UbnYTar.exe
  C:\Windows\System\UbnYTar.exe
  2⤵
  PID:9088
- C:\Windows\System\kbsQaPc.exe
  C:\Windows\System\kbsQaPc.exe
  2⤵
  PID:9188
- C:\Windows\System\GPSyLxs.exe
  C:\Windows\System\GPSyLxs.exe
  2⤵
  PID:8320
- C:\Windows\System\VmsnDWl.exe
  C:\Windows\System\VmsnDWl.exe
  2⤵
  PID:8828
- C:\Windows\System\NYMrizq.exe
  C:\Windows\System\NYMrizq.exe
  2⤵
  PID:8208
- C:\Windows\System\VyBhYMs.exe
  C:\Windows\System\VyBhYMs.exe
  2⤵
  PID:8936
- C:\Windows\System\cHgPnIF.exe
  C:\Windows\System\cHgPnIF.exe
  2⤵
  PID:9172
- C:\Windows\System\IVoRibO.exe
  C:\Windows\System\IVoRibO.exe
  2⤵
  PID:8816
- C:\Windows\System\Unowvjc.exe
  C:\Windows\System\Unowvjc.exe
  2⤵
  PID:8776
- C:\Windows\System\sQqlnKK.exe
  C:\Windows\System\sQqlnKK.exe
  2⤵
  PID:8188
- C:\Windows\System\wCcdkBv.exe
  C:\Windows\System\wCcdkBv.exe
  2⤵
  PID:8632
- C:\Windows\System\iiclarh.exe
  C:\Windows\System\iiclarh.exe
  2⤵
  PID:7288
- C:\Windows\System\gcReMrt.exe
  C:\Windows\System\gcReMrt.exe
  2⤵
  PID:8844
- C:\Windows\System\sNhHHzt.exe
  C:\Windows\System\sNhHHzt.exe
  2⤵
  PID:7500
- C:\Windows\System\MvHsGHx.exe
  C:\Windows\System\MvHsGHx.exe
  2⤵
  PID:9220
- C:\Windows\System\ZDZgtmY.exe
  C:\Windows\System\ZDZgtmY.exe
  2⤵
  PID:9236
- C:\Windows\System\eCEXMvA.exe
  C:\Windows\System\eCEXMvA.exe
  2⤵
  PID:9252
- C:\Windows\System\IVpreoA.exe
  C:\Windows\System\IVpreoA.exe
  2⤵
  PID:9268
- C:\Windows\System\blMsNDe.exe
  C:\Windows\System\blMsNDe.exe
  2⤵
  PID:9284
- C:\Windows\System\bYhkOvN.exe
  C:\Windows\System\bYhkOvN.exe
  2⤵
  PID:9300
- C:\Windows\System\XhoJzMK.exe
  C:\Windows\System\XhoJzMK.exe
  2⤵
  PID:9316
- C:\Windows\System\LgOMpbg.exe
  C:\Windows\System\LgOMpbg.exe
  2⤵
  PID:9332
- C:\Windows\System\zITzBMW.exe
  C:\Windows\System\zITzBMW.exe
  2⤵
  PID:9348
- C:\Windows\System\kabtWaa.exe
  C:\Windows\System\kabtWaa.exe
  2⤵
  PID:9364
- C:\Windows\System\DckCDYW.exe
  C:\Windows\System\DckCDYW.exe
  2⤵
  PID:9380
- C:\Windows\System\QKZtubM.exe
  C:\Windows\System\QKZtubM.exe
  2⤵
  PID:9396
- C:\Windows\System\NEfIIPF.exe
  C:\Windows\System\NEfIIPF.exe
  2⤵
  PID:9412
- C:\Windows\System\UFXPbsw.exe
  C:\Windows\System\UFXPbsw.exe
  2⤵
  PID:9428
- C:\Windows\System\YZYrJnv.exe
  C:\Windows\System\YZYrJnv.exe
  2⤵
  PID:9444
- C:\Windows\System\RVsfoxc.exe
  C:\Windows\System\RVsfoxc.exe
  2⤵
  PID:9460
- C:\Windows\System\TUIdWAw.exe
  C:\Windows\System\TUIdWAw.exe
  2⤵
  PID:9488
- C:\Windows\System\OzOXwQO.exe
  C:\Windows\System\OzOXwQO.exe
  2⤵
  PID:9504
- C:\Windows\System\KHkVsXP.exe
  C:\Windows\System\KHkVsXP.exe
  2⤵
  PID:9520
- C:\Windows\System\wfbMBHS.exe
  C:\Windows\System\wfbMBHS.exe
  2⤵
  PID:9536
- C:\Windows\System\cHdPiiD.exe
  C:\Windows\System\cHdPiiD.exe
  2⤵
  PID:9572
- C:\Windows\System\uAHVLxv.exe
  C:\Windows\System\uAHVLxv.exe
  2⤵
  PID:9612
- C:\Windows\System\tyruEEf.exe
  C:\Windows\System\tyruEEf.exe
  2⤵
  PID:9628
- C:\Windows\System\QhbuiCu.exe
  C:\Windows\System\QhbuiCu.exe
  2⤵
  PID:9644
- C:\Windows\System\AyZDuRQ.exe
  C:\Windows\System\AyZDuRQ.exe
  2⤵
  PID:9660
- C:\Windows\System\CYEqPBs.exe
  C:\Windows\System\CYEqPBs.exe
  2⤵
  PID:9704
- C:\Windows\System\hrblyhF.exe
  C:\Windows\System\hrblyhF.exe
  2⤵
  PID:9720
- C:\Windows\System\BBaZQka.exe
  C:\Windows\System\BBaZQka.exe
  2⤵
  PID:9736
- C:\Windows\System\kldruHv.exe
  C:\Windows\System\kldruHv.exe
  2⤵
  PID:9752
- C:\Windows\System\jFnOZKS.exe
  C:\Windows\System\jFnOZKS.exe
  2⤵
  PID:9792
- C:\Windows\System\XjRraSB.exe
  C:\Windows\System\XjRraSB.exe
  2⤵
  PID:9808
- C:\Windows\System\UKfQxqi.exe
  C:\Windows\System\UKfQxqi.exe
  2⤵
  PID:9824
- C:\Windows\System\WayWpbZ.exe
  C:\Windows\System\WayWpbZ.exe
  2⤵
  PID:9840
- C:\Windows\System\YicSYXp.exe
  C:\Windows\System\YicSYXp.exe
  2⤵
  PID:9856
- C:\Windows\System\QqgITBX.exe
  C:\Windows\System\QqgITBX.exe
  2⤵
  PID:9872
- C:\Windows\System\EtFlfAP.exe
  C:\Windows\System\EtFlfAP.exe
  2⤵
  PID:9892
- C:\Windows\System\iFVScdk.exe
  C:\Windows\System\iFVScdk.exe
  2⤵
  PID:9908
- C:\Windows\System\VKVOZPf.exe
  C:\Windows\System\VKVOZPf.exe
  2⤵
  PID:9924
- C:\Windows\System\xMOayXf.exe
  C:\Windows\System\xMOayXf.exe
  2⤵
  PID:9940
- C:\Windows\System\aNEoOEO.exe
  C:\Windows\System\aNEoOEO.exe
  2⤵
  PID:9956
- C:\Windows\System\skuvKLT.exe
  C:\Windows\System\skuvKLT.exe
  2⤵
  PID:9972
- C:\Windows\System\IVcLHon.exe
  C:\Windows\System\IVcLHon.exe
  2⤵
  PID:9988
- C:\Windows\System\KEzAOFk.exe
  C:\Windows\System\KEzAOFk.exe
  2⤵
  PID:10004
- C:\Windows\System\HIUDbyX.exe
  C:\Windows\System\HIUDbyX.exe
  2⤵
  PID:10020
- C:\Windows\System\tGUXUdx.exe
  C:\Windows\System\tGUXUdx.exe
  2⤵
  PID:10036
- C:\Windows\System\kXjXUUv.exe
  C:\Windows\System\kXjXUUv.exe
  2⤵
  PID:10052
- C:\Windows\System\nvEAwer.exe
  C:\Windows\System\nvEAwer.exe
  2⤵
  PID:10068
- C:\Windows\System\OiSXeQa.exe
  C:\Windows\System\OiSXeQa.exe
  2⤵
  PID:10084
- C:\Windows\System\kVpNvvv.exe
  C:\Windows\System\kVpNvvv.exe
  2⤵
  PID:10100
- C:\Windows\System\ZufcHPp.exe
  C:\Windows\System\ZufcHPp.exe
  2⤵
  PID:10116
- C:\Windows\System\NJfwSAl.exe
  C:\Windows\System\NJfwSAl.exe
  2⤵
  PID:10132
- C:\Windows\System\VMNptev.exe
  C:\Windows\System\VMNptev.exe
  2⤵
  PID:10148
- C:\Windows\System\jgzSrDy.exe
  C:\Windows\System\jgzSrDy.exe
  2⤵
  PID:10164
- C:\Windows\System\fohOlus.exe
  C:\Windows\System\fohOlus.exe
  2⤵
  PID:10180
- C:\Windows\System\bSKfUao.exe
  C:\Windows\System\bSKfUao.exe
  2⤵
  PID:10196
- C:\Windows\System\xtiorLB.exe
  C:\Windows\System\xtiorLB.exe
  2⤵
  PID:10212
- C:\Windows\System\TSqLvGv.exe
  C:\Windows\System\TSqLvGv.exe
  2⤵
  PID:10228
- C:\Windows\System\HuzdIST.exe
  C:\Windows\System\HuzdIST.exe
  2⤵
  PID:8480
- C:\Windows\System\TiAWTSB.exe
  C:\Windows\System\TiAWTSB.exe
  2⤵
  PID:8952
- C:\Windows\System\LRVWgJX.exe
  C:\Windows\System\LRVWgJX.exe
  2⤵
  PID:8704
- C:\Windows\System\GpZiOjt.exe
  C:\Windows\System\GpZiOjt.exe
  2⤵
  PID:8928
- C:\Windows\System\UVzkSuu.exe
  C:\Windows\System\UVzkSuu.exe
  2⤵
  PID:9056
- C:\Windows\System\KspyYKO.exe
  C:\Windows\System\KspyYKO.exe
  2⤵
  PID:8332
- C:\Windows\System\zcyxSAp.exe
  C:\Windows\System\zcyxSAp.exe
  2⤵
  PID:8336
- C:\Windows\System\xsfPekp.exe
  C:\Windows\System\xsfPekp.exe
  2⤵
  PID:8388
- C:\Windows\System\jJxhNjQ.exe
  C:\Windows\System\jJxhNjQ.exe
  2⤵
  PID:9668
- C:\Windows\System\pHrqpWF.exe
  C:\Windows\System\pHrqpWF.exe
  2⤵
  PID:9472
- C:\Windows\System\zcxOcuX.exe
  C:\Windows\System\zcxOcuX.exe
  2⤵
  PID:9732
- C:\Windows\System\KAkxuQT.exe
  C:\Windows\System\KAkxuQT.exe
  2⤵
  PID:9548
- C:\Windows\System\CAhNNnL.exe
  C:\Windows\System\CAhNNnL.exe
  2⤵
  PID:9568
- C:\Windows\System\kihgBEZ.exe
  C:\Windows\System\kihgBEZ.exe
  2⤵
  PID:9496
- C:\Windows\System\CgEZwGW.exe
  C:\Windows\System\CgEZwGW.exe
  2⤵
  PID:9596
- C:\Windows\System\cioqTnf.exe
  C:\Windows\System\cioqTnf.exe
  2⤵
  PID:9688
- C:\Windows\System\cXoixHC.exe
  C:\Windows\System\cXoixHC.exe
  2⤵
  PID:9816
- C:\Windows\System\RigYtCE.exe
  C:\Windows\System\RigYtCE.exe
  2⤵
  PID:9780
- C:\Windows\System\OGIYePZ.exe
  C:\Windows\System\OGIYePZ.exe
  2⤵
  PID:9952
- C:\Windows\System\TXBVnrV.exe
  C:\Windows\System\TXBVnrV.exe
  2⤵
  PID:9932
- C:\Windows\System\HpbLbGa.exe
  C:\Windows\System\HpbLbGa.exe
  2⤵
  PID:10140
- C:\Windows\System\TROCike.exe
  C:\Windows\System\TROCike.exe
  2⤵
  PID:9996
- C:\Windows\System\hLyHxaP.exe
  C:\Windows\System\hLyHxaP.exe
  2⤵
  PID:10204
- C:\Windows\System\QLuXLVf.exe
  C:\Windows\System\QLuXLVf.exe
  2⤵
  PID:10224
- C:\Windows\System\QcksBCg.exe
  C:\Windows\System\QcksBCg.exe
  2⤵
  PID:10188
- C:\Windows\System\IWshliF.exe
  C:\Windows\System\IWshliF.exe
  2⤵
  PID:8740
- C:\Windows\System\vWtiTfL.exe
  C:\Windows\System\vWtiTfL.exe
  2⤵
  PID:10124
- C:\Windows\System\NIZXGpx.exe
  C:\Windows\System\NIZXGpx.exe
  2⤵
  PID:9124
- C:\Windows\System\rvGmNUt.exe
  C:\Windows\System\rvGmNUt.exe
  2⤵
  PID:8560
- C:\Windows\System\nXbqHrd.exe
  C:\Windows\System\nXbqHrd.exe
  2⤵
  PID:8988
- C:\Windows\System\RYJDnOM.exe
  C:\Windows\System\RYJDnOM.exe
  2⤵
  PID:9152
- C:\Windows\System\lxWTgge.exe
  C:\Windows\System\lxWTgge.exe
  2⤵
  PID:9672
- C:\Windows\System\NdtiCHt.exe
  C:\Windows\System\NdtiCHt.exe
  2⤵
  PID:9544
- C:\Windows\System\fDUiVwV.exe
  C:\Windows\System\fDUiVwV.exe
  2⤵
  PID:9456
- C:\Windows\System\oOnFufT.exe
  C:\Windows\System\oOnFufT.exe
  2⤵
  PID:9408
- C:\Windows\System\IubSEaT.exe
  C:\Windows\System\IubSEaT.exe
  2⤵
  PID:9584
- C:\Windows\System\zMJxgyA.exe
  C:\Windows\System\zMJxgyA.exe
  2⤵
  PID:9784
- C:\Windows\System\wNCLuXs.exe
  C:\Windows\System\wNCLuXs.exe
  2⤵
  PID:9360
- C:\Windows\System\WfJUVWB.exe
  C:\Windows\System\WfJUVWB.exe
  2⤵
  PID:9452
- C:\Windows\System\KxIMBfU.exe
  C:\Windows\System\KxIMBfU.exe
  2⤵
  PID:9516
- C:\Windows\System\YUSAvha.exe
  C:\Windows\System\YUSAvha.exe
  2⤵
  PID:9640
- C:\Windows\System\kkuUmVo.exe
  C:\Windows\System\kkuUmVo.exe
  2⤵
  PID:9528
- C:\Windows\System\VRKtEIs.exe
  C:\Windows\System\VRKtEIs.exe
  2⤵
  PID:9764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BSmOjkb.exe

Filesize
2.1MB

MD5
fe4ace29c249dc412414d7000b7371fe

SHA1
73c1253feb12688c3c064cf7c1faa4c66ca6b223

SHA256
6ccc97689cb3d9b25e4f78da9ba688e8dbef4b1ec7b0e090a99c73d2a1d0837e

SHA512
d98bd64e143ad1c71518d3d5ebe075505ebdc4693504e8650566fbbd0979b5829f49f8107266e61420d916be949118cc8e532ace02644e0b152fe215a0c66067

Download Submit
C:\Windows\system\DbaKirq.exe

Filesize
2.1MB

MD5
6f6af30a265794c36b88424c9e87296b

SHA1
adaac54d6f1fdd1f4265a96d6fa0e55f6a504c92

SHA256
b0cf9907c9a6043012e0443aefd2c84311edb29da5e04e066f82eb0f91df5a0f

SHA512
68892e8fb737dbc16bc99ac768af0ad987f560a485e4a6023a9dc09a0f3cc64c141dbafef3c245df4b02d6b4952b4fc9dd6883ffab97628ea02314f8548c1004

Download Submit
C:\Windows\system\EEzftFL.exe

Filesize
2.1MB

MD5
ce25246e883724bbad6e8d55e08798ea

SHA1
6c7858e57cf86495bdb18265b6dcbe5aa6c584dd

SHA256
37f8751377cfb0e9c1615e6762d0d08b1c55b80b77e7bb22239414effaf3ab0b

SHA512
1fb50ee183d1fd3fc06854037262e925e0a26056e3e82f9531ff4b8c95b871c121b360f978892cca80080af019d34c664be3a4e09f8f87499250878fb67ca845

Download Submit
C:\Windows\system\FEVQrJJ.exe

Filesize
2.1MB

MD5
cdc223317934a234bdae163ee721cce9

SHA1
e656dc9af8bebb39db6a0a11ef580cba13e530d5

SHA256
0fe149d730e4b145c9b1b82a34e54d14647c338400699c74367f464d9e89171e

SHA512
a7a886822b1d7f665a97d5e9b38039261b81aab470eb741d981816c5559ee198432b10c768292caa058cd4f3a659683808da4e34db7fa283f4919ef1b1dd16ba

Download Submit
C:\Windows\system\GcrgcMB.exe

Filesize
2.1MB

MD5
2ea39de5f413a0de6fe2c8fe17fb3904

SHA1
c8f3adafaafad0764a19077a0bc31e356f5c58ff

SHA256
6c889d80bee6ef0ab5a73bb2ff267830fa96bfe2b68d6fc6705a583fd241eac7

SHA512
e0f0952f51699f27c52ba9fbd41e09ac5e882de30a58cd256b4fa897476a93580842d77076e3f6674fd0b3f2530355f5318c237067174d3fcf38f48d2ff9c533

Download Submit
C:\Windows\system\PHtkMmS.exe

Filesize
2.1MB

MD5
e974bedeee7bb55a26fb97d7f4f853de

SHA1
7ac04df372ce4108e3ac2cf3bbacaa28aa2a92d0

SHA256
70ae4d285928772198f6e3880294714157e92fb065e7a81e1afbc20e6fe96349

SHA512
1dd863c56cd7546d10d26877fae83dbc79d3b40dddbbebd46194d6ae692b3e188f720b99cff26523d5c599b5e041f592f8ddec331a735d38bb233a7dfddc039c

Download Submit
C:\Windows\system\QYzaxsz.exe

Filesize
2.1MB

MD5
48a3d38a43efc7f0b5d71a0a42893db2

SHA1
65db462c768683242459bd3b857b06a40ae949e0

SHA256
10a7101985b4678a1f9f9b5c3885ce20c7bac365c3ca7c57b85fc919db2d608d

SHA512
1610a2a57657f7328024c29dad4b3281d417e2c94ceed182d392a2cb463f645bf5dc20b3adfca1d0bb8506f02dff7a70229a8c513bb0eaeaa2fa80a928dd4940

Download Submit
C:\Windows\system\TNyQmjk.exe

Filesize
2.1MB

MD5
272a3ede5425670b2f10e6e95e2f8ab0

SHA1
dd07eaa3635f340b78e4288bb0ab75337902c27e

SHA256
81a5df17c144a163e451dd3d04be173f0cd7a1ba81b9e2d2e403e36b64e8e27e

SHA512
d9d69ac0898d4687ee3c1c4b6de4f9862154d29a70bd21cd7d531cf0782d3158b37730384a571713caa23738db469d3c2a57d02922b88df5dd5cd3dbfed01f19

Download Submit
C:\Windows\system\blbrhrn.exe

Filesize
2.1MB

MD5
a1943f0bafcc89ba9d5b12dd359f32ff

SHA1
119abbbb10999059f47482b4b0c8e44106ec8889

SHA256
ed874ef6c029ce1824d7852d6e584ccc2ffa66518477e98d6579d027dc167927

SHA512
6e18715794db8a8d09219439790919cd33476e15621285e258f68a1563495882a68f269b2f256fafc436648bae513c959f3c342d5b4ab255f76d8f149bef646c

Download Submit
C:\Windows\system\dhipmmu.exe

Filesize
2.1MB

MD5
c7164c8103c705081e8cb595304666e3

SHA1
c0e00344a61d1dc382514aafcc01433dfd417cb2

SHA256
52a7cffc3c0e0f8d2d4bb5450f227d25a24ad7339e4fecaa0625cadabfaceaf5

SHA512
e2bc93fe959ab60d1b238e5bfd5aabdb4ef6e2f2ccd8ae6251c4b345f8cbb2eb6eeaf26fc033e21f2ee6d535c9a26b871b6838257a83f23fba61255a55c6a5d1

Download Submit
C:\Windows\system\drelZyy.exe

Filesize
2.1MB

MD5
b702fb824597074f1b63b9b5be8226ef

SHA1
ffdbbd86a6471f3c04eda14985e59d041ec3e3c1

SHA256
903e1cbc6e5df737cc3589744c1661a13a9ae5d02106e0a624641ebfb3f85654

SHA512
32939412c31923c66b673ebd8ba636c1e12711c1ecdae8b336ee8e7a1c9c48517e2974466690026572353b78d05b177c87aebb2c58e3097c06359250f93f1b24

Download Submit
C:\Windows\system\eogOkCb.exe

Filesize
2.1MB

MD5
860efa075e4b96448883ff68cac68a83

SHA1
68dd3e586870507997b5195fe6f64ac48b15e3da

SHA256
9018327c7b58b265934a00645657f4cc3743e99ac2fe64fc3fde78da4bf3510b

SHA512
ea93c12440c926da0defcd05496f6262d1f43f2265454034cadc235f4a729a57ed1cf0184ef734cd05330e5b9c10569ac387da5c371a2938baa21434b3a0ae9b

Download Submit
C:\Windows\system\kbDeqeZ.exe

Filesize
2.1MB

MD5
809dff85394f43d3cec8937d48759a7d

SHA1
13a5658b4789186485c9402e072ddff1a01688f0

SHA256
0e495315201a63bc7f5b13c408295e85c807141d95cde76aa680a499468c03f0

SHA512
e19bbe5cf9fd8160a695b9dd9f7839d11e31e0aadc808bb2e8f5ca8038e234fde6a1fc46b183fcfafd1fd0a928d0c32d272eeaa63d575c8a6e12b0ec8387881a

Download Submit
C:\Windows\system\nqGDPDl.exe

Filesize
2.1MB

MD5
2154447e2653a7a8a036804192c94ebd

SHA1
5e7c5353077780e76af7f6fe8fecb5b469681e2d

SHA256
28b1bc1c200e149c0a0fb887679bc190232c40e4c0d254e6ee71e84c63c108e1

SHA512
bdc904cfb0391248a3a080a316d2ad49a579d46f377f5beb581b7f538625a10007939d680c9593cb4d061ad86bb004fc702c9c7bca30a4ab24072eded4dc6911

Download Submit
C:\Windows\system\oFCwRsp.exe

Filesize
2.1MB

MD5
a9f3d16c4b4f71c47ca2d060d7ae6c61

SHA1
269331a649b7d7a44e711ffdf07a7d0b1c4b4684

SHA256
0ecb87833cabcf74a7caac758432f486a09ccbee29d0dd2c321d650358bb0d09

SHA512
19d5f997c18c4cff7a6ccbd641b859f38d708e1302021689fefc5b23a5e940148427413ac0f54b27de1365e891b4b5739744b6be9f1645ea3e7b8e66d055cee5

Download Submit
C:\Windows\system\pkfYaEK.exe

Filesize
2.1MB

MD5
68b140eb11b1af6bb128480dac079699

SHA1
2989faa5276381aeac06513264e2e4fdef4c3609

SHA256
0d9e51704321e813ef03fbe4bda6f512b5418eb6217f182c79f05a0cf55e6a87

SHA512
4c3f160389ea6b81437638d427cfe8d7266e2d3cc6789e16404bd9ceb0599b82dbeef18472acbd972d8f057f306ecb196424db2ef3c9eaa0b8e50ad77a4caf24

Download Submit
C:\Windows\system\tLNElGj.exe

Filesize
2.1MB

MD5
1549ee403c23de823dcec77c29a162b9

SHA1
dc69a1116bae91895bf9fcd1a92d4fa814f639a6

SHA256
ff59399343b5bdd40fa80ef4e9426d9646e2f8a9d68cb0b6fafa99a58156476b

SHA512
41f84d22a1a271da57ce2616fd00071c9e567b07c5a49784c4e7adc234846337bea0c8453b3a180fadacd7adda5dc8073c63bfd61ded764bd2704a0c6b4391b7

Download Submit
C:\Windows\system\xAojgfQ.exe

Filesize
2.1MB

MD5
dc493a5cbd8368332dc1908d1c85a600

SHA1
24adafcb8dd6481ce4cfbeaa991b08024e55e132

SHA256
7b59c316a368f36cc568e5c757fbe0429d037e1e285d8a1d1912b6d32709b7c3

SHA512
e6e44dd898238c4c57a010ba5df7800b74ae9cdba265a8764fde6765c93beb87816349bee9b513cddff65afb3dc9bdc97b7218a4b4accaab3238337c04af97b8

Download Submit
C:\Windows\system\yCkVlci.exe

Filesize
2.1MB

MD5
9e270b3d0c9e58395eb47be08084eb29

SHA1
8fa683c3be5f43f2c6ccb8da1c8b864ff2602f62

SHA256
02fdccc647ee97e80eabb1cb624ccda9b3e6c0dccaa6323de57dbaea1412bc05

SHA512
5aa2826c5998fddb7976dc9aa790fc49d2948f8dbbe02f4f58444dde5ad51ff3412a91225e177165886b12c1d8184bfc104d6435bc8f3670d39c4eb9d7ebe756

Download Submit
\Windows\system\HtcYHum.exe

Filesize
2.1MB

MD5
c8f70c2d56adf97fe135b96d94b722a3

SHA1
fad3b0e35f7183e67e11d062d73890bc569e7eaf

SHA256
bdf2ed2bb50ba12c81d9dd6b92ff28c70925238edcbb81c36839be70dbc4cd24

SHA512
808c79192d5c5b7f295643fafb4c3e292269c40f4d1ec384a8e0979ea25f6badc1713faeab6e7b0d468cca45c92646eddd64abdea7f66f57479197b19d99c454

Download Submit
\Windows\system\IHuegJn.exe

Filesize
2.1MB

MD5
8e07bea36edc69b06c6665a5c734080c

SHA1
78e784555e8b0d799dc0ce0bc60d597f08fb997a

SHA256
09e088e2851244fcb2d1d5e2bd36f2060fa9ab3e352317cbc5f1085a5137100f

SHA512
66586530de98d2c3a11c27d6ed39f20822fc55123d2b5af8f0e50e41e8e1108e39afe13bd9ca6c8e5e7210dc02e7164af48c24b047fabf85fe2b0a2d2963e76c

Download Submit
\Windows\system\ILiHalD.exe

Filesize
2.1MB

MD5
edc263823c7c813e067af125325daf1a

SHA1
99f7396babbe68d1872545c2419ff2f5cc7b0b59

SHA256
5f75858c213d8ece8bb39bf5c624f9898fa681949175e1eaa3b327f2c92fdd3b

SHA512
7a1752cfd970df589f2b154427c0352c8c2b5e0971a9c87f08165d2a2bc4018572ed486e77451085a05f74ece6f7601eb34fe4b07af570ec731e055060a7e782

Download Submit
\Windows\system\IiLBNPT.exe

Filesize
2.1MB

MD5
d17e25133c0ab997e2def8621626014e

SHA1
0bcbad21acd8c4ec1fa531ae9e40f6e2b3cd2990

SHA256
03c2a315c08425769d1cabc2d282b8b7234f4fc826b03deeb239b4927950cfbb

SHA512
b6b5673fc6478438c08986f6683da7fb2f8e7b94eb1d9dca6a2a35fb1aaddae9fa595f2b6d32fcdb71dd4c303e47111ed6aa5f6e00489b9d0967ff4aaf97ef9a

Download Submit
\Windows\system\JZKjtAf.exe

Filesize
2.1MB

MD5
1551c1c9fd6eff3663a9c1683abbab5c

SHA1
5329e70a6266cf0cc79c25e5a2c4222fb45b5d7d

SHA256
2ea98c1ee8f60c4306fd3f835f9465a687306486c34d63d29848c4fffcd780cb

SHA512
f31371625ae8815dfc5714e53fe5dae8d3740c46ba1411c1b5ad17b2545ca33eab849e520d5327d0c3c13856c8348d27b3d282e35ad6e6198520e2fa30101478

Download Submit
\Windows\system\KnrgVxc.exe

Filesize
2.1MB

MD5
4210d91006f65413d1df7e53d6684a9f

SHA1
ef104f8ea3e4c972cb766fa4007f9deb28ecdacd

SHA256
033466be1ecdf511950d1db8232e876ffb618a56ec5ba883a063c8c69172afd2

SHA512
d03e0362f144c5cc2e1d85b07c7cca55bb7602be3c126a4bddf1f199699f39e5b3f4604c47a2b4b826e1a768b3c8c6b1208de937371af83eea1bb8ec5c78e65b

Download Submit
\Windows\system\MyABMJb.exe

Filesize
2.1MB

MD5
4907d67e17afa0479a1372fc62f2a7d5

SHA1
c2d84c9b6d239e9f650591d6a3767d346f2b86ea

SHA256
59d8a777568d1c362f82c9ed4dd4ead0f64f58e22209a8a8914f0ba1a8ab3d11

SHA512
3689eb2a393cf9611065021ece38fe25fcdf624237897675d23eb606c8908e860d08811ab441059fcce140dd1f63163eadd79d12d4490725b4bd0054195770cb

Download Submit
\Windows\system\OaXtAcH.exe

Filesize
2.1MB

MD5
255f0bb700bf872f608885b61ddb824a

SHA1
7ccb78c60c6847f6b43ebfeda38ee5a841ce05d3

SHA256
8a8eac0ad2cd76177e11869e46bd190dd2027114a3582a0b420bbe26a03add84

SHA512
f2d0cbb3017f511f7f71ab967f7263f20d5512e6a89906ad338e6eb276f98147e3fc1083a1ba52fbac7a63487d518180a517ec71b140df00b61823df26ba0826

Download Submit
\Windows\system\OeLzSzn.exe

Filesize
2.1MB

MD5
1329b490eb13791bd5d45980df6d88b6

SHA1
ffe00e95ee6e28a78e7a9aef84d84e7a55bf2b58

SHA256
dcb0f09ca3cfae5fb24eb94d46153b80f843cd788c0fdb078e63543467946966

SHA512
a6cc305a7e716cfd09fcb965a414a65447ae0c3f01bbba5219e429a39fa04cff5b50438c199cbbaf783ca7b2fc850033eb69ec585a402e6f693a95ba562ddbfe

Download Submit
\Windows\system\YGYzePN.exe

Filesize
2.1MB

MD5
bc974f52299d0a3aca12afacf0d97de8

SHA1
077ea64f674ac76861484eec3307a81225dc8b1a

SHA256
480b134cc9da318c215763680f8e50c7315ca01b51b9f0f0406c6f84b4f31849

SHA512
06d98a0d2d0f9d17886f3f787dc27dca0fa7cf2e580d2e45d58836b09b3c33b1cc660b10f4e644d29c3ff186e7d707661afdbd8431a352c001adec50f938584d

Download Submit
\Windows\system\ZBnJaVP.exe

Filesize
2.1MB

MD5
783502dd66180e6e2c76227e8a5aff22

SHA1
10d88cf1c85e76b9fcceceea4f50925b5d576f14

SHA256
83f3c1266710bc7bed2b692e935c03cc2e6a6ad6e5f895cc24676b3b19bcfba3

SHA512
7b93014790431c9d5d0c24cef2af43fc1cf8f0651e41c6bd2e0063cf20ee0682b926be8a1084d9666cbdd4628044b41d7bde3ed8c4fd7b4ff024d06062fb22c1

Download Submit
\Windows\system\aZnTxqT.exe

Filesize
2.1MB

MD5
1ab4dae33d7bde3f0a4c04f0519a2f11

SHA1
282984b1b463caf10bb301dfd85ae854c78d7720

SHA256
c396683538d1e777a85cd2acfe393543517dc4d10d7f92b6293a355af89ae96b

SHA512
41ed1e22bbe9c13af3050134c271a0b6e597a51108bff8ac1e4544b3390021a4d8a104372db21f698c97e93337b17f850bda56d3746f16476346fbc281e182c5

Download Submit
\Windows\system\bHEudyn.exe

Filesize
2.1MB

MD5
9ecd0f285467432b972f277426e0b2fe

SHA1
58d816e3f9a0b7d6c6c2d83eef7faaf41488abad

SHA256
0d60e23bd8319a9fd5541f47115bfda50c5afb882c5682a07a0724b4efcc7607

SHA512
2557fdd329b7cd605198a41c7204ab46f3af9fa6b98320cbdf7b28210e48dbc5e6771ce8d3b39689ebce43105d07a7a0922f5dbad8232529bc49c5470db6d52d

Download Submit
\Windows\system\jXcGZpf.exe

Filesize
2.1MB

MD5
899289d085b95dfa486cd7298c9281d5

SHA1
0db0fa03b38be0108199c57a302b136f6f58b8b5

SHA256
60ea3ef6645ca4dc7fcad968b0b332efea0ad7c80ddd1980607181963c41ea6d

SHA512
bc26eccebff020ea3b1131e48361724f44dfea2f982aafc469dd1ed2705aa2e27111ae25741e08565e9c8c6cffd40b161ebefc3ff2db8683e55411963d483d40

Download Submit
\Windows\system\kVStJfj.exe

Filesize
2.1MB

MD5
26562436f158fba430ef3f6323b30eee

SHA1
a2d450127c100e9aa1c2b55a50c62b368bac83ec

SHA256
e79735b13c3904eb836797232270bfa7f3ed423f3562d6146713dbd67b9458bb

SHA512
a32b136dba3b3d349f093190ce9cd2d29d8659e3a9d2c082bc79d374ef69e127ae9ac6fb756c9a907c863fa90b3a0e46776087526dcc893f172f34a237fbed0a

Download Submit
\Windows\system\mrjZhbL.exe

Filesize
2.1MB

MD5
4fc03d875d3cc27985cc3c4652c106ea

SHA1
c8f006053667ec0c2cf49708b49ca61ea942e44c

SHA256
418766c38ce5ab1cdf383358397bc2f9e9d6bf506145b85849560f2802a00b58

SHA512
b0379976c505c2fb8b86ce30005f373c7b0e902ad1017ca236bbfa9fa137f620a33933a2234d0c2989c456a91dbfb4dfb8204f95f82f0de6771c12a2472a641d

Download Submit
\Windows\system\ohOfyVR.exe

Filesize
2.1MB

MD5
993690682b14379b5b6581c5b255cc69

SHA1
02f33f8a53d70bd1d479de33ba3759882b99068f

SHA256
beb17343b82c9dba7107d3009ed028f7b13567f9fcb79158992c0245815a4bbe

SHA512
7e4c0b53dbfa3fd20d63eaff0595be843950d5cab8ca35a980dbab4c8a753cc7ede30f5a9327a3e10e3f19cef289f30e3c3d2e37cde093d8f236835fa0f6807b

Download Submit
\Windows\system\pBMZDlW.exe

Filesize
2.1MB

MD5
603ebe27d17a4dafacfa4f02bb07aa8e

SHA1
a090a6d97b964c8e2257a0e26968b072f7c3222b

SHA256
c353417b43573c4f6c64e81c94feedc496fdbfc4f7bcb7707587dad4d67430ef

SHA512
5e73d329958b81ce8f762726fde95bfe2633a7b2a65468d5ed456187730e338e85b91f8981518dad096500afdac3901864d78c3e1f689b44510a60d8766b0d67

Download Submit
memory/592-3757-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/592-160-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2340-3257-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2340-151-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-149-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2468-3781-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2504-163-0x000007FEF5860000-0x000007FEF61FD000-memory.dmp

Filesize
9.6MB

Download
memory/2504-144-0x0000000002650000-0x00000000026D0000-memory.dmp

Filesize
512KB

Download
memory/2504-113-0x000000001B230000-0x000000001B512000-memory.dmp

Filesize
2.9MB

Download
memory/2504-21-0x0000000002650000-0x00000000026D0000-memory.dmp

Filesize
512KB

Download
memory/2504-142-0x000007FEF5860000-0x000007FEF61FD000-memory.dmp

Filesize
9.6MB

Download
memory/2504-831-0x000007FEF5860000-0x000007FEF61FD000-memory.dmp

Filesize
9.6MB

Download
memory/2504-118-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/2528-145-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-3875-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-9-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2560-3770-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2564-19-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-3256-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-0-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/2656-148-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2656-152-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2656-146-0x0000000002C90000-0x0000000003082000-memory.dmp

Filesize
3.9MB

Download
memory/2656-161-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2656-1-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2656-159-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2656-8-0x0000000002C90000-0x0000000003082000-memory.dmp

Filesize
3.9MB

Download
memory/2656-13-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-153-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-164-0x0000000002C90000-0x0000000003082000-memory.dmp

Filesize
3.9MB

Download
memory/2656-150-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-3258-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-147-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-2775-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-157-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-158-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-3934-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download