xmrig | a8bf14e05981fe410aa14f794a9f92d782c93ab6554c22947043a7e22bdaba6c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
Size

1.4MB
MD5

0ebd28e354ae8437d1959f67aa080958
SHA1

02f4ab00070f3ba84f4260a30d76bc0b508e7e2e
SHA256

a8bf14e05981fe410aa14f794a9f92d782c93ab6554c22947043a7e22bdaba6c
SHA512

11a901d6f69d9ce2eecaf59fb7ac59039aa9a43a37be5e4f857242e2e108fca5c9284303d0eff2c7d9680812b947e35bcf8599769ec240248ca124ec78684a92
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwmv:Lz071uv4BPMkibTIA5CJvv

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/3048-9-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2668-20-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/1116-111-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/556-109-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2844-107-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2836-104-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2472-100-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2392-98-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2196-94-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2484-91-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2128-83-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2576-82-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/3048-2254-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2128-2255-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2484-2256-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2196-2257-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2392-2258-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2836-2259-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/556-2260-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2576-2261-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/1116-2275-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2844-2274-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2668-2299-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2472-2262-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2164	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3048	tukRtnk.exe
2668	LFjNajU.exe
2576	RVryffT.exe
2128	bINpNmb.exe
2484	wNPvaZf.exe
2196	MJNgSGK.exe
2392	pHeyigO.exe
2472	uoKdduY.exe
2836	sAlwtDs.exe
2844	JAlDfSu.exe
556	FsqWzZp.exe
1116	RjjQPRA.exe
2316	WigJkaG.exe
1592	RROTIHB.exe
1976	lbeydbv.exe
948	liiPuSL.exe
2496	UQjwnhB.exe
2320	yKgojHu.exe
1504	PQqxptS.exe
1180	lwfKuLU.exe
1088	yPvQnKq.exe
1644	NQcmaYg.exe
1640	UnSKwzX.exe
2256	pYiLPly.exe
2436	wDNAFQf.exe
2280	NMkyfCR.exe
476	nWFoiks.exe
792	yaWjxSU.exe
1060	GHTkGQe.exe
2968	ohgQgLK.exe
2140	LXUNgOv.exe
3056	VNGuqDA.exe
1160	HNSBxJK.exe
1564	zVWAjbX.exe
2328	dFpdJPb.exe
1812	SYYEZQR.exe
1684	iDqKMwJ.exe
1352	pBDxfWq.exe
2136	GbfVSLZ.exe
1824	OyVpTwV.exe
320	CMyWZwG.exe
2952	WufcveJ.exe
1968	ozItBkQ.exe
896	vUMHCaC.exe
1344	zDZAOAO.exe
972	qEerzfS.exe
2808	QFzjrWZ.exe
1364	kHYZIXT.exe
2100	NRBloos.exe
2252	OOTnSho.exe
2492	inGXBnl.exe
2884	bkTeCIW.exe
1212	TZFaFaL.exe
1512	vUrrjzd.exe
2860	gvOHaLz.exe
2324	IGoOlzW.exe
2096	KCwvfRC.exe
2480	oaQCyFE.exe
1600	PANqYGs.exe
1872	YCaDWSk.exe
3004	dXsdlCp.exe
2916	XlLcZyF.exe
2628	jhtUupa.exe
2500	nQlDOqY.exe

Loads dropped DLL 64 IoCs

pid	Process
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1368-0-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x000b0000000155e2-6.dat	upx
behavioral1/memory/3048-9-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0024000000015c23-14.dat	upx
behavioral1/memory/2668-20-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-23.dat	upx
behavioral1/files/0x0008000000015c69-28.dat	upx
behavioral1/files/0x0014000000015c2f-32.dat	upx
behavioral1/files/0x0007000000015c7c-38.dat	upx
behavioral1/files/0x0007000000015c87-47.dat	upx
behavioral1/files/0x0009000000015d88-50.dat	upx
behavioral1/files/0x000500000001868c-56.dat	upx
behavioral1/files/0x00050000000186a0-64.dat	upx
behavioral1/files/0x0006000000018ae8-72.dat	upx
behavioral1/memory/1116-111-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/files/0x0006000000018b37-121.dat	upx
behavioral1/files/0x0006000000018b15-120.dat	upx
behavioral1/files/0x0006000000018b4a-118.dat	upx
behavioral1/memory/556-109-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2844-107-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2836-104-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-115.dat	upx
behavioral1/memory/2472-100-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2392-98-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2196-94-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2484-91-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x0006000000018b33-90.dat	upx
behavioral1/files/0x0006000000018b6a-127.dat	upx
behavioral1/files/0x0006000000018b73-132.dat	upx
behavioral1/files/0x0006000000018b96-140.dat	upx
behavioral1/files/0x0006000000018d06-151.dat	upx
behavioral1/files/0x000500000001931b-162.dat	upx
behavioral1/files/0x0005000000019333-169.dat	upx
behavioral1/files/0x0005000000019410-191.dat	upx
behavioral1/files/0x00050000000193b0-187.dat	upx
behavioral1/files/0x000500000001939b-183.dat	upx
behavioral1/files/0x0005000000019377-179.dat	upx
behavioral1/files/0x0005000000019368-175.dat	upx
behavioral1/files/0x00050000000192c9-156.dat	upx
behavioral1/files/0x00050000000192f4-161.dat	upx
behavioral1/files/0x0006000000018ba2-149.dat	upx
behavioral1/memory/2128-83-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2576-82-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x0006000000018ae2-68.dat	upx
behavioral1/files/0x0005000000018698-60.dat	upx
behavioral1/memory/3048-2254-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2128-2255-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2484-2256-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2196-2257-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2392-2258-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2836-2259-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/556-2260-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2576-2261-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/1116-2275-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2844-2274-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2668-2299-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2472-2262-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MJkCeec.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\PaMOhIb.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\HefZsem.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\PXIlcsd.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\LKfGeVq.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\ZQnxnQK.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\oTBLDiE.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\knzGpHl.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\LLljHOe.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\LyfhoVm.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\gnDGVoQ.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\mdhLYrE.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\bDPqyKV.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\hvcCKHn.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\XCkakgk.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\PVQEgUB.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\GkjTJrC.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\gqFaEAT.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\bpolvSp.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\ZtWbaxZ.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\kxOPAsj.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\vyRXWVg.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\XlWWcFd.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\BHLrtWa.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\NAOYEYG.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\ZfZVjsA.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\aCvmKis.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\BzbyolS.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\kStjPLT.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\CzlZNWQ.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\ZRnWgPD.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\llKlkmy.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\hpFwRpI.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\depcZzy.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\GYIgcGS.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\Wlvenoj.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\QQpszLJ.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\hTnmcnl.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\IsTNFta.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\iePUgKh.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\ptEZjDJ.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\CLvfOuV.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\PuuijRH.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\hsTNpEO.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\ofCKKjM.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\uPAOSyw.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\OhoYpKg.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\zFXtaEi.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\SBXwWuH.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\wpIstBs.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\KVgzTOO.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\QikUjdy.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\OAekhBY.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\SHiBNTF.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\qoqShrZ.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\MyWirdP.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\LFjNajU.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\pOdGAPY.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\cNWEruV.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\PPlVQzB.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\ESYtDYa.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\BMPXuZu.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\qXLwswy.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
File created	C:\Windows\System\zSMiGUz.exe	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2164	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
Token: SeDebugPrivilege	2164	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2164	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	29
PID 1368 wrote to memory of 2164	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	29
PID 1368 wrote to memory of 2164	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	29
PID 1368 wrote to memory of 3048	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	30
PID 1368 wrote to memory of 3048	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	30
PID 1368 wrote to memory of 3048	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	30
PID 1368 wrote to memory of 2668	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	31
PID 1368 wrote to memory of 2668	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	31
PID 1368 wrote to memory of 2668	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	31
PID 1368 wrote to memory of 2576	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2576	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2576	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	32
PID 1368 wrote to memory of 2128	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	33
PID 1368 wrote to memory of 2128	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	33
PID 1368 wrote to memory of 2128	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	33
PID 1368 wrote to memory of 2484	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	34
PID 1368 wrote to memory of 2484	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	34
PID 1368 wrote to memory of 2484	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	34
PID 1368 wrote to memory of 2196	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	35
PID 1368 wrote to memory of 2196	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	35
PID 1368 wrote to memory of 2196	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	35
PID 1368 wrote to memory of 2392	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	36
PID 1368 wrote to memory of 2392	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	36
PID 1368 wrote to memory of 2392	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	36
PID 1368 wrote to memory of 2472	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	37
PID 1368 wrote to memory of 2472	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	37
PID 1368 wrote to memory of 2472	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	37
PID 1368 wrote to memory of 2836	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	38
PID 1368 wrote to memory of 2836	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	38
PID 1368 wrote to memory of 2836	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	38
PID 1368 wrote to memory of 2844	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	39
PID 1368 wrote to memory of 2844	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	39
PID 1368 wrote to memory of 2844	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	39
PID 1368 wrote to memory of 556	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	40
PID 1368 wrote to memory of 556	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	40
PID 1368 wrote to memory of 556	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	40
PID 1368 wrote to memory of 1116	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	41
PID 1368 wrote to memory of 1116	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	41
PID 1368 wrote to memory of 1116	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	41
PID 1368 wrote to memory of 2316	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	42
PID 1368 wrote to memory of 2316	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	42
PID 1368 wrote to memory of 2316	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	42
PID 1368 wrote to memory of 948	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	43
PID 1368 wrote to memory of 948	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	43
PID 1368 wrote to memory of 948	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	43
PID 1368 wrote to memory of 1592	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	44
PID 1368 wrote to memory of 1592	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	44
PID 1368 wrote to memory of 1592	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	44
PID 1368 wrote to memory of 2496	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	45
PID 1368 wrote to memory of 2496	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	45
PID 1368 wrote to memory of 2496	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	45
PID 1368 wrote to memory of 1976	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	46
PID 1368 wrote to memory of 1976	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	46
PID 1368 wrote to memory of 1976	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	46
PID 1368 wrote to memory of 1504	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	47
PID 1368 wrote to memory of 1504	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	47
PID 1368 wrote to memory of 1504	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	47
PID 1368 wrote to memory of 2320	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	48
PID 1368 wrote to memory of 2320	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	48
PID 1368 wrote to memory of 2320	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	48
PID 1368 wrote to memory of 1180	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	49
PID 1368 wrote to memory of 1180	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	49
PID 1368 wrote to memory of 1180	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	49
PID 1368 wrote to memory of 1088	1368	0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ebd28e354ae8437d1959f67aa080958_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\System\tukRtnk.exe
  C:\Windows\System\tukRtnk.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\LFjNajU.exe
  C:\Windows\System\LFjNajU.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\RVryffT.exe
  C:\Windows\System\RVryffT.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\bINpNmb.exe
  C:\Windows\System\bINpNmb.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\wNPvaZf.exe
  C:\Windows\System\wNPvaZf.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\MJNgSGK.exe
  C:\Windows\System\MJNgSGK.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\pHeyigO.exe
  C:\Windows\System\pHeyigO.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\uoKdduY.exe
  C:\Windows\System\uoKdduY.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\sAlwtDs.exe
  C:\Windows\System\sAlwtDs.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\JAlDfSu.exe
  C:\Windows\System\JAlDfSu.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\FsqWzZp.exe
  C:\Windows\System\FsqWzZp.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\RjjQPRA.exe
  C:\Windows\System\RjjQPRA.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\WigJkaG.exe
  C:\Windows\System\WigJkaG.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\liiPuSL.exe
  C:\Windows\System\liiPuSL.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\RROTIHB.exe
  C:\Windows\System\RROTIHB.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\UQjwnhB.exe
  C:\Windows\System\UQjwnhB.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\lbeydbv.exe
  C:\Windows\System\lbeydbv.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\PQqxptS.exe
  C:\Windows\System\PQqxptS.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\yKgojHu.exe
  C:\Windows\System\yKgojHu.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\lwfKuLU.exe
  C:\Windows\System\lwfKuLU.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\yPvQnKq.exe
  C:\Windows\System\yPvQnKq.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\NQcmaYg.exe
  C:\Windows\System\NQcmaYg.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\UnSKwzX.exe
  C:\Windows\System\UnSKwzX.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\pYiLPly.exe
  C:\Windows\System\pYiLPly.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\wDNAFQf.exe
  C:\Windows\System\wDNAFQf.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\NMkyfCR.exe
  C:\Windows\System\NMkyfCR.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\nWFoiks.exe
  C:\Windows\System\nWFoiks.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\yaWjxSU.exe
  C:\Windows\System\yaWjxSU.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\GHTkGQe.exe
  C:\Windows\System\GHTkGQe.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\ohgQgLK.exe
  C:\Windows\System\ohgQgLK.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\LXUNgOv.exe
  C:\Windows\System\LXUNgOv.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\VNGuqDA.exe
  C:\Windows\System\VNGuqDA.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\HNSBxJK.exe
  C:\Windows\System\HNSBxJK.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\zVWAjbX.exe
  C:\Windows\System\zVWAjbX.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\dFpdJPb.exe
  C:\Windows\System\dFpdJPb.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\SYYEZQR.exe
  C:\Windows\System\SYYEZQR.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\iDqKMwJ.exe
  C:\Windows\System\iDqKMwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\pBDxfWq.exe
  C:\Windows\System\pBDxfWq.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\GbfVSLZ.exe
  C:\Windows\System\GbfVSLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\OyVpTwV.exe
  C:\Windows\System\OyVpTwV.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\CMyWZwG.exe
  C:\Windows\System\CMyWZwG.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\WufcveJ.exe
  C:\Windows\System\WufcveJ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\ozItBkQ.exe
  C:\Windows\System\ozItBkQ.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\vUMHCaC.exe
  C:\Windows\System\vUMHCaC.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\zDZAOAO.exe
  C:\Windows\System\zDZAOAO.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\qEerzfS.exe
  C:\Windows\System\qEerzfS.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\QFzjrWZ.exe
  C:\Windows\System\QFzjrWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\kHYZIXT.exe
  C:\Windows\System\kHYZIXT.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\NRBloos.exe
  C:\Windows\System\NRBloos.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\OOTnSho.exe
  C:\Windows\System\OOTnSho.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\inGXBnl.exe
  C:\Windows\System\inGXBnl.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\bkTeCIW.exe
  C:\Windows\System\bkTeCIW.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\TZFaFaL.exe
  C:\Windows\System\TZFaFaL.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\gvOHaLz.exe
  C:\Windows\System\gvOHaLz.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\vUrrjzd.exe
  C:\Windows\System\vUrrjzd.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\IGoOlzW.exe
  C:\Windows\System\IGoOlzW.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\KCwvfRC.exe
  C:\Windows\System\KCwvfRC.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\oaQCyFE.exe
  C:\Windows\System\oaQCyFE.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\PANqYGs.exe
  C:\Windows\System\PANqYGs.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\YCaDWSk.exe
  C:\Windows\System\YCaDWSk.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\dXsdlCp.exe
  C:\Windows\System\dXsdlCp.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\XlLcZyF.exe
  C:\Windows\System\XlLcZyF.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\jhtUupa.exe
  C:\Windows\System\jhtUupa.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\nQlDOqY.exe
  C:\Windows\System\nQlDOqY.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\dDumDGg.exe
  C:\Windows\System\dDumDGg.exe
  2⤵
  PID:2404
- C:\Windows\System\mDHaCgl.exe
  C:\Windows\System\mDHaCgl.exe
  2⤵
  PID:2432
- C:\Windows\System\YsifHCQ.exe
  C:\Windows\System\YsifHCQ.exe
  2⤵
  PID:2896
- C:\Windows\System\mrIhJlH.exe
  C:\Windows\System\mrIhJlH.exe
  2⤵
  PID:2552
- C:\Windows\System\bDPqyKV.exe
  C:\Windows\System\bDPqyKV.exe
  2⤵
  PID:2192
- C:\Windows\System\rPCrIum.exe
  C:\Windows\System\rPCrIum.exe
  2⤵
  PID:2528
- C:\Windows\System\OhEYlnS.exe
  C:\Windows\System\OhEYlnS.exe
  2⤵
  PID:2840
- C:\Windows\System\TSRlsQm.exe
  C:\Windows\System\TSRlsQm.exe
  2⤵
  PID:1484
- C:\Windows\System\NTIqalY.exe
  C:\Windows\System\NTIqalY.exe
  2⤵
  PID:1888
- C:\Windows\System\HphUimm.exe
  C:\Windows\System\HphUimm.exe
  2⤵
  PID:2224
- C:\Windows\System\dfIJxgY.exe
  C:\Windows\System\dfIJxgY.exe
  2⤵
  PID:2640
- C:\Windows\System\gWakkcn.exe
  C:\Windows\System\gWakkcn.exe
  2⤵
  PID:3040
- C:\Windows\System\yXOdWGt.exe
  C:\Windows\System\yXOdWGt.exe
  2⤵
  PID:1172
- C:\Windows\System\sRHzcUu.exe
  C:\Windows\System\sRHzcUu.exe
  2⤵
  PID:2584
- C:\Windows\System\FYHFnCr.exe
  C:\Windows\System\FYHFnCr.exe
  2⤵
  PID:1780
- C:\Windows\System\MFgIqKo.exe
  C:\Windows\System\MFgIqKo.exe
  2⤵
  PID:2228
- C:\Windows\System\kHqFYGP.exe
  C:\Windows\System\kHqFYGP.exe
  2⤵
  PID:2756
- C:\Windows\System\XqWtUiu.exe
  C:\Windows\System\XqWtUiu.exe
  2⤵
  PID:1492
- C:\Windows\System\KnhzTcr.exe
  C:\Windows\System\KnhzTcr.exe
  2⤵
  PID:2876
- C:\Windows\System\oMVGcLK.exe
  C:\Windows\System\oMVGcLK.exe
  2⤵
  PID:868
- C:\Windows\System\YLrcOTi.exe
  C:\Windows\System\YLrcOTi.exe
  2⤵
  PID:2364
- C:\Windows\System\OavPUbs.exe
  C:\Windows\System\OavPUbs.exe
  2⤵
  PID:1340
- C:\Windows\System\oRGEPfA.exe
  C:\Windows\System\oRGEPfA.exe
  2⤵
  PID:1096
- C:\Windows\System\iflnYnL.exe
  C:\Windows\System\iflnYnL.exe
  2⤵
  PID:1712
- C:\Windows\System\EOaGSjI.exe
  C:\Windows\System\EOaGSjI.exe
  2⤵
  PID:2312
- C:\Windows\System\sCRcNzY.exe
  C:\Windows\System\sCRcNzY.exe
  2⤵
  PID:1964
- C:\Windows\System\YCBwcUP.exe
  C:\Windows\System\YCBwcUP.exe
  2⤵
  PID:1176
- C:\Windows\System\wdoeruk.exe
  C:\Windows\System\wdoeruk.exe
  2⤵
  PID:1936
- C:\Windows\System\OkCfnhN.exe
  C:\Windows\System\OkCfnhN.exe
  2⤵
  PID:2760
- C:\Windows\System\aWbooGq.exe
  C:\Windows\System\aWbooGq.exe
  2⤵
  PID:2720
- C:\Windows\System\QpuKfCE.exe
  C:\Windows\System\QpuKfCE.exe
  2⤵
  PID:2272
- C:\Windows\System\cpOBbHF.exe
  C:\Windows\System\cpOBbHF.exe
  2⤵
  PID:3052
- C:\Windows\System\QDGldyl.exe
  C:\Windows\System\QDGldyl.exe
  2⤵
  PID:324
- C:\Windows\System\xpACLfP.exe
  C:\Windows\System\xpACLfP.exe
  2⤵
  PID:756
- C:\Windows\System\NuiDAIX.exe
  C:\Windows\System\NuiDAIX.exe
  2⤵
  PID:628
- C:\Windows\System\PYNsjVM.exe
  C:\Windows\System\PYNsjVM.exe
  2⤵
  PID:1056
- C:\Windows\System\hQeLJKl.exe
  C:\Windows\System\hQeLJKl.exe
  2⤵
  PID:1848
- C:\Windows\System\yICDPcl.exe
  C:\Windows\System\yICDPcl.exe
  2⤵
  PID:1380
- C:\Windows\System\OUQoROh.exe
  C:\Windows\System\OUQoROh.exe
  2⤵
  PID:340
- C:\Windows\System\RnaGwhD.exe
  C:\Windows\System\RnaGwhD.exe
  2⤵
  PID:1560
- C:\Windows\System\SuUaSCq.exe
  C:\Windows\System\SuUaSCq.exe
  2⤵
  PID:2824
- C:\Windows\System\gPgfcPi.exe
  C:\Windows\System\gPgfcPi.exe
  2⤵
  PID:2868
- C:\Windows\System\AqvDBMx.exe
  C:\Windows\System\AqvDBMx.exe
  2⤵
  PID:1516
- C:\Windows\System\eabgPMy.exe
  C:\Windows\System\eabgPMy.exe
  2⤵
  PID:2812
- C:\Windows\System\kKKMfPa.exe
  C:\Windows\System\kKKMfPa.exe
  2⤵
  PID:1224
- C:\Windows\System\AWKFmda.exe
  C:\Windows\System\AWKFmda.exe
  2⤵
  PID:912
- C:\Windows\System\xItgffF.exe
  C:\Windows\System\xItgffF.exe
  2⤵
  PID:2624
- C:\Windows\System\UstzkMz.exe
  C:\Windows\System\UstzkMz.exe
  2⤵
  PID:2872
- C:\Windows\System\AyaAUBu.exe
  C:\Windows\System\AyaAUBu.exe
  2⤵
  PID:2428
- C:\Windows\System\sTKDgpb.exe
  C:\Windows\System\sTKDgpb.exe
  2⤵
  PID:2832
- C:\Windows\System\MVlSpjC.exe
  C:\Windows\System\MVlSpjC.exe
  2⤵
  PID:1012
- C:\Windows\System\rpXKybX.exe
  C:\Windows\System\rpXKybX.exe
  2⤵
  PID:2632
- C:\Windows\System\pOdGAPY.exe
  C:\Windows\System\pOdGAPY.exe
  2⤵
  PID:840
- C:\Windows\System\SRKgSNO.exe
  C:\Windows\System\SRKgSNO.exe
  2⤵
  PID:2412
- C:\Windows\System\iuvqbHf.exe
  C:\Windows\System\iuvqbHf.exe
  2⤵
  PID:1692
- C:\Windows\System\vbOmFsy.exe
  C:\Windows\System\vbOmFsy.exe
  2⤵
  PID:1764
- C:\Windows\System\VsVjEDv.exe
  C:\Windows\System\VsVjEDv.exe
  2⤵
  PID:2536
- C:\Windows\System\uYFWpkB.exe
  C:\Windows\System\uYFWpkB.exe
  2⤵
  PID:2852
- C:\Windows\System\gENMfLk.exe
  C:\Windows\System\gENMfLk.exe
  2⤵
  PID:1080
- C:\Windows\System\RAAoEuV.exe
  C:\Windows\System\RAAoEuV.exe
  2⤵
  PID:1724
- C:\Windows\System\npxclVT.exe
  C:\Windows\System\npxclVT.exe
  2⤵
  PID:2204
- C:\Windows\System\MsaxdoS.exe
  C:\Windows\System\MsaxdoS.exe
  2⤵
  PID:2900
- C:\Windows\System\WgAAeaa.exe
  C:\Windows\System\WgAAeaa.exe
  2⤵
  PID:1636
- C:\Windows\System\yEBrsOu.exe
  C:\Windows\System\yEBrsOu.exe
  2⤵
  PID:700
- C:\Windows\System\EpzhuFI.exe
  C:\Windows\System\EpzhuFI.exe
  2⤵
  PID:1092
- C:\Windows\System\OhoYpKg.exe
  C:\Windows\System\OhoYpKg.exe
  2⤵
  PID:380
- C:\Windows\System\KDSRdCg.exe
  C:\Windows\System\KDSRdCg.exe
  2⤵
  PID:672
- C:\Windows\System\gTLslHU.exe
  C:\Windows\System\gTLslHU.exe
  2⤵
  PID:2060
- C:\Windows\System\OIMtRwK.exe
  C:\Windows\System\OIMtRwK.exe
  2⤵
  PID:2784
- C:\Windows\System\VPKludP.exe
  C:\Windows\System\VPKludP.exe
  2⤵
  PID:1068
- C:\Windows\System\KtwFXOi.exe
  C:\Windows\System\KtwFXOi.exe
  2⤵
  PID:2796
- C:\Windows\System\ktFeJHP.exe
  C:\Windows\System\ktFeJHP.exe
  2⤵
  PID:2160
- C:\Windows\System\VwGsKqQ.exe
  C:\Windows\System\VwGsKqQ.exe
  2⤵
  PID:2284
- C:\Windows\System\AizCzAd.exe
  C:\Windows\System\AizCzAd.exe
  2⤵
  PID:2216
- C:\Windows\System\RSEFOlK.exe
  C:\Windows\System\RSEFOlK.exe
  2⤵
  PID:2020
- C:\Windows\System\WbQiFTT.exe
  C:\Windows\System\WbQiFTT.exe
  2⤵
  PID:2040
- C:\Windows\System\hfppqUs.exe
  C:\Windows\System\hfppqUs.exe
  2⤵
  PID:2612
- C:\Windows\System\dzOCDJi.exe
  C:\Windows\System\dzOCDJi.exe
  2⤵
  PID:1716
- C:\Windows\System\LxyGtJh.exe
  C:\Windows\System\LxyGtJh.exe
  2⤵
  PID:1748
- C:\Windows\System\UaRBUbi.exe
  C:\Windows\System\UaRBUbi.exe
  2⤵
  PID:596
- C:\Windows\System\IttjGxL.exe
  C:\Windows\System\IttjGxL.exe
  2⤵
  PID:1476
- C:\Windows\System\HUUGwJI.exe
  C:\Windows\System\HUUGwJI.exe
  2⤵
  PID:1204
- C:\Windows\System\fgLaars.exe
  C:\Windows\System\fgLaars.exe
  2⤵
  PID:2396
- C:\Windows\System\BGEqezZ.exe
  C:\Windows\System\BGEqezZ.exe
  2⤵
  PID:2572
- C:\Windows\System\aQbqCgJ.exe
  C:\Windows\System\aQbqCgJ.exe
  2⤵
  PID:1200
- C:\Windows\System\RJgUmHl.exe
  C:\Windows\System\RJgUmHl.exe
  2⤵
  PID:1912
- C:\Windows\System\aShcnGy.exe
  C:\Windows\System\aShcnGy.exe
  2⤵
  PID:1624
- C:\Windows\System\HRWXobz.exe
  C:\Windows\System\HRWXobz.exe
  2⤵
  PID:2264
- C:\Windows\System\monvglp.exe
  C:\Windows\System\monvglp.exe
  2⤵
  PID:2512
- C:\Windows\System\DTsOKOH.exe
  C:\Windows\System\DTsOKOH.exe
  2⤵
  PID:2588
- C:\Windows\System\pKesMHB.exe
  C:\Windows\System\pKesMHB.exe
  2⤵
  PID:2540
- C:\Windows\System\EyFkxpJ.exe
  C:\Windows\System\EyFkxpJ.exe
  2⤵
  PID:2456
- C:\Windows\System\hgxOafW.exe
  C:\Windows\System\hgxOafW.exe
  2⤵
  PID:1660
- C:\Windows\System\yLdzbkA.exe
  C:\Windows\System\yLdzbkA.exe
  2⤵
  PID:3064
- C:\Windows\System\YdDRFpf.exe
  C:\Windows\System\YdDRFpf.exe
  2⤵
  PID:2948
- C:\Windows\System\TdLbZIY.exe
  C:\Windows\System\TdLbZIY.exe
  2⤵
  PID:876
- C:\Windows\System\gORbCXE.exe
  C:\Windows\System\gORbCXE.exe
  2⤵
  PID:2776
- C:\Windows\System\CFMQMRz.exe
  C:\Windows\System\CFMQMRz.exe
  2⤵
  PID:1320
- C:\Windows\System\OPRupXe.exe
  C:\Windows\System\OPRupXe.exe
  2⤵
  PID:2508
- C:\Windows\System\CpBJVlP.exe
  C:\Windows\System\CpBJVlP.exe
  2⤵
  PID:1676
- C:\Windows\System\wpIstBs.exe
  C:\Windows\System\wpIstBs.exe
  2⤵
  PID:1612
- C:\Windows\System\NgvJLNE.exe
  C:\Windows\System\NgvJLNE.exe
  2⤵
  PID:2344
- C:\Windows\System\tTwuUcO.exe
  C:\Windows\System\tTwuUcO.exe
  2⤵
  PID:1480
- C:\Windows\System\ALBnQLc.exe
  C:\Windows\System\ALBnQLc.exe
  2⤵
  PID:1960
- C:\Windows\System\walAGfP.exe
  C:\Windows\System\walAGfP.exe
  2⤵
  PID:2444
- C:\Windows\System\lsuMStn.exe
  C:\Windows\System\lsuMStn.exe
  2⤵
  PID:3036
- C:\Windows\System\gtftvJg.exe
  C:\Windows\System\gtftvJg.exe
  2⤵
  PID:1656
- C:\Windows\System\ShxoAHn.exe
  C:\Windows\System\ShxoAHn.exe
  2⤵
  PID:1428
- C:\Windows\System\pgYUysY.exe
  C:\Windows\System\pgYUysY.exe
  2⤵
  PID:3076
- C:\Windows\System\wCRFoyy.exe
  C:\Windows\System\wCRFoyy.exe
  2⤵
  PID:3092
- C:\Windows\System\EBewIUa.exe
  C:\Windows\System\EBewIUa.exe
  2⤵
  PID:3108
- C:\Windows\System\McLeKrL.exe
  C:\Windows\System\McLeKrL.exe
  2⤵
  PID:3124
- C:\Windows\System\eojpZxy.exe
  C:\Windows\System\eojpZxy.exe
  2⤵
  PID:3140
- C:\Windows\System\amaEETp.exe
  C:\Windows\System\amaEETp.exe
  2⤵
  PID:3156
- C:\Windows\System\ToGyWYq.exe
  C:\Windows\System\ToGyWYq.exe
  2⤵
  PID:3212
- C:\Windows\System\lTbpCdN.exe
  C:\Windows\System\lTbpCdN.exe
  2⤵
  PID:3236
- C:\Windows\System\fFipqeh.exe
  C:\Windows\System\fFipqeh.exe
  2⤵
  PID:3256
- C:\Windows\System\zZxkiCG.exe
  C:\Windows\System\zZxkiCG.exe
  2⤵
  PID:3272
- C:\Windows\System\cNWEruV.exe
  C:\Windows\System\cNWEruV.exe
  2⤵
  PID:3288
- C:\Windows\System\qrxGEWq.exe
  C:\Windows\System\qrxGEWq.exe
  2⤵
  PID:3304
- C:\Windows\System\yRptaxe.exe
  C:\Windows\System\yRptaxe.exe
  2⤵
  PID:3320
- C:\Windows\System\FxUDznt.exe
  C:\Windows\System\FxUDznt.exe
  2⤵
  PID:3336
- C:\Windows\System\FILnEas.exe
  C:\Windows\System\FILnEas.exe
  2⤵
  PID:3352
- C:\Windows\System\sEAvipX.exe
  C:\Windows\System\sEAvipX.exe
  2⤵
  PID:3368
- C:\Windows\System\IQncmWV.exe
  C:\Windows\System\IQncmWV.exe
  2⤵
  PID:3392
- C:\Windows\System\zkMBgGk.exe
  C:\Windows\System\zkMBgGk.exe
  2⤵
  PID:3408
- C:\Windows\System\KNnrXfw.exe
  C:\Windows\System\KNnrXfw.exe
  2⤵
  PID:3424
- C:\Windows\System\mnHpgsb.exe
  C:\Windows\System\mnHpgsb.exe
  2⤵
  PID:3440
- C:\Windows\System\hijnFTi.exe
  C:\Windows\System\hijnFTi.exe
  2⤵
  PID:3456
- C:\Windows\System\ufDuhyj.exe
  C:\Windows\System\ufDuhyj.exe
  2⤵
  PID:3472
- C:\Windows\System\dRfgKIm.exe
  C:\Windows\System\dRfgKIm.exe
  2⤵
  PID:3488
- C:\Windows\System\MNspsZK.exe
  C:\Windows\System\MNspsZK.exe
  2⤵
  PID:3504
- C:\Windows\System\txaRKka.exe
  C:\Windows\System\txaRKka.exe
  2⤵
  PID:3520
- C:\Windows\System\NcVukUx.exe
  C:\Windows\System\NcVukUx.exe
  2⤵
  PID:3536
- C:\Windows\System\oPUwykM.exe
  C:\Windows\System\oPUwykM.exe
  2⤵
  PID:3552
- C:\Windows\System\FruQPkY.exe
  C:\Windows\System\FruQPkY.exe
  2⤵
  PID:3568
- C:\Windows\System\aXSwSzK.exe
  C:\Windows\System\aXSwSzK.exe
  2⤵
  PID:3584
- C:\Windows\System\uiFxvPH.exe
  C:\Windows\System\uiFxvPH.exe
  2⤵
  PID:3600
- C:\Windows\System\tNMSUoI.exe
  C:\Windows\System\tNMSUoI.exe
  2⤵
  PID:3620
- C:\Windows\System\uhKOSlp.exe
  C:\Windows\System\uhKOSlp.exe
  2⤵
  PID:3636
- C:\Windows\System\BviKEPO.exe
  C:\Windows\System\BviKEPO.exe
  2⤵
  PID:3652
- C:\Windows\System\ROtzCun.exe
  C:\Windows\System\ROtzCun.exe
  2⤵
  PID:3668
- C:\Windows\System\nLAGQcp.exe
  C:\Windows\System\nLAGQcp.exe
  2⤵
  PID:3688
- C:\Windows\System\BCYivzX.exe
  C:\Windows\System\BCYivzX.exe
  2⤵
  PID:3704
- C:\Windows\System\GgHjJvd.exe
  C:\Windows\System\GgHjJvd.exe
  2⤵
  PID:3720
- C:\Windows\System\jWqbzGO.exe
  C:\Windows\System\jWqbzGO.exe
  2⤵
  PID:3736
- C:\Windows\System\QpzCmnr.exe
  C:\Windows\System\QpzCmnr.exe
  2⤵
  PID:3752
- C:\Windows\System\oJNbnbx.exe
  C:\Windows\System\oJNbnbx.exe
  2⤵
  PID:3768
- C:\Windows\System\UHAQQwT.exe
  C:\Windows\System\UHAQQwT.exe
  2⤵
  PID:3784
- C:\Windows\System\naJbsqI.exe
  C:\Windows\System\naJbsqI.exe
  2⤵
  PID:3800
- C:\Windows\System\eoknDuV.exe
  C:\Windows\System\eoknDuV.exe
  2⤵
  PID:3820
- C:\Windows\System\NjPcdhG.exe
  C:\Windows\System\NjPcdhG.exe
  2⤵
  PID:3836
- C:\Windows\System\pvXrRLM.exe
  C:\Windows\System\pvXrRLM.exe
  2⤵
  PID:3852
- C:\Windows\System\hVDBNHw.exe
  C:\Windows\System\hVDBNHw.exe
  2⤵
  PID:3868
- C:\Windows\System\udMxXim.exe
  C:\Windows\System\udMxXim.exe
  2⤵
  PID:3884
- C:\Windows\System\qhuITQs.exe
  C:\Windows\System\qhuITQs.exe
  2⤵
  PID:3900
- C:\Windows\System\dQCOnnn.exe
  C:\Windows\System\dQCOnnn.exe
  2⤵
  PID:3916
- C:\Windows\System\kHLAHCC.exe
  C:\Windows\System\kHLAHCC.exe
  2⤵
  PID:3932
- C:\Windows\System\RrjrosE.exe
  C:\Windows\System\RrjrosE.exe
  2⤵
  PID:3948
- C:\Windows\System\jYRHiLX.exe
  C:\Windows\System\jYRHiLX.exe
  2⤵
  PID:3964
- C:\Windows\System\yHOFnLg.exe
  C:\Windows\System\yHOFnLg.exe
  2⤵
  PID:3980
- C:\Windows\System\oMBmAYB.exe
  C:\Windows\System\oMBmAYB.exe
  2⤵
  PID:3996
- C:\Windows\System\rLdhAww.exe
  C:\Windows\System\rLdhAww.exe
  2⤵
  PID:4012
- C:\Windows\System\LgQursf.exe
  C:\Windows\System\LgQursf.exe
  2⤵
  PID:4028
- C:\Windows\System\sGzrnmS.exe
  C:\Windows\System\sGzrnmS.exe
  2⤵
  PID:4044
- C:\Windows\System\ingsgil.exe
  C:\Windows\System\ingsgil.exe
  2⤵
  PID:4060
- C:\Windows\System\mgrDiaZ.exe
  C:\Windows\System\mgrDiaZ.exe
  2⤵
  PID:4076
- C:\Windows\System\TDllSTQ.exe
  C:\Windows\System\TDllSTQ.exe
  2⤵
  PID:4092
- C:\Windows\System\RzuKXgN.exe
  C:\Windows\System\RzuKXgN.exe
  2⤵
  PID:2636
- C:\Windows\System\HAYluFy.exe
  C:\Windows\System\HAYluFy.exe
  2⤵
  PID:1896
- C:\Windows\System\kbwcSkz.exe
  C:\Windows\System\kbwcSkz.exe
  2⤵
  PID:2684
- C:\Windows\System\dOPKWxd.exe
  C:\Windows\System\dOPKWxd.exe
  2⤵
  PID:292
- C:\Windows\System\HefZsem.exe
  C:\Windows\System\HefZsem.exe
  2⤵
  PID:828
- C:\Windows\System\zonEXKU.exe
  C:\Windows\System\zonEXKU.exe
  2⤵
  PID:2696
- C:\Windows\System\ZwmDkxd.exe
  C:\Windows\System\ZwmDkxd.exe
  2⤵
  PID:2292
- C:\Windows\System\JImmrHC.exe
  C:\Windows\System\JImmrHC.exe
  2⤵
  PID:3088
- C:\Windows\System\tNyJGpu.exe
  C:\Windows\System\tNyJGpu.exe
  2⤵
  PID:3152
- C:\Windows\System\YqwaeGC.exe
  C:\Windows\System\YqwaeGC.exe
  2⤵
  PID:3224
- C:\Windows\System\GycOirh.exe
  C:\Windows\System\GycOirh.exe
  2⤵
  PID:3136
- C:\Windows\System\CweCKub.exe
  C:\Windows\System\CweCKub.exe
  2⤵
  PID:3328
- C:\Windows\System\KlQydOg.exe
  C:\Windows\System\KlQydOg.exe
  2⤵
  PID:3068
- C:\Windows\System\hvcCKHn.exe
  C:\Windows\System\hvcCKHn.exe
  2⤵
  PID:3104
- C:\Windows\System\XaYQjpJ.exe
  C:\Windows\System\XaYQjpJ.exe
  2⤵
  PID:3176
- C:\Windows\System\ujdjgmN.exe
  C:\Windows\System\ujdjgmN.exe
  2⤵
  PID:3200
- C:\Windows\System\NWMGjXh.exe
  C:\Windows\System\NWMGjXh.exe
  2⤵
  PID:3248
- C:\Windows\System\QqtIflc.exe
  C:\Windows\System\QqtIflc.exe
  2⤵
  PID:3348
- C:\Windows\System\KrFqjTL.exe
  C:\Windows\System\KrFqjTL.exe
  2⤵
  PID:3400
- C:\Windows\System\SRkhZPu.exe
  C:\Windows\System\SRkhZPu.exe
  2⤵
  PID:3436
- C:\Windows\System\GZnEWBp.exe
  C:\Windows\System\GZnEWBp.exe
  2⤵
  PID:3468
- C:\Windows\System\kStoAAa.exe
  C:\Windows\System\kStoAAa.exe
  2⤵
  PID:3384
- C:\Windows\System\NjFobMz.exe
  C:\Windows\System\NjFobMz.exe
  2⤵
  PID:1940
- C:\Windows\System\daBDhYM.exe
  C:\Windows\System\daBDhYM.exe
  2⤵
  PID:3596
- C:\Windows\System\sbuEUZV.exe
  C:\Windows\System\sbuEUZV.exe
  2⤵
  PID:3516
- C:\Windows\System\GIaJsEN.exe
  C:\Windows\System\GIaJsEN.exe
  2⤵
  PID:3664
- C:\Windows\System\kPaMYDc.exe
  C:\Windows\System\kPaMYDc.exe
  2⤵
  PID:3544
- C:\Windows\System\ehNRUPF.exe
  C:\Windows\System\ehNRUPF.exe
  2⤵
  PID:3452
- C:\Windows\System\cNeZJGy.exe
  C:\Windows\System\cNeZJGy.exe
  2⤵
  PID:3732
- C:\Windows\System\fPjdOPQ.exe
  C:\Windows\System\fPjdOPQ.exe
  2⤵
  PID:3644
- C:\Windows\System\PKjqVGL.exe
  C:\Windows\System\PKjqVGL.exe
  2⤵
  PID:3648
- C:\Windows\System\GdtegLz.exe
  C:\Windows\System\GdtegLz.exe
  2⤵
  PID:3608
- C:\Windows\System\dPqOHEV.exe
  C:\Windows\System\dPqOHEV.exe
  2⤵
  PID:3780
- C:\Windows\System\YSEYYQg.exe
  C:\Windows\System\YSEYYQg.exe
  2⤵
  PID:3828
- C:\Windows\System\dDubdTs.exe
  C:\Windows\System\dDubdTs.exe
  2⤵
  PID:3892
- C:\Windows\System\EkDSnKf.exe
  C:\Windows\System\EkDSnKf.exe
  2⤵
  PID:3908
- C:\Windows\System\gDcHpUX.exe
  C:\Windows\System\gDcHpUX.exe
  2⤵
  PID:3960
- C:\Windows\System\fCrnZaB.exe
  C:\Windows\System\fCrnZaB.exe
  2⤵
  PID:3912
- C:\Windows\System\SOGrKrW.exe
  C:\Windows\System\SOGrKrW.exe
  2⤵
  PID:4020
- C:\Windows\System\pukItgL.exe
  C:\Windows\System\pukItgL.exe
  2⤵
  PID:4056
- C:\Windows\System\DlsPsJI.exe
  C:\Windows\System\DlsPsJI.exe
  2⤵
  PID:2268
- C:\Windows\System\rDWZUwi.exe
  C:\Windows\System\rDWZUwi.exe
  2⤵
  PID:3972
- C:\Windows\System\pkvndNi.exe
  C:\Windows\System\pkvndNi.exe
  2⤵
  PID:4068
- C:\Windows\System\eCdMSaP.exe
  C:\Windows\System\eCdMSaP.exe
  2⤵
  PID:2084
- C:\Windows\System\XarTBRc.exe
  C:\Windows\System\XarTBRc.exe
  2⤵
  PID:2936
- C:\Windows\System\jxFdOor.exe
  C:\Windows\System\jxFdOor.exe
  2⤵
  PID:1376
- C:\Windows\System\dPKEHsl.exe
  C:\Windows\System\dPKEHsl.exe
  2⤵
  PID:1672
- C:\Windows\System\qNqVhQV.exe
  C:\Windows\System\qNqVhQV.exe
  2⤵
  PID:3220
- C:\Windows\System\HHtxvZQ.exe
  C:\Windows\System\HHtxvZQ.exe
  2⤵
  PID:2240
- C:\Windows\System\smcwOdB.exe
  C:\Windows\System\smcwOdB.exe
  2⤵
  PID:1508
- C:\Windows\System\TBTOHcz.exe
  C:\Windows\System\TBTOHcz.exe
  2⤵
  PID:3364
- C:\Windows\System\LxtniTU.exe
  C:\Windows\System\LxtniTU.exe
  2⤵
  PID:3284
- C:\Windows\System\kvsiuML.exe
  C:\Windows\System\kvsiuML.exe
  2⤵
  PID:3404
- C:\Windows\System\gULsfTt.exe
  C:\Windows\System\gULsfTt.exe
  2⤵
  PID:3280
- C:\Windows\System\BiTTOqd.exe
  C:\Windows\System\BiTTOqd.exe
  2⤵
  PID:824
- C:\Windows\System\anwvxjt.exe
  C:\Windows\System\anwvxjt.exe
  2⤵
  PID:3576
- C:\Windows\System\CWXEUOZ.exe
  C:\Windows\System\CWXEUOZ.exe
  2⤵
  PID:3388
- C:\Windows\System\nDHGtkL.exe
  C:\Windows\System\nDHGtkL.exe
  2⤵
  PID:3728
- C:\Windows\System\IfKpdyC.exe
  C:\Windows\System\IfKpdyC.exe
  2⤵
  PID:1072
- C:\Windows\System\ShutZIV.exe
  C:\Windows\System\ShutZIV.exe
  2⤵
  PID:3796
- C:\Windows\System\rKjRfwD.exe
  C:\Windows\System\rKjRfwD.exe
  2⤵
  PID:3864
- C:\Windows\System\NrjXgjy.exe
  C:\Windows\System\NrjXgjy.exe
  2⤵
  PID:3876
- C:\Windows\System\wWOyRQg.exe
  C:\Windows\System\wWOyRQg.exe
  2⤵
  PID:3988
- C:\Windows\System\ynOTSMv.exe
  C:\Windows\System\ynOTSMv.exe
  2⤵
  PID:4088
- C:\Windows\System\zihezoM.exe
  C:\Windows\System\zihezoM.exe
  2⤵
  PID:2816
- C:\Windows\System\dkImZrN.exe
  C:\Windows\System\dkImZrN.exe
  2⤵
  PID:4036
- C:\Windows\System\YFaQsJS.exe
  C:\Windows\System\YFaQsJS.exe
  2⤵
  PID:2864
- C:\Windows\System\monXbiw.exe
  C:\Windows\System\monXbiw.exe
  2⤵
  PID:3296
- C:\Windows\System\pfTnbWC.exe
  C:\Windows\System\pfTnbWC.exe
  2⤵
  PID:3316
- C:\Windows\System\EHAKOCi.exe
  C:\Windows\System\EHAKOCi.exe
  2⤵
  PID:2984
- C:\Windows\System\hpFwRpI.exe
  C:\Windows\System\hpFwRpI.exe
  2⤵
  PID:1184
- C:\Windows\System\OEWWtND.exe
  C:\Windows\System\OEWWtND.exe
  2⤵
  PID:3632
- C:\Windows\System\vbdkjRM.exe
  C:\Windows\System\vbdkjRM.exe
  2⤵
  PID:3612
- C:\Windows\System\mRmVqLm.exe
  C:\Windows\System\mRmVqLm.exe
  2⤵
  PID:3808
- C:\Windows\System\RMozMsD.exe
  C:\Windows\System\RMozMsD.exe
  2⤵
  PID:3880
- C:\Windows\System\UlnGmsz.exe
  C:\Windows\System\UlnGmsz.exe
  2⤵
  PID:3976
- C:\Windows\System\EUvzDwf.exe
  C:\Windows\System\EUvzDwf.exe
  2⤵
  PID:3044
- C:\Windows\System\uiVPPnR.exe
  C:\Windows\System\uiVPPnR.exe
  2⤵
  PID:3196
- C:\Windows\System\MApPLnS.exe
  C:\Windows\System\MApPLnS.exe
  2⤵
  PID:3592
- C:\Windows\System\hayJfwb.exe
  C:\Windows\System\hayJfwb.exe
  2⤵
  PID:3684
- C:\Windows\System\eeCiNcm.exe
  C:\Windows\System\eeCiNcm.exe
  2⤵
  PID:3944
- C:\Windows\System\fvOieIz.exe
  C:\Windows\System\fvOieIz.exe
  2⤵
  PID:4112
- C:\Windows\System\jyBlFhh.exe
  C:\Windows\System\jyBlFhh.exe
  2⤵
  PID:4140
- C:\Windows\System\JUbJnuC.exe
  C:\Windows\System\JUbJnuC.exe
  2⤵
  PID:4156
- C:\Windows\System\QzzhgVI.exe
  C:\Windows\System\QzzhgVI.exe
  2⤵
  PID:4180
- C:\Windows\System\MeRtklq.exe
  C:\Windows\System\MeRtklq.exe
  2⤵
  PID:4196
- C:\Windows\System\Kvmkgke.exe
  C:\Windows\System\Kvmkgke.exe
  2⤵
  PID:4212
- C:\Windows\System\pZRZeFD.exe
  C:\Windows\System\pZRZeFD.exe
  2⤵
  PID:4228
- C:\Windows\System\pnJLDnl.exe
  C:\Windows\System\pnJLDnl.exe
  2⤵
  PID:4248
- C:\Windows\System\yhLpEoa.exe
  C:\Windows\System\yhLpEoa.exe
  2⤵
  PID:4272
- C:\Windows\System\jxpIoIx.exe
  C:\Windows\System\jxpIoIx.exe
  2⤵
  PID:4288
- C:\Windows\System\euEPtgt.exe
  C:\Windows\System\euEPtgt.exe
  2⤵
  PID:4304
- C:\Windows\System\cNyTWNQ.exe
  C:\Windows\System\cNyTWNQ.exe
  2⤵
  PID:4320
- C:\Windows\System\sowStKw.exe
  C:\Windows\System\sowStKw.exe
  2⤵
  PID:4336
- C:\Windows\System\FfhTQfM.exe
  C:\Windows\System\FfhTQfM.exe
  2⤵
  PID:4356
- C:\Windows\System\sCoZnvu.exe
  C:\Windows\System\sCoZnvu.exe
  2⤵
  PID:4372
- C:\Windows\System\blWoIAk.exe
  C:\Windows\System\blWoIAk.exe
  2⤵
  PID:4388
- C:\Windows\System\WSVMwmc.exe
  C:\Windows\System\WSVMwmc.exe
  2⤵
  PID:4404
- C:\Windows\System\ZhxhIdE.exe
  C:\Windows\System\ZhxhIdE.exe
  2⤵
  PID:4420
- C:\Windows\System\kJrctUX.exe
  C:\Windows\System\kJrctUX.exe
  2⤵
  PID:4440
- C:\Windows\System\AuedHHz.exe
  C:\Windows\System\AuedHHz.exe
  2⤵
  PID:4456
- C:\Windows\System\mcseoCQ.exe
  C:\Windows\System\mcseoCQ.exe
  2⤵
  PID:4472
- C:\Windows\System\OAekhBY.exe
  C:\Windows\System\OAekhBY.exe
  2⤵
  PID:4492
- C:\Windows\System\uaRzUjG.exe
  C:\Windows\System\uaRzUjG.exe
  2⤵
  PID:4508
- C:\Windows\System\RkEwXyd.exe
  C:\Windows\System\RkEwXyd.exe
  2⤵
  PID:4524
- C:\Windows\System\TMHwYIK.exe
  C:\Windows\System\TMHwYIK.exe
  2⤵
  PID:4540
- C:\Windows\System\qEdQOpk.exe
  C:\Windows\System\qEdQOpk.exe
  2⤵
  PID:4556
- C:\Windows\System\FNNzEdt.exe
  C:\Windows\System\FNNzEdt.exe
  2⤵
  PID:4576
- C:\Windows\System\xprinMN.exe
  C:\Windows\System\xprinMN.exe
  2⤵
  PID:4592
- C:\Windows\System\Qhwlgnw.exe
  C:\Windows\System\Qhwlgnw.exe
  2⤵
  PID:4608
- C:\Windows\System\BYKMrTn.exe
  C:\Windows\System\BYKMrTn.exe
  2⤵
  PID:4628
- C:\Windows\System\byCLmES.exe
  C:\Windows\System\byCLmES.exe
  2⤵
  PID:4644
- C:\Windows\System\babaJCN.exe
  C:\Windows\System\babaJCN.exe
  2⤵
  PID:4664
- C:\Windows\System\vSmstZh.exe
  C:\Windows\System\vSmstZh.exe
  2⤵
  PID:4680
- C:\Windows\System\IfvUFLS.exe
  C:\Windows\System\IfvUFLS.exe
  2⤵
  PID:4696
- C:\Windows\System\iewlkpJ.exe
  C:\Windows\System\iewlkpJ.exe
  2⤵
  PID:4712
- C:\Windows\System\EDPgHcW.exe
  C:\Windows\System\EDPgHcW.exe
  2⤵
  PID:4728
- C:\Windows\System\Dmbyoge.exe
  C:\Windows\System\Dmbyoge.exe
  2⤵
  PID:4744
- C:\Windows\System\jGZHJkf.exe
  C:\Windows\System\jGZHJkf.exe
  2⤵
  PID:4760
- C:\Windows\System\apEIqlu.exe
  C:\Windows\System\apEIqlu.exe
  2⤵
  PID:4776
- C:\Windows\System\gqjvBCs.exe
  C:\Windows\System\gqjvBCs.exe
  2⤵
  PID:4792
- C:\Windows\System\JSyKljz.exe
  C:\Windows\System\JSyKljz.exe
  2⤵
  PID:4808
- C:\Windows\System\duQRdCj.exe
  C:\Windows\System\duQRdCj.exe
  2⤵
  PID:4824
- C:\Windows\System\XvrTTfg.exe
  C:\Windows\System\XvrTTfg.exe
  2⤵
  PID:4840
- C:\Windows\System\veEJNsf.exe
  C:\Windows\System\veEJNsf.exe
  2⤵
  PID:4856
- C:\Windows\System\jkaUwDN.exe
  C:\Windows\System\jkaUwDN.exe
  2⤵
  PID:4880
- C:\Windows\System\VhTghxd.exe
  C:\Windows\System\VhTghxd.exe
  2⤵
  PID:4896
- C:\Windows\System\mesTkXh.exe
  C:\Windows\System\mesTkXh.exe
  2⤵
  PID:4912
- C:\Windows\System\gbwswkh.exe
  C:\Windows\System\gbwswkh.exe
  2⤵
  PID:4928
- C:\Windows\System\rvFJWiu.exe
  C:\Windows\System\rvFJWiu.exe
  2⤵
  PID:4944
- C:\Windows\System\QHycsnL.exe
  C:\Windows\System\QHycsnL.exe
  2⤵
  PID:4960
- C:\Windows\System\RciSErM.exe
  C:\Windows\System\RciSErM.exe
  2⤵
  PID:4980
- C:\Windows\System\OsphBMi.exe
  C:\Windows\System\OsphBMi.exe
  2⤵
  PID:4996
- C:\Windows\System\LdZSSWu.exe
  C:\Windows\System\LdZSSWu.exe
  2⤵
  PID:5020
- C:\Windows\System\SbTkupN.exe
  C:\Windows\System\SbTkupN.exe
  2⤵
  PID:5036
- C:\Windows\System\GzMniVs.exe
  C:\Windows\System\GzMniVs.exe
  2⤵
  PID:5052
- C:\Windows\System\mqWJEsr.exe
  C:\Windows\System\mqWJEsr.exe
  2⤵
  PID:5072
- C:\Windows\System\RrhIVOO.exe
  C:\Windows\System\RrhIVOO.exe
  2⤵
  PID:5088
- C:\Windows\System\sdoFguR.exe
  C:\Windows\System\sdoFguR.exe
  2⤵
  PID:5104
- C:\Windows\System\RBwQGwk.exe
  C:\Windows\System\RBwQGwk.exe
  2⤵
  PID:3700
- C:\Windows\System\DXLICEZ.exe
  C:\Windows\System\DXLICEZ.exe
  2⤵
  PID:3100
- C:\Windows\System\hrSzPXk.exe
  C:\Windows\System\hrSzPXk.exe
  2⤵
  PID:3432
- C:\Windows\System\gYVNHCs.exe
  C:\Windows\System\gYVNHCs.exe
  2⤵
  PID:3184
- C:\Windows\System\xlpfzgg.exe
  C:\Windows\System\xlpfzgg.exe
  2⤵
  PID:4132
- C:\Windows\System\BDksvRH.exe
  C:\Windows\System\BDksvRH.exe
  2⤵
  PID:4164
- C:\Windows\System\avEIeIQ.exe
  C:\Windows\System\avEIeIQ.exe
  2⤵
  PID:4244
- C:\Windows\System\ZtdacNi.exe
  C:\Windows\System\ZtdacNi.exe
  2⤵
  PID:4312
- C:\Windows\System\LMqoZUj.exe
  C:\Windows\System\LMqoZUj.exe
  2⤵
  PID:4416
- C:\Windows\System\eLZCoHX.exe
  C:\Windows\System\eLZCoHX.exe
  2⤵
  PID:4192
- C:\Windows\System\RgkRNqv.exe
  C:\Windows\System\RgkRNqv.exe
  2⤵
  PID:4396
- C:\Windows\System\RwVTdIf.exe
  C:\Windows\System\RwVTdIf.exe
  2⤵
  PID:4432
- C:\Windows\System\pfmQIom.exe
  C:\Windows\System\pfmQIom.exe
  2⤵
  PID:4344
- C:\Windows\System\gAOxSQO.exe
  C:\Windows\System\gAOxSQO.exe
  2⤵
  PID:4328
- C:\Windows\System\XWpRLBm.exe
  C:\Windows\System\XWpRLBm.exe
  2⤵
  PID:4400
- C:\Windows\System\OuKkLzW.exe
  C:\Windows\System\OuKkLzW.exe
  2⤵
  PID:4520
- C:\Windows\System\wZbYBgW.exe
  C:\Windows\System\wZbYBgW.exe
  2⤵
  PID:4480
- C:\Windows\System\ElAIVCC.exe
  C:\Windows\System\ElAIVCC.exe
  2⤵
  PID:4500
- C:\Windows\System\yDxLfsi.exe
  C:\Windows\System\yDxLfsi.exe
  2⤵
  PID:4564
- C:\Windows\System\VROevMR.exe
  C:\Windows\System\VROevMR.exe
  2⤵
  PID:4600
- C:\Windows\System\RLhQhhw.exe
  C:\Windows\System\RLhQhhw.exe
  2⤵
  PID:4640
- C:\Windows\System\bAgTdkN.exe
  C:\Windows\System\bAgTdkN.exe
  2⤵
  PID:4620
- C:\Windows\System\oBeJqqA.exe
  C:\Windows\System\oBeJqqA.exe
  2⤵
  PID:4652
- C:\Windows\System\ZmxsBgH.exe
  C:\Windows\System\ZmxsBgH.exe
  2⤵
  PID:4688
- C:\Windows\System\awGlyhv.exe
  C:\Windows\System\awGlyhv.exe
  2⤵
  PID:4768
- C:\Windows\System\MdCoEXv.exe
  C:\Windows\System\MdCoEXv.exe
  2⤵
  PID:4836
- C:\Windows\System\cYgMbaM.exe
  C:\Windows\System\cYgMbaM.exe
  2⤵
  PID:4832
- C:\Windows\System\hLmHsbH.exe
  C:\Windows\System\hLmHsbH.exe
  2⤵
  PID:4952
- C:\Windows\System\rxDWijF.exe
  C:\Windows\System\rxDWijF.exe
  2⤵
  PID:4936
- C:\Windows\System\WhwtmLG.exe
  C:\Windows\System\WhwtmLG.exe
  2⤵
  PID:4968
- C:\Windows\System\roFUZqN.exe
  C:\Windows\System\roFUZqN.exe
  2⤵
  PID:4848
- C:\Windows\System\nDcWxOB.exe
  C:\Windows\System\nDcWxOB.exe
  2⤵
  PID:4892
- C:\Windows\System\nBvRCIx.exe
  C:\Windows\System\nBvRCIx.exe
  2⤵
  PID:4992
- C:\Windows\System\EkwOgow.exe
  C:\Windows\System\EkwOgow.exe
  2⤵
  PID:5048
- C:\Windows\System\IOisThd.exe
  C:\Windows\System\IOisThd.exe
  2⤵
  PID:5116
- C:\Windows\System\QruPTNR.exe
  C:\Windows\System\QruPTNR.exe
  2⤵
  PID:4004
- C:\Windows\System\xLHqqbf.exe
  C:\Windows\System\xLHqqbf.exe
  2⤵
  PID:5096
- C:\Windows\System\SBUCbbP.exe
  C:\Windows\System\SBUCbbP.exe
  2⤵
  PID:4108
- C:\Windows\System\auxZbWk.exe
  C:\Windows\System\auxZbWk.exe
  2⤵
  PID:4172
- C:\Windows\System\pKQDGnt.exe
  C:\Windows\System\pKQDGnt.exe
  2⤵
  PID:4816
- C:\Windows\System\muZdnPn.exe
  C:\Windows\System\muZdnPn.exe
  2⤵
  PID:4852
- C:\Windows\System\UZYhecw.exe
  C:\Windows\System\UZYhecw.exe
  2⤵
  PID:4584
- C:\Windows\System\rOqLcVj.exe
  C:\Windows\System\rOqLcVj.exe
  2⤵
  PID:4772
- C:\Windows\System\HlfRoan.exe
  C:\Windows\System\HlfRoan.exe
  2⤵
  PID:4588
- C:\Windows\System\mvxlKRe.exe
  C:\Windows\System\mvxlKRe.exe
  2⤵
  PID:4572
- C:\Windows\System\MsGkaFb.exe
  C:\Windows\System\MsGkaFb.exe
  2⤵
  PID:4876
- C:\Windows\System\Ppnmbnn.exe
  C:\Windows\System\Ppnmbnn.exe
  2⤵
  PID:5084
- C:\Windows\System\CJbmjcq.exe
  C:\Windows\System\CJbmjcq.exe
  2⤵
  PID:4124
- C:\Windows\System\CewDVFA.exe
  C:\Windows\System\CewDVFA.exe
  2⤵
  PID:4136
- C:\Windows\System\SxGtJua.exe
  C:\Windows\System\SxGtJua.exe
  2⤵
  PID:5016
- C:\Windows\System\KjcbxXl.exe
  C:\Windows\System\KjcbxXl.exe
  2⤵
  PID:5068
- C:\Windows\System\AOYEQeX.exe
  C:\Windows\System\AOYEQeX.exe
  2⤵
  PID:4348
- C:\Windows\System\thrqUwe.exe
  C:\Windows\System\thrqUwe.exe
  2⤵
  PID:4268
- C:\Windows\System\LhCZhcq.exe
  C:\Windows\System\LhCZhcq.exe
  2⤵
  PID:4488
- C:\Windows\System\NmcAhrX.exe
  C:\Windows\System\NmcAhrX.exe
  2⤵
  PID:1916
- C:\Windows\System\NQqAXcj.exe
  C:\Windows\System\NQqAXcj.exe
  2⤵
  PID:5064
- C:\Windows\System\PuFoiUB.exe
  C:\Windows\System\PuFoiUB.exe
  2⤵
  PID:1580
- C:\Windows\System\sxPYZbl.exe
  C:\Windows\System\sxPYZbl.exe
  2⤵
  PID:4208
- C:\Windows\System\EbQUFWv.exe
  C:\Windows\System\EbQUFWv.exe
  2⤵
  PID:4868
- C:\Windows\System\WvwyvZL.exe
  C:\Windows\System\WvwyvZL.exe
  2⤵
  PID:4740
- C:\Windows\System\LuyhAmk.exe
  C:\Windows\System\LuyhAmk.exe
  2⤵
  PID:4384
- C:\Windows\System\EnnZlnn.exe
  C:\Windows\System\EnnZlnn.exe
  2⤵
  PID:4908
- C:\Windows\System\raWjFGk.exe
  C:\Windows\System\raWjFGk.exe
  2⤵
  PID:4264
- C:\Windows\System\HeFzKet.exe
  C:\Windows\System\HeFzKet.exe
  2⤵
  PID:4724
- C:\Windows\System\QWhNTxK.exe
  C:\Windows\System\QWhNTxK.exe
  2⤵
  PID:4484
- C:\Windows\System\ZxgKYlq.exe
  C:\Windows\System\ZxgKYlq.exe
  2⤵
  PID:4660
- C:\Windows\System\aStdYHg.exe
  C:\Windows\System\aStdYHg.exe
  2⤵
  PID:4128
- C:\Windows\System\ZylhTTD.exe
  C:\Windows\System\ZylhTTD.exe
  2⤵
  PID:4924
- C:\Windows\System\IccSKBY.exe
  C:\Windows\System\IccSKBY.exe
  2⤵
  PID:4708
- C:\Windows\System\mBAdxWC.exe
  C:\Windows\System\mBAdxWC.exe
  2⤵
  PID:4300
- C:\Windows\System\JbIfYDx.exe
  C:\Windows\System\JbIfYDx.exe
  2⤵
  PID:5132
- C:\Windows\System\envHimC.exe
  C:\Windows\System\envHimC.exe
  2⤵
  PID:5148
- C:\Windows\System\TGbyouy.exe
  C:\Windows\System\TGbyouy.exe
  2⤵
  PID:5164
- C:\Windows\System\fQIkvLZ.exe
  C:\Windows\System\fQIkvLZ.exe
  2⤵
  PID:5180
- C:\Windows\System\pDzTNWu.exe
  C:\Windows\System\pDzTNWu.exe
  2⤵
  PID:5196
- C:\Windows\System\mIpIefl.exe
  C:\Windows\System\mIpIefl.exe
  2⤵
  PID:5212
- C:\Windows\System\Nxkskps.exe
  C:\Windows\System\Nxkskps.exe
  2⤵
  PID:5228
- C:\Windows\System\VKHhtcM.exe
  C:\Windows\System\VKHhtcM.exe
  2⤵
  PID:5244
- C:\Windows\System\XSoekwC.exe
  C:\Windows\System\XSoekwC.exe
  2⤵
  PID:5260
- C:\Windows\System\BrDCgQp.exe
  C:\Windows\System\BrDCgQp.exe
  2⤵
  PID:5288
- C:\Windows\System\UexYNRU.exe
  C:\Windows\System\UexYNRU.exe
  2⤵
  PID:5364
- C:\Windows\System\DMebyZD.exe
  C:\Windows\System\DMebyZD.exe
  2⤵
  PID:5632
- C:\Windows\System\rvwWatg.exe
  C:\Windows\System\rvwWatg.exe
  2⤵
  PID:5648
- C:\Windows\System\zdKoSpv.exe
  C:\Windows\System\zdKoSpv.exe
  2⤵
  PID:5664
- C:\Windows\System\jzDwkVp.exe
  C:\Windows\System\jzDwkVp.exe
  2⤵
  PID:5680
- C:\Windows\System\sJBWyjb.exe
  C:\Windows\System\sJBWyjb.exe
  2⤵
  PID:5844
- C:\Windows\System\WkluOcG.exe
  C:\Windows\System\WkluOcG.exe
  2⤵
  PID:5860
- C:\Windows\System\uoezQNt.exe
  C:\Windows\System\uoezQNt.exe
  2⤵
  PID:5876
- C:\Windows\System\TBcQINJ.exe
  C:\Windows\System\TBcQINJ.exe
  2⤵
  PID:5892
- C:\Windows\System\UrMfjNp.exe
  C:\Windows\System\UrMfjNp.exe
  2⤵
  PID:5908
- C:\Windows\System\QuXwvWe.exe
  C:\Windows\System\QuXwvWe.exe
  2⤵
  PID:5924
- C:\Windows\System\ZfZVjsA.exe
  C:\Windows\System\ZfZVjsA.exe
  2⤵
  PID:5940
- C:\Windows\System\QImWixy.exe
  C:\Windows\System\QImWixy.exe
  2⤵
  PID:5968
- C:\Windows\System\VrOItMd.exe
  C:\Windows\System\VrOItMd.exe
  2⤵
  PID:5984
- C:\Windows\System\woAgkNP.exe
  C:\Windows\System\woAgkNP.exe
  2⤵
  PID:6008
- C:\Windows\System\sKIgzlZ.exe
  C:\Windows\System\sKIgzlZ.exe
  2⤵
  PID:6024
- C:\Windows\System\DbZVMat.exe
  C:\Windows\System\DbZVMat.exe
  2⤵
  PID:6040
- C:\Windows\System\rKOqnGb.exe
  C:\Windows\System\rKOqnGb.exe
  2⤵
  PID:6056
- C:\Windows\System\aCvmKis.exe
  C:\Windows\System\aCvmKis.exe
  2⤵
  PID:6072
- C:\Windows\System\wQxxjaN.exe
  C:\Windows\System\wQxxjaN.exe
  2⤵
  PID:6104
- C:\Windows\System\fbBVYvT.exe
  C:\Windows\System\fbBVYvT.exe
  2⤵
  PID:6120
- C:\Windows\System\SbQkhTz.exe
  C:\Windows\System\SbQkhTz.exe
  2⤵
  PID:6136
- C:\Windows\System\FedaeJT.exe
  C:\Windows\System\FedaeJT.exe
  2⤵
  PID:5124
- C:\Windows\System\zkPSdiK.exe
  C:\Windows\System\zkPSdiK.exe
  2⤵
  PID:4120
- C:\Windows\System\lqeANoi.exe
  C:\Windows\System\lqeANoi.exe
  2⤵
  PID:5252
- C:\Windows\System\QQpszLJ.exe
  C:\Windows\System\QQpszLJ.exe
  2⤵
  PID:5140
- C:\Windows\System\CgoLchK.exe
  C:\Windows\System\CgoLchK.exe
  2⤵
  PID:5208
- C:\Windows\System\hRrhLLP.exe
  C:\Windows\System\hRrhLLP.exe
  2⤵
  PID:5060
- C:\Windows\System\KVgzTOO.exe
  C:\Windows\System\KVgzTOO.exe
  2⤵
  PID:5300
- C:\Windows\System\THZwPXU.exe
  C:\Windows\System\THZwPXU.exe
  2⤵
  PID:5336
- C:\Windows\System\GrwLDcW.exe
  C:\Windows\System\GrwLDcW.exe
  2⤵
  PID:5360
- C:\Windows\System\TgzjmfB.exe
  C:\Windows\System\TgzjmfB.exe
  2⤵
  PID:5552
- C:\Windows\System\zsfygzB.exe
  C:\Windows\System\zsfygzB.exe
  2⤵
  PID:5444
- C:\Windows\System\uYJGMBM.exe
  C:\Windows\System\uYJGMBM.exe
  2⤵
  PID:5396
- C:\Windows\System\wQNKqWa.exe
  C:\Windows\System\wQNKqWa.exe
  2⤵
  PID:5548
- C:\Windows\System\OBAbTmu.exe
  C:\Windows\System\OBAbTmu.exe
  2⤵
  PID:5576
- C:\Windows\System\RrcHrCD.exe
  C:\Windows\System\RrcHrCD.exe
  2⤵
  PID:5572
- C:\Windows\System\AZeFOPt.exe
  C:\Windows\System\AZeFOPt.exe
  2⤵
  PID:5512
- C:\Windows\System\vlbfKpz.exe
  C:\Windows\System\vlbfKpz.exe
  2⤵
  PID:5392
- C:\Windows\System\tBIirRD.exe
  C:\Windows\System\tBIirRD.exe
  2⤵
  PID:5488
- C:\Windows\System\mZSYIgj.exe
  C:\Windows\System\mZSYIgj.exe
  2⤵
  PID:5440
- C:\Windows\System\OZXQnof.exe
  C:\Windows\System\OZXQnof.exe
  2⤵
  PID:5416
- C:\Windows\System\XzHOMZd.exe
  C:\Windows\System\XzHOMZd.exe
  2⤵
  PID:844
- C:\Windows\System\fkFfQEu.exe
  C:\Windows\System\fkFfQEu.exe
  2⤵
  PID:2236
- C:\Windows\System\YNGvFNH.exe
  C:\Windows\System\YNGvFNH.exe
  2⤵
  PID:5676
- C:\Windows\System\kaDbvFU.exe
  C:\Windows\System\kaDbvFU.exe
  2⤵
  PID:5828
- C:\Windows\System\JscErUS.exe
  C:\Windows\System\JscErUS.exe
  2⤵
  PID:5608
- C:\Windows\System\qHcJSId.exe
  C:\Windows\System\qHcJSId.exe
  2⤵
  PID:5936
- C:\Windows\System\dNkJnRe.exe
  C:\Windows\System\dNkJnRe.exe
  2⤵
  PID:5980
- C:\Windows\System\QrPJYYS.exe
  C:\Windows\System\QrPJYYS.exe
  2⤵
  PID:6052
- C:\Windows\System\ByMyoCC.exe
  C:\Windows\System\ByMyoCC.exe
  2⤵
  PID:6092
- C:\Windows\System\tJYbbdb.exe
  C:\Windows\System\tJYbbdb.exe
  2⤵
  PID:6132
- C:\Windows\System\kGlavcv.exe
  C:\Windows\System\kGlavcv.exe
  2⤵
  PID:5156
- C:\Windows\System\ZuswDqu.exe
  C:\Windows\System\ZuswDqu.exe
  2⤵
  PID:5916
- C:\Windows\System\wrkXlnp.exe
  C:\Windows\System\wrkXlnp.exe
  2⤵
  PID:5692
- C:\Windows\System\cxWQWtp.exe
  C:\Windows\System\cxWQWtp.exe
  2⤵
  PID:5268
- C:\Windows\System\ZqjCHHS.exe
  C:\Windows\System\ZqjCHHS.exe
  2⤵
  PID:5320
- C:\Windows\System\yosTjMa.exe
  C:\Windows\System\yosTjMa.exe
  2⤵
  PID:5544
- C:\Windows\System\GjskCqR.exe
  C:\Windows\System\GjskCqR.exe
  2⤵
  PID:5516
- C:\Windows\System\ZUDcfud.exe
  C:\Windows\System\ZUDcfud.exe
  2⤵
  PID:5700
- C:\Windows\System\tLfEiLF.exe
  C:\Windows\System\tLfEiLF.exe
  2⤵
  PID:5792
- C:\Windows\System\BqjAMFI.exe
  C:\Windows\System\BqjAMFI.exe
  2⤵
  PID:5768
- C:\Windows\System\EaczPAI.exe
  C:\Windows\System\EaczPAI.exe
  2⤵
  PID:5752
- C:\Windows\System\wEKHHyX.exe
  C:\Windows\System\wEKHHyX.exe
  2⤵
  PID:5736
- C:\Windows\System\bsKimhc.exe
  C:\Windows\System\bsKimhc.exe
  2⤵
  PID:5716
- C:\Windows\System\XbuWOdv.exe
  C:\Windows\System\XbuWOdv.exe
  2⤵
  PID:5388
- C:\Windows\System\ZEffgnI.exe
  C:\Windows\System\ZEffgnI.exe
  2⤵
  PID:5852
- C:\Windows\System\sjCYiJj.exe
  C:\Windows\System\sjCYiJj.exe
  2⤵
  PID:5596
- C:\Windows\System\gEuddqx.exe
  C:\Windows\System\gEuddqx.exe
  2⤵
  PID:5964
- C:\Windows\System\UQGrvbT.exe
  C:\Windows\System\UQGrvbT.exe
  2⤵
  PID:6004
- C:\Windows\System\AWdAobw.exe
  C:\Windows\System\AWdAobw.exe
  2⤵
  PID:5816
- C:\Windows\System\yIQCagu.exe
  C:\Windows\System\yIQCagu.exe
  2⤵
  PID:5464
- C:\Windows\System\VDVyWdk.exe
  C:\Windows\System\VDVyWdk.exe
  2⤵
  PID:5224
- C:\Windows\System\kiuzsxT.exe
  C:\Windows\System\kiuzsxT.exe
  2⤵
  PID:5824
- C:\Windows\System\mBxiOZc.exe
  C:\Windows\System\mBxiOZc.exe
  2⤵
  PID:5344
- C:\Windows\System\ktTpyVB.exe
  C:\Windows\System\ktTpyVB.exe
  2⤵
  PID:5468
- C:\Windows\System\dGfvEpr.exe
  C:\Windows\System\dGfvEpr.exe
  2⤵
  PID:5672
- C:\Windows\System\eGoqhcg.exe
  C:\Windows\System\eGoqhcg.exe
  2⤵
  PID:5900
- C:\Windows\System\oYwkSRg.exe
  C:\Windows\System\oYwkSRg.exe
  2⤵
  PID:5476
- C:\Windows\System\NhpXCtw.exe
  C:\Windows\System\NhpXCtw.exe
  2⤵
  PID:5584
- C:\Windows\System\xnOcvAn.exe
  C:\Windows\System\xnOcvAn.exe
  2⤵
  PID:5836
- C:\Windows\System\uoRrwmJ.exe
  C:\Windows\System\uoRrwmJ.exe
  2⤵
  PID:6100
- C:\Windows\System\mXICsnc.exe
  C:\Windows\System\mXICsnc.exe
  2⤵
  PID:6088
- C:\Windows\System\reAxojG.exe
  C:\Windows\System\reAxojG.exe
  2⤵
  PID:5604
- C:\Windows\System\cLcRAAx.exe
  C:\Windows\System\cLcRAAx.exe
  2⤵
  PID:5660
- C:\Windows\System\YyYpPPD.exe
  C:\Windows\System\YyYpPPD.exe
  2⤵
  PID:5740
- C:\Windows\System\tKKQYOI.exe
  C:\Windows\System\tKKQYOI.exe
  2⤵
  PID:5784
- C:\Windows\System\lhmuqpH.exe
  C:\Windows\System\lhmuqpH.exe
  2⤵
  PID:6032
- C:\Windows\System\upCSYVq.exe
  C:\Windows\System\upCSYVq.exe
  2⤵
  PID:5796
- C:\Windows\System\MSkjPLW.exe
  C:\Windows\System\MSkjPLW.exe
  2⤵
  PID:5380
- C:\Windows\System\GUdJhpW.exe
  C:\Windows\System\GUdJhpW.exe
  2⤵
  PID:5428
- C:\Windows\System\aWTICst.exe
  C:\Windows\System\aWTICst.exe
  2⤵
  PID:5756
- C:\Windows\System\qmgOiZs.exe
  C:\Windows\System\qmgOiZs.exe
  2⤵
  PID:5296
- C:\Windows\System\LseaFZG.exe
  C:\Windows\System\LseaFZG.exe
  2⤵
  PID:5044
- C:\Windows\System\wkjpFrg.exe
  C:\Windows\System\wkjpFrg.exe
  2⤵
  PID:5484
- C:\Windows\System\gqFaEAT.exe
  C:\Windows\System\gqFaEAT.exe
  2⤵
  PID:5284
- C:\Windows\System\bfacWFf.exe
  C:\Windows\System\bfacWFf.exe
  2⤵
  PID:5540
- C:\Windows\System\ifdTcOu.exe
  C:\Windows\System\ifdTcOu.exe
  2⤵
  PID:5460
- C:\Windows\System\nXVvaaV.exe
  C:\Windows\System\nXVvaaV.exe
  2⤵
  PID:5144
- C:\Windows\System\pmTlLOq.exe
  C:\Windows\System\pmTlLOq.exe
  2⤵
  PID:5372
- C:\Windows\System\lRlUbSy.exe
  C:\Windows\System\lRlUbSy.exe
  2⤵
  PID:5696
- C:\Windows\System\HuCYneB.exe
  C:\Windows\System\HuCYneB.exe
  2⤵
  PID:5324
- C:\Windows\System\efvTxyy.exe
  C:\Windows\System\efvTxyy.exe
  2⤵
  PID:5708
- C:\Windows\System\iqPEtol.exe
  C:\Windows\System\iqPEtol.exe
  2⤵
  PID:6064
- C:\Windows\System\guvwqwH.exe
  C:\Windows\System\guvwqwH.exe
  2⤵
  PID:5504
- C:\Windows\System\plswbmQ.exe
  C:\Windows\System\plswbmQ.exe
  2⤵
  PID:5976
- C:\Windows\System\oBVaAEY.exe
  C:\Windows\System\oBVaAEY.exe
  2⤵
  PID:6116
- C:\Windows\System\fDIDNHG.exe
  C:\Windows\System\fDIDNHG.exe
  2⤵
  PID:5840
- C:\Windows\System\BzbyolS.exe
  C:\Windows\System\BzbyolS.exe
  2⤵
  PID:5588
- C:\Windows\System\qXLwswy.exe
  C:\Windows\System\qXLwswy.exe
  2⤵
  PID:5712
- C:\Windows\System\odjNYQn.exe
  C:\Windows\System\odjNYQn.exe
  2⤵
  PID:240
- C:\Windows\System\NrUFNDo.exe
  C:\Windows\System\NrUFNDo.exe
  2⤵
  PID:5640
- C:\Windows\System\Mtanshu.exe
  C:\Windows\System\Mtanshu.exe
  2⤵
  PID:5328
- C:\Windows\System\zFXtaEi.exe
  C:\Windows\System\zFXtaEi.exe
  2⤵
  PID:6152
- C:\Windows\System\OYeaNpI.exe
  C:\Windows\System\OYeaNpI.exe
  2⤵
  PID:6168
- C:\Windows\System\fupFISV.exe
  C:\Windows\System\fupFISV.exe
  2⤵
  PID:6184
- C:\Windows\System\ogbuikl.exe
  C:\Windows\System\ogbuikl.exe
  2⤵
  PID:6200
- C:\Windows\System\zMTmFmT.exe
  C:\Windows\System\zMTmFmT.exe
  2⤵
  PID:6216
- C:\Windows\System\UqCzvUA.exe
  C:\Windows\System\UqCzvUA.exe
  2⤵
  PID:6232
- C:\Windows\System\xamCEKo.exe
  C:\Windows\System\xamCEKo.exe
  2⤵
  PID:6252
- C:\Windows\System\JHHJasq.exe
  C:\Windows\System\JHHJasq.exe
  2⤵
  PID:6268
- C:\Windows\System\AIBKqjt.exe
  C:\Windows\System\AIBKqjt.exe
  2⤵
  PID:6284
- C:\Windows\System\eyxcqaF.exe
  C:\Windows\System\eyxcqaF.exe
  2⤵
  PID:6300
- C:\Windows\System\fLougtl.exe
  C:\Windows\System\fLougtl.exe
  2⤵
  PID:6316
- C:\Windows\System\lMnFbzp.exe
  C:\Windows\System\lMnFbzp.exe
  2⤵
  PID:6336
- C:\Windows\System\CkauoNs.exe
  C:\Windows\System\CkauoNs.exe
  2⤵
  PID:6352
- C:\Windows\System\UdddwCG.exe
  C:\Windows\System\UdddwCG.exe
  2⤵
  PID:6368
- C:\Windows\System\IAeeLFt.exe
  C:\Windows\System\IAeeLFt.exe
  2⤵
  PID:6400
- C:\Windows\System\XwifaIR.exe
  C:\Windows\System\XwifaIR.exe
  2⤵
  PID:6416
- C:\Windows\System\HFjVHfi.exe
  C:\Windows\System\HFjVHfi.exe
  2⤵
  PID:6432
- C:\Windows\System\OLNEfnZ.exe
  C:\Windows\System\OLNEfnZ.exe
  2⤵
  PID:6456
- C:\Windows\System\aaQrdBw.exe
  C:\Windows\System\aaQrdBw.exe
  2⤵
  PID:6472
- C:\Windows\System\qzWidoo.exe
  C:\Windows\System\qzWidoo.exe
  2⤵
  PID:6488
- C:\Windows\System\eIBrkhD.exe
  C:\Windows\System\eIBrkhD.exe
  2⤵
  PID:6504
- C:\Windows\System\DVyqwQQ.exe
  C:\Windows\System\DVyqwQQ.exe
  2⤵
  PID:6520
- C:\Windows\System\rRgXhwy.exe
  C:\Windows\System\rRgXhwy.exe
  2⤵
  PID:6536
- C:\Windows\System\SmRWkZQ.exe
  C:\Windows\System\SmRWkZQ.exe
  2⤵
  PID:6564
- C:\Windows\System\oTBLDiE.exe
  C:\Windows\System\oTBLDiE.exe
  2⤵
  PID:6580
- C:\Windows\System\nhLkeDk.exe
  C:\Windows\System\nhLkeDk.exe
  2⤵
  PID:6596
- C:\Windows\System\xVoFROc.exe
  C:\Windows\System\xVoFROc.exe
  2⤵
  PID:6612
- C:\Windows\System\GkgAwqv.exe
  C:\Windows\System\GkgAwqv.exe
  2⤵
  PID:6628
- C:\Windows\System\lfIikEl.exe
  C:\Windows\System\lfIikEl.exe
  2⤵
  PID:6644
- C:\Windows\System\lnSNOAR.exe
  C:\Windows\System\lnSNOAR.exe
  2⤵
  PID:6660
- C:\Windows\System\PPUzPXP.exe
  C:\Windows\System\PPUzPXP.exe
  2⤵
  PID:6676
- C:\Windows\System\xomKuiS.exe
  C:\Windows\System\xomKuiS.exe
  2⤵
  PID:6692
- C:\Windows\System\NJptPzp.exe
  C:\Windows\System\NJptPzp.exe
  2⤵
  PID:6708
- C:\Windows\System\ZSvVzkJ.exe
  C:\Windows\System\ZSvVzkJ.exe
  2⤵
  PID:6724
- C:\Windows\System\YOpjIYQ.exe
  C:\Windows\System\YOpjIYQ.exe
  2⤵
  PID:6740
- C:\Windows\System\KXYVufX.exe
  C:\Windows\System\KXYVufX.exe
  2⤵
  PID:6756
- C:\Windows\System\JDSMJLp.exe
  C:\Windows\System\JDSMJLp.exe
  2⤵
  PID:6772
- C:\Windows\System\ApYXAsI.exe
  C:\Windows\System\ApYXAsI.exe
  2⤵
  PID:6788
- C:\Windows\System\ejHOJDz.exe
  C:\Windows\System\ejHOJDz.exe
  2⤵
  PID:6804
- C:\Windows\System\JllSbuP.exe
  C:\Windows\System\JllSbuP.exe
  2⤵
  PID:6820
- C:\Windows\System\UfryElx.exe
  C:\Windows\System\UfryElx.exe
  2⤵
  PID:6836
- C:\Windows\System\pBpWmYr.exe
  C:\Windows\System\pBpWmYr.exe
  2⤵
  PID:6856
- C:\Windows\System\cRGmupE.exe
  C:\Windows\System\cRGmupE.exe
  2⤵
  PID:6872
- C:\Windows\System\ePsdMaK.exe
  C:\Windows\System\ePsdMaK.exe
  2⤵
  PID:6888
- C:\Windows\System\GTzbKPN.exe
  C:\Windows\System\GTzbKPN.exe
  2⤵
  PID:6904
- C:\Windows\System\DuuoJMt.exe
  C:\Windows\System\DuuoJMt.exe
  2⤵
  PID:6920
- C:\Windows\System\SoPcYuA.exe
  C:\Windows\System\SoPcYuA.exe
  2⤵
  PID:6936
- C:\Windows\System\APEkdqu.exe
  C:\Windows\System\APEkdqu.exe
  2⤵
  PID:6952
- C:\Windows\System\CVrxjdn.exe
  C:\Windows\System\CVrxjdn.exe
  2⤵
  PID:6968
- C:\Windows\System\tfNqXwg.exe
  C:\Windows\System\tfNqXwg.exe
  2⤵
  PID:6984
- C:\Windows\System\uohRmen.exe
  C:\Windows\System\uohRmen.exe
  2⤵
  PID:7000
- C:\Windows\System\pjclmsB.exe
  C:\Windows\System\pjclmsB.exe
  2⤵
  PID:7016
- C:\Windows\System\cNOFFAu.exe
  C:\Windows\System\cNOFFAu.exe
  2⤵
  PID:7032
- C:\Windows\System\EhdsmzF.exe
  C:\Windows\System\EhdsmzF.exe
  2⤵
  PID:7048
- C:\Windows\System\imDLelL.exe
  C:\Windows\System\imDLelL.exe
  2⤵
  PID:7064
- C:\Windows\System\ncniwUo.exe
  C:\Windows\System\ncniwUo.exe
  2⤵
  PID:7080
- C:\Windows\System\zJmhpSZ.exe
  C:\Windows\System\zJmhpSZ.exe
  2⤵
  PID:7096
- C:\Windows\System\ntackqE.exe
  C:\Windows\System\ntackqE.exe
  2⤵
  PID:7112
- C:\Windows\System\ZoLuXdj.exe
  C:\Windows\System\ZoLuXdj.exe
  2⤵
  PID:7128
- C:\Windows\System\KJJdWvL.exe
  C:\Windows\System\KJJdWvL.exe
  2⤵
  PID:7144
- C:\Windows\System\CRlMmBd.exe
  C:\Windows\System\CRlMmBd.exe
  2⤵
  PID:7160
- C:\Windows\System\PuuijRH.exe
  C:\Windows\System\PuuijRH.exe
  2⤵
  PID:6068
- C:\Windows\System\tDJxtUx.exe
  C:\Windows\System\tDJxtUx.exe
  2⤵
  PID:6164
- C:\Windows\System\NLgkEww.exe
  C:\Windows\System\NLgkEww.exe
  2⤵
  PID:6212
- C:\Windows\System\WOEFCqs.exe
  C:\Windows\System\WOEFCqs.exe
  2⤵
  PID:6244
- C:\Windows\System\uPDMqYs.exe
  C:\Windows\System\uPDMqYs.exe
  2⤵
  PID:6276
- C:\Windows\System\nJGNhLH.exe
  C:\Windows\System\nJGNhLH.exe
  2⤵
  PID:6260
- C:\Windows\System\YZFSTqP.exe
  C:\Windows\System\YZFSTqP.exe
  2⤵
  PID:6344
- C:\Windows\System\zLpnPxh.exe
  C:\Windows\System\zLpnPxh.exe
  2⤵
  PID:6332
- C:\Windows\System\nxJkIfW.exe
  C:\Windows\System\nxJkIfW.exe
  2⤵
  PID:6364
- C:\Windows\System\PXIlcsd.exe
  C:\Windows\System\PXIlcsd.exe
  2⤵
  PID:6396
- C:\Windows\System\zqeWNkU.exe
  C:\Windows\System\zqeWNkU.exe
  2⤵
  PID:6408
- C:\Windows\System\ynTWGnV.exe
  C:\Windows\System\ynTWGnV.exe
  2⤵
  PID:6444
- C:\Windows\System\gStOjJv.exe
  C:\Windows\System\gStOjJv.exe
  2⤵
  PID:6484
- C:\Windows\System\mjFTKDO.exe
  C:\Windows\System\mjFTKDO.exe
  2⤵
  PID:6512
- C:\Windows\System\JQMjGoI.exe
  C:\Windows\System\JQMjGoI.exe
  2⤵
  PID:6548
- C:\Windows\System\KwEmDVm.exe
  C:\Windows\System\KwEmDVm.exe
  2⤵
  PID:6576
- C:\Windows\System\VRroPeO.exe
  C:\Windows\System\VRroPeO.exe
  2⤵
  PID:6604
- C:\Windows\System\PofZrGu.exe
  C:\Windows\System\PofZrGu.exe
  2⤵
  PID:6700
- C:\Windows\System\eFmXvoD.exe
  C:\Windows\System\eFmXvoD.exe
  2⤵
  PID:6560
- C:\Windows\System\XHpyXik.exe
  C:\Windows\System\XHpyXik.exe
  2⤵
  PID:6684
- C:\Windows\System\RwCyOUj.exe
  C:\Windows\System\RwCyOUj.exe
  2⤵
  PID:6732
- C:\Windows\System\nPWFthF.exe
  C:\Windows\System\nPWFthF.exe
  2⤵
  PID:6768
- C:\Windows\System\ILDMHVe.exe
  C:\Windows\System\ILDMHVe.exe
  2⤵
  PID:6828
- C:\Windows\System\rWExtUQ.exe
  C:\Windows\System\rWExtUQ.exe
  2⤵
  PID:6784
- C:\Windows\System\FSsZGjo.exe
  C:\Windows\System\FSsZGjo.exe
  2⤵
  PID:6896
- C:\Windows\System\kVcIzRh.exe
  C:\Windows\System\kVcIzRh.exe
  2⤵
  PID:6912
- C:\Windows\System\IYJVypJ.exe
  C:\Windows\System\IYJVypJ.exe
  2⤵
  PID:6884
- C:\Windows\System\dtOYMNH.exe
  C:\Windows\System\dtOYMNH.exe
  2⤵
  PID:6996
- C:\Windows\System\pAPsGdB.exe
  C:\Windows\System\pAPsGdB.exe
  2⤵
  PID:6976
- C:\Windows\System\AetONqH.exe
  C:\Windows\System\AetONqH.exe
  2⤵
  PID:7040
- C:\Windows\System\LKfGeVq.exe
  C:\Windows\System\LKfGeVq.exe
  2⤵
  PID:7072
- C:\Windows\System\imoZcQn.exe
  C:\Windows\System\imoZcQn.exe
  2⤵
  PID:7124
- C:\Windows\System\quwvIwI.exe
  C:\Windows\System\quwvIwI.exe
  2⤵
  PID:7076
- C:\Windows\System\kATfLDc.exe
  C:\Windows\System\kATfLDc.exe
  2⤵
  PID:7140
- C:\Windows\System\bTRmoXm.exe
  C:\Windows\System\bTRmoXm.exe
  2⤵
  PID:6148
- C:\Windows\System\QiGUIyN.exe
  C:\Windows\System\QiGUIyN.exe
  2⤵
  PID:5624
- C:\Windows\System\ByOCOVv.exe
  C:\Windows\System\ByOCOVv.exe
  2⤵
  PID:6312
- C:\Windows\System\LflZhNb.exe
  C:\Windows\System\LflZhNb.exe
  2⤵
  PID:6296
- C:\Windows\System\gyKKGMs.exe
  C:\Windows\System\gyKKGMs.exe
  2⤵
  PID:6376
- C:\Windows\System\cNbyEWo.exe
  C:\Windows\System\cNbyEWo.exe
  2⤵
  PID:6464
- C:\Windows\System\ojoGZQU.exe
  C:\Windows\System\ojoGZQU.exe
  2⤵
  PID:6480
- C:\Windows\System\UAZPySG.exe
  C:\Windows\System\UAZPySG.exe
  2⤵
  PID:6572
- C:\Windows\System\nXQxSOK.exe
  C:\Windows\System\nXQxSOK.exe
  2⤵
  PID:6624
- C:\Windows\System\JFYrAkc.exe
  C:\Windows\System\JFYrAkc.exe
  2⤵
  PID:6752
- C:\Windows\System\WsUKekp.exe
  C:\Windows\System\WsUKekp.exe
  2⤵
  PID:6736
- C:\Windows\System\JaAittY.exe
  C:\Windows\System\JaAittY.exe
  2⤵
  PID:6928
- C:\Windows\System\qQuFMAv.exe
  C:\Windows\System\qQuFMAv.exe
  2⤵
  PID:6964
- C:\Windows\System\zfKjAtR.exe
  C:\Windows\System\zfKjAtR.exe
  2⤵
  PID:6992
- C:\Windows\System\mOTPjLV.exe
  C:\Windows\System\mOTPjLV.exe
  2⤵
  PID:7028
- C:\Windows\System\wyDkqCh.exe
  C:\Windows\System\wyDkqCh.exe
  2⤵
  PID:7060
- C:\Windows\System\cFhbgYa.exe
  C:\Windows\System\cFhbgYa.exe
  2⤵
  PID:7120
- C:\Windows\System\uzGwYpu.exe
  C:\Windows\System\uzGwYpu.exe
  2⤵
  PID:6180
- C:\Windows\System\hQPAwnd.exe
  C:\Windows\System\hQPAwnd.exe
  2⤵
  PID:6468
- C:\Windows\System\GcqAGRG.exe
  C:\Windows\System\GcqAGRG.exe
  2⤵
  PID:6716
- C:\Windows\System\JgwbjHz.exe
  C:\Windows\System\JgwbjHz.exe
  2⤵
  PID:6308
- C:\Windows\System\vCksuHc.exe
  C:\Windows\System\vCksuHc.exe
  2⤵
  PID:6392
- C:\Windows\System\HPMNtHe.exe
  C:\Windows\System\HPMNtHe.exe
  2⤵
  PID:6620
- C:\Windows\System\XCkakgk.exe
  C:\Windows\System\XCkakgk.exe
  2⤵
  PID:6880
- C:\Windows\System\pJSCCXJ.exe
  C:\Windows\System\pJSCCXJ.exe
  2⤵
  PID:7136
- C:\Windows\System\hsFqhIE.exe
  C:\Windows\System\hsFqhIE.exe
  2⤵
  PID:6048
- C:\Windows\System\Zyyqgsq.exe
  C:\Windows\System\Zyyqgsq.exe
  2⤵
  PID:6656
- C:\Windows\System\BqJbogR.exe
  C:\Windows\System\BqJbogR.exe
  2⤵
  PID:6248
- C:\Windows\System\AaoBlbv.exe
  C:\Windows\System\AaoBlbv.exe
  2⤵
  PID:6916
- C:\Windows\System\gQyyfby.exe
  C:\Windows\System\gQyyfby.exe
  2⤵
  PID:6932
- C:\Windows\System\ebsxwcq.exe
  C:\Windows\System\ebsxwcq.exe
  2⤵
  PID:6532
- C:\Windows\System\hOrpAzH.exe
  C:\Windows\System\hOrpAzH.exe
  2⤵
  PID:7156
- C:\Windows\System\wfwYVje.exe
  C:\Windows\System\wfwYVje.exe
  2⤵
  PID:6348
- C:\Windows\System\NHFGwSa.exe
  C:\Windows\System\NHFGwSa.exe
  2⤵
  PID:7184
- C:\Windows\System\bpolvSp.exe
  C:\Windows\System\bpolvSp.exe
  2⤵
  PID:7200
- C:\Windows\System\ZxirVXT.exe
  C:\Windows\System\ZxirVXT.exe
  2⤵
  PID:7216
- C:\Windows\System\AyVseaE.exe
  C:\Windows\System\AyVseaE.exe
  2⤵
  PID:7232
- C:\Windows\System\sUySqYN.exe
  C:\Windows\System\sUySqYN.exe
  2⤵
  PID:7248
- C:\Windows\System\XoZlrEr.exe
  C:\Windows\System\XoZlrEr.exe
  2⤵
  PID:7264
- C:\Windows\System\hcutaUi.exe
  C:\Windows\System\hcutaUi.exe
  2⤵
  PID:7280
- C:\Windows\System\LXrCAAD.exe
  C:\Windows\System\LXrCAAD.exe
  2⤵
  PID:7296
- C:\Windows\System\xLCzBKX.exe
  C:\Windows\System\xLCzBKX.exe
  2⤵
  PID:7312
- C:\Windows\System\MzjjgwB.exe
  C:\Windows\System\MzjjgwB.exe
  2⤵
  PID:7328
- C:\Windows\System\kQADnJp.exe
  C:\Windows\System\kQADnJp.exe
  2⤵
  PID:7344
- C:\Windows\System\RFDpmnS.exe
  C:\Windows\System\RFDpmnS.exe
  2⤵
  PID:7360
- C:\Windows\System\wxtRzYI.exe
  C:\Windows\System\wxtRzYI.exe
  2⤵
  PID:7376
- C:\Windows\System\OPmXNvW.exe
  C:\Windows\System\OPmXNvW.exe
  2⤵
  PID:7392
- C:\Windows\System\XfKxQZB.exe
  C:\Windows\System\XfKxQZB.exe
  2⤵
  PID:7412
- C:\Windows\System\DEYRsqB.exe
  C:\Windows\System\DEYRsqB.exe
  2⤵
  PID:7428
- C:\Windows\System\QxkbVbh.exe
  C:\Windows\System\QxkbVbh.exe
  2⤵
  PID:7444
- C:\Windows\System\WjmQtQW.exe
  C:\Windows\System\WjmQtQW.exe
  2⤵
  PID:7460
- C:\Windows\System\teSVdYA.exe
  C:\Windows\System\teSVdYA.exe
  2⤵
  PID:7476
- C:\Windows\System\rKxbGTY.exe
  C:\Windows\System\rKxbGTY.exe
  2⤵
  PID:7492
- C:\Windows\System\FayCXyr.exe
  C:\Windows\System\FayCXyr.exe
  2⤵
  PID:7508
- C:\Windows\System\QQIZnjz.exe
  C:\Windows\System\QQIZnjz.exe
  2⤵
  PID:7524
- C:\Windows\System\NYKFTxA.exe
  C:\Windows\System\NYKFTxA.exe
  2⤵
  PID:7540
- C:\Windows\System\FrLfcgI.exe
  C:\Windows\System\FrLfcgI.exe
  2⤵
  PID:7556
- C:\Windows\System\hGPabim.exe
  C:\Windows\System\hGPabim.exe
  2⤵
  PID:7572
- C:\Windows\System\WcLuNTj.exe
  C:\Windows\System\WcLuNTj.exe
  2⤵
  PID:7588
- C:\Windows\System\JZEPUyo.exe
  C:\Windows\System\JZEPUyo.exe
  2⤵
  PID:7604
- C:\Windows\System\gbSAeFE.exe
  C:\Windows\System\gbSAeFE.exe
  2⤵
  PID:7620
- C:\Windows\System\JTLukna.exe
  C:\Windows\System\JTLukna.exe
  2⤵
  PID:7636
- C:\Windows\System\PBwOvmX.exe
  C:\Windows\System\PBwOvmX.exe
  2⤵
  PID:7652
- C:\Windows\System\WmHUlMl.exe
  C:\Windows\System\WmHUlMl.exe
  2⤵
  PID:7668
- C:\Windows\System\wLDVXQb.exe
  C:\Windows\System\wLDVXQb.exe
  2⤵
  PID:7684
- C:\Windows\System\fndTbaR.exe
  C:\Windows\System\fndTbaR.exe
  2⤵
  PID:7700
- C:\Windows\System\wscWxJn.exe
  C:\Windows\System\wscWxJn.exe
  2⤵
  PID:7716
- C:\Windows\System\YKBkaVf.exe
  C:\Windows\System\YKBkaVf.exe
  2⤵
  PID:7732
- C:\Windows\System\mRQIIPF.exe
  C:\Windows\System\mRQIIPF.exe
  2⤵
  PID:7748
- C:\Windows\System\VtkjCpo.exe
  C:\Windows\System\VtkjCpo.exe
  2⤵
  PID:7764
- C:\Windows\System\kasWdir.exe
  C:\Windows\System\kasWdir.exe
  2⤵
  PID:7780
- C:\Windows\System\aErNpLp.exe
  C:\Windows\System\aErNpLp.exe
  2⤵
  PID:7796
- C:\Windows\System\SiJaxCV.exe
  C:\Windows\System\SiJaxCV.exe
  2⤵
  PID:7812
- C:\Windows\System\ZtWbaxZ.exe
  C:\Windows\System\ZtWbaxZ.exe
  2⤵
  PID:7828
- C:\Windows\System\ZQnQDuc.exe
  C:\Windows\System\ZQnQDuc.exe
  2⤵
  PID:7844
- C:\Windows\System\rFtplZl.exe
  C:\Windows\System\rFtplZl.exe
  2⤵
  PID:7860
- C:\Windows\System\boBqiIq.exe
  C:\Windows\System\boBqiIq.exe
  2⤵
  PID:7876
- C:\Windows\System\htZxamn.exe
  C:\Windows\System\htZxamn.exe
  2⤵
  PID:7892
- C:\Windows\System\JLFSovd.exe
  C:\Windows\System\JLFSovd.exe
  2⤵
  PID:7908
- C:\Windows\System\xvoQrII.exe
  C:\Windows\System\xvoQrII.exe
  2⤵
  PID:7924
- C:\Windows\System\aFJVzIQ.exe
  C:\Windows\System\aFJVzIQ.exe
  2⤵
  PID:7944
- C:\Windows\System\XBZbXLJ.exe
  C:\Windows\System\XBZbXLJ.exe
  2⤵
  PID:7960
- C:\Windows\System\HstpGNu.exe
  C:\Windows\System\HstpGNu.exe
  2⤵
  PID:7976
- C:\Windows\System\MNCOugJ.exe
  C:\Windows\System\MNCOugJ.exe
  2⤵
  PID:7992
- C:\Windows\System\BhECWIc.exe
  C:\Windows\System\BhECWIc.exe
  2⤵
  PID:8008
- C:\Windows\System\sVBfsIf.exe
  C:\Windows\System\sVBfsIf.exe
  2⤵
  PID:8024
- C:\Windows\System\uwUbHEn.exe
  C:\Windows\System\uwUbHEn.exe
  2⤵
  PID:8040
- C:\Windows\System\sRiytsA.exe
  C:\Windows\System\sRiytsA.exe
  2⤵
  PID:8056
- C:\Windows\System\VWkNsiI.exe
  C:\Windows\System\VWkNsiI.exe
  2⤵
  PID:8076
- C:\Windows\System\UCJMnjn.exe
  C:\Windows\System\UCJMnjn.exe
  2⤵
  PID:8092
- C:\Windows\System\MVhVjSI.exe
  C:\Windows\System\MVhVjSI.exe
  2⤵
  PID:8108
- C:\Windows\System\MauCeJR.exe
  C:\Windows\System\MauCeJR.exe
  2⤵
  PID:8124
- C:\Windows\System\lrJmKwD.exe
  C:\Windows\System\lrJmKwD.exe
  2⤵
  PID:8140
- C:\Windows\System\lOTHRcD.exe
  C:\Windows\System\lOTHRcD.exe
  2⤵
  PID:8160
- C:\Windows\System\NUKjbEo.exe
  C:\Windows\System\NUKjbEo.exe
  2⤵
  PID:8176
- C:\Windows\System\cmqnlnj.exe
  C:\Windows\System\cmqnlnj.exe
  2⤵
  PID:6780
- C:\Windows\System\eksSGdS.exe
  C:\Windows\System\eksSGdS.exe
  2⤵
  PID:7208
- C:\Windows\System\hPMjZTe.exe
  C:\Windows\System\hPMjZTe.exe
  2⤵
  PID:7224
- C:\Windows\System\fbXAUUu.exe
  C:\Windows\System\fbXAUUu.exe
  2⤵
  PID:7260
- C:\Windows\System\ZrNgabg.exe
  C:\Windows\System\ZrNgabg.exe
  2⤵
  PID:7288
- C:\Windows\System\APXaETP.exe
  C:\Windows\System\APXaETP.exe
  2⤵
  PID:7336
- C:\Windows\System\wjOUMjB.exe
  C:\Windows\System\wjOUMjB.exe
  2⤵
  PID:7400
- C:\Windows\System\PCWMwOj.exe
  C:\Windows\System\PCWMwOj.exe
  2⤵
  PID:7320
- C:\Windows\System\bYJtqie.exe
  C:\Windows\System\bYJtqie.exe
  2⤵
  PID:7352
- C:\Windows\System\GJANrMc.exe
  C:\Windows\System\GJANrMc.exe
  2⤵
  PID:7468
- C:\Windows\System\HNfQCZY.exe
  C:\Windows\System\HNfQCZY.exe
  2⤵
  PID:7536
- C:\Windows\System\iKNGhrF.exe
  C:\Windows\System\iKNGhrF.exe
  2⤵
  PID:7596
- C:\Windows\System\vEPxxPx.exe
  C:\Windows\System\vEPxxPx.exe
  2⤵
  PID:7664
- C:\Windows\System\OpysFwg.exe
  C:\Windows\System\OpysFwg.exe
  2⤵
  PID:7584
- C:\Windows\System\gwJvzfU.exe
  C:\Windows\System\gwJvzfU.exe
  2⤵
  PID:7520
- C:\Windows\System\PyvfwWl.exe
  C:\Windows\System\PyvfwWl.exe
  2⤵
  PID:7488
- C:\Windows\System\jCRpDGw.exe
  C:\Windows\System\jCRpDGw.exe
  2⤵
  PID:7552
- C:\Windows\System\yhGCthV.exe
  C:\Windows\System\yhGCthV.exe
  2⤵
  PID:7648
- C:\Windows\System\kXFQtCm.exe
  C:\Windows\System\kXFQtCm.exe
  2⤵
  PID:7776
- C:\Windows\System\ZftURAu.exe
  C:\Windows\System\ZftURAu.exe
  2⤵
  PID:7792
- C:\Windows\System\WWmUdrA.exe
  C:\Windows\System\WWmUdrA.exe
  2⤵
  PID:7808
- C:\Windows\System\NBZGkjU.exe
  C:\Windows\System\NBZGkjU.exe
  2⤵
  PID:7840
- C:\Windows\System\pPzWhPP.exe
  C:\Windows\System\pPzWhPP.exe
  2⤵
  PID:7920
- C:\Windows\System\HtchhxZ.exe
  C:\Windows\System\HtchhxZ.exe
  2⤵
  PID:6704
- C:\Windows\System\SUlHYGp.exe
  C:\Windows\System\SUlHYGp.exe
  2⤵
  PID:7968
- C:\Windows\System\IrRIyan.exe
  C:\Windows\System\IrRIyan.exe
  2⤵
  PID:7972
- C:\Windows\System\SmmEdgw.exe
  C:\Windows\System\SmmEdgw.exe
  2⤵
  PID:8048
- C:\Windows\System\ABybNVm.exe
  C:\Windows\System\ABybNVm.exe
  2⤵
  PID:8116
- C:\Windows\System\QCCikRO.exe
  C:\Windows\System\QCCikRO.exe
  2⤵
  PID:8152
- C:\Windows\System\mgbzZfl.exe
  C:\Windows\System\mgbzZfl.exe
  2⤵
  PID:8100
- C:\Windows\System\rtpPQhm.exe
  C:\Windows\System\rtpPQhm.exe
  2⤵
  PID:8064
- C:\Windows\System\kbphCFd.exe
  C:\Windows\System\kbphCFd.exe
  2⤵
  PID:8136
- C:\Windows\System\AHpxtzk.exe
  C:\Windows\System\AHpxtzk.exe
  2⤵
  PID:6588
- C:\Windows\System\etMKKkS.exe
  C:\Windows\System\etMKKkS.exe
  2⤵
  PID:7372
- C:\Windows\System\TXUCVwT.exe
  C:\Windows\System\TXUCVwT.exe
  2⤵
  PID:7192
- C:\Windows\System\EDthRgP.exe
  C:\Windows\System\EDthRgP.exe
  2⤵
  PID:7308
- C:\Windows\System\crzbHAt.exe
  C:\Windows\System\crzbHAt.exe
  2⤵
  PID:7440
- C:\Windows\System\JoEOlLs.exe
  C:\Windows\System\JoEOlLs.exe
  2⤵
  PID:7568
- C:\Windows\System\cXMKdbV.exe
  C:\Windows\System\cXMKdbV.exe
  2⤵
  PID:7660
- C:\Windows\System\ncSOPxV.exe
  C:\Windows\System\ncSOPxV.exe
  2⤵
  PID:7708
- C:\Windows\System\QssXCVG.exe
  C:\Windows\System\QssXCVG.exe
  2⤵
  PID:7612
- C:\Windows\System\bHtmxmO.exe
  C:\Windows\System\bHtmxmO.exe
  2⤵
  PID:7728
- C:\Windows\System\WuJNujO.exe
  C:\Windows\System\WuJNujO.exe
  2⤵
  PID:7872
- C:\Windows\System\GGctUxp.exe
  C:\Windows\System\GGctUxp.exe
  2⤵
  PID:7884
- C:\Windows\System\kxOPAsj.exe
  C:\Windows\System\kxOPAsj.exe
  2⤵
  PID:7988
- C:\Windows\System\bAhbKOF.exe
  C:\Windows\System\bAhbKOF.exe
  2⤵
  PID:8148
- C:\Windows\System\KdDSfrV.exe
  C:\Windows\System\KdDSfrV.exe
  2⤵
  PID:8184
- C:\Windows\System\wHYrvEH.exe
  C:\Windows\System\wHYrvEH.exe
  2⤵
  PID:8088
- C:\Windows\System\nwKxJbK.exe
  C:\Windows\System\nwKxJbK.exe
  2⤵
  PID:7228
- C:\Windows\System\aDsZiBW.exe
  C:\Windows\System\aDsZiBW.exe
  2⤵
  PID:7388
- C:\Windows\System\DiifAbL.exe
  C:\Windows\System\DiifAbL.exe
  2⤵
  PID:7632
- C:\Windows\System\TVGgTOF.exe
  C:\Windows\System\TVGgTOF.exe
  2⤵
  PID:7712
- C:\Windows\System\kQqWyrO.exe
  C:\Windows\System\kQqWyrO.exe
  2⤵
  PID:7772
- C:\Windows\System\xFyeviA.exe
  C:\Windows\System\xFyeviA.exe
  2⤵
  PID:7788
- C:\Windows\System\wlGEdWj.exe
  C:\Windows\System\wlGEdWj.exe
  2⤵
  PID:7856
- C:\Windows\System\MdVmfem.exe
  C:\Windows\System\MdVmfem.exe
  2⤵
  PID:8104
- C:\Windows\System\CIxSYmT.exe
  C:\Windows\System\CIxSYmT.exe
  2⤵
  PID:8020
- C:\Windows\System\vyRXWVg.exe
  C:\Windows\System\vyRXWVg.exe
  2⤵
  PID:8072
- C:\Windows\System\bdqLUMA.exe
  C:\Windows\System\bdqLUMA.exe
  2⤵
  PID:7616
- C:\Windows\System\uRsgkPs.exe
  C:\Windows\System\uRsgkPs.exe
  2⤵
  PID:8068
- C:\Windows\System\IjKYrvR.exe
  C:\Windows\System\IjKYrvR.exe
  2⤵
  PID:7952
- C:\Windows\System\DYefyfS.exe
  C:\Windows\System\DYefyfS.exe
  2⤵
  PID:7580
- C:\Windows\System\TpHSbEa.exe
  C:\Windows\System\TpHSbEa.exe
  2⤵
  PID:8188
- C:\Windows\System\EsJDsvF.exe
  C:\Windows\System\EsJDsvF.exe
  2⤵
  PID:7436
- C:\Windows\System\UUicccS.exe
  C:\Windows\System\UUicccS.exe
  2⤵
  PID:8208
- C:\Windows\System\JPXnHkr.exe
  C:\Windows\System\JPXnHkr.exe
  2⤵
  PID:8224
- C:\Windows\System\ArVhbaC.exe
  C:\Windows\System\ArVhbaC.exe
  2⤵
  PID:8240
- C:\Windows\System\kchSaeh.exe
  C:\Windows\System\kchSaeh.exe
  2⤵
  PID:8256
- C:\Windows\System\PevArWy.exe
  C:\Windows\System\PevArWy.exe
  2⤵
  PID:8272
- C:\Windows\System\UIpJvGO.exe
  C:\Windows\System\UIpJvGO.exe
  2⤵
  PID:8288
- C:\Windows\System\mDxtXhT.exe
  C:\Windows\System\mDxtXhT.exe
  2⤵
  PID:8304
- C:\Windows\System\ekIuXmj.exe
  C:\Windows\System\ekIuXmj.exe
  2⤵
  PID:8320
- C:\Windows\System\hsCxFld.exe
  C:\Windows\System\hsCxFld.exe
  2⤵
  PID:8336
- C:\Windows\System\GdoKCgZ.exe
  C:\Windows\System\GdoKCgZ.exe
  2⤵
  PID:8352
- C:\Windows\System\SQsiFHk.exe
  C:\Windows\System\SQsiFHk.exe
  2⤵
  PID:8368
- C:\Windows\System\azHwaxu.exe
  C:\Windows\System\azHwaxu.exe
  2⤵
  PID:8384
- C:\Windows\System\xsJiPwB.exe
  C:\Windows\System\xsJiPwB.exe
  2⤵
  PID:8400
- C:\Windows\System\mYzXCCg.exe
  C:\Windows\System\mYzXCCg.exe
  2⤵
  PID:8416
- C:\Windows\System\eoJrfZh.exe
  C:\Windows\System\eoJrfZh.exe
  2⤵
  PID:8432
- C:\Windows\System\kcZEyOj.exe
  C:\Windows\System\kcZEyOj.exe
  2⤵
  PID:8448
- C:\Windows\System\rRlONAm.exe
  C:\Windows\System\rRlONAm.exe
  2⤵
  PID:8464
- C:\Windows\System\zLepmjL.exe
  C:\Windows\System\zLepmjL.exe
  2⤵
  PID:8480
- C:\Windows\System\EAGODCG.exe
  C:\Windows\System\EAGODCG.exe
  2⤵
  PID:8496
- C:\Windows\System\KtjXQzL.exe
  C:\Windows\System\KtjXQzL.exe
  2⤵
  PID:8512
- C:\Windows\System\REBJhlq.exe
  C:\Windows\System\REBJhlq.exe
  2⤵
  PID:8532
- C:\Windows\System\nnRKcoQ.exe
  C:\Windows\System\nnRKcoQ.exe
  2⤵
  PID:8548
- C:\Windows\System\oibsWUM.exe
  C:\Windows\System\oibsWUM.exe
  2⤵
  PID:8564
- C:\Windows\System\SdlqWUe.exe
  C:\Windows\System\SdlqWUe.exe
  2⤵
  PID:8580
- C:\Windows\System\XupCEEe.exe
  C:\Windows\System\XupCEEe.exe
  2⤵
  PID:8596
- C:\Windows\System\NuabAxs.exe
  C:\Windows\System\NuabAxs.exe
  2⤵
  PID:8612
- C:\Windows\System\HaaLQku.exe
  C:\Windows\System\HaaLQku.exe
  2⤵
  PID:8628
- C:\Windows\System\tozbGmy.exe
  C:\Windows\System\tozbGmy.exe
  2⤵
  PID:8644
- C:\Windows\System\CgArgtB.exe
  C:\Windows\System\CgArgtB.exe
  2⤵
  PID:8660
- C:\Windows\System\AQRfRbF.exe
  C:\Windows\System\AQRfRbF.exe
  2⤵
  PID:8680
- C:\Windows\System\ClTCgYD.exe
  C:\Windows\System\ClTCgYD.exe
  2⤵
  PID:8696
- C:\Windows\System\tVTZCCd.exe
  C:\Windows\System\tVTZCCd.exe
  2⤵
  PID:8712
- C:\Windows\System\ObwcTjz.exe
  C:\Windows\System\ObwcTjz.exe
  2⤵
  PID:8728
- C:\Windows\System\fpVOdgZ.exe
  C:\Windows\System\fpVOdgZ.exe
  2⤵
  PID:8744
- C:\Windows\System\GvtTgcA.exe
  C:\Windows\System\GvtTgcA.exe
  2⤵
  PID:8760
- C:\Windows\System\rAljcwp.exe
  C:\Windows\System\rAljcwp.exe
  2⤵
  PID:8776
- C:\Windows\System\NFpAoYD.exe
  C:\Windows\System\NFpAoYD.exe
  2⤵
  PID:8792
- C:\Windows\System\rWpxfIe.exe
  C:\Windows\System\rWpxfIe.exe
  2⤵
  PID:8808
- C:\Windows\System\huLAsFH.exe
  C:\Windows\System\huLAsFH.exe
  2⤵
  PID:8824
- C:\Windows\System\fVxfEuW.exe
  C:\Windows\System\fVxfEuW.exe
  2⤵
  PID:8840
- C:\Windows\System\GYRuOBy.exe
  C:\Windows\System\GYRuOBy.exe
  2⤵
  PID:8856
- C:\Windows\System\DCppAls.exe
  C:\Windows\System\DCppAls.exe
  2⤵
  PID:8872
- C:\Windows\System\vidTIPe.exe
  C:\Windows\System\vidTIPe.exe
  2⤵
  PID:8888
- C:\Windows\System\depcZzy.exe
  C:\Windows\System\depcZzy.exe
  2⤵
  PID:8904
- C:\Windows\System\zKhTELr.exe
  C:\Windows\System\zKhTELr.exe
  2⤵
  PID:8920
- C:\Windows\System\kXupkdP.exe
  C:\Windows\System\kXupkdP.exe
  2⤵
  PID:8936
- C:\Windows\System\JeIxifk.exe
  C:\Windows\System\JeIxifk.exe
  2⤵
  PID:8952
- C:\Windows\System\PLMUrId.exe
  C:\Windows\System\PLMUrId.exe
  2⤵
  PID:8968
- C:\Windows\System\NdhiCsQ.exe
  C:\Windows\System\NdhiCsQ.exe
  2⤵
  PID:8984
- C:\Windows\System\gyaEtEu.exe
  C:\Windows\System\gyaEtEu.exe
  2⤵
  PID:9000
- C:\Windows\System\ADkrTAA.exe
  C:\Windows\System\ADkrTAA.exe
  2⤵
  PID:9016
- C:\Windows\System\SDpiQbh.exe
  C:\Windows\System\SDpiQbh.exe
  2⤵
  PID:9032
- C:\Windows\System\CZItqlQ.exe
  C:\Windows\System\CZItqlQ.exe
  2⤵
  PID:9048
- C:\Windows\System\qdyqCbn.exe
  C:\Windows\System\qdyqCbn.exe
  2⤵
  PID:9064
- C:\Windows\System\lmxDHDw.exe
  C:\Windows\System\lmxDHDw.exe
  2⤵
  PID:9080
- C:\Windows\System\rGbhwLp.exe
  C:\Windows\System\rGbhwLp.exe
  2⤵
  PID:9096
- C:\Windows\System\fjqTBRO.exe
  C:\Windows\System\fjqTBRO.exe
  2⤵
  PID:9112
- C:\Windows\System\jfWbpzB.exe
  C:\Windows\System\jfWbpzB.exe
  2⤵
  PID:9128
- C:\Windows\System\ZPpWfPB.exe
  C:\Windows\System\ZPpWfPB.exe
  2⤵
  PID:9144
- C:\Windows\System\qbJNgsJ.exe
  C:\Windows\System\qbJNgsJ.exe
  2⤵
  PID:9160
- C:\Windows\System\mSdBRcL.exe
  C:\Windows\System\mSdBRcL.exe
  2⤵
  PID:9176
- C:\Windows\System\lIkxTbc.exe
  C:\Windows\System\lIkxTbc.exe
  2⤵
  PID:9192
- C:\Windows\System\QJRMtUm.exe
  C:\Windows\System\QJRMtUm.exe
  2⤵
  PID:9208
- C:\Windows\System\HTeTzqV.exe
  C:\Windows\System\HTeTzqV.exe
  2⤵
  PID:8204
- C:\Windows\System\MLfHBIQ.exe
  C:\Windows\System\MLfHBIQ.exe
  2⤵
  PID:7900
- C:\Windows\System\LzJmJph.exe
  C:\Windows\System\LzJmJph.exe
  2⤵
  PID:8300
- C:\Windows\System\cHqcgKt.exe
  C:\Windows\System\cHqcgKt.exe
  2⤵
  PID:7852
- C:\Windows\System\kqLbjbO.exe
  C:\Windows\System\kqLbjbO.exe
  2⤵
  PID:8312
- C:\Windows\System\wjNfYRl.exe
  C:\Windows\System\wjNfYRl.exe
  2⤵
  PID:8252
- C:\Windows\System\psQwlyE.exe
  C:\Windows\System\psQwlyE.exe
  2⤵
  PID:8440
- C:\Windows\System\PNMMubp.exe
  C:\Windows\System\PNMMubp.exe
  2⤵
  PID:8488
- C:\Windows\System\yREmBoB.exe
  C:\Windows\System\yREmBoB.exe
  2⤵
  PID:8504
- C:\Windows\System\QMQLpWn.exe
  C:\Windows\System\QMQLpWn.exe
  2⤵
  PID:8556
- C:\Windows\System\BiLSuvP.exe
  C:\Windows\System\BiLSuvP.exe
  2⤵
  PID:8540
- C:\Windows\System\ZBDEemQ.exe
  C:\Windows\System\ZBDEemQ.exe
  2⤵
  PID:8672
- C:\Windows\System\oRfZbDE.exe
  C:\Windows\System\oRfZbDE.exe
  2⤵
  PID:8704
- C:\Windows\System\BnCudJj.exe
  C:\Windows\System\BnCudJj.exe
  2⤵
  PID:8752
- C:\Windows\System\TIdnOSQ.exe
  C:\Windows\System\TIdnOSQ.exe
  2⤵
  PID:8784
- C:\Windows\System\uerFPLr.exe
  C:\Windows\System\uerFPLr.exe
  2⤵
  PID:8804
- C:\Windows\System\VRrVWUU.exe
  C:\Windows\System\VRrVWUU.exe
  2⤵
  PID:8848
- C:\Windows\System\LrXYIwk.exe
  C:\Windows\System\LrXYIwk.exe
  2⤵
  PID:8912
- C:\Windows\System\KbizHtF.exe
  C:\Windows\System\KbizHtF.exe
  2⤵
  PID:9008
- C:\Windows\System\hsRtLsA.exe
  C:\Windows\System\hsRtLsA.exe
  2⤵
  PID:9072
- C:\Windows\System\GYIgcGS.exe
  C:\Windows\System\GYIgcGS.exe
  2⤵
  PID:8928
- C:\Windows\System\CPPNpPM.exe
  C:\Windows\System\CPPNpPM.exe
  2⤵
  PID:8992
- C:\Windows\System\SVfGjPD.exe
  C:\Windows\System\SVfGjPD.exe
  2⤵
  PID:9104
- C:\Windows\System\pGeVQxu.exe
  C:\Windows\System\pGeVQxu.exe
  2⤵
  PID:9136
- C:\Windows\System\JmQsVBP.exe
  C:\Windows\System\JmQsVBP.exe
  2⤵
  PID:9200
- C:\Windows\System\YlSCqFC.exe
  C:\Windows\System\YlSCqFC.exe
  2⤵
  PID:9152
- C:\Windows\System\xtGofLp.exe
  C:\Windows\System\xtGofLp.exe
  2⤵
  PID:8788
- C:\Windows\System\XqTHGVS.exe
  C:\Windows\System\XqTHGVS.exe
  2⤵
  PID:8820
- C:\Windows\System\AdMyqyn.exe
  C:\Windows\System\AdMyqyn.exe
  2⤵
  PID:9040
- C:\Windows\System\FkZTIza.exe
  C:\Windows\System\FkZTIza.exe
  2⤵
  PID:9056
- C:\Windows\System\RIUvMQF.exe
  C:\Windows\System\RIUvMQF.exe
  2⤵
  PID:8900
- C:\Windows\System\MCDXwCF.exe
  C:\Windows\System\MCDXwCF.exe
  2⤵
  PID:9168
- C:\Windows\System\WXKhIMR.exe
  C:\Windows\System\WXKhIMR.exe
  2⤵
  PID:8036
- C:\Windows\System\UfEWLaN.exe
  C:\Windows\System\UfEWLaN.exe
  2⤵
  PID:8248
- C:\Windows\System\qOkFlAW.exe
  C:\Windows\System\qOkFlAW.exe
  2⤵
  PID:7484
- C:\Windows\System\qvjQuVR.exe
  C:\Windows\System\qvjQuVR.exe
  2⤵
  PID:8724
- C:\Windows\System\kXQXcjQ.exe
  C:\Windows\System\kXQXcjQ.exe
  2⤵
  PID:8976
- C:\Windows\System\lZKsdTf.exe
  C:\Windows\System\lZKsdTf.exe
  2⤵
  PID:8360
- C:\Windows\System\SYTFsMA.exe
  C:\Windows\System\SYTFsMA.exe
  2⤵
  PID:8944
- C:\Windows\System\YblVnLO.exe
  C:\Windows\System\YblVnLO.exe
  2⤵
  PID:8424
- C:\Windows\System\sidJWdu.exe
  C:\Windows\System\sidJWdu.exe
  2⤵
  PID:8960
- C:\Windows\System\FjrmIrW.exe
  C:\Windows\System\FjrmIrW.exe
  2⤵
  PID:8220
- C:\Windows\System\ZCsOgQH.exe
  C:\Windows\System\ZCsOgQH.exe
  2⤵
  PID:8656
- C:\Windows\System\cuuKoZK.exe
  C:\Windows\System\cuuKoZK.exe
  2⤵
  PID:8348
- C:\Windows\System\XTFzTkN.exe
  C:\Windows\System\XTFzTkN.exe
  2⤵
  PID:8576
- C:\Windows\System\YegKoqD.exe
  C:\Windows\System\YegKoqD.exe
  2⤵
  PID:8816
- C:\Windows\System\tKtTkyd.exe
  C:\Windows\System\tKtTkyd.exe
  2⤵
  PID:9124
- C:\Windows\System\DckjwfN.exe
  C:\Windows\System\DckjwfN.exe
  2⤵
  PID:9028
- C:\Windows\System\nmelqcN.exe
  C:\Windows\System\nmelqcN.exe
  2⤵
  PID:9252
- C:\Windows\System\jZhsAHl.exe
  C:\Windows\System\jZhsAHl.exe
  2⤵
  PID:8640
- C:\Windows\System\RTrhgET.exe
  C:\Windows\System\RTrhgET.exe
  2⤵
  PID:8412
- C:\Windows\System\YPHQoyt.exe
  C:\Windows\System\YPHQoyt.exe
  2⤵
  PID:8896
- C:\Windows\System\ivALOkW.exe
  C:\Windows\System\ivALOkW.exe
  2⤵
  PID:9188
- C:\Windows\System\SjKOybb.exe
  C:\Windows\System\SjKOybb.exe
  2⤵
  PID:8592
- C:\Windows\System\nlKrXky.exe
  C:\Windows\System\nlKrXky.exe
  2⤵
  PID:9272
- C:\Windows\System\JhopJAz.exe
  C:\Windows\System\JhopJAz.exe
  2⤵
  PID:8608
- C:\Windows\System\bWKBcUT.exe
  C:\Windows\System\bWKBcUT.exe
  2⤵
  PID:9276
- C:\Windows\System\gprRciz.exe
  C:\Windows\System\gprRciz.exe
  2⤵
  PID:9360
- C:\Windows\System\lCReTMk.exe
  C:\Windows\System\lCReTMk.exe
  2⤵
  PID:9524
- C:\Windows\System\QpoyfvR.exe
  C:\Windows\System\QpoyfvR.exe
  2⤵
  PID:9540
- C:\Windows\System\IHuVAdn.exe
  C:\Windows\System\IHuVAdn.exe
  2⤵
  PID:9544
- C:\Windows\System\rTfNjke.exe
  C:\Windows\System\rTfNjke.exe
  2⤵
  PID:9624
- C:\Windows\System\aAgYLGt.exe
  C:\Windows\System\aAgYLGt.exe
  2⤵
  PID:9568
- C:\Windows\System\fXntroL.exe
  C:\Windows\System\fXntroL.exe
  2⤵
  PID:9648
- C:\Windows\System\HbLoFYd.exe
  C:\Windows\System\HbLoFYd.exe
  2⤵
  PID:9608
- C:\Windows\System\ZJyqYhG.exe
  C:\Windows\System\ZJyqYhG.exe
  2⤵
  PID:9636
- C:\Windows\System\DRGQyfg.exe
  C:\Windows\System\DRGQyfg.exe
  2⤵
  PID:9664
- C:\Windows\System\UKwHXkj.exe
  C:\Windows\System\UKwHXkj.exe
  2⤵
  PID:9688
- C:\Windows\System\GRYmFDX.exe
  C:\Windows\System\GRYmFDX.exe
  2⤵
  PID:9752
- C:\Windows\System\jeJgNwt.exe
  C:\Windows\System\jeJgNwt.exe
  2⤵
  PID:9848
- C:\Windows\System\ijRENEW.exe
  C:\Windows\System\ijRENEW.exe
  2⤵
  PID:10000
- C:\Windows\System\ZRBONdV.exe
  C:\Windows\System\ZRBONdV.exe
  2⤵
  PID:9644
- C:\Windows\System\LmoWcXD.exe
  C:\Windows\System\LmoWcXD.exe
  2⤵
  PID:10044
- C:\Windows\System\GnvVIcQ.exe
  C:\Windows\System\GnvVIcQ.exe
  2⤵
  PID:9920
- C:\Windows\System\iheBtVb.exe
  C:\Windows\System\iheBtVb.exe
  2⤵
  PID:10012
- C:\Windows\System\APDDOSD.exe
  C:\Windows\System\APDDOSD.exe
  2⤵
  PID:9960
- C:\Windows\System\ByeZkEL.exe
  C:\Windows\System\ByeZkEL.exe
  2⤵
  PID:2368
- C:\Windows\System\PLeUDqy.exe
  C:\Windows\System\PLeUDqy.exe
  2⤵
  PID:10220
- C:\Windows\System\EyLQHML.exe
  C:\Windows\System\EyLQHML.exe
  2⤵
  PID:10236
- C:\Windows\System\UtJnzFm.exe
  C:\Windows\System\UtJnzFm.exe
  2⤵
  PID:1488
- C:\Windows\System\XOfPkos.exe
  C:\Windows\System\XOfPkos.exe
  2⤵
  PID:8620
- C:\Windows\System\HZaeelA.exe
  C:\Windows\System\HZaeelA.exe
  2⤵
  PID:8948
- C:\Windows\System\rpxYNGw.exe
  C:\Windows\System\rpxYNGw.exe
  2⤵
  PID:9260
- C:\Windows\System\SRcYdLO.exe
  C:\Windows\System\SRcYdLO.exe
  2⤵
  PID:1956
- C:\Windows\System\rVpIfFZ.exe
  C:\Windows\System\rVpIfFZ.exe
  2⤵
  PID:8884
- C:\Windows\System\NAVQVNn.exe
  C:\Windows\System\NAVQVNn.exe
  2⤵
  PID:8520
- C:\Windows\System\AyqjnPN.exe
  C:\Windows\System\AyqjnPN.exe
  2⤵
  PID:9356
- C:\Windows\System\rYUYOmZ.exe
  C:\Windows\System\rYUYOmZ.exe
  2⤵
  PID:9580
- C:\Windows\System\ImQWioG.exe
  C:\Windows\System\ImQWioG.exe
  2⤵
  PID:9320
- C:\Windows\System\aXkCDmZ.exe
  C:\Windows\System\aXkCDmZ.exe
  2⤵
  PID:9496
- C:\Windows\System\yjBBuAA.exe
  C:\Windows\System\yjBBuAA.exe
  2⤵
  PID:9640
- C:\Windows\System\IKxPiEu.exe
  C:\Windows\System\IKxPiEu.exe
  2⤵
  PID:9672
- C:\Windows\System\hUxPOLO.exe
  C:\Windows\System\hUxPOLO.exe
  2⤵
  PID:9684
- C:\Windows\System\DCZWMaP.exe
  C:\Windows\System\DCZWMaP.exe
  2⤵
  PID:9396
- C:\Windows\System\LYoENvf.exe
  C:\Windows\System\LYoENvf.exe
  2⤵
  PID:9380
- C:\Windows\System\cFmjkYt.exe
  C:\Windows\System\cFmjkYt.exe
  2⤵
  PID:9484
- C:\Windows\System\IQmOlUA.exe
  C:\Windows\System\IQmOlUA.exe
  2⤵
  PID:9516
- C:\Windows\System\qbZOlJu.exe
  C:\Windows\System\qbZOlJu.exe
  2⤵
  PID:9808
- C:\Windows\System\GdrnkvY.exe
  C:\Windows\System\GdrnkvY.exe
  2⤵
  PID:9828
- C:\Windows\System\RamVeoo.exe
  C:\Windows\System\RamVeoo.exe
  2⤵
  PID:9512
- C:\Windows\System\vICxLdr.exe
  C:\Windows\System\vICxLdr.exe
  2⤵
  PID:9944
- C:\Windows\System\iyOqSxb.exe
  C:\Windows\System\iyOqSxb.exe
  2⤵
  PID:9924
- C:\Windows\System\saydjZV.exe
  C:\Windows\System\saydjZV.exe
  2⤵
  PID:9908
- C:\Windows\System\NtyoSVy.exe
  C:\Windows\System\NtyoSVy.exe
  2⤵
  PID:9864
- C:\Windows\System\sviYrJl.exe
  C:\Windows\System\sviYrJl.exe
  2⤵
  PID:10028
- C:\Windows\System\zaiyzex.exe
  C:\Windows\System\zaiyzex.exe
  2⤵
  PID:10076
- C:\Windows\System\xMOqHTn.exe
  C:\Windows\System\xMOqHTn.exe
  2⤵
  PID:10052
- C:\Windows\System\pBdtPdY.exe
  C:\Windows\System\pBdtPdY.exe
  2⤵
  PID:9940
- C:\Windows\System\CSErMyA.exe
  C:\Windows\System\CSErMyA.exe
  2⤵
  PID:10096
- C:\Windows\System\PnFrsMZ.exe
  C:\Windows\System\PnFrsMZ.exe
  2⤵
  PID:10124
- C:\Windows\System\WZcWeQx.exe
  C:\Windows\System\WZcWeQx.exe
  2⤵
  PID:10140
- C:\Windows\System\SBXwWuH.exe
  C:\Windows\System\SBXwWuH.exe
  2⤵
  PID:9896
- C:\Windows\System\uVsLbrN.exe
  C:\Windows\System\uVsLbrN.exe
  2⤵
  PID:9992
- C:\Windows\System\uEOXBnB.exe
  C:\Windows\System\uEOXBnB.exe
  2⤵
  PID:10216
- C:\Windows\System\blkVsbl.exe
  C:\Windows\System\blkVsbl.exe
  2⤵
  PID:9248
- C:\Windows\System\FPoKPbI.exe
  C:\Windows\System\FPoKPbI.exe
  2⤵
  PID:10188
- C:\Windows\System\xdWyYZA.exe
  C:\Windows\System\xdWyYZA.exe
  2⤵
  PID:2660
- C:\Windows\System\ErnCatX.exe
  C:\Windows\System\ErnCatX.exe
  2⤵
  PID:9236
- C:\Windows\System\nAvMeMj.exe
  C:\Windows\System\nAvMeMj.exe
  2⤵
  PID:9244
- C:\Windows\System\vqOqfAr.exe
  C:\Windows\System\vqOqfAr.exe
  2⤵
  PID:9340
- C:\Windows\System\iVOaKUg.exe
  C:\Windows\System\iVOaKUg.exe
  2⤵
  PID:9632
- C:\Windows\System\SrKwahX.exe
  C:\Windows\System\SrKwahX.exe
  2⤵
  PID:8720
- C:\Windows\System\WCosCWv.exe
  C:\Windows\System\WCosCWv.exe
  2⤵
  PID:9604
- C:\Windows\System\ImVqCRE.exe
  C:\Windows\System\ImVqCRE.exe
  2⤵
  PID:9388
- C:\Windows\System\MQJfZFq.exe
  C:\Windows\System\MQJfZFq.exe
  2⤵
  PID:9416
- C:\Windows\System\OFVDtkB.exe
  C:\Windows\System\OFVDtkB.exe
  2⤵
  PID:9436
- C:\Windows\System\AUtDlFh.exe
  C:\Windows\System\AUtDlFh.exe
  2⤵
  PID:9308
- C:\Windows\System\gTYFqMN.exe
  C:\Windows\System\gTYFqMN.exe
  2⤵
  PID:9476
- C:\Windows\System\uOSxsSw.exe
  C:\Windows\System\uOSxsSw.exe
  2⤵
  PID:9700
- C:\Windows\System\pCtKZnb.exe
  C:\Windows\System\pCtKZnb.exe
  2⤵
  PID:9696
- C:\Windows\System\BdvhDgU.exe
  C:\Windows\System\BdvhDgU.exe
  2⤵
  PID:9720
- C:\Windows\System\LRIfkcI.exe
  C:\Windows\System\LRIfkcI.exe
  2⤵
  PID:9748
- C:\Windows\System\WqAQrcB.exe
  C:\Windows\System\WqAQrcB.exe
  2⤵
  PID:9776
- C:\Windows\System\XOxMfLS.exe
  C:\Windows\System\XOxMfLS.exe
  2⤵
  PID:9788
- C:\Windows\System\OfTgHES.exe
  C:\Windows\System\OfTgHES.exe
  2⤵
  PID:9840
- C:\Windows\System\JmeSkGe.exe
  C:\Windows\System\JmeSkGe.exe
  2⤵
  PID:9876
- C:\Windows\System\rveaWwo.exe
  C:\Windows\System\rveaWwo.exe
  2⤵
  PID:9860
- C:\Windows\System\lizfdoA.exe
  C:\Windows\System\lizfdoA.exe
  2⤵
  PID:9900
- C:\Windows\System\xSfeFsL.exe
  C:\Windows\System\xSfeFsL.exe
  2⤵
  PID:9844
- C:\Windows\System\bkgHLMx.exe
  C:\Windows\System\bkgHLMx.exe
  2⤵
  PID:10004
- C:\Windows\System\ATlPqhY.exe
  C:\Windows\System\ATlPqhY.exe
  2⤵
  PID:10132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FsqWzZp.exe

Filesize
1.4MB

MD5
1e7e590205132fb4b88dedb7579c3099

SHA1
5aea8a8cdbfbed005f3e3bd47beb43672280b039

SHA256
c836f3eb93ddd0d27c9bdafbdb0ecedda22aa496ea70a6a2a95eccfd74ae629b

SHA512
0fe2213184e7b286a198e4837b848c0904f69115a0f95ca95c467f974122e09ebcd7d276a2f0e9314610a5d16f9db0cadbde2c80a8cd8baeb36861a90be9dcca

Download Submit
C:\Windows\system\GHTkGQe.exe

Filesize
1.4MB

MD5
d44fa9baf4d3c2e3bd63d00ee0ab2864

SHA1
3249f3ecb557b63c6ed373ba24250d193ac1aa26

SHA256
7c3cb72e83886bd9dccd5d045d3f1db4e3151303bc572d544f7461fcc26bfd03

SHA512
62dea7e9066fbb4abaa3f46bd98b79824cda8af9d2b0b7a6791257fde1ea4332a248ff13947675a1ad09e51b50b170d205ce354caddfc13cbac69ca9be05d1eb

Download Submit
C:\Windows\system\JAlDfSu.exe

Filesize
1.4MB

MD5
c6ab957e37b5db27dc335c18d374942e

SHA1
84203403cdf0e1fe6c95126f9171c31ed73793f0

SHA256
8a4771625a5db146c1e546e2c24cfe8a776b6d4d844d526bcaaa12f517519b47

SHA512
35c411a63cc5b73410a51a3b1e8e8918f59bcca020ca3636bf4caaaef5af287ff14fa34272706a845b5042c106f7baf4a0e2a744875017a935df73453085f3a4

Download Submit
C:\Windows\system\LXUNgOv.exe

Filesize
1.4MB

MD5
e8f5deb0b381337a4914fa83e037d095

SHA1
d4363ee5cb6ffcbd0881a0f1119389d1382e663f

SHA256
bc399a2af1ee1c70873423f02564507b92c025f5940cbf27e24ac7220e9ab1f0

SHA512
99e5bc6eee3a7d1e981ee94eb14a1e5961a5faa34837d26b4d92d1240c0f99b07f47d32bb4ca194eb7609470b441d4aeca3ac21c87d7f0e2a92dd73add41bb9d

Download Submit
C:\Windows\system\NQcmaYg.exe

Filesize
1.4MB

MD5
dc22a5cb7c1d32dd01cbbdb861e7c315

SHA1
de8a172081f927548a8246bdced05b58f8c09319

SHA256
26adcf62e6c1ccbcecf89da7f7b116c1f1bb1f72d820f7327c57f309980c8cb5

SHA512
7e2cb1ee8efd97cb60d83231baa35336d20a59a797989a63b174d38aa3658f3a30d9cc391708ebeca3f57310be1f8c754a7ddb1a34fd90af6db27c31f247411e

Download Submit
C:\Windows\system\RROTIHB.exe

Filesize
1.4MB

MD5
8b6576165747f307e9d0ea37045c050e

SHA1
34c84029c0c74348d6bc0ec37575cb3ef1f08a1d

SHA256
264864f4c733a8645e1bf074e2e1e7c84b09cce185d3df1bf0e05f05e2cf60c2

SHA512
f48e40c376dcb3dbb9d1f34c4ce0e139ff72ba09f2d8f6e4542d852e568edd3dad576e9255bcb12cc1737191236e86e5c0ef3a630ac05efb61e63071e9afa308

Download Submit
C:\Windows\system\RjjQPRA.exe

Filesize
1.4MB

MD5
394e380f96b81b64bf84989fa84f9b55

SHA1
af6a688d1055bd9892321087a679ea603b35e87c

SHA256
e37f3350e87bc7b190e2c0a0ed68b84e4c2eb22ef65ef6fbf732d1785c4a24b7

SHA512
e3cbf60ced87a74f3661a572cbdbf4c3b9cc2215c7da747015976031971f60f2fea0f8d672ca489465b61f27fa91508ec135e6652a06460ec141f447ad1571cf

Download Submit
C:\Windows\system\UQjwnhB.exe

Filesize
1.4MB

MD5
b8d095773526b7ce39e12020c44581e1

SHA1
191c371498a5ad09c3805f353804b151362ffcb5

SHA256
1d898352ce59fa7e80dfee73c10d83d4de11c4ddd57abd9eb38162d136411fa6

SHA512
fb73059fff6404fb8b971b0d583761f373b0308274c4b21aec36e905fedbf2b3598305c485558fb5867ad9750f20e286bc2a1bb65ba1df3af22ed0f2b46b56fc

Download Submit
C:\Windows\system\UnSKwzX.exe

Filesize
1.4MB

MD5
0cd77182292945602c540f5f0cc5d2ac

SHA1
9496d3950cbd68337287e3b13fa8a1cfb8b6525f

SHA256
721fa5a12badd71b8c26c663474801e6a8b320d9383dfa057dea690378df38ec

SHA512
c9fa31ca326f5a65e3bc99a547e22d647aa7dc2701cc7740dd3b699d85d8bc820d25248c9fcf1e2e689459903345122f636c6b4e2e4968421ee4f06cc1d9b4e8

Download Submit
C:\Windows\system\VNGuqDA.exe

Filesize
1.4MB

MD5
92d2904532d1befd06f211989ea7b992

SHA1
fbfdb0570fa1bec0cc02b7d38e44b8351cf8df68

SHA256
abb63f37f2dcc85bee1b47890fddc4ab1e1d7ca2057ae768db783acd8a8241e0

SHA512
bab57c55d366b42262326614c19cf30bc2557839c95efd0aef955a3fc90de5708c8ee84d214a549d8e1eb0d73d1cf28732af12e06132ab62f8c152a9a1373a20

Download Submit
C:\Windows\system\WigJkaG.exe

Filesize
1.4MB

MD5
d4a9c9c5bfe07bd708dea9598dc491ac

SHA1
ece503a2dae38d4af1a918067de236f3f029f3d2

SHA256
7dd41ee006841d4e6609968c3d8aab70d7a9d95c2f50e0f17b4d18ec94791be2

SHA512
37b2a0eb5e8bdc931a5775c83f42c38e00b58cf07754c0bbc57be2cd2ecc4d7743aa9489293700d5a0ee69374428d00af8ff688f09e08ac26af65579b18d6586

Download Submit
C:\Windows\system\lbeydbv.exe

Filesize
1.4MB

MD5
bfa0d5f9fdd1a1d189aa9007ebe97260

SHA1
5c67f82be20f80e0f4b773c197df63460083dd26

SHA256
a9c23807dbedce7e454fac809e3237dfecf28fa3e7a14b611a5eea35ca719e18

SHA512
f5be3b6f317521cfc2edd4a5f5705894f5aa6cc033fdc2e39b80983ff33336582ecec3b2cb972043246ba6dd336f9aa8c5d025e5e903f47c9a5aaac0ad50c3f2

Download Submit
C:\Windows\system\liiPuSL.exe

Filesize
1.4MB

MD5
b5b02c17dac5d93c925bf65c6c2a5c4b

SHA1
f7c9fc239f591fb199b5a2d87ec9032545e2c271

SHA256
7ed4d1af8e6bb75251e5d44fa0e889e8c1b6b04ff0b0095deefb63698cb09ced

SHA512
63dd7533dac66739e11c489dd474fe72277cc7952c828384c8d28ec56ec87597af26ca2674ee9fbd92677dd87334857b8658d8495d7bb488db01b5628342a9c1

Download Submit
C:\Windows\system\nWFoiks.exe

Filesize
1.4MB

MD5
fcdb7f70edf40b8cdc7319f8c35f528a

SHA1
3c61e77a90ee9a5870d2851111b65a82e8790f5f

SHA256
5ac406ffd0b413df90b801fea5ad1c9a22212ee0a06dc0ef69f74fd0fcc39f27

SHA512
d6cc30eac558482c72dfeb55e3441a5e228121bb1f946346176a356dc0fddbfbf2bee1fbd986e9d087cb9c84883886e51c8ec5bf48e866adcf049aa41e7c3d10

Download Submit
C:\Windows\system\ohgQgLK.exe

Filesize
1.4MB

MD5
75e0e3d13b518f5a7a1cd7f84cf784e1

SHA1
2d59bf2fe0b9dc7ed29bc9511c1a50c8ba357836

SHA256
1db580ed185b974ae0d224d975b99a415db98cd5195a9daa1b729db6b2780706

SHA512
06e6766477620b0e1b763d5fbfecc04e8886badd13efb329b81b3a0ea75c5966459e83fee8427e348d0de0f08197d8f0803b0c563c1c0f0f57721bb79ceeb0f0

Download Submit
C:\Windows\system\pHeyigO.exe

Filesize
1.4MB

MD5
ab163e0fe8fce754ddeb3ad73454b4d9

SHA1
7579ec2c62752076e2028bfc68128e265585cba9

SHA256
2a9ef489d94f25063e868106bf810812e698fce2bc6c7cb084f37dc48806b401

SHA512
8481dc73a84424c43c1cda847a546d7a5084f0efef5468d3ab02bac388e28e1a4d097d18bc0c487cbad2f04289d56065771ac47cca710dc56cea67e505746695

Download Submit
C:\Windows\system\pYiLPly.exe

Filesize
1.4MB

MD5
784cf7903b7458d82ceb8733d758ed29

SHA1
0693ba357b6aebe218145ac69547928dc7094c88

SHA256
104eccc8cb6882bf90b21d8094f76cc375e1dc3f828c22d7932ec09c4c2d33bd

SHA512
bf5587878adc1626804f2ea5c1b95016c3e4c583346290aa1308d6bc5cb4dac85406132dfe258d78462572c5a66c9b602b134f66af8288d066120943b8fa87c9

Download Submit
C:\Windows\system\sAlwtDs.exe

Filesize
1.4MB

MD5
604ed4fcd0429aa2230c3ed81705410f

SHA1
b3ba4d86457ed718a02ad16b0a2be538c3e889af

SHA256
8e3c65b759266e9ffa2c11395c5e3cbf9e18e56c888612d3125e51268a149f68

SHA512
c68d68a073539b57a1db7b0983b6b04d3e40511359106fb7c9fb1de7e9cc7f7d65f94b1650066681c87a540de553765b5cf46f4ad6c9c2f277d488f4d6cf6fb1

Download Submit
C:\Windows\system\tukRtnk.exe

Filesize
1.4MB

MD5
973dd298593e2115187fba7a8d271077

SHA1
cdf1f0349441a982887d92300c519cd44b175fb8

SHA256
344fd8874a3a2f568451b99c6163f9cb56621febb21f60a560bfe3f091fe4df8

SHA512
4df20de7d91b26a75591f5f2c23b7a89ca7c9ade7f2d01c0d72f9db49a5663766a258834e0da0a09bc8699c297c64dbacdc7284018e5b642427f56a339961439

Download Submit
C:\Windows\system\wDNAFQf.exe

Filesize
1.4MB

MD5
f4d6727999823a9faf6ec827cf1c8924

SHA1
27ea55d35b7f6f24c2ab0282cb62805ed45e39a1

SHA256
b56196b12c391533239b0c4caf563d0c51c519cb816228720bd2b55497f646bd

SHA512
0fdffed30d0a7bc3c46bdf55dba2f0177b270a33d5416ee3455170203fa0e2ecad5e83a3d6d2380dffb5f8675c6e4ac93f7e549c592e2322384ed4fd24f71d2c

Download Submit
C:\Windows\system\yPvQnKq.exe

Filesize
1.4MB

MD5
298af2a8d3a63c0ab389282646428735

SHA1
10a31475de975fe0f08b7c678e27c2451061c1ab

SHA256
c7616452d6f9d008c802fdff63b1c16a7e0061aaef8a8f0c51c85747bc24defe

SHA512
5652a0be332f2e898ce00f25c9ffc20a1da66412ee168e131f9c0303ad11afc7aae448dce8beb01cacef0ee4f2bab588f02f1f91a0bef0fd7fcabde1330d8eff

Download Submit
C:\Windows\system\yaWjxSU.exe

Filesize
1.4MB

MD5
694c2312155864cb7af39149b78efa88

SHA1
5c70173bd5c49fe729518e179b73248a3356f983

SHA256
70e42979c5f9b7389dd5ce3019b6437be0ff0e80f8a77526f565d285ee55c2b5

SHA512
3f06c340eca442bb8981004f56b50d7667ecbfd0566701c6c9fdf7494eb020f63211caf43fd264f91c1bdb6b4b50155d3bb06b020c9b5d9f539a87cd99bcb751

Download Submit
\Windows\system\LFjNajU.exe

Filesize
1.4MB

MD5
99299794244e4750e96ee975ed7b0396

SHA1
e729d75f12e018344a730d87ae4c492b0fe67fd9

SHA256
ef0fb70d6fe0be9a68ccbb3ca4db504ee7641af2c42900fe671048509b7f44aa

SHA512
7b60eea2818dad94876ec5f9fe3beba9ab30c571a98598515378c71f0d6155802d03c67ba4d620a749f0e227da8b59d5b4f9bd8bfd62d9bc51fd46711526f168

Download Submit
\Windows\system\MJNgSGK.exe

Filesize
1.4MB

MD5
70af15b1d7965685ae9a90217fdf21ae

SHA1
ed666aea99efd32eb9ca7a0e011e1a39f9e9f2b6

SHA256
721d2dec2986e7f28d9ba8307bb366416c0bb792af0a4e3c7275130fa89fa3da

SHA512
2bee483c9ba5ba769f952f2a0132dc9d826daf32e1448cd0dc31d1b41b6fd5826730e5894df5287f16106c420eca087eed54e1b2c6260437c3f6df0d5e7b9355

Download Submit
\Windows\system\NMkyfCR.exe

Filesize
1.4MB

MD5
ad58417be28848ad890cdf0797d209df

SHA1
d3fc74e9c2fe29db0c9caa413a4c315a6f3af6a3

SHA256
9cafdf0e25931c192088999b336a7fc333abdd5736329697992385fbedf02213

SHA512
f12305fbf2ea7f3b4b96d755953c2814da7d060f884fd97c7901a1df59895b5bd20e5d6f03a9f23804f7237c215d216c7d35537101bdc127c66ccf1f1e072d97

Download Submit
\Windows\system\PQqxptS.exe

Filesize
1.4MB

MD5
d2617c33b4851341e6641143923c34d5

SHA1
4548d3f3ad5692630bf43b0b74ace625ff553daa

SHA256
0c0cd435e8ded39ff7f505a4d8cc4b00eecac48ae0b137e68a53575159efe207

SHA512
b87feb40c13ff19dd35939b0300f54fde367a8eaa072307ff112e254695bab855b0dd76ebe92bab662139ab58d9736637424d18b7854357469da5dff0989d671

Download Submit
\Windows\system\RVryffT.exe

Filesize
1.4MB

MD5
dc5cf23f7e8562f63089a9551477493e

SHA1
3123881fe2fd50cef9786ed12dfd012115a59a62

SHA256
d3b605ac9c17cf22cd51d54b73b37194b4bc3fa4ba9ae528e5e90f636c7c33c3

SHA512
8f7cca013fb2bd6c0ea5770022bc5b8a9c5f5d3b35bb217d992d47f4386dac67e14f0f6405dc7d250f20a302c3e74e25c03808529404fe57ce16af3ae93e08db

Download Submit
\Windows\system\bINpNmb.exe

Filesize
1.4MB

MD5
ef4961dd23319e14efe831f9f8ebdb57

SHA1
1573d5adbebd68ea0544aa1fb0a3821106e7e7e7

SHA256
c5c43a20b5894f16dd52505db191d530a8a4b30559e6b9258e4a1a0e37672c16

SHA512
16782f01bf3bb195a92aebce6b3ef680ee712ff6b2c1c03d3d6e2d3757cb783899089538f8e3238e01939b917fb1b44fcfea3f4f90684de76193e9cdf8ce9e69

Download Submit
\Windows\system\lwfKuLU.exe

Filesize
1.4MB

MD5
df3d2a4e79f6aafe786998e807b7d8b5

SHA1
cdf3f4c42d3b67d1c5b332939eda61f4aa7732c9

SHA256
04631389369e8771fc8f63f886bf68448a8c2f1f1b3c1b1372e2651787616e6a

SHA512
27a663aba34559b73cadcff50448487194316e1ce9c7253aa08d352373967758e420b9d899c223ec7ce696c42ff8e786745dc58711405e79b0b4751454a3b7cc

Download Submit
\Windows\system\uoKdduY.exe

Filesize
1.4MB

MD5
82be8ffe2670ea60088f0cae00311d78

SHA1
28e8d9d93e180d09bd4b3a7c56ab2c118e472044

SHA256
e8b703ef503f0452227b1bb35922fa4b41cb65c91918a25390b2cbe95c0b7165

SHA512
6787183e01aa30537c60ba54642a47f5b87e9700a237222d20cc59fe90304c943cb05eeb58158b6b1c4f46262cb85cef4e1d965c6f604019302d98351975b14a

Download Submit
\Windows\system\wNPvaZf.exe

Filesize
1.4MB

MD5
563eb0b887a7c9cb9938b5f0c9bd2403

SHA1
2cf7793f99b309921133f4cfdb8516e77b834c36

SHA256
f3ebabff22b2b004288e361c998ae7289fa8a4c79799ee26193f2a23c9ae568c

SHA512
acddcfac86c41076500de746ad72af24e0f874fc242884179a6522bafcbb33d9283707c370f57122accaef392d65d3dec3bf5fcc929ce95f06ddd1f0fe6920e2

Download Submit
\Windows\system\yKgojHu.exe

Filesize
1.4MB

MD5
2d4efb964ad93b335ad35baf2f8b91c0

SHA1
f955aca68e1139e798a187a6a0db61fb2fcfff22

SHA256
a2da1763092d1ca316db28373954e82326635e980610729f072afcc371f49a1b

SHA512
f7c94b990c4f04eeabb058d69e668265e218cdf0e311edae95a67575b0fc06a1e1d4a5543065e2b0316f7c290af4e04e6a4348587529bbabbb30efce344a4b67

Download Submit
memory/556-109-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/556-2260-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-2275-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-111-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-116-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/1368-92-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1368-99-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/1368-101-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-97-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1368-117-0x0000000002AA0000-0x0000000002E92000-memory.dmp

Filesize
3.9MB

Download
memory/1368-110-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1368-19-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/1368-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1368-8-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1368-87-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1368-108-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-106-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-0-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2128-83-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2128-2255-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2164-124-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2164-81-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2164-21-0x00000000025C0000-0x0000000002640000-memory.dmp

Filesize
512KB

Download
memory/2164-22-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/2164-42-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/2164-96-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2164-43-0x00000000020C0000-0x00000000020C8000-memory.dmp

Filesize
32KB

Download
memory/2164-79-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2196-2257-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2196-94-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2392-98-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2258-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2472-2262-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2472-100-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2484-91-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2256-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-2261-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2576-82-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2668-2299-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2668-20-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2836-2259-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-104-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2274-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-107-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-2254-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/3048-9-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download