xmrig | 89c2239fbf6b8c3ed3e9a6da55fe0138495dd09101aa1b58f2677357bd615503

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
Size

2.4MB
MD5

13525010260f506b65997c2676fb19d3
SHA1

27a29e9e1f4d44fe7bcde633a35f0ee4862f53ff
SHA256

89c2239fbf6b8c3ed3e9a6da55fe0138495dd09101aa1b58f2677357bd615503
SHA512

9e73e4838525657b403db76757c551bbc0b02e9e419ba187327f96e32d1eebaedd15936f836c3f4edd16dfaa3278a9138256fdbc48ec184ebc676f5c77d73795
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbsv:NAB2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2604-15-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2580-78-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/1664-81-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2572-83-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2452-65-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/1664-82-0x00000000036B0000-0x0000000003AA2000-memory.dmp	xmrig
behavioral1/memory/2400-79-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/304-77-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/3036-595-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2716-1738-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2528-31-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/3036-5219-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2400-5220-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2580-5240-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/304-5239-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2716-5247-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2472-5252-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2436-5234-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2452-5232-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2604-5325-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2292-5351-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2156	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3036	MkCSkkh.exe
2604	DthxCMd.exe
2528	RPYZOBL.exe
2716	xSYkeEp.exe
2452	OiQnYHf.exe
2436	kwvOwBC.exe
2400	EQZxnjm.exe
304	qqSkFop.exe
2580	vELiQIU.exe
2572	SFZFviC.exe
2472	GGzMEgy.exe
2292	LnYRyrq.exe
1596	NMSMjWH.exe
1600	vSniujc.exe
1796	VblaGcF.exe
1564	UppxEFd.exe
2128	OAZQmvl.exe
1696	xaNyiUb.exe
1496	qZJDJjJ.exe
1376	kGYVifv.exe
1708	gtieoPe.exe
2076	GxPKoml.exe
1244	PMhhZHo.exe
2140	LDhtEVf.exe
2196	RdXlSOw.exe
540	GfONrjz.exe
652	lEiJOAT.exe
2052	qiOjavD.exe
324	ztbWEgF.exe
2964	OJUmWSm.exe
1064	MHBviIe.exe
3032	DnhHabj.exe
1512	IWweZit.exe
1932	DIQqVrJ.exe
1556	DTRAfNi.exe
780	tJswDwS.exe
2364	PeHaFAB.exe
924	PZdHxTC.exe
1092	aNVdkxE.exe
572	LcKroHg.exe
1576	AKntztc.exe
2360	gfxMels.exe
2944	cIEXGIB.exe
2272	VdnFOQG.exe
1736	fcixPnB.exe
2084	enKffYq.exe
1432	wizlmDU.exe
904	tTZEsSb.exe
1984	AuIQooI.exe
1508	cZTHATt.exe
2512	oXTNjgk.exe
2788	GhmOSJu.exe
1940	OFmffMB.exe
2480	PwthCjG.exe
632	pQQSjam.exe
2904	AorYERP.exe
2412	CVRlOKw.exe
836	wnIOkBF.exe
1364	PoqGGDU.exe
1200	sGqhqaa.exe
1808	HBFKUkp.exe
1280	ORonuIq.exe
1444	mSaMyGf.exe
1956	CkqqYoG.exe

Loads dropped DLL 64 IoCs

pid	Process
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x000b0000000144e0-3.dat	upx
behavioral1/memory/2604-15-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x000e000000014ba7-16.dat	upx
behavioral1/files/0x0007000000014dae-32.dat	upx
behavioral1/files/0x00070000000153c7-47.dat	upx
behavioral1/files/0x000900000001540d-55.dat	upx
behavioral1/files/0x0008000000015cce-69.dat	upx
behavioral1/memory/2580-78-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/1664-81-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2572-83-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x0006000000015cd9-84.dat	upx
behavioral1/memory/2452-65-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2400-79-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/304-77-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x0006000000015d0c-94.dat	upx
behavioral1/files/0x0006000000015ce3-70.dat	upx
behavioral1/memory/2292-91-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x0006000000015d44-125.dat	upx
behavioral1/files/0x0006000000015fa7-136.dat	upx
behavioral1/files/0x00060000000161b3-146.dat	upx
behavioral1/files/0x0006000000016a6f-172.dat	upx
behavioral1/files/0x00060000000162c9-151.dat	upx
behavioral1/memory/3036-595-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2716-1738-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0006000000016c42-191.dat	upx
behavioral1/files/0x0006000000016c3a-186.dat	upx
behavioral1/files/0x0006000000016c1d-182.dat	upx
behavioral1/files/0x0006000000016813-180.dat	upx
behavioral1/files/0x000600000001654a-177.dat	upx
behavioral1/files/0x0006000000016476-157.dat	upx
behavioral1/files/0x00060000000165f0-162.dat	upx
behavioral1/files/0x00060000000160cc-141.dat	upx
behavioral1/files/0x0006000000015f3c-131.dat	upx
behavioral1/files/0x0006000000015d4c-115.dat	upx
behavioral1/files/0x0006000000015e09-114.dat	upx
behavioral1/files/0x0006000000015d24-101.dat	upx
behavioral1/files/0x0006000000015e6d-120.dat	upx
behavioral1/files/0x00340000000149e1-105.dat	upx
behavioral1/memory/2472-89-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x0006000000015cf5-87.dat	upx
behavioral1/files/0x000800000001502c-54.dat	upx
behavioral1/memory/2436-51-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x001800000000558a-46.dat	upx
behavioral1/memory/2716-36-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2528-31-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x003400000001480e-12.dat	upx
behavioral1/memory/3036-11-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/3036-5219-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2400-5220-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2580-5240-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/304-5239-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2716-5247-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2472-5252-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2436-5234-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2452-5232-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2604-5325-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2292-5351-0x000000013F230000-0x000000013F622000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dOaiWWR.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\THepJRq.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\wyUHXxQ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\gwcreGY.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\SbvtpUv.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\WraFSGS.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\aWKcqtq.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ibtCYdK.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\IhBrrep.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\RilGZVr.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\whCRGcc.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\eOgXBpL.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\gUqECcf.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\MDURCFK.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\wqyKImY.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\rIyRWqj.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\AGYeahW.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\trMNLiz.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\NcmtCIE.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\tqGMULe.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\PhgvZnI.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\oHroEGj.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\xiBpAkN.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\NPlmvWW.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\qSuhvqH.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\mtQvQzz.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\cugPEpx.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\MkKqNWI.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\oRwASwD.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\QLoTBcH.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\odJrtTY.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\TgTKVoh.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\EMOBtyF.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\tbTaEWZ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\zZlsdpl.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\NRjgRok.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\VlJcLJG.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\JFZbUkb.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\nUBWNCi.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\BOltRoP.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\XZViCyN.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\MSAeVnn.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\fIGzafs.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\fjNTzIf.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\IEUWDts.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\emJwmXQ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\uSAgosL.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\fAMbaMp.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\ktBYHiW.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\yiEAnQc.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\IsDqIHG.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\gxLHKhk.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\PWBbBLF.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\sJskwJY.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\AHmWGbQ.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\GQKxtTl.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\SLXYvBB.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\LBYhjUE.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\YvwLUXA.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\jEblNue.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\aNsBVbo.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\PnfdTKx.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\xPSXzSD.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
File created	C:\Windows\System\hLDQSvg.exe	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2156	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
Token: SeDebugPrivilege	2156	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2156	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	29
PID 1664 wrote to memory of 2156	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	29
PID 1664 wrote to memory of 2156	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	29
PID 1664 wrote to memory of 3036	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	30
PID 1664 wrote to memory of 3036	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	30
PID 1664 wrote to memory of 3036	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	30
PID 1664 wrote to memory of 2604	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	31
PID 1664 wrote to memory of 2604	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	31
PID 1664 wrote to memory of 2604	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	31
PID 1664 wrote to memory of 2528	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	32
PID 1664 wrote to memory of 2528	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	32
PID 1664 wrote to memory of 2528	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	32
PID 1664 wrote to memory of 2716	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	33
PID 1664 wrote to memory of 2716	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	33
PID 1664 wrote to memory of 2716	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	33
PID 1664 wrote to memory of 2452	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	34
PID 1664 wrote to memory of 2452	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	34
PID 1664 wrote to memory of 2452	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	34
PID 1664 wrote to memory of 2400	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	35
PID 1664 wrote to memory of 2400	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	35
PID 1664 wrote to memory of 2400	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	35
PID 1664 wrote to memory of 2436	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	36
PID 1664 wrote to memory of 2436	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	36
PID 1664 wrote to memory of 2436	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	36
PID 1664 wrote to memory of 2572	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	37
PID 1664 wrote to memory of 2572	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	37
PID 1664 wrote to memory of 2572	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	37
PID 1664 wrote to memory of 304	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	38
PID 1664 wrote to memory of 304	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	38
PID 1664 wrote to memory of 304	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	38
PID 1664 wrote to memory of 2472	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	39
PID 1664 wrote to memory of 2472	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	39
PID 1664 wrote to memory of 2472	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	39
PID 1664 wrote to memory of 2580	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	40
PID 1664 wrote to memory of 2580	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	40
PID 1664 wrote to memory of 2580	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	40
PID 1664 wrote to memory of 2292	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	41
PID 1664 wrote to memory of 2292	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	41
PID 1664 wrote to memory of 2292	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	41
PID 1664 wrote to memory of 1596	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	42
PID 1664 wrote to memory of 1596	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	42
PID 1664 wrote to memory of 1596	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	42
PID 1664 wrote to memory of 1600	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	43
PID 1664 wrote to memory of 1600	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	43
PID 1664 wrote to memory of 1600	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	43
PID 1664 wrote to memory of 1796	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	44
PID 1664 wrote to memory of 1796	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	44
PID 1664 wrote to memory of 1796	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	44
PID 1664 wrote to memory of 1696	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	45
PID 1664 wrote to memory of 1696	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	45
PID 1664 wrote to memory of 1696	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	45
PID 1664 wrote to memory of 1564	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	46
PID 1664 wrote to memory of 1564	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	46
PID 1664 wrote to memory of 1564	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	46
PID 1664 wrote to memory of 1496	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	47
PID 1664 wrote to memory of 1496	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	47
PID 1664 wrote to memory of 1496	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	47
PID 1664 wrote to memory of 2128	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	48
PID 1664 wrote to memory of 2128	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	48
PID 1664 wrote to memory of 2128	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	48
PID 1664 wrote to memory of 1376	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	49
PID 1664 wrote to memory of 1376	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	49
PID 1664 wrote to memory of 1376	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	49
PID 1664 wrote to memory of 1708	1664	13525010260f506b65997c2676fb19d3_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\13525010260f506b65997c2676fb19d3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13525010260f506b65997c2676fb19d3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\System\MkCSkkh.exe
  C:\Windows\System\MkCSkkh.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\DthxCMd.exe
  C:\Windows\System\DthxCMd.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\RPYZOBL.exe
  C:\Windows\System\RPYZOBL.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\xSYkeEp.exe
  C:\Windows\System\xSYkeEp.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\OiQnYHf.exe
  C:\Windows\System\OiQnYHf.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\EQZxnjm.exe
  C:\Windows\System\EQZxnjm.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\kwvOwBC.exe
  C:\Windows\System\kwvOwBC.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\SFZFviC.exe
  C:\Windows\System\SFZFviC.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\qqSkFop.exe
  C:\Windows\System\qqSkFop.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\GGzMEgy.exe
  C:\Windows\System\GGzMEgy.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\vELiQIU.exe
  C:\Windows\System\vELiQIU.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\LnYRyrq.exe
  C:\Windows\System\LnYRyrq.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\NMSMjWH.exe
  C:\Windows\System\NMSMjWH.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\vSniujc.exe
  C:\Windows\System\vSniujc.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\VblaGcF.exe
  C:\Windows\System\VblaGcF.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\xaNyiUb.exe
  C:\Windows\System\xaNyiUb.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\UppxEFd.exe
  C:\Windows\System\UppxEFd.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\qZJDJjJ.exe
  C:\Windows\System\qZJDJjJ.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\OAZQmvl.exe
  C:\Windows\System\OAZQmvl.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\kGYVifv.exe
  C:\Windows\System\kGYVifv.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\gtieoPe.exe
  C:\Windows\System\gtieoPe.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\GxPKoml.exe
  C:\Windows\System\GxPKoml.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\PMhhZHo.exe
  C:\Windows\System\PMhhZHo.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\LDhtEVf.exe
  C:\Windows\System\LDhtEVf.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\RdXlSOw.exe
  C:\Windows\System\RdXlSOw.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qiOjavD.exe
  C:\Windows\System\qiOjavD.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\GfONrjz.exe
  C:\Windows\System\GfONrjz.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ztbWEgF.exe
  C:\Windows\System\ztbWEgF.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\lEiJOAT.exe
  C:\Windows\System\lEiJOAT.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\OJUmWSm.exe
  C:\Windows\System\OJUmWSm.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\MHBviIe.exe
  C:\Windows\System\MHBviIe.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\DnhHabj.exe
  C:\Windows\System\DnhHabj.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\IWweZit.exe
  C:\Windows\System\IWweZit.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\DIQqVrJ.exe
  C:\Windows\System\DIQqVrJ.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\DTRAfNi.exe
  C:\Windows\System\DTRAfNi.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\tJswDwS.exe
  C:\Windows\System\tJswDwS.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\PeHaFAB.exe
  C:\Windows\System\PeHaFAB.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\PZdHxTC.exe
  C:\Windows\System\PZdHxTC.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\aNVdkxE.exe
  C:\Windows\System\aNVdkxE.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\LcKroHg.exe
  C:\Windows\System\LcKroHg.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\AKntztc.exe
  C:\Windows\System\AKntztc.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\gfxMels.exe
  C:\Windows\System\gfxMels.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\cIEXGIB.exe
  C:\Windows\System\cIEXGIB.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\VdnFOQG.exe
  C:\Windows\System\VdnFOQG.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\fcixPnB.exe
  C:\Windows\System\fcixPnB.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\wizlmDU.exe
  C:\Windows\System\wizlmDU.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\enKffYq.exe
  C:\Windows\System\enKffYq.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\tTZEsSb.exe
  C:\Windows\System\tTZEsSb.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\AuIQooI.exe
  C:\Windows\System\AuIQooI.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\OFmffMB.exe
  C:\Windows\System\OFmffMB.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\cZTHATt.exe
  C:\Windows\System\cZTHATt.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\AorYERP.exe
  C:\Windows\System\AorYERP.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\oXTNjgk.exe
  C:\Windows\System\oXTNjgk.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\CVRlOKw.exe
  C:\Windows\System\CVRlOKw.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\GhmOSJu.exe
  C:\Windows\System\GhmOSJu.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\wnIOkBF.exe
  C:\Windows\System\wnIOkBF.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\PwthCjG.exe
  C:\Windows\System\PwthCjG.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\PoqGGDU.exe
  C:\Windows\System\PoqGGDU.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\pQQSjam.exe
  C:\Windows\System\pQQSjam.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\sGqhqaa.exe
  C:\Windows\System\sGqhqaa.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\HBFKUkp.exe
  C:\Windows\System\HBFKUkp.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\gypTqZV.exe
  C:\Windows\System\gypTqZV.exe
  2⤵
  PID:2168
- C:\Windows\System\ORonuIq.exe
  C:\Windows\System\ORonuIq.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\HdodDJg.exe
  C:\Windows\System\HdodDJg.exe
  2⤵
  PID:296
- C:\Windows\System\mSaMyGf.exe
  C:\Windows\System\mSaMyGf.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\wBZezfu.exe
  C:\Windows\System\wBZezfu.exe
  2⤵
  PID:2208
- C:\Windows\System\CkqqYoG.exe
  C:\Windows\System\CkqqYoG.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\WFktFCS.exe
  C:\Windows\System\WFktFCS.exe
  2⤵
  PID:2116
- C:\Windows\System\MeniYnn.exe
  C:\Windows\System\MeniYnn.exe
  2⤵
  PID:704
- C:\Windows\System\BEhqgQd.exe
  C:\Windows\System\BEhqgQd.exe
  2⤵
  PID:2388
- C:\Windows\System\stvuxJE.exe
  C:\Windows\System\stvuxJE.exe
  2⤵
  PID:1136
- C:\Windows\System\iLjSahh.exe
  C:\Windows\System\iLjSahh.exe
  2⤵
  PID:2088
- C:\Windows\System\qlutXkM.exe
  C:\Windows\System\qlutXkM.exe
  2⤵
  PID:1492
- C:\Windows\System\nEwkMAh.exe
  C:\Windows\System\nEwkMAh.exe
  2⤵
  PID:1284
- C:\Windows\System\gxGTupa.exe
  C:\Windows\System\gxGTupa.exe
  2⤵
  PID:2256
- C:\Windows\System\coMGKVc.exe
  C:\Windows\System\coMGKVc.exe
  2⤵
  PID:784
- C:\Windows\System\qjtChrQ.exe
  C:\Windows\System\qjtChrQ.exe
  2⤵
  PID:1072
- C:\Windows\System\EkTETOw.exe
  C:\Windows\System\EkTETOw.exe
  2⤵
  PID:1632
- C:\Windows\System\UulmegL.exe
  C:\Windows\System\UulmegL.exe
  2⤵
  PID:936
- C:\Windows\System\DuReXvG.exe
  C:\Windows\System\DuReXvG.exe
  2⤵
  PID:2956
- C:\Windows\System\NimPrCn.exe
  C:\Windows\System\NimPrCn.exe
  2⤵
  PID:1688
- C:\Windows\System\ssFjuGg.exe
  C:\Windows\System\ssFjuGg.exe
  2⤵
  PID:576
- C:\Windows\System\OFpvDAV.exe
  C:\Windows\System\OFpvDAV.exe
  2⤵
  PID:2620
- C:\Windows\System\JGQEuax.exe
  C:\Windows\System\JGQEuax.exe
  2⤵
  PID:2872
- C:\Windows\System\mUIgaBY.exe
  C:\Windows\System\mUIgaBY.exe
  2⤵
  PID:2444
- C:\Windows\System\erlmPGX.exe
  C:\Windows\System\erlmPGX.exe
  2⤵
  PID:2284
- C:\Windows\System\oBsuZWb.exe
  C:\Windows\System\oBsuZWb.exe
  2⤵
  PID:1884
- C:\Windows\System\BUPGIPw.exe
  C:\Windows\System\BUPGIPw.exe
  2⤵
  PID:2236
- C:\Windows\System\CPmOLKV.exe
  C:\Windows\System\CPmOLKV.exe
  2⤵
  PID:2712
- C:\Windows\System\SAFHUTO.exe
  C:\Windows\System\SAFHUTO.exe
  2⤵
  PID:1304
- C:\Windows\System\FTKrSkQ.exe
  C:\Windows\System\FTKrSkQ.exe
  2⤵
  PID:952
- C:\Windows\System\ANiLnyD.exe
  C:\Windows\System\ANiLnyD.exe
  2⤵
  PID:2484
- C:\Windows\System\kOljgoH.exe
  C:\Windows\System\kOljgoH.exe
  2⤵
  PID:2652
- C:\Windows\System\PPWddVi.exe
  C:\Windows\System\PPWddVi.exe
  2⤵
  PID:2296
- C:\Windows\System\bwaCzCU.exe
  C:\Windows\System\bwaCzCU.exe
  2⤵
  PID:2692
- C:\Windows\System\yQRliEo.exe
  C:\Windows\System\yQRliEo.exe
  2⤵
  PID:1464
- C:\Windows\System\nMpZQkZ.exe
  C:\Windows\System\nMpZQkZ.exe
  2⤵
  PID:1580
- C:\Windows\System\dbiREqx.exe
  C:\Windows\System\dbiREqx.exe
  2⤵
  PID:404
- C:\Windows\System\hbxfoQo.exe
  C:\Windows\System\hbxfoQo.exe
  2⤵
  PID:2260
- C:\Windows\System\iXRWwes.exe
  C:\Windows\System\iXRWwes.exe
  2⤵
  PID:2112
- C:\Windows\System\BEdJpji.exe
  C:\Windows\System\BEdJpji.exe
  2⤵
  PID:1928
- C:\Windows\System\MnewcoS.exe
  C:\Windows\System\MnewcoS.exe
  2⤵
  PID:968
- C:\Windows\System\xiBclRO.exe
  C:\Windows\System\xiBclRO.exe
  2⤵
  PID:2188
- C:\Windows\System\MBlaquq.exe
  C:\Windows\System\MBlaquq.exe
  2⤵
  PID:2720
- C:\Windows\System\jBnstKE.exe
  C:\Windows\System\jBnstKE.exe
  2⤵
  PID:2424
- C:\Windows\System\xTrozvJ.exe
  C:\Windows\System\xTrozvJ.exe
  2⤵
  PID:668
- C:\Windows\System\cWnwcbk.exe
  C:\Windows\System\cWnwcbk.exe
  2⤵
  PID:2064
- C:\Windows\System\xzuBpns.exe
  C:\Windows\System\xzuBpns.exe
  2⤵
  PID:2668
- C:\Windows\System\GLDtTIl.exe
  C:\Windows\System\GLDtTIl.exe
  2⤵
  PID:2644
- C:\Windows\System\wxBSuXj.exe
  C:\Windows\System\wxBSuXj.exe
  2⤵
  PID:1976
- C:\Windows\System\Tletkny.exe
  C:\Windows\System\Tletkny.exe
  2⤵
  PID:2684
- C:\Windows\System\PAODeLs.exe
  C:\Windows\System\PAODeLs.exe
  2⤵
  PID:2876
- C:\Windows\System\bdHGxMg.exe
  C:\Windows\System\bdHGxMg.exe
  2⤵
  PID:788
- C:\Windows\System\KupRmQL.exe
  C:\Windows\System\KupRmQL.exe
  2⤵
  PID:688
- C:\Windows\System\SGVjAMM.exe
  C:\Windows\System\SGVjAMM.exe
  2⤵
  PID:2868
- C:\Windows\System\bfHUtPH.exe
  C:\Windows\System\bfHUtPH.exe
  2⤵
  PID:2768
- C:\Windows\System\ubZeOpL.exe
  C:\Windows\System\ubZeOpL.exe
  2⤵
  PID:2732
- C:\Windows\System\qtzWrao.exe
  C:\Windows\System\qtzWrao.exe
  2⤵
  PID:1804
- C:\Windows\System\lykpKqx.exe
  C:\Windows\System\lykpKqx.exe
  2⤵
  PID:1788
- C:\Windows\System\bXUdPzl.exe
  C:\Windows\System\bXUdPzl.exe
  2⤵
  PID:2808
- C:\Windows\System\qeDVrBy.exe
  C:\Windows\System\qeDVrBy.exe
  2⤵
  PID:1612
- C:\Windows\System\aTZfoZI.exe
  C:\Windows\System\aTZfoZI.exe
  2⤵
  PID:2880
- C:\Windows\System\gVkAelV.exe
  C:\Windows\System\gVkAelV.exe
  2⤵
  PID:644
- C:\Windows\System\YyElRBE.exe
  C:\Windows\System\YyElRBE.exe
  2⤵
  PID:2496
- C:\Windows\System\ICGlZQF.exe
  C:\Windows\System\ICGlZQF.exe
  2⤵
  PID:2940
- C:\Windows\System\UgrUNJZ.exe
  C:\Windows\System\UgrUNJZ.exe
  2⤵
  PID:1156
- C:\Windows\System\icKYNWy.exe
  C:\Windows\System\icKYNWy.exe
  2⤵
  PID:604
- C:\Windows\System\BYIjQIe.exe
  C:\Windows\System\BYIjQIe.exe
  2⤵
  PID:1276
- C:\Windows\System\aGwweHN.exe
  C:\Windows\System\aGwweHN.exe
  2⤵
  PID:2556
- C:\Windows\System\LvOLFkF.exe
  C:\Windows\System\LvOLFkF.exe
  2⤵
  PID:1908
- C:\Windows\System\NvkOMvQ.exe
  C:\Windows\System\NvkOMvQ.exe
  2⤵
  PID:2216
- C:\Windows\System\keuIUfW.exe
  C:\Windows\System\keuIUfW.exe
  2⤵
  PID:3068
- C:\Windows\System\xiBpAkN.exe
  C:\Windows\System\xiBpAkN.exe
  2⤵
  PID:2756
- C:\Windows\System\uwrBFpz.exe
  C:\Windows\System\uwrBFpz.exe
  2⤵
  PID:2144
- C:\Windows\System\SjWPVDa.exe
  C:\Windows\System\SjWPVDa.exe
  2⤵
  PID:1816
- C:\Windows\System\pbobLwP.exe
  C:\Windows\System\pbobLwP.exe
  2⤵
  PID:2060
- C:\Windows\System\vsdntzM.exe
  C:\Windows\System\vsdntzM.exe
  2⤵
  PID:2476
- C:\Windows\System\QUrvmJL.exe
  C:\Windows\System\QUrvmJL.exe
  2⤵
  PID:2636
- C:\Windows\System\cUCHhfO.exe
  C:\Windows\System\cUCHhfO.exe
  2⤵
  PID:2796
- C:\Windows\System\jWnJZaF.exe
  C:\Windows\System\jWnJZaF.exe
  2⤵
  PID:2404
- C:\Windows\System\XFMUUIg.exe
  C:\Windows\System\XFMUUIg.exe
  2⤵
  PID:2608
- C:\Windows\System\akpIDfP.exe
  C:\Windows\System\akpIDfP.exe
  2⤵
  PID:1260
- C:\Windows\System\ByqQpaN.exe
  C:\Windows\System\ByqQpaN.exe
  2⤵
  PID:1964
- C:\Windows\System\MwyNRmE.exe
  C:\Windows\System\MwyNRmE.exe
  2⤵
  PID:3080
- C:\Windows\System\wcOORGN.exe
  C:\Windows\System\wcOORGN.exe
  2⤵
  PID:3100
- C:\Windows\System\WVFEcpS.exe
  C:\Windows\System\WVFEcpS.exe
  2⤵
  PID:3116
- C:\Windows\System\BOltRoP.exe
  C:\Windows\System\BOltRoP.exe
  2⤵
  PID:3132
- C:\Windows\System\MeJwEgz.exe
  C:\Windows\System\MeJwEgz.exe
  2⤵
  PID:3148
- C:\Windows\System\whCRGcc.exe
  C:\Windows\System\whCRGcc.exe
  2⤵
  PID:3164
- C:\Windows\System\rqtLlhO.exe
  C:\Windows\System\rqtLlhO.exe
  2⤵
  PID:3180
- C:\Windows\System\hCmHsgX.exe
  C:\Windows\System\hCmHsgX.exe
  2⤵
  PID:3196
- C:\Windows\System\lnYDlJE.exe
  C:\Windows\System\lnYDlJE.exe
  2⤵
  PID:3216
- C:\Windows\System\nVkFvgq.exe
  C:\Windows\System\nVkFvgq.exe
  2⤵
  PID:3232
- C:\Windows\System\KwQQjgz.exe
  C:\Windows\System\KwQQjgz.exe
  2⤵
  PID:3248
- C:\Windows\System\AejkrtI.exe
  C:\Windows\System\AejkrtI.exe
  2⤵
  PID:3264
- C:\Windows\System\biPrAiS.exe
  C:\Windows\System\biPrAiS.exe
  2⤵
  PID:3280
- C:\Windows\System\CCXJfRy.exe
  C:\Windows\System\CCXJfRy.exe
  2⤵
  PID:3296
- C:\Windows\System\mFLVICy.exe
  C:\Windows\System\mFLVICy.exe
  2⤵
  PID:3312
- C:\Windows\System\rKJAQDi.exe
  C:\Windows\System\rKJAQDi.exe
  2⤵
  PID:3328
- C:\Windows\System\wwJbHxc.exe
  C:\Windows\System\wwJbHxc.exe
  2⤵
  PID:3344
- C:\Windows\System\rlAGykx.exe
  C:\Windows\System\rlAGykx.exe
  2⤵
  PID:3360
- C:\Windows\System\mtQvQzz.exe
  C:\Windows\System\mtQvQzz.exe
  2⤵
  PID:3376
- C:\Windows\System\iilNrwR.exe
  C:\Windows\System\iilNrwR.exe
  2⤵
  PID:3392
- C:\Windows\System\kOsVRyn.exe
  C:\Windows\System\kOsVRyn.exe
  2⤵
  PID:3408
- C:\Windows\System\WQwDWmN.exe
  C:\Windows\System\WQwDWmN.exe
  2⤵
  PID:3428
- C:\Windows\System\rytPKDr.exe
  C:\Windows\System\rytPKDr.exe
  2⤵
  PID:3444
- C:\Windows\System\xEvYpRA.exe
  C:\Windows\System\xEvYpRA.exe
  2⤵
  PID:3460
- C:\Windows\System\JpJppan.exe
  C:\Windows\System\JpJppan.exe
  2⤵
  PID:3476
- C:\Windows\System\ahQOGWo.exe
  C:\Windows\System\ahQOGWo.exe
  2⤵
  PID:3492
- C:\Windows\System\wMuLpCU.exe
  C:\Windows\System\wMuLpCU.exe
  2⤵
  PID:3508
- C:\Windows\System\PSeooPZ.exe
  C:\Windows\System\PSeooPZ.exe
  2⤵
  PID:3528
- C:\Windows\System\OZzrYVp.exe
  C:\Windows\System\OZzrYVp.exe
  2⤵
  PID:3640
- C:\Windows\System\wUoZRqI.exe
  C:\Windows\System\wUoZRqI.exe
  2⤵
  PID:3656
- C:\Windows\System\EsWtCCb.exe
  C:\Windows\System\EsWtCCb.exe
  2⤵
  PID:3672
- C:\Windows\System\cfRrYBS.exe
  C:\Windows\System\cfRrYBS.exe
  2⤵
  PID:3688
- C:\Windows\System\HDKeYhn.exe
  C:\Windows\System\HDKeYhn.exe
  2⤵
  PID:3708
- C:\Windows\System\ChoChzA.exe
  C:\Windows\System\ChoChzA.exe
  2⤵
  PID:3736
- C:\Windows\System\dvDIfnc.exe
  C:\Windows\System\dvDIfnc.exe
  2⤵
  PID:3864
- C:\Windows\System\zJTnENZ.exe
  C:\Windows\System\zJTnENZ.exe
  2⤵
  PID:3880
- C:\Windows\System\GBqhWoc.exe
  C:\Windows\System\GBqhWoc.exe
  2⤵
  PID:3896
- C:\Windows\System\EdCgjWP.exe
  C:\Windows\System\EdCgjWP.exe
  2⤵
  PID:3912
- C:\Windows\System\IWQtywR.exe
  C:\Windows\System\IWQtywR.exe
  2⤵
  PID:3928
- C:\Windows\System\NrZtAFg.exe
  C:\Windows\System\NrZtAFg.exe
  2⤵
  PID:3944
- C:\Windows\System\dlnMGGU.exe
  C:\Windows\System\dlnMGGU.exe
  2⤵
  PID:3960
- C:\Windows\System\KZkvWUX.exe
  C:\Windows\System\KZkvWUX.exe
  2⤵
  PID:3976
- C:\Windows\System\BVgjcIf.exe
  C:\Windows\System\BVgjcIf.exe
  2⤵
  PID:3992
- C:\Windows\System\aGNJjZJ.exe
  C:\Windows\System\aGNJjZJ.exe
  2⤵
  PID:4012
- C:\Windows\System\KojXmLn.exe
  C:\Windows\System\KojXmLn.exe
  2⤵
  PID:4028
- C:\Windows\System\niuxvle.exe
  C:\Windows\System\niuxvle.exe
  2⤵
  PID:4044
- C:\Windows\System\FGeDLHy.exe
  C:\Windows\System\FGeDLHy.exe
  2⤵
  PID:4060
- C:\Windows\System\vouyXCG.exe
  C:\Windows\System\vouyXCG.exe
  2⤵
  PID:4076
- C:\Windows\System\XpYpGAu.exe
  C:\Windows\System\XpYpGAu.exe
  2⤵
  PID:4092
- C:\Windows\System\LOtGGGD.exe
  C:\Windows\System\LOtGGGD.exe
  2⤵
  PID:2708
- C:\Windows\System\eQuPbcq.exe
  C:\Windows\System\eQuPbcq.exe
  2⤵
  PID:2332
- C:\Windows\System\sdqCVwD.exe
  C:\Windows\System\sdqCVwD.exe
  2⤵
  PID:2516
- C:\Windows\System\fzHJWrC.exe
  C:\Windows\System\fzHJWrC.exe
  2⤵
  PID:2568
- C:\Windows\System\qrsjqlV.exe
  C:\Windows\System\qrsjqlV.exe
  2⤵
  PID:2356
- C:\Windows\System\tRchAca.exe
  C:\Windows\System\tRchAca.exe
  2⤵
  PID:3096
- C:\Windows\System\paczcwM.exe
  C:\Windows\System\paczcwM.exe
  2⤵
  PID:1704
- C:\Windows\System\LXaHNsm.exe
  C:\Windows\System\LXaHNsm.exe
  2⤵
  PID:2552
- C:\Windows\System\domHxcc.exe
  C:\Windows\System\domHxcc.exe
  2⤵
  PID:856
- C:\Windows\System\fbBqUKP.exe
  C:\Windows\System\fbBqUKP.exe
  2⤵
  PID:2672
- C:\Windows\System\rVVzVdI.exe
  C:\Windows\System\rVVzVdI.exe
  2⤵
  PID:3092
- C:\Windows\System\OYrKDtD.exe
  C:\Windows\System\OYrKDtD.exe
  2⤵
  PID:3320
- C:\Windows\System\ilPRcmW.exe
  C:\Windows\System\ilPRcmW.exe
  2⤵
  PID:3456
- C:\Windows\System\tjFVmDO.exe
  C:\Windows\System\tjFVmDO.exe
  2⤵
  PID:1256
- C:\Windows\System\smGLGDz.exe
  C:\Windows\System\smGLGDz.exe
  2⤵
  PID:1680
- C:\Windows\System\Qtzkoek.exe
  C:\Windows\System\Qtzkoek.exe
  2⤵
  PID:3140
- C:\Windows\System\UaoPjsc.exe
  C:\Windows\System\UaoPjsc.exe
  2⤵
  PID:3204
- C:\Windows\System\WtSoPFV.exe
  C:\Windows\System\WtSoPFV.exe
  2⤵
  PID:3240
- C:\Windows\System\gwOvQWb.exe
  C:\Windows\System\gwOvQWb.exe
  2⤵
  PID:3584
- C:\Windows\System\wsVuSMZ.exe
  C:\Windows\System\wsVuSMZ.exe
  2⤵
  PID:3596
- C:\Windows\System\pwDavXm.exe
  C:\Windows\System\pwDavXm.exe
  2⤵
  PID:3308
- C:\Windows\System\ldDXyjB.exe
  C:\Windows\System\ldDXyjB.exe
  2⤵
  PID:3372
- C:\Windows\System\cHdHKsW.exe
  C:\Windows\System\cHdHKsW.exe
  2⤵
  PID:472
- C:\Windows\System\RlKHfxy.exe
  C:\Windows\System\RlKHfxy.exe
  2⤵
  PID:3572
- C:\Windows\System\WgDeSBH.exe
  C:\Windows\System\WgDeSBH.exe
  2⤵
  PID:3680
- C:\Windows\System\MGbHbFD.exe
  C:\Windows\System\MGbHbFD.exe
  2⤵
  PID:3500
- C:\Windows\System\mQHNUYS.exe
  C:\Windows\System\mQHNUYS.exe
  2⤵
  PID:3624
- C:\Windows\System\TjOzZBI.exe
  C:\Windows\System\TjOzZBI.exe
  2⤵
  PID:1992
- C:\Windows\System\DiDSImS.exe
  C:\Windows\System\DiDSImS.exe
  2⤵
  PID:1644
- C:\Windows\System\FcNTSKX.exe
  C:\Windows\System\FcNTSKX.exe
  2⤵
  PID:3668
- C:\Windows\System\woDbLjs.exe
  C:\Windows\System\woDbLjs.exe
  2⤵
  PID:1032
- C:\Windows\System\VHFharl.exe
  C:\Windows\System\VHFharl.exe
  2⤵
  PID:3764
- C:\Windows\System\UMakfeR.exe
  C:\Windows\System\UMakfeR.exe
  2⤵
  PID:3720
- C:\Windows\System\vBPpSkD.exe
  C:\Windows\System\vBPpSkD.exe
  2⤵
  PID:3768
- C:\Windows\System\rPueKdw.exe
  C:\Windows\System\rPueKdw.exe
  2⤵
  PID:3784
- C:\Windows\System\bJCDYlZ.exe
  C:\Windows\System\bJCDYlZ.exe
  2⤵
  PID:868
- C:\Windows\System\FHbpcJW.exe
  C:\Windows\System\FHbpcJW.exe
  2⤵
  PID:3812
- C:\Windows\System\SVXkHKc.exe
  C:\Windows\System\SVXkHKc.exe
  2⤵
  PID:3848
- C:\Windows\System\urDiHTm.exe
  C:\Windows\System\urDiHTm.exe
  2⤵
  PID:3876
- C:\Windows\System\MsobSHV.exe
  C:\Windows\System\MsobSHV.exe
  2⤵
  PID:3968
- C:\Windows\System\LpQAqZM.exe
  C:\Windows\System\LpQAqZM.exe
  2⤵
  PID:4036
- C:\Windows\System\DdQtMNJ.exe
  C:\Windows\System\DdQtMNJ.exe
  2⤵
  PID:1160
- C:\Windows\System\OhiMQzE.exe
  C:\Windows\System\OhiMQzE.exe
  2⤵
  PID:2680
- C:\Windows\System\IDiGJRD.exe
  C:\Windows\System\IDiGJRD.exe
  2⤵
  PID:3156
- C:\Windows\System\BERArdR.exe
  C:\Windows\System\BERArdR.exe
  2⤵
  PID:4072
- C:\Windows\System\KxVxNvu.exe
  C:\Windows\System\KxVxNvu.exe
  2⤵
  PID:2744
- C:\Windows\System\jFKYcdK.exe
  C:\Windows\System\jFKYcdK.exe
  2⤵
  PID:2752
- C:\Windows\System\babdgvb.exe
  C:\Windows\System\babdgvb.exe
  2⤵
  PID:3520
- C:\Windows\System\fSrMQoE.exe
  C:\Windows\System\fSrMQoE.exe
  2⤵
  PID:1472
- C:\Windows\System\rCGdMIi.exe
  C:\Windows\System\rCGdMIi.exe
  2⤵
  PID:2972
- C:\Windows\System\LLZbinQ.exe
  C:\Windows\System\LLZbinQ.exe
  2⤵
  PID:1700
- C:\Windows\System\Ddjktgk.exe
  C:\Windows\System\Ddjktgk.exe
  2⤵
  PID:3304
- C:\Windows\System\IugJoEC.exe
  C:\Windows\System\IugJoEC.exe
  2⤵
  PID:692
- C:\Windows\System\bXPFtJZ.exe
  C:\Windows\System\bXPFtJZ.exe
  2⤵
  PID:3732
- C:\Windows\System\fdbMCns.exe
  C:\Windows\System\fdbMCns.exe
  2⤵
  PID:3760
- C:\Windows\System\uezeraF.exe
  C:\Windows\System\uezeraF.exe
  2⤵
  PID:4008
- C:\Windows\System\zkyGRnN.exe
  C:\Windows\System\zkyGRnN.exe
  2⤵
  PID:3060
- C:\Windows\System\vdYKFIf.exe
  C:\Windows\System\vdYKFIf.exe
  2⤵
  PID:3544
- C:\Windows\System\XQdqxNA.exe
  C:\Windows\System\XQdqxNA.exe
  2⤵
  PID:3704
- C:\Windows\System\gRpvaTq.exe
  C:\Windows\System\gRpvaTq.exe
  2⤵
  PID:3888
- C:\Windows\System\WlYsqHd.exe
  C:\Windows\System\WlYsqHd.exe
  2⤵
  PID:3984
- C:\Windows\System\juUYJkW.exe
  C:\Windows\System\juUYJkW.exe
  2⤵
  PID:3212
- C:\Windows\System\xpMeYpa.exe
  C:\Windows\System\xpMeYpa.exe
  2⤵
  PID:3260
- C:\Windows\System\TxkvZQo.exe
  C:\Windows\System\TxkvZQo.exe
  2⤵
  PID:3292
- C:\Windows\System\sPfVZcm.exe
  C:\Windows\System\sPfVZcm.exe
  2⤵
  PID:3088
- C:\Windows\System\kQLbPOV.exe
  C:\Windows\System\kQLbPOV.exe
  2⤵
  PID:3484
- C:\Windows\System\uOwuTFR.exe
  C:\Windows\System\uOwuTFR.exe
  2⤵
  PID:3648
- C:\Windows\System\iVVnbdr.exe
  C:\Windows\System\iVVnbdr.exe
  2⤵
  PID:3608
- C:\Windows\System\FsHRBXA.exe
  C:\Windows\System\FsHRBXA.exe
  2⤵
  PID:2916
- C:\Windows\System\JzPubph.exe
  C:\Windows\System\JzPubph.exe
  2⤵
  PID:3796
- C:\Windows\System\EVjDnff.exe
  C:\Windows\System\EVjDnff.exe
  2⤵
  PID:1652
- C:\Windows\System\otEMwxT.exe
  C:\Windows\System\otEMwxT.exe
  2⤵
  PID:2248
- C:\Windows\System\toVNEpg.exe
  C:\Windows\System\toVNEpg.exe
  2⤵
  PID:4024
- C:\Windows\System\uhvFAAh.exe
  C:\Windows\System\uhvFAAh.exe
  2⤵
  PID:2632
- C:\Windows\System\BeZzeXV.exe
  C:\Windows\System\BeZzeXV.exe
  2⤵
  PID:2212
- C:\Windows\System\vzdMcXt.exe
  C:\Windows\System\vzdMcXt.exe
  2⤵
  PID:2548
- C:\Windows\System\wgeOaFy.exe
  C:\Windows\System\wgeOaFy.exe
  2⤵
  PID:3224
- C:\Windows\System\CUPUReu.exe
  C:\Windows\System\CUPUReu.exe
  2⤵
  PID:3288
- C:\Windows\System\TnMgQeV.exe
  C:\Windows\System\TnMgQeV.exe
  2⤵
  PID:2772
- C:\Windows\System\XhcCZjW.exe
  C:\Windows\System\XhcCZjW.exe
  2⤵
  PID:3892
- C:\Windows\System\mLWwTez.exe
  C:\Windows\System\mLWwTez.exe
  2⤵
  PID:3440
- C:\Windows\System\SeCYsoF.exe
  C:\Windows\System\SeCYsoF.exe
  2⤵
  PID:3728
- C:\Windows\System\aqLOnXs.exe
  C:\Windows\System\aqLOnXs.exe
  2⤵
  PID:3472
- C:\Windows\System\lWVnxUG.exe
  C:\Windows\System\lWVnxUG.exe
  2⤵
  PID:3808
- C:\Windows\System\kBfMPLT.exe
  C:\Windows\System\kBfMPLT.exe
  2⤵
  PID:3564
- C:\Windows\System\cFnsfLN.exe
  C:\Windows\System\cFnsfLN.exe
  2⤵
  PID:1812
- C:\Windows\System\smIrqRq.exe
  C:\Windows\System\smIrqRq.exe
  2⤵
  PID:2368
- C:\Windows\System\hwlAcRo.exe
  C:\Windows\System\hwlAcRo.exe
  2⤵
  PID:3424
- C:\Windows\System\ZYqXQbg.exe
  C:\Windows\System\ZYqXQbg.exe
  2⤵
  PID:2120
- C:\Windows\System\ffEinGt.exe
  C:\Windows\System\ffEinGt.exe
  2⤵
  PID:3592
- C:\Windows\System\wOLeZzD.exe
  C:\Windows\System\wOLeZzD.exe
  2⤵
  PID:3368
- C:\Windows\System\zrSTFEk.exe
  C:\Windows\System\zrSTFEk.exe
  2⤵
  PID:2372
- C:\Windows\System\uAaiDkj.exe
  C:\Windows\System\uAaiDkj.exe
  2⤵
  PID:2736
- C:\Windows\System\DjmziNq.exe
  C:\Windows\System\DjmziNq.exe
  2⤵
  PID:3920
- C:\Windows\System\NsROCiF.exe
  C:\Windows\System\NsROCiF.exe
  2⤵
  PID:3956
- C:\Windows\System\PjFkroq.exe
  C:\Windows\System\PjFkroq.exe
  2⤵
  PID:3388
- C:\Windows\System\WcZjQWt.exe
  C:\Windows\System\WcZjQWt.exe
  2⤵
  PID:3176
- C:\Windows\System\erqsuiI.exe
  C:\Windows\System\erqsuiI.exe
  2⤵
  PID:1456
- C:\Windows\System\sdNKHnI.exe
  C:\Windows\System\sdNKHnI.exe
  2⤵
  PID:1220
- C:\Windows\System\opqXcya.exe
  C:\Windows\System\opqXcya.exe
  2⤵
  PID:3276
- C:\Windows\System\LljHfHo.exe
  C:\Windows\System\LljHfHo.exe
  2⤵
  PID:3936
- C:\Windows\System\EfeOJkR.exe
  C:\Windows\System\EfeOJkR.exe
  2⤵
  PID:4108
- C:\Windows\System\ntwlzIp.exe
  C:\Windows\System\ntwlzIp.exe
  2⤵
  PID:4124
- C:\Windows\System\RuKdlDs.exe
  C:\Windows\System\RuKdlDs.exe
  2⤵
  PID:4140
- C:\Windows\System\aQqcxlk.exe
  C:\Windows\System\aQqcxlk.exe
  2⤵
  PID:4156
- C:\Windows\System\wrmwykq.exe
  C:\Windows\System\wrmwykq.exe
  2⤵
  PID:4172
- C:\Windows\System\LvIPCxh.exe
  C:\Windows\System\LvIPCxh.exe
  2⤵
  PID:4188
- C:\Windows\System\JyWzzgA.exe
  C:\Windows\System\JyWzzgA.exe
  2⤵
  PID:4204
- C:\Windows\System\hhvHfLi.exe
  C:\Windows\System\hhvHfLi.exe
  2⤵
  PID:4220
- C:\Windows\System\PkYyqYO.exe
  C:\Windows\System\PkYyqYO.exe
  2⤵
  PID:4236
- C:\Windows\System\WmAbJKi.exe
  C:\Windows\System\WmAbJKi.exe
  2⤵
  PID:4252
- C:\Windows\System\hnYAyQl.exe
  C:\Windows\System\hnYAyQl.exe
  2⤵
  PID:4272
- C:\Windows\System\kLoTbkn.exe
  C:\Windows\System\kLoTbkn.exe
  2⤵
  PID:4372
- C:\Windows\System\TwQCYNa.exe
  C:\Windows\System\TwQCYNa.exe
  2⤵
  PID:4436
- C:\Windows\System\FdKcLiR.exe
  C:\Windows\System\FdKcLiR.exe
  2⤵
  PID:4452
- C:\Windows\System\EBeNHyT.exe
  C:\Windows\System\EBeNHyT.exe
  2⤵
  PID:4468
- C:\Windows\System\KppTzBe.exe
  C:\Windows\System\KppTzBe.exe
  2⤵
  PID:4488
- C:\Windows\System\tcIMvTv.exe
  C:\Windows\System\tcIMvTv.exe
  2⤵
  PID:4504
- C:\Windows\System\PevcNus.exe
  C:\Windows\System\PevcNus.exe
  2⤵
  PID:4520
- C:\Windows\System\BYbHrIG.exe
  C:\Windows\System\BYbHrIG.exe
  2⤵
  PID:4536
- C:\Windows\System\DbvJSMO.exe
  C:\Windows\System\DbvJSMO.exe
  2⤵
  PID:4588
- C:\Windows\System\ENOOQLF.exe
  C:\Windows\System\ENOOQLF.exe
  2⤵
  PID:4604
- C:\Windows\System\cIhcGWR.exe
  C:\Windows\System\cIhcGWR.exe
  2⤵
  PID:4620
- C:\Windows\System\kmpnWRL.exe
  C:\Windows\System\kmpnWRL.exe
  2⤵
  PID:4636
- C:\Windows\System\SuwaBMD.exe
  C:\Windows\System\SuwaBMD.exe
  2⤵
  PID:4668
- C:\Windows\System\QmkPRam.exe
  C:\Windows\System\QmkPRam.exe
  2⤵
  PID:4684
- C:\Windows\System\DTkglht.exe
  C:\Windows\System\DTkglht.exe
  2⤵
  PID:4700
- C:\Windows\System\IEUWDts.exe
  C:\Windows\System\IEUWDts.exe
  2⤵
  PID:4716
- C:\Windows\System\ZSnCJYe.exe
  C:\Windows\System\ZSnCJYe.exe
  2⤵
  PID:4732
- C:\Windows\System\rSbxWCt.exe
  C:\Windows\System\rSbxWCt.exe
  2⤵
  PID:4748
- C:\Windows\System\QraXbyf.exe
  C:\Windows\System\QraXbyf.exe
  2⤵
  PID:4780
- C:\Windows\System\XXenRmA.exe
  C:\Windows\System\XXenRmA.exe
  2⤵
  PID:4804
- C:\Windows\System\eJrJFKf.exe
  C:\Windows\System\eJrJFKf.exe
  2⤵
  PID:4828
- C:\Windows\System\hcIeUBF.exe
  C:\Windows\System\hcIeUBF.exe
  2⤵
  PID:4848
- C:\Windows\System\FxmDAGr.exe
  C:\Windows\System\FxmDAGr.exe
  2⤵
  PID:4864
- C:\Windows\System\FtaYnTV.exe
  C:\Windows\System\FtaYnTV.exe
  2⤵
  PID:4888
- C:\Windows\System\vtRLBah.exe
  C:\Windows\System\vtRLBah.exe
  2⤵
  PID:4904
- C:\Windows\System\mVYqYHL.exe
  C:\Windows\System\mVYqYHL.exe
  2⤵
  PID:4924
- C:\Windows\System\NDynADD.exe
  C:\Windows\System\NDynADD.exe
  2⤵
  PID:4944
- C:\Windows\System\iGRTkJo.exe
  C:\Windows\System\iGRTkJo.exe
  2⤵
  PID:4964
- C:\Windows\System\PloxibR.exe
  C:\Windows\System\PloxibR.exe
  2⤵
  PID:4996
- C:\Windows\System\XlYbgwE.exe
  C:\Windows\System\XlYbgwE.exe
  2⤵
  PID:5020
- C:\Windows\System\CDRouge.exe
  C:\Windows\System\CDRouge.exe
  2⤵
  PID:5068
- C:\Windows\System\sAiqTYF.exe
  C:\Windows\System\sAiqTYF.exe
  2⤵
  PID:5092
- C:\Windows\System\tAXfJXC.exe
  C:\Windows\System\tAXfJXC.exe
  2⤵
  PID:5108
- C:\Windows\System\TqiViri.exe
  C:\Windows\System\TqiViri.exe
  2⤵
  PID:4104
- C:\Windows\System\csnfLJj.exe
  C:\Windows\System\csnfLJj.exe
  2⤵
  PID:1756
- C:\Windows\System\tDLXVsY.exe
  C:\Windows\System\tDLXVsY.exe
  2⤵
  PID:4000
- C:\Windows\System\ldVvSSO.exe
  C:\Windows\System\ldVvSSO.exe
  2⤵
  PID:608
- C:\Windows\System\KwDbQBp.exe
  C:\Windows\System\KwDbQBp.exe
  2⤵
  PID:3700
- C:\Windows\System\ixKvuFM.exe
  C:\Windows\System\ixKvuFM.exe
  2⤵
  PID:1952
- C:\Windows\System\uwUbFnB.exe
  C:\Windows\System\uwUbFnB.exe
  2⤵
  PID:4152
- C:\Windows\System\SImKbuk.exe
  C:\Windows\System\SImKbuk.exe
  2⤵
  PID:4228
- C:\Windows\System\OekiiiL.exe
  C:\Windows\System\OekiiiL.exe
  2⤵
  PID:4200
- C:\Windows\System\vMiiQXa.exe
  C:\Windows\System\vMiiQXa.exe
  2⤵
  PID:4312
- C:\Windows\System\jYJkojF.exe
  C:\Windows\System\jYJkojF.exe
  2⤵
  PID:4244
- C:\Windows\System\LEVDDhM.exe
  C:\Windows\System\LEVDDhM.exe
  2⤵
  PID:4320
- C:\Windows\System\nXrBkyx.exe
  C:\Windows\System\nXrBkyx.exe
  2⤵
  PID:4344
- C:\Windows\System\EkRryBe.exe
  C:\Windows\System\EkRryBe.exe
  2⤵
  PID:4380
- C:\Windows\System\DyPGTEy.exe
  C:\Windows\System\DyPGTEy.exe
  2⤵
  PID:4408
- C:\Windows\System\pWsYEEx.exe
  C:\Windows\System\pWsYEEx.exe
  2⤵
  PID:4424
- C:\Windows\System\dqaRIcf.exe
  C:\Windows\System\dqaRIcf.exe
  2⤵
  PID:4460
- C:\Windows\System\uGzmdXu.exe
  C:\Windows\System\uGzmdXu.exe
  2⤵
  PID:4500
- C:\Windows\System\mmxcwrD.exe
  C:\Windows\System\mmxcwrD.exe
  2⤵
  PID:4484
- C:\Windows\System\gmAnPiV.exe
  C:\Windows\System\gmAnPiV.exe
  2⤵
  PID:4544
- C:\Windows\System\IzSXufH.exe
  C:\Windows\System\IzSXufH.exe
  2⤵
  PID:4560
- C:\Windows\System\ZhkzKJo.exe
  C:\Windows\System\ZhkzKJo.exe
  2⤵
  PID:4572
- C:\Windows\System\cHSnXrN.exe
  C:\Windows\System\cHSnXrN.exe
  2⤵
  PID:4600
- C:\Windows\System\XZViCyN.exe
  C:\Windows\System\XZViCyN.exe
  2⤵
  PID:4612
- C:\Windows\System\oXpvtiV.exe
  C:\Windows\System\oXpvtiV.exe
  2⤵
  PID:4660
- C:\Windows\System\wfElanP.exe
  C:\Windows\System\wfElanP.exe
  2⤵
  PID:4648
- C:\Windows\System\EzzWgYt.exe
  C:\Windows\System\EzzWgYt.exe
  2⤵
  PID:4788
- C:\Windows\System\pLuyvut.exe
  C:\Windows\System\pLuyvut.exe
  2⤵
  PID:4812
- C:\Windows\System\kwBxcdu.exe
  C:\Windows\System\kwBxcdu.exe
  2⤵
  PID:4824
- C:\Windows\System\gaWJDdI.exe
  C:\Windows\System\gaWJDdI.exe
  2⤵
  PID:4844
- C:\Windows\System\IlfVvHR.exe
  C:\Windows\System\IlfVvHR.exe
  2⤵
  PID:4884
- C:\Windows\System\doLwPqG.exe
  C:\Windows\System\doLwPqG.exe
  2⤵
  PID:4916
- C:\Windows\System\pTqhcoZ.exe
  C:\Windows\System\pTqhcoZ.exe
  2⤵
  PID:4940
- C:\Windows\System\QWLeRTS.exe
  C:\Windows\System\QWLeRTS.exe
  2⤵
  PID:4988
- C:\Windows\System\bvsaTNC.exe
  C:\Windows\System\bvsaTNC.exe
  2⤵
  PID:4992
- C:\Windows\System\fscmwjz.exe
  C:\Windows\System\fscmwjz.exe
  2⤵
  PID:5028
- C:\Windows\System\tvvleSb.exe
  C:\Windows\System\tvvleSb.exe
  2⤵
  PID:5036
- C:\Windows\System\XRLBHWZ.exe
  C:\Windows\System\XRLBHWZ.exe
  2⤵
  PID:5060
- C:\Windows\System\UZxdEsf.exe
  C:\Windows\System\UZxdEsf.exe
  2⤵
  PID:4164
- C:\Windows\System\klrspZP.exe
  C:\Windows\System\klrspZP.exe
  2⤵
  PID:3420
- C:\Windows\System\rtfKkYQ.exe
  C:\Windows\System\rtfKkYQ.exe
  2⤵
  PID:4088
- C:\Windows\System\FrTbdvg.exe
  C:\Windows\System\FrTbdvg.exe
  2⤵
  PID:4148
- C:\Windows\System\JRWVvAr.exe
  C:\Windows\System\JRWVvAr.exe
  2⤵
  PID:4880
- C:\Windows\System\qSOOBCv.exe
  C:\Windows\System\qSOOBCv.exe
  2⤵
  PID:4268
- C:\Windows\System\cEfqYyi.exe
  C:\Windows\System\cEfqYyi.exe
  2⤵
  PID:4248
- C:\Windows\System\aNIUyLg.exe
  C:\Windows\System\aNIUyLg.exe
  2⤵
  PID:2172
- C:\Windows\System\YuScwkb.exe
  C:\Windows\System\YuScwkb.exe
  2⤵
  PID:4396
- C:\Windows\System\VDIFvDB.exe
  C:\Windows\System\VDIFvDB.exe
  2⤵
  PID:4552
- C:\Windows\System\jMhcmgD.exe
  C:\Windows\System\jMhcmgD.exe
  2⤵
  PID:4412
- C:\Windows\System\mGMkPSk.exe
  C:\Windows\System\mGMkPSk.exe
  2⤵
  PID:4496
- C:\Windows\System\JFNkmxD.exe
  C:\Windows\System\JFNkmxD.exe
  2⤵
  PID:4548
- C:\Windows\System\FAiWqwm.exe
  C:\Windows\System\FAiWqwm.exe
  2⤵
  PID:4744
- C:\Windows\System\HlEaxes.exe
  C:\Windows\System\HlEaxes.exe
  2⤵
  PID:4696
- C:\Windows\System\cUkPZIB.exe
  C:\Windows\System\cUkPZIB.exe
  2⤵
  PID:4724
- C:\Windows\System\vzBFlRV.exe
  C:\Windows\System\vzBFlRV.exe
  2⤵
  PID:4772
- C:\Windows\System\kwQdQhs.exe
  C:\Windows\System\kwQdQhs.exe
  2⤵
  PID:4796
- C:\Windows\System\WOMNMnY.exe
  C:\Windows\System\WOMNMnY.exe
  2⤵
  PID:4876
- C:\Windows\System\kjZZEep.exe
  C:\Windows\System\kjZZEep.exe
  2⤵
  PID:4956
- C:\Windows\System\rWwnLNg.exe
  C:\Windows\System\rWwnLNg.exe
  2⤵
  PID:5076
- C:\Windows\System\eLeHPbd.exe
  C:\Windows\System\eLeHPbd.exe
  2⤵
  PID:4912
- C:\Windows\System\cTugbVe.exe
  C:\Windows\System\cTugbVe.exe
  2⤵
  PID:5088
- C:\Windows\System\MkKqNWI.exe
  C:\Windows\System\MkKqNWI.exe
  2⤵
  PID:4136
- C:\Windows\System\jwmwuun.exe
  C:\Windows\System\jwmwuun.exe
  2⤵
  PID:3632
- C:\Windows\System\fvgSbpM.exe
  C:\Windows\System\fvgSbpM.exe
  2⤵
  PID:5100
- C:\Windows\System\mgbuIyM.exe
  C:\Windows\System\mgbuIyM.exe
  2⤵
  PID:3340
- C:\Windows\System\HryOiNB.exe
  C:\Windows\System\HryOiNB.exe
  2⤵
  PID:4120
- C:\Windows\System\XvxYZOU.exe
  C:\Windows\System\XvxYZOU.exe
  2⤵
  PID:4260
- C:\Windows\System\yiVfRvt.exe
  C:\Windows\System\yiVfRvt.exe
  2⤵
  PID:4336
- C:\Windows\System\AwZrztV.exe
  C:\Windows\System\AwZrztV.exe
  2⤵
  PID:4340
- C:\Windows\System\MDsukiI.exe
  C:\Windows\System\MDsukiI.exe
  2⤵
  PID:4392
- C:\Windows\System\gFiNmIj.exe
  C:\Windows\System\gFiNmIj.exe
  2⤵
  PID:488
- C:\Windows\System\tuptOtK.exe
  C:\Windows\System\tuptOtK.exe
  2⤵
  PID:4712
- C:\Windows\System\uHFWfOg.exe
  C:\Windows\System\uHFWfOg.exe
  2⤵
  PID:4680
- C:\Windows\System\iATAHyR.exe
  C:\Windows\System\iATAHyR.exe
  2⤵
  PID:4860
- C:\Windows\System\tLUMsKg.exe
  C:\Windows\System\tLUMsKg.exe
  2⤵
  PID:4584
- C:\Windows\System\CZiaLUB.exe
  C:\Windows\System\CZiaLUB.exe
  2⤵
  PID:4384
- C:\Windows\System\zvvlJJr.exe
  C:\Windows\System\zvvlJJr.exe
  2⤵
  PID:1744
- C:\Windows\System\HaBYQhq.exe
  C:\Windows\System\HaBYQhq.exe
  2⤵
  PID:4708
- C:\Windows\System\LbuZaSz.exe
  C:\Windows\System\LbuZaSz.exe
  2⤵
  PID:5104
- C:\Windows\System\fuDdtPn.exe
  C:\Windows\System\fuDdtPn.exe
  2⤵
  PID:4356
- C:\Windows\System\yPPNfSZ.exe
  C:\Windows\System\yPPNfSZ.exe
  2⤵
  PID:4936
- C:\Windows\System\sPPAaKh.exe
  C:\Windows\System\sPPAaKh.exe
  2⤵
  PID:5012
- C:\Windows\System\bNwpaor.exe
  C:\Windows\System\bNwpaor.exe
  2⤵
  PID:5172
- C:\Windows\System\XLgcZIK.exe
  C:\Windows\System\XLgcZIK.exe
  2⤵
  PID:5188
- C:\Windows\System\kLVufRG.exe
  C:\Windows\System\kLVufRG.exe
  2⤵
  PID:5204
- C:\Windows\System\WnIMSTB.exe
  C:\Windows\System\WnIMSTB.exe
  2⤵
  PID:5220
- C:\Windows\System\EdFjwNZ.exe
  C:\Windows\System\EdFjwNZ.exe
  2⤵
  PID:5240
- C:\Windows\System\jGTjxsx.exe
  C:\Windows\System\jGTjxsx.exe
  2⤵
  PID:5256
- C:\Windows\System\YmdSBor.exe
  C:\Windows\System\YmdSBor.exe
  2⤵
  PID:5272
- C:\Windows\System\mvZmZDl.exe
  C:\Windows\System\mvZmZDl.exe
  2⤵
  PID:5288
- C:\Windows\System\SPdEaUM.exe
  C:\Windows\System\SPdEaUM.exe
  2⤵
  PID:5304
- C:\Windows\System\qpLjMnl.exe
  C:\Windows\System\qpLjMnl.exe
  2⤵
  PID:5320
- C:\Windows\System\axoSVxP.exe
  C:\Windows\System\axoSVxP.exe
  2⤵
  PID:5336
- C:\Windows\System\ZALKypH.exe
  C:\Windows\System\ZALKypH.exe
  2⤵
  PID:5352
- C:\Windows\System\QDETAci.exe
  C:\Windows\System\QDETAci.exe
  2⤵
  PID:5368
- C:\Windows\System\cXudgcj.exe
  C:\Windows\System\cXudgcj.exe
  2⤵
  PID:5384
- C:\Windows\System\XxhoVsj.exe
  C:\Windows\System\XxhoVsj.exe
  2⤵
  PID:5400
- C:\Windows\System\IzveBTO.exe
  C:\Windows\System\IzveBTO.exe
  2⤵
  PID:5416
- C:\Windows\System\FkjZkxk.exe
  C:\Windows\System\FkjZkxk.exe
  2⤵
  PID:5432
- C:\Windows\System\hPBIFow.exe
  C:\Windows\System\hPBIFow.exe
  2⤵
  PID:5448
- C:\Windows\System\anUwhrm.exe
  C:\Windows\System\anUwhrm.exe
  2⤵
  PID:5464
- C:\Windows\System\NGPeocc.exe
  C:\Windows\System\NGPeocc.exe
  2⤵
  PID:5480
- C:\Windows\System\pemewyR.exe
  C:\Windows\System\pemewyR.exe
  2⤵
  PID:5496
- C:\Windows\System\PZCbFbZ.exe
  C:\Windows\System\PZCbFbZ.exe
  2⤵
  PID:5512
- C:\Windows\System\ewMqyvh.exe
  C:\Windows\System\ewMqyvh.exe
  2⤵
  PID:5528
- C:\Windows\System\vPgEyTX.exe
  C:\Windows\System\vPgEyTX.exe
  2⤵
  PID:5544
- C:\Windows\System\xcUotkM.exe
  C:\Windows\System\xcUotkM.exe
  2⤵
  PID:5564
- C:\Windows\System\MruUsLE.exe
  C:\Windows\System\MruUsLE.exe
  2⤵
  PID:5580
- C:\Windows\System\FLIzbdj.exe
  C:\Windows\System\FLIzbdj.exe
  2⤵
  PID:5596
- C:\Windows\System\YMxhVZx.exe
  C:\Windows\System\YMxhVZx.exe
  2⤵
  PID:5728
- C:\Windows\System\ZcXtsmC.exe
  C:\Windows\System\ZcXtsmC.exe
  2⤵
  PID:5744
- C:\Windows\System\ZvlsCSb.exe
  C:\Windows\System\ZvlsCSb.exe
  2⤵
  PID:5760
- C:\Windows\System\qwASTPv.exe
  C:\Windows\System\qwASTPv.exe
  2⤵
  PID:5776
- C:\Windows\System\JlVjhox.exe
  C:\Windows\System\JlVjhox.exe
  2⤵
  PID:5792
- C:\Windows\System\CZwxglA.exe
  C:\Windows\System\CZwxglA.exe
  2⤵
  PID:5808
- C:\Windows\System\cnXVumu.exe
  C:\Windows\System\cnXVumu.exe
  2⤵
  PID:5828
- C:\Windows\System\XeJrsBH.exe
  C:\Windows\System\XeJrsBH.exe
  2⤵
  PID:5844
- C:\Windows\System\fOuGHfV.exe
  C:\Windows\System\fOuGHfV.exe
  2⤵
  PID:5860
- C:\Windows\System\NKeIOFd.exe
  C:\Windows\System\NKeIOFd.exe
  2⤵
  PID:5876
- C:\Windows\System\gqnenBc.exe
  C:\Windows\System\gqnenBc.exe
  2⤵
  PID:5892
- C:\Windows\System\aeokNXf.exe
  C:\Windows\System\aeokNXf.exe
  2⤵
  PID:5912
- C:\Windows\System\gsqQSIP.exe
  C:\Windows\System\gsqQSIP.exe
  2⤵
  PID:5928
- C:\Windows\System\TpQDUCm.exe
  C:\Windows\System\TpQDUCm.exe
  2⤵
  PID:5944
- C:\Windows\System\GpmLaqV.exe
  C:\Windows\System\GpmLaqV.exe
  2⤵
  PID:5960
- C:\Windows\System\fuWepUV.exe
  C:\Windows\System\fuWepUV.exe
  2⤵
  PID:5976
- C:\Windows\System\MXcTAQQ.exe
  C:\Windows\System\MXcTAQQ.exe
  2⤵
  PID:5992
- C:\Windows\System\ElYPkKi.exe
  C:\Windows\System\ElYPkKi.exe
  2⤵
  PID:6012
- C:\Windows\System\EBxVXkg.exe
  C:\Windows\System\EBxVXkg.exe
  2⤵
  PID:6028
- C:\Windows\System\GSAOkuF.exe
  C:\Windows\System\GSAOkuF.exe
  2⤵
  PID:6044
- C:\Windows\System\wXiWkUE.exe
  C:\Windows\System\wXiWkUE.exe
  2⤵
  PID:6060
- C:\Windows\System\YZQneoi.exe
  C:\Windows\System\YZQneoi.exe
  2⤵
  PID:6076
- C:\Windows\System\lsgtTzs.exe
  C:\Windows\System\lsgtTzs.exe
  2⤵
  PID:6100
- C:\Windows\System\XgBBpos.exe
  C:\Windows\System\XgBBpos.exe
  2⤵
  PID:6116
- C:\Windows\System\QjaZOMC.exe
  C:\Windows\System\QjaZOMC.exe
  2⤵
  PID:6132
- C:\Windows\System\zzqEmUs.exe
  C:\Windows\System\zzqEmUs.exe
  2⤵
  PID:5084
- C:\Windows\System\MoZzPRS.exe
  C:\Windows\System\MoZzPRS.exe
  2⤵
  PID:4740
- C:\Windows\System\sDGeNvq.exe
  C:\Windows\System\sDGeNvq.exe
  2⤵
  PID:5080
- C:\Windows\System\WIWfEjs.exe
  C:\Windows\System\WIWfEjs.exe
  2⤵
  PID:4800
- C:\Windows\System\fkcEYWJ.exe
  C:\Windows\System\fkcEYWJ.exe
  2⤵
  PID:5124
- C:\Windows\System\uKJutfi.exe
  C:\Windows\System\uKJutfi.exe
  2⤵
  PID:5056
- C:\Windows\System\NIRbFnS.exe
  C:\Windows\System\NIRbFnS.exe
  2⤵
  PID:5200
- C:\Windows\System\kDuYzmw.exe
  C:\Windows\System\kDuYzmw.exe
  2⤵
  PID:5524
- C:\Windows\System\BXMOnEI.exe
  C:\Windows\System\BXMOnEI.exe
  2⤵
  PID:5296
- C:\Windows\System\DZimzbg.exe
  C:\Windows\System\DZimzbg.exe
  2⤵
  PID:5592
- C:\Windows\System\DboaCyo.exe
  C:\Windows\System\DboaCyo.exe
  2⤵
  PID:5280
- C:\Windows\System\AtQAOQU.exe
  C:\Windows\System\AtQAOQU.exe
  2⤵
  PID:5216
- C:\Windows\System\YXvKpDN.exe
  C:\Windows\System\YXvKpDN.exe
  2⤵
  PID:5504
- C:\Windows\System\jdmMbVE.exe
  C:\Windows\System\jdmMbVE.exe
  2⤵
  PID:5252
- C:\Windows\System\OQxeCdx.exe
  C:\Windows\System\OQxeCdx.exe
  2⤵
  PID:5376
- C:\Windows\System\agUleGE.exe
  C:\Windows\System\agUleGE.exe
  2⤵
  PID:5476
- C:\Windows\System\KYZoJrm.exe
  C:\Windows\System\KYZoJrm.exe
  2⤵
  PID:5572
- C:\Windows\System\LBaZVCq.exe
  C:\Windows\System\LBaZVCq.exe
  2⤵
  PID:5616
- C:\Windows\System\PDZISHP.exe
  C:\Windows\System\PDZISHP.exe
  2⤵
  PID:5632
- C:\Windows\System\oUNzXSb.exe
  C:\Windows\System\oUNzXSb.exe
  2⤵
  PID:5648
- C:\Windows\System\cduetZG.exe
  C:\Windows\System\cduetZG.exe
  2⤵
  PID:5656
- C:\Windows\System\sPbSrfJ.exe
  C:\Windows\System\sPbSrfJ.exe
  2⤵
  PID:5680
- C:\Windows\System\hGShlIT.exe
  C:\Windows\System\hGShlIT.exe
  2⤵
  PID:5700
- C:\Windows\System\pdRbbuY.exe
  C:\Windows\System\pdRbbuY.exe
  2⤵
  PID:5712
- C:\Windows\System\hebgvAz.exe
  C:\Windows\System\hebgvAz.exe
  2⤵
  PID:5740
- C:\Windows\System\rUthbjS.exe
  C:\Windows\System\rUthbjS.exe
  2⤵
  PID:5804
- C:\Windows\System\neMOrsf.exe
  C:\Windows\System\neMOrsf.exe
  2⤵
  PID:5868
- C:\Windows\System\VdgblBD.exe
  C:\Windows\System\VdgblBD.exe
  2⤵
  PID:5908
- C:\Windows\System\CMppmGv.exe
  C:\Windows\System\CMppmGv.exe
  2⤵
  PID:5788
- C:\Windows\System\ZvxaATe.exe
  C:\Windows\System\ZvxaATe.exe
  2⤵
  PID:5972
- C:\Windows\System\IvMFTUm.exe
  C:\Windows\System\IvMFTUm.exe
  2⤵
  PID:5820
- C:\Windows\System\rSbLtGe.exe
  C:\Windows\System\rSbLtGe.exe
  2⤵
  PID:6000
- C:\Windows\System\GMZLjja.exe
  C:\Windows\System\GMZLjja.exe
  2⤵
  PID:5824
- C:\Windows\System\xDuxipK.exe
  C:\Windows\System\xDuxipK.exe
  2⤵
  PID:6072
- C:\Windows\System\UBBNgad.exe
  C:\Windows\System\UBBNgad.exe
  2⤵
  PID:5940
- C:\Windows\System\GDSibya.exe
  C:\Windows\System\GDSibya.exe
  2⤵
  PID:6052
- C:\Windows\System\QBtRRAQ.exe
  C:\Windows\System\QBtRRAQ.exe
  2⤵
  PID:6088
- C:\Windows\System\uNQnSfV.exe
  C:\Windows\System\uNQnSfV.exe
  2⤵
  PID:1616
- C:\Windows\System\XmGRtCb.exe
  C:\Windows\System\XmGRtCb.exe
  2⤵
  PID:3488
- C:\Windows\System\hzNtUQr.exe
  C:\Windows\System\hzNtUQr.exe
  2⤵
  PID:4664
- C:\Windows\System\PwaynLZ.exe
  C:\Windows\System\PwaynLZ.exe
  2⤵
  PID:4512
- C:\Windows\System\vRqCrqS.exe
  C:\Windows\System\vRqCrqS.exe
  2⤵
  PID:5152
- C:\Windows\System\lfPANeO.exe
  C:\Windows\System\lfPANeO.exe
  2⤵
  PID:4020
- C:\Windows\System\ueUErZK.exe
  C:\Windows\System\ueUErZK.exe
  2⤵
  PID:4352
- C:\Windows\System\VUktktz.exe
  C:\Windows\System\VUktktz.exe
  2⤵
  PID:5196
- C:\Windows\System\EMOBtyF.exe
  C:\Windows\System\EMOBtyF.exe
  2⤵
  PID:5456
- C:\Windows\System\PDhynnq.exe
  C:\Windows\System\PDhynnq.exe
  2⤵
  PID:5268
- C:\Windows\System\JmwxTie.exe
  C:\Windows\System\JmwxTie.exe
  2⤵
  PID:5364
- C:\Windows\System\htmcJXO.exe
  C:\Windows\System\htmcJXO.exe
  2⤵
  PID:5184
- C:\Windows\System\XCOLHFn.exe
  C:\Windows\System\XCOLHFn.exe
  2⤵
  PID:5628
- C:\Windows\System\AVAmGon.exe
  C:\Windows\System\AVAmGon.exe
  2⤵
  PID:5672
- C:\Windows\System\GJlIQVd.exe
  C:\Windows\System\GJlIQVd.exe
  2⤵
  PID:5696
- C:\Windows\System\WbkLyXv.exe
  C:\Windows\System\WbkLyXv.exe
  2⤵
  PID:5640
- C:\Windows\System\GcFdxbd.exe
  C:\Windows\System\GcFdxbd.exe
  2⤵
  PID:5668
- C:\Windows\System\bVENzmn.exe
  C:\Windows\System\bVENzmn.exe
  2⤵
  PID:6040
- C:\Windows\System\wJBQNDf.exe
  C:\Windows\System\wJBQNDf.exe
  2⤵
  PID:5784
- C:\Windows\System\mqBQVWV.exe
  C:\Windows\System\mqBQVWV.exe
  2⤵
  PID:6096
- C:\Windows\System\ICOHkDO.exe
  C:\Windows\System\ICOHkDO.exe
  2⤵
  PID:4596
- C:\Windows\System\YFNmoGE.exe
  C:\Windows\System\YFNmoGE.exe
  2⤵
  PID:5168
- C:\Windows\System\KPpwpJD.exe
  C:\Windows\System\KPpwpJD.exe
  2⤵
  PID:5236
- C:\Windows\System\lZOapTX.exe
  C:\Windows\System\lZOapTX.exe
  2⤵
  PID:5444
- C:\Windows\System\NyVkcyQ.exe
  C:\Windows\System\NyVkcyQ.exe
  2⤵
  PID:5560
- C:\Windows\System\shQJDKQ.exe
  C:\Windows\System\shQJDKQ.exe
  2⤵
  PID:5800
- C:\Windows\System\vGUUSWT.exe
  C:\Windows\System\vGUUSWT.exe
  2⤵
  PID:5968
- C:\Windows\System\XxUkomS.exe
  C:\Windows\System\XxUkomS.exe
  2⤵
  PID:5888
- C:\Windows\System\yAFBASc.exe
  C:\Windows\System\yAFBASc.exe
  2⤵
  PID:1560
- C:\Windows\System\lyvpkIy.exe
  C:\Windows\System\lyvpkIy.exe
  2⤵
  PID:4296
- C:\Windows\System\IJIksXA.exe
  C:\Windows\System\IJIksXA.exe
  2⤵
  PID:5300
- C:\Windows\System\INAvCyc.exe
  C:\Windows\System\INAvCyc.exe
  2⤵
  PID:5540
- C:\Windows\System\zYecjfr.exe
  C:\Windows\System\zYecjfr.exe
  2⤵
  PID:5472
- C:\Windows\System\ICMuhXI.exe
  C:\Windows\System\ICMuhXI.exe
  2⤵
  PID:6024
- C:\Windows\System\BPSgrvU.exe
  C:\Windows\System\BPSgrvU.exe
  2⤵
  PID:5644
- C:\Windows\System\ApcpIHJ.exe
  C:\Windows\System\ApcpIHJ.exe
  2⤵
  PID:5840
- C:\Windows\System\PXFKODm.exe
  C:\Windows\System\PXFKODm.exe
  2⤵
  PID:5360
- C:\Windows\System\zVJGDRx.exe
  C:\Windows\System\zVJGDRx.exe
  2⤵
  PID:6084
- C:\Windows\System\FfAihMn.exe
  C:\Windows\System\FfAihMn.exe
  2⤵
  PID:5704
- C:\Windows\System\PDXSNNt.exe
  C:\Windows\System\PDXSNNt.exe
  2⤵
  PID:5708
- C:\Windows\System\ETHhYgd.exe
  C:\Windows\System\ETHhYgd.exe
  2⤵
  PID:5316
- C:\Windows\System\ViwEAVY.exe
  C:\Windows\System\ViwEAVY.exe
  2⤵
  PID:5612
- C:\Windows\System\GgtFsSR.exe
  C:\Windows\System\GgtFsSR.exe
  2⤵
  PID:5856
- C:\Windows\System\Efsvwfu.exe
  C:\Windows\System\Efsvwfu.exe
  2⤵
  PID:6152
- C:\Windows\System\dWBpmwe.exe
  C:\Windows\System\dWBpmwe.exe
  2⤵
  PID:6168
- C:\Windows\System\FcJaJLp.exe
  C:\Windows\System\FcJaJLp.exe
  2⤵
  PID:6184
- C:\Windows\System\EefvcMF.exe
  C:\Windows\System\EefvcMF.exe
  2⤵
  PID:6200
- C:\Windows\System\omEzZjt.exe
  C:\Windows\System\omEzZjt.exe
  2⤵
  PID:6216
- C:\Windows\System\kvVLhNR.exe
  C:\Windows\System\kvVLhNR.exe
  2⤵
  PID:6232
- C:\Windows\System\ZYVewpY.exe
  C:\Windows\System\ZYVewpY.exe
  2⤵
  PID:6252
- C:\Windows\System\hQmgUDA.exe
  C:\Windows\System\hQmgUDA.exe
  2⤵
  PID:6268
- C:\Windows\System\zuJyafc.exe
  C:\Windows\System\zuJyafc.exe
  2⤵
  PID:6284
- C:\Windows\System\ZwcByHr.exe
  C:\Windows\System\ZwcByHr.exe
  2⤵
  PID:6300
- C:\Windows\System\PZroGJx.exe
  C:\Windows\System\PZroGJx.exe
  2⤵
  PID:6316
- C:\Windows\System\bgcOEmw.exe
  C:\Windows\System\bgcOEmw.exe
  2⤵
  PID:6332
- C:\Windows\System\qeHoNLt.exe
  C:\Windows\System\qeHoNLt.exe
  2⤵
  PID:6348
- C:\Windows\System\xMbXqZX.exe
  C:\Windows\System\xMbXqZX.exe
  2⤵
  PID:6364
- C:\Windows\System\TIpQdja.exe
  C:\Windows\System\TIpQdja.exe
  2⤵
  PID:6380
- C:\Windows\System\wEQETJx.exe
  C:\Windows\System\wEQETJx.exe
  2⤵
  PID:6400
- C:\Windows\System\hKKftXY.exe
  C:\Windows\System\hKKftXY.exe
  2⤵
  PID:6416
- C:\Windows\System\qUOHgoK.exe
  C:\Windows\System\qUOHgoK.exe
  2⤵
  PID:6432
- C:\Windows\System\dxGgIyG.exe
  C:\Windows\System\dxGgIyG.exe
  2⤵
  PID:6448
- C:\Windows\System\msDevzl.exe
  C:\Windows\System\msDevzl.exe
  2⤵
  PID:6464
- C:\Windows\System\SkXjlxC.exe
  C:\Windows\System\SkXjlxC.exe
  2⤵
  PID:6480
- C:\Windows\System\eQokHFe.exe
  C:\Windows\System\eQokHFe.exe
  2⤵
  PID:6496
- C:\Windows\System\TmrNKSM.exe
  C:\Windows\System\TmrNKSM.exe
  2⤵
  PID:6516
- C:\Windows\System\poawVvp.exe
  C:\Windows\System\poawVvp.exe
  2⤵
  PID:6532
- C:\Windows\System\PfXWOWs.exe
  C:\Windows\System\PfXWOWs.exe
  2⤵
  PID:6548
- C:\Windows\System\JSbcsvE.exe
  C:\Windows\System\JSbcsvE.exe
  2⤵
  PID:6564
- C:\Windows\System\SNqeVqm.exe
  C:\Windows\System\SNqeVqm.exe
  2⤵
  PID:6580
- C:\Windows\System\XmZajAr.exe
  C:\Windows\System\XmZajAr.exe
  2⤵
  PID:6596
- C:\Windows\System\wWHRIrk.exe
  C:\Windows\System\wWHRIrk.exe
  2⤵
  PID:6612
- C:\Windows\System\iUgvDBA.exe
  C:\Windows\System\iUgvDBA.exe
  2⤵
  PID:6628
- C:\Windows\System\YWrvBvx.exe
  C:\Windows\System\YWrvBvx.exe
  2⤵
  PID:6644
- C:\Windows\System\lxvXvyD.exe
  C:\Windows\System\lxvXvyD.exe
  2⤵
  PID:6660
- C:\Windows\System\CsDCZhP.exe
  C:\Windows\System\CsDCZhP.exe
  2⤵
  PID:6676
- C:\Windows\System\RZNoBSj.exe
  C:\Windows\System\RZNoBSj.exe
  2⤵
  PID:6692
- C:\Windows\System\GrVgJeK.exe
  C:\Windows\System\GrVgJeK.exe
  2⤵
  PID:6712
- C:\Windows\System\EXOfFcT.exe
  C:\Windows\System\EXOfFcT.exe
  2⤵
  PID:6728
- C:\Windows\System\YHrmEFd.exe
  C:\Windows\System\YHrmEFd.exe
  2⤵
  PID:6744
- C:\Windows\System\oMeEjnh.exe
  C:\Windows\System\oMeEjnh.exe
  2⤵
  PID:6760
- C:\Windows\System\spcnfjm.exe
  C:\Windows\System\spcnfjm.exe
  2⤵
  PID:6776
- C:\Windows\System\vlvQjrH.exe
  C:\Windows\System\vlvQjrH.exe
  2⤵
  PID:6792
- C:\Windows\System\JQXLxTs.exe
  C:\Windows\System\JQXLxTs.exe
  2⤵
  PID:6808
- C:\Windows\System\YuLJubL.exe
  C:\Windows\System\YuLJubL.exe
  2⤵
  PID:6824
- C:\Windows\System\JYWSSnR.exe
  C:\Windows\System\JYWSSnR.exe
  2⤵
  PID:6840
- C:\Windows\System\VIdIWFj.exe
  C:\Windows\System\VIdIWFj.exe
  2⤵
  PID:6856
- C:\Windows\System\tdVxhOR.exe
  C:\Windows\System\tdVxhOR.exe
  2⤵
  PID:6872
- C:\Windows\System\mVbZoQT.exe
  C:\Windows\System\mVbZoQT.exe
  2⤵
  PID:6892
- C:\Windows\System\OugSkaA.exe
  C:\Windows\System\OugSkaA.exe
  2⤵
  PID:6908
- C:\Windows\System\qwvajFW.exe
  C:\Windows\System\qwvajFW.exe
  2⤵
  PID:6924
- C:\Windows\System\kAUrmPk.exe
  C:\Windows\System\kAUrmPk.exe
  2⤵
  PID:6940
- C:\Windows\System\HidCDfo.exe
  C:\Windows\System\HidCDfo.exe
  2⤵
  PID:6956
- C:\Windows\System\uHxkUqp.exe
  C:\Windows\System\uHxkUqp.exe
  2⤵
  PID:6972
- C:\Windows\System\LGfDgKL.exe
  C:\Windows\System\LGfDgKL.exe
  2⤵
  PID:6988
- C:\Windows\System\LMHfVkZ.exe
  C:\Windows\System\LMHfVkZ.exe
  2⤵
  PID:7004
- C:\Windows\System\SXlEvnw.exe
  C:\Windows\System\SXlEvnw.exe
  2⤵
  PID:7020
- C:\Windows\System\oIqejHn.exe
  C:\Windows\System\oIqejHn.exe
  2⤵
  PID:7040
- C:\Windows\System\FlfzZta.exe
  C:\Windows\System\FlfzZta.exe
  2⤵
  PID:7056
- C:\Windows\System\wHGNMqS.exe
  C:\Windows\System\wHGNMqS.exe
  2⤵
  PID:7072
- C:\Windows\System\XzAGOUD.exe
  C:\Windows\System\XzAGOUD.exe
  2⤵
  PID:7088
- C:\Windows\System\eveZNSh.exe
  C:\Windows\System\eveZNSh.exe
  2⤵
  PID:7104
- C:\Windows\System\LvLlDfW.exe
  C:\Windows\System\LvLlDfW.exe
  2⤵
  PID:7120
- C:\Windows\System\KGSKOdr.exe
  C:\Windows\System\KGSKOdr.exe
  2⤵
  PID:7136
- C:\Windows\System\OmFXTGC.exe
  C:\Windows\System\OmFXTGC.exe
  2⤵
  PID:7152
- C:\Windows\System\FxRwSaH.exe
  C:\Windows\System\FxRwSaH.exe
  2⤵
  PID:5460
- C:\Windows\System\AuZNISI.exe
  C:\Windows\System\AuZNISI.exe
  2⤵
  PID:6148
- C:\Windows\System\jvoYLxz.exe
  C:\Windows\System\jvoYLxz.exe
  2⤵
  PID:6208
- C:\Windows\System\bKQCQnE.exe
  C:\Windows\System\bKQCQnE.exe
  2⤵
  PID:6248
- C:\Windows\System\ruukYnJ.exe
  C:\Windows\System\ruukYnJ.exe
  2⤵
  PID:6340
- C:\Windows\System\pZLEVEw.exe
  C:\Windows\System\pZLEVEw.exe
  2⤵
  PID:6128
- C:\Windows\System\QWCIPxb.exe
  C:\Windows\System\QWCIPxb.exe
  2⤵
  PID:5132
- C:\Windows\System\UDVJnup.exe
  C:\Windows\System\UDVJnup.exe
  2⤵
  PID:5328
- C:\Windows\System\emSQiVF.exe
  C:\Windows\System\emSQiVF.exe
  2⤵
  PID:5756
- C:\Windows\System\fKEACVV.exe
  C:\Windows\System\fKEACVV.exe
  2⤵
  PID:6196
- C:\Windows\System\KKptIcR.exe
  C:\Windows\System\KKptIcR.exe
  2⤵
  PID:6292
- C:\Windows\System\GDPpCby.exe
  C:\Windows\System\GDPpCby.exe
  2⤵
  PID:6360
- C:\Windows\System\GHGhjKR.exe
  C:\Windows\System\GHGhjKR.exe
  2⤵
  PID:6428
- C:\Windows\System\qTlWSZK.exe
  C:\Windows\System\qTlWSZK.exe
  2⤵
  PID:6460
- C:\Windows\System\ZKSfdMA.exe
  C:\Windows\System\ZKSfdMA.exe
  2⤵
  PID:6528
- C:\Windows\System\itDVcSw.exe
  C:\Windows\System\itDVcSw.exe
  2⤵
  PID:6408
- C:\Windows\System\YKIgNEO.exe
  C:\Windows\System\YKIgNEO.exe
  2⤵
  PID:6472
- C:\Windows\System\YZcomcD.exe
  C:\Windows\System\YZcomcD.exe
  2⤵
  PID:6512
- C:\Windows\System\VlJcLJG.exe
  C:\Windows\System\VlJcLJG.exe
  2⤵
  PID:6576
- C:\Windows\System\fkycInT.exe
  C:\Windows\System\fkycInT.exe
  2⤵
  PID:6604
- C:\Windows\System\FzXDBiG.exe
  C:\Windows\System\FzXDBiG.exe
  2⤵
  PID:6652
- C:\Windows\System\fqVLyLZ.exe
  C:\Windows\System\fqVLyLZ.exe
  2⤵
  PID:6668
- C:\Windows\System\nfRDfKr.exe
  C:\Windows\System\nfRDfKr.exe
  2⤵
  PID:6700
- C:\Windows\System\jPCirWU.exe
  C:\Windows\System\jPCirWU.exe
  2⤵
  PID:5148
- C:\Windows\System\MjiOCpJ.exe
  C:\Windows\System\MjiOCpJ.exe
  2⤵
  PID:6804
- C:\Windows\System\QHDIbvo.exe
  C:\Windows\System\QHDIbvo.exe
  2⤵
  PID:6868
- C:\Windows\System\UMiXzkD.exe
  C:\Windows\System\UMiXzkD.exe
  2⤵
  PID:6936
- C:\Windows\System\VFtyHYw.exe
  C:\Windows\System\VFtyHYw.exe
  2⤵
  PID:7028
- C:\Windows\System\PWBbBLF.exe
  C:\Windows\System\PWBbBLF.exe
  2⤵
  PID:7032
- C:\Windows\System\ywEWXSs.exe
  C:\Windows\System\ywEWXSs.exe
  2⤵
  PID:6788
- C:\Windows\System\GOLJWgz.exe
  C:\Windows\System\GOLJWgz.exe
  2⤵
  PID:6880
- C:\Windows\System\RuPiwyY.exe
  C:\Windows\System\RuPiwyY.exe
  2⤵
  PID:6916
- C:\Windows\System\DMjmSmA.exe
  C:\Windows\System\DMjmSmA.exe
  2⤵
  PID:6980
- C:\Windows\System\BjFNBSp.exe
  C:\Windows\System\BjFNBSp.exe
  2⤵
  PID:7100
- C:\Windows\System\QZzZXQc.exe
  C:\Windows\System\QZzZXQc.exe
  2⤵
  PID:7164
- C:\Windows\System\rKcsnEG.exe
  C:\Windows\System\rKcsnEG.exe
  2⤵
  PID:6308
- C:\Windows\System\jnZShNA.exe
  C:\Windows\System\jnZShNA.exe
  2⤵
  PID:7016
- C:\Windows\System\gCpGBpm.exe
  C:\Windows\System\gCpGBpm.exe
  2⤵
  PID:5412
- C:\Windows\System\RuTJEki.exe
  C:\Windows\System\RuTJEki.exe
  2⤵
  PID:6392
- C:\Windows\System\MghVwRx.exe
  C:\Windows\System\MghVwRx.exe
  2⤵
  PID:7084
- C:\Windows\System\WSnejKZ.exe
  C:\Windows\System\WSnejKZ.exe
  2⤵
  PID:6240
- C:\Windows\System\JBNAazK.exe
  C:\Windows\System\JBNAazK.exe
  2⤵
  PID:6440
- C:\Windows\System\xfQghsf.exe
  C:\Windows\System\xfQghsf.exe
  2⤵
  PID:6620
- C:\Windows\System\OodulrN.exe
  C:\Windows\System\OodulrN.exe
  2⤵
  PID:6108
- C:\Windows\System\CVPxdBI.exe
  C:\Windows\System\CVPxdBI.exe
  2⤵
  PID:5392
- C:\Windows\System\tOodtMa.exe
  C:\Windows\System\tOodtMa.exe
  2⤵
  PID:6376
- C:\Windows\System\srbAWGa.exe
  C:\Windows\System\srbAWGa.exe
  2⤵
  PID:6684
- C:\Windows\System\otIwfkL.exe
  C:\Windows\System\otIwfkL.exe
  2⤵
  PID:6456
- C:\Windows\System\xcqhwRA.exe
  C:\Windows\System\xcqhwRA.exe
  2⤵
  PID:6328
- C:\Windows\System\kIFQxZa.exe
  C:\Windows\System\kIFQxZa.exe
  2⤵
  PID:6904
- C:\Windows\System\mPCKHza.exe
  C:\Windows\System\mPCKHza.exe
  2⤵
  PID:6852
- C:\Windows\System\DbNUjQK.exe
  C:\Windows\System\DbNUjQK.exe
  2⤵
  PID:7160
- C:\Windows\System\xKGaBZt.exe
  C:\Windows\System\xKGaBZt.exe
  2⤵
  PID:6264
- C:\Windows\System\TEpjfjX.exe
  C:\Windows\System\TEpjfjX.exe
  2⤵
  PID:6572
- C:\Windows\System\GlTdiZg.exe
  C:\Windows\System\GlTdiZg.exe
  2⤵
  PID:6524
- C:\Windows\System\dCjpbFN.exe
  C:\Windows\System\dCjpbFN.exe
  2⤵
  PID:6756
- C:\Windows\System\ZDGhRVe.exe
  C:\Windows\System\ZDGhRVe.exe
  2⤵
  PID:7068
- C:\Windows\System\sCwyfHO.exe
  C:\Windows\System\sCwyfHO.exe
  2⤵
  PID:5312
- C:\Windows\System\KmDnLfD.exe
  C:\Windows\System\KmDnLfD.exe
  2⤵
  PID:7148
- C:\Windows\System\JtAlXKe.exe
  C:\Windows\System\JtAlXKe.exe
  2⤵
  PID:5396
- C:\Windows\System\peHkxbC.exe
  C:\Windows\System\peHkxbC.exe
  2⤵
  PID:6800
- C:\Windows\System\zmbCcgm.exe
  C:\Windows\System\zmbCcgm.exe
  2⤵
  PID:6504
- C:\Windows\System\vPSxsRj.exe
  C:\Windows\System\vPSxsRj.exe
  2⤵
  PID:7036
- C:\Windows\System\xGBnyHI.exe
  C:\Windows\System\xGBnyHI.exe
  2⤵
  PID:6260
- C:\Windows\System\qMsZXbO.exe
  C:\Windows\System\qMsZXbO.exe
  2⤵
  PID:6888
- C:\Windows\System\VXmxUjh.exe
  C:\Windows\System\VXmxUjh.exe
  2⤵
  PID:6996
- C:\Windows\System\ogPuBeo.exe
  C:\Windows\System\ogPuBeo.exe
  2⤵
  PID:6180
- C:\Windows\System\UdLSLvo.exe
  C:\Windows\System\UdLSLvo.exe
  2⤵
  PID:6968
- C:\Windows\System\nMydJUL.exe
  C:\Windows\System\nMydJUL.exe
  2⤵
  PID:7180
- C:\Windows\System\fkmTsfK.exe
  C:\Windows\System\fkmTsfK.exe
  2⤵
  PID:7196
- C:\Windows\System\XIMptsX.exe
  C:\Windows\System\XIMptsX.exe
  2⤵
  PID:7212
- C:\Windows\System\aXXIruO.exe
  C:\Windows\System\aXXIruO.exe
  2⤵
  PID:7228
- C:\Windows\System\FxaQXHS.exe
  C:\Windows\System\FxaQXHS.exe
  2⤵
  PID:7248
- C:\Windows\System\hyKwewN.exe
  C:\Windows\System\hyKwewN.exe
  2⤵
  PID:7268
- C:\Windows\System\TDeqcUW.exe
  C:\Windows\System\TDeqcUW.exe
  2⤵
  PID:7288
- C:\Windows\System\CEXoMfv.exe
  C:\Windows\System\CEXoMfv.exe
  2⤵
  PID:7304
- C:\Windows\System\kXhSksL.exe
  C:\Windows\System\kXhSksL.exe
  2⤵
  PID:7320
- C:\Windows\System\XvBIvPv.exe
  C:\Windows\System\XvBIvPv.exe
  2⤵
  PID:7336
- C:\Windows\System\MqtVXeS.exe
  C:\Windows\System\MqtVXeS.exe
  2⤵
  PID:7484
- C:\Windows\System\dLdsNha.exe
  C:\Windows\System\dLdsNha.exe
  2⤵
  PID:7528
- C:\Windows\System\BYipkAT.exe
  C:\Windows\System\BYipkAT.exe
  2⤵
  PID:7544
- C:\Windows\System\gVZLnsz.exe
  C:\Windows\System\gVZLnsz.exe
  2⤵
  PID:7560
- C:\Windows\System\CBGeTWg.exe
  C:\Windows\System\CBGeTWg.exe
  2⤵
  PID:7576
- C:\Windows\System\TnqtYDO.exe
  C:\Windows\System\TnqtYDO.exe
  2⤵
  PID:7592
- C:\Windows\System\MQxBeXb.exe
  C:\Windows\System\MQxBeXb.exe
  2⤵
  PID:7608
- C:\Windows\System\mUuKNKM.exe
  C:\Windows\System\mUuKNKM.exe
  2⤵
  PID:7624
- C:\Windows\System\gTfIWcJ.exe
  C:\Windows\System\gTfIWcJ.exe
  2⤵
  PID:7640
- C:\Windows\System\VeryjJx.exe
  C:\Windows\System\VeryjJx.exe
  2⤵
  PID:7660
- C:\Windows\System\lIjiBeO.exe
  C:\Windows\System\lIjiBeO.exe
  2⤵
  PID:7676
- C:\Windows\System\TBzOdQF.exe
  C:\Windows\System\TBzOdQF.exe
  2⤵
  PID:7692
- C:\Windows\System\iJohEgi.exe
  C:\Windows\System\iJohEgi.exe
  2⤵
  PID:7708
- C:\Windows\System\tnqHvqm.exe
  C:\Windows\System\tnqHvqm.exe
  2⤵
  PID:7728
- C:\Windows\System\PxAgLot.exe
  C:\Windows\System\PxAgLot.exe
  2⤵
  PID:7748
- C:\Windows\System\CGKEKrC.exe
  C:\Windows\System\CGKEKrC.exe
  2⤵
  PID:7780
- C:\Windows\System\IRLAUzc.exe
  C:\Windows\System\IRLAUzc.exe
  2⤵
  PID:7796
- C:\Windows\System\YUUXFKr.exe
  C:\Windows\System\YUUXFKr.exe
  2⤵
  PID:7812
- C:\Windows\System\ngZyfUr.exe
  C:\Windows\System\ngZyfUr.exe
  2⤵
  PID:7960
- C:\Windows\System\ojIasDN.exe
  C:\Windows\System\ojIasDN.exe
  2⤵
  PID:7976
- C:\Windows\System\HJZOwLZ.exe
  C:\Windows\System\HJZOwLZ.exe
  2⤵
  PID:7996
- C:\Windows\System\jnzgzOv.exe
  C:\Windows\System\jnzgzOv.exe
  2⤵
  PID:8012
- C:\Windows\System\fxpPWYH.exe
  C:\Windows\System\fxpPWYH.exe
  2⤵
  PID:8028
- C:\Windows\System\YSSMMKF.exe
  C:\Windows\System\YSSMMKF.exe
  2⤵
  PID:8048
- C:\Windows\System\ZMLzyPh.exe
  C:\Windows\System\ZMLzyPh.exe
  2⤵
  PID:8064
- C:\Windows\System\EBqncSK.exe
  C:\Windows\System\EBqncSK.exe
  2⤵
  PID:8080
- C:\Windows\System\lHsyiwA.exe
  C:\Windows\System\lHsyiwA.exe
  2⤵
  PID:8096
- C:\Windows\System\KDPAGYX.exe
  C:\Windows\System\KDPAGYX.exe
  2⤵
  PID:8112
- C:\Windows\System\majKnXu.exe
  C:\Windows\System\majKnXu.exe
  2⤵
  PID:8132
- C:\Windows\System\gYqnNYJ.exe
  C:\Windows\System\gYqnNYJ.exe
  2⤵
  PID:8148
- C:\Windows\System\JZwYFIZ.exe
  C:\Windows\System\JZwYFIZ.exe
  2⤵
  PID:8164
- C:\Windows\System\uApAYOd.exe
  C:\Windows\System\uApAYOd.exe
  2⤵
  PID:8184
- C:\Windows\System\urCKkux.exe
  C:\Windows\System\urCKkux.exe
  2⤵
  PID:6544
- C:\Windows\System\XVzNBOe.exe
  C:\Windows\System\XVzNBOe.exe
  2⤵
  PID:7192
- C:\Windows\System\djrpPuZ.exe
  C:\Windows\System\djrpPuZ.exe
  2⤵
  PID:6324
- C:\Windows\System\JHoKYRp.exe
  C:\Windows\System\JHoKYRp.exe
  2⤵
  PID:5608
- C:\Windows\System\WnKsbZQ.exe
  C:\Windows\System\WnKsbZQ.exe
  2⤵
  PID:7208
- C:\Windows\System\eblFEXX.exe
  C:\Windows\System\eblFEXX.exe
  2⤵
  PID:6708
- C:\Windows\System\gRbcAQs.exe
  C:\Windows\System\gRbcAQs.exe
  2⤵
  PID:7240
- C:\Windows\System\MuZVhXa.exe
  C:\Windows\System\MuZVhXa.exe
  2⤵
  PID:7296
- C:\Windows\System\EtXgfAV.exe
  C:\Windows\System\EtXgfAV.exe
  2⤵
  PID:7328
- C:\Windows\System\OyKACqr.exe
  C:\Windows\System\OyKACqr.exe
  2⤵
  PID:7356
- C:\Windows\System\YapRxpt.exe
  C:\Windows\System\YapRxpt.exe
  2⤵
  PID:7372
- C:\Windows\System\ydRdaSk.exe
  C:\Windows\System\ydRdaSk.exe
  2⤵
  PID:7388
- C:\Windows\System\UZBOqTY.exe
  C:\Windows\System\UZBOqTY.exe
  2⤵
  PID:7404
- C:\Windows\System\mLnIqoH.exe
  C:\Windows\System\mLnIqoH.exe
  2⤵
  PID:1504
- C:\Windows\System\SFszRUO.exe
  C:\Windows\System\SFszRUO.exe
  2⤵
  PID:7436
- C:\Windows\System\HHZkdAJ.exe
  C:\Windows\System\HHZkdAJ.exe
  2⤵
  PID:7456
- C:\Windows\System\QUiYLay.exe
  C:\Windows\System\QUiYLay.exe
  2⤵
  PID:7476
- C:\Windows\System\SGkVEau.exe
  C:\Windows\System\SGkVEau.exe
  2⤵
  PID:7496
- C:\Windows\System\IwWAmqW.exe
  C:\Windows\System\IwWAmqW.exe
  2⤵
  PID:7572
- C:\Windows\System\abvYxMJ.exe
  C:\Windows\System\abvYxMJ.exe
  2⤵
  PID:7636
- C:\Windows\System\OtsaRax.exe
  C:\Windows\System\OtsaRax.exe
  2⤵
  PID:7704
- C:\Windows\System\kvKOfYO.exe
  C:\Windows\System\kvKOfYO.exe
  2⤵
  PID:7792
- C:\Windows\System\eIPmuNb.exe
  C:\Windows\System\eIPmuNb.exe
  2⤵
  PID:7772
- C:\Windows\System\TzqHDZx.exe
  C:\Windows\System\TzqHDZx.exe
  2⤵
  PID:7516
- C:\Windows\System\oJWRtIB.exe
  C:\Windows\System\oJWRtIB.exe
  2⤵
  PID:7556
- C:\Windows\System\dsPhntO.exe
  C:\Windows\System\dsPhntO.exe
  2⤵
  PID:7620
- C:\Windows\System\ZcAdcUb.exe
  C:\Windows\System\ZcAdcUb.exe
  2⤵
  PID:7684
- C:\Windows\System\mhMUHHD.exe
  C:\Windows\System\mhMUHHD.exe
  2⤵
  PID:7724
- C:\Windows\System\JheJwOs.exe
  C:\Windows\System\JheJwOs.exe
  2⤵
  PID:7768
- C:\Windows\System\RUGnLlX.exe
  C:\Windows\System\RUGnLlX.exe
  2⤵
  PID:7832
- C:\Windows\System\BuAHTLb.exe
  C:\Windows\System\BuAHTLb.exe
  2⤵
  PID:7848
- C:\Windows\System\dMTYkEc.exe
  C:\Windows\System\dMTYkEc.exe
  2⤵
  PID:7864
- C:\Windows\System\xfQHltC.exe
  C:\Windows\System\xfQHltC.exe
  2⤵
  PID:7880
- C:\Windows\System\tWFFlHk.exe
  C:\Windows\System\tWFFlHk.exe
  2⤵
  PID:7892
- C:\Windows\System\bjGhnTv.exe
  C:\Windows\System\bjGhnTv.exe
  2⤵
  PID:7908
- C:\Windows\System\WnuzVkx.exe
  C:\Windows\System\WnuzVkx.exe
  2⤵
  PID:7928
- C:\Windows\System\Qyabflu.exe
  C:\Windows\System\Qyabflu.exe
  2⤵
  PID:7968
- C:\Windows\System\eATWKkw.exe
  C:\Windows\System\eATWKkw.exe
  2⤵
  PID:7944
- C:\Windows\System\WcGjpUD.exe
  C:\Windows\System\WcGjpUD.exe
  2⤵
  PID:8036
- C:\Windows\System\prVrGHU.exe
  C:\Windows\System\prVrGHU.exe
  2⤵
  PID:8076
- C:\Windows\System\YPhkWzZ.exe
  C:\Windows\System\YPhkWzZ.exe
  2⤵
  PID:8140
- C:\Windows\System\EjRoBfG.exe
  C:\Windows\System\EjRoBfG.exe
  2⤵
  PID:8180
- C:\Windows\System\saLWnWr.exe
  C:\Windows\System\saLWnWr.exe
  2⤵
  PID:8024
- C:\Windows\System\YuMFaiQ.exe
  C:\Windows\System\YuMFaiQ.exe
  2⤵
  PID:8120
- C:\Windows\System\sjHtAfN.exe
  C:\Windows\System\sjHtAfN.exe
  2⤵
  PID:8160
- C:\Windows\System\IsAMwwq.exe
  C:\Windows\System\IsAMwwq.exe
  2⤵
  PID:6724
- C:\Windows\System\aTHtyeY.exe
  C:\Windows\System\aTHtyeY.exe
  2⤵
  PID:6396
- C:\Windows\System\HhBjIKb.exe
  C:\Windows\System\HhBjIKb.exe
  2⤵
  PID:7300
- C:\Windows\System\MnXnYmg.exe
  C:\Windows\System\MnXnYmg.exe
  2⤵
  PID:7432
- C:\Windows\System\xSkmhIv.exe
  C:\Windows\System\xSkmhIv.exe
  2⤵
  PID:7412
- C:\Windows\System\TkhrKoq.exe
  C:\Windows\System\TkhrKoq.exe
  2⤵
  PID:7448
- C:\Windows\System\viKggtI.exe
  C:\Windows\System\viKggtI.exe
  2⤵
  PID:7632
- C:\Windows\System\cDpJxgC.exe
  C:\Windows\System\cDpJxgC.exe
  2⤵
  PID:7504
- C:\Windows\System\LJKTkFm.exe
  C:\Windows\System\LJKTkFm.exe
  2⤵
  PID:7568
- C:\Windows\System\aDSItYQ.exe
  C:\Windows\System\aDSItYQ.exe
  2⤵
  PID:7824
- C:\Windows\System\OiGDedH.exe
  C:\Windows\System\OiGDedH.exe
  2⤵
  PID:7652
- C:\Windows\System\RAbSAja.exe
  C:\Windows\System\RAbSAja.exe
  2⤵
  PID:7844
- C:\Windows\System\NSRPbCO.exe
  C:\Windows\System\NSRPbCO.exe
  2⤵
  PID:7720
- C:\Windows\System\BRSsIUD.exe
  C:\Windows\System\BRSsIUD.exe
  2⤵
  PID:7904
- C:\Windows\System\TzFUIVG.exe
  C:\Windows\System\TzFUIVG.exe
  2⤵
  PID:7936
- C:\Windows\System\YCoRpdK.exe
  C:\Windows\System\YCoRpdK.exe
  2⤵
  PID:8108
- C:\Windows\System\NoMcOuY.exe
  C:\Windows\System\NoMcOuY.exe
  2⤵
  PID:7924
- C:\Windows\System\ALtOCnl.exe
  C:\Windows\System\ALtOCnl.exe
  2⤵
  PID:7952
- C:\Windows\System\QbgtKuJ.exe
  C:\Windows\System\QbgtKuJ.exe
  2⤵
  PID:7204
- C:\Windows\System\XSJcXra.exe
  C:\Windows\System\XSJcXra.exe
  2⤵
  PID:8020
- C:\Windows\System\PVprLPG.exe
  C:\Windows\System\PVprLPG.exe
  2⤵
  PID:8088
- C:\Windows\System\OGOPpSF.exe
  C:\Windows\System\OGOPpSF.exe
  2⤵
  PID:7276
- C:\Windows\System\hlrbgSG.exe
  C:\Windows\System\hlrbgSG.exe
  2⤵
  PID:7312
- C:\Windows\System\PQpfPaG.exe
  C:\Windows\System\PQpfPaG.exe
  2⤵
  PID:7828
- C:\Windows\System\hFGtOKd.exe
  C:\Windows\System\hFGtOKd.exe
  2⤵
  PID:7364
- C:\Windows\System\OiBCfwp.exe
  C:\Windows\System\OiBCfwp.exe
  2⤵
  PID:7380
- C:\Windows\System\WlTkySC.exe
  C:\Windows\System\WlTkySC.exe
  2⤵
  PID:7540
- C:\Windows\System\GcgqCDt.exe
  C:\Windows\System\GcgqCDt.exe
  2⤵
  PID:7552
- C:\Windows\System\bzQlAhA.exe
  C:\Windows\System\bzQlAhA.exe
  2⤵
  PID:7468
- C:\Windows\System\bepalgk.exe
  C:\Windows\System\bepalgk.exe
  2⤵
  PID:6588
- C:\Windows\System\LQqvfih.exe
  C:\Windows\System\LQqvfih.exe
  2⤵
  PID:7860
- C:\Windows\System\XdyjDdS.exe
  C:\Windows\System\XdyjDdS.exe
  2⤵
  PID:8172
- C:\Windows\System\HfrDlzK.exe
  C:\Windows\System\HfrDlzK.exe
  2⤵
  PID:8060
- C:\Windows\System\qCKpaSY.exe
  C:\Windows\System\qCKpaSY.exe
  2⤵
  PID:7920
- C:\Windows\System\IcmgwXx.exe
  C:\Windows\System\IcmgwXx.exe
  2⤵
  PID:7284
- C:\Windows\System\sjhXLLu.exe
  C:\Windows\System\sjhXLLu.exe
  2⤵
  PID:7788
- C:\Windows\System\fDlJSAP.exe
  C:\Windows\System\fDlJSAP.exe
  2⤵
  PID:7740
- C:\Windows\System\UwRkdsZ.exe
  C:\Windows\System\UwRkdsZ.exe
  2⤵
  PID:8040
- C:\Windows\System\idPTgaK.exe
  C:\Windows\System\idPTgaK.exe
  2⤵
  PID:7244
- C:\Windows\System\hbHTJZq.exe
  C:\Windows\System\hbHTJZq.exe
  2⤵
  PID:8200
- C:\Windows\System\THepJRq.exe
  C:\Windows\System\THepJRq.exe
  2⤵
  PID:8216
- C:\Windows\System\lOHPhja.exe
  C:\Windows\System\lOHPhja.exe
  2⤵
  PID:8232
- C:\Windows\System\nghBlRE.exe
  C:\Windows\System\nghBlRE.exe
  2⤵
  PID:8248
- C:\Windows\System\SEwdWQp.exe
  C:\Windows\System\SEwdWQp.exe
  2⤵
  PID:8264
- C:\Windows\System\JaRMiWP.exe
  C:\Windows\System\JaRMiWP.exe
  2⤵
  PID:8280
- C:\Windows\System\RVMELIQ.exe
  C:\Windows\System\RVMELIQ.exe
  2⤵
  PID:8296
- C:\Windows\System\qfCzxzv.exe
  C:\Windows\System\qfCzxzv.exe
  2⤵
  PID:8312
- C:\Windows\System\bDkCUjB.exe
  C:\Windows\System\bDkCUjB.exe
  2⤵
  PID:8328
- C:\Windows\System\nHeOTHh.exe
  C:\Windows\System\nHeOTHh.exe
  2⤵
  PID:8344
- C:\Windows\System\tEkzTKy.exe
  C:\Windows\System\tEkzTKy.exe
  2⤵
  PID:8360
- C:\Windows\System\zRPyvne.exe
  C:\Windows\System\zRPyvne.exe
  2⤵
  PID:8376
- C:\Windows\System\SMqtJxo.exe
  C:\Windows\System\SMqtJxo.exe
  2⤵
  PID:8392
- C:\Windows\System\FtXYgUl.exe
  C:\Windows\System\FtXYgUl.exe
  2⤵
  PID:8408
- C:\Windows\System\brgudsz.exe
  C:\Windows\System\brgudsz.exe
  2⤵
  PID:8424
- C:\Windows\System\oAbeXpV.exe
  C:\Windows\System\oAbeXpV.exe
  2⤵
  PID:8440
- C:\Windows\System\rHTpWTQ.exe
  C:\Windows\System\rHTpWTQ.exe
  2⤵
  PID:8456
- C:\Windows\System\DcvuRZH.exe
  C:\Windows\System\DcvuRZH.exe
  2⤵
  PID:8472
- C:\Windows\System\rKkQqnR.exe
  C:\Windows\System\rKkQqnR.exe
  2⤵
  PID:8488
- C:\Windows\System\KCepHDw.exe
  C:\Windows\System\KCepHDw.exe
  2⤵
  PID:8504
- C:\Windows\System\nRvEnSA.exe
  C:\Windows\System\nRvEnSA.exe
  2⤵
  PID:8520
- C:\Windows\System\cQSLvQs.exe
  C:\Windows\System\cQSLvQs.exe
  2⤵
  PID:8536
- C:\Windows\System\wIwVQMN.exe
  C:\Windows\System\wIwVQMN.exe
  2⤵
  PID:8560
- C:\Windows\System\hWePHUe.exe
  C:\Windows\System\hWePHUe.exe
  2⤵
  PID:8592
- C:\Windows\System\htxLDtN.exe
  C:\Windows\System\htxLDtN.exe
  2⤵
  PID:8608
- C:\Windows\System\eDRgKTw.exe
  C:\Windows\System\eDRgKTw.exe
  2⤵
  PID:8624
- C:\Windows\System\QLHJqRB.exe
  C:\Windows\System\QLHJqRB.exe
  2⤵
  PID:8644
- C:\Windows\System\tEPbNch.exe
  C:\Windows\System\tEPbNch.exe
  2⤵
  PID:8660
- C:\Windows\System\TrTRxZl.exe
  C:\Windows\System\TrTRxZl.exe
  2⤵
  PID:8684
- C:\Windows\System\wCCabGT.exe
  C:\Windows\System\wCCabGT.exe
  2⤵
  PID:8704
- C:\Windows\System\VdMXxXW.exe
  C:\Windows\System\VdMXxXW.exe
  2⤵
  PID:8720
- C:\Windows\System\wstYRfY.exe
  C:\Windows\System\wstYRfY.exe
  2⤵
  PID:8736
- C:\Windows\System\lRvJQYT.exe
  C:\Windows\System\lRvJQYT.exe
  2⤵
  PID:8756
- C:\Windows\System\OnyzOUD.exe
  C:\Windows\System\OnyzOUD.exe
  2⤵
  PID:8772
- C:\Windows\System\EjnkgQI.exe
  C:\Windows\System\EjnkgQI.exe
  2⤵
  PID:8788
- C:\Windows\System\hGrsviK.exe
  C:\Windows\System\hGrsviK.exe
  2⤵
  PID:8804
- C:\Windows\System\zOwPfjt.exe
  C:\Windows\System\zOwPfjt.exe
  2⤵
  PID:8820
- C:\Windows\System\YgipSQb.exe
  C:\Windows\System\YgipSQb.exe
  2⤵
  PID:8836
- C:\Windows\System\eHbQlcG.exe
  C:\Windows\System\eHbQlcG.exe
  2⤵
  PID:8852
- C:\Windows\System\GWHzOTf.exe
  C:\Windows\System\GWHzOTf.exe
  2⤵
  PID:8868
- C:\Windows\System\bjTalld.exe
  C:\Windows\System\bjTalld.exe
  2⤵
  PID:8952
- C:\Windows\System\oWxdYMZ.exe
  C:\Windows\System\oWxdYMZ.exe
  2⤵
  PID:8976
- C:\Windows\System\WIrIkuC.exe
  C:\Windows\System\WIrIkuC.exe
  2⤵
  PID:8992
- C:\Windows\System\HyZvvMc.exe
  C:\Windows\System\HyZvvMc.exe
  2⤵
  PID:9008
- C:\Windows\System\nsQRvlJ.exe
  C:\Windows\System\nsQRvlJ.exe
  2⤵
  PID:9024
- C:\Windows\System\IrseDfq.exe
  C:\Windows\System\IrseDfq.exe
  2⤵
  PID:9040
- C:\Windows\System\Mijvmhi.exe
  C:\Windows\System\Mijvmhi.exe
  2⤵
  PID:9076
- C:\Windows\System\UptPeLZ.exe
  C:\Windows\System\UptPeLZ.exe
  2⤵
  PID:9092
- C:\Windows\System\sRREhZI.exe
  C:\Windows\System\sRREhZI.exe
  2⤵
  PID:9112
- C:\Windows\System\yCuhVJq.exe
  C:\Windows\System\yCuhVJq.exe
  2⤵
  PID:9132
- C:\Windows\System\bJXzIIc.exe
  C:\Windows\System\bJXzIIc.exe
  2⤵
  PID:9148
- C:\Windows\System\lBDCGLm.exe
  C:\Windows\System\lBDCGLm.exe
  2⤵
  PID:9164
- C:\Windows\System\WpgjRCW.exe
  C:\Windows\System\WpgjRCW.exe
  2⤵
  PID:9184
- C:\Windows\System\moEDdPe.exe
  C:\Windows\System\moEDdPe.exe
  2⤵
  PID:9200
- C:\Windows\System\gXbRoGM.exe
  C:\Windows\System\gXbRoGM.exe
  2⤵
  PID:8196
- C:\Windows\System\HwDhJOg.exe
  C:\Windows\System\HwDhJOg.exe
  2⤵
  PID:8260
- C:\Windows\System\AqkeEqz.exe
  C:\Windows\System\AqkeEqz.exe
  2⤵
  PID:8324
- C:\Windows\System\ixTNySj.exe
  C:\Windows\System\ixTNySj.exe
  2⤵
  PID:7512
- C:\Windows\System\WmDThpo.exe
  C:\Windows\System\WmDThpo.exe
  2⤵
  PID:7444
- C:\Windows\System\LBYhjUE.exe
  C:\Windows\System\LBYhjUE.exe
  2⤵
  PID:7256
- C:\Windows\System\vcmRpBJ.exe
  C:\Windows\System\vcmRpBJ.exe
  2⤵
  PID:7760
- C:\Windows\System\SVXOapZ.exe
  C:\Windows\System\SVXOapZ.exe
  2⤵
  PID:8416
- C:\Windows\System\IRGazkx.exe
  C:\Windows\System\IRGazkx.exe
  2⤵
  PID:8044
- C:\Windows\System\tWMCnBy.exe
  C:\Windows\System\tWMCnBy.exe
  2⤵
  PID:8212
- C:\Windows\System\RJgWFOw.exe
  C:\Windows\System\RJgWFOw.exe
  2⤵
  PID:8516
- C:\Windows\System\mRlkHPw.exe
  C:\Windows\System\mRlkHPw.exe
  2⤵
  PID:8340
- C:\Windows\System\XEsbhyq.exe
  C:\Windows\System\XEsbhyq.exe
  2⤵
  PID:8552
- C:\Windows\System\txtIyoX.exe
  C:\Windows\System\txtIyoX.exe
  2⤵
  PID:8436
- C:\Windows\System\mmCVQlb.exe
  C:\Windows\System\mmCVQlb.exe
  2⤵
  PID:8636
- C:\Windows\System\acNdYtX.exe
  C:\Windows\System\acNdYtX.exe
  2⤵
  PID:8676
- C:\Windows\System\Lpitiby.exe
  C:\Windows\System\Lpitiby.exe
  2⤵
  PID:8568
- C:\Windows\System\dgQKsfB.exe
  C:\Windows\System\dgQKsfB.exe
  2⤵
  PID:8500
- C:\Windows\System\rxEcGTr.exe
  C:\Windows\System\rxEcGTr.exe
  2⤵
  PID:8652
- C:\Windows\System\hkeoQJk.exe
  C:\Windows\System\hkeoQJk.exe
  2⤵
  PID:8572
- C:\Windows\System\JQfzvWK.exe
  C:\Windows\System\JQfzvWK.exe
  2⤵
  PID:8732
- C:\Windows\System\nbVNSlQ.exe
  C:\Windows\System\nbVNSlQ.exe
  2⤵
  PID:8728
- C:\Windows\System\SjmGCZc.exe
  C:\Windows\System\SjmGCZc.exe
  2⤵
  PID:8796
- C:\Windows\System\PMXpqrb.exe
  C:\Windows\System\PMXpqrb.exe
  2⤵
  PID:8828
- C:\Windows\System\cPosegU.exe
  C:\Windows\System\cPosegU.exe
  2⤵
  PID:8864
- C:\Windows\System\UrsQXvf.exe
  C:\Windows\System\UrsQXvf.exe
  2⤵
  PID:8896
- C:\Windows\System\Dsvwokq.exe
  C:\Windows\System\Dsvwokq.exe
  2⤵
  PID:8904
- C:\Windows\System\xSLGNPl.exe
  C:\Windows\System\xSLGNPl.exe
  2⤵
  PID:8916
- C:\Windows\System\snyZPlh.exe
  C:\Windows\System\snyZPlh.exe
  2⤵
  PID:8944
- C:\Windows\System\guBlSOM.exe
  C:\Windows\System\guBlSOM.exe
  2⤵
  PID:8972
- C:\Windows\System\ISazZWw.exe
  C:\Windows\System\ISazZWw.exe
  2⤵
  PID:9000
- C:\Windows\System\lptAYbW.exe
  C:\Windows\System\lptAYbW.exe
  2⤵
  PID:9032
- C:\Windows\System\urfhFde.exe
  C:\Windows\System\urfhFde.exe
  2⤵
  PID:9064
- C:\Windows\System\hkvdFqG.exe
  C:\Windows\System\hkvdFqG.exe
  2⤵
  PID:9108
- C:\Windows\System\eEUnxdM.exe
  C:\Windows\System\eEUnxdM.exe
  2⤵
  PID:9208
- C:\Windows\System\bNvYNrk.exe
  C:\Windows\System\bNvYNrk.exe
  2⤵
  PID:7868
- C:\Windows\System\peGNrws.exe
  C:\Windows\System\peGNrws.exe
  2⤵
  PID:9156
- C:\Windows\System\McvaOVD.exe
  C:\Windows\System\McvaOVD.exe
  2⤵
  PID:8228
- C:\Windows\System\SazfDmx.exe
  C:\Windows\System\SazfDmx.exe
  2⤵
  PID:9196
- C:\Windows\System\HliwRaD.exe
  C:\Windows\System\HliwRaD.exe
  2⤵
  PID:7616
- C:\Windows\System\YCkcmRq.exe
  C:\Windows\System\YCkcmRq.exe
  2⤵
  PID:8272
- C:\Windows\System\IIsFnyv.exe
  C:\Windows\System\IIsFnyv.exe
  2⤵
  PID:8484
- C:\Windows\System\UsnjXqF.exe
  C:\Windows\System\UsnjXqF.exe
  2⤵
  PID:8420
- C:\Windows\System\nLZlZsb.exe
  C:\Windows\System\nLZlZsb.exe
  2⤵
  PID:7352
- C:\Windows\System\lxXoRFd.exe
  C:\Windows\System\lxXoRFd.exe
  2⤵
  PID:8600
- C:\Windows\System\tbTaEWZ.exe
  C:\Windows\System\tbTaEWZ.exe
  2⤵
  PID:8668
- C:\Windows\System\tkcxwke.exe
  C:\Windows\System\tkcxwke.exe
  2⤵
  PID:8532
- C:\Windows\System\DHqkDdg.exe
  C:\Windows\System\DHqkDdg.exe
  2⤵
  PID:8752
- C:\Windows\System\pHiFWNC.exe
  C:\Windows\System\pHiFWNC.exe
  2⤵
  PID:8816
- C:\Windows\System\VAZRqOy.exe
  C:\Windows\System\VAZRqOy.exe
  2⤵
  PID:7224
- C:\Windows\System\AYcBlwB.exe
  C:\Windows\System\AYcBlwB.exe
  2⤵
  PID:9016
- C:\Windows\System\DCPlMjv.exe
  C:\Windows\System\DCPlMjv.exe
  2⤵
  PID:9060
- C:\Windows\System\nUwSELq.exe
  C:\Windows\System\nUwSELq.exe
  2⤵
  PID:8584
- C:\Windows\System\wyUHXxQ.exe
  C:\Windows\System\wyUHXxQ.exe
  2⤵
  PID:8696
- C:\Windows\System\ytbKEki.exe
  C:\Windows\System\ytbKEki.exe
  2⤵
  PID:9072
- C:\Windows\System\DltoTWm.exe
  C:\Windows\System\DltoTWm.exe
  2⤵
  PID:8288
- C:\Windows\System\bieFneW.exe
  C:\Windows\System\bieFneW.exe
  2⤵
  PID:7400
- C:\Windows\System\aAVscdW.exe
  C:\Windows\System\aAVscdW.exe
  2⤵
  PID:8936
- C:\Windows\System\brYeiDn.exe
  C:\Windows\System\brYeiDn.exe
  2⤵
  PID:8372
- C:\Windows\System\PijxOaJ.exe
  C:\Windows\System\PijxOaJ.exe
  2⤵
  PID:8400
- C:\Windows\System\bnNImSh.exe
  C:\Windows\System\bnNImSh.exe
  2⤵
  PID:8632
- C:\Windows\System\NeFEBrK.exe
  C:\Windows\System\NeFEBrK.exe
  2⤵
  PID:9056
- C:\Windows\System\epEpGfG.exe
  C:\Windows\System\epEpGfG.exe
  2⤵
  PID:8920
- C:\Windows\System\uaWeKcU.exe
  C:\Windows\System\uaWeKcU.exe
  2⤵
  PID:8924
- C:\Windows\System\aYgaeWH.exe
  C:\Windows\System\aYgaeWH.exe
  2⤵
  PID:8128
- C:\Windows\System\CExjIHY.exe
  C:\Windows\System\CExjIHY.exe
  2⤵
  PID:8900
- C:\Windows\System\SrdmnKt.exe
  C:\Windows\System\SrdmnKt.exe
  2⤵
  PID:8908
- C:\Windows\System\FWiTkmb.exe
  C:\Windows\System\FWiTkmb.exe
  2⤵
  PID:9144
- C:\Windows\System\xQBlVhi.exe
  C:\Windows\System\xQBlVhi.exe
  2⤵
  PID:9020
- C:\Windows\System\nkBRZYo.exe
  C:\Windows\System\nkBRZYo.exe
  2⤵
  PID:8744
- C:\Windows\System\FEqLYse.exe
  C:\Windows\System\FEqLYse.exe
  2⤵
  PID:9048
- C:\Windows\System\KzAoRIX.exe
  C:\Windows\System\KzAoRIX.exe
  2⤵
  PID:8960
- C:\Windows\System\CnmaVjY.exe
  C:\Windows\System\CnmaVjY.exe
  2⤵
  PID:8308
- C:\Windows\System\vqlQkIv.exe
  C:\Windows\System\vqlQkIv.exe
  2⤵
  PID:8604
- C:\Windows\System\ypTznFV.exe
  C:\Windows\System\ypTznFV.exe
  2⤵
  PID:9212
- C:\Windows\System\XXtPrFI.exe
  C:\Windows\System\XXtPrFI.exe
  2⤵
  PID:8964
- C:\Windows\System\ozhjixJ.exe
  C:\Windows\System\ozhjixJ.exe
  2⤵
  PID:9236
- C:\Windows\System\bycFCty.exe
  C:\Windows\System\bycFCty.exe
  2⤵
  PID:9260
- C:\Windows\System\hTxMLeX.exe
  C:\Windows\System\hTxMLeX.exe
  2⤵
  PID:9276
- C:\Windows\System\oTMnFHA.exe
  C:\Windows\System\oTMnFHA.exe
  2⤵
  PID:9300
- C:\Windows\System\SzefgIv.exe
  C:\Windows\System\SzefgIv.exe
  2⤵
  PID:9316
- C:\Windows\System\njuEYki.exe
  C:\Windows\System\njuEYki.exe
  2⤵
  PID:9332
- C:\Windows\System\sdbTvVk.exe
  C:\Windows\System\sdbTvVk.exe
  2⤵
  PID:9352
- C:\Windows\System\Jgqiusi.exe
  C:\Windows\System\Jgqiusi.exe
  2⤵
  PID:9368
- C:\Windows\System\ffPqZbV.exe
  C:\Windows\System\ffPqZbV.exe
  2⤵
  PID:9384
- C:\Windows\System\UBFtnpC.exe
  C:\Windows\System\UBFtnpC.exe
  2⤵
  PID:9400
- C:\Windows\System\RJtnvyv.exe
  C:\Windows\System\RJtnvyv.exe
  2⤵
  PID:9416
- C:\Windows\System\uZaLXti.exe
  C:\Windows\System\uZaLXti.exe
  2⤵
  PID:9432
- C:\Windows\System\ewOAmLx.exe
  C:\Windows\System\ewOAmLx.exe
  2⤵
  PID:9448
- C:\Windows\System\sZhiAqz.exe
  C:\Windows\System\sZhiAqz.exe
  2⤵
  PID:9464
- C:\Windows\System\QSRltXp.exe
  C:\Windows\System\QSRltXp.exe
  2⤵
  PID:9480
- C:\Windows\System\hDERuxd.exe
  C:\Windows\System\hDERuxd.exe
  2⤵
  PID:9496
- C:\Windows\System\wfMSRNb.exe
  C:\Windows\System\wfMSRNb.exe
  2⤵
  PID:9512
- C:\Windows\System\GLvLBbs.exe
  C:\Windows\System\GLvLBbs.exe
  2⤵
  PID:9532
- C:\Windows\System\llsPQjD.exe
  C:\Windows\System\llsPQjD.exe
  2⤵
  PID:9548
- C:\Windows\System\kvWGXFc.exe
  C:\Windows\System\kvWGXFc.exe
  2⤵
  PID:9564
- C:\Windows\System\oPBuwRH.exe
  C:\Windows\System\oPBuwRH.exe
  2⤵
  PID:9580
- C:\Windows\System\YAkCoZo.exe
  C:\Windows\System\YAkCoZo.exe
  2⤵
  PID:9596
- C:\Windows\System\QvSAysI.exe
  C:\Windows\System\QvSAysI.exe
  2⤵
  PID:9716
- C:\Windows\System\ohdAuAz.exe
  C:\Windows\System\ohdAuAz.exe
  2⤵
  PID:9732
- C:\Windows\System\FrecRgm.exe
  C:\Windows\System\FrecRgm.exe
  2⤵
  PID:9748
- C:\Windows\System\kcMSxgN.exe
  C:\Windows\System\kcMSxgN.exe
  2⤵
  PID:9764
- C:\Windows\System\IrXVGHj.exe
  C:\Windows\System\IrXVGHj.exe
  2⤵
  PID:9780
- C:\Windows\System\biYzaEX.exe
  C:\Windows\System\biYzaEX.exe
  2⤵
  PID:9800
- C:\Windows\System\hwfKPxR.exe
  C:\Windows\System\hwfKPxR.exe
  2⤵
  PID:9816
- C:\Windows\System\IPQRmeQ.exe
  C:\Windows\System\IPQRmeQ.exe
  2⤵
  PID:9832
- C:\Windows\System\nftfJnu.exe
  C:\Windows\System\nftfJnu.exe
  2⤵
  PID:9852
- C:\Windows\System\sRRsRZA.exe
  C:\Windows\System\sRRsRZA.exe
  2⤵
  PID:9868
- C:\Windows\System\massmuZ.exe
  C:\Windows\System\massmuZ.exe
  2⤵
  PID:9884
- C:\Windows\System\OFBCPFQ.exe
  C:\Windows\System\OFBCPFQ.exe
  2⤵
  PID:9904
- C:\Windows\System\qUdOJKh.exe
  C:\Windows\System\qUdOJKh.exe
  2⤵
  PID:9924
- C:\Windows\System\curBgop.exe
  C:\Windows\System\curBgop.exe
  2⤵
  PID:9940
- C:\Windows\System\QKYsdKB.exe
  C:\Windows\System\QKYsdKB.exe
  2⤵
  PID:9956
- C:\Windows\System\akYnqmI.exe
  C:\Windows\System\akYnqmI.exe
  2⤵
  PID:9976
- C:\Windows\System\hZgqYZh.exe
  C:\Windows\System\hZgqYZh.exe
  2⤵
  PID:9992
- C:\Windows\System\KxJcRKY.exe
  C:\Windows\System\KxJcRKY.exe
  2⤵
  PID:10008
- C:\Windows\System\TGqPwIQ.exe
  C:\Windows\System\TGqPwIQ.exe
  2⤵
  PID:10024
- C:\Windows\System\hnFwaxM.exe
  C:\Windows\System\hnFwaxM.exe
  2⤵
  PID:10044
- C:\Windows\System\BQuLnHZ.exe
  C:\Windows\System\BQuLnHZ.exe
  2⤵
  PID:10068
- C:\Windows\System\mkxyaHi.exe
  C:\Windows\System\mkxyaHi.exe
  2⤵
  PID:10124
- C:\Windows\System\MvPACyX.exe
  C:\Windows\System\MvPACyX.exe
  2⤵
  PID:10140
- C:\Windows\System\HBIwUki.exe
  C:\Windows\System\HBIwUki.exe
  2⤵
  PID:10156
- C:\Windows\System\jqlGXIZ.exe
  C:\Windows\System\jqlGXIZ.exe
  2⤵
  PID:10172
- C:\Windows\System\iMsMPWi.exe
  C:\Windows\System\iMsMPWi.exe
  2⤵
  PID:10188
- C:\Windows\System\aMLUxHk.exe
  C:\Windows\System\aMLUxHk.exe
  2⤵
  PID:10204
- C:\Windows\System\Tnihvpi.exe
  C:\Windows\System\Tnihvpi.exe
  2⤵
  PID:10220
- C:\Windows\System\gkplgjw.exe
  C:\Windows\System\gkplgjw.exe
  2⤵
  PID:9232
- C:\Windows\System\PdaQhvy.exe
  C:\Windows\System\PdaQhvy.exe
  2⤵
  PID:9308
- C:\Windows\System\cSblLZb.exe
  C:\Windows\System\cSblLZb.exe
  2⤵
  PID:9348
- C:\Windows\System\RuiUUVX.exe
  C:\Windows\System\RuiUUVX.exe
  2⤵
  PID:9412
- C:\Windows\System\xVMcCMj.exe
  C:\Windows\System\xVMcCMj.exe
  2⤵
  PID:9508
- C:\Windows\System\DqqwXTc.exe
  C:\Windows\System\DqqwXTc.exe
  2⤵
  PID:9572
- C:\Windows\System\LFWClFC.exe
  C:\Windows\System\LFWClFC.exe
  2⤵
  PID:9612
- C:\Windows\System\wKINueg.exe
  C:\Windows\System\wKINueg.exe
  2⤵
  PID:9624
- C:\Windows\System\afqtrHZ.exe
  C:\Windows\System\afqtrHZ.exe
  2⤵
  PID:8368
- C:\Windows\System\LWjZkim.exe
  C:\Windows\System\LWjZkim.exe
  2⤵
  PID:9128
- C:\Windows\System\ZNwQRcs.exe
  C:\Windows\System\ZNwQRcs.exe
  2⤵
  PID:8884
- C:\Windows\System\gAXaaEj.exe
  C:\Windows\System\gAXaaEj.exe
  2⤵
  PID:9252
- C:\Windows\System\cclGccT.exe
  C:\Windows\System\cclGccT.exe
  2⤵
  PID:9324
- C:\Windows\System\oCdtwcz.exe
  C:\Windows\System\oCdtwcz.exe
  2⤵
  PID:9396
- C:\Windows\System\oCmmcZR.exe
  C:\Windows\System\oCmmcZR.exe
  2⤵
  PID:9488
- C:\Windows\System\jJdYhJB.exe
  C:\Windows\System\jJdYhJB.exe
  2⤵
  PID:9556
- C:\Windows\System\benCfER.exe
  C:\Windows\System\benCfER.exe
  2⤵
  PID:9640
- C:\Windows\System\LrMzpgt.exe
  C:\Windows\System\LrMzpgt.exe
  2⤵
  PID:9656
- C:\Windows\System\uFUzBrt.exe
  C:\Windows\System\uFUzBrt.exe
  2⤵
  PID:9684
- C:\Windows\System\gQRChaU.exe
  C:\Windows\System\gQRChaU.exe
  2⤵
  PID:9696
- C:\Windows\System\bVTpsau.exe
  C:\Windows\System\bVTpsau.exe
  2⤵
  PID:8848
- C:\Windows\System\hOODZAS.exe
  C:\Windows\System\hOODZAS.exe
  2⤵
  PID:9744
- C:\Windows\System\lNXNoEC.exe
  C:\Windows\System\lNXNoEC.exe
  2⤵
  PID:9812
- C:\Windows\System\nokLgBY.exe
  C:\Windows\System\nokLgBY.exe
  2⤵
  PID:9876
- C:\Windows\System\nZMvurT.exe
  C:\Windows\System\nZMvurT.exe
  2⤵
  PID:10212
- C:\Windows\System\beaOzpo.exe
  C:\Windows\System\beaOzpo.exe
  2⤵
  PID:9444
- C:\Windows\System\FhSaNgS.exe
  C:\Windows\System\FhSaNgS.exe
  2⤵
  PID:9632
- C:\Windows\System\neCUaBK.exe
  C:\Windows\System\neCUaBK.exe
  2⤵
  PID:9604
- C:\Windows\System\vlJohBb.exe
  C:\Windows\System\vlJohBb.exe
  2⤵
  PID:9272
- C:\Windows\System\QiBVElD.exe
  C:\Windows\System\QiBVElD.exe
  2⤵
  PID:9620
- C:\Windows\System\SlmXFFE.exe
  C:\Windows\System\SlmXFFE.exe
  2⤵
  PID:9248
- C:\Windows\System\Goqivvs.exe
  C:\Windows\System\Goqivvs.exe
  2⤵
  PID:9428
- C:\Windows\System\iffdJgg.exe
  C:\Windows\System\iffdJgg.exe
  2⤵
  PID:9676
- C:\Windows\System\rKZHyFe.exe
  C:\Windows\System\rKZHyFe.exe
  2⤵
  PID:9704
- C:\Windows\System\HftiHfZ.exe
  C:\Windows\System\HftiHfZ.exe
  2⤵
  PID:9692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DnhHabj.exe

Filesize
2.4MB

MD5
278f1fb2a9c4c049ca128cf5803660e0

SHA1
c4e131b6a3db58dcf080dde083e8690b9ccf0f4d

SHA256
9e6fd76df4a4fd755360bc78f2fed86cae50e9119e9bafc586355185eaac4821

SHA512
6391b0833e59aee207df84293d8e5bbb23d992768e5cc732b3aad317b28e7d1ad08a3652279d2ace9d21fac6e70a924962f1c32b5d16b92ddbc6229e4c31d3de

Download Submit
C:\Windows\system\DthxCMd.exe

Filesize
2.4MB

MD5
3ac15ea0b645a617568fc26367478791

SHA1
ce991376848c1a0cd938102baf8d58fdefa443bb

SHA256
87ef15c2d9b5a90deba17e60b7f0f55c47deca2b05b6b7460d6afaa6f5d99e4f

SHA512
3cd0b718da00108f8e60aba74d717ea0506c0fc14bd841fa7f1d8d3e6af2ae45a500072dd4aa9e0f63f9f9e7f560d5016034f764d6d3f6856a2f4b97a101a257

Download Submit
C:\Windows\system\EQZxnjm.exe

Filesize
2.4MB

MD5
18dd91bbbb3a08ef584a9ec0419b0143

SHA1
7372b6addd5a692f1c1c4e8d56999507a9205a83

SHA256
bf16c949e26c4a0643131025c35fa6770c7d05d6f0d51e4064ca1d6fcd8f4c05

SHA512
464f0a5cb765bd4411dbe10a2cced0e608241851deb62dde0782d8f3adb3e888bbf005628af27d6f70be58b4663d36a8dc71a5fa8f36bfad673e92a866ff866a

Download Submit
C:\Windows\system\GGzMEgy.exe

Filesize
2.4MB

MD5
e7e5587fb320be614177bea0436734cb

SHA1
206a0cfde8c0126a90be6946d704390076e1bcc3

SHA256
5c5cde67f230927d1e36ba229d37a04aa74cc31ae09b02aaf5c7de27783e5541

SHA512
47dbb30154aa002f7b3ed9fa005f87554bdaa7a6b7b6535b622aa15f34f94720a5cecf3f08df86d5d907865110820d43e23dacf365ffbb0729c4b02b3899d3bd

Download Submit
C:\Windows\system\GfONrjz.exe

Filesize
2.4MB

MD5
4385d183195fdee57db9be69729727f5

SHA1
3ef5fa40efb8ed1dc211addebe9fb85ac33d7380

SHA256
4bec5a6b8364954dc85c7559d240b77dca778a103431a70ffde940359676f6c1

SHA512
81e8bd6114a352d6d722b568c594773a9d7712f9bd338fd9b28b117d8abcd91db8efbc138ca9211d527269a6d7999323c988dad86ec81db4fff9c59e3995d2b5

Download Submit
C:\Windows\system\GxPKoml.exe

Filesize
2.4MB

MD5
06bbe09acfc2109e7a8ac9603be6ac19

SHA1
42d37fa02a0564b60f027c20a98416034ffc51f9

SHA256
e904fe6108d0983c7118c93a136e121ebb5dd5892e40634315753b5932e4c56b

SHA512
9dad3ef28a963ccaf224465e64137e5cd73d6a3e1686ae4bff7856d2bee7c6fd1174991d1e5cf39ffff339d9897b62a029ae36969bcbbbead5f52ab984bc4f57

Download Submit
C:\Windows\system\LDhtEVf.exe

Filesize
2.4MB

MD5
02d8fba2282581256bce4636f419ced3

SHA1
9594701f746670ec8cd28e611f3f1f9c6642582d

SHA256
a6f0d00cb8cd0d29d67dba7567de295d014384d4455a76f9db02fe3c419e4b3f

SHA512
a30d44921dfca76d8ee159fb9b6fbaa60634c5822543d0c2d182b2bc050ba1ab3245140859e4646ce084eccf6d9053de50848531879a94a6c6fadc86fbacb59b

Download Submit
C:\Windows\system\LnYRyrq.exe

Filesize
2.4MB

MD5
bf627a0941b2952802784dd95a741d5a

SHA1
f8598a9cd09d52e4fdc54cfb7dd2d60a60e91bef

SHA256
79689752ffffeb47ff08a1b953d0ac4803afd8e65b29db57729c4517b85a9b46

SHA512
fe0d509da211369ba55760c4292d20ca4aa5cc5b6f98a3157aab6df2a43c717304a0cc513d414784b6cc524c075e1d60c883e08af6b6db87378e2816a8cd7645

Download Submit
C:\Windows\system\MHBviIe.exe

Filesize
2.4MB

MD5
dbfc80db613ec04fa7e2481f15ff2c8a

SHA1
ce36676403b076ac0bd008685c55dbf12a03bdf4

SHA256
c0e706880b3bdc9448abc380c8905a9fad8e9d914c2248b4e9f0f1e3a507d3b8

SHA512
02050c24679ef3545ba7725d033edcfaa7403933f5caf1a206bda93ec7d116173917b65f6327df1a905b11d045ba77c035573bcb9de16ddbcde6fe8a5aa17b2f

Download Submit
C:\Windows\system\OAZQmvl.exe

Filesize
2.4MB

MD5
5f52f187e40c03ccf5d44d3272d288af

SHA1
9baceac987e3a42a1bf7bba3360a5909a6a7c1dc

SHA256
8577ac5f8367675dc84abd8d66f30693338f1da0bf97593b7e3ab84ef0d68c9b

SHA512
4b85bf136e8b673537573e0d712ae9c49059e0f61354bd3c6e5a83bf2cbed179d8812483ae33bbd587123d6b10ff8fbaf7c4ba169616229fbf03fac798d03518

Download Submit
C:\Windows\system\OJUmWSm.exe

Filesize
2.4MB

MD5
3391f464a74370187921783113b1d678

SHA1
3cbfdfbba9db355d06f7b61eee44e9f0434ea86c

SHA256
ee9dbd96e7584b1ea2e939bd273aca7a67777c86b526cb1ae8779cd515067792

SHA512
701651e3e5eee6aa22509de63e32c880fb597a6eab7958cbbd4632605aa65f3188cc46a7c06bb63afc3901e924f3ab7ad15591c81de7b448cbb461b3e336b375

Download Submit
C:\Windows\system\OiQnYHf.exe

Filesize
2.4MB

MD5
e52f391de20e1498e9de0749c594336e

SHA1
4a7c2060712544600a6c2d1f93319d9b6642a0c8

SHA256
5bbea68b895279fe12abf59490fc274a0b4a723d2ca61a34f9d08e6f544f7fab

SHA512
71eeb08da2b9b9a200d353a4e8e73165d0f507b10f3327e911cf615e567e57dec7444542428dbdcab2f91621e35363fc9b0e998cb8b4be9044dfe3c0b50acc66

Download Submit
C:\Windows\system\PMhhZHo.exe

Filesize
2.4MB

MD5
6f8f174ca5f39221efb2dba1c34d1503

SHA1
44f10e23de47b99022beb54a91d290ff5266fca0

SHA256
885d7c4e60d5bf126186c9e6e62210e214482555af2de575a96ed701c1c71656

SHA512
b6f0e9530259e865e01bbf872eec6c477692fe519cf296e3b226da3c0000ac489540d2d543372d642deccb6996186a9b6104c45fe08302d5756f0656c4de610d

Download Submit
C:\Windows\system\RdXlSOw.exe

Filesize
2.4MB

MD5
300aac2b7fdd14f37463f0140d1c3a69

SHA1
1fe633f9a3f6c71494fe1611c86e8da266d9377c

SHA256
5b560ceeaeb18ade29dcdaa4f19ab4942fd5843a8bac2b428c075ce8e8b39d8b

SHA512
963fd22f2e2ce3306d446eb3bb09044bbadd55ce1112281d8796b04b71ad537e64c3e8fa07c5f153be9046d1fb76ab263f2047d484e62beb8ab4a9d7ab24c9a5

Download Submit
C:\Windows\system\UppxEFd.exe

Filesize
2.4MB

MD5
55442bd81d5e10b8d3843fddfd2538cb

SHA1
69f795634609abb57646f4bd173d353b8ec0cf65

SHA256
1a2bd83b69d4bc0410db6268aa7d16252d1be06c448940ceaade8433366e9ac3

SHA512
474d8f2e51e11839f25a861270fb1263fd7cbc233a94e80548bf31fb57e414851a3ad89d66e3a32634408500fa5e07c2a544702ff994686102a7acfff7c934c3

Download Submit
C:\Windows\system\VblaGcF.exe

Filesize
2.4MB

MD5
4d4686946cb7de33a9703eeb132ccaa5

SHA1
f8e8040b3b8c6ae3571b089414d717526c6dbfd6

SHA256
976264e1253a23b0f4e6d5a75c78e2f6ac4a6f4859a60ff3b7ea82706ad6bda5

SHA512
83827034760dada7ac3a8be37ea40ee720c8057bf3416aa3472918a09a5614edfce709d40a7a94c7373f854ac8c150dbf561f2467d9387ea0f20666338f5e5b2

Download Submit
C:\Windows\system\gtieoPe.exe

Filesize
2.4MB

MD5
054abf8efcf64f39878f03c1821b121e

SHA1
4dda9091350a063a1f2f6ee512cfdd6b4e05579c

SHA256
9e3eb60cc709e592526e0644b52d5c6b87465d600ce98c299866b277e45a6546

SHA512
67c9825d17e01b284404c77fa8eb582d55ed74f18b22d42741563a135f914ffa80fda4ee9bc0e16e10dbfe69d9854c195e1bb178f493e9467374beeb28d85ead

Download Submit
C:\Windows\system\hJLxVsl.exe

Filesize
18B

MD5
c66cdc789fed99d92127571e86ecb03d

SHA1
188873e18e6e3b9ceef082be68645df41216c2de

SHA256
aac7227006c039705440741dfa58468767a241db7d3bd85e302e4fd55fd7ced0

SHA512
ca491a8b679cfad4b78e62443d1e9e343553264817662db17ef1a796af3daf08d0f856e86dd7157e45e360cbb25ececc19a9a25447b465dc5e199a0bbaf01a20

Download Submit
C:\Windows\system\kGYVifv.exe

Filesize
2.4MB

MD5
301b8030fc37a136294f12192e3e41bb

SHA1
8a324ec1d4c745d0c9d9788acaaee83382fd228b

SHA256
0da173893a05b828497a93f0e8f8bc0018ea9529fde4f4101ad957f6c9981260

SHA512
5f2b9ef8d1f6d0d614348cc03cf9185714b2e6ddbacb2463a2067196b7b6f50291e9581cfde06ac03d731b1d15c281fe968bd6e41ab653b65d55c69192453541

Download Submit
C:\Windows\system\kwvOwBC.exe

Filesize
2.4MB

MD5
5542a122bc1494878e3f85ea3b473f0d

SHA1
9317b0100c132b8dbd4a2d71474f78cf4a241667

SHA256
d7f1f7ca40a8b5ecefcd796bae1acfac4c98ed40205f4fe7fb1f251dabf29095

SHA512
eadc28c773436b6e19292fb93ecdc062410d15b167d829711917c1decc7c5a7c57ef6cb536f9ac5abf3818dd297b952e4360e22a90ea50a5c6b9a9e10d140b71

Download Submit
C:\Windows\system\lEiJOAT.exe

Filesize
2.4MB

MD5
f01321289cfedb828fc8bdc92851af59

SHA1
ca6007a181b133ebee4efc2121cc3cdc26e28218

SHA256
e81373c568b7b25bff483633203a58eedc5f7f4dbf65c04bcc0d14e80cf5c44a

SHA512
47095fa334bddc30304a0379d78f6c95c16dacd11c5750a662969d1578d01e2984bd0736625ca823725f52635425859bd6e6abf6df90e120b26ed8c646f96c05

Download Submit
C:\Windows\system\qiOjavD.exe

Filesize
2.4MB

MD5
e4a8429c7c7b41f9e00ad1a39a6c2a36

SHA1
92d913da10333ee9e1517d4e5f20f7d55cb2c529

SHA256
5f8cb1b07a994962092055cd61ced754d143d1b5ab06556f4be4f1ba094bf093

SHA512
2546ecb6fc623cd04f4e45120760ea2a7bcfa54358188aeadfed2bb09b9ab9378b7b9e0ba9a8152b9e9faa787f2694569a6b44c8efff574b0e49c76a1f038f99

Download Submit
C:\Windows\system\qqSkFop.exe

Filesize
2.4MB

MD5
4ff299b459f985e2951488c833e36404

SHA1
519bedd8200a3e3aee40421d0c9343fa389ca418

SHA256
3112ae6b7edf490a906cf91fabb7fa647570f0b033dd8b84bbaad696ed650aa0

SHA512
2fec99444a19ae36b1580a1946d271f9ef7b432188419f494c63683e3a798c7d22a706a0c53b74ec09b0adaef36b4aa58bf72c31be1a25875aa224eec08a5b67

Download Submit
C:\Windows\system\vELiQIU.exe

Filesize
2.4MB

MD5
d527b80ec0ef5cbcc982646021752c06

SHA1
ffe7677074c97262d1a319a20a797ada04168ac3

SHA256
ba8760eda48faa8143607c8d39ebff17d6daaf35fbe8275f7efd0355cdfe3f33

SHA512
a0dcb478ad2a70eb0bbe64aba5a15264d66829a7357bcc3139040d5abb82c2c73b21743394b1cad80e7328fee4b2af33fa1b8eacbbbd2198029a4e0c2308ebe4

Download Submit
C:\Windows\system\vSniujc.exe

Filesize
2.4MB

MD5
089eb39194df65907c456bb2512b1b63

SHA1
2554c4043ff05cde52894e8ff96714f08d20fade

SHA256
5d7c7c4c40d11812c7f231240dee78882493a21e008e12a2a56de9f93e73bf57

SHA512
cdb8b17fa37c4871612998f6eb95c70b2c968e68412f8ce57b22787e3fdd1ed7deb54e2247a07165d6e76abd2a892326395fdcb62878664dd2f4c3aebbf27b19

Download Submit
C:\Windows\system\xSYkeEp.exe

Filesize
2.4MB

MD5
600df99fa590f213b8c435776a6ebbdf

SHA1
da6e19e737cb23617e2d51cb802447c82874ec0e

SHA256
b8f1702fa1b2c8dd39b7110023e9ff91673c19451847c5c827f9079d8b7e5e21

SHA512
3311ca070eed408fe09532fc24f3a895640b9baf642053ebf7bf1d345721524af82ed350b418efa076502fcdeae504096e9e896ee6b6877f8cb33f2b6201a0c5

Download Submit
C:\Windows\system\xaNyiUb.exe

Filesize
2.4MB

MD5
367fcf80bf731d4067c3b4953fbd394a

SHA1
cb56c6a64088312f85a4006ed13fe74181524180

SHA256
cc6ef41d7bf879c3252cceb981faba381ece244c57b5bd5311cc13a751d73a2d

SHA512
02ff3662618bfcf665d0271fcab39c179f7840b22ad9534e76c4817735e8acd89e97dc4030a688f0d6deaf2c06fab9a51e84b7d368fe29ec19e5127bd02c1542

Download Submit
C:\Windows\system\ztbWEgF.exe

Filesize
2.4MB

MD5
07a22c0454bb9868479184ebcd91d1bb

SHA1
595e85fb9c6bf6eaf185e202f4ac124201f3e540

SHA256
8e61e969c379d1fbebbb4a3802857224801dc0298bad7198547827e143e142af

SHA512
672e73d536b8b15de592747c397544499d17f1c70552fac4a086ca7d57e0c00b262ab16886094dc857eed64751c6251dc04f07aee44bb0be56d477225e24c7bf

Download Submit
\Windows\system\MkCSkkh.exe

Filesize
2.4MB

MD5
f0bab486cd59a3b5bbc45fce39b95c65

SHA1
a3748c7215f53ecfa5c26bdf4e0b9e538942c7de

SHA256
1059a4a0011fe1f3faa6325fd6d1191e14e470d608de08f5fb0142b2bdfca807

SHA512
26a93a25c4d33ea7843352fe47245c1c30a8bb951e484cdbaea8ebd9b9813099ddc0efc071c5e1d3fd23728f9bbe0c52a4b3b824377a4e87698cf59bead33d93

Download Submit
\Windows\system\NMSMjWH.exe

Filesize
2.4MB

MD5
92b177024a43c645e3a4070989bca479

SHA1
818e15b035f36f94892905af1c6c2534c2e54901

SHA256
e200c1d86660ef9841356ab1833049709cf9748a755215c0561be684f1be7a6c

SHA512
c1c09dbef57fa1ff39406112938cd2e21e7d99ad3393242d020ac55bf65b0abd44f9817a1fe35f7fa254053cc75bb4ac30d1a219367ed42545270965e2a702d5

Download Submit
\Windows\system\RPYZOBL.exe

Filesize
2.4MB

MD5
c705e21c732bc3dc606f23d4ce2b0705

SHA1
31f3c14b73f5520f5bdfd9bd2c9a5aa4bf4e3f45

SHA256
00d167f502cd621dfa73eadca12e49d4e2b80b635f193d42372129e80272b002

SHA512
8faed9b4a694ebc0f50a91cea8f9d2fb9027733057ef7344231041d46d3a2c1a146a26c53ca9de0ca7f79525701485d34af2dfc60d3bb47153cec5ceb327d52d

Download Submit
\Windows\system\SFZFviC.exe

Filesize
2.4MB

MD5
74e71a122847cfc092c6f905c8262878

SHA1
bcda7864d3a8766bbad15a1fc67b3da50571b1a3

SHA256
843d3e994d5f404a28eae9f172a09b3510be6c7aff4858f9193acf012f2ce0ee

SHA512
6baa5c42fd443be0c6953f8cff22c1a1d21fbb6bee55dd13700952348c0f7e44d5a401b0c8e3c5b3211e7cec320a8c67f203741445ea228162ef5fb768fcb4a6

Download Submit
\Windows\system\qZJDJjJ.exe

Filesize
2.4MB

MD5
e8ee39edc635b3005d28a846791de7e1

SHA1
145af77cf9897c45c22fab506fab52b76078d59c

SHA256
cf3ad4cdc9519986a72f31745a193d38efb960b6dd4837e9a8524c024e8f9958

SHA512
e3f66e4786fe509900ecca4ad7798bc5f3fd2da65fc2d181a0964951a9e09c865e8f16e58c99f4967d6ded8070a55532fd8e1a4836b948eddf507da659d0cb4f

Download Submit
memory/304-77-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/304-5239-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1664-80-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1664-23-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/1664-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1664-6-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-71-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/1664-75-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-30-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1664-0-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-82-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-45-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/1664-13-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/1664-81-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-90-0x00000000036B0000-0x0000000003AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-52-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2156-50-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2156-53-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2156-37-0x0000000002E70000-0x0000000002EF0000-memory.dmp

Filesize
512KB

Download
memory/2292-5351-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2292-91-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2400-79-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2400-5220-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2436-51-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2436-5234-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2452-5232-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2452-65-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2472-89-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-5252-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-31-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2572-83-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2580-78-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2580-5240-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2604-5325-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2604-15-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2716-5247-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2716-36-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2716-1738-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/3036-595-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-5219-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-11-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download