xmrig | 7b6bcd721e5cddc0d74b38a76cab8224e1b2ba3b39ad7e0f382cbc5314c1f17e

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
Size

1.7MB
MD5

175cfc2db509885fafdd38d98ca61fb9
SHA1

0c9ca4eab86f44f0a7d5ca795cd1f5b6c0dbc85a
SHA256

7b6bcd721e5cddc0d74b38a76cab8224e1b2ba3b39ad7e0f382cbc5314c1f17e
SHA512

5d528640af3f0b18fb48a5c0b03a724a84df399a53e36004f3769028549bf691b308eed07828c8d24856b755444d6ca146637e386d892d6e84dc951c4933143c
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pxtUp:NABk

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2936-9-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2420-111-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/552-119-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2844-124-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/752-118-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/3040-114-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2472-107-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2224-103-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2548-3942-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/752-3960-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2472-4009-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2936-4069-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/552-4070-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2700-4114-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2844-4112-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2420-4415-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/3040-4541-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2224-4519-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
112	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2936	tCSrBDU.exe
2700	edAYEOH.exe
2548	AsieDFQ.exe
2224	jrEcLFw.exe
2472	vkdfoMH.exe
2420	Vbvsudn.exe
2844	YbyPOms.exe
3040	dtiMDwH.exe
752	oNEhnvZ.exe
552	EPaBfjx.exe
1208	MCsePnq.exe
1128	BNrXdpm.exe
2408	ujXcrxn.exe
940	fXZLJrG.exe
2712	icMAgPU.exe
1388	UrpNqyn.exe
280	SnFfqPw.exe
2656	LbiDEGK.exe
1792	ClslKQf.exe
2180	DAEhILh.exe
2660	bKfYCzm.exe
1572	dPmIyvJ.exe
832	WBvECJy.exe
2096	MVZTXEn.exe
2044	vblgJaB.exe
2788	MLeqQeZ.exe
3024	GUKdPNh.exe
2148	ylqxHEQ.exe
1712	RzLIYdN.exe
2320	WXPuWnf.exe
2232	PjfKsnC.exe
824	BsYgKeY.exe
1332	zXGwnLz.exe
1376	QVFwFFp.exe
1656	Flidxoj.exe
1348	uKTBVpj.exe
1500	irLdqRD.exe
1660	ojNziEl.exe
1648	EphwyJJ.exe
616	MwDAXwV.exe
1664	xJguxtc.exe
2924	oOnWeMB.exe
2276	vZoCJsX.exe
2128	rLFqPec.exe
1752	YiiFlbt.exe
2260	WmBzVtV.exe
1136	oCaQvfM.exe
2908	hFiiUCw.exe
1244	oNJuhzO.exe
1964	ORXSLrU.exe
868	VPSpnBV.exe
1516	QaPCSnt.exe
2564	KqmNSXa.exe
2540	VIAumrx.exe
1108	POhoeLy.exe
2424	CiAhNIg.exe
2576	gzccjRs.exe
588	mbDJTEX.exe
1580	vHJNAmZ.exe
2760	pHhRggI.exe
2536	PFResxF.exe
2704	bMwEyrE.exe
2160	ybFxNMZ.exe
2468	qurmsWe.exe

Loads dropped DLL 64 IoCs

pid	Process
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1284-0-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x000b000000014b6d-3.dat	upx
behavioral1/memory/2936-9-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x002e000000015364-10.dat	upx
behavioral1/files/0x000800000001560a-12.dat	upx
behavioral1/memory/2548-25-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2700-23-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x0007000000015a2d-33.dat	upx
behavioral1/files/0x000f0000000006fd-38.dat	upx
behavioral1/files/0x000f0000000155d4-39.dat	upx
behavioral1/files/0x000a000000015c0d-51.dat	upx
behavioral1/files/0x0006000000016d4f-63.dat	upx
behavioral1/files/0x0006000000017090-85.dat	upx
behavioral1/files/0x0006000000016d4a-83.dat	upx
behavioral1/files/0x000600000001704f-81.dat	upx
behavioral1/files/0x0006000000016e56-78.dat	upx
behavioral1/files/0x0005000000018698-110.dat	upx
behavioral1/memory/2420-111-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/552-119-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2844-124-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x000500000001868c-125.dat	upx
behavioral1/memory/752-118-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/3040-114-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x0006000000016d89-74.dat	upx
behavioral1/files/0x0006000000016d84-71.dat	upx
behavioral1/files/0x0009000000015e5b-57.dat	upx
behavioral1/files/0x0006000000016d41-55.dat	upx
behavioral1/files/0x0006000000016d55-66.dat	upx
behavioral1/memory/2472-107-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0006000000018ae2-140.dat	upx
behavioral1/files/0x0006000000018b15-150.dat	upx
behavioral1/files/0x0006000000018b4a-170.dat	upx
behavioral1/files/0x0006000000018b42-166.dat	upx
behavioral1/files/0x0006000000018b73-179.dat	upx
behavioral1/files/0x0006000000018d06-196.dat	upx
behavioral1/files/0x0006000000018b96-186.dat	upx
behavioral1/files/0x0006000000018ba2-190.dat	upx
behavioral1/files/0x0006000000018b6a-175.dat	upx
behavioral1/files/0x0006000000018b33-156.dat	upx
behavioral1/files/0x0006000000018b37-160.dat	upx
behavioral1/files/0x0006000000018ae8-146.dat	upx
behavioral1/files/0x00050000000186a0-136.dat	upx
behavioral1/memory/2224-103-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2548-3942-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/752-3960-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2472-4009-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2936-4069-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/552-4070-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2700-4114-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2844-4112-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2420-4415-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/3040-4541-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2224-4519-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tFHRqwP.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\EwbOUhy.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\tbrOOMe.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\bUdjdJs.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\kdGJWSX.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\dSyBgtQ.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\kGjWZoP.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\BxjiuiT.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\FEISbNR.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\sRZborK.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\BByzaJp.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\LsxcJgv.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\UmvsOWm.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\RdsrjRN.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\aScLJyQ.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\BVALxSl.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\ZlQCSMW.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\ujXcrxn.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\vHJNAmZ.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\bzUVAnb.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\cqxmlZu.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\htxgtcp.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\BFudOYj.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\NCoWphK.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\efvaRyr.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\PcEeubU.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\EphwyJJ.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\BhwwEXO.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\oGGZAFm.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\maLxjiq.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\amPZHCY.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\BfcXzqu.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\JqPuPfu.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\GVsMmJM.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\jrEcLFw.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\nSkcEtk.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\YPGZaze.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\YcfhDZg.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\jJqqfvr.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\xMBhDVH.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\jbhxEsI.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\aEccuZK.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\oSMuAbK.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\ZxKlaul.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\lrzffHk.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\ZNrbvjD.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\BLWUjeU.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\eTSzgEj.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\ChhLaOw.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\MBdXZks.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\EizzLAX.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\lXjOBWv.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\osyqplH.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\qzLmnll.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\fURccik.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\KQbEzTN.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\eoNYIkJ.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\jSUUTfY.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\nVSAtXV.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\WXPuWnf.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\XhEbcak.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\Lmqjeio.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\vYzckVy.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
File created	C:\Windows\System\LoRkmfg.exe	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
112	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
Token: SeDebugPrivilege	112	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 112	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	29
PID 1284 wrote to memory of 112	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	29
PID 1284 wrote to memory of 112	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	29
PID 1284 wrote to memory of 2936	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	30
PID 1284 wrote to memory of 2936	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	30
PID 1284 wrote to memory of 2936	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	30
PID 1284 wrote to memory of 2700	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	31
PID 1284 wrote to memory of 2700	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	31
PID 1284 wrote to memory of 2700	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	31
PID 1284 wrote to memory of 2548	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	32
PID 1284 wrote to memory of 2548	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	32
PID 1284 wrote to memory of 2548	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	32
PID 1284 wrote to memory of 2224	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	33
PID 1284 wrote to memory of 2224	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	33
PID 1284 wrote to memory of 2224	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	33
PID 1284 wrote to memory of 2472	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	34
PID 1284 wrote to memory of 2472	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	34
PID 1284 wrote to memory of 2472	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	34
PID 1284 wrote to memory of 2420	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	35
PID 1284 wrote to memory of 2420	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	35
PID 1284 wrote to memory of 2420	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	35
PID 1284 wrote to memory of 2844	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	36
PID 1284 wrote to memory of 2844	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	36
PID 1284 wrote to memory of 2844	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	36
PID 1284 wrote to memory of 3040	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	37
PID 1284 wrote to memory of 3040	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	37
PID 1284 wrote to memory of 3040	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	37
PID 1284 wrote to memory of 752	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	38
PID 1284 wrote to memory of 752	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	38
PID 1284 wrote to memory of 752	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	38
PID 1284 wrote to memory of 1208	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	39
PID 1284 wrote to memory of 1208	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	39
PID 1284 wrote to memory of 1208	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	39
PID 1284 wrote to memory of 552	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	40
PID 1284 wrote to memory of 552	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	40
PID 1284 wrote to memory of 552	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	40
PID 1284 wrote to memory of 2408	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	41
PID 1284 wrote to memory of 2408	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	41
PID 1284 wrote to memory of 2408	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	41
PID 1284 wrote to memory of 1128	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	42
PID 1284 wrote to memory of 1128	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	42
PID 1284 wrote to memory of 1128	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	42
PID 1284 wrote to memory of 1388	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	43
PID 1284 wrote to memory of 1388	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	43
PID 1284 wrote to memory of 1388	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	43
PID 1284 wrote to memory of 940	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	44
PID 1284 wrote to memory of 940	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	44
PID 1284 wrote to memory of 940	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	44
PID 1284 wrote to memory of 280	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	45
PID 1284 wrote to memory of 280	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	45
PID 1284 wrote to memory of 280	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	45
PID 1284 wrote to memory of 2712	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	46
PID 1284 wrote to memory of 2712	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	46
PID 1284 wrote to memory of 2712	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	46
PID 1284 wrote to memory of 2656	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	47
PID 1284 wrote to memory of 2656	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	47
PID 1284 wrote to memory of 2656	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	47
PID 1284 wrote to memory of 1792	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	48
PID 1284 wrote to memory of 1792	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	48
PID 1284 wrote to memory of 1792	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	48
PID 1284 wrote to memory of 2180	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	49
PID 1284 wrote to memory of 2180	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	49
PID 1284 wrote to memory of 2180	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	49
PID 1284 wrote to memory of 2660	1284	175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\175cfc2db509885fafdd38d98ca61fb9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:112
- C:\Windows\System\tCSrBDU.exe
  C:\Windows\System\tCSrBDU.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\edAYEOH.exe
  C:\Windows\System\edAYEOH.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\AsieDFQ.exe
  C:\Windows\System\AsieDFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\jrEcLFw.exe
  C:\Windows\System\jrEcLFw.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\vkdfoMH.exe
  C:\Windows\System\vkdfoMH.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\Vbvsudn.exe
  C:\Windows\System\Vbvsudn.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\YbyPOms.exe
  C:\Windows\System\YbyPOms.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\dtiMDwH.exe
  C:\Windows\System\dtiMDwH.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\oNEhnvZ.exe
  C:\Windows\System\oNEhnvZ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\MCsePnq.exe
  C:\Windows\System\MCsePnq.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\EPaBfjx.exe
  C:\Windows\System\EPaBfjx.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ujXcrxn.exe
  C:\Windows\System\ujXcrxn.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\BNrXdpm.exe
  C:\Windows\System\BNrXdpm.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\UrpNqyn.exe
  C:\Windows\System\UrpNqyn.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\fXZLJrG.exe
  C:\Windows\System\fXZLJrG.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\SnFfqPw.exe
  C:\Windows\System\SnFfqPw.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\icMAgPU.exe
  C:\Windows\System\icMAgPU.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\LbiDEGK.exe
  C:\Windows\System\LbiDEGK.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ClslKQf.exe
  C:\Windows\System\ClslKQf.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\DAEhILh.exe
  C:\Windows\System\DAEhILh.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\bKfYCzm.exe
  C:\Windows\System\bKfYCzm.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\dPmIyvJ.exe
  C:\Windows\System\dPmIyvJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\WBvECJy.exe
  C:\Windows\System\WBvECJy.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\MVZTXEn.exe
  C:\Windows\System\MVZTXEn.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\vblgJaB.exe
  C:\Windows\System\vblgJaB.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\MLeqQeZ.exe
  C:\Windows\System\MLeqQeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\GUKdPNh.exe
  C:\Windows\System\GUKdPNh.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\ylqxHEQ.exe
  C:\Windows\System\ylqxHEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\RzLIYdN.exe
  C:\Windows\System\RzLIYdN.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\WXPuWnf.exe
  C:\Windows\System\WXPuWnf.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\PjfKsnC.exe
  C:\Windows\System\PjfKsnC.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\BsYgKeY.exe
  C:\Windows\System\BsYgKeY.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\zXGwnLz.exe
  C:\Windows\System\zXGwnLz.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\Flidxoj.exe
  C:\Windows\System\Flidxoj.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\QVFwFFp.exe
  C:\Windows\System\QVFwFFp.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\uKTBVpj.exe
  C:\Windows\System\uKTBVpj.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\irLdqRD.exe
  C:\Windows\System\irLdqRD.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ojNziEl.exe
  C:\Windows\System\ojNziEl.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\EphwyJJ.exe
  C:\Windows\System\EphwyJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\xJguxtc.exe
  C:\Windows\System\xJguxtc.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\MwDAXwV.exe
  C:\Windows\System\MwDAXwV.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\oOnWeMB.exe
  C:\Windows\System\oOnWeMB.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\vZoCJsX.exe
  C:\Windows\System\vZoCJsX.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\rLFqPec.exe
  C:\Windows\System\rLFqPec.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\YiiFlbt.exe
  C:\Windows\System\YiiFlbt.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\oCaQvfM.exe
  C:\Windows\System\oCaQvfM.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\WmBzVtV.exe
  C:\Windows\System\WmBzVtV.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\hFiiUCw.exe
  C:\Windows\System\hFiiUCw.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\oNJuhzO.exe
  C:\Windows\System\oNJuhzO.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\VPSpnBV.exe
  C:\Windows\System\VPSpnBV.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\ORXSLrU.exe
  C:\Windows\System\ORXSLrU.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\POhoeLy.exe
  C:\Windows\System\POhoeLy.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\QaPCSnt.exe
  C:\Windows\System\QaPCSnt.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\vHJNAmZ.exe
  C:\Windows\System\vHJNAmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\KqmNSXa.exe
  C:\Windows\System\KqmNSXa.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\bMwEyrE.exe
  C:\Windows\System\bMwEyrE.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\VIAumrx.exe
  C:\Windows\System\VIAumrx.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\ybFxNMZ.exe
  C:\Windows\System\ybFxNMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\CiAhNIg.exe
  C:\Windows\System\CiAhNIg.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\qurmsWe.exe
  C:\Windows\System\qurmsWe.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\gzccjRs.exe
  C:\Windows\System\gzccjRs.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\OWFeqif.exe
  C:\Windows\System\OWFeqif.exe
  2⤵
  PID:2848
- C:\Windows\System\mbDJTEX.exe
  C:\Windows\System\mbDJTEX.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\qrnSKUL.exe
  C:\Windows\System\qrnSKUL.exe
  2⤵
  PID:924
- C:\Windows\System\pHhRggI.exe
  C:\Windows\System\pHhRggI.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\YZGuShj.exe
  C:\Windows\System\YZGuShj.exe
  2⤵
  PID:1684
- C:\Windows\System\PFResxF.exe
  C:\Windows\System\PFResxF.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\idhmZEe.exe
  C:\Windows\System\idhmZEe.exe
  2⤵
  PID:2284
- C:\Windows\System\CQenkFx.exe
  C:\Windows\System\CQenkFx.exe
  2⤵
  PID:2008
- C:\Windows\System\TdNfsDM.exe
  C:\Windows\System\TdNfsDM.exe
  2⤵
  PID:2264
- C:\Windows\System\XhscBAn.exe
  C:\Windows\System\XhscBAn.exe
  2⤵
  PID:748
- C:\Windows\System\iKwzJtT.exe
  C:\Windows\System\iKwzJtT.exe
  2⤵
  PID:2464
- C:\Windows\System\FgSYeWW.exe
  C:\Windows\System\FgSYeWW.exe
  2⤵
  PID:2652
- C:\Windows\System\tLwRQRE.exe
  C:\Windows\System\tLwRQRE.exe
  2⤵
  PID:2356
- C:\Windows\System\DaiQqQv.exe
  C:\Windows\System\DaiQqQv.exe
  2⤵
  PID:1788
- C:\Windows\System\kNgswzJ.exe
  C:\Windows\System\kNgswzJ.exe
  2⤵
  PID:2288
- C:\Windows\System\nGPNXGI.exe
  C:\Windows\System\nGPNXGI.exe
  2⤵
  PID:780
- C:\Windows\System\tyuwHUD.exe
  C:\Windows\System\tyuwHUD.exe
  2⤵
  PID:1412
- C:\Windows\System\wiZDVID.exe
  C:\Windows\System\wiZDVID.exe
  2⤵
  PID:400
- C:\Windows\System\klJHUXM.exe
  C:\Windows\System\klJHUXM.exe
  2⤵
  PID:1364
- C:\Windows\System\ssWHjly.exe
  C:\Windows\System\ssWHjly.exe
  2⤵
  PID:1100
- C:\Windows\System\hIOyxWu.exe
  C:\Windows\System\hIOyxWu.exe
  2⤵
  PID:2584
- C:\Windows\System\rEgVzkK.exe
  C:\Windows\System\rEgVzkK.exe
  2⤵
  PID:1852
- C:\Windows\System\dILuEhT.exe
  C:\Windows\System\dILuEhT.exe
  2⤵
  PID:1800
- C:\Windows\System\uyBRYIA.exe
  C:\Windows\System\uyBRYIA.exe
  2⤵
  PID:2984
- C:\Windows\System\YZQJMOY.exe
  C:\Windows\System\YZQJMOY.exe
  2⤵
  PID:844
- C:\Windows\System\bUdjdJs.exe
  C:\Windows\System\bUdjdJs.exe
  2⤵
  PID:2088
- C:\Windows\System\RrhBfeU.exe
  C:\Windows\System\RrhBfeU.exe
  2⤵
  PID:876
- C:\Windows\System\SrMOoGt.exe
  C:\Windows\System\SrMOoGt.exe
  2⤵
  PID:2244
- C:\Windows\System\mmkgFqY.exe
  C:\Windows\System\mmkgFqY.exe
  2⤵
  PID:2948
- C:\Windows\System\hdwXBwo.exe
  C:\Windows\System\hdwXBwo.exe
  2⤵
  PID:2616
- C:\Windows\System\boTYxIZ.exe
  C:\Windows\System\boTYxIZ.exe
  2⤵
  PID:2532
- C:\Windows\System\bhZoEHQ.exe
  C:\Windows\System\bhZoEHQ.exe
  2⤵
  PID:1700
- C:\Windows\System\JHoIsDT.exe
  C:\Windows\System\JHoIsDT.exe
  2⤵
  PID:1004
- C:\Windows\System\GymoBsV.exe
  C:\Windows\System\GymoBsV.exe
  2⤵
  PID:1148
- C:\Windows\System\OaShFOQ.exe
  C:\Windows\System\OaShFOQ.exe
  2⤵
  PID:2632
- C:\Windows\System\AWijUoq.exe
  C:\Windows\System\AWijUoq.exe
  2⤵
  PID:1596
- C:\Windows\System\ZVHkePi.exe
  C:\Windows\System\ZVHkePi.exe
  2⤵
  PID:1736
- C:\Windows\System\NozxthY.exe
  C:\Windows\System\NozxthY.exe
  2⤵
  PID:2992
- C:\Windows\System\tKeHJfr.exe
  C:\Windows\System\tKeHJfr.exe
  2⤵
  PID:2596
- C:\Windows\System\tMIFfAe.exe
  C:\Windows\System\tMIFfAe.exe
  2⤵
  PID:2488
- C:\Windows\System\uPQjCWX.exe
  C:\Windows\System\uPQjCWX.exe
  2⤵
  PID:1044
- C:\Windows\System\Zvyfthc.exe
  C:\Windows\System\Zvyfthc.exe
  2⤵
  PID:2648
- C:\Windows\System\oGcjxWT.exe
  C:\Windows\System\oGcjxWT.exe
  2⤵
  PID:1480
- C:\Windows\System\MYlydAW.exe
  C:\Windows\System\MYlydAW.exe
  2⤵
  PID:2676
- C:\Windows\System\BJeWIcf.exe
  C:\Windows\System\BJeWIcf.exe
  2⤵
  PID:2440
- C:\Windows\System\BpEJozS.exe
  C:\Windows\System\BpEJozS.exe
  2⤵
  PID:1984
- C:\Windows\System\IRQqLiC.exe
  C:\Windows\System\IRQqLiC.exe
  2⤵
  PID:1444
- C:\Windows\System\MaJdeEX.exe
  C:\Windows\System\MaJdeEX.exe
  2⤵
  PID:2636
- C:\Windows\System\LeWmPDp.exe
  C:\Windows\System\LeWmPDp.exe
  2⤵
  PID:2804
- C:\Windows\System\kPNcjpc.exe
  C:\Windows\System\kPNcjpc.exe
  2⤵
  PID:2036
- C:\Windows\System\PVSvHps.exe
  C:\Windows\System\PVSvHps.exe
  2⤵
  PID:2520
- C:\Windows\System\ikwehUK.exe
  C:\Windows\System\ikwehUK.exe
  2⤵
  PID:2172
- C:\Windows\System\hbRfCRc.exe
  C:\Windows\System\hbRfCRc.exe
  2⤵
  PID:1256
- C:\Windows\System\JUwjDKO.exe
  C:\Windows\System\JUwjDKO.exe
  2⤵
  PID:892
- C:\Windows\System\NMFGHsC.exe
  C:\Windows\System\NMFGHsC.exe
  2⤵
  PID:2016
- C:\Windows\System\CbVLoKj.exe
  C:\Windows\System\CbVLoKj.exe
  2⤵
  PID:792
- C:\Windows\System\DXIioAm.exe
  C:\Windows\System\DXIioAm.exe
  2⤵
  PID:2864
- C:\Windows\System\mSQLxXg.exe
  C:\Windows\System\mSQLxXg.exe
  2⤵
  PID:964
- C:\Windows\System\RGfjoFb.exe
  C:\Windows\System\RGfjoFb.exe
  2⤵
  PID:1300
- C:\Windows\System\rZuWhUt.exe
  C:\Windows\System\rZuWhUt.exe
  2⤵
  PID:2588
- C:\Windows\System\kDLjCfC.exe
  C:\Windows\System\kDLjCfC.exe
  2⤵
  PID:1040
- C:\Windows\System\ZsPPAmt.exe
  C:\Windows\System\ZsPPAmt.exe
  2⤵
  PID:1192
- C:\Windows\System\VOjsuev.exe
  C:\Windows\System\VOjsuev.exe
  2⤵
  PID:1940
- C:\Windows\System\HUJWpPy.exe
  C:\Windows\System\HUJWpPy.exe
  2⤵
  PID:2512
- C:\Windows\System\onZCsDv.exe
  C:\Windows\System\onZCsDv.exe
  2⤵
  PID:3080
- C:\Windows\System\lVsXZRh.exe
  C:\Windows\System\lVsXZRh.exe
  2⤵
  PID:3096
- C:\Windows\System\zPwANjH.exe
  C:\Windows\System\zPwANjH.exe
  2⤵
  PID:3116
- C:\Windows\System\HIyczYw.exe
  C:\Windows\System\HIyczYw.exe
  2⤵
  PID:3156
- C:\Windows\System\RoRICEJ.exe
  C:\Windows\System\RoRICEJ.exe
  2⤵
  PID:3180
- C:\Windows\System\FohNKpP.exe
  C:\Windows\System\FohNKpP.exe
  2⤵
  PID:3196
- C:\Windows\System\hjBpbKI.exe
  C:\Windows\System\hjBpbKI.exe
  2⤵
  PID:3212
- C:\Windows\System\tjvTOmx.exe
  C:\Windows\System\tjvTOmx.exe
  2⤵
  PID:3232
- C:\Windows\System\FwBPOcA.exe
  C:\Windows\System\FwBPOcA.exe
  2⤵
  PID:3248
- C:\Windows\System\XQguvAd.exe
  C:\Windows\System\XQguvAd.exe
  2⤵
  PID:3264
- C:\Windows\System\HHHOcWl.exe
  C:\Windows\System\HHHOcWl.exe
  2⤵
  PID:3280
- C:\Windows\System\kEPhwXg.exe
  C:\Windows\System\kEPhwXg.exe
  2⤵
  PID:3296
- C:\Windows\System\tfXQSAv.exe
  C:\Windows\System\tfXQSAv.exe
  2⤵
  PID:3312
- C:\Windows\System\wHCqbhg.exe
  C:\Windows\System\wHCqbhg.exe
  2⤵
  PID:3332
- C:\Windows\System\MsGPJXL.exe
  C:\Windows\System\MsGPJXL.exe
  2⤵
  PID:3348
- C:\Windows\System\PCrXKzR.exe
  C:\Windows\System\PCrXKzR.exe
  2⤵
  PID:3364
- C:\Windows\System\qKZFjBM.exe
  C:\Windows\System\qKZFjBM.exe
  2⤵
  PID:3380
- C:\Windows\System\GCuQZkM.exe
  C:\Windows\System\GCuQZkM.exe
  2⤵
  PID:3420
- C:\Windows\System\OiaQvvq.exe
  C:\Windows\System\OiaQvvq.exe
  2⤵
  PID:3436
- C:\Windows\System\HWbAZNJ.exe
  C:\Windows\System\HWbAZNJ.exe
  2⤵
  PID:3452
- C:\Windows\System\dozquaM.exe
  C:\Windows\System\dozquaM.exe
  2⤵
  PID:3468
- C:\Windows\System\DdcRybQ.exe
  C:\Windows\System\DdcRybQ.exe
  2⤵
  PID:3484
- C:\Windows\System\INQtzWo.exe
  C:\Windows\System\INQtzWo.exe
  2⤵
  PID:3500
- C:\Windows\System\roTCDCz.exe
  C:\Windows\System\roTCDCz.exe
  2⤵
  PID:3516
- C:\Windows\System\YjwzpUf.exe
  C:\Windows\System\YjwzpUf.exe
  2⤵
  PID:3532
- C:\Windows\System\hYKQgLO.exe
  C:\Windows\System\hYKQgLO.exe
  2⤵
  PID:3548
- C:\Windows\System\JsBREFX.exe
  C:\Windows\System\JsBREFX.exe
  2⤵
  PID:3564
- C:\Windows\System\fIJBDhZ.exe
  C:\Windows\System\fIJBDhZ.exe
  2⤵
  PID:3580
- C:\Windows\System\rryCOLJ.exe
  C:\Windows\System\rryCOLJ.exe
  2⤵
  PID:3596
- C:\Windows\System\sQfFhom.exe
  C:\Windows\System\sQfFhom.exe
  2⤵
  PID:3612
- C:\Windows\System\UEWpfaH.exe
  C:\Windows\System\UEWpfaH.exe
  2⤵
  PID:3628
- C:\Windows\System\gtnUWJJ.exe
  C:\Windows\System\gtnUWJJ.exe
  2⤵
  PID:3644
- C:\Windows\System\ltjkBKP.exe
  C:\Windows\System\ltjkBKP.exe
  2⤵
  PID:3660
- C:\Windows\System\ZubDEdp.exe
  C:\Windows\System\ZubDEdp.exe
  2⤵
  PID:3676
- C:\Windows\System\mevWKux.exe
  C:\Windows\System\mevWKux.exe
  2⤵
  PID:3692
- C:\Windows\System\mZALMvM.exe
  C:\Windows\System\mZALMvM.exe
  2⤵
  PID:3708
- C:\Windows\System\nHUswmT.exe
  C:\Windows\System\nHUswmT.exe
  2⤵
  PID:3724
- C:\Windows\System\prgbdyS.exe
  C:\Windows\System\prgbdyS.exe
  2⤵
  PID:3816
- C:\Windows\System\FDeTvUP.exe
  C:\Windows\System\FDeTvUP.exe
  2⤵
  PID:3836
- C:\Windows\System\LsxcJgv.exe
  C:\Windows\System\LsxcJgv.exe
  2⤵
  PID:3856
- C:\Windows\System\ZfZAtuW.exe
  C:\Windows\System\ZfZAtuW.exe
  2⤵
  PID:3876
- C:\Windows\System\ISFsCDn.exe
  C:\Windows\System\ISFsCDn.exe
  2⤵
  PID:3892
- C:\Windows\System\aaEAWQN.exe
  C:\Windows\System\aaEAWQN.exe
  2⤵
  PID:3912
- C:\Windows\System\xgIeOCL.exe
  C:\Windows\System\xgIeOCL.exe
  2⤵
  PID:3928
- C:\Windows\System\dquJnFY.exe
  C:\Windows\System\dquJnFY.exe
  2⤵
  PID:3944
- C:\Windows\System\KYMEJPj.exe
  C:\Windows\System\KYMEJPj.exe
  2⤵
  PID:3960
- C:\Windows\System\ClaHzHA.exe
  C:\Windows\System\ClaHzHA.exe
  2⤵
  PID:3976
- C:\Windows\System\SOrJDmi.exe
  C:\Windows\System\SOrJDmi.exe
  2⤵
  PID:3992
- C:\Windows\System\rTHyLll.exe
  C:\Windows\System\rTHyLll.exe
  2⤵
  PID:4008
- C:\Windows\System\jZgjcMY.exe
  C:\Windows\System\jZgjcMY.exe
  2⤵
  PID:4024
- C:\Windows\System\YbbrKDj.exe
  C:\Windows\System\YbbrKDj.exe
  2⤵
  PID:4040
- C:\Windows\System\eUqENYn.exe
  C:\Windows\System\eUqENYn.exe
  2⤵
  PID:4064
- C:\Windows\System\LWMgCSp.exe
  C:\Windows\System\LWMgCSp.exe
  2⤵
  PID:2352
- C:\Windows\System\yNSNMKW.exe
  C:\Windows\System\yNSNMKW.exe
  2⤵
  PID:2820
- C:\Windows\System\BrjGboG.exe
  C:\Windows\System\BrjGboG.exe
  2⤵
  PID:1968
- C:\Windows\System\HuLPwmU.exe
  C:\Windows\System\HuLPwmU.exe
  2⤵
  PID:2412
- C:\Windows\System\fcYtblb.exe
  C:\Windows\System\fcYtblb.exe
  2⤵
  PID:2256
- C:\Windows\System\CufyzLC.exe
  C:\Windows\System\CufyzLC.exe
  2⤵
  PID:1240
- C:\Windows\System\bqtVcJh.exe
  C:\Windows\System\bqtVcJh.exe
  2⤵
  PID:2116
- C:\Windows\System\CuuwPdO.exe
  C:\Windows\System\CuuwPdO.exe
  2⤵
  PID:3076
- C:\Windows\System\FCOlESc.exe
  C:\Windows\System\FCOlESc.exe
  2⤵
  PID:1976
- C:\Windows\System\fsSkYrs.exe
  C:\Windows\System\fsSkYrs.exe
  2⤵
  PID:1824
- C:\Windows\System\VzZrnOU.exe
  C:\Windows\System\VzZrnOU.exe
  2⤵
  PID:3164
- C:\Windows\System\BgtsZJq.exe
  C:\Windows\System\BgtsZJq.exe
  2⤵
  PID:1096
- C:\Windows\System\OZXFQHW.exe
  C:\Windows\System\OZXFQHW.exe
  2⤵
  PID:3208
- C:\Windows\System\xfenOQy.exe
  C:\Windows\System\xfenOQy.exe
  2⤵
  PID:2072
- C:\Windows\System\jtGsiyK.exe
  C:\Windows\System\jtGsiyK.exe
  2⤵
  PID:3528
- C:\Windows\System\WSZaQjF.exe
  C:\Windows\System\WSZaQjF.exe
  2⤵
  PID:3592
- C:\Windows\System\teYtqYJ.exe
  C:\Windows\System\teYtqYJ.exe
  2⤵
  PID:3656
- C:\Windows\System\fNZhNLY.exe
  C:\Windows\System\fNZhNLY.exe
  2⤵
  PID:3716
- C:\Windows\System\aDqCLnm.exe
  C:\Windows\System\aDqCLnm.exe
  2⤵
  PID:2136
- C:\Windows\System\XgQeRFI.exe
  C:\Windows\System\XgQeRFI.exe
  2⤵
  PID:1680
- C:\Windows\System\wfgqXQh.exe
  C:\Windows\System\wfgqXQh.exe
  2⤵
  PID:3900
- C:\Windows\System\sLLywwE.exe
  C:\Windows\System\sLLywwE.exe
  2⤵
  PID:3936
- C:\Windows\System\iehVPZW.exe
  C:\Windows\System\iehVPZW.exe
  2⤵
  PID:4000
- C:\Windows\System\nRZshKx.exe
  C:\Windows\System\nRZshKx.exe
  2⤵
  PID:4072
- C:\Windows\System\VaLTWzR.exe
  C:\Windows\System\VaLTWzR.exe
  2⤵
  PID:620
- C:\Windows\System\FvuZozy.exe
  C:\Windows\System\FvuZozy.exe
  2⤵
  PID:836
- C:\Windows\System\kofPsOC.exe
  C:\Windows\System\kofPsOC.exe
  2⤵
  PID:1032
- C:\Windows\System\zJAYqRM.exe
  C:\Windows\System\zJAYqRM.exe
  2⤵
  PID:2872
- C:\Windows\System\JLaYPRJ.exe
  C:\Windows\System\JLaYPRJ.exe
  2⤵
  PID:3036
- C:\Windows\System\eSuTYeS.exe
  C:\Windows\System\eSuTYeS.exe
  2⤵
  PID:2776
- C:\Windows\System\fGizPdu.exe
  C:\Windows\System\fGizPdu.exe
  2⤵
  PID:3432
- C:\Windows\System\bcFaOtE.exe
  C:\Windows\System\bcFaOtE.exe
  2⤵
  PID:2684
- C:\Windows\System\ZOsFpPM.exe
  C:\Windows\System\ZOsFpPM.exe
  2⤵
  PID:3496
- C:\Windows\System\OOIkJEr.exe
  C:\Windows\System\OOIkJEr.exe
  2⤵
  PID:1936
- C:\Windows\System\ETLRVpD.exe
  C:\Windows\System\ETLRVpD.exe
  2⤵
  PID:3652
- C:\Windows\System\ApRaXwJ.exe
  C:\Windows\System\ApRaXwJ.exe
  2⤵
  PID:1196
- C:\Windows\System\szGaesG.exe
  C:\Windows\System\szGaesG.exe
  2⤵
  PID:1584
- C:\Windows\System\RxgWeAY.exe
  C:\Windows\System\RxgWeAY.exe
  2⤵
  PID:2528
- C:\Windows\System\MMaaCAk.exe
  C:\Windows\System\MMaaCAk.exe
  2⤵
  PID:1520
- C:\Windows\System\ACIuNrm.exe
  C:\Windows\System\ACIuNrm.exe
  2⤵
  PID:1632
- C:\Windows\System\wcNAZoB.exe
  C:\Windows\System\wcNAZoB.exe
  2⤵
  PID:936
- C:\Windows\System\tCyqZAq.exe
  C:\Windows\System\tCyqZAq.exe
  2⤵
  PID:2580
- C:\Windows\System\bVfHvOQ.exe
  C:\Windows\System\bVfHvOQ.exe
  2⤵
  PID:2988
- C:\Windows\System\HlCLIsV.exe
  C:\Windows\System\HlCLIsV.exe
  2⤵
  PID:4016
- C:\Windows\System\yrlVZrW.exe
  C:\Windows\System\yrlVZrW.exe
  2⤵
  PID:4112
- C:\Windows\System\CPnjTQt.exe
  C:\Windows\System\CPnjTQt.exe
  2⤵
  PID:4128
- C:\Windows\System\JWJXzoN.exe
  C:\Windows\System\JWJXzoN.exe
  2⤵
  PID:4144
- C:\Windows\System\eJkxzhH.exe
  C:\Windows\System\eJkxzhH.exe
  2⤵
  PID:4160
- C:\Windows\System\hQJKXWS.exe
  C:\Windows\System\hQJKXWS.exe
  2⤵
  PID:4176
- C:\Windows\System\oPiDHfG.exe
  C:\Windows\System\oPiDHfG.exe
  2⤵
  PID:4192
- C:\Windows\System\nhFtJcn.exe
  C:\Windows\System\nhFtJcn.exe
  2⤵
  PID:4208
- C:\Windows\System\oCGrJse.exe
  C:\Windows\System\oCGrJse.exe
  2⤵
  PID:4228
- C:\Windows\System\BhtwDxy.exe
  C:\Windows\System\BhtwDxy.exe
  2⤵
  PID:4244
- C:\Windows\System\zqeXLHO.exe
  C:\Windows\System\zqeXLHO.exe
  2⤵
  PID:4316
- C:\Windows\System\XshAwXI.exe
  C:\Windows\System\XshAwXI.exe
  2⤵
  PID:4332
- C:\Windows\System\iRqjHfF.exe
  C:\Windows\System\iRqjHfF.exe
  2⤵
  PID:4356
- C:\Windows\System\ZqODTTz.exe
  C:\Windows\System\ZqODTTz.exe
  2⤵
  PID:4388
- C:\Windows\System\WtYKrzn.exe
  C:\Windows\System\WtYKrzn.exe
  2⤵
  PID:4436
- C:\Windows\System\iJtuKsj.exe
  C:\Windows\System\iJtuKsj.exe
  2⤵
  PID:4472
- C:\Windows\System\nshsOEk.exe
  C:\Windows\System\nshsOEk.exe
  2⤵
  PID:4512
- C:\Windows\System\ZcDUiWa.exe
  C:\Windows\System\ZcDUiWa.exe
  2⤵
  PID:4560
- C:\Windows\System\PgxbQqf.exe
  C:\Windows\System\PgxbQqf.exe
  2⤵
  PID:4576
- C:\Windows\System\FAAubrg.exe
  C:\Windows\System\FAAubrg.exe
  2⤵
  PID:4592
- C:\Windows\System\bYxzXbP.exe
  C:\Windows\System\bYxzXbP.exe
  2⤵
  PID:4608
- C:\Windows\System\szDcTbZ.exe
  C:\Windows\System\szDcTbZ.exe
  2⤵
  PID:4624
- C:\Windows\System\nUgCufd.exe
  C:\Windows\System\nUgCufd.exe
  2⤵
  PID:4640
- C:\Windows\System\pPPLjfq.exe
  C:\Windows\System\pPPLjfq.exe
  2⤵
  PID:4656
- C:\Windows\System\wAKvMnH.exe
  C:\Windows\System\wAKvMnH.exe
  2⤵
  PID:4676
- C:\Windows\System\sCbeVMc.exe
  C:\Windows\System\sCbeVMc.exe
  2⤵
  PID:4704
- C:\Windows\System\MHNjhZU.exe
  C:\Windows\System\MHNjhZU.exe
  2⤵
  PID:4732
- C:\Windows\System\AlfMMYF.exe
  C:\Windows\System\AlfMMYF.exe
  2⤵
  PID:4756
- C:\Windows\System\KIEYwLS.exe
  C:\Windows\System\KIEYwLS.exe
  2⤵
  PID:4784
- C:\Windows\System\IYsjbdA.exe
  C:\Windows\System\IYsjbdA.exe
  2⤵
  PID:4808
- C:\Windows\System\YgxOliw.exe
  C:\Windows\System\YgxOliw.exe
  2⤵
  PID:4832
- C:\Windows\System\HsVcPga.exe
  C:\Windows\System\HsVcPga.exe
  2⤵
  PID:4852
- C:\Windows\System\OXhJOJB.exe
  C:\Windows\System\OXhJOJB.exe
  2⤵
  PID:4868
- C:\Windows\System\qfYpwGG.exe
  C:\Windows\System\qfYpwGG.exe
  2⤵
  PID:4884
- C:\Windows\System\LSmQWHg.exe
  C:\Windows\System\LSmQWHg.exe
  2⤵
  PID:4952
- C:\Windows\System\KVMRMta.exe
  C:\Windows\System\KVMRMta.exe
  2⤵
  PID:4968
- C:\Windows\System\CcOoUQy.exe
  C:\Windows\System\CcOoUQy.exe
  2⤵
  PID:4988
- C:\Windows\System\YujdMxS.exe
  C:\Windows\System\YujdMxS.exe
  2⤵
  PID:5004
- C:\Windows\System\QxBXlcn.exe
  C:\Windows\System\QxBXlcn.exe
  2⤵
  PID:5020
- C:\Windows\System\MjOZmKY.exe
  C:\Windows\System\MjOZmKY.exe
  2⤵
  PID:5036
- C:\Windows\System\EMFdZHw.exe
  C:\Windows\System\EMFdZHw.exe
  2⤵
  PID:5052
- C:\Windows\System\xqgOSWf.exe
  C:\Windows\System\xqgOSWf.exe
  2⤵
  PID:5068
- C:\Windows\System\abLjMFP.exe
  C:\Windows\System\abLjMFP.exe
  2⤵
  PID:5084
- C:\Windows\System\dkbTMoE.exe
  C:\Windows\System\dkbTMoE.exe
  2⤵
  PID:5100
- C:\Windows\System\zaikFxy.exe
  C:\Windows\System\zaikFxy.exe
  2⤵
  PID:5116
- C:\Windows\System\gTWVKLx.exe
  C:\Windows\System\gTWVKLx.exe
  2⤵
  PID:292
- C:\Windows\System\hKezTia.exe
  C:\Windows\System\hKezTia.exe
  2⤵
  PID:2968
- C:\Windows\System\KwVAfUc.exe
  C:\Windows\System\KwVAfUc.exe
  2⤵
  PID:1720
- C:\Windows\System\SuYlvPw.exe
  C:\Windows\System\SuYlvPw.exe
  2⤵
  PID:1756
- C:\Windows\System\BhpFxrC.exe
  C:\Windows\System\BhpFxrC.exe
  2⤵
  PID:1460
- C:\Windows\System\qPIEKnI.exe
  C:\Windows\System\qPIEKnI.exe
  2⤵
  PID:1992
- C:\Windows\System\qYvnxCs.exe
  C:\Windows\System\qYvnxCs.exe
  2⤵
  PID:3624
- C:\Windows\System\kCGGani.exe
  C:\Windows\System\kCGGani.exe
  2⤵
  PID:2604
- C:\Windows\System\ofxHtxb.exe
  C:\Windows\System\ofxHtxb.exe
  2⤵
  PID:4108
- C:\Windows\System\VkIWGxg.exe
  C:\Windows\System\VkIWGxg.exe
  2⤵
  PID:4172
- C:\Windows\System\thcQumh.exe
  C:\Windows\System\thcQumh.exe
  2⤵
  PID:4240
- C:\Windows\System\vMgWAzV.exe
  C:\Windows\System\vMgWAzV.exe
  2⤵
  PID:3148
- C:\Windows\System\OyyAFiZ.exe
  C:\Windows\System\OyyAFiZ.exe
  2⤵
  PID:3444
- C:\Windows\System\NyNuXHC.exe
  C:\Windows\System\NyNuXHC.exe
  2⤵
  PID:756
- C:\Windows\System\fOeulID.exe
  C:\Windows\System\fOeulID.exe
  2⤵
  PID:3844
- C:\Windows\System\rptlOni.exe
  C:\Windows\System\rptlOni.exe
  2⤵
  PID:2268
- C:\Windows\System\XLgpVqi.exe
  C:\Windows\System\XLgpVqi.exe
  2⤵
  PID:4020
- C:\Windows\System\eaqbjtg.exe
  C:\Windows\System\eaqbjtg.exe
  2⤵
  PID:1732
- C:\Windows\System\rbiXuGJ.exe
  C:\Windows\System\rbiXuGJ.exe
  2⤵
  PID:3092
- C:\Windows\System\yTgyUka.exe
  C:\Windows\System\yTgyUka.exe
  2⤵
  PID:3152
- C:\Windows\System\BhwwEXO.exe
  C:\Windows\System\BhwwEXO.exe
  2⤵
  PID:3256
- C:\Windows\System\sEwOYNE.exe
  C:\Windows\System\sEwOYNE.exe
  2⤵
  PID:3328
- C:\Windows\System\sMzziGC.exe
  C:\Windows\System\sMzziGC.exe
  2⤵
  PID:3392
- C:\Windows\System\CKKQpey.exe
  C:\Windows\System\CKKQpey.exe
  2⤵
  PID:3512
- C:\Windows\System\JUuhHDf.exe
  C:\Windows\System\JUuhHDf.exe
  2⤵
  PID:3604
- C:\Windows\System\eTssuqE.exe
  C:\Windows\System\eTssuqE.exe
  2⤵
  PID:3672
- C:\Windows\System\pTJJSvz.exe
  C:\Windows\System\pTJJSvz.exe
  2⤵
  PID:3736
- C:\Windows\System\NvUiJRI.exe
  C:\Windows\System\NvUiJRI.exe
  2⤵
  PID:2308
- C:\Windows\System\CrmYIGV.exe
  C:\Windows\System\CrmYIGV.exe
  2⤵
  PID:3784
- C:\Windows\System\ojibHix.exe
  C:\Windows\System\ojibHix.exe
  2⤵
  PID:3340
- C:\Windows\System\jxNQfmq.exe
  C:\Windows\System\jxNQfmq.exe
  2⤵
  PID:3832
- C:\Windows\System\tjiGbvG.exe
  C:\Windows\System\tjiGbvG.exe
  2⤵
  PID:4032
- C:\Windows\System\TRNNMRk.exe
  C:\Windows\System\TRNNMRk.exe
  2⤵
  PID:3288
- C:\Windows\System\OlQgaQA.exe
  C:\Windows\System\OlQgaQA.exe
  2⤵
  PID:3204
- C:\Windows\System\ylzatzh.exe
  C:\Windows\System\ylzatzh.exe
  2⤵
  PID:2056
- C:\Windows\System\YNAjSjQ.exe
  C:\Windows\System\YNAjSjQ.exe
  2⤵
  PID:2976
- C:\Windows\System\fKGTwxz.exe
  C:\Windows\System\fKGTwxz.exe
  2⤵
  PID:2460
- C:\Windows\System\kfYsMKb.exe
  C:\Windows\System\kfYsMKb.exe
  2⤵
  PID:4124
- C:\Windows\System\sgYdNLw.exe
  C:\Windows\System\sgYdNLw.exe
  2⤵
  PID:4188
- C:\Windows\System\QdjYpAY.exe
  C:\Windows\System\QdjYpAY.exe
  2⤵
  PID:4252
- C:\Windows\System\NDGJuZS.exe
  C:\Windows\System\NDGJuZS.exe
  2⤵
  PID:1132
- C:\Windows\System\zOqGpJR.exe
  C:\Windows\System\zOqGpJR.exe
  2⤵
  PID:1280
- C:\Windows\System\HwNOewK.exe
  C:\Windows\System\HwNOewK.exe
  2⤵
  PID:1292
- C:\Windows\System\HVgamAv.exe
  C:\Windows\System\HVgamAv.exe
  2⤵
  PID:4444
- C:\Windows\System\XwFgKmZ.exe
  C:\Windows\System\XwFgKmZ.exe
  2⤵
  PID:4460
- C:\Windows\System\DlNSVWG.exe
  C:\Windows\System\DlNSVWG.exe
  2⤵
  PID:4524
- C:\Windows\System\QvKCSRw.exe
  C:\Windows\System\QvKCSRw.exe
  2⤵
  PID:4544
- C:\Windows\System\nrQJRpn.exe
  C:\Windows\System\nrQJRpn.exe
  2⤵
  PID:4616
- C:\Windows\System\IsnoDaj.exe
  C:\Windows\System\IsnoDaj.exe
  2⤵
  PID:4684
- C:\Windows\System\EJIWkZs.exe
  C:\Windows\System\EJIWkZs.exe
  2⤵
  PID:4744
- C:\Windows\System\NuXjKcD.exe
  C:\Windows\System\NuXjKcD.exe
  2⤵
  PID:4796
- C:\Windows\System\TsiehJB.exe
  C:\Windows\System\TsiehJB.exe
  2⤵
  PID:4844
- C:\Windows\System\juTejrq.exe
  C:\Windows\System\juTejrq.exe
  2⤵
  PID:4880
- C:\Windows\System\BplcpUy.exe
  C:\Windows\System\BplcpUy.exe
  2⤵
  PID:5000
- C:\Windows\System\YBtFXdZ.exe
  C:\Windows\System\YBtFXdZ.exe
  2⤵
  PID:5064
- C:\Windows\System\TnJBAUX.exe
  C:\Windows\System\TnJBAUX.exe
  2⤵
  PID:1776
- C:\Windows\System\CVOtviL.exe
  C:\Windows\System\CVOtviL.exe
  2⤵
  PID:2080
- C:\Windows\System\IMNWLDQ.exe
  C:\Windows\System\IMNWLDQ.exe
  2⤵
  PID:2720
- C:\Windows\System\jXbJdnf.exe
  C:\Windows\System\jXbJdnf.exe
  2⤵
  PID:1860
- C:\Windows\System\IymbOPy.exe
  C:\Windows\System\IymbOPy.exe
  2⤵
  PID:3848
- C:\Windows\System\bWLLxfQ.exe
  C:\Windows\System\bWLLxfQ.exe
  2⤵
  PID:3988
- C:\Windows\System\dwSKXmu.exe
  C:\Windows\System\dwSKXmu.exe
  2⤵
  PID:3140
- C:\Windows\System\iQSxSnp.exe
  C:\Windows\System\iQSxSnp.exe
  2⤵
  PID:5016
- C:\Windows\System\RwdhAqQ.exe
  C:\Windows\System\RwdhAqQ.exe
  2⤵
  PID:5080
- C:\Windows\System\eTSzgEj.exe
  C:\Windows\System\eTSzgEj.exe
  2⤵
  PID:2304
- C:\Windows\System\UbqEOhF.exe
  C:\Windows\System\UbqEOhF.exe
  2⤵
  PID:3124
- C:\Windows\System\hlmccQX.exe
  C:\Windows\System\hlmccQX.exe
  2⤵
  PID:3172
- C:\Windows\System\AGpWuPH.exe
  C:\Windows\System\AGpWuPH.exe
  2⤵
  PID:3308
- C:\Windows\System\mzaLXcL.exe
  C:\Windows\System\mzaLXcL.exe
  2⤵
  PID:3376
- C:\Windows\System\ctQTbCG.exe
  C:\Windows\System\ctQTbCG.exe
  2⤵
  PID:4340
- C:\Windows\System\JBseHZY.exe
  C:\Windows\System\JBseHZY.exe
  2⤵
  PID:4400
- C:\Windows\System\rBlcNnl.exe
  C:\Windows\System\rBlcNnl.exe
  2⤵
  PID:4412
- C:\Windows\System\iiyBWvs.exe
  C:\Windows\System\iiyBWvs.exe
  2⤵
  PID:4432
- C:\Windows\System\fOshXmk.exe
  C:\Windows\System\fOshXmk.exe
  2⤵
  PID:4500
- C:\Windows\System\nwbXjzj.exe
  C:\Windows\System\nwbXjzj.exe
  2⤵
  PID:4604
- C:\Windows\System\mSOpveb.exe
  C:\Windows\System\mSOpveb.exe
  2⤵
  PID:4668
- C:\Windows\System\ZnwvEYs.exe
  C:\Windows\System\ZnwvEYs.exe
  2⤵
  PID:4720
- C:\Windows\System\DYksLtc.exe
  C:\Windows\System\DYksLtc.exe
  2⤵
  PID:4768
- C:\Windows\System\kTzWNlY.exe
  C:\Windows\System\kTzWNlY.exe
  2⤵
  PID:4820
- C:\Windows\System\XIJdthz.exe
  C:\Windows\System\XIJdthz.exe
  2⤵
  PID:4892
- C:\Windows\System\uAjKeJG.exe
  C:\Windows\System\uAjKeJG.exe
  2⤵
  PID:4916
- C:\Windows\System\ChhLaOw.exe
  C:\Windows\System\ChhLaOw.exe
  2⤵
  PID:4940
- C:\Windows\System\UxnlpMj.exe
  C:\Windows\System\UxnlpMj.exe
  2⤵
  PID:4976
- C:\Windows\System\gfTohYd.exe
  C:\Windows\System\gfTohYd.exe
  2⤵
  PID:1644
- C:\Windows\System\kFisrVa.exe
  C:\Windows\System\kFisrVa.exe
  2⤵
  PID:2592
- C:\Windows\System\Phgqpmw.exe
  C:\Windows\System\Phgqpmw.exe
  2⤵
  PID:3220
- C:\Windows\System\SoIPNkm.exe
  C:\Windows\System\SoIPNkm.exe
  2⤵
  PID:3192
- C:\Windows\System\UjvhKRN.exe
  C:\Windows\System\UjvhKRN.exe
  2⤵
  PID:3292
- C:\Windows\System\dWTLcpm.exe
  C:\Windows\System\dWTLcpm.exe
  2⤵
  PID:3732
- C:\Windows\System\sRmAJgk.exe
  C:\Windows\System\sRmAJgk.exe
  2⤵
  PID:3404
- C:\Windows\System\pCUSioL.exe
  C:\Windows\System\pCUSioL.exe
  2⤵
  PID:3476
- C:\Windows\System\MXpIbTP.exe
  C:\Windows\System\MXpIbTP.exe
  2⤵
  PID:3636
- C:\Windows\System\oVyHJuc.exe
  C:\Windows\System\oVyHJuc.exe
  2⤵
  PID:3588
- C:\Windows\System\uYvlOQs.exe
  C:\Windows\System\uYvlOQs.exe
  2⤵
  PID:3772
- C:\Windows\System\mVCsIKu.exe
  C:\Windows\System\mVCsIKu.exe
  2⤵
  PID:4092
- C:\Windows\System\VhoapNQ.exe
  C:\Windows\System\VhoapNQ.exe
  2⤵
  PID:4156
- C:\Windows\System\UaNHGrn.exe
  C:\Windows\System\UaNHGrn.exe
  2⤵
  PID:3684
- C:\Windows\System\gEohfKk.exe
  C:\Windows\System\gEohfKk.exe
  2⤵
  PID:3804
- C:\Windows\System\rrXIOEs.exe
  C:\Windows\System\rrXIOEs.exe
  2⤵
  PID:3796
- C:\Windows\System\UIWiDCi.exe
  C:\Windows\System\UIWiDCi.exe
  2⤵
  PID:1496
- C:\Windows\System\rYmkFzM.exe
  C:\Windows\System\rYmkFzM.exe
  2⤵
  PID:4224
- C:\Windows\System\mzhkClz.exe
  C:\Windows\System\mzhkClz.exe
  2⤵
  PID:3176
- C:\Windows\System\iKZMswh.exe
  C:\Windows\System\iKZMswh.exe
  2⤵
  PID:4448
- C:\Windows\System\jPjvOsJ.exe
  C:\Windows\System\jPjvOsJ.exe
  2⤵
  PID:4536
- C:\Windows\System\ASRJqcK.exe
  C:\Windows\System\ASRJqcK.exe
  2⤵
  PID:2216
- C:\Windows\System\rDASdiw.exe
  C:\Windows\System\rDASdiw.exe
  2⤵
  PID:4652
- C:\Windows\System\GBSbkIf.exe
  C:\Windows\System\GBSbkIf.exe
  2⤵
  PID:4324
- C:\Windows\System\hcySBKm.exe
  C:\Windows\System\hcySBKm.exe
  2⤵
  PID:4380
- C:\Windows\System\erIkjPq.exe
  C:\Windows\System\erIkjPq.exe
  2⤵
  PID:4552
- C:\Windows\System\DXziFpg.exe
  C:\Windows\System\DXziFpg.exe
  2⤵
  PID:644
- C:\Windows\System\DTYbNGg.exe
  C:\Windows\System\DTYbNGg.exe
  2⤵
  PID:532
- C:\Windows\System\mmbwMgb.exe
  C:\Windows\System\mmbwMgb.exe
  2⤵
  PID:4912
- C:\Windows\System\GvKgpDQ.exe
  C:\Windows\System\GvKgpDQ.exe
  2⤵
  PID:2744
- C:\Windows\System\XSsnDBl.exe
  C:\Windows\System\XSsnDBl.exe
  2⤵
  PID:4352
- C:\Windows\System\hkfsAQN.exe
  C:\Windows\System\hkfsAQN.exe
  2⤵
  PID:4568
- C:\Windows\System\GMvKQyr.exe
  C:\Windows\System\GMvKQyr.exe
  2⤵
  PID:4776
- C:\Windows\System\hCvFtLC.exe
  C:\Windows\System\hCvFtLC.exe
  2⤵
  PID:4780
- C:\Windows\System\xtVokjo.exe
  C:\Windows\System\xtVokjo.exe
  2⤵
  PID:4964
- C:\Windows\System\RqzZzWi.exe
  C:\Windows\System\RqzZzWi.exe
  2⤵
  PID:3524
- C:\Windows\System\hHrCuec.exe
  C:\Windows\System\hHrCuec.exe
  2⤵
  PID:4140
- C:\Windows\System\fqRtzAB.exe
  C:\Windows\System\fqRtzAB.exe
  2⤵
  PID:3128
- C:\Windows\System\PKZIRiv.exe
  C:\Windows\System\PKZIRiv.exe
  2⤵
  PID:4416
- C:\Windows\System\bIzvzkx.exe
  C:\Windows\System\bIzvzkx.exe
  2⤵
  PID:4496
- C:\Windows\System\bzUVAnb.exe
  C:\Windows\System\bzUVAnb.exe
  2⤵
  PID:4764
- C:\Windows\System\KToazuJ.exe
  C:\Windows\System\KToazuJ.exe
  2⤵
  PID:4908
- C:\Windows\System\adqzith.exe
  C:\Windows\System\adqzith.exe
  2⤵
  PID:4920
- C:\Windows\System\zTcaVXs.exe
  C:\Windows\System\zTcaVXs.exe
  2⤵
  PID:2092
- C:\Windows\System\jiexOZS.exe
  C:\Windows\System\jiexOZS.exe
  2⤵
  PID:4060
- C:\Windows\System\DZqlHJg.exe
  C:\Windows\System\DZqlHJg.exe
  2⤵
  PID:3388
- C:\Windows\System\CHvSfpu.exe
  C:\Windows\System\CHvSfpu.exe
  2⤵
  PID:4036
- C:\Windows\System\hipZlfR.exe
  C:\Windows\System\hipZlfR.exe
  2⤵
  PID:3788
- C:\Windows\System\uBRmBKw.exe
  C:\Windows\System\uBRmBKw.exe
  2⤵
  PID:4532
- C:\Windows\System\ZWNmjjY.exe
  C:\Windows\System\ZWNmjjY.exe
  2⤵
  PID:3756
- C:\Windows\System\LfifLdg.exe
  C:\Windows\System\LfifLdg.exe
  2⤵
  PID:4648
- C:\Windows\System\jQpZGAG.exe
  C:\Windows\System\jQpZGAG.exe
  2⤵
  PID:3508
- C:\Windows\System\ONyzACw.exe
  C:\Windows\System\ONyzACw.exe
  2⤵
  PID:3812
- C:\Windows\System\XwnngiW.exe
  C:\Windows\System\XwnngiW.exe
  2⤵
  PID:2884
- C:\Windows\System\bCknWFK.exe
  C:\Windows\System\bCknWFK.exe
  2⤵
  PID:3808
- C:\Windows\System\rHxtyWi.exe
  C:\Windows\System\rHxtyWi.exe
  2⤵
  PID:2552
- C:\Windows\System\sPdoKKb.exe
  C:\Windows\System\sPdoKKb.exe
  2⤵
  PID:1724
- C:\Windows\System\JQkrigY.exe
  C:\Windows\System\JQkrigY.exe
  2⤵
  PID:4876
- C:\Windows\System\JmFzaiS.exe
  C:\Windows\System\JmFzaiS.exe
  2⤵
  PID:5060
- C:\Windows\System\ZHvxenD.exe
  C:\Windows\System\ZHvxenD.exe
  2⤵
  PID:2372
- C:\Windows\System\YnenJSQ.exe
  C:\Windows\System\YnenJSQ.exe
  2⤵
  PID:4396
- C:\Windows\System\YAODgks.exe
  C:\Windows\System\YAODgks.exe
  2⤵
  PID:4572
- C:\Windows\System\VLQkiRG.exe
  C:\Windows\System\VLQkiRG.exe
  2⤵
  PID:4716
- C:\Windows\System\zLrYekh.exe
  C:\Windows\System\zLrYekh.exe
  2⤵
  PID:4428
- C:\Windows\System\hXFHiZz.exe
  C:\Windows\System\hXFHiZz.exe
  2⤵
  PID:3412
- C:\Windows\System\lhKqYuT.exe
  C:\Windows\System\lhKqYuT.exe
  2⤵
  PID:4728
- C:\Windows\System\TgFnlMo.exe
  C:\Windows\System\TgFnlMo.exe
  2⤵
  PID:3416
- C:\Windows\System\uLynikA.exe
  C:\Windows\System\uLynikA.exe
  2⤵
  PID:1640
- C:\Windows\System\bdpQuPg.exe
  C:\Windows\System\bdpQuPg.exe
  2⤵
  PID:2064
- C:\Windows\System\oughPHT.exe
  C:\Windows\System\oughPHT.exe
  2⤵
  PID:4848
- C:\Windows\System\MSsYOAC.exe
  C:\Windows\System\MSsYOAC.exe
  2⤵
  PID:4520
- C:\Windows\System\duRVSXE.exe
  C:\Windows\System\duRVSXE.exe
  2⤵
  PID:4600
- C:\Windows\System\zRfiiZx.exe
  C:\Windows\System\zRfiiZx.exe
  2⤵
  PID:2236
- C:\Windows\System\UtobFRk.exe
  C:\Windows\System\UtobFRk.exe
  2⤵
  PID:3572
- C:\Windows\System\JxDRscn.exe
  C:\Windows\System\JxDRscn.exe
  2⤵
  PID:3324
- C:\Windows\System\tnmrWbw.exe
  C:\Windows\System\tnmrWbw.exe
  2⤵
  PID:4752
- C:\Windows\System\PEARLym.exe
  C:\Windows\System\PEARLym.exe
  2⤵
  PID:4408
- C:\Windows\System\hSVUBvw.exe
  C:\Windows\System\hSVUBvw.exe
  2⤵
  PID:4488
- C:\Windows\System\qRJCQcu.exe
  C:\Windows\System\qRJCQcu.exe
  2⤵
  PID:4376
- C:\Windows\System\GUEMOZf.exe
  C:\Windows\System\GUEMOZf.exe
  2⤵
  PID:4052
- C:\Windows\System\LSJgNim.exe
  C:\Windows\System\LSJgNim.exe
  2⤵
  PID:3828
- C:\Windows\System\MjgWFkl.exe
  C:\Windows\System\MjgWFkl.exe
  2⤵
  PID:1948
- C:\Windows\System\mjYRoOn.exe
  C:\Windows\System\mjYRoOn.exe
  2⤵
  PID:4584
- C:\Windows\System\gXuzQBc.exe
  C:\Windows\System\gXuzQBc.exe
  2⤵
  PID:3544
- C:\Windows\System\QBVDWOm.exe
  C:\Windows\System\QBVDWOm.exe
  2⤵
  PID:5124
- C:\Windows\System\PUosmjc.exe
  C:\Windows\System\PUosmjc.exe
  2⤵
  PID:5140
- C:\Windows\System\ZnCauNp.exe
  C:\Windows\System\ZnCauNp.exe
  2⤵
  PID:5172
- C:\Windows\System\yKUlByL.exe
  C:\Windows\System\yKUlByL.exe
  2⤵
  PID:5272
- C:\Windows\System\LWVwhII.exe
  C:\Windows\System\LWVwhII.exe
  2⤵
  PID:5288
- C:\Windows\System\jGNRSCk.exe
  C:\Windows\System\jGNRSCk.exe
  2⤵
  PID:5308
- C:\Windows\System\VaLgIPi.exe
  C:\Windows\System\VaLgIPi.exe
  2⤵
  PID:5328
- C:\Windows\System\xabUlgm.exe
  C:\Windows\System\xabUlgm.exe
  2⤵
  PID:5344
- C:\Windows\System\FmDpXvk.exe
  C:\Windows\System\FmDpXvk.exe
  2⤵
  PID:5360
- C:\Windows\System\vIBJAsu.exe
  C:\Windows\System\vIBJAsu.exe
  2⤵
  PID:5376
- C:\Windows\System\itjCcVs.exe
  C:\Windows\System\itjCcVs.exe
  2⤵
  PID:5392
- C:\Windows\System\GTeCNOf.exe
  C:\Windows\System\GTeCNOf.exe
  2⤵
  PID:5408
- C:\Windows\System\lLvqgbo.exe
  C:\Windows\System\lLvqgbo.exe
  2⤵
  PID:5424
- C:\Windows\System\EKCqWFv.exe
  C:\Windows\System\EKCqWFv.exe
  2⤵
  PID:5464
- C:\Windows\System\xmIzlRS.exe
  C:\Windows\System\xmIzlRS.exe
  2⤵
  PID:5484
- C:\Windows\System\VHlERUV.exe
  C:\Windows\System\VHlERUV.exe
  2⤵
  PID:5504
- C:\Windows\System\pnDycTJ.exe
  C:\Windows\System\pnDycTJ.exe
  2⤵
  PID:5524
- C:\Windows\System\cqEBkyJ.exe
  C:\Windows\System\cqEBkyJ.exe
  2⤵
  PID:5540
- C:\Windows\System\dChBpWx.exe
  C:\Windows\System\dChBpWx.exe
  2⤵
  PID:5556
- C:\Windows\System\ICZjrjQ.exe
  C:\Windows\System\ICZjrjQ.exe
  2⤵
  PID:5576
- C:\Windows\System\FTRvvbx.exe
  C:\Windows\System\FTRvvbx.exe
  2⤵
  PID:5592
- C:\Windows\System\ORDbRsP.exe
  C:\Windows\System\ORDbRsP.exe
  2⤵
  PID:5608
- C:\Windows\System\bjVJvLt.exe
  C:\Windows\System\bjVJvLt.exe
  2⤵
  PID:5624
- C:\Windows\System\nALHFoB.exe
  C:\Windows\System\nALHFoB.exe
  2⤵
  PID:5648
- C:\Windows\System\XhJqQEc.exe
  C:\Windows\System\XhJqQEc.exe
  2⤵
  PID:5664
- C:\Windows\System\DnyGPWm.exe
  C:\Windows\System\DnyGPWm.exe
  2⤵
  PID:5684
- C:\Windows\System\sGHKVGQ.exe
  C:\Windows\System\sGHKVGQ.exe
  2⤵
  PID:5700
- C:\Windows\System\GpWzxdo.exe
  C:\Windows\System\GpWzxdo.exe
  2⤵
  PID:5720
- C:\Windows\System\WOKqejL.exe
  C:\Windows\System\WOKqejL.exe
  2⤵
  PID:5736
- C:\Windows\System\MJbfDyF.exe
  C:\Windows\System\MJbfDyF.exe
  2⤵
  PID:5752
- C:\Windows\System\HZClehC.exe
  C:\Windows\System\HZClehC.exe
  2⤵
  PID:5768
- C:\Windows\System\cuaTvfP.exe
  C:\Windows\System\cuaTvfP.exe
  2⤵
  PID:5788
- C:\Windows\System\fGdoZwv.exe
  C:\Windows\System\fGdoZwv.exe
  2⤵
  PID:5808
- C:\Windows\System\PBxUkCj.exe
  C:\Windows\System\PBxUkCj.exe
  2⤵
  PID:5824
- C:\Windows\System\PxoASYt.exe
  C:\Windows\System\PxoASYt.exe
  2⤵
  PID:5844
- C:\Windows\System\PvcclcE.exe
  C:\Windows\System\PvcclcE.exe
  2⤵
  PID:5864
- C:\Windows\System\VerHDPN.exe
  C:\Windows\System\VerHDPN.exe
  2⤵
  PID:5884
- C:\Windows\System\fmbNXuL.exe
  C:\Windows\System\fmbNXuL.exe
  2⤵
  PID:5908
- C:\Windows\System\tNtrVVE.exe
  C:\Windows\System\tNtrVVE.exe
  2⤵
  PID:5924
- C:\Windows\System\oJEgddp.exe
  C:\Windows\System\oJEgddp.exe
  2⤵
  PID:5944
- C:\Windows\System\GAGGPCZ.exe
  C:\Windows\System\GAGGPCZ.exe
  2⤵
  PID:5960
- C:\Windows\System\MDpjrUY.exe
  C:\Windows\System\MDpjrUY.exe
  2⤵
  PID:5976
- C:\Windows\System\rzkfMfm.exe
  C:\Windows\System\rzkfMfm.exe
  2⤵
  PID:5992
- C:\Windows\System\CjMhbcy.exe
  C:\Windows\System\CjMhbcy.exe
  2⤵
  PID:6008
- C:\Windows\System\NNcplfj.exe
  C:\Windows\System\NNcplfj.exe
  2⤵
  PID:6024
- C:\Windows\System\atQypOX.exe
  C:\Windows\System\atQypOX.exe
  2⤵
  PID:6040
- C:\Windows\System\MLlqEOV.exe
  C:\Windows\System\MLlqEOV.exe
  2⤵
  PID:6056
- C:\Windows\System\iNwuovw.exe
  C:\Windows\System\iNwuovw.exe
  2⤵
  PID:6072
- C:\Windows\System\jgGMNrH.exe
  C:\Windows\System\jgGMNrH.exe
  2⤵
  PID:6088
- C:\Windows\System\CeGSSpv.exe
  C:\Windows\System\CeGSSpv.exe
  2⤵
  PID:6104
- C:\Windows\System\QVTEZIT.exe
  C:\Windows\System\QVTEZIT.exe
  2⤵
  PID:6120
- C:\Windows\System\TGUJYCY.exe
  C:\Windows\System\TGUJYCY.exe
  2⤵
  PID:6136
- C:\Windows\System\FiAwdgZ.exe
  C:\Windows\System\FiAwdgZ.exe
  2⤵
  PID:5132
- C:\Windows\System\sMYMrmb.exe
  C:\Windows\System\sMYMrmb.exe
  2⤵
  PID:5212
- C:\Windows\System\xrhalfT.exe
  C:\Windows\System\xrhalfT.exe
  2⤵
  PID:5224
- C:\Windows\System\OEPygQY.exe
  C:\Windows\System\OEPygQY.exe
  2⤵
  PID:5244
- C:\Windows\System\ZXWNsqo.exe
  C:\Windows\System\ZXWNsqo.exe
  2⤵
  PID:5208
- C:\Windows\System\BkBFKTk.exe
  C:\Windows\System\BkBFKTk.exe
  2⤵
  PID:5300
- C:\Windows\System\TdNrrzW.exe
  C:\Windows\System\TdNrrzW.exe
  2⤵
  PID:5296
- C:\Windows\System\JTNJCAh.exe
  C:\Windows\System\JTNJCAh.exe
  2⤵
  PID:5164
- C:\Windows\System\VGQKcbs.exe
  C:\Windows\System\VGQKcbs.exe
  2⤵
  PID:5448
- C:\Windows\System\KrdSZwf.exe
  C:\Windows\System\KrdSZwf.exe
  2⤵
  PID:5452
- C:\Windows\System\mMJfFSD.exe
  C:\Windows\System\mMJfFSD.exe
  2⤵
  PID:5500
- C:\Windows\System\RHnxxze.exe
  C:\Windows\System\RHnxxze.exe
  2⤵
  PID:2024
- C:\Windows\System\dQyNZID.exe
  C:\Windows\System\dQyNZID.exe
  2⤵
  PID:5168
- C:\Windows\System\hsAXkLE.exe
  C:\Windows\System\hsAXkLE.exe
  2⤵
  PID:5280
- C:\Windows\System\fZNxJks.exe
  C:\Windows\System\fZNxJks.exe
  2⤵
  PID:5352
- C:\Windows\System\XlBllTo.exe
  C:\Windows\System\XlBllTo.exe
  2⤵
  PID:5416
- C:\Windows\System\THwzCTH.exe
  C:\Windows\System\THwzCTH.exe
  2⤵
  PID:5604
- C:\Windows\System\lOREooh.exe
  C:\Windows\System\lOREooh.exe
  2⤵
  PID:5632
- C:\Windows\System\vNyoycl.exe
  C:\Windows\System\vNyoycl.exe
  2⤵
  PID:5512
- C:\Windows\System\PUeFiGj.exe
  C:\Windows\System\PUeFiGj.exe
  2⤵
  PID:5548
- C:\Windows\System\efeLdwZ.exe
  C:\Windows\System\efeLdwZ.exe
  2⤵
  PID:5644
- C:\Windows\System\Uspljqz.exe
  C:\Windows\System\Uspljqz.exe
  2⤵
  PID:5748
- C:\Windows\System\HCzmeCJ.exe
  C:\Windows\System\HCzmeCJ.exe
  2⤵
  PID:5616
- C:\Windows\System\MrCOReE.exe
  C:\Windows\System\MrCOReE.exe
  2⤵
  PID:5660
- C:\Windows\System\boUKKFr.exe
  C:\Windows\System\boUKKFr.exe
  2⤵
  PID:5760
- C:\Windows\System\ULftOqT.exe
  C:\Windows\System\ULftOqT.exe
  2⤵
  PID:5776
- C:\Windows\System\brhLGqU.exe
  C:\Windows\System\brhLGqU.exe
  2⤵
  PID:5852
- C:\Windows\System\VmcjTmO.exe
  C:\Windows\System\VmcjTmO.exe
  2⤵
  PID:5876
- C:\Windows\System\lsALNbC.exe
  C:\Windows\System\lsALNbC.exe
  2⤵
  PID:5920
- C:\Windows\System\vpMEyxg.exe
  C:\Windows\System\vpMEyxg.exe
  2⤵
  PID:5984
- C:\Windows\System\ucGbSGo.exe
  C:\Windows\System\ucGbSGo.exe
  2⤵
  PID:5892
- C:\Windows\System\OxFcXsK.exe
  C:\Windows\System\OxFcXsK.exe
  2⤵
  PID:5904
- C:\Windows\System\ntfAIRC.exe
  C:\Windows\System\ntfAIRC.exe
  2⤵
  PID:5968
- C:\Windows\System\LDciRFo.exe
  C:\Windows\System\LDciRFo.exe
  2⤵
  PID:6064
- C:\Windows\System\mGypUrE.exe
  C:\Windows\System\mGypUrE.exe
  2⤵
  PID:6048
- C:\Windows\System\OVGsfSg.exe
  C:\Windows\System\OVGsfSg.exe
  2⤵
  PID:6100
- C:\Windows\System\wlXdAIG.exe
  C:\Windows\System\wlXdAIG.exe
  2⤵
  PID:5180
- C:\Windows\System\yyXLgZu.exe
  C:\Windows\System\yyXLgZu.exe
  2⤵
  PID:5196
- C:\Windows\System\gbYvcHR.exe
  C:\Windows\System\gbYvcHR.exe
  2⤵
  PID:5228
- C:\Windows\System\cbdPMpL.exe
  C:\Windows\System\cbdPMpL.exe
  2⤵
  PID:5248
- C:\Windows\System\WqnOsEN.exe
  C:\Windows\System\WqnOsEN.exe
  2⤵
  PID:5160
- C:\Windows\System\odOeOOi.exe
  C:\Windows\System\odOeOOi.exe
  2⤵
  PID:5496
- C:\Windows\System\kZNoIFc.exe
  C:\Windows\System\kZNoIFc.exe
  2⤵
  PID:5156
- C:\Windows\System\RDHJdEB.exe
  C:\Windows\System\RDHJdEB.exe
  2⤵
  PID:5564
- C:\Windows\System\ZXXnmZv.exe
  C:\Windows\System\ZXXnmZv.exe
  2⤵
  PID:5388
- C:\Windows\System\HUGhMSu.exe
  C:\Windows\System\HUGhMSu.exe
  2⤵
  PID:5676
- C:\Windows\System\CCRNTzz.exe
  C:\Windows\System\CCRNTzz.exe
  2⤵
  PID:5716
- C:\Windows\System\xoqYycP.exe
  C:\Windows\System\xoqYycP.exe
  2⤵
  PID:5472
- C:\Windows\System\ZQmxwFx.exe
  C:\Windows\System\ZQmxwFx.exe
  2⤵
  PID:5588
- C:\Windows\System\BkzhTMH.exe
  C:\Windows\System\BkzhTMH.exe
  2⤵
  PID:5796
- C:\Windows\System\SBuOOHf.exe
  C:\Windows\System\SBuOOHf.exe
  2⤵
  PID:5880
- C:\Windows\System\buNnoPh.exe
  C:\Windows\System\buNnoPh.exe
  2⤵
  PID:5956
- C:\Windows\System\JsknAJa.exe
  C:\Windows\System\JsknAJa.exe
  2⤵
  PID:6036
- C:\Windows\System\UwkuYgC.exe
  C:\Windows\System\UwkuYgC.exe
  2⤵
  PID:5184
- C:\Windows\System\EGUPivx.exe
  C:\Windows\System\EGUPivx.exe
  2⤵
  PID:5252
- C:\Windows\System\LXwMrlM.exe
  C:\Windows\System\LXwMrlM.exe
  2⤵
  PID:5316
- C:\Windows\System\JxTGFdl.exe
  C:\Windows\System\JxTGFdl.exe
  2⤵
  PID:6096
- C:\Windows\System\tigfRVf.exe
  C:\Windows\System\tigfRVf.exe
  2⤵
  PID:5744
- C:\Windows\System\SmjHKCF.exe
  C:\Windows\System\SmjHKCF.exe
  2⤵
  PID:5336
- C:\Windows\System\laXBHAC.exe
  C:\Windows\System\laXBHAC.exe
  2⤵
  PID:5404
- C:\Windows\System\gLdekHG.exe
  C:\Windows\System\gLdekHG.exe
  2⤵
  PID:5804
- C:\Windows\System\rYfDfRk.exe
  C:\Windows\System\rYfDfRk.exe
  2⤵
  PID:5696
- C:\Windows\System\jTVnYVR.exe
  C:\Windows\System\jTVnYVR.exe
  2⤵
  PID:5264
- C:\Windows\System\mDBnint.exe
  C:\Windows\System\mDBnint.exe
  2⤵
  PID:6032
- C:\Windows\System\ieqBmEq.exe
  C:\Windows\System\ieqBmEq.exe
  2⤵
  PID:5444
- C:\Windows\System\GlKXJur.exe
  C:\Windows\System\GlKXJur.exe
  2⤵
  PID:5440
- C:\Windows\System\aWMEVxC.exe
  C:\Windows\System\aWMEVxC.exe
  2⤵
  PID:5384
- C:\Windows\System\nzYNoum.exe
  C:\Windows\System\nzYNoum.exe
  2⤵
  PID:6148
- C:\Windows\System\tTPuYka.exe
  C:\Windows\System\tTPuYka.exe
  2⤵
  PID:6164
- C:\Windows\System\TVCqkYV.exe
  C:\Windows\System\TVCqkYV.exe
  2⤵
  PID:6180
- C:\Windows\System\LkGfOGg.exe
  C:\Windows\System\LkGfOGg.exe
  2⤵
  PID:6196
- C:\Windows\System\meHQFlA.exe
  C:\Windows\System\meHQFlA.exe
  2⤵
  PID:6212
- C:\Windows\System\aJLHhtl.exe
  C:\Windows\System\aJLHhtl.exe
  2⤵
  PID:6232
- C:\Windows\System\lLPMTaw.exe
  C:\Windows\System\lLPMTaw.exe
  2⤵
  PID:6248
- C:\Windows\System\sylbRdY.exe
  C:\Windows\System\sylbRdY.exe
  2⤵
  PID:6268
- C:\Windows\System\IdZHPaS.exe
  C:\Windows\System\IdZHPaS.exe
  2⤵
  PID:6284
- C:\Windows\System\zrgsrXB.exe
  C:\Windows\System\zrgsrXB.exe
  2⤵
  PID:6308
- C:\Windows\System\qGHeDzy.exe
  C:\Windows\System\qGHeDzy.exe
  2⤵
  PID:6332
- C:\Windows\System\PpvYAsh.exe
  C:\Windows\System\PpvYAsh.exe
  2⤵
  PID:6348
- C:\Windows\System\hEvCYqR.exe
  C:\Windows\System\hEvCYqR.exe
  2⤵
  PID:6364
- C:\Windows\System\XeSFZHo.exe
  C:\Windows\System\XeSFZHo.exe
  2⤵
  PID:6384
- C:\Windows\System\AbSBGBP.exe
  C:\Windows\System\AbSBGBP.exe
  2⤵
  PID:6400
- C:\Windows\System\bBuZvvX.exe
  C:\Windows\System\bBuZvvX.exe
  2⤵
  PID:6416
- C:\Windows\System\HQBGUJq.exe
  C:\Windows\System\HQBGUJq.exe
  2⤵
  PID:6432
- C:\Windows\System\rwPDtQW.exe
  C:\Windows\System\rwPDtQW.exe
  2⤵
  PID:6448
- C:\Windows\System\PLEAgdK.exe
  C:\Windows\System\PLEAgdK.exe
  2⤵
  PID:6464
- C:\Windows\System\ojbZhwx.exe
  C:\Windows\System\ojbZhwx.exe
  2⤵
  PID:6480
- C:\Windows\System\TDVzZdy.exe
  C:\Windows\System\TDVzZdy.exe
  2⤵
  PID:6496
- C:\Windows\System\joJBIXk.exe
  C:\Windows\System\joJBIXk.exe
  2⤵
  PID:6512
- C:\Windows\System\VwiVFuQ.exe
  C:\Windows\System\VwiVFuQ.exe
  2⤵
  PID:6528
- C:\Windows\System\WBwUVFj.exe
  C:\Windows\System\WBwUVFj.exe
  2⤵
  PID:6544
- C:\Windows\System\ncmaXBB.exe
  C:\Windows\System\ncmaXBB.exe
  2⤵
  PID:6560
- C:\Windows\System\bhcqZGf.exe
  C:\Windows\System\bhcqZGf.exe
  2⤵
  PID:6576
- C:\Windows\System\mGnLxZY.exe
  C:\Windows\System\mGnLxZY.exe
  2⤵
  PID:6592
- C:\Windows\System\naWcnbO.exe
  C:\Windows\System\naWcnbO.exe
  2⤵
  PID:6608
- C:\Windows\System\yAUXTtV.exe
  C:\Windows\System\yAUXTtV.exe
  2⤵
  PID:6624
- C:\Windows\System\DaBtpKJ.exe
  C:\Windows\System\DaBtpKJ.exe
  2⤵
  PID:6640
- C:\Windows\System\pqXOYAS.exe
  C:\Windows\System\pqXOYAS.exe
  2⤵
  PID:6656
- C:\Windows\System\FplHoOU.exe
  C:\Windows\System\FplHoOU.exe
  2⤵
  PID:6672
- C:\Windows\System\RPtwdIp.exe
  C:\Windows\System\RPtwdIp.exe
  2⤵
  PID:6688
- C:\Windows\System\CmalIAw.exe
  C:\Windows\System\CmalIAw.exe
  2⤵
  PID:6704
- C:\Windows\System\clPbGwV.exe
  C:\Windows\System\clPbGwV.exe
  2⤵
  PID:6720
- C:\Windows\System\bXVfddQ.exe
  C:\Windows\System\bXVfddQ.exe
  2⤵
  PID:6736
- C:\Windows\System\MbCJHEC.exe
  C:\Windows\System\MbCJHEC.exe
  2⤵
  PID:6752
- C:\Windows\System\AxwJfag.exe
  C:\Windows\System\AxwJfag.exe
  2⤵
  PID:6768
- C:\Windows\System\CJQPYKE.exe
  C:\Windows\System\CJQPYKE.exe
  2⤵
  PID:6784
- C:\Windows\System\ydllKzH.exe
  C:\Windows\System\ydllKzH.exe
  2⤵
  PID:6804
- C:\Windows\System\ozAGwBq.exe
  C:\Windows\System\ozAGwBq.exe
  2⤵
  PID:6820
- C:\Windows\System\sMyXSoS.exe
  C:\Windows\System\sMyXSoS.exe
  2⤵
  PID:6836
- C:\Windows\System\dSUyOPD.exe
  C:\Windows\System\dSUyOPD.exe
  2⤵
  PID:6852
- C:\Windows\System\pyJedHv.exe
  C:\Windows\System\pyJedHv.exe
  2⤵
  PID:6868
- C:\Windows\System\cNieTPi.exe
  C:\Windows\System\cNieTPi.exe
  2⤵
  PID:6884
- C:\Windows\System\hpZfzbQ.exe
  C:\Windows\System\hpZfzbQ.exe
  2⤵
  PID:6900
- C:\Windows\System\pzyPawv.exe
  C:\Windows\System\pzyPawv.exe
  2⤵
  PID:6916
- C:\Windows\System\YZKabwW.exe
  C:\Windows\System\YZKabwW.exe
  2⤵
  PID:6932
- C:\Windows\System\NJqFxCC.exe
  C:\Windows\System\NJqFxCC.exe
  2⤵
  PID:6948
- C:\Windows\System\xuIWhqv.exe
  C:\Windows\System\xuIWhqv.exe
  2⤵
  PID:6964
- C:\Windows\System\YQYCNxO.exe
  C:\Windows\System\YQYCNxO.exe
  2⤵
  PID:6980
- C:\Windows\System\wUQOqjt.exe
  C:\Windows\System\wUQOqjt.exe
  2⤵
  PID:6996
- C:\Windows\System\wnGwmmv.exe
  C:\Windows\System\wnGwmmv.exe
  2⤵
  PID:7012
- C:\Windows\System\jcyjLAt.exe
  C:\Windows\System\jcyjLAt.exe
  2⤵
  PID:7028
- C:\Windows\System\BwWufSM.exe
  C:\Windows\System\BwWufSM.exe
  2⤵
  PID:7044
- C:\Windows\System\yGfejll.exe
  C:\Windows\System\yGfejll.exe
  2⤵
  PID:7060
- C:\Windows\System\DddXbVG.exe
  C:\Windows\System\DddXbVG.exe
  2⤵
  PID:7076
- C:\Windows\System\GDKCdYZ.exe
  C:\Windows\System\GDKCdYZ.exe
  2⤵
  PID:7092
- C:\Windows\System\sIZDhxo.exe
  C:\Windows\System\sIZDhxo.exe
  2⤵
  PID:7108
- C:\Windows\System\hoEBQqG.exe
  C:\Windows\System\hoEBQqG.exe
  2⤵
  PID:7124
- C:\Windows\System\mcZPyOC.exe
  C:\Windows\System\mcZPyOC.exe
  2⤵
  PID:7140
- C:\Windows\System\qEwidkC.exe
  C:\Windows\System\qEwidkC.exe
  2⤵
  PID:7156
- C:\Windows\System\FKugaxL.exe
  C:\Windows\System\FKugaxL.exe
  2⤵
  PID:5896
- C:\Windows\System\oymFdRm.exe
  C:\Windows\System\oymFdRm.exe
  2⤵
  PID:6068
- C:\Windows\System\bBdzRwG.exe
  C:\Windows\System\bBdzRwG.exe
  2⤵
  PID:5188
- C:\Windows\System\pMZJQRA.exe
  C:\Windows\System\pMZJQRA.exe
  2⤵
  PID:6208
- C:\Windows\System\dtKOitp.exe
  C:\Windows\System\dtKOitp.exe
  2⤵
  PID:5940
- C:\Windows\System\yhHLXno.exe
  C:\Windows\System\yhHLXno.exe
  2⤵
  PID:6188
- C:\Windows\System\suDtylY.exe
  C:\Windows\System\suDtylY.exe
  2⤵
  PID:6256
- C:\Windows\System\qXacqnH.exe
  C:\Windows\System\qXacqnH.exe
  2⤵
  PID:6280
- C:\Windows\System\xUcbxqa.exe
  C:\Windows\System\xUcbxqa.exe
  2⤵
  PID:6340
- C:\Windows\System\eMCpcCM.exe
  C:\Windows\System\eMCpcCM.exe
  2⤵
  PID:6304
- C:\Windows\System\zVOIjhX.exe
  C:\Windows\System\zVOIjhX.exe
  2⤵
  PID:6324
- C:\Windows\System\bTRxlaa.exe
  C:\Windows\System\bTRxlaa.exe
  2⤵
  PID:6440
- C:\Windows\System\GILBXty.exe
  C:\Windows\System\GILBXty.exe
  2⤵
  PID:6428
- C:\Windows\System\zlyPFBU.exe
  C:\Windows\System\zlyPFBU.exe
  2⤵
  PID:6460
- C:\Windows\System\ArMRHxO.exe
  C:\Windows\System\ArMRHxO.exe
  2⤵
  PID:6488
- C:\Windows\System\qodXwzo.exe
  C:\Windows\System\qodXwzo.exe
  2⤵
  PID:6524
- C:\Windows\System\sAKbrkx.exe
  C:\Windows\System\sAKbrkx.exe
  2⤵
  PID:6552
- C:\Windows\System\zWpIrli.exe
  C:\Windows\System\zWpIrli.exe
  2⤵
  PID:6604
- C:\Windows\System\jzgSrcS.exe
  C:\Windows\System\jzgSrcS.exe
  2⤵
  PID:6668
- C:\Windows\System\mOqklOX.exe
  C:\Windows\System\mOqklOX.exe
  2⤵
  PID:6732
- C:\Windows\System\yQjDmNI.exe
  C:\Windows\System\yQjDmNI.exe
  2⤵
  PID:6380
- C:\Windows\System\gtSUxGr.exe
  C:\Windows\System\gtSUxGr.exe
  2⤵
  PID:6800
- C:\Windows\System\nwSqfjx.exe
  C:\Windows\System\nwSqfjx.exe
  2⤵
  PID:6620
- C:\Windows\System\PqLAkeT.exe
  C:\Windows\System\PqLAkeT.exe
  2⤵
  PID:6684
- C:\Windows\System\geIfngg.exe
  C:\Windows\System\geIfngg.exe
  2⤵
  PID:6860
- C:\Windows\System\uvRHAbZ.exe
  C:\Windows\System\uvRHAbZ.exe
  2⤵
  PID:6780
- C:\Windows\System\tUYcgIu.exe
  C:\Windows\System\tUYcgIu.exe
  2⤵
  PID:6848
- C:\Windows\System\qQSyUrV.exe
  C:\Windows\System\qQSyUrV.exe
  2⤵
  PID:6928
- C:\Windows\System\kuzJSpf.exe
  C:\Windows\System\kuzJSpf.exe
  2⤵
  PID:6992
- C:\Windows\System\iiXUeNl.exe
  C:\Windows\System\iiXUeNl.exe
  2⤵
  PID:6908
- C:\Windows\System\WcwTVPI.exe
  C:\Windows\System\WcwTVPI.exe
  2⤵
  PID:6912
- C:\Windows\System\fpPWcZy.exe
  C:\Windows\System\fpPWcZy.exe
  2⤵
  PID:7040
- C:\Windows\System\EBsXLCE.exe
  C:\Windows\System\EBsXLCE.exe
  2⤵
  PID:7068
- C:\Windows\System\SdemrIE.exe
  C:\Windows\System\SdemrIE.exe
  2⤵
  PID:7152
- C:\Windows\System\mZoAJXl.exe
  C:\Windows\System\mZoAJXl.exe
  2⤵
  PID:7100
- C:\Windows\System\VzYbreC.exe
  C:\Windows\System\VzYbreC.exe
  2⤵
  PID:5856
- C:\Windows\System\GafnxDK.exe
  C:\Windows\System\GafnxDK.exe
  2⤵
  PID:5712
- C:\Windows\System\SSRTSfG.exe
  C:\Windows\System\SSRTSfG.exe
  2⤵
  PID:6220
- C:\Windows\System\YrSwQpF.exe
  C:\Windows\System\YrSwQpF.exe
  2⤵
  PID:6372
- C:\Windows\System\iSaorcO.exe
  C:\Windows\System\iSaorcO.exe
  2⤵
  PID:6408
- C:\Windows\System\dLMJNXy.exe
  C:\Windows\System\dLMJNXy.exe
  2⤵
  PID:6296
- C:\Windows\System\pRYAqnt.exe
  C:\Windows\System\pRYAqnt.exe
  2⤵
  PID:6696
- C:\Windows\System\WlOLgON.exe
  C:\Windows\System\WlOLgON.exe
  2⤵
  PID:6652
- C:\Windows\System\EHgRJZZ.exe
  C:\Windows\System\EHgRJZZ.exe
  2⤵
  PID:6424
- C:\Windows\System\XDNKIsG.exe
  C:\Windows\System\XDNKIsG.exe
  2⤵
  PID:6472
- C:\Windows\System\WZKisga.exe
  C:\Windows\System\WZKisga.exe
  2⤵
  PID:6764
- C:\Windows\System\kTfSzYJ.exe
  C:\Windows\System\kTfSzYJ.exe
  2⤵
  PID:6616
- C:\Windows\System\vscoblc.exe
  C:\Windows\System\vscoblc.exe
  2⤵
  PID:6924
- C:\Windows\System\pGjKkCO.exe
  C:\Windows\System\pGjKkCO.exe
  2⤵
  PID:7052
- C:\Windows\System\TSXnfXI.exe
  C:\Windows\System\TSXnfXI.exe
  2⤵
  PID:6976
- C:\Windows\System\nkbvbWC.exe
  C:\Windows\System\nkbvbWC.exe
  2⤵
  PID:7036
- C:\Windows\System\TAGyYCk.exe
  C:\Windows\System\TAGyYCk.exe
  2⤵
  PID:7148
- C:\Windows\System\SrrRknA.exe
  C:\Windows\System\SrrRknA.exe
  2⤵
  PID:6160
- C:\Windows\System\UobkmTg.exe
  C:\Windows\System\UobkmTg.exe
  2⤵
  PID:5936
- C:\Windows\System\LcOyIZR.exe
  C:\Windows\System\LcOyIZR.exe
  2⤵
  PID:6276
- C:\Windows\System\hmmYJXf.exe
  C:\Windows\System\hmmYJXf.exe
  2⤵
  PID:6728
- C:\Windows\System\Kujqphx.exe
  C:\Windows\System\Kujqphx.exe
  2⤵
  PID:6664
- C:\Windows\System\OTpiYCC.exe
  C:\Windows\System\OTpiYCC.exe
  2⤵
  PID:6744
- C:\Windows\System\JicFIrF.exe
  C:\Windows\System\JicFIrF.exe
  2⤵
  PID:7088
- C:\Windows\System\qPdTqRF.exe
  C:\Windows\System\qPdTqRF.exe
  2⤵
  PID:6588
- C:\Windows\System\nkzfwtV.exe
  C:\Windows\System\nkzfwtV.exe
  2⤵
  PID:6796
- C:\Windows\System\OXPUicI.exe
  C:\Windows\System\OXPUicI.exe
  2⤵
  PID:6944
- C:\Windows\System\naWouor.exe
  C:\Windows\System\naWouor.exe
  2⤵
  PID:7164
- C:\Windows\System\ZxyiQNo.exe
  C:\Windows\System\ZxyiQNo.exe
  2⤵
  PID:4368
- C:\Windows\System\BMZXiiL.exe
  C:\Windows\System\BMZXiiL.exe
  2⤵
  PID:6360
- C:\Windows\System\AujTfEO.exe
  C:\Windows\System\AujTfEO.exe
  2⤵
  PID:6456
- C:\Windows\System\CeDFQTV.exe
  C:\Windows\System\CeDFQTV.exe
  2⤵
  PID:6568
- C:\Windows\System\rVOSicu.exe
  C:\Windows\System\rVOSicu.exe
  2⤵
  PID:7184
- C:\Windows\System\unTuazj.exe
  C:\Windows\System\unTuazj.exe
  2⤵
  PID:7200
- C:\Windows\System\QJIyFzi.exe
  C:\Windows\System\QJIyFzi.exe
  2⤵
  PID:7216
- C:\Windows\System\DexvbMT.exe
  C:\Windows\System\DexvbMT.exe
  2⤵
  PID:7232
- C:\Windows\System\dUGxZBk.exe
  C:\Windows\System\dUGxZBk.exe
  2⤵
  PID:7248
- C:\Windows\System\aabkqlI.exe
  C:\Windows\System\aabkqlI.exe
  2⤵
  PID:7264
- C:\Windows\System\qTeFaOV.exe
  C:\Windows\System\qTeFaOV.exe
  2⤵
  PID:7280
- C:\Windows\System\thDxzBT.exe
  C:\Windows\System\thDxzBT.exe
  2⤵
  PID:7296
- C:\Windows\System\TMDkRDw.exe
  C:\Windows\System\TMDkRDw.exe
  2⤵
  PID:7312
- C:\Windows\System\VHHnBac.exe
  C:\Windows\System\VHHnBac.exe
  2⤵
  PID:7328
- C:\Windows\System\WexVHKd.exe
  C:\Windows\System\WexVHKd.exe
  2⤵
  PID:7344
- C:\Windows\System\RfbmUxb.exe
  C:\Windows\System\RfbmUxb.exe
  2⤵
  PID:7360
- C:\Windows\System\gNUUgkR.exe
  C:\Windows\System\gNUUgkR.exe
  2⤵
  PID:7376
- C:\Windows\System\hqobrCP.exe
  C:\Windows\System\hqobrCP.exe
  2⤵
  PID:7392
- C:\Windows\System\tvpIKSF.exe
  C:\Windows\System\tvpIKSF.exe
  2⤵
  PID:7408
- C:\Windows\System\FQYRAkF.exe
  C:\Windows\System\FQYRAkF.exe
  2⤵
  PID:7424
- C:\Windows\System\SAvgNEN.exe
  C:\Windows\System\SAvgNEN.exe
  2⤵
  PID:7440
- C:\Windows\System\EMbSdJv.exe
  C:\Windows\System\EMbSdJv.exe
  2⤵
  PID:7456
- C:\Windows\System\frmGWBa.exe
  C:\Windows\System\frmGWBa.exe
  2⤵
  PID:7472
- C:\Windows\System\wtpPxPD.exe
  C:\Windows\System\wtpPxPD.exe
  2⤵
  PID:7488
- C:\Windows\System\TLIPpCU.exe
  C:\Windows\System\TLIPpCU.exe
  2⤵
  PID:7504
- C:\Windows\System\XRvWVVZ.exe
  C:\Windows\System\XRvWVVZ.exe
  2⤵
  PID:7524
- C:\Windows\System\PmsEaok.exe
  C:\Windows\System\PmsEaok.exe
  2⤵
  PID:7540
- C:\Windows\System\ubXSloi.exe
  C:\Windows\System\ubXSloi.exe
  2⤵
  PID:7556
- C:\Windows\System\uyyRzam.exe
  C:\Windows\System\uyyRzam.exe
  2⤵
  PID:7572
- C:\Windows\System\lRjbDyg.exe
  C:\Windows\System\lRjbDyg.exe
  2⤵
  PID:7592
- C:\Windows\System\JYgsCff.exe
  C:\Windows\System\JYgsCff.exe
  2⤵
  PID:7608
- C:\Windows\System\wQfBGdv.exe
  C:\Windows\System\wQfBGdv.exe
  2⤵
  PID:7624
- C:\Windows\System\iLNeQsJ.exe
  C:\Windows\System\iLNeQsJ.exe
  2⤵
  PID:7640
- C:\Windows\System\xxMOYWW.exe
  C:\Windows\System\xxMOYWW.exe
  2⤵
  PID:7656
- C:\Windows\System\MBdXZks.exe
  C:\Windows\System\MBdXZks.exe
  2⤵
  PID:7672
- C:\Windows\System\OpIkaqS.exe
  C:\Windows\System\OpIkaqS.exe
  2⤵
  PID:7688
- C:\Windows\System\SMzWZvQ.exe
  C:\Windows\System\SMzWZvQ.exe
  2⤵
  PID:7704
- C:\Windows\System\vBUzSDZ.exe
  C:\Windows\System\vBUzSDZ.exe
  2⤵
  PID:7720
- C:\Windows\System\cHPKMqV.exe
  C:\Windows\System\cHPKMqV.exe
  2⤵
  PID:7736
- C:\Windows\System\eIzxQZg.exe
  C:\Windows\System\eIzxQZg.exe
  2⤵
  PID:7752
- C:\Windows\System\LxLuQnh.exe
  C:\Windows\System\LxLuQnh.exe
  2⤵
  PID:7768
- C:\Windows\System\BFudOYj.exe
  C:\Windows\System\BFudOYj.exe
  2⤵
  PID:7784
- C:\Windows\System\ajNUKjM.exe
  C:\Windows\System\ajNUKjM.exe
  2⤵
  PID:7800
- C:\Windows\System\oJfYRwa.exe
  C:\Windows\System\oJfYRwa.exe
  2⤵
  PID:7816
- C:\Windows\System\FCvVTaJ.exe
  C:\Windows\System\FCvVTaJ.exe
  2⤵
  PID:7832
- C:\Windows\System\QafasOA.exe
  C:\Windows\System\QafasOA.exe
  2⤵
  PID:7852
- C:\Windows\System\WuzHxlC.exe
  C:\Windows\System\WuzHxlC.exe
  2⤵
  PID:7872
- C:\Windows\System\BdvYyUE.exe
  C:\Windows\System\BdvYyUE.exe
  2⤵
  PID:7896
- C:\Windows\System\tebqEVv.exe
  C:\Windows\System\tebqEVv.exe
  2⤵
  PID:7912
- C:\Windows\System\PnuSyXX.exe
  C:\Windows\System\PnuSyXX.exe
  2⤵
  PID:7928
- C:\Windows\System\sgXehJr.exe
  C:\Windows\System\sgXehJr.exe
  2⤵
  PID:7944
- C:\Windows\System\LoRkmfg.exe
  C:\Windows\System\LoRkmfg.exe
  2⤵
  PID:7960
- C:\Windows\System\djGYbkF.exe
  C:\Windows\System\djGYbkF.exe
  2⤵
  PID:7976
- C:\Windows\System\jcTvHVU.exe
  C:\Windows\System\jcTvHVU.exe
  2⤵
  PID:7992
- C:\Windows\System\afwrMQN.exe
  C:\Windows\System\afwrMQN.exe
  2⤵
  PID:8008
- C:\Windows\System\bagZRTj.exe
  C:\Windows\System\bagZRTj.exe
  2⤵
  PID:8024
- C:\Windows\System\JWtggPr.exe
  C:\Windows\System\JWtggPr.exe
  2⤵
  PID:8060
- C:\Windows\System\UJVFSDt.exe
  C:\Windows\System\UJVFSDt.exe
  2⤵
  PID:8076
- C:\Windows\System\AUhvvKi.exe
  C:\Windows\System\AUhvvKi.exe
  2⤵
  PID:8092
- C:\Windows\System\BLyDbJB.exe
  C:\Windows\System\BLyDbJB.exe
  2⤵
  PID:8108
- C:\Windows\System\OUGCSvl.exe
  C:\Windows\System\OUGCSvl.exe
  2⤵
  PID:8124
- C:\Windows\System\uBcrsSN.exe
  C:\Windows\System\uBcrsSN.exe
  2⤵
  PID:8140
- C:\Windows\System\qxlSISF.exe
  C:\Windows\System\qxlSISF.exe
  2⤵
  PID:8156
- C:\Windows\System\dlOXBdA.exe
  C:\Windows\System\dlOXBdA.exe
  2⤵
  PID:8172
- C:\Windows\System\cwkKMap.exe
  C:\Windows\System\cwkKMap.exe
  2⤵
  PID:8188
- C:\Windows\System\umxLhWD.exe
  C:\Windows\System\umxLhWD.exe
  2⤵
  PID:7212
- C:\Windows\System\AzxehyC.exe
  C:\Windows\System\AzxehyC.exe
  2⤵
  PID:7244
- C:\Windows\System\UFMiHbh.exe
  C:\Windows\System\UFMiHbh.exe
  2⤵
  PID:6832
- C:\Windows\System\SvwwPic.exe
  C:\Windows\System\SvwwPic.exe
  2⤵
  PID:7056
- C:\Windows\System\HYTyPtT.exe
  C:\Windows\System\HYTyPtT.exe
  2⤵
  PID:7276
- C:\Windows\System\JnZOMJq.exe
  C:\Windows\System\JnZOMJq.exe
  2⤵
  PID:7256
- C:\Windows\System\PPqXzVS.exe
  C:\Windows\System\PPqXzVS.exe
  2⤵
  PID:7292
- C:\Windows\System\orphpVL.exe
  C:\Windows\System\orphpVL.exe
  2⤵
  PID:7324
- C:\Windows\System\JwkLCzV.exe
  C:\Windows\System\JwkLCzV.exe
  2⤵
  PID:7404
- C:\Windows\System\HHMqnxu.exe
  C:\Windows\System\HHMqnxu.exe
  2⤵
  PID:7384
- C:\Windows\System\jbpuVZN.exe
  C:\Windows\System\jbpuVZN.exe
  2⤵
  PID:7388
- C:\Windows\System\hpgERat.exe
  C:\Windows\System\hpgERat.exe
  2⤵
  PID:7416
- C:\Windows\System\PKjlHZV.exe
  C:\Windows\System\PKjlHZV.exe
  2⤵
  PID:7536
- C:\Windows\System\ozETeLY.exe
  C:\Windows\System\ozETeLY.exe
  2⤵
  PID:7600
- C:\Windows\System\CsooZVI.exe
  C:\Windows\System\CsooZVI.exe
  2⤵
  PID:7636
- C:\Windows\System\FgDBWud.exe
  C:\Windows\System\FgDBWud.exe
  2⤵
  PID:7584
- C:\Windows\System\XgcEKaF.exe
  C:\Windows\System\XgcEKaF.exe
  2⤵
  PID:7652
- C:\Windows\System\kpoeZZQ.exe
  C:\Windows\System\kpoeZZQ.exe
  2⤵
  PID:7728
- C:\Windows\System\zoHphZG.exe
  C:\Windows\System\zoHphZG.exe
  2⤵
  PID:7760
- C:\Windows\System\TInofry.exe
  C:\Windows\System\TInofry.exe
  2⤵
  PID:7824
- C:\Windows\System\tnPkips.exe
  C:\Windows\System\tnPkips.exe
  2⤵
  PID:7776
- C:\Windows\System\VjrBUJY.exe
  C:\Windows\System\VjrBUJY.exe
  2⤵
  PID:7812
- C:\Windows\System\bjOZObt.exe
  C:\Windows\System\bjOZObt.exe
  2⤵
  PID:7908
- C:\Windows\System\ZbxZXfH.exe
  C:\Windows\System\ZbxZXfH.exe
  2⤵
  PID:7940
- C:\Windows\System\QoRXqMC.exe
  C:\Windows\System\QoRXqMC.exe
  2⤵
  PID:8000
- C:\Windows\System\ZidrTrS.exe
  C:\Windows\System\ZidrTrS.exe
  2⤵
  PID:7988
- C:\Windows\System\ulpsUVD.exe
  C:\Windows\System\ulpsUVD.exe
  2⤵
  PID:7884
- C:\Windows\System\beNAEQs.exe
  C:\Windows\System\beNAEQs.exe
  2⤵
  PID:7956
- C:\Windows\System\NSDBOLP.exe
  C:\Windows\System\NSDBOLP.exe
  2⤵
  PID:8052
- C:\Windows\System\WdcwouP.exe
  C:\Windows\System\WdcwouP.exe
  2⤵
  PID:8120
- C:\Windows\System\LlTtDRm.exe
  C:\Windows\System\LlTtDRm.exe
  2⤵
  PID:8056
- C:\Windows\System\fMHChcX.exe
  C:\Windows\System\fMHChcX.exe
  2⤵
  PID:8068
- C:\Windows\System\LeNjhBE.exe
  C:\Windows\System\LeNjhBE.exe
  2⤵
  PID:6600
- C:\Windows\System\cmKhiTE.exe
  C:\Windows\System\cmKhiTE.exe
  2⤵
  PID:8104
- C:\Windows\System\aYXjTWe.exe
  C:\Windows\System\aYXjTWe.exe
  2⤵
  PID:6240
- C:\Windows\System\HetHeGb.exe
  C:\Windows\System\HetHeGb.exe
  2⤵
  PID:7272
- C:\Windows\System\yURKvUi.exe
  C:\Windows\System\yURKvUi.exe
  2⤵
  PID:7260
- C:\Windows\System\FPstgOq.exe
  C:\Windows\System\FPstgOq.exe
  2⤵
  PID:7448
- C:\Windows\System\cRfQMQg.exe
  C:\Windows\System\cRfQMQg.exe
  2⤵
  PID:7520
- C:\Windows\System\HckkWaL.exe
  C:\Windows\System\HckkWaL.exe
  2⤵
  PID:7532
- C:\Windows\System\ebiutTZ.exe
  C:\Windows\System\ebiutTZ.exe
  2⤵
  PID:7620
- C:\Windows\System\LlzKFdS.exe
  C:\Windows\System\LlzKFdS.exe
  2⤵
  PID:7588
- C:\Windows\System\JNBRbvt.exe
  C:\Windows\System\JNBRbvt.exe
  2⤵
  PID:7700
- C:\Windows\System\zRtuoVZ.exe
  C:\Windows\System\zRtuoVZ.exe
  2⤵
  PID:8032
- C:\Windows\System\nklWZVT.exe
  C:\Windows\System\nklWZVT.exe
  2⤵
  PID:8044
- C:\Windows\System\qqQaSrA.exe
  C:\Windows\System\qqQaSrA.exe
  2⤵
  PID:7848
- C:\Windows\System\zgqPxzv.exe
  C:\Windows\System\zgqPxzv.exe
  2⤵
  PID:7744
- C:\Windows\System\xWKOyYY.exe
  C:\Windows\System\xWKOyYY.exe
  2⤵
  PID:8036
- C:\Windows\System\innpevL.exe
  C:\Windows\System\innpevL.exe
  2⤵
  PID:6476
- C:\Windows\System\Zqpffqy.exe
  C:\Windows\System\Zqpffqy.exe
  2⤵
  PID:8164
- C:\Windows\System\ysqiuwg.exe
  C:\Windows\System\ysqiuwg.exe
  2⤵
  PID:5480
- C:\Windows\System\tOosxpz.exe
  C:\Windows\System\tOosxpz.exe
  2⤵
  PID:7464
- C:\Windows\System\IMWuksD.exe
  C:\Windows\System\IMWuksD.exe
  2⤵
  PID:7372
- C:\Windows\System\EkYozaI.exe
  C:\Windows\System\EkYozaI.exe
  2⤵
  PID:7500
- C:\Windows\System\cpIKmvS.exe
  C:\Windows\System\cpIKmvS.exe
  2⤵
  PID:7684
- C:\Windows\System\dxREdst.exe
  C:\Windows\System\dxREdst.exe
  2⤵
  PID:8020
- C:\Windows\System\nBacLQW.exe
  C:\Windows\System\nBacLQW.exe
  2⤵
  PID:7180
- C:\Windows\System\PCwnCoH.exe
  C:\Windows\System\PCwnCoH.exe
  2⤵
  PID:7712
- C:\Windows\System\xaxQiEc.exe
  C:\Windows\System\xaxQiEc.exe
  2⤵
  PID:7496
- C:\Windows\System\sOWnNpA.exe
  C:\Windows\System\sOWnNpA.exe
  2⤵
  PID:7716
- C:\Windows\System\TCCjZQT.exe
  C:\Windows\System\TCCjZQT.exe
  2⤵
  PID:8180
- C:\Windows\System\ORUvUGQ.exe
  C:\Windows\System\ORUvUGQ.exe
  2⤵
  PID:7888
- C:\Windows\System\NsjXjVF.exe
  C:\Windows\System\NsjXjVF.exe
  2⤵
  PID:7208
- C:\Windows\System\lnWCSAj.exe
  C:\Windows\System\lnWCSAj.exe
  2⤵
  PID:7680
- C:\Windows\System\sFUYEsD.exe
  C:\Windows\System\sFUYEsD.exe
  2⤵
  PID:8200
- C:\Windows\System\icVICay.exe
  C:\Windows\System\icVICay.exe
  2⤵
  PID:8216
- C:\Windows\System\VgVLLLg.exe
  C:\Windows\System\VgVLLLg.exe
  2⤵
  PID:8232
- C:\Windows\System\mulUkHr.exe
  C:\Windows\System\mulUkHr.exe
  2⤵
  PID:8248
- C:\Windows\System\SEMtRop.exe
  C:\Windows\System\SEMtRop.exe
  2⤵
  PID:8264
- C:\Windows\System\StmUwXh.exe
  C:\Windows\System\StmUwXh.exe
  2⤵
  PID:8284
- C:\Windows\System\hFdIWNi.exe
  C:\Windows\System\hFdIWNi.exe
  2⤵
  PID:8300
- C:\Windows\System\ZkJZhYn.exe
  C:\Windows\System\ZkJZhYn.exe
  2⤵
  PID:8316
- C:\Windows\System\YTvLBgL.exe
  C:\Windows\System\YTvLBgL.exe
  2⤵
  PID:8364
- C:\Windows\System\tjAYIae.exe
  C:\Windows\System\tjAYIae.exe
  2⤵
  PID:8400
- C:\Windows\System\XnDiAWW.exe
  C:\Windows\System\XnDiAWW.exe
  2⤵
  PID:8416
- C:\Windows\System\EPbmoMn.exe
  C:\Windows\System\EPbmoMn.exe
  2⤵
  PID:8432
- C:\Windows\System\VLjmmQv.exe
  C:\Windows\System\VLjmmQv.exe
  2⤵
  PID:8448
- C:\Windows\System\lGbkeqm.exe
  C:\Windows\System\lGbkeqm.exe
  2⤵
  PID:8464
- C:\Windows\System\RaDMFPp.exe
  C:\Windows\System\RaDMFPp.exe
  2⤵
  PID:8480
- C:\Windows\System\xRPSFoT.exe
  C:\Windows\System\xRPSFoT.exe
  2⤵
  PID:8496
- C:\Windows\System\HTCrYJj.exe
  C:\Windows\System\HTCrYJj.exe
  2⤵
  PID:8528
- C:\Windows\System\oDhSmTb.exe
  C:\Windows\System\oDhSmTb.exe
  2⤵
  PID:8544
- C:\Windows\System\MLOsQjK.exe
  C:\Windows\System\MLOsQjK.exe
  2⤵
  PID:8564
- C:\Windows\System\uPMfgWQ.exe
  C:\Windows\System\uPMfgWQ.exe
  2⤵
  PID:8580
- C:\Windows\System\ZYaXfHs.exe
  C:\Windows\System\ZYaXfHs.exe
  2⤵
  PID:8596
- C:\Windows\System\WOXukRY.exe
  C:\Windows\System\WOXukRY.exe
  2⤵
  PID:8612
- C:\Windows\System\meVtKYs.exe
  C:\Windows\System\meVtKYs.exe
  2⤵
  PID:8628
- C:\Windows\System\SpjKKUB.exe
  C:\Windows\System\SpjKKUB.exe
  2⤵
  PID:8644
- C:\Windows\System\OwIRtDD.exe
  C:\Windows\System\OwIRtDD.exe
  2⤵
  PID:8660
- C:\Windows\System\FKxTTFp.exe
  C:\Windows\System\FKxTTFp.exe
  2⤵
  PID:8676
- C:\Windows\System\tNMRQOD.exe
  C:\Windows\System\tNMRQOD.exe
  2⤵
  PID:8692
- C:\Windows\System\tuxOdtm.exe
  C:\Windows\System\tuxOdtm.exe
  2⤵
  PID:8708
- C:\Windows\System\AeruqRA.exe
  C:\Windows\System\AeruqRA.exe
  2⤵
  PID:8724
- C:\Windows\System\fxZDmdl.exe
  C:\Windows\System\fxZDmdl.exe
  2⤵
  PID:8740
- C:\Windows\System\DOiaWQh.exe
  C:\Windows\System\DOiaWQh.exe
  2⤵
  PID:8756
- C:\Windows\System\oUaSHAK.exe
  C:\Windows\System\oUaSHAK.exe
  2⤵
  PID:8772
- C:\Windows\System\JztOVvP.exe
  C:\Windows\System\JztOVvP.exe
  2⤵
  PID:8792
- C:\Windows\System\QAOBLUE.exe
  C:\Windows\System\QAOBLUE.exe
  2⤵
  PID:8808
- C:\Windows\System\BxjiuiT.exe
  C:\Windows\System\BxjiuiT.exe
  2⤵
  PID:8824
- C:\Windows\System\ydhueQt.exe
  C:\Windows\System\ydhueQt.exe
  2⤵
  PID:8840
- C:\Windows\System\ZxKlaul.exe
  C:\Windows\System\ZxKlaul.exe
  2⤵
  PID:8856
- C:\Windows\System\FNpwdKO.exe
  C:\Windows\System\FNpwdKO.exe
  2⤵
  PID:8872
- C:\Windows\System\MbEAPdj.exe
  C:\Windows\System\MbEAPdj.exe
  2⤵
  PID:8888
- C:\Windows\System\ipWiqXP.exe
  C:\Windows\System\ipWiqXP.exe
  2⤵
  PID:8904
- C:\Windows\System\kyIRgdr.exe
  C:\Windows\System\kyIRgdr.exe
  2⤵
  PID:8920
- C:\Windows\System\KHMtXRR.exe
  C:\Windows\System\KHMtXRR.exe
  2⤵
  PID:8936
- C:\Windows\System\pWLlena.exe
  C:\Windows\System\pWLlena.exe
  2⤵
  PID:8952
- C:\Windows\System\TNdkEiF.exe
  C:\Windows\System\TNdkEiF.exe
  2⤵
  PID:8968
- C:\Windows\System\rQDpXgp.exe
  C:\Windows\System\rQDpXgp.exe
  2⤵
  PID:8984
- C:\Windows\System\pUVNByh.exe
  C:\Windows\System\pUVNByh.exe
  2⤵
  PID:9000
- C:\Windows\System\ewmPCRu.exe
  C:\Windows\System\ewmPCRu.exe
  2⤵
  PID:9016
- C:\Windows\System\dVdHeNH.exe
  C:\Windows\System\dVdHeNH.exe
  2⤵
  PID:9032
- C:\Windows\System\CpataOT.exe
  C:\Windows\System\CpataOT.exe
  2⤵
  PID:9048
- C:\Windows\System\sFBClph.exe
  C:\Windows\System\sFBClph.exe
  2⤵
  PID:9064
- C:\Windows\System\VKgevCf.exe
  C:\Windows\System\VKgevCf.exe
  2⤵
  PID:9080
- C:\Windows\System\eSRFWZE.exe
  C:\Windows\System\eSRFWZE.exe
  2⤵
  PID:9096
- C:\Windows\System\kbKDiID.exe
  C:\Windows\System\kbKDiID.exe
  2⤵
  PID:9124
- C:\Windows\System\FEISbNR.exe
  C:\Windows\System\FEISbNR.exe
  2⤵
  PID:9140
- C:\Windows\System\WUyRFyA.exe
  C:\Windows\System\WUyRFyA.exe
  2⤵
  PID:9156
- C:\Windows\System\wrQwnFu.exe
  C:\Windows\System\wrQwnFu.exe
  2⤵
  PID:9172
- C:\Windows\System\ElgmOUT.exe
  C:\Windows\System\ElgmOUT.exe
  2⤵
  PID:9188
- C:\Windows\System\XhEbcak.exe
  C:\Windows\System\XhEbcak.exe
  2⤵
  PID:9204
- C:\Windows\System\XLwVvLN.exe
  C:\Windows\System\XLwVvLN.exe
  2⤵
  PID:8072
- C:\Windows\System\iIndzhg.exe
  C:\Windows\System\iIndzhg.exe
  2⤵
  PID:7512
- C:\Windows\System\oddyXbI.exe
  C:\Windows\System\oddyXbI.exe
  2⤵
  PID:8040
- C:\Windows\System\IJQQhNR.exe
  C:\Windows\System\IJQQhNR.exe
  2⤵
  PID:8260
- C:\Windows\System\NgPFQbn.exe
  C:\Windows\System\NgPFQbn.exe
  2⤵
  PID:8228
- C:\Windows\System\mXhFcHn.exe
  C:\Windows\System\mXhFcHn.exe
  2⤵
  PID:8328
- C:\Windows\System\TpsMtRL.exe
  C:\Windows\System\TpsMtRL.exe
  2⤵
  PID:8428
- C:\Windows\System\NCoWphK.exe
  C:\Windows\System\NCoWphK.exe
  2⤵
  PID:8348
- C:\Windows\System\JYPgtUN.exe
  C:\Windows\System\JYPgtUN.exe
  2⤵
  PID:8424
- C:\Windows\System\vxYWQCq.exe
  C:\Windows\System\vxYWQCq.exe
  2⤵
  PID:8492
- C:\Windows\System\wqtoJgt.exe
  C:\Windows\System\wqtoJgt.exe
  2⤵
  PID:8516
- C:\Windows\System\iokPypF.exe
  C:\Windows\System\iokPypF.exe
  2⤵
  PID:8672
- C:\Windows\System\rbeHNUd.exe
  C:\Windows\System\rbeHNUd.exe
  2⤵
  PID:8512
- C:\Windows\System\WpUcDlu.exe
  C:\Windows\System\WpUcDlu.exe
  2⤵
  PID:8700
- C:\Windows\System\xukknDV.exe
  C:\Windows\System\xukknDV.exe
  2⤵
  PID:8408
- C:\Windows\System\VomZzST.exe
  C:\Windows\System\VomZzST.exe
  2⤵
  PID:8764
- C:\Windows\System\OmpWPQs.exe
  C:\Windows\System\OmpWPQs.exe
  2⤵
  PID:8832
- C:\Windows\System\QdUdOFl.exe
  C:\Windows\System\QdUdOFl.exe
  2⤵
  PID:8896
- C:\Windows\System\djbHHLM.exe
  C:\Windows\System\djbHHLM.exe
  2⤵
  PID:8960
- C:\Windows\System\JUmZbhe.exe
  C:\Windows\System\JUmZbhe.exe
  2⤵
  PID:8556
- C:\Windows\System\hwVdIga.exe
  C:\Windows\System\hwVdIga.exe
  2⤵
  PID:8588
- C:\Windows\System\FiOKJnr.exe
  C:\Windows\System\FiOKJnr.exe
  2⤵
  PID:8748
- C:\Windows\System\rfSkxTu.exe
  C:\Windows\System\rfSkxTu.exe
  2⤵
  PID:8560
- C:\Windows\System\dDkTTrK.exe
  C:\Windows\System\dDkTTrK.exe
  2⤵
  PID:8656
- C:\Windows\System\Ukaqgtv.exe
  C:\Windows\System\Ukaqgtv.exe
  2⤵
  PID:8720
- C:\Windows\System\xEDrJmN.exe
  C:\Windows\System\xEDrJmN.exe
  2⤵
  PID:8816
- C:\Windows\System\wIiwOBC.exe
  C:\Windows\System\wIiwOBC.exe
  2⤵
  PID:8880
- C:\Windows\System\fXTowme.exe
  C:\Windows\System\fXTowme.exe
  2⤵
  PID:8916
- C:\Windows\System\byWGZIi.exe
  C:\Windows\System\byWGZIi.exe
  2⤵
  PID:9008
- C:\Windows\System\fSVIvNU.exe
  C:\Windows\System\fSVIvNU.exe
  2⤵
  PID:9088
- C:\Windows\System\RFuyIjQ.exe
  C:\Windows\System\RFuyIjQ.exe
  2⤵
  PID:9164
- C:\Windows\System\VDqRveA.exe
  C:\Windows\System\VDqRveA.exe
  2⤵
  PID:9116
- C:\Windows\System\nMPSGkp.exe
  C:\Windows\System\nMPSGkp.exe
  2⤵
  PID:7696
- C:\Windows\System\EWEBEVg.exe
  C:\Windows\System\EWEBEVg.exe
  2⤵
  PID:9152
- C:\Windows\System\vwbnnEH.exe
  C:\Windows\System\vwbnnEH.exe
  2⤵
  PID:8208
- C:\Windows\System\vEzGKZB.exe
  C:\Windows\System\vEzGKZB.exe
  2⤵
  PID:8240
- C:\Windows\System\MtfRZNd.exe
  C:\Windows\System\MtfRZNd.exe
  2⤵
  PID:7796
- C:\Windows\System\pWcpuNw.exe
  C:\Windows\System\pWcpuNw.exe
  2⤵
  PID:8332
- C:\Windows\System\hBbionh.exe
  C:\Windows\System\hBbionh.exe
  2⤵
  PID:8396
- C:\Windows\System\NCDrygs.exe
  C:\Windows\System\NCDrygs.exe
  2⤵
  PID:8668
- C:\Windows\System\vViZmIH.exe
  C:\Windows\System\vViZmIH.exe
  2⤵
  PID:8608
- C:\Windows\System\xBvPpdI.exe
  C:\Windows\System\xBvPpdI.exe
  2⤵
  PID:8868
- C:\Windows\System\HgfMiUy.exe
  C:\Windows\System\HgfMiUy.exe
  2⤵
  PID:9060
- C:\Windows\System\IKCyTLs.exe
  C:\Windows\System\IKCyTLs.exe
  2⤵
  PID:8620
- C:\Windows\System\RZgmtJT.exe
  C:\Windows\System\RZgmtJT.exe
  2⤵
  PID:9044
- C:\Windows\System\VwAjqLR.exe
  C:\Windows\System\VwAjqLR.exe
  2⤵
  PID:9076
- C:\Windows\System\PqMdZue.exe
  C:\Windows\System\PqMdZue.exe
  2⤵
  PID:8540
- C:\Windows\System\SGUegAE.exe
  C:\Windows\System\SGUegAE.exe
  2⤵
  PID:8852
- C:\Windows\System\cTlAjHW.exe
  C:\Windows\System\cTlAjHW.exe
  2⤵
  PID:8980
- C:\Windows\System\zOHBIix.exe
  C:\Windows\System\zOHBIix.exe
  2⤵
  PID:9024
- C:\Windows\System\tDmsqsl.exe
  C:\Windows\System\tDmsqsl.exe
  2⤵
  PID:8976
- C:\Windows\System\ypqowZA.exe
  C:\Windows\System\ypqowZA.exe
  2⤵
  PID:9148
- C:\Windows\System\OkUanhO.exe
  C:\Windows\System\OkUanhO.exe
  2⤵
  PID:8224
- C:\Windows\System\AnFXmek.exe
  C:\Windows\System\AnFXmek.exe
  2⤵
  PID:8520
- C:\Windows\System\ffveprb.exe
  C:\Windows\System\ffveprb.exe
  2⤵
  PID:8944
- C:\Windows\System\PELihLl.exe
  C:\Windows\System\PELihLl.exe
  2⤵
  PID:8504
- C:\Windows\System\SqBfyEb.exe
  C:\Windows\System\SqBfyEb.exe
  2⤵
  PID:9104
- C:\Windows\System\cnvYiry.exe
  C:\Windows\System\cnvYiry.exe
  2⤵
  PID:8508
- C:\Windows\System\CsGFlMq.exe
  C:\Windows\System\CsGFlMq.exe
  2⤵
  PID:8996
- C:\Windows\System\FPNDYMw.exe
  C:\Windows\System\FPNDYMw.exe
  2⤵
  PID:8804
- C:\Windows\System\tMeREIf.exe
  C:\Windows\System\tMeREIf.exe
  2⤵
  PID:8272
- C:\Windows\System\KPYbmXI.exe
  C:\Windows\System\KPYbmXI.exe
  2⤵
  PID:9212
- C:\Windows\System\FKVJMqB.exe
  C:\Windows\System\FKVJMqB.exe
  2⤵
  PID:8604
- C:\Windows\System\ckbSRhx.exe
  C:\Windows\System\ckbSRhx.exe
  2⤵
  PID:8732
- C:\Windows\System\tfjytsY.exe
  C:\Windows\System\tfjytsY.exe
  2⤵
  PID:8848
- C:\Windows\System\CfTFQoo.exe
  C:\Windows\System\CfTFQoo.exe
  2⤵
  PID:8932
- C:\Windows\System\kHrgPue.exe
  C:\Windows\System\kHrgPue.exe
  2⤵
  PID:9180
- C:\Windows\System\mSTlLqJ.exe
  C:\Windows\System\mSTlLqJ.exe
  2⤵
  PID:8388
- C:\Windows\System\bBhhwXI.exe
  C:\Windows\System\bBhhwXI.exe
  2⤵
  PID:8380
- C:\Windows\System\lzHwsaa.exe
  C:\Windows\System\lzHwsaa.exe
  2⤵
  PID:9200
- C:\Windows\System\TJbtGBw.exe
  C:\Windows\System\TJbtGBw.exe
  2⤵
  PID:9120
- C:\Windows\System\lZFrEWW.exe
  C:\Windows\System\lZFrEWW.exe
  2⤵
  PID:9236
- C:\Windows\System\VPJQPhk.exe
  C:\Windows\System\VPJQPhk.exe
  2⤵
  PID:9252
- C:\Windows\System\xZVVzoQ.exe
  C:\Windows\System\xZVVzoQ.exe
  2⤵
  PID:9268
- C:\Windows\System\unKWtJH.exe
  C:\Windows\System\unKWtJH.exe
  2⤵
  PID:9284
- C:\Windows\System\IztFQFs.exe
  C:\Windows\System\IztFQFs.exe
  2⤵
  PID:9300
- C:\Windows\System\jWgUStB.exe
  C:\Windows\System\jWgUStB.exe
  2⤵
  PID:9316
- C:\Windows\System\Svwfzic.exe
  C:\Windows\System\Svwfzic.exe
  2⤵
  PID:9336
- C:\Windows\System\nSkcEtk.exe
  C:\Windows\System\nSkcEtk.exe
  2⤵
  PID:9352
- C:\Windows\System\FFKfugg.exe
  C:\Windows\System\FFKfugg.exe
  2⤵
  PID:9368
- C:\Windows\System\NoPRNWU.exe
  C:\Windows\System\NoPRNWU.exe
  2⤵
  PID:9384
- C:\Windows\System\FwXzXdr.exe
  C:\Windows\System\FwXzXdr.exe
  2⤵
  PID:9400
- C:\Windows\System\lZjXlfj.exe
  C:\Windows\System\lZjXlfj.exe
  2⤵
  PID:9416
- C:\Windows\System\QkZWZEj.exe
  C:\Windows\System\QkZWZEj.exe
  2⤵
  PID:9448
- C:\Windows\System\yycJCHY.exe
  C:\Windows\System\yycJCHY.exe
  2⤵
  PID:9464
- C:\Windows\System\LpGKWyd.exe
  C:\Windows\System\LpGKWyd.exe
  2⤵
  PID:9484
- C:\Windows\System\BoNziso.exe
  C:\Windows\System\BoNziso.exe
  2⤵
  PID:9504
- C:\Windows\System\jOpWLaR.exe
  C:\Windows\System\jOpWLaR.exe
  2⤵
  PID:9520
- C:\Windows\System\DAGopvu.exe
  C:\Windows\System\DAGopvu.exe
  2⤵
  PID:9536
- C:\Windows\System\aVtYwmD.exe
  C:\Windows\System\aVtYwmD.exe
  2⤵
  PID:9552
- C:\Windows\System\GPSJBHB.exe
  C:\Windows\System\GPSJBHB.exe
  2⤵
  PID:9568
- C:\Windows\System\mvcAmzT.exe
  C:\Windows\System\mvcAmzT.exe
  2⤵
  PID:9584
- C:\Windows\System\RqqZXLZ.exe
  C:\Windows\System\RqqZXLZ.exe
  2⤵
  PID:9600
- C:\Windows\System\mCetwsa.exe
  C:\Windows\System\mCetwsa.exe
  2⤵
  PID:9616
- C:\Windows\System\ZyeTKnZ.exe
  C:\Windows\System\ZyeTKnZ.exe
  2⤵
  PID:9632
- C:\Windows\System\jJukpBv.exe
  C:\Windows\System\jJukpBv.exe
  2⤵
  PID:9648
- C:\Windows\System\FlaWAqt.exe
  C:\Windows\System\FlaWAqt.exe
  2⤵
  PID:9664
- C:\Windows\System\RwwVDHC.exe
  C:\Windows\System\RwwVDHC.exe
  2⤵
  PID:9680
- C:\Windows\System\kBgTdUs.exe
  C:\Windows\System\kBgTdUs.exe
  2⤵
  PID:9696
- C:\Windows\System\rxkNmiD.exe
  C:\Windows\System\rxkNmiD.exe
  2⤵
  PID:9712
- C:\Windows\System\SwOOXZQ.exe
  C:\Windows\System\SwOOXZQ.exe
  2⤵
  PID:9728
- C:\Windows\System\wibzaTn.exe
  C:\Windows\System\wibzaTn.exe
  2⤵
  PID:9744
- C:\Windows\System\iYKgCar.exe
  C:\Windows\System\iYKgCar.exe
  2⤵
  PID:9768
- C:\Windows\System\UBzWVzY.exe
  C:\Windows\System\UBzWVzY.exe
  2⤵
  PID:9784
- C:\Windows\System\QTWncRN.exe
  C:\Windows\System\QTWncRN.exe
  2⤵
  PID:9800
- C:\Windows\System\yFDJUUf.exe
  C:\Windows\System\yFDJUUf.exe
  2⤵
  PID:9876
- C:\Windows\System\IKoKrnB.exe
  C:\Windows\System\IKoKrnB.exe
  2⤵
  PID:9900
- C:\Windows\System\GWQcuVD.exe
  C:\Windows\System\GWQcuVD.exe
  2⤵
  PID:9916
- C:\Windows\System\jAOmWEX.exe
  C:\Windows\System\jAOmWEX.exe
  2⤵
  PID:9932
- C:\Windows\System\GWWAgNJ.exe
  C:\Windows\System\GWWAgNJ.exe
  2⤵
  PID:9948
- C:\Windows\System\fKPoqVw.exe
  C:\Windows\System\fKPoqVw.exe
  2⤵
  PID:9964
- C:\Windows\System\beBJguP.exe
  C:\Windows\System\beBJguP.exe
  2⤵
  PID:9980
- C:\Windows\System\eaDgAbX.exe
  C:\Windows\System\eaDgAbX.exe
  2⤵
  PID:9996
- C:\Windows\System\RULLKZN.exe
  C:\Windows\System\RULLKZN.exe
  2⤵
  PID:10012
- C:\Windows\System\yhMWnhf.exe
  C:\Windows\System\yhMWnhf.exe
  2⤵
  PID:10032
- C:\Windows\System\TBTDhxx.exe
  C:\Windows\System\TBTDhxx.exe
  2⤵
  PID:10048
- C:\Windows\System\wNhGuvh.exe
  C:\Windows\System\wNhGuvh.exe
  2⤵
  PID:10064
- C:\Windows\System\SDhCccD.exe
  C:\Windows\System\SDhCccD.exe
  2⤵
  PID:10080
- C:\Windows\System\xSPRryc.exe
  C:\Windows\System\xSPRryc.exe
  2⤵
  PID:10096
- C:\Windows\System\QwjDELA.exe
  C:\Windows\System\QwjDELA.exe
  2⤵
  PID:10112
- C:\Windows\System\npjfpfZ.exe
  C:\Windows\System\npjfpfZ.exe
  2⤵
  PID:10128
- C:\Windows\System\fwgAZwM.exe
  C:\Windows\System\fwgAZwM.exe
  2⤵
  PID:10144
- C:\Windows\System\osyqplH.exe
  C:\Windows\System\osyqplH.exe
  2⤵
  PID:10160
- C:\Windows\System\kIZAqQu.exe
  C:\Windows\System\kIZAqQu.exe
  2⤵
  PID:10176
- C:\Windows\System\WUNDyEy.exe
  C:\Windows\System\WUNDyEy.exe
  2⤵
  PID:10192
- C:\Windows\System\TqkuySl.exe
  C:\Windows\System\TqkuySl.exe
  2⤵
  PID:10208
- C:\Windows\System\UQIFOnu.exe
  C:\Windows\System\UQIFOnu.exe
  2⤵
  PID:10228
- C:\Windows\System\ikYWBom.exe
  C:\Windows\System\ikYWBom.exe
  2⤵
  PID:8640
- C:\Windows\System\OGSecUh.exe
  C:\Windows\System\OGSecUh.exe
  2⤵
  PID:9264
- C:\Windows\System\zXMulqw.exe
  C:\Windows\System\zXMulqw.exe
  2⤵
  PID:9292
- C:\Windows\System\XXdLEma.exe
  C:\Windows\System\XXdLEma.exe
  2⤵
  PID:9332
- C:\Windows\System\yzamKXy.exe
  C:\Windows\System\yzamKXy.exe
  2⤵
  PID:9012
- C:\Windows\System\SiRakLi.exe
  C:\Windows\System\SiRakLi.exe
  2⤵
  PID:9248
- C:\Windows\System\MIWLlqn.exe
  C:\Windows\System\MIWLlqn.exe
  2⤵
  PID:9312
- C:\Windows\System\FOgvaPY.exe
  C:\Windows\System\FOgvaPY.exe
  2⤵
  PID:9392
- C:\Windows\System\GITdLiX.exe
  C:\Windows\System\GITdLiX.exe
  2⤵
  PID:9408
- C:\Windows\System\rNfobkl.exe
  C:\Windows\System\rNfobkl.exe
  2⤵
  PID:9184
- C:\Windows\System\gVxyJAX.exe
  C:\Windows\System\gVxyJAX.exe
  2⤵
  PID:9516
- C:\Windows\System\DqXkCCY.exe
  C:\Windows\System\DqXkCCY.exe
  2⤵
  PID:9544
- C:\Windows\System\iYzmUIR.exe
  C:\Windows\System\iYzmUIR.exe
  2⤵
  PID:9528
- C:\Windows\System\npOubxJ.exe
  C:\Windows\System\npOubxJ.exe
  2⤵
  PID:9640
- C:\Windows\System\pJEKnMn.exe
  C:\Windows\System\pJEKnMn.exe
  2⤵
  PID:9676
- C:\Windows\System\KLtlwRy.exe
  C:\Windows\System\KLtlwRy.exe
  2⤵
  PID:9740
- C:\Windows\System\aIsCgWy.exe
  C:\Windows\System\aIsCgWy.exe
  2⤵
  PID:9560
- C:\Windows\System\OltgDBD.exe
  C:\Windows\System\OltgDBD.exe
  2⤵
  PID:9688
- C:\Windows\System\vsIRfLN.exe
  C:\Windows\System\vsIRfLN.exe
  2⤵
  PID:9796
- C:\Windows\System\QyYQkUA.exe
  C:\Windows\System\QyYQkUA.exe
  2⤵
  PID:9832
- C:\Windows\System\zHsHZcn.exe
  C:\Windows\System\zHsHZcn.exe
  2⤵
  PID:9840
- C:\Windows\System\IiKFjpV.exe
  C:\Windows\System\IiKFjpV.exe
  2⤵
  PID:10040
- C:\Windows\System\xCtNEWR.exe
  C:\Windows\System\xCtNEWR.exe
  2⤵
  PID:10104
- C:\Windows\System\oVNGZmj.exe
  C:\Windows\System\oVNGZmj.exe
  2⤵
  PID:10136
- C:\Windows\System\iDBGOwR.exe
  C:\Windows\System\iDBGOwR.exe
  2⤵
  PID:9864
- C:\Windows\System\ajWyPDY.exe
  C:\Windows\System\ajWyPDY.exe
  2⤵
  PID:9872
- C:\Windows\System\XGREXgd.exe
  C:\Windows\System\XGREXgd.exe
  2⤵
  PID:9972
- C:\Windows\System\AAbeyan.exe
  C:\Windows\System\AAbeyan.exe
  2⤵
  PID:8784
- C:\Windows\System\lSIhpBR.exe
  C:\Windows\System\lSIhpBR.exe
  2⤵
  PID:10152
- C:\Windows\System\oWgecdU.exe
  C:\Windows\System\oWgecdU.exe
  2⤵
  PID:9380
- C:\Windows\System\pwAKqny.exe
  C:\Windows\System\pwAKqny.exe
  2⤵
  PID:8736
- C:\Windows\System\aAYzPxz.exe
  C:\Windows\System\aAYzPxz.exe
  2⤵
  PID:9364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AsieDFQ.exe

Filesize
1.7MB

MD5
b639c96dc16adcb0a8fc78c1f26e4885

SHA1
fd27ef60e38f65c5e16bf8ee473072d92a34e88f

SHA256
439c47c6eddbac1c49ebf46b21e792655954a9a6371be95d157ff8d21c1a8859

SHA512
2a78eea2512e990ac3400638c7770110c7f143727ad741f60b418fa99925bee68b9a23402bb7cae285483c84b925b2590dfab98eccb8b887163358a9554b3fe8

Download Submit
C:\Windows\system\BsYgKeY.exe

Filesize
1.7MB

MD5
aa2b181a8f0c8b6efaa63f0d775f654a

SHA1
b7274b74d4f4cb4ab654d97dbd2678fa85e16a4f

SHA256
26eac5ebf4cddd9a509dea4d7f3eca5e0c2e1208f718c48b319122eaadec774a

SHA512
8961d09eafe7ba2ed19131ba6e852576c64338ba266788e0cc16251b5fd5a76f6b069fa30fdb951d6c397c5feb7fe5e437c347977964520feabec16e62bc9a7f

Download Submit
C:\Windows\system\DAEhILh.exe

Filesize
1.7MB

MD5
4f7a5d96c5eae92035bffa42ddab2c36

SHA1
bd854231f8a455588d3d91c4406cf312269d7349

SHA256
4d4b1cb809f01f45960999d80bbf82f7dd3081e128cb99b908ea296159dc619a

SHA512
d674fd90ba0d325d299dd2b601cf41654e38961a3045f84161681eaaf45ee63f6ca78910698592da02b30c4a657f83f6333b332e99ade6dfbf42a055cf0fd619

Download Submit
C:\Windows\system\GUKdPNh.exe

Filesize
1.7MB

MD5
e00b061f5907e95db09f4c4060919f61

SHA1
78884f5edfde243d11c0a4c5238a49a531513b39

SHA256
3cebe8752c6b37da3be358ce464a2c48f05a3daa77b7b2311e65d38c995adf58

SHA512
27e7a1d30650cc2bddc4a7760ff00f79b45ba8d7f7d09b2b231630f3bdd77643a3da4323aac83a893397f680403debe57cf6b7e4d151086fb38482fe403d732f

Download Submit
C:\Windows\system\LbiDEGK.exe

Filesize
1.7MB

MD5
ad89d7ff7818d461d97da9ee6cd15aac

SHA1
271213e654ed03c57ed575168f89c9483f99d350

SHA256
db9cba82dd515b2dc363322802eec5e29b93715aebe9cc8e8e58352b56682c7b

SHA512
a4dc48b7202bbc03870490249f7b31c30c23ac8c3134f22137ef1ef5893b4332056dc7b8706f5053f0c20999dac2d5b457325a187f8cd2bcc99057e48d794152

Download Submit
C:\Windows\system\MCsePnq.exe

Filesize
1.7MB

MD5
53311221aaa41745e1021314407704ff

SHA1
b81bc53edb11dc4b7c044f6fad6d516efb2bf6f6

SHA256
52775a4ded7c87c30e271a5341e3d0149f1d1056bbbe929f209e4a6afffb6deb

SHA512
11f0c42fd0b7cedf02b9451f63966cd9b5b21138fadef5bd7f6a11873481ad7b957475ac0f37fbf534554acb23533577e855186a5faafeeda3451f6965920f26

Download Submit
C:\Windows\system\MLeqQeZ.exe

Filesize
1.7MB

MD5
97aa21ca36ea9853dba243179ac6d754

SHA1
174bb6acf811cbf271db14658df9779ebdb991c1

SHA256
546470816fd21dcacac16b5605cd142130a445e6410710e0945d4a8d42b9e412

SHA512
cc23756c10ceb0c5bee650e7b37b1fcd5d87bb8955175b7b45f2449b45f259acc22a2407db1da7bf19ca58653ce312b769ec7fb5824cf752e46ce6ab909dcc54

Download Submit
C:\Windows\system\MVZTXEn.exe

Filesize
1.7MB

MD5
fe666d402e41928c3be8aefaa01e1467

SHA1
888337cc811b861de42a517e44bed67685188cd8

SHA256
ace41ee4e9fe812361f60bde53de209fe92697f953fc0eda3f3665d2ea46b3d9

SHA512
48ae3b69af49d27d76c54cf0a807634e4475fca0c84111a7cb074b31af5a964c56d9e0d00b1443749dc685bd4a4a5cd2cebbbd86e80241affca37a64415d14e6

Download Submit
C:\Windows\system\PjfKsnC.exe

Filesize
1.7MB

MD5
9901fe0da81ee71c8b112ecec03eed8f

SHA1
c68109a904600622ca0620a0315552aff75f4649

SHA256
a9adf33adec61372c50a04fad1d4d754ba63c277ad89351a4116539afdca4581

SHA512
bb13e5b60fe4aab356c42784b2d25f826e540f8de1abbaafe1f33c424151748458f76fefcbe2048ad965e3fd26aef35c9132c945a02c9cd0ace2640ae7d0b359

Download Submit
C:\Windows\system\RzLIYdN.exe

Filesize
1.7MB

MD5
303ee623b054e5040e44ffdbdfa5ae38

SHA1
c3374ec0f6dfe53f555ff769752e077a4091f485

SHA256
de06360b379063cd39b4257b577d057ecf835c657db23dd32f7689c25b58f218

SHA512
2bc230fad5520bc2500105112ebf759d6b97d9272cc295188d6bbc1ebe09717e81e069a8550b5379bb603a191baa1cec7d108de373c21b2ed757c6a30144839b

Download Submit
C:\Windows\system\WBvECJy.exe

Filesize
1.7MB

MD5
63f134b51e72b27c33c927267a90310d

SHA1
80c785d5dda9acfdc64241eea25fb0ff28252b8f

SHA256
f64a97622bf0fe8f6a70e82f4f8cbeb4c7d46896cd1dc9f6f7083835ca4a45a7

SHA512
b5000b23f7c6eb04aaf4d3ade81d53c825dfda1a484a9658f86a8f46c661657b15ea08660fb53490ffe29ca6798e88bc46a93288413b6bc55d83778e76d11caf

Download Submit
C:\Windows\system\WXPuWnf.exe

Filesize
1.7MB

MD5
fa982331788d764bfc4558ec71f2b8dd

SHA1
65d9d3d45cb04567f1682da548c730414eb8ef67

SHA256
efa29d9b31a6ef73ee990ca38b47de0e03ed0474f1dbf8e76b13e5f0198218eb

SHA512
048f7b3cc3cd6fd2181ac923cb5939ab7b290332288bac6b099ef4cafdb7549f7f5d45e8bc668b95d6c220d59ce9d82b8cb08375bb84ed4303ad8b7984c170f2

Download Submit
C:\Windows\system\YbyPOms.exe

Filesize
1.7MB

MD5
9297ffea2281a4b2a699a8efbf0b5859

SHA1
9b3f7f1abb55d46bb6135f99dcfc309d3b258b97

SHA256
7d1368a38c3281cf5ea3df99ef6d9d68522121c19181b31d0ce24dc4852bd08c

SHA512
3fd3e4c94380862a3dab1c01587e2cc781f86d9f6d63a0cc5e95af47cd339488496e228762ca6a0aa8949c5d202e46bad9caa74341e36b24535c47d917426813

Download Submit
C:\Windows\system\bKfYCzm.exe

Filesize
1.7MB

MD5
3895b4755c8ed0f696a9875827210602

SHA1
aa5984b478311c7ae273880f4b1249e2fbae9f18

SHA256
51038946bee178959ff29e6f03a5ed7b59351ad9f55b98c621986d460d0863dd

SHA512
43db9897dbbe73a1cad3bd575df093a2bfdae300355ffb3544a953e575c36a91a24ad88b7ea9423df377098df8b277eef06cc2d995506025b4209c116499a865

Download Submit
C:\Windows\system\dPmIyvJ.exe

Filesize
1.7MB

MD5
0d418ed51ced6baf03b5661ec356fe45

SHA1
fd350e74c9e8e0a8b98b8d77de6cd1000eea77a0

SHA256
2229c158ba51323bee344ba2cd17e473e926f7d0e66f22a6160cf134b777fc4a

SHA512
100dbd1cd7323e502f0ae703210e975d37ae1a76503917ac5a1b2b0cc600dccd594da4c57fe48952da68a2bbbaba63e9d64fd3faf86cf6f63449d65957ec6455

Download Submit
C:\Windows\system\dtiMDwH.exe

Filesize
1.7MB

MD5
84110bb4f32a5231266ca6f2b57a4cb3

SHA1
031b40810e4b52b513b6849f8e1577d0cbe30c91

SHA256
7b11dfc1d518958f18861f2df9e66107431d9fd762c71c37962173c648d9c700

SHA512
4cfbc3e629503869acfee523929d9aec8576de1900dd48cd6461db1c2155764ffa09216f40795abba15109860f5d3d42b2ac5e91e89f68494a6db211bd9842be

Download Submit
C:\Windows\system\jrEcLFw.exe

Filesize
1.7MB

MD5
2722781a6509ddf0fd6d13388fad98dc

SHA1
bb61abe9a13ffbf7bef0c703854f52c1c89626fb

SHA256
6b9a4334d26411e9323cbaa618dcce1272f822ae6548ff7ad1e99dd151ee22b8

SHA512
87a0ac5351e05d9c4ac761d51db224f71e6d0159325d9a752e75d0369b7854b81f8fd22747d6bf4ff977f73857ad9bac7c9304fda467ae6d9f9fcf9237cf76e4

Download Submit
C:\Windows\system\vblgJaB.exe

Filesize
1.7MB

MD5
9d2abae87808751f770a8d72864c61a0

SHA1
b9c1ce516bc8da7330c786c90f7a53ab25b1807c

SHA256
beeaebe1544877605e357a163420581fdb1241a9bc92a291c22eaa7afa01ec2a

SHA512
91cabc71b92fced1bb4acf32203bf6da92554a8fb6df122e9a1bdc8ebfca9ab26606400967d55779de635e439da71a3822ebc08d28d3f0916b6ac0b2fa549a46

Download Submit
C:\Windows\system\vkdfoMH.exe

Filesize
1.7MB

MD5
82ef764b3bb37f0e7fbcdba8df27217c

SHA1
9e55d6285a70eba365a7cd4a513e53a2cb351284

SHA256
353f232bd36bf7d4bef45e89ed17200133d06afdf43c48877220c83dd2c32d2e

SHA512
d446227a3c741c0f371e599cdbba457cc5411ba8e8c75901f8779c4fcd3e434ff5fae3d0d14bced7144db3b89a6613d7c7d0b460b1d5f54d3feee15d7ae30ab1

Download Submit
C:\Windows\system\ylqxHEQ.exe

Filesize
1.7MB

MD5
0bfb540475cb41cacef30bf5bebd3a7c

SHA1
f6ae594d2375626407b2b1d5c4693249fbbed59b

SHA256
8b3ed99f0e532cbc744012739f3c41aed69ca5c0f9a7e166a4055947c9ce1f10

SHA512
b5a2ca912ea64e3eebece18a69c20d6a72e9e6def8fbbd0f0f8c6835a580936a0c6a0562d99e50d6e50fb8bf47e3fa581916eac43066125d577fa5d595717b60

Download Submit
\Windows\system\BNrXdpm.exe

Filesize
1.7MB

MD5
c3a8c632d6a753724fc10898367f8874

SHA1
01f9a224784537547a274f29243c664bfe20181d

SHA256
0b076a440fdcdd5f2ca297c1e06b1643e9624377e4631c3d99835a02b71ea92c

SHA512
e2447bbd8b9b7e61d9188e773f963c2c4492ff8442854e497726f9ca42854285efcc73f9d6dae9855308459c03ebe62595c47bddef740fecdaa9e52709a10c6e

Download Submit
\Windows\system\ClslKQf.exe

Filesize
1.7MB

MD5
0a23959625488f3fc8497e2aca622fd5

SHA1
ee045cf6268a5c09b218fbf3036d09f5782b5447

SHA256
d0740ef47d462343a06dc702ec8c0c1a927f83435aff634a2bd553b05f08f20e

SHA512
633485c0a9980a2b0e6e82af7284ef70e69a6b50cd5008dc0eee5cc8337e0f78a806e278dcf3139f28101a6535c16be149644f46bc0ea407c0db1ac5d0430aba

Download Submit
\Windows\system\EPaBfjx.exe

Filesize
1.7MB

MD5
1a3db96242079471b38d9a509ad7c9f5

SHA1
1bc9715090de6efe68f1303cccb61351a3047104

SHA256
2794c760dc4393d59bc0c51abcbbf1553d177780cb11ea7db46e22923129c0fb

SHA512
a6cca5cdba9978a3566f25eba8eedf43b279a3460376ca0ddbe56b489853a36c2e0bb30ef04554ba92e2056a2ae9ea714ec19625cb0f06147d9062a0d5a66399

Download Submit
\Windows\system\SnFfqPw.exe

Filesize
1.7MB

MD5
398d14a4c9434e422dca54fe060a23f3

SHA1
ab7939ee63a30da1df337d33495a21432f78845b

SHA256
46507e3e3dbdd0cc307e60d17efb6aed6bdf54b7850151e4c865f93434f0b71d

SHA512
0bfad11fc7db765b0f7e3ac0e544e87b95cd407e9de9388f1773247a7b795ea408efcf46db9dc6cc25371d4f8cb4b22959e04be27a664a37d36e98429ca3cfd8

Download Submit
\Windows\system\UrpNqyn.exe

Filesize
1.7MB

MD5
aa658a3182d3246710ffffbbb4cd9972

SHA1
2d0042853be0c9c8dbf2e8af6e81d580721d0837

SHA256
73042ab24a372f4534a3cfb517be47f63c561e6f5f1cac685262e8c6d82865b3

SHA512
a7da55e72b10b24511ffbfdb79f6724e510c175826b847210df37eb0db4ce008d3c5e708e05894e622376ad12d73305a44c432336f8d4f855fb6c74cba272d7f

Download Submit
\Windows\system\Vbvsudn.exe

Filesize
1.7MB

MD5
0966f9d453f89c62f951816a62d9d009

SHA1
05624c08dfecd9ff4033755e3fdce7f4f0b3fb37

SHA256
efb8ade002a8af2be1a226a9bb238f87b289cc5252389143cfa3116c3a748b35

SHA512
b6ec6fe1dac690854ed4223b87be487d87c31b0b099f005a3b4af4534f3884492e08ca4f26d6371561b1519414addcb5cf2616405ba3686408ddba481a676fe7

Download Submit
\Windows\system\edAYEOH.exe

Filesize
1.7MB

MD5
b14589fd32c2f984c2222d6c69b3b8b7

SHA1
ea44e73ba69c02cdfab897a9e21c713d5dffba7d

SHA256
1645da78d3af9978bb1e388578aef727ebdf36f95e43c01dfac5391111810b8d

SHA512
e2416ca8bbdcd1b85d0908e6d2aa07cf7b81a6f9958c6f062ecf423fe7889ef91a472d467e96dc576c0afb67c5b3fb3b0660884f1f2a5027764221c28be79415

Download Submit
\Windows\system\fXZLJrG.exe

Filesize
1.7MB

MD5
bca9800cf369df424186a31d77407989

SHA1
867447b2153d6df660307afade4e1b4cd0323ca2

SHA256
969c372be7479a8f1f6267e64a6a45de4d3df22d83c9e1a0773cec296c3b8830

SHA512
c7d7760c3ed1403fe1327b7c761b081845308c513b1fa15a0c339b01083a13ff166467334cb85a98ea790eb47e9e7cf3c44efbb087845b9963a326535e5329a8

Download Submit
\Windows\system\icMAgPU.exe

Filesize
1.7MB

MD5
e52a8c19bfa8c0bd81212c9b7e58ac5b

SHA1
9131bcba3535e8be6d082822ad98242ba0e51e0c

SHA256
66c8414e350770be9595fd3c76f4da662568928a039e1851122f1b8fbe7af7bb

SHA512
860d9c81b1ec88a55648f21c5e83f7cb652cf600e433ee75f3dad5bdce53300c36987f06e16e261919fff4023b44eb25b0767e8b0cb47175e0b271f313d6ee7b

Download Submit
\Windows\system\oNEhnvZ.exe

Filesize
1.7MB

MD5
6391a8d2cde604d494c6ce1f9c1267b1

SHA1
e43b6a757c60de5f4843e43e80905b0403cd4587

SHA256
aa037ee08ba9a45e9e6f9628bd6246dccac6ceea9608b9dcb44576940b548688

SHA512
9d3676edc742b84b75877b8d61d23653b938eedacdafd2cdf848dbdc413267d8bbc392083458883334f70fc98fa664449ca879d5e86fe1ad6066d58488e5d281

Download Submit
\Windows\system\tCSrBDU.exe

Filesize
1.7MB

MD5
d6be1b1710134bf3591ac31123395f1c

SHA1
833f8b76da847e9bafb2c77887169351cdc780a7

SHA256
245bc1ddb7d39ff41fd3acbf15ad59810763820fa0aa18ea12b442ce479b5481

SHA512
84d3e4e3c5a2655e58e6df87a0a59119decee4ca0c90e2d2d73117b075f2c366354646318914f82f9fa1414d011e7afe3acb48b0473f3e47948a1b3a1cdf60d1

Download Submit
\Windows\system\ujXcrxn.exe

Filesize
1.7MB

MD5
4c2a8645fd5e4152e5dc7f99a0093618

SHA1
3673a67b8f3a3a222e7bddbbc77ac6256b5b685c

SHA256
cbfcba8e4e0e3e4642c5f05ca0589ca421635dcdf246b8bbdb2b65f0ddb2750e

SHA512
5ed95eb4ccb90c70a7dffd2a6dd27896498fbe154d48d68a030686313433b8941220524313352c3b9b4929bd27c84f93c27d4193945ee388e93c5bb03a4f86d2

Download Submit
memory/112-137-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/112-26-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/112-42-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/112-27-0x000007FEF561E000-0x000007FEF561F000-memory.dmp

Filesize
4KB

Download
memory/112-109-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/112-77-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/112-47-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/112-41-0x000000001B2D0000-0x000000001B5B2000-memory.dmp

Filesize
2.9MB

Download
memory/552-119-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/552-4070-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/752-118-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/752-3960-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1284-115-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/1284-116-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/1284-14-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/1284-117-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-108-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-112-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1284-123-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-0-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/1284-105-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-122-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/1284-29-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-121-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1284-113-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-120-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-7-0x0000000002DE0000-0x00000000031D2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-4519-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2224-103-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2420-4415-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-111-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-107-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-4009-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-3942-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2548-25-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2700-4114-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2700-23-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2844-124-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-4112-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-4069-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-9-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3040-4541-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3040-114-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download