xmrig | 5c7a2b24b54e6a1a64340648c4a0213666e62369b816c2031a84feae954f1233

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
Size

2.0MB
MD5

18415e676f0e0386866b883fbd1a4acd
SHA1

e2be1a8fb28940949c7a5eb0f5a24c3f9227b68a
SHA256

5c7a2b24b54e6a1a64340648c4a0213666e62369b816c2031a84feae954f1233
SHA512

3937e4158e2f613a82a092b62ddcd350b5ce6f64db91c5bd672e40a2264deda4a4b3c3f83ba12475e4253bd3e6033a1ee3fb7a74331f558f132a2a4374cdc1c7
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafm4i:NAB7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2700-34-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2896-26-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2148-21-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2804-542-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2816-551-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/776-90-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2944-89-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/372-84-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2764-83-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2444-82-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2336-81-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2408-78-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2764-2751-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2524-2762-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2816-2760-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2148-3196-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2896-3511-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2700-3501-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2336-3523-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/372-3522-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2408-3547-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2944-3549-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/776-3552-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2444-3558-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2220	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2816	LNHCPtD.exe
2148	ezGwfRO.exe
2896	CaQauCn.exe
2700	VpNTUIa.exe
2524	enuipTU.exe
2336	NkWQiCu.exe
2444	NEVdxFA.exe
2764	mTsXWjN.exe
372	iEiJnMt.exe
2408	LotGRMJ.exe
2944	YxDKveO.exe
776	uClcDcO.exe
964	BunowLm.exe
1840	ANrfInx.exe
1932	InnBugs.exe
2184	zTAtxgc.exe
2304	qwEeFDl.exe
1156	hdmbecQ.exe
1360	EytTSEf.exe
2136	ocTACWQ.exe
2020	tNpZHHP.exe
2308	sZEKkwF.exe
1776	mRWAgtr.exe
1780	KyYAxpr.exe
1756	UWEZpAt.exe
1956	xzvAsiO.exe
3012	jcBcstT.exe
2420	YduzdUI.exe
2644	KzvzSCY.exe
2576	vIWIvzj.exe
436	nORRhwz.exe
2996	Kpxtebd.exe
1844	aglikEF.exe
1572	NJmhRuf.exe
2884	CvgSVzK.exe
2596	vhngtvO.exe
720	VhdsRhP.exe
328	VnmCntf.exe
1980	okchAzA.exe
1964	IgODgzY.exe
1976	kaLiVNT.exe
604	Pfxeqvp.exe
2852	NEGkPiM.exe
2124	NfxUJgo.exe
1088	tAMCqYX.exe
1752	MPXKaZB.exe
2888	JVFUNju.exe
2260	kcaahKw.exe
1536	IWwKBks.exe
880	gqbybqw.exe
1164	NhHRNPG.exe
1056	lxYviBf.exe
1588	qrTXJhl.exe
1604	zYAHOKh.exe
1324	fpqqXGX.exe
2476	IkVkvRT.exe
3068	XSvyIgS.exe
2492	wRnNLPl.exe
2628	eRXCELp.exe
2352	DUxFsEr.exe
2436	hsNrccQ.exe
2100	QWrsfoa.exe
1848	WiuwXJq.exe
1424	kMRqHKm.exe

Loads dropped DLL 64 IoCs

pid	Process
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2804-0-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x0007000000015c3c-31.dat	upx
behavioral1/files/0x0007000000015c2f-35.dat	upx
behavioral1/memory/2524-36-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2700-34-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2896-26-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2148-21-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x00090000000155e2-12.dat	upx
behavioral1/files/0x000f0000000006fd-50.dat	upx
behavioral1/files/0x0009000000015c52-44.dat	upx
behavioral1/files/0x0006000000016476-94.dat	upx
behavioral1/files/0x00060000000165ae-97.dat	upx
behavioral1/files/0x00060000000167db-109.dat	upx
behavioral1/files/0x0006000000016b96-119.dat	upx
behavioral1/files/0x0006000000016c1a-129.dat	upx
behavioral1/files/0x0006000000016ccf-146.dat	upx
behavioral1/files/0x0006000000016d24-173.dat	upx
behavioral1/files/0x0006000000016d36-179.dat	upx
behavioral1/memory/2804-542-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2816-551-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d4a-189.dat	upx
behavioral1/files/0x0006000000016d41-184.dat	upx
behavioral1/files/0x0006000000016d11-169.dat	upx
behavioral1/files/0x0006000000016cf0-160.dat	upx
behavioral1/files/0x0006000000016d01-163.dat	upx
behavioral1/files/0x0006000000016c90-140.dat	upx
behavioral1/files/0x0006000000016cd4-152.dat	upx
behavioral1/files/0x0006000000016ca9-144.dat	upx
behavioral1/files/0x0006000000016c23-134.dat	upx
behavioral1/files/0x0006000000016c10-124.dat	upx
behavioral1/files/0x0006000000016b5e-114.dat	upx
behavioral1/files/0x000600000001663d-104.dat	upx
behavioral1/memory/776-90-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2944-89-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x0006000000016332-87.dat	upx
behavioral1/files/0x000600000001604b-86.dat	upx
behavioral1/memory/372-84-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2764-83-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2444-82-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2336-81-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2408-78-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x0007000000016042-73.dat	upx
behavioral1/files/0x0006000000016283-68.dat	upx
behavioral1/files/0x000900000001560a-60.dat	upx
behavioral1/files/0x0008000000015c23-16.dat	upx
behavioral1/memory/2816-8-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x000b000000014fe1-6.dat	upx
behavioral1/memory/2764-2751-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2524-2762-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2816-2760-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2148-3196-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/2896-3511-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2700-3501-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2336-3523-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/372-3522-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2408-3547-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2944-3549-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/776-3552-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2444-3558-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UTBeiwz.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\HwShgqA.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\pCyACuO.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\zNqMmkn.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\NNcElee.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\qOhJMOo.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\RALROAc.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\FCmXoKF.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\xwZxksv.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\sokvBQI.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\bFfgbWr.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\wwtcKAx.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\upOHCFk.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\aHAwDoK.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\ZSDWzzZ.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\OmZvNXt.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\JbQPuru.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\lpSyuLM.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\eERnUlb.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\wuznAPi.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\YGVftMz.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\NrNlosy.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\WQNzXWg.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\CJdMYiB.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\oHkTwMU.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\nPNGbot.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\SogmtCw.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\uPzdAeJ.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\EvjdUAV.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\fmVbUuS.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\HwsgoFC.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\SXuNYdn.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\AItTrLZ.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\zbfFtSG.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\bkUnkmo.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\uvuqqIT.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\BkERLCj.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\ilvqMOq.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\tMywAJm.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\EyywkFL.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\YxDKveO.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\nCoLqGc.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\KoLqKRk.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\UfouSDH.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\ivHlUEA.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\SgxYhcT.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\waVqSOU.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\gXJZwvL.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\UJAArEz.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\TgmtNTn.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\yVsDUMA.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\gdlDplJ.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\XqtoJyB.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\eyUjaFv.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\EjBJnDA.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\fPqWwij.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\cCKoAkM.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\kPtrfaj.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\uiqiXwO.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\afZUtLh.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\cFktAIf.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\efzkrvY.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\AHSjiLD.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
File created	C:\Windows\System\DDOoxDK.exe	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2220	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
Token: SeDebugPrivilege	2220	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2220	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	29
PID 2804 wrote to memory of 2220	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	29
PID 2804 wrote to memory of 2220	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	29
PID 2804 wrote to memory of 2816	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2816	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2816	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2148	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2148	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2148	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	31
PID 2804 wrote to memory of 2896	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	32
PID 2804 wrote to memory of 2896	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	32
PID 2804 wrote to memory of 2896	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	32
PID 2804 wrote to memory of 2524	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	33
PID 2804 wrote to memory of 2524	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	33
PID 2804 wrote to memory of 2524	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	33
PID 2804 wrote to memory of 2700	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	34
PID 2804 wrote to memory of 2700	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	34
PID 2804 wrote to memory of 2700	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	34
PID 2804 wrote to memory of 2444	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	35
PID 2804 wrote to memory of 2444	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	35
PID 2804 wrote to memory of 2444	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	35
PID 2804 wrote to memory of 2336	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	36
PID 2804 wrote to memory of 2336	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	36
PID 2804 wrote to memory of 2336	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	36
PID 2804 wrote to memory of 2408	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	37
PID 2804 wrote to memory of 2408	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	37
PID 2804 wrote to memory of 2408	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	37
PID 2804 wrote to memory of 2764	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	38
PID 2804 wrote to memory of 2764	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	38
PID 2804 wrote to memory of 2764	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	38
PID 2804 wrote to memory of 2944	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	39
PID 2804 wrote to memory of 2944	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	39
PID 2804 wrote to memory of 2944	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	39
PID 2804 wrote to memory of 372	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	40
PID 2804 wrote to memory of 372	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	40
PID 2804 wrote to memory of 372	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	40
PID 2804 wrote to memory of 776	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	41
PID 2804 wrote to memory of 776	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	41
PID 2804 wrote to memory of 776	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	41
PID 2804 wrote to memory of 964	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	42
PID 2804 wrote to memory of 964	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	42
PID 2804 wrote to memory of 964	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	42
PID 2804 wrote to memory of 1840	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	43
PID 2804 wrote to memory of 1840	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	43
PID 2804 wrote to memory of 1840	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	43
PID 2804 wrote to memory of 1932	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	44
PID 2804 wrote to memory of 1932	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	44
PID 2804 wrote to memory of 1932	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	44
PID 2804 wrote to memory of 2184	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	45
PID 2804 wrote to memory of 2184	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	45
PID 2804 wrote to memory of 2184	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	45
PID 2804 wrote to memory of 2304	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	46
PID 2804 wrote to memory of 2304	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	46
PID 2804 wrote to memory of 2304	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	46
PID 2804 wrote to memory of 1156	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	47
PID 2804 wrote to memory of 1156	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	47
PID 2804 wrote to memory of 1156	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	47
PID 2804 wrote to memory of 1360	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	48
PID 2804 wrote to memory of 1360	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	48
PID 2804 wrote to memory of 1360	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	48
PID 2804 wrote to memory of 2136	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	49
PID 2804 wrote to memory of 2136	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	49
PID 2804 wrote to memory of 2136	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	49
PID 2804 wrote to memory of 2020	2804	18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18415e676f0e0386866b883fbd1a4acd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\System\LNHCPtD.exe
  C:\Windows\System\LNHCPtD.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ezGwfRO.exe
  C:\Windows\System\ezGwfRO.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\CaQauCn.exe
  C:\Windows\System\CaQauCn.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\enuipTU.exe
  C:\Windows\System\enuipTU.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\VpNTUIa.exe
  C:\Windows\System\VpNTUIa.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\NEVdxFA.exe
  C:\Windows\System\NEVdxFA.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\NkWQiCu.exe
  C:\Windows\System\NkWQiCu.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\LotGRMJ.exe
  C:\Windows\System\LotGRMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\mTsXWjN.exe
  C:\Windows\System\mTsXWjN.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\YxDKveO.exe
  C:\Windows\System\YxDKveO.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\iEiJnMt.exe
  C:\Windows\System\iEiJnMt.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\uClcDcO.exe
  C:\Windows\System\uClcDcO.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\BunowLm.exe
  C:\Windows\System\BunowLm.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ANrfInx.exe
  C:\Windows\System\ANrfInx.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\InnBugs.exe
  C:\Windows\System\InnBugs.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\zTAtxgc.exe
  C:\Windows\System\zTAtxgc.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\qwEeFDl.exe
  C:\Windows\System\qwEeFDl.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\hdmbecQ.exe
  C:\Windows\System\hdmbecQ.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\EytTSEf.exe
  C:\Windows\System\EytTSEf.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ocTACWQ.exe
  C:\Windows\System\ocTACWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\tNpZHHP.exe
  C:\Windows\System\tNpZHHP.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\sZEKkwF.exe
  C:\Windows\System\sZEKkwF.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\mRWAgtr.exe
  C:\Windows\System\mRWAgtr.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\UWEZpAt.exe
  C:\Windows\System\UWEZpAt.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\KyYAxpr.exe
  C:\Windows\System\KyYAxpr.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\xzvAsiO.exe
  C:\Windows\System\xzvAsiO.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\jcBcstT.exe
  C:\Windows\System\jcBcstT.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\YduzdUI.exe
  C:\Windows\System\YduzdUI.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\KzvzSCY.exe
  C:\Windows\System\KzvzSCY.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\vIWIvzj.exe
  C:\Windows\System\vIWIvzj.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\nORRhwz.exe
  C:\Windows\System\nORRhwz.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\Kpxtebd.exe
  C:\Windows\System\Kpxtebd.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\aglikEF.exe
  C:\Windows\System\aglikEF.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\NJmhRuf.exe
  C:\Windows\System\NJmhRuf.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\CvgSVzK.exe
  C:\Windows\System\CvgSVzK.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\vhngtvO.exe
  C:\Windows\System\vhngtvO.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\VhdsRhP.exe
  C:\Windows\System\VhdsRhP.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\VnmCntf.exe
  C:\Windows\System\VnmCntf.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\okchAzA.exe
  C:\Windows\System\okchAzA.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\IgODgzY.exe
  C:\Windows\System\IgODgzY.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\kaLiVNT.exe
  C:\Windows\System\kaLiVNT.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\Pfxeqvp.exe
  C:\Windows\System\Pfxeqvp.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\NEGkPiM.exe
  C:\Windows\System\NEGkPiM.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\NfxUJgo.exe
  C:\Windows\System\NfxUJgo.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\tAMCqYX.exe
  C:\Windows\System\tAMCqYX.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\MPXKaZB.exe
  C:\Windows\System\MPXKaZB.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\JVFUNju.exe
  C:\Windows\System\JVFUNju.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\kcaahKw.exe
  C:\Windows\System\kcaahKw.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\IWwKBks.exe
  C:\Windows\System\IWwKBks.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\gqbybqw.exe
  C:\Windows\System\gqbybqw.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\NhHRNPG.exe
  C:\Windows\System\NhHRNPG.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\lxYviBf.exe
  C:\Windows\System\lxYviBf.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\qrTXJhl.exe
  C:\Windows\System\qrTXJhl.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\zYAHOKh.exe
  C:\Windows\System\zYAHOKh.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\fpqqXGX.exe
  C:\Windows\System\fpqqXGX.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\IkVkvRT.exe
  C:\Windows\System\IkVkvRT.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\XSvyIgS.exe
  C:\Windows\System\XSvyIgS.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\wRnNLPl.exe
  C:\Windows\System\wRnNLPl.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\eRXCELp.exe
  C:\Windows\System\eRXCELp.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\DUxFsEr.exe
  C:\Windows\System\DUxFsEr.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\hsNrccQ.exe
  C:\Windows\System\hsNrccQ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\QWrsfoa.exe
  C:\Windows\System\QWrsfoa.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\WiuwXJq.exe
  C:\Windows\System\WiuwXJq.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\kMRqHKm.exe
  C:\Windows\System\kMRqHKm.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\kyFIAYn.exe
  C:\Windows\System\kyFIAYn.exe
  2⤵
  PID:2932
- C:\Windows\System\lycSXPj.exe
  C:\Windows\System\lycSXPj.exe
  2⤵
  PID:2200
- C:\Windows\System\rJbWcUI.exe
  C:\Windows\System\rJbWcUI.exe
  2⤵
  PID:948
- C:\Windows\System\fVbcNFF.exe
  C:\Windows\System\fVbcNFF.exe
  2⤵
  PID:1916
- C:\Windows\System\ElTFRti.exe
  C:\Windows\System\ElTFRti.exe
  2⤵
  PID:2276
- C:\Windows\System\PmdJJWC.exe
  C:\Windows\System\PmdJJWC.exe
  2⤵
  PID:2488
- C:\Windows\System\yqvUkiK.exe
  C:\Windows\System\yqvUkiK.exe
  2⤵
  PID:1556
- C:\Windows\System\roCbJxo.exe
  C:\Windows\System\roCbJxo.exe
  2⤵
  PID:1616
- C:\Windows\System\qUGIxWM.exe
  C:\Windows\System\qUGIxWM.exe
  2⤵
  PID:1680
- C:\Windows\System\WrLYyqA.exe
  C:\Windows\System\WrLYyqA.exe
  2⤵
  PID:1772
- C:\Windows\System\PRVZKoU.exe
  C:\Windows\System\PRVZKoU.exe
  2⤵
  PID:2388
- C:\Windows\System\TPzxGUz.exe
  C:\Windows\System\TPzxGUz.exe
  2⤵
  PID:2140
- C:\Windows\System\wsEdVBs.exe
  C:\Windows\System\wsEdVBs.exe
  2⤵
  PID:3020
- C:\Windows\System\MmioNeh.exe
  C:\Windows\System\MmioNeh.exe
  2⤵
  PID:2580
- C:\Windows\System\mbfvZdV.exe
  C:\Windows\System\mbfvZdV.exe
  2⤵
  PID:2652
- C:\Windows\System\SArEvRc.exe
  C:\Windows\System\SArEvRc.exe
  2⤵
  PID:2708
- C:\Windows\System\qtxSmtY.exe
  C:\Windows\System\qtxSmtY.exe
  2⤵
  PID:1636
- C:\Windows\System\xiQGWHi.exe
  C:\Windows\System\xiQGWHi.exe
  2⤵
  PID:832
- C:\Windows\System\gRNGPly.exe
  C:\Windows\System\gRNGPly.exe
  2⤵
  PID:1828
- C:\Windows\System\ngRGvAS.exe
  C:\Windows\System\ngRGvAS.exe
  2⤵
  PID:980
- C:\Windows\System\cfybUQm.exe
  C:\Windows\System\cfybUQm.exe
  2⤵
  PID:1768
- C:\Windows\System\qfjsUca.exe
  C:\Windows\System\qfjsUca.exe
  2⤵
  PID:2984
- C:\Windows\System\MQMHvlM.exe
  C:\Windows\System\MQMHvlM.exe
  2⤵
  PID:368
- C:\Windows\System\sdROBuc.exe
  C:\Windows\System\sdROBuc.exe
  2⤵
  PID:1992
- C:\Windows\System\HRrpKLi.exe
  C:\Windows\System\HRrpKLi.exe
  2⤵
  PID:2060
- C:\Windows\System\YIxMVMB.exe
  C:\Windows\System\YIxMVMB.exe
  2⤵
  PID:2688
- C:\Windows\System\phlpxDH.exe
  C:\Windows\System\phlpxDH.exe
  2⤵
  PID:2976
- C:\Windows\System\assDDQy.exe
  C:\Windows\System\assDDQy.exe
  2⤵
  PID:1764
- C:\Windows\System\FEchwNC.exe
  C:\Windows\System\FEchwNC.exe
  2⤵
  PID:2116
- C:\Windows\System\ECRdJOj.exe
  C:\Windows\System\ECRdJOj.exe
  2⤵
  PID:1692
- C:\Windows\System\cFktAIf.exe
  C:\Windows\System\cFktAIf.exe
  2⤵
  PID:1712
- C:\Windows\System\ccPbcQY.exe
  C:\Windows\System\ccPbcQY.exe
  2⤵
  PID:2236
- C:\Windows\System\VALHLna.exe
  C:\Windows\System\VALHLna.exe
  2⤵
  PID:1344
- C:\Windows\System\jMNjUse.exe
  C:\Windows\System\jMNjUse.exe
  2⤵
  PID:2456
- C:\Windows\System\OVYeLpJ.exe
  C:\Windows\System\OVYeLpJ.exe
  2⤵
  PID:1540
- C:\Windows\System\SZkWjQE.exe
  C:\Windows\System\SZkWjQE.exe
  2⤵
  PID:2552
- C:\Windows\System\NengMMb.exe
  C:\Windows\System\NengMMb.exe
  2⤵
  PID:2484
- C:\Windows\System\MsutdVi.exe
  C:\Windows\System\MsutdVi.exe
  2⤵
  PID:828
- C:\Windows\System\JeMjmlf.exe
  C:\Windows\System\JeMjmlf.exe
  2⤵
  PID:1124
- C:\Windows\System\HwsgoFC.exe
  C:\Windows\System\HwsgoFC.exe
  2⤵
  PID:460
- C:\Windows\System\MDUIlxE.exe
  C:\Windows\System\MDUIlxE.exe
  2⤵
  PID:952
- C:\Windows\System\OaFnCKb.exe
  C:\Windows\System\OaFnCKb.exe
  2⤵
  PID:572
- C:\Windows\System\nfRagIT.exe
  C:\Windows\System\nfRagIT.exe
  2⤵
  PID:2284
- C:\Windows\System\ClmmeSU.exe
  C:\Windows\System\ClmmeSU.exe
  2⤵
  PID:2320
- C:\Windows\System\eFGTfCb.exe
  C:\Windows\System\eFGTfCb.exe
  2⤵
  PID:1152
- C:\Windows\System\EkJgcyU.exe
  C:\Windows\System\EkJgcyU.exe
  2⤵
  PID:808
- C:\Windows\System\MHttGLM.exe
  C:\Windows\System\MHttGLM.exe
  2⤵
  PID:2752
- C:\Windows\System\jeAKeVA.exe
  C:\Windows\System\jeAKeVA.exe
  2⤵
  PID:2760
- C:\Windows\System\KCGSxyB.exe
  C:\Windows\System\KCGSxyB.exe
  2⤵
  PID:2904
- C:\Windows\System\TDRZDCY.exe
  C:\Windows\System\TDRZDCY.exe
  2⤵
  PID:2712
- C:\Windows\System\TQRZiFr.exe
  C:\Windows\System\TQRZiFr.exe
  2⤵
  PID:2848
- C:\Windows\System\NMOZuXb.exe
  C:\Windows\System\NMOZuXb.exe
  2⤵
  PID:2112
- C:\Windows\System\ZyoHosI.exe
  C:\Windows\System\ZyoHosI.exe
  2⤵
  PID:1624
- C:\Windows\System\GofYkdk.exe
  C:\Windows\System\GofYkdk.exe
  2⤵
  PID:1596
- C:\Windows\System\JAmrzbv.exe
  C:\Windows\System\JAmrzbv.exe
  2⤵
  PID:876
- C:\Windows\System\XzrBHXh.exe
  C:\Windows\System\XzrBHXh.exe
  2⤵
  PID:2072
- C:\Windows\System\kdkYKAM.exe
  C:\Windows\System\kdkYKAM.exe
  2⤵
  PID:2268
- C:\Windows\System\sokvBQI.exe
  C:\Windows\System\sokvBQI.exe
  2⤵
  PID:2472
- C:\Windows\System\hvyqPYK.exe
  C:\Windows\System\hvyqPYK.exe
  2⤵
  PID:1676
- C:\Windows\System\hrmiWKQ.exe
  C:\Windows\System\hrmiWKQ.exe
  2⤵
  PID:2080
- C:\Windows\System\igUtmgQ.exe
  C:\Windows\System\igUtmgQ.exe
  2⤵
  PID:2332
- C:\Windows\System\JoRKWZd.exe
  C:\Windows\System\JoRKWZd.exe
  2⤵
  PID:2144
- C:\Windows\System\hcBvYUX.exe
  C:\Windows\System\hcBvYUX.exe
  2⤵
  PID:2732
- C:\Windows\System\vYavXlR.exe
  C:\Windows\System\vYavXlR.exe
  2⤵
  PID:1784
- C:\Windows\System\NZfQyPl.exe
  C:\Windows\System\NZfQyPl.exe
  2⤵
  PID:940
- C:\Windows\System\hvYESxV.exe
  C:\Windows\System\hvYESxV.exe
  2⤵
  PID:1720
- C:\Windows\System\RDQauzG.exe
  C:\Windows\System\RDQauzG.exe
  2⤵
  PID:2180
- C:\Windows\System\rkIkmVh.exe
  C:\Windows\System\rkIkmVh.exe
  2⤵
  PID:1312
- C:\Windows\System\tMQDaLy.exe
  C:\Windows\System\tMQDaLy.exe
  2⤵
  PID:3016
- C:\Windows\System\BdCiKme.exe
  C:\Windows\System\BdCiKme.exe
  2⤵
  PID:3064
- C:\Windows\System\mVZmnUZ.exe
  C:\Windows\System\mVZmnUZ.exe
  2⤵
  PID:2516
- C:\Windows\System\kwmToPV.exe
  C:\Windows\System\kwmToPV.exe
  2⤵
  PID:1796
- C:\Windows\System\JnJHKYF.exe
  C:\Windows\System\JnJHKYF.exe
  2⤵
  PID:584
- C:\Windows\System\aYamsDH.exe
  C:\Windows\System\aYamsDH.exe
  2⤵
  PID:2120
- C:\Windows\System\pVKhBId.exe
  C:\Windows\System\pVKhBId.exe
  2⤵
  PID:1620
- C:\Windows\System\zhasoAr.exe
  C:\Windows\System\zhasoAr.exe
  2⤵
  PID:904
- C:\Windows\System\flcZxwK.exe
  C:\Windows\System\flcZxwK.exe
  2⤵
  PID:3056
- C:\Windows\System\nTmzIhH.exe
  C:\Windows\System\nTmzIhH.exe
  2⤵
  PID:2792
- C:\Windows\System\zYTGFhA.exe
  C:\Windows\System\zYTGFhA.exe
  2⤵
  PID:1808
- C:\Windows\System\VsJWBSM.exe
  C:\Windows\System\VsJWBSM.exe
  2⤵
  PID:2564
- C:\Windows\System\jcHBZPW.exe
  C:\Windows\System\jcHBZPW.exe
  2⤵
  PID:564
- C:\Windows\System\yLYdCLA.exe
  C:\Windows\System\yLYdCLA.exe
  2⤵
  PID:2676
- C:\Windows\System\IfYBHzG.exe
  C:\Windows\System\IfYBHzG.exe
  2⤵
  PID:2724
- C:\Windows\System\FRDrfKY.exe
  C:\Windows\System\FRDrfKY.exe
  2⤵
  PID:2376
- C:\Windows\System\TUVFtaW.exe
  C:\Windows\System\TUVFtaW.exe
  2⤵
  PID:2272
- C:\Windows\System\obLgOXW.exe
  C:\Windows\System\obLgOXW.exe
  2⤵
  PID:2856
- C:\Windows\System\KFyxrrX.exe
  C:\Windows\System\KFyxrrX.exe
  2⤵
  PID:2916
- C:\Windows\System\KDAMxpN.exe
  C:\Windows\System\KDAMxpN.exe
  2⤵
  PID:2300
- C:\Windows\System\XAavQlg.exe
  C:\Windows\System\XAavQlg.exe
  2⤵
  PID:2696
- C:\Windows\System\lZAthzt.exe
  C:\Windows\System\lZAthzt.exe
  2⤵
  PID:2648
- C:\Windows\System\BZrLGql.exe
  C:\Windows\System\BZrLGql.exe
  2⤵
  PID:292
- C:\Windows\System\PjXVdbC.exe
  C:\Windows\System\PjXVdbC.exe
  2⤵
  PID:2572
- C:\Windows\System\hDkPWFo.exe
  C:\Windows\System\hDkPWFo.exe
  2⤵
  PID:680
- C:\Windows\System\YlhcaIZ.exe
  C:\Windows\System\YlhcaIZ.exe
  2⤵
  PID:1664
- C:\Windows\System\xecroWm.exe
  C:\Windows\System\xecroWm.exe
  2⤵
  PID:2452
- C:\Windows\System\nCTCyOI.exe
  C:\Windows\System\nCTCyOI.exe
  2⤵
  PID:1920
- C:\Windows\System\ndqmIRS.exe
  C:\Windows\System\ndqmIRS.exe
  2⤵
  PID:1856
- C:\Windows\System\npCVnnP.exe
  C:\Windows\System\npCVnnP.exe
  2⤵
  PID:1608
- C:\Windows\System\DyfaldS.exe
  C:\Windows\System\DyfaldS.exe
  2⤵
  PID:884
- C:\Windows\System\gqqxHEp.exe
  C:\Windows\System\gqqxHEp.exe
  2⤵
  PID:1168
- C:\Windows\System\evnszxw.exe
  C:\Windows\System\evnszxw.exe
  2⤵
  PID:2084
- C:\Windows\System\QdLRVdQ.exe
  C:\Windows\System\QdLRVdQ.exe
  2⤵
  PID:1072
- C:\Windows\System\aBcOShB.exe
  C:\Windows\System\aBcOShB.exe
  2⤵
  PID:2088
- C:\Windows\System\znltDHQ.exe
  C:\Windows\System\znltDHQ.exe
  2⤵
  PID:2608
- C:\Windows\System\fihdbdx.exe
  C:\Windows\System\fihdbdx.exe
  2⤵
  PID:2588
- C:\Windows\System\CoHjKFa.exe
  C:\Windows\System\CoHjKFa.exe
  2⤵
  PID:2396
- C:\Windows\System\exxwIEY.exe
  C:\Windows\System\exxwIEY.exe
  2⤵
  PID:576
- C:\Windows\System\awDecSP.exe
  C:\Windows\System\awDecSP.exe
  2⤵
  PID:1952
- C:\Windows\System\cqgUviX.exe
  C:\Windows\System\cqgUviX.exe
  2⤵
  PID:2348
- C:\Windows\System\DrvdUWh.exe
  C:\Windows\System\DrvdUWh.exe
  2⤵
  PID:3084
- C:\Windows\System\jiGHtOt.exe
  C:\Windows\System\jiGHtOt.exe
  2⤵
  PID:3100
- C:\Windows\System\kARHhlc.exe
  C:\Windows\System\kARHhlc.exe
  2⤵
  PID:3116
- C:\Windows\System\VIIcKrc.exe
  C:\Windows\System\VIIcKrc.exe
  2⤵
  PID:3132
- C:\Windows\System\aTbcnCh.exe
  C:\Windows\System\aTbcnCh.exe
  2⤵
  PID:3148
- C:\Windows\System\TGVMnPS.exe
  C:\Windows\System\TGVMnPS.exe
  2⤵
  PID:3224
- C:\Windows\System\FflJtgF.exe
  C:\Windows\System\FflJtgF.exe
  2⤵
  PID:3240
- C:\Windows\System\upOHCFk.exe
  C:\Windows\System\upOHCFk.exe
  2⤵
  PID:3256
- C:\Windows\System\aijoRYZ.exe
  C:\Windows\System\aijoRYZ.exe
  2⤵
  PID:3272
- C:\Windows\System\KNqOoHS.exe
  C:\Windows\System\KNqOoHS.exe
  2⤵
  PID:3288
- C:\Windows\System\gNIDzDX.exe
  C:\Windows\System\gNIDzDX.exe
  2⤵
  PID:3304
- C:\Windows\System\gyGnJrZ.exe
  C:\Windows\System\gyGnJrZ.exe
  2⤵
  PID:3320
- C:\Windows\System\KfvOvqx.exe
  C:\Windows\System\KfvOvqx.exe
  2⤵
  PID:3336
- C:\Windows\System\GtvStpU.exe
  C:\Windows\System\GtvStpU.exe
  2⤵
  PID:3356
- C:\Windows\System\OrfKRmE.exe
  C:\Windows\System\OrfKRmE.exe
  2⤵
  PID:3372
- C:\Windows\System\SbYXzUp.exe
  C:\Windows\System\SbYXzUp.exe
  2⤵
  PID:3388
- C:\Windows\System\FIjuMNH.exe
  C:\Windows\System\FIjuMNH.exe
  2⤵
  PID:3404
- C:\Windows\System\cIBkEKr.exe
  C:\Windows\System\cIBkEKr.exe
  2⤵
  PID:3460
- C:\Windows\System\PkePnWh.exe
  C:\Windows\System\PkePnWh.exe
  2⤵
  PID:3476
- C:\Windows\System\lMnClNa.exe
  C:\Windows\System\lMnClNa.exe
  2⤵
  PID:3496
- C:\Windows\System\nsrOAFY.exe
  C:\Windows\System\nsrOAFY.exe
  2⤵
  PID:3512
- C:\Windows\System\pXYqHjY.exe
  C:\Windows\System\pXYqHjY.exe
  2⤵
  PID:3532
- C:\Windows\System\XAGDcNz.exe
  C:\Windows\System\XAGDcNz.exe
  2⤵
  PID:3548
- C:\Windows\System\nLwRLGr.exe
  C:\Windows\System\nLwRLGr.exe
  2⤵
  PID:3564
- C:\Windows\System\ShTKAyl.exe
  C:\Windows\System\ShTKAyl.exe
  2⤵
  PID:3580
- C:\Windows\System\zRYPYaK.exe
  C:\Windows\System\zRYPYaK.exe
  2⤵
  PID:3600
- C:\Windows\System\fKgwHaV.exe
  C:\Windows\System\fKgwHaV.exe
  2⤵
  PID:3620
- C:\Windows\System\IKtAAxs.exe
  C:\Windows\System\IKtAAxs.exe
  2⤵
  PID:3636
- C:\Windows\System\jYQdGBm.exe
  C:\Windows\System\jYQdGBm.exe
  2⤵
  PID:3652
- C:\Windows\System\aRmdbaV.exe
  C:\Windows\System\aRmdbaV.exe
  2⤵
  PID:3668
- C:\Windows\System\jBiMDeV.exe
  C:\Windows\System\jBiMDeV.exe
  2⤵
  PID:3688
- C:\Windows\System\plmaxYE.exe
  C:\Windows\System\plmaxYE.exe
  2⤵
  PID:3704
- C:\Windows\System\mmDVleH.exe
  C:\Windows\System\mmDVleH.exe
  2⤵
  PID:3720
- C:\Windows\System\MCgIDEy.exe
  C:\Windows\System\MCgIDEy.exe
  2⤵
  PID:3736
- C:\Windows\System\rDFhHRx.exe
  C:\Windows\System\rDFhHRx.exe
  2⤵
  PID:3792
- C:\Windows\System\PwFSZPD.exe
  C:\Windows\System\PwFSZPD.exe
  2⤵
  PID:3808
- C:\Windows\System\kOalqQX.exe
  C:\Windows\System\kOalqQX.exe
  2⤵
  PID:3828
- C:\Windows\System\TdqxgGb.exe
  C:\Windows\System\TdqxgGb.exe
  2⤵
  PID:3844
- C:\Windows\System\qbKqEef.exe
  C:\Windows\System\qbKqEef.exe
  2⤵
  PID:3868
- C:\Windows\System\RYvXBha.exe
  C:\Windows\System\RYvXBha.exe
  2⤵
  PID:3884
- C:\Windows\System\NHsupth.exe
  C:\Windows\System\NHsupth.exe
  2⤵
  PID:3904
- C:\Windows\System\nedJqNx.exe
  C:\Windows\System\nedJqNx.exe
  2⤵
  PID:3920
- C:\Windows\System\tgWONRp.exe
  C:\Windows\System\tgWONRp.exe
  2⤵
  PID:3936
- C:\Windows\System\vtWgQmI.exe
  C:\Windows\System\vtWgQmI.exe
  2⤵
  PID:3952
- C:\Windows\System\YlitVjC.exe
  C:\Windows\System\YlitVjC.exe
  2⤵
  PID:3972
- C:\Windows\System\PMUSGyH.exe
  C:\Windows\System\PMUSGyH.exe
  2⤵
  PID:3988
- C:\Windows\System\UoHhudZ.exe
  C:\Windows\System\UoHhudZ.exe
  2⤵
  PID:4004
- C:\Windows\System\bKOFvSO.exe
  C:\Windows\System\bKOFvSO.exe
  2⤵
  PID:4024
- C:\Windows\System\PZqpgaq.exe
  C:\Windows\System\PZqpgaq.exe
  2⤵
  PID:4040
- C:\Windows\System\ORALzsT.exe
  C:\Windows\System\ORALzsT.exe
  2⤵
  PID:2744
- C:\Windows\System\MDKYjds.exe
  C:\Windows\System\MDKYjds.exe
  2⤵
  PID:2520
- C:\Windows\System\KPeEKjw.exe
  C:\Windows\System\KPeEKjw.exe
  2⤵
  PID:3108
- C:\Windows\System\MdrDmHk.exe
  C:\Windows\System\MdrDmHk.exe
  2⤵
  PID:2500
- C:\Windows\System\KXsmGVK.exe
  C:\Windows\System\KXsmGVK.exe
  2⤵
  PID:2380
- C:\Windows\System\JlUyVwQ.exe
  C:\Windows\System\JlUyVwQ.exe
  2⤵
  PID:3096
- C:\Windows\System\BTqkdqp.exe
  C:\Windows\System\BTqkdqp.exe
  2⤵
  PID:3168
- C:\Windows\System\bsNkbQo.exe
  C:\Windows\System\bsNkbQo.exe
  2⤵
  PID:3208
- C:\Windows\System\COFIoIx.exe
  C:\Windows\System\COFIoIx.exe
  2⤵
  PID:3212
- C:\Windows\System\VdAmpDb.exe
  C:\Windows\System\VdAmpDb.exe
  2⤵
  PID:1320
- C:\Windows\System\OznveDT.exe
  C:\Windows\System\OznveDT.exe
  2⤵
  PID:3280
- C:\Windows\System\sqQMumu.exe
  C:\Windows\System\sqQMumu.exe
  2⤵
  PID:3344
- C:\Windows\System\TmNioAh.exe
  C:\Windows\System\TmNioAh.exe
  2⤵
  PID:3252
- C:\Windows\System\WMtwguV.exe
  C:\Windows\System\WMtwguV.exe
  2⤵
  PID:3428
- C:\Windows\System\lhwlnuM.exe
  C:\Windows\System\lhwlnuM.exe
  2⤵
  PID:3264
- C:\Windows\System\NGOgCdB.exe
  C:\Windows\System\NGOgCdB.exe
  2⤵
  PID:3380
- C:\Windows\System\KWvUeJU.exe
  C:\Windows\System\KWvUeJU.exe
  2⤵
  PID:3332
- C:\Windows\System\SgpgFvG.exe
  C:\Windows\System\SgpgFvG.exe
  2⤵
  PID:3420
- C:\Windows\System\HGrgZvy.exe
  C:\Windows\System\HGrgZvy.exe
  2⤵
  PID:3412
- C:\Windows\System\IivbmzS.exe
  C:\Windows\System\IivbmzS.exe
  2⤵
  PID:3484
- C:\Windows\System\MkIHbDN.exe
  C:\Windows\System\MkIHbDN.exe
  2⤵
  PID:3508
- C:\Windows\System\BokfEEe.exe
  C:\Windows\System\BokfEEe.exe
  2⤵
  PID:3572
- C:\Windows\System\wCkvcHd.exe
  C:\Windows\System\wCkvcHd.exe
  2⤵
  PID:3644
- C:\Windows\System\oxMxSaF.exe
  C:\Windows\System\oxMxSaF.exe
  2⤵
  PID:3680
- C:\Windows\System\nbXTTGf.exe
  C:\Windows\System\nbXTTGf.exe
  2⤵
  PID:3556
- C:\Windows\System\axfVHQD.exe
  C:\Windows\System\axfVHQD.exe
  2⤵
  PID:3596
- C:\Windows\System\srIlCVB.exe
  C:\Windows\System\srIlCVB.exe
  2⤵
  PID:3660
- C:\Windows\System\hAUoNkK.exe
  C:\Windows\System\hAUoNkK.exe
  2⤵
  PID:3696
- C:\Windows\System\NaXqHEK.exe
  C:\Windows\System\NaXqHEK.exe
  2⤵
  PID:3732
- C:\Windows\System\LQFfrOS.exe
  C:\Windows\System\LQFfrOS.exe
  2⤵
  PID:3700
- C:\Windows\System\mhMAcmu.exe
  C:\Windows\System\mhMAcmu.exe
  2⤵
  PID:3864
- C:\Windows\System\UNWMeMY.exe
  C:\Windows\System\UNWMeMY.exe
  2⤵
  PID:4032
- C:\Windows\System\nVFHZTe.exe
  C:\Windows\System\nVFHZTe.exe
  2⤵
  PID:3964
- C:\Windows\System\wmUAGDa.exe
  C:\Windows\System\wmUAGDa.exe
  2⤵
  PID:3948
- C:\Windows\System\hVnjSGy.exe
  C:\Windows\System\hVnjSGy.exe
  2⤵
  PID:3840
- C:\Windows\System\TsFdLJL.exe
  C:\Windows\System\TsFdLJL.exe
  2⤵
  PID:4020
- C:\Windows\System\aLvnkwD.exe
  C:\Windows\System\aLvnkwD.exe
  2⤵
  PID:3916
- C:\Windows\System\yVsDUMA.exe
  C:\Windows\System\yVsDUMA.exe
  2⤵
  PID:4016
- C:\Windows\System\SoqHLOZ.exe
  C:\Windows\System\SoqHLOZ.exe
  2⤵
  PID:4064
- C:\Windows\System\TmxjxRP.exe
  C:\Windows\System\TmxjxRP.exe
  2⤵
  PID:4080
- C:\Windows\System\muvhvjG.exe
  C:\Windows\System\muvhvjG.exe
  2⤵
  PID:4084
- C:\Windows\System\YkZNuSf.exe
  C:\Windows\System\YkZNuSf.exe
  2⤵
  PID:3144
- C:\Windows\System\XTZIFdy.exe
  C:\Windows\System\XTZIFdy.exe
  2⤵
  PID:812
- C:\Windows\System\aHAwDoK.exe
  C:\Windows\System\aHAwDoK.exe
  2⤵
  PID:3176
- C:\Windows\System\soFGNxL.exe
  C:\Windows\System\soFGNxL.exe
  2⤵
  PID:3184
- C:\Windows\System\DBWfQMS.exe
  C:\Windows\System\DBWfQMS.exe
  2⤵
  PID:1052
- C:\Windows\System\YAEDVpv.exe
  C:\Windows\System\YAEDVpv.exe
  2⤵
  PID:3312
- C:\Windows\System\QTcNTHW.exe
  C:\Windows\System\QTcNTHW.exe
  2⤵
  PID:1292
- C:\Windows\System\tNGHLWi.exe
  C:\Windows\System\tNGHLWi.exe
  2⤵
  PID:3316
- C:\Windows\System\SBwwUhb.exe
  C:\Windows\System\SBwwUhb.exe
  2⤵
  PID:3432
- C:\Windows\System\jtYlynW.exe
  C:\Windows\System\jtYlynW.exe
  2⤵
  PID:3268
- C:\Windows\System\RZMYtiC.exe
  C:\Windows\System\RZMYtiC.exe
  2⤵
  PID:3676
- C:\Windows\System\OCrQIfI.exe
  C:\Windows\System\OCrQIfI.exe
  2⤵
  PID:3468
- C:\Windows\System\YmGDGiy.exe
  C:\Windows\System\YmGDGiy.exe
  2⤵
  PID:3764
- C:\Windows\System\QXEphqr.exe
  C:\Windows\System\QXEphqr.exe
  2⤵
  PID:3440
- C:\Windows\System\xZZPqLi.exe
  C:\Windows\System\xZZPqLi.exe
  2⤵
  PID:4076
- C:\Windows\System\TIssCNh.exe
  C:\Windows\System\TIssCNh.exe
  2⤵
  PID:2748
- C:\Windows\System\OtmsFSH.exe
  C:\Windows\System\OtmsFSH.exe
  2⤵
  PID:4112
- C:\Windows\System\iPrLOeb.exe
  C:\Windows\System\iPrLOeb.exe
  2⤵
  PID:4128
- C:\Windows\System\ssDmIpX.exe
  C:\Windows\System\ssDmIpX.exe
  2⤵
  PID:4184
- C:\Windows\System\qGbYKTp.exe
  C:\Windows\System\qGbYKTp.exe
  2⤵
  PID:4324
- C:\Windows\System\dxrsIqG.exe
  C:\Windows\System\dxrsIqG.exe
  2⤵
  PID:4340
- C:\Windows\System\nILaDMG.exe
  C:\Windows\System\nILaDMG.exe
  2⤵
  PID:4356
- C:\Windows\System\jOsUHuu.exe
  C:\Windows\System\jOsUHuu.exe
  2⤵
  PID:4376
- C:\Windows\System\zMJFfFP.exe
  C:\Windows\System\zMJFfFP.exe
  2⤵
  PID:4392
- C:\Windows\System\LzgTAdJ.exe
  C:\Windows\System\LzgTAdJ.exe
  2⤵
  PID:4408
- C:\Windows\System\TruzyPZ.exe
  C:\Windows\System\TruzyPZ.exe
  2⤵
  PID:4424
- C:\Windows\System\GRySMwB.exe
  C:\Windows\System\GRySMwB.exe
  2⤵
  PID:4444
- C:\Windows\System\uSwfnng.exe
  C:\Windows\System\uSwfnng.exe
  2⤵
  PID:4460
- C:\Windows\System\rESKIaC.exe
  C:\Windows\System\rESKIaC.exe
  2⤵
  PID:4480
- C:\Windows\System\uibIjJr.exe
  C:\Windows\System\uibIjJr.exe
  2⤵
  PID:4496
- C:\Windows\System\xvPJGXb.exe
  C:\Windows\System\xvPJGXb.exe
  2⤵
  PID:4540
- C:\Windows\System\FkncgHk.exe
  C:\Windows\System\FkncgHk.exe
  2⤵
  PID:4564
- C:\Windows\System\luWXwjz.exe
  C:\Windows\System\luWXwjz.exe
  2⤵
  PID:4580
- C:\Windows\System\QUGLvBB.exe
  C:\Windows\System\QUGLvBB.exe
  2⤵
  PID:4596
- C:\Windows\System\EjIMFjz.exe
  C:\Windows\System\EjIMFjz.exe
  2⤵
  PID:4612
- C:\Windows\System\KODMMGv.exe
  C:\Windows\System\KODMMGv.exe
  2⤵
  PID:4640
- C:\Windows\System\yRosluZ.exe
  C:\Windows\System\yRosluZ.exe
  2⤵
  PID:4716
- C:\Windows\System\HwSxHgG.exe
  C:\Windows\System\HwSxHgG.exe
  2⤵
  PID:4740
- C:\Windows\System\oThgpMU.exe
  C:\Windows\System\oThgpMU.exe
  2⤵
  PID:4756
- C:\Windows\System\woVGgyR.exe
  C:\Windows\System\woVGgyR.exe
  2⤵
  PID:4772
- C:\Windows\System\uMTwAFk.exe
  C:\Windows\System\uMTwAFk.exe
  2⤵
  PID:4788
- C:\Windows\System\QyCilrW.exe
  C:\Windows\System\QyCilrW.exe
  2⤵
  PID:4804
- C:\Windows\System\zolzhes.exe
  C:\Windows\System\zolzhes.exe
  2⤵
  PID:4820
- C:\Windows\System\fkSnvYU.exe
  C:\Windows\System\fkSnvYU.exe
  2⤵
  PID:4884
- C:\Windows\System\AGonaUC.exe
  C:\Windows\System\AGonaUC.exe
  2⤵
  PID:4900
- C:\Windows\System\kDIIWqC.exe
  C:\Windows\System\kDIIWqC.exe
  2⤵
  PID:4916
- C:\Windows\System\TBdQCrs.exe
  C:\Windows\System\TBdQCrs.exe
  2⤵
  PID:4932
- C:\Windows\System\MeVbswf.exe
  C:\Windows\System\MeVbswf.exe
  2⤵
  PID:4984
- C:\Windows\System\WJZjCWa.exe
  C:\Windows\System\WJZjCWa.exe
  2⤵
  PID:5004
- C:\Windows\System\LyHxgvv.exe
  C:\Windows\System\LyHxgvv.exe
  2⤵
  PID:5020
- C:\Windows\System\iwsvucT.exe
  C:\Windows\System\iwsvucT.exe
  2⤵
  PID:5036
- C:\Windows\System\lyObBkx.exe
  C:\Windows\System\lyObBkx.exe
  2⤵
  PID:5052
- C:\Windows\System\nnUfGZP.exe
  C:\Windows\System\nnUfGZP.exe
  2⤵
  PID:5084
- C:\Windows\System\xPCWFVH.exe
  C:\Windows\System\xPCWFVH.exe
  2⤵
  PID:3076
- C:\Windows\System\vLWMzCr.exe
  C:\Windows\System\vLWMzCr.exe
  2⤵
  PID:3592
- C:\Windows\System\NamBocD.exe
  C:\Windows\System\NamBocD.exe
  2⤵
  PID:3752
- C:\Windows\System\ccRZFKX.exe
  C:\Windows\System\ccRZFKX.exe
  2⤵
  PID:3164
- C:\Windows\System\QPzNRSM.exe
  C:\Windows\System\QPzNRSM.exe
  2⤵
  PID:1008
- C:\Windows\System\lbdjJXT.exe
  C:\Windows\System\lbdjJXT.exe
  2⤵
  PID:3896
- C:\Windows\System\FPUzRmX.exe
  C:\Windows\System\FPUzRmX.exe
  2⤵
  PID:3140
- C:\Windows\System\izfSiyz.exe
  C:\Windows\System\izfSiyz.exe
  2⤵
  PID:3748
- C:\Windows\System\oRfFnPw.exe
  C:\Windows\System\oRfFnPw.exe
  2⤵
  PID:3768
- C:\Windows\System\HUIvyiL.exe
  C:\Windows\System\HUIvyiL.exe
  2⤵
  PID:3776
- C:\Windows\System\OszSbvM.exe
  C:\Windows\System\OszSbvM.exe
  2⤵
  PID:4148
- C:\Windows\System\iMpWwnF.exe
  C:\Windows\System\iMpWwnF.exe
  2⤵
  PID:1108
- C:\Windows\System\VlaKmAL.exe
  C:\Windows\System\VlaKmAL.exe
  2⤵
  PID:3204
- C:\Windows\System\GBzqwQf.exe
  C:\Windows\System\GBzqwQf.exe
  2⤵
  PID:4168
- C:\Windows\System\rZGGCJt.exe
  C:\Windows\System\rZGGCJt.exe
  2⤵
  PID:3716
- C:\Windows\System\yPrIScR.exe
  C:\Windows\System\yPrIScR.exe
  2⤵
  PID:3932
- C:\Windows\System\xivoZjX.exe
  C:\Windows\System\xivoZjX.exe
  2⤵
  PID:4056
- C:\Windows\System\TMuPjXU.exe
  C:\Windows\System\TMuPjXU.exe
  2⤵
  PID:4124
- C:\Windows\System\BJcRszx.exe
  C:\Windows\System\BJcRszx.exe
  2⤵
  PID:4212
- C:\Windows\System\bmBKNWB.exe
  C:\Windows\System\bmBKNWB.exe
  2⤵
  PID:1412
- C:\Windows\System\SogmtCw.exe
  C:\Windows\System\SogmtCw.exe
  2⤵
  PID:4236
- C:\Windows\System\TbogoVm.exe
  C:\Windows\System\TbogoVm.exe
  2⤵
  PID:4252
- C:\Windows\System\MWZUIUK.exe
  C:\Windows\System\MWZUIUK.exe
  2⤵
  PID:4280
- C:\Windows\System\xTaybRj.exe
  C:\Windows\System\xTaybRj.exe
  2⤵
  PID:4292
- C:\Windows\System\JeQnFYp.exe
  C:\Windows\System\JeQnFYp.exe
  2⤵
  PID:4176
- C:\Windows\System\yLWhoPy.exe
  C:\Windows\System\yLWhoPy.exe
  2⤵
  PID:4372
- C:\Windows\System\EcpwfRk.exe
  C:\Windows\System\EcpwfRk.exe
  2⤵
  PID:4436
- C:\Windows\System\homWEJl.exe
  C:\Windows\System\homWEJl.exe
  2⤵
  PID:4388
- C:\Windows\System\GyUoxdM.exe
  C:\Windows\System\GyUoxdM.exe
  2⤵
  PID:4420
- C:\Windows\System\qWvTHrR.exe
  C:\Windows\System\qWvTHrR.exe
  2⤵
  PID:4524
- C:\Windows\System\TopCpGQ.exe
  C:\Windows\System\TopCpGQ.exe
  2⤵
  PID:4556
- C:\Windows\System\hogQEra.exe
  C:\Windows\System\hogQEra.exe
  2⤵
  PID:4576
- C:\Windows\System\EdSNoEi.exe
  C:\Windows\System\EdSNoEi.exe
  2⤵
  PID:4608
- C:\Windows\System\aJuFNGF.exe
  C:\Windows\System\aJuFNGF.exe
  2⤵
  PID:4648
- C:\Windows\System\LsWWwRi.exe
  C:\Windows\System\LsWWwRi.exe
  2⤵
  PID:4668
- C:\Windows\System\rOUiVGy.exe
  C:\Windows\System\rOUiVGy.exe
  2⤵
  PID:4688
- C:\Windows\System\lrXFYDV.exe
  C:\Windows\System\lrXFYDV.exe
  2⤵
  PID:4704
- C:\Windows\System\nDbNFHs.exe
  C:\Windows\System\nDbNFHs.exe
  2⤵
  PID:4752
- C:\Windows\System\oZrIbaG.exe
  C:\Windows\System\oZrIbaG.exe
  2⤵
  PID:4784
- C:\Windows\System\vJynsMT.exe
  C:\Windows\System\vJynsMT.exe
  2⤵
  PID:4768
- C:\Windows\System\kcDNhpG.exe
  C:\Windows\System\kcDNhpG.exe
  2⤵
  PID:4800
- C:\Windows\System\LQmEHsh.exe
  C:\Windows\System\LQmEHsh.exe
  2⤵
  PID:4928
- C:\Windows\System\cyxtYAa.exe
  C:\Windows\System\cyxtYAa.exe
  2⤵
  PID:4864
- C:\Windows\System\aCnESpb.exe
  C:\Windows\System\aCnESpb.exe
  2⤵
  PID:4868
- C:\Windows\System\yelWCGF.exe
  C:\Windows\System\yelWCGF.exe
  2⤵
  PID:4944
- C:\Windows\System\ZauJYGo.exe
  C:\Windows\System\ZauJYGo.exe
  2⤵
  PID:5000
- C:\Windows\System\DxQzvYN.exe
  C:\Windows\System\DxQzvYN.exe
  2⤵
  PID:5016
- C:\Windows\System\ZfXCZET.exe
  C:\Windows\System\ZfXCZET.exe
  2⤵
  PID:4980
- C:\Windows\System\aavfazU.exe
  C:\Windows\System\aavfazU.exe
  2⤵
  PID:5072
- C:\Windows\System\hxCPJth.exe
  C:\Windows\System\hxCPJth.exe
  2⤵
  PID:3996
- C:\Windows\System\GnbfgXa.exe
  C:\Windows\System\GnbfgXa.exe
  2⤵
  PID:5116
- C:\Windows\System\kLYNSpW.exe
  C:\Windows\System\kLYNSpW.exe
  2⤵
  PID:3820
- C:\Windows\System\xDKabBW.exe
  C:\Windows\System\xDKabBW.exe
  2⤵
  PID:3756
- C:\Windows\System\ElTSImm.exe
  C:\Windows\System\ElTSImm.exe
  2⤵
  PID:5104
- C:\Windows\System\HLeDeOE.exe
  C:\Windows\System\HLeDeOE.exe
  2⤵
  PID:3504
- C:\Windows\System\nJgFFCI.exe
  C:\Windows\System\nJgFFCI.exe
  2⤵
  PID:5096
- C:\Windows\System\KnnAIuQ.exe
  C:\Windows\System\KnnAIuQ.exe
  2⤵
  PID:3128
- C:\Windows\System\ZSDWzzZ.exe
  C:\Windows\System\ZSDWzzZ.exe
  2⤵
  PID:1708
- C:\Windows\System\UCXcGRV.exe
  C:\Windows\System\UCXcGRV.exe
  2⤵
  PID:552
- C:\Windows\System\AwxBRNj.exe
  C:\Windows\System\AwxBRNj.exe
  2⤵
  PID:976
- C:\Windows\System\qhyQAfA.exe
  C:\Windows\System\qhyQAfA.exe
  2⤵
  PID:4368
- C:\Windows\System\RcHCvJJ.exe
  C:\Windows\System\RcHCvJJ.exe
  2⤵
  PID:4508
- C:\Windows\System\fpMDuNY.exe
  C:\Windows\System\fpMDuNY.exe
  2⤵
  PID:4304
- C:\Windows\System\nuvgKPe.exe
  C:\Windows\System\nuvgKPe.exe
  2⤵
  PID:4432
- C:\Windows\System\hbblhVR.exe
  C:\Windows\System\hbblhVR.exe
  2⤵
  PID:4536
- C:\Windows\System\aKmzlfJ.exe
  C:\Windows\System\aKmzlfJ.exe
  2⤵
  PID:4604
- C:\Windows\System\TRIwsLf.exe
  C:\Windows\System\TRIwsLf.exe
  2⤵
  PID:4592
- C:\Windows\System\NoAmcGo.exe
  C:\Windows\System\NoAmcGo.exe
  2⤵
  PID:4684
- C:\Windows\System\wupyidx.exe
  C:\Windows\System\wupyidx.exe
  2⤵
  PID:4816
- C:\Windows\System\olcmaqz.exe
  C:\Windows\System\olcmaqz.exe
  2⤵
  PID:4664
- C:\Windows\System\uNcseyQ.exe
  C:\Windows\System\uNcseyQ.exe
  2⤵
  PID:4880
- C:\Windows\System\oafmqnB.exe
  C:\Windows\System\oafmqnB.exe
  2⤵
  PID:4832
- C:\Windows\System\CkyXSWH.exe
  C:\Windows\System\CkyXSWH.exe
  2⤵
  PID:4976
- C:\Windows\System\HIvtWHu.exe
  C:\Windows\System\HIvtWHu.exe
  2⤵
  PID:4696
- C:\Windows\System\ZzopFqJ.exe
  C:\Windows\System\ZzopFqJ.exe
  2⤵
  PID:5080
- C:\Windows\System\CgLcRJP.exe
  C:\Windows\System\CgLcRJP.exe
  2⤵
  PID:5060
- C:\Windows\System\bkkReyH.exe
  C:\Windows\System\bkkReyH.exe
  2⤵
  PID:3912
- C:\Windows\System\YCRJlis.exe
  C:\Windows\System\YCRJlis.exe
  2⤵
  PID:5068
- C:\Windows\System\pqmuzPI.exe
  C:\Windows\System\pqmuzPI.exe
  2⤵
  PID:3444
- C:\Windows\System\RNYcyYv.exe
  C:\Windows\System\RNYcyYv.exe
  2⤵
  PID:4160
- C:\Windows\System\rTmFEOH.exe
  C:\Windows\System\rTmFEOH.exe
  2⤵
  PID:1348
- C:\Windows\System\sGATwyJ.exe
  C:\Windows\System\sGATwyJ.exe
  2⤵
  PID:5112
- C:\Windows\System\FuLRqnv.exe
  C:\Windows\System\FuLRqnv.exe
  2⤵
  PID:2612
- C:\Windows\System\lXalxEw.exe
  C:\Windows\System\lXalxEw.exe
  2⤵
  PID:4156
- C:\Windows\System\xHxZSkw.exe
  C:\Windows\System\xHxZSkw.exe
  2⤵
  PID:4244
- C:\Windows\System\GoWbSVX.exe
  C:\Windows\System\GoWbSVX.exe
  2⤵
  PID:4476
- C:\Windows\System\PpLDfvo.exe
  C:\Windows\System\PpLDfvo.exe
  2⤵
  PID:4348
- C:\Windows\System\WpDbEfz.exe
  C:\Windows\System\WpDbEfz.exe
  2⤵
  PID:4492
- C:\Windows\System\fPqWwij.exe
  C:\Windows\System\fPqWwij.exe
  2⤵
  PID:4516
- C:\Windows\System\azhacPw.exe
  C:\Windows\System\azhacPw.exe
  2⤵
  PID:4628
- C:\Windows\System\kstSekK.exe
  C:\Windows\System\kstSekK.exe
  2⤵
  PID:4844
- C:\Windows\System\xbzhqYc.exe
  C:\Windows\System\xbzhqYc.exe
  2⤵
  PID:4892
- C:\Windows\System\QzFXCbB.exe
  C:\Windows\System\QzFXCbB.exe
  2⤵
  PID:4796
- C:\Windows\System\CDdAGno.exe
  C:\Windows\System\CDdAGno.exe
  2⤵
  PID:3760
- C:\Windows\System\uZCJAZw.exe
  C:\Windows\System\uZCJAZw.exe
  2⤵
  PID:3980
- C:\Windows\System\ZgSzdiN.exe
  C:\Windows\System\ZgSzdiN.exe
  2⤵
  PID:4092
- C:\Windows\System\zxwPQFa.exe
  C:\Windows\System\zxwPQFa.exe
  2⤵
  PID:3780
- C:\Windows\System\clYpUFC.exe
  C:\Windows\System\clYpUFC.exe
  2⤵
  PID:4852
- C:\Windows\System\GukAjIn.exe
  C:\Windows\System\GukAjIn.exe
  2⤵
  PID:1308
- C:\Windows\System\FIzVFBp.exe
  C:\Windows\System\FIzVFBp.exe
  2⤵
  PID:4956
- C:\Windows\System\GhdobCL.exe
  C:\Windows\System\GhdobCL.exe
  2⤵
  PID:4780
- C:\Windows\System\hpELXWa.exe
  C:\Windows\System\hpELXWa.exe
  2⤵
  PID:4968
- C:\Windows\System\EyoogiM.exe
  C:\Windows\System\EyoogiM.exe
  2⤵
  PID:4300
- C:\Windows\System\kfmDHQe.exe
  C:\Windows\System\kfmDHQe.exe
  2⤵
  PID:4764
- C:\Windows\System\keihSqq.exe
  C:\Windows\System\keihSqq.exe
  2⤵
  PID:1100
- C:\Windows\System\NuWpZoN.exe
  C:\Windows\System\NuWpZoN.exe
  2⤵
  PID:4624
- C:\Windows\System\bewtrFi.exe
  C:\Windows\System\bewtrFi.exe
  2⤵
  PID:280
- C:\Windows\System\kWnVfEU.exe
  C:\Windows\System\kWnVfEU.exe
  2⤵
  PID:5100
- C:\Windows\System\MiNLeCs.exe
  C:\Windows\System\MiNLeCs.exe
  2⤵
  PID:4140
- C:\Windows\System\YJPyTOx.exe
  C:\Windows\System\YJPyTOx.exe
  2⤵
  PID:3528
- C:\Windows\System\RALROAc.exe
  C:\Windows\System\RALROAc.exe
  2⤵
  PID:4748
- C:\Windows\System\EmeWdNx.exe
  C:\Windows\System\EmeWdNx.exe
  2⤵
  PID:4700
- C:\Windows\System\jLjEpiC.exe
  C:\Windows\System\jLjEpiC.exe
  2⤵
  PID:4144
- C:\Windows\System\TUqEMOg.exe
  C:\Windows\System\TUqEMOg.exe
  2⤵
  PID:4488
- C:\Windows\System\ouHyaXx.exe
  C:\Windows\System\ouHyaXx.exe
  2⤵
  PID:5136
- C:\Windows\System\nJrWRhW.exe
  C:\Windows\System\nJrWRhW.exe
  2⤵
  PID:5152
- C:\Windows\System\WozwnHs.exe
  C:\Windows\System\WozwnHs.exe
  2⤵
  PID:5168
- C:\Windows\System\yGvquDF.exe
  C:\Windows\System\yGvquDF.exe
  2⤵
  PID:5184
- C:\Windows\System\ZmRqRaR.exe
  C:\Windows\System\ZmRqRaR.exe
  2⤵
  PID:5204
- C:\Windows\System\BBVJdPF.exe
  C:\Windows\System\BBVJdPF.exe
  2⤵
  PID:5220
- C:\Windows\System\VacsZEH.exe
  C:\Windows\System\VacsZEH.exe
  2⤵
  PID:5244
- C:\Windows\System\LNSZWCd.exe
  C:\Windows\System\LNSZWCd.exe
  2⤵
  PID:5260
- C:\Windows\System\PXuXOmi.exe
  C:\Windows\System\PXuXOmi.exe
  2⤵
  PID:5276
- C:\Windows\System\PPwMLdM.exe
  C:\Windows\System\PPwMLdM.exe
  2⤵
  PID:5292
- C:\Windows\System\UKuwyLP.exe
  C:\Windows\System\UKuwyLP.exe
  2⤵
  PID:5308
- C:\Windows\System\xCZNjoY.exe
  C:\Windows\System\xCZNjoY.exe
  2⤵
  PID:5324
- C:\Windows\System\efzkrvY.exe
  C:\Windows\System\efzkrvY.exe
  2⤵
  PID:5340
- C:\Windows\System\XDfMoMA.exe
  C:\Windows\System\XDfMoMA.exe
  2⤵
  PID:5360
- C:\Windows\System\qTqrxKE.exe
  C:\Windows\System\qTqrxKE.exe
  2⤵
  PID:5376
- C:\Windows\System\BGvEFHp.exe
  C:\Windows\System\BGvEFHp.exe
  2⤵
  PID:5392
- C:\Windows\System\NVSWSyG.exe
  C:\Windows\System\NVSWSyG.exe
  2⤵
  PID:5408
- C:\Windows\System\jUOXmLz.exe
  C:\Windows\System\jUOXmLz.exe
  2⤵
  PID:5424
- C:\Windows\System\ivHlUEA.exe
  C:\Windows\System\ivHlUEA.exe
  2⤵
  PID:5464
- C:\Windows\System\RjKVXeh.exe
  C:\Windows\System\RjKVXeh.exe
  2⤵
  PID:5484
- C:\Windows\System\JqrxuKk.exe
  C:\Windows\System\JqrxuKk.exe
  2⤵
  PID:5500
- C:\Windows\System\DnjJjnC.exe
  C:\Windows\System\DnjJjnC.exe
  2⤵
  PID:5520
- C:\Windows\System\vzAilGv.exe
  C:\Windows\System\vzAilGv.exe
  2⤵
  PID:5536
- C:\Windows\System\zYnxjLD.exe
  C:\Windows\System\zYnxjLD.exe
  2⤵
  PID:5552
- C:\Windows\System\QsxWgsZ.exe
  C:\Windows\System\QsxWgsZ.exe
  2⤵
  PID:5568
- C:\Windows\System\YbjBzdG.exe
  C:\Windows\System\YbjBzdG.exe
  2⤵
  PID:5584
- C:\Windows\System\hgefrsF.exe
  C:\Windows\System\hgefrsF.exe
  2⤵
  PID:5604
- C:\Windows\System\Ujpwhcu.exe
  C:\Windows\System\Ujpwhcu.exe
  2⤵
  PID:5624
- C:\Windows\System\TOJLwdH.exe
  C:\Windows\System\TOJLwdH.exe
  2⤵
  PID:5640
- C:\Windows\System\oVWhvfM.exe
  C:\Windows\System\oVWhvfM.exe
  2⤵
  PID:5660
- C:\Windows\System\boTaOTV.exe
  C:\Windows\System\boTaOTV.exe
  2⤵
  PID:5676
- C:\Windows\System\SaHBToY.exe
  C:\Windows\System\SaHBToY.exe
  2⤵
  PID:5696
- C:\Windows\System\oESPjaT.exe
  C:\Windows\System\oESPjaT.exe
  2⤵
  PID:5712
- C:\Windows\System\NioFVgU.exe
  C:\Windows\System\NioFVgU.exe
  2⤵
  PID:5732
- C:\Windows\System\wLeHxxn.exe
  C:\Windows\System\wLeHxxn.exe
  2⤵
  PID:5748
- C:\Windows\System\bkUnkmo.exe
  C:\Windows\System\bkUnkmo.exe
  2⤵
  PID:5764
- C:\Windows\System\YPbLunn.exe
  C:\Windows\System\YPbLunn.exe
  2⤵
  PID:5780
- C:\Windows\System\WTcbwoF.exe
  C:\Windows\System\WTcbwoF.exe
  2⤵
  PID:5796
- C:\Windows\System\vkCMHei.exe
  C:\Windows\System\vkCMHei.exe
  2⤵
  PID:5812
- C:\Windows\System\xMYYhGm.exe
  C:\Windows\System\xMYYhGm.exe
  2⤵
  PID:5828
- C:\Windows\System\LenPvey.exe
  C:\Windows\System\LenPvey.exe
  2⤵
  PID:5848
- C:\Windows\System\TYkXlFr.exe
  C:\Windows\System\TYkXlFr.exe
  2⤵
  PID:5864
- C:\Windows\System\XkQJEYH.exe
  C:\Windows\System\XkQJEYH.exe
  2⤵
  PID:5880
- C:\Windows\System\HDmBsAT.exe
  C:\Windows\System\HDmBsAT.exe
  2⤵
  PID:5896
- C:\Windows\System\iopDHCF.exe
  C:\Windows\System\iopDHCF.exe
  2⤵
  PID:5924
- C:\Windows\System\slAsodq.exe
  C:\Windows\System\slAsodq.exe
  2⤵
  PID:5940
- C:\Windows\System\joBZHGk.exe
  C:\Windows\System\joBZHGk.exe
  2⤵
  PID:5956
- C:\Windows\System\ftnbkbO.exe
  C:\Windows\System\ftnbkbO.exe
  2⤵
  PID:5972
- C:\Windows\System\WgTdUCX.exe
  C:\Windows\System\WgTdUCX.exe
  2⤵
  PID:5988
- C:\Windows\System\whEchFT.exe
  C:\Windows\System\whEchFT.exe
  2⤵
  PID:6008
- C:\Windows\System\OgjiwnU.exe
  C:\Windows\System\OgjiwnU.exe
  2⤵
  PID:6024
- C:\Windows\System\EGjugnG.exe
  C:\Windows\System\EGjugnG.exe
  2⤵
  PID:6044
- C:\Windows\System\FLQJfnM.exe
  C:\Windows\System\FLQJfnM.exe
  2⤵
  PID:6104
- C:\Windows\System\YGaNKIk.exe
  C:\Windows\System\YGaNKIk.exe
  2⤵
  PID:6120
- C:\Windows\System\lCTCvke.exe
  C:\Windows\System\lCTCvke.exe
  2⤵
  PID:6140
- C:\Windows\System\bNekxwY.exe
  C:\Windows\System\bNekxwY.exe
  2⤵
  PID:4108
- C:\Windows\System\mzHnHhF.exe
  C:\Windows\System\mzHnHhF.exe
  2⤵
  PID:4336
- C:\Windows\System\VspLcsu.exe
  C:\Windows\System\VspLcsu.exe
  2⤵
  PID:5132
- C:\Windows\System\pyaCAtN.exe
  C:\Windows\System\pyaCAtN.exe
  2⤵
  PID:5232
- C:\Windows\System\IXWjVvc.exe
  C:\Windows\System\IXWjVvc.exe
  2⤵
  PID:5176
- C:\Windows\System\cdBMktY.exe
  C:\Windows\System\cdBMktY.exe
  2⤵
  PID:5252
- C:\Windows\System\miTcEmR.exe
  C:\Windows\System\miTcEmR.exe
  2⤵
  PID:5368
- C:\Windows\System\qXVdUra.exe
  C:\Windows\System\qXVdUra.exe
  2⤵
  PID:5300
- C:\Windows\System\skkIPZP.exe
  C:\Windows\System\skkIPZP.exe
  2⤵
  PID:5440
- C:\Windows\System\pvGLBiO.exe
  C:\Windows\System\pvGLBiO.exe
  2⤵
  PID:5348
- C:\Windows\System\ESJIKzO.exe
  C:\Windows\System\ESJIKzO.exe
  2⤵
  PID:5416
- C:\Windows\System\zcsYoHw.exe
  C:\Windows\System\zcsYoHw.exe
  2⤵
  PID:5516
- C:\Windows\System\OeVWEEN.exe
  C:\Windows\System\OeVWEEN.exe
  2⤵
  PID:5480
- C:\Windows\System\sDKakSj.exe
  C:\Windows\System\sDKakSj.exe
  2⤵
  PID:5560
- C:\Windows\System\HCnYsMZ.exe
  C:\Windows\System\HCnYsMZ.exe
  2⤵
  PID:5632
- C:\Windows\System\iUUdZie.exe
  C:\Windows\System\iUUdZie.exe
  2⤵
  PID:5512
- C:\Windows\System\gwRjytH.exe
  C:\Windows\System\gwRjytH.exe
  2⤵
  PID:5576
- C:\Windows\System\fZqJMRm.exe
  C:\Windows\System\fZqJMRm.exe
  2⤵
  PID:5648
- C:\Windows\System\jwSGyKy.exe
  C:\Windows\System\jwSGyKy.exe
  2⤵
  PID:5692
- C:\Windows\System\rgXKhuF.exe
  C:\Windows\System\rgXKhuF.exe
  2⤵
  PID:5720
- C:\Windows\System\XcVUPvM.exe
  C:\Windows\System\XcVUPvM.exe
  2⤵
  PID:5776
- C:\Windows\System\PcqwDKh.exe
  C:\Windows\System\PcqwDKh.exe
  2⤵
  PID:5844
- C:\Windows\System\OMkmoxZ.exe
  C:\Windows\System\OMkmoxZ.exe
  2⤵
  PID:5728
- C:\Windows\System\puIRgBg.exe
  C:\Windows\System\puIRgBg.exe
  2⤵
  PID:5820
- C:\Windows\System\zvtaGbg.exe
  C:\Windows\System\zvtaGbg.exe
  2⤵
  PID:5856
- C:\Windows\System\WbVlKgn.exe
  C:\Windows\System\WbVlKgn.exe
  2⤵
  PID:5912
- C:\Windows\System\PnjoIpG.exe
  C:\Windows\System\PnjoIpG.exe
  2⤵
  PID:5932
- C:\Windows\System\ZIxKHBi.exe
  C:\Windows\System\ZIxKHBi.exe
  2⤵
  PID:5968
- C:\Windows\System\TPaksQC.exe
  C:\Windows\System\TPaksQC.exe
  2⤵
  PID:6020
- C:\Windows\System\hKkCJoK.exe
  C:\Windows\System\hKkCJoK.exe
  2⤵
  PID:6060
- C:\Windows\System\lQIChXt.exe
  C:\Windows\System\lQIChXt.exe
  2⤵
  PID:6072
- C:\Windows\System\ZJBIPWz.exe
  C:\Windows\System\ZJBIPWz.exe
  2⤵
  PID:6112
- C:\Windows\System\WirEmir.exe
  C:\Windows\System\WirEmir.exe
  2⤵
  PID:6128
- C:\Windows\System\aNPFlWn.exe
  C:\Windows\System\aNPFlWn.exe
  2⤵
  PID:5148
- C:\Windows\System\jVrrstm.exe
  C:\Windows\System\jVrrstm.exe
  2⤵
  PID:5240
- C:\Windows\System\GRdLVAF.exe
  C:\Windows\System\GRdLVAF.exe
  2⤵
  PID:5592
- C:\Windows\System\hegXdgR.exe
  C:\Windows\System\hegXdgR.exe
  2⤵
  PID:5492
- C:\Windows\System\oFKQYBH.exe
  C:\Windows\System\oFKQYBH.exe
  2⤵
  PID:5532
- C:\Windows\System\OupguVn.exe
  C:\Windows\System\OupguVn.exe
  2⤵
  PID:5672
- C:\Windows\System\FULARgW.exe
  C:\Windows\System\FULARgW.exe
  2⤵
  PID:5772
- C:\Windows\System\jmnRsyy.exe
  C:\Windows\System\jmnRsyy.exe
  2⤵
  PID:5708
- C:\Windows\System\zgPnNZy.exe
  C:\Windows\System\zgPnNZy.exe
  2⤵
  PID:5920
- C:\Windows\System\XZeUhoQ.exe
  C:\Windows\System\XZeUhoQ.exe
  2⤵
  PID:5980
- C:\Windows\System\qdrmlBl.exe
  C:\Windows\System\qdrmlBl.exe
  2⤵
  PID:5792
- C:\Windows\System\ufXPilK.exe
  C:\Windows\System\ufXPilK.exe
  2⤵
  PID:4352
- C:\Windows\System\aIijkMj.exe
  C:\Windows\System\aIijkMj.exe
  2⤵
  PID:5460
- C:\Windows\System\uvOoxIe.exe
  C:\Windows\System\uvOoxIe.exe
  2⤵
  PID:5284
- C:\Windows\System\lwlrJri.exe
  C:\Windows\System\lwlrJri.exe
  2⤵
  PID:6088
- C:\Windows\System\wSrlxLd.exe
  C:\Windows\System\wSrlxLd.exe
  2⤵
  PID:5384
- C:\Windows\System\ShoeKjZ.exe
  C:\Windows\System\ShoeKjZ.exe
  2⤵
  PID:4924
- C:\Windows\System\bFvKWfn.exe
  C:\Windows\System\bFvKWfn.exe
  2⤵
  PID:5216
- C:\Windows\System\JKnYAUF.exe
  C:\Windows\System\JKnYAUF.exe
  2⤵
  PID:6132
- C:\Windows\System\ZqheqWn.exe
  C:\Windows\System\ZqheqWn.exe
  2⤵
  PID:5452
- C:\Windows\System\wPfOxQW.exe
  C:\Windows\System\wPfOxQW.exe
  2⤵
  PID:5372
- C:\Windows\System\EXDjUXW.exe
  C:\Windows\System\EXDjUXW.exe
  2⤵
  PID:5668
- C:\Windows\System\BXQbiNN.exe
  C:\Windows\System\BXQbiNN.exe
  2⤵
  PID:5564
- C:\Windows\System\NzzKSEE.exe
  C:\Windows\System\NzzKSEE.exe
  2⤵
  PID:5704
- C:\Windows\System\NUCbCTC.exe
  C:\Windows\System\NUCbCTC.exe
  2⤵
  PID:5528
- C:\Windows\System\FiwkVFf.exe
  C:\Windows\System\FiwkVFf.exe
  2⤵
  PID:5688
- C:\Windows\System\uvuqqIT.exe
  C:\Windows\System\uvuqqIT.exe
  2⤵
  PID:6040
- C:\Windows\System\ZawZUde.exe
  C:\Windows\System\ZawZUde.exe
  2⤵
  PID:4532
- C:\Windows\System\gPiaLBQ.exe
  C:\Windows\System\gPiaLBQ.exe
  2⤵
  PID:3112
- C:\Windows\System\MKnFQrp.exe
  C:\Windows\System\MKnFQrp.exe
  2⤵
  PID:4872
- C:\Windows\System\MJDqbQy.exe
  C:\Windows\System\MJDqbQy.exe
  2⤵
  PID:5128
- C:\Windows\System\QuuNOPp.exe
  C:\Windows\System\QuuNOPp.exe
  2⤵
  PID:5612
- C:\Windows\System\kFjQVAr.exe
  C:\Windows\System\kFjQVAr.exe
  2⤵
  PID:5876
- C:\Windows\System\fONoJZQ.exe
  C:\Windows\System\fONoJZQ.exe
  2⤵
  PID:5872
- C:\Windows\System\mYDfjPR.exe
  C:\Windows\System\mYDfjPR.exe
  2⤵
  PID:5432
- C:\Windows\System\GwNBzBL.exe
  C:\Windows\System\GwNBzBL.exe
  2⤵
  PID:5472
- C:\Windows\System\qSRvLPc.exe
  C:\Windows\System\qSRvLPc.exe
  2⤵
  PID:4268
- C:\Windows\System\QwEtgNY.exe
  C:\Windows\System\QwEtgNY.exe
  2⤵
  PID:5456
- C:\Windows\System\jCqLiWS.exe
  C:\Windows\System\jCqLiWS.exe
  2⤵
  PID:5180
- C:\Windows\System\lZeJNws.exe
  C:\Windows\System\lZeJNws.exe
  2⤵
  PID:5288
- C:\Windows\System\upDPqcW.exe
  C:\Windows\System\upDPqcW.exe
  2⤵
  PID:5228
- C:\Windows\System\WvSVEay.exe
  C:\Windows\System\WvSVEay.exe
  2⤵
  PID:6160
- C:\Windows\System\nUyXLTL.exe
  C:\Windows\System\nUyXLTL.exe
  2⤵
  PID:6176
- C:\Windows\System\TYqWJMF.exe
  C:\Windows\System\TYqWJMF.exe
  2⤵
  PID:6192
- C:\Windows\System\egLiGvp.exe
  C:\Windows\System\egLiGvp.exe
  2⤵
  PID:6208
- C:\Windows\System\xJdsMMv.exe
  C:\Windows\System\xJdsMMv.exe
  2⤵
  PID:6224
- C:\Windows\System\AazamuS.exe
  C:\Windows\System\AazamuS.exe
  2⤵
  PID:6240
- C:\Windows\System\hhJzMeg.exe
  C:\Windows\System\hhJzMeg.exe
  2⤵
  PID:6256
- C:\Windows\System\KJmRPYY.exe
  C:\Windows\System\KJmRPYY.exe
  2⤵
  PID:6272
- C:\Windows\System\CYmtToA.exe
  C:\Windows\System\CYmtToA.exe
  2⤵
  PID:6288
- C:\Windows\System\RDQPWIS.exe
  C:\Windows\System\RDQPWIS.exe
  2⤵
  PID:6304
- C:\Windows\System\yJQnzjs.exe
  C:\Windows\System\yJQnzjs.exe
  2⤵
  PID:6324
- C:\Windows\System\ORbhLnb.exe
  C:\Windows\System\ORbhLnb.exe
  2⤵
  PID:6340
- C:\Windows\System\VDdShow.exe
  C:\Windows\System\VDdShow.exe
  2⤵
  PID:6356
- C:\Windows\System\aYhwvYI.exe
  C:\Windows\System\aYhwvYI.exe
  2⤵
  PID:6372
- C:\Windows\System\EGHbxmK.exe
  C:\Windows\System\EGHbxmK.exe
  2⤵
  PID:6392
- C:\Windows\System\uFJHjpP.exe
  C:\Windows\System\uFJHjpP.exe
  2⤵
  PID:6408
- C:\Windows\System\ZRzGtpO.exe
  C:\Windows\System\ZRzGtpO.exe
  2⤵
  PID:6424
- C:\Windows\System\TSYJxen.exe
  C:\Windows\System\TSYJxen.exe
  2⤵
  PID:6440
- C:\Windows\System\TPRnEKh.exe
  C:\Windows\System\TPRnEKh.exe
  2⤵
  PID:6456
- C:\Windows\System\uKQbETs.exe
  C:\Windows\System\uKQbETs.exe
  2⤵
  PID:6472
- C:\Windows\System\CrJpKhL.exe
  C:\Windows\System\CrJpKhL.exe
  2⤵
  PID:6492
- C:\Windows\System\NmInucw.exe
  C:\Windows\System\NmInucw.exe
  2⤵
  PID:6508
- C:\Windows\System\hpkMGti.exe
  C:\Windows\System\hpkMGti.exe
  2⤵
  PID:6524
- C:\Windows\System\kMJLUCU.exe
  C:\Windows\System\kMJLUCU.exe
  2⤵
  PID:6540
- C:\Windows\System\gqZMUvr.exe
  C:\Windows\System\gqZMUvr.exe
  2⤵
  PID:6560
- C:\Windows\System\eAoBicp.exe
  C:\Windows\System\eAoBicp.exe
  2⤵
  PID:6576
- C:\Windows\System\wlVXxco.exe
  C:\Windows\System\wlVXxco.exe
  2⤵
  PID:6592
- C:\Windows\System\SXuNYdn.exe
  C:\Windows\System\SXuNYdn.exe
  2⤵
  PID:6608
- C:\Windows\System\MsUWHaN.exe
  C:\Windows\System\MsUWHaN.exe
  2⤵
  PID:6632
- C:\Windows\System\syldLTV.exe
  C:\Windows\System\syldLTV.exe
  2⤵
  PID:6648
- C:\Windows\System\LUMzmSu.exe
  C:\Windows\System\LUMzmSu.exe
  2⤵
  PID:6664
- C:\Windows\System\WoDawDc.exe
  C:\Windows\System\WoDawDc.exe
  2⤵
  PID:6680
- C:\Windows\System\uXyLoOp.exe
  C:\Windows\System\uXyLoOp.exe
  2⤵
  PID:6696
- C:\Windows\System\cwSIyJe.exe
  C:\Windows\System\cwSIyJe.exe
  2⤵
  PID:6720
- C:\Windows\System\qdinrRZ.exe
  C:\Windows\System\qdinrRZ.exe
  2⤵
  PID:6736
- C:\Windows\System\ygAvyeM.exe
  C:\Windows\System\ygAvyeM.exe
  2⤵
  PID:6752
- C:\Windows\System\VYpEsXV.exe
  C:\Windows\System\VYpEsXV.exe
  2⤵
  PID:6768
- C:\Windows\System\EuLibdm.exe
  C:\Windows\System\EuLibdm.exe
  2⤵
  PID:6788
- C:\Windows\System\TlHoFZY.exe
  C:\Windows\System\TlHoFZY.exe
  2⤵
  PID:6872
- C:\Windows\System\hFHeKYX.exe
  C:\Windows\System\hFHeKYX.exe
  2⤵
  PID:6888
- C:\Windows\System\QRMsAqo.exe
  C:\Windows\System\QRMsAqo.exe
  2⤵
  PID:6904
- C:\Windows\System\WWayakF.exe
  C:\Windows\System\WWayakF.exe
  2⤵
  PID:6920
- C:\Windows\System\edbAfFj.exe
  C:\Windows\System\edbAfFj.exe
  2⤵
  PID:6940
- C:\Windows\System\URbFXfU.exe
  C:\Windows\System\URbFXfU.exe
  2⤵
  PID:6964
- C:\Windows\System\ivOAjEh.exe
  C:\Windows\System\ivOAjEh.exe
  2⤵
  PID:6980
- C:\Windows\System\dwiqxBI.exe
  C:\Windows\System\dwiqxBI.exe
  2⤵
  PID:6996
- C:\Windows\System\qaAkuMt.exe
  C:\Windows\System\qaAkuMt.exe
  2⤵
  PID:7012
- C:\Windows\System\zNqMmkn.exe
  C:\Windows\System\zNqMmkn.exe
  2⤵
  PID:7028
- C:\Windows\System\AJjXAXP.exe
  C:\Windows\System\AJjXAXP.exe
  2⤵
  PID:7044
- C:\Windows\System\moFMCZp.exe
  C:\Windows\System\moFMCZp.exe
  2⤵
  PID:7060
- C:\Windows\System\spEcIMz.exe
  C:\Windows\System\spEcIMz.exe
  2⤵
  PID:7084
- C:\Windows\System\oSMLKYc.exe
  C:\Windows\System\oSMLKYc.exe
  2⤵
  PID:7108
- C:\Windows\System\DPNnnNg.exe
  C:\Windows\System\DPNnnNg.exe
  2⤵
  PID:7124
- C:\Windows\System\lQWTLwI.exe
  C:\Windows\System\lQWTLwI.exe
  2⤵
  PID:7140
- C:\Windows\System\FzIJqYK.exe
  C:\Windows\System\FzIJqYK.exe
  2⤵
  PID:7160
- C:\Windows\System\ORcSpmf.exe
  C:\Windows\System\ORcSpmf.exe
  2⤵
  PID:6152
- C:\Windows\System\GqZCWXf.exe
  C:\Windows\System\GqZCWXf.exe
  2⤵
  PID:5316
- C:\Windows\System\DDZKcEs.exe
  C:\Windows\System\DDZKcEs.exe
  2⤵
  PID:6172
- C:\Windows\System\KJRywRS.exe
  C:\Windows\System\KJRywRS.exe
  2⤵
  PID:6236
- C:\Windows\System\ZWNCATJ.exe
  C:\Windows\System\ZWNCATJ.exe
  2⤵
  PID:6280
- C:\Windows\System\WPpwBIF.exe
  C:\Windows\System\WPpwBIF.exe
  2⤵
  PID:6312
- C:\Windows\System\REOAvdm.exe
  C:\Windows\System\REOAvdm.exe
  2⤵
  PID:6348
- C:\Windows\System\xTRoIeo.exe
  C:\Windows\System\xTRoIeo.exe
  2⤵
  PID:6388
- C:\Windows\System\GIUwIdd.exe
  C:\Windows\System\GIUwIdd.exe
  2⤵
  PID:6448
- C:\Windows\System\muxWBKn.exe
  C:\Windows\System\muxWBKn.exe
  2⤵
  PID:6484
- C:\Windows\System\PVVUnid.exe
  C:\Windows\System\PVVUnid.exe
  2⤵
  PID:6464
- C:\Windows\System\nCuSHwi.exe
  C:\Windows\System\nCuSHwi.exe
  2⤵
  PID:6536
- C:\Windows\System\lspbkCT.exe
  C:\Windows\System\lspbkCT.exe
  2⤵
  PID:6656
- C:\Windows\System\KQMjNng.exe
  C:\Windows\System\KQMjNng.exe
  2⤵
  PID:6688
- C:\Windows\System\cWEDSSq.exe
  C:\Windows\System\cWEDSSq.exe
  2⤵
  PID:6552
- C:\Windows\System\CuqhsrI.exe
  C:\Windows\System\CuqhsrI.exe
  2⤵
  PID:6732
- C:\Windows\System\NpnXUGF.exe
  C:\Windows\System\NpnXUGF.exe
  2⤵
  PID:6764
- C:\Windows\System\SgxYhcT.exe
  C:\Windows\System\SgxYhcT.exe
  2⤵
  PID:6640
- C:\Windows\System\ibGewlF.exe
  C:\Windows\System\ibGewlF.exe
  2⤵
  PID:6704
- C:\Windows\System\HhNjKJs.exe
  C:\Windows\System\HhNjKJs.exe
  2⤵
  PID:6744
- C:\Windows\System\qsvyTAh.exe
  C:\Windows\System\qsvyTAh.exe
  2⤵
  PID:6676
- C:\Windows\System\DDTMEKS.exe
  C:\Windows\System\DDTMEKS.exe
  2⤵
  PID:6812
- C:\Windows\System\ttUyaZJ.exe
  C:\Windows\System\ttUyaZJ.exe
  2⤵
  PID:6828
- C:\Windows\System\WdCCGLG.exe
  C:\Windows\System\WdCCGLG.exe
  2⤵
  PID:6840
- C:\Windows\System\LMNjOFW.exe
  C:\Windows\System\LMNjOFW.exe
  2⤵
  PID:6912
- C:\Windows\System\xKZHGJW.exe
  C:\Windows\System\xKZHGJW.exe
  2⤵
  PID:6932
- C:\Windows\System\sCwKIdO.exe
  C:\Windows\System\sCwKIdO.exe
  2⤵
  PID:6916
- C:\Windows\System\BRaakVA.exe
  C:\Windows\System\BRaakVA.exe
  2⤵
  PID:6972
- C:\Windows\System\RZiwLun.exe
  C:\Windows\System\RZiwLun.exe
  2⤵
  PID:7036
- C:\Windows\System\DXzqgLT.exe
  C:\Windows\System\DXzqgLT.exe
  2⤵
  PID:7080
- C:\Windows\System\yTSeDbF.exe
  C:\Windows\System\yTSeDbF.exe
  2⤵
  PID:7120
- C:\Windows\System\nFazMSo.exe
  C:\Windows\System\nFazMSo.exe
  2⤵
  PID:6988
- C:\Windows\System\JUUSoeU.exe
  C:\Windows\System\JUUSoeU.exe
  2⤵
  PID:7100
- C:\Windows\System\KmluNKI.exe
  C:\Windows\System\KmluNKI.exe
  2⤵
  PID:7156
- C:\Windows\System\LXspLjf.exe
  C:\Windows\System\LXspLjf.exe
  2⤵
  PID:1096
- C:\Windows\System\kjhCYmk.exe
  C:\Windows\System\kjhCYmk.exe
  2⤵
  PID:6168
- C:\Windows\System\GJtKUrY.exe
  C:\Windows\System\GJtKUrY.exe
  2⤵
  PID:6296
- C:\Windows\System\FHMuOvG.exe
  C:\Windows\System\FHMuOvG.exe
  2⤵
  PID:6480
- C:\Windows\System\hgKTEPP.exe
  C:\Windows\System\hgKTEPP.exe
  2⤵
  PID:6404
- C:\Windows\System\LXdAOFx.exe
  C:\Windows\System\LXdAOFx.exe
  2⤵
  PID:6504
- C:\Windows\System\ASdiOLM.exe
  C:\Windows\System\ASdiOLM.exe
  2⤵
  PID:6616
- C:\Windows\System\HsUvzIa.exe
  C:\Windows\System\HsUvzIa.exe
  2⤵
  PID:6584
- C:\Windows\System\ecRPGzV.exe
  C:\Windows\System\ecRPGzV.exe
  2⤵
  PID:6760
- C:\Windows\System\Abjvwpo.exe
  C:\Windows\System\Abjvwpo.exe
  2⤵
  PID:6780
- C:\Windows\System\YAQkklx.exe
  C:\Windows\System\YAQkklx.exe
  2⤵
  PID:6848
- C:\Windows\System\UGIxIqL.exe
  C:\Windows\System\UGIxIqL.exe
  2⤵
  PID:6708
- C:\Windows\System\NYsBdFe.exe
  C:\Windows\System\NYsBdFe.exe
  2⤵
  PID:7068
- C:\Windows\System\BJsVMNB.exe
  C:\Windows\System\BJsVMNB.exe
  2⤵
  PID:6884
- C:\Windows\System\YqSZLLP.exe
  C:\Windows\System\YqSZLLP.exe
  2⤵
  PID:7008
- C:\Windows\System\HIAHdip.exe
  C:\Windows\System\HIAHdip.exe
  2⤵
  PID:6204
- C:\Windows\System\kPPaVLL.exe
  C:\Windows\System\kPPaVLL.exe
  2⤵
  PID:6188
- C:\Windows\System\YOgJUhg.exe
  C:\Windows\System\YOgJUhg.exe
  2⤵
  PID:6252
- C:\Windows\System\xWzsEnW.exe
  C:\Windows\System\xWzsEnW.exe
  2⤵
  PID:6432
- C:\Windows\System\treXmMy.exe
  C:\Windows\System\treXmMy.exe
  2⤵
  PID:6796
- C:\Windows\System\CZrtAKT.exe
  C:\Windows\System\CZrtAKT.exe
  2⤵
  PID:6856
- C:\Windows\System\nqtcXfR.exe
  C:\Windows\System\nqtcXfR.exe
  2⤵
  PID:6520
- C:\Windows\System\ZXqLIzv.exe
  C:\Windows\System\ZXqLIzv.exe
  2⤵
  PID:7052
- C:\Windows\System\gsQPnOL.exe
  C:\Windows\System\gsQPnOL.exe
  2⤵
  PID:6488
- C:\Windows\System\ynZJcgK.exe
  C:\Windows\System\ynZJcgK.exe
  2⤵
  PID:7072
- C:\Windows\System\EDXDMIM.exe
  C:\Windows\System\EDXDMIM.exe
  2⤵
  PID:6600
- C:\Windows\System\CFnFppt.exe
  C:\Windows\System\CFnFppt.exe
  2⤵
  PID:6784
- C:\Windows\System\WuwzELC.exe
  C:\Windows\System\WuwzELC.exe
  2⤵
  PID:6316
- C:\Windows\System\LSbEHNG.exe
  C:\Windows\System\LSbEHNG.exe
  2⤵
  PID:6816
- C:\Windows\System\ByCiHFA.exe
  C:\Windows\System\ByCiHFA.exe
  2⤵
  PID:6824
- C:\Windows\System\rRZOOzG.exe
  C:\Windows\System\rRZOOzG.exe
  2⤵
  PID:6692
- C:\Windows\System\XqeAuia.exe
  C:\Windows\System\XqeAuia.exe
  2⤵
  PID:6804
- C:\Windows\System\vbzvLgd.exe
  C:\Windows\System\vbzvLgd.exe
  2⤵
  PID:6748
- C:\Windows\System\XcJbZda.exe
  C:\Windows\System\XcJbZda.exe
  2⤵
  PID:6844
- C:\Windows\System\JMKhyLm.exe
  C:\Windows\System\JMKhyLm.exe
  2⤵
  PID:7172
- C:\Windows\System\rqgkUWp.exe
  C:\Windows\System\rqgkUWp.exe
  2⤵
  PID:7188
- C:\Windows\System\JGkqRJw.exe
  C:\Windows\System\JGkqRJw.exe
  2⤵
  PID:7204
- C:\Windows\System\RWMWVnW.exe
  C:\Windows\System\RWMWVnW.exe
  2⤵
  PID:7224
- C:\Windows\System\WparUyf.exe
  C:\Windows\System\WparUyf.exe
  2⤵
  PID:7240
- C:\Windows\System\UYzEuIV.exe
  C:\Windows\System\UYzEuIV.exe
  2⤵
  PID:7256
- C:\Windows\System\qbMOGAl.exe
  C:\Windows\System\qbMOGAl.exe
  2⤵
  PID:7272
- C:\Windows\System\XfVKLBT.exe
  C:\Windows\System\XfVKLBT.exe
  2⤵
  PID:7288
- C:\Windows\System\VvjLmWr.exe
  C:\Windows\System\VvjLmWr.exe
  2⤵
  PID:7304
- C:\Windows\System\bNIsQBH.exe
  C:\Windows\System\bNIsQBH.exe
  2⤵
  PID:7324
- C:\Windows\System\qWIYZsf.exe
  C:\Windows\System\qWIYZsf.exe
  2⤵
  PID:7340
- C:\Windows\System\WtLxxSW.exe
  C:\Windows\System\WtLxxSW.exe
  2⤵
  PID:7360
- C:\Windows\System\bHNvrLR.exe
  C:\Windows\System\bHNvrLR.exe
  2⤵
  PID:7380
- C:\Windows\System\LaPmaEj.exe
  C:\Windows\System\LaPmaEj.exe
  2⤵
  PID:7396
- C:\Windows\System\HdZeYFv.exe
  C:\Windows\System\HdZeYFv.exe
  2⤵
  PID:7412
- C:\Windows\System\iARSRUq.exe
  C:\Windows\System\iARSRUq.exe
  2⤵
  PID:7428
- C:\Windows\System\AHSjiLD.exe
  C:\Windows\System\AHSjiLD.exe
  2⤵
  PID:7448
- C:\Windows\System\CUdRJAW.exe
  C:\Windows\System\CUdRJAW.exe
  2⤵
  PID:7464
- C:\Windows\System\lhiBUSK.exe
  C:\Windows\System\lhiBUSK.exe
  2⤵
  PID:7480
- C:\Windows\System\jepDgwN.exe
  C:\Windows\System\jepDgwN.exe
  2⤵
  PID:7496
- C:\Windows\System\vZKlOgD.exe
  C:\Windows\System\vZKlOgD.exe
  2⤵
  PID:7512
- C:\Windows\System\SrVNnnP.exe
  C:\Windows\System\SrVNnnP.exe
  2⤵
  PID:7528
- C:\Windows\System\uXQlMIk.exe
  C:\Windows\System\uXQlMIk.exe
  2⤵
  PID:7544
- C:\Windows\System\YDetoqn.exe
  C:\Windows\System\YDetoqn.exe
  2⤵
  PID:7560
- C:\Windows\System\ynvNerb.exe
  C:\Windows\System\ynvNerb.exe
  2⤵
  PID:7576
- C:\Windows\System\AgiOHAz.exe
  C:\Windows\System\AgiOHAz.exe
  2⤵
  PID:7592
- C:\Windows\System\uaSpdvs.exe
  C:\Windows\System\uaSpdvs.exe
  2⤵
  PID:7608
- C:\Windows\System\FGIDYOs.exe
  C:\Windows\System\FGIDYOs.exe
  2⤵
  PID:7640
- C:\Windows\System\fZsbmZG.exe
  C:\Windows\System\fZsbmZG.exe
  2⤵
  PID:7676
- C:\Windows\System\GeIEgaa.exe
  C:\Windows\System\GeIEgaa.exe
  2⤵
  PID:7712
- C:\Windows\System\LUFMDRn.exe
  C:\Windows\System\LUFMDRn.exe
  2⤵
  PID:7728
- C:\Windows\System\bIwmvRd.exe
  C:\Windows\System\bIwmvRd.exe
  2⤵
  PID:7744
- C:\Windows\System\rRmPPqW.exe
  C:\Windows\System\rRmPPqW.exe
  2⤵
  PID:7760
- C:\Windows\System\KoogGmt.exe
  C:\Windows\System\KoogGmt.exe
  2⤵
  PID:7780
- C:\Windows\System\DZlxVkv.exe
  C:\Windows\System\DZlxVkv.exe
  2⤵
  PID:7824
- C:\Windows\System\DLqzsUC.exe
  C:\Windows\System\DLqzsUC.exe
  2⤵
  PID:7840
- C:\Windows\System\aNbxRre.exe
  C:\Windows\System\aNbxRre.exe
  2⤵
  PID:7860
- C:\Windows\System\VMuuKcs.exe
  C:\Windows\System\VMuuKcs.exe
  2⤵
  PID:7876
- C:\Windows\System\XJslbdC.exe
  C:\Windows\System\XJslbdC.exe
  2⤵
  PID:7900
- C:\Windows\System\UfDsVnM.exe
  C:\Windows\System\UfDsVnM.exe
  2⤵
  PID:7916
- C:\Windows\System\jqyMCpK.exe
  C:\Windows\System\jqyMCpK.exe
  2⤵
  PID:7932
- C:\Windows\System\LRclivY.exe
  C:\Windows\System\LRclivY.exe
  2⤵
  PID:7964
- C:\Windows\System\TFnEqNo.exe
  C:\Windows\System\TFnEqNo.exe
  2⤵
  PID:7984
- C:\Windows\System\cCKoAkM.exe
  C:\Windows\System\cCKoAkM.exe
  2⤵
  PID:8000
- C:\Windows\System\SgGOnmW.exe
  C:\Windows\System\SgGOnmW.exe
  2⤵
  PID:8020
- C:\Windows\System\baXCCrn.exe
  C:\Windows\System\baXCCrn.exe
  2⤵
  PID:8044
- C:\Windows\System\oNgESAQ.exe
  C:\Windows\System\oNgESAQ.exe
  2⤵
  PID:8060
- C:\Windows\System\frbvhme.exe
  C:\Windows\System\frbvhme.exe
  2⤵
  PID:8076
- C:\Windows\System\QqAXdIt.exe
  C:\Windows\System\QqAXdIt.exe
  2⤵
  PID:8092
- C:\Windows\System\rJrNgbm.exe
  C:\Windows\System\rJrNgbm.exe
  2⤵
  PID:8112
- C:\Windows\System\ppywyRX.exe
  C:\Windows\System\ppywyRX.exe
  2⤵
  PID:8128
- C:\Windows\System\EAHTeGr.exe
  C:\Windows\System\EAHTeGr.exe
  2⤵
  PID:8144
- C:\Windows\System\zaHULWV.exe
  C:\Windows\System\zaHULWV.exe
  2⤵
  PID:8160
- C:\Windows\System\qSEieOc.exe
  C:\Windows\System\qSEieOc.exe
  2⤵
  PID:8180
- C:\Windows\System\FCmXoKF.exe
  C:\Windows\System\FCmXoKF.exe
  2⤵
  PID:7252
- C:\Windows\System\DhwDshi.exe
  C:\Windows\System\DhwDshi.exe
  2⤵
  PID:7316
- C:\Windows\System\WWSaPSL.exe
  C:\Windows\System\WWSaPSL.exe
  2⤵
  PID:7132
- C:\Windows\System\RpPKiXe.exe
  C:\Windows\System\RpPKiXe.exe
  2⤵
  PID:7320
- C:\Windows\System\zPLJCIE.exe
  C:\Windows\System\zPLJCIE.exe
  2⤵
  PID:7236
- C:\Windows\System\FpkKNdu.exe
  C:\Windows\System\FpkKNdu.exe
  2⤵
  PID:7388
- C:\Windows\System\YHTtkLs.exe
  C:\Windows\System\YHTtkLs.exe
  2⤵
  PID:7336
- C:\Windows\System\aFjyNHK.exe
  C:\Windows\System\aFjyNHK.exe
  2⤵
  PID:7368
- C:\Windows\System\LgmvDUt.exe
  C:\Windows\System\LgmvDUt.exe
  2⤵
  PID:7460
- C:\Windows\System\WTTpiDn.exe
  C:\Windows\System\WTTpiDn.exe
  2⤵
  PID:7472
- C:\Windows\System\PirIrcQ.exe
  C:\Windows\System\PirIrcQ.exe
  2⤵
  PID:7552
- C:\Windows\System\EHTXpDL.exe
  C:\Windows\System\EHTXpDL.exe
  2⤵
  PID:7508
- C:\Windows\System\Cuxgirq.exe
  C:\Windows\System\Cuxgirq.exe
  2⤵
  PID:7572
- C:\Windows\System\dLAqLoH.exe
  C:\Windows\System\dLAqLoH.exe
  2⤵
  PID:6384
- C:\Windows\System\uCkVqxD.exe
  C:\Windows\System\uCkVqxD.exe
  2⤵
  PID:7656
- C:\Windows\System\vGYWiaD.exe
  C:\Windows\System\vGYWiaD.exe
  2⤵
  PID:7768
- C:\Windows\System\hTQTtFA.exe
  C:\Windows\System\hTQTtFA.exe
  2⤵
  PID:7696
- C:\Windows\System\aHqPEwV.exe
  C:\Windows\System\aHqPEwV.exe
  2⤵
  PID:7720
- C:\Windows\System\PBrDHzb.exe
  C:\Windows\System\PBrDHzb.exe
  2⤵
  PID:7756
- C:\Windows\System\gfoKdai.exe
  C:\Windows\System\gfoKdai.exe
  2⤵
  PID:7832
- C:\Windows\System\pgWpoTJ.exe
  C:\Windows\System\pgWpoTJ.exe
  2⤵
  PID:7940
- C:\Windows\System\OBlDsdX.exe
  C:\Windows\System\OBlDsdX.exe
  2⤵
  PID:7956
- C:\Windows\System\BerJvrD.exe
  C:\Windows\System\BerJvrD.exe
  2⤵
  PID:8036
- C:\Windows\System\fsLNeSb.exe
  C:\Windows\System\fsLNeSb.exe
  2⤵
  PID:7888
- C:\Windows\System\szQNmcg.exe
  C:\Windows\System\szQNmcg.exe
  2⤵
  PID:8008
- C:\Windows\System\HPQuUAw.exe
  C:\Windows\System\HPQuUAw.exe
  2⤵
  PID:7928
- C:\Windows\System\QJvcJeD.exe
  C:\Windows\System\QJvcJeD.exe
  2⤵
  PID:8052
- C:\Windows\System\HmgXTpq.exe
  C:\Windows\System\HmgXTpq.exe
  2⤵
  PID:8108
- C:\Windows\System\fEjImBg.exe
  C:\Windows\System\fEjImBg.exe
  2⤵
  PID:8168
- C:\Windows\System\XotyAwm.exe
  C:\Windows\System\XotyAwm.exe
  2⤵
  PID:8056
- C:\Windows\System\SrfdAuX.exe
  C:\Windows\System\SrfdAuX.exe
  2⤵
  PID:8124
- C:\Windows\System\QytjnJo.exe
  C:\Windows\System\QytjnJo.exe
  2⤵
  PID:7300
- C:\Windows\System\fwqzimp.exe
  C:\Windows\System\fwqzimp.exe
  2⤵
  PID:7352
- C:\Windows\System\NgNcjYs.exe
  C:\Windows\System\NgNcjYs.exe
  2⤵
  PID:7212
- C:\Windows\System\tPvHomL.exe
  C:\Windows\System\tPvHomL.exe
  2⤵
  PID:7200
- C:\Windows\System\hKtLccM.exe
  C:\Windows\System\hKtLccM.exe
  2⤵
  PID:7408
- C:\Windows\System\KcBcKYX.exe
  C:\Windows\System\KcBcKYX.exe
  2⤵
  PID:7220
- C:\Windows\System\jsjyByy.exe
  C:\Windows\System\jsjyByy.exe
  2⤵
  PID:7536
- C:\Windows\System\DvIHpLX.exe
  C:\Windows\System\DvIHpLX.exe
  2⤵
  PID:7568
- C:\Windows\System\kIqqwDE.exe
  C:\Windows\System\kIqqwDE.exe
  2⤵
  PID:7616
- C:\Windows\System\aZDoYWr.exe
  C:\Windows\System\aZDoYWr.exe
  2⤵
  PID:7736
- C:\Windows\System\SclVJhS.exe
  C:\Windows\System\SclVJhS.exe
  2⤵
  PID:7708
- C:\Windows\System\idyIqup.exe
  C:\Windows\System\idyIqup.exe
  2⤵
  PID:7692
- C:\Windows\System\fVqQDJT.exe
  C:\Windows\System\fVqQDJT.exe
  2⤵
  PID:7788
- C:\Windows\System\UxUPOar.exe
  C:\Windows\System\UxUPOar.exe
  2⤵
  PID:7872
- C:\Windows\System\jQsTLGn.exe
  C:\Windows\System\jQsTLGn.exe
  2⤵
  PID:8028
- C:\Windows\System\HBpNRyg.exe
  C:\Windows\System\HBpNRyg.exe
  2⤵
  PID:7856
- C:\Windows\System\lviigBv.exe
  C:\Windows\System\lviigBv.exe
  2⤵
  PID:8100
- C:\Windows\System\MXMtZaL.exe
  C:\Windows\System\MXMtZaL.exe
  2⤵
  PID:8012
- C:\Windows\System\JLREZCA.exe
  C:\Windows\System\JLREZCA.exe
  2⤵
  PID:8032
- C:\Windows\System\gIYpraM.exe
  C:\Windows\System\gIYpraM.exe
  2⤵
  PID:7180
- C:\Windows\System\BeEnSIU.exe
  C:\Windows\System\BeEnSIU.exe
  2⤵
  PID:7376
- C:\Windows\System\HiJjrKK.exe
  C:\Windows\System\HiJjrKK.exe
  2⤵
  PID:7492
- C:\Windows\System\RxQdSOX.exe
  C:\Windows\System\RxQdSOX.exe
  2⤵
  PID:7440
- C:\Windows\System\UraSEbz.exe
  C:\Windows\System\UraSEbz.exe
  2⤵
  PID:7992
- C:\Windows\System\pwRxayq.exe
  C:\Windows\System\pwRxayq.exe
  2⤵
  PID:7996
- C:\Windows\System\hEFEgpc.exe
  C:\Windows\System\hEFEgpc.exe
  2⤵
  PID:7704
- C:\Windows\System\YPZktxI.exe
  C:\Windows\System\YPZktxI.exe
  2⤵
  PID:7924
- C:\Windows\System\waVqSOU.exe
  C:\Windows\System\waVqSOU.exe
  2⤵
  PID:7980
- C:\Windows\System\UksATVd.exe
  C:\Windows\System\UksATVd.exe
  2⤵
  PID:7332
- C:\Windows\System\CwgCQkH.exe
  C:\Windows\System\CwgCQkH.exe
  2⤵
  PID:7852
- C:\Windows\System\ECVPrHw.exe
  C:\Windows\System\ECVPrHw.exe
  2⤵
  PID:7684
- C:\Windows\System\AmpLQoW.exe
  C:\Windows\System\AmpLQoW.exe
  2⤵
  PID:7476
- C:\Windows\System\JzXmsPq.exe
  C:\Windows\System\JzXmsPq.exe
  2⤵
  PID:7952
- C:\Windows\System\DKXcVIj.exe
  C:\Windows\System\DKXcVIj.exe
  2⤵
  PID:7436
- C:\Windows\System\SRkWrTB.exe
  C:\Windows\System\SRkWrTB.exe
  2⤵
  PID:8208
- C:\Windows\System\THvsFJJ.exe
  C:\Windows\System\THvsFJJ.exe
  2⤵
  PID:8224
- C:\Windows\System\PaKGiel.exe
  C:\Windows\System\PaKGiel.exe
  2⤵
  PID:8240
- C:\Windows\System\snhWdAj.exe
  C:\Windows\System\snhWdAj.exe
  2⤵
  PID:8256
- C:\Windows\System\QasEhNB.exe
  C:\Windows\System\QasEhNB.exe
  2⤵
  PID:8276
- C:\Windows\System\dRyypbI.exe
  C:\Windows\System\dRyypbI.exe
  2⤵
  PID:8292
- C:\Windows\System\LHSExpv.exe
  C:\Windows\System\LHSExpv.exe
  2⤵
  PID:8308
- C:\Windows\System\WrCERXQ.exe
  C:\Windows\System\WrCERXQ.exe
  2⤵
  PID:8324
- C:\Windows\System\LgDjCRR.exe
  C:\Windows\System\LgDjCRR.exe
  2⤵
  PID:8344
- C:\Windows\System\HweLXHH.exe
  C:\Windows\System\HweLXHH.exe
  2⤵
  PID:8368
- C:\Windows\System\MJuQoTk.exe
  C:\Windows\System\MJuQoTk.exe
  2⤵
  PID:8384
- C:\Windows\System\xyliyGk.exe
  C:\Windows\System\xyliyGk.exe
  2⤵
  PID:8400
- C:\Windows\System\ElwbUjq.exe
  C:\Windows\System\ElwbUjq.exe
  2⤵
  PID:8416
- C:\Windows\System\FZvNdUu.exe
  C:\Windows\System\FZvNdUu.exe
  2⤵
  PID:8432
- C:\Windows\System\orrkauG.exe
  C:\Windows\System\orrkauG.exe
  2⤵
  PID:8460
- C:\Windows\System\YAhiTqq.exe
  C:\Windows\System\YAhiTqq.exe
  2⤵
  PID:8480
- C:\Windows\System\qvdbsLg.exe
  C:\Windows\System\qvdbsLg.exe
  2⤵
  PID:8496
- C:\Windows\System\TzFkEBT.exe
  C:\Windows\System\TzFkEBT.exe
  2⤵
  PID:8512
- C:\Windows\System\cyFksqO.exe
  C:\Windows\System\cyFksqO.exe
  2⤵
  PID:8528
- C:\Windows\System\yqPyXrf.exe
  C:\Windows\System\yqPyXrf.exe
  2⤵
  PID:8544
- C:\Windows\System\JGPLlHH.exe
  C:\Windows\System\JGPLlHH.exe
  2⤵
  PID:8560
- C:\Windows\System\CilNhas.exe
  C:\Windows\System\CilNhas.exe
  2⤵
  PID:8584
- C:\Windows\System\jhqkWhg.exe
  C:\Windows\System\jhqkWhg.exe
  2⤵
  PID:8600
- C:\Windows\System\sLQWRXb.exe
  C:\Windows\System\sLQWRXb.exe
  2⤵
  PID:8616
- C:\Windows\System\xgxqOFy.exe
  C:\Windows\System\xgxqOFy.exe
  2⤵
  PID:8632
- C:\Windows\System\RCKGwPa.exe
  C:\Windows\System\RCKGwPa.exe
  2⤵
  PID:8648
- C:\Windows\System\NhoMblD.exe
  C:\Windows\System\NhoMblD.exe
  2⤵
  PID:8680
- C:\Windows\System\qXmPXJv.exe
  C:\Windows\System\qXmPXJv.exe
  2⤵
  PID:8696
- C:\Windows\System\HCCkhnz.exe
  C:\Windows\System\HCCkhnz.exe
  2⤵
  PID:8712
- C:\Windows\System\qNtTQvt.exe
  C:\Windows\System\qNtTQvt.exe
  2⤵
  PID:8728
- C:\Windows\System\RpyonNC.exe
  C:\Windows\System\RpyonNC.exe
  2⤵
  PID:8744
- C:\Windows\System\jfzOiHw.exe
  C:\Windows\System\jfzOiHw.exe
  2⤵
  PID:8760
- C:\Windows\System\bkmEurd.exe
  C:\Windows\System\bkmEurd.exe
  2⤵
  PID:8776
- C:\Windows\System\JYRQqpX.exe
  C:\Windows\System\JYRQqpX.exe
  2⤵
  PID:8796
- C:\Windows\System\hZpjzbd.exe
  C:\Windows\System\hZpjzbd.exe
  2⤵
  PID:8824
- C:\Windows\System\Vqvsrny.exe
  C:\Windows\System\Vqvsrny.exe
  2⤵
  PID:8844
- C:\Windows\System\JvrLsBz.exe
  C:\Windows\System\JvrLsBz.exe
  2⤵
  PID:8864
- C:\Windows\System\oKFxzAO.exe
  C:\Windows\System\oKFxzAO.exe
  2⤵
  PID:8880
- C:\Windows\System\vevEPRX.exe
  C:\Windows\System\vevEPRX.exe
  2⤵
  PID:8896
- C:\Windows\System\WQNzXWg.exe
  C:\Windows\System\WQNzXWg.exe
  2⤵
  PID:8912
- C:\Windows\System\gXJZwvL.exe
  C:\Windows\System\gXJZwvL.exe
  2⤵
  PID:8948
- C:\Windows\System\DjslkTc.exe
  C:\Windows\System\DjslkTc.exe
  2⤵
  PID:8972
- C:\Windows\System\TgbGmuD.exe
  C:\Windows\System\TgbGmuD.exe
  2⤵
  PID:8992
- C:\Windows\System\pcIpvBE.exe
  C:\Windows\System\pcIpvBE.exe
  2⤵
  PID:9008
- C:\Windows\System\Oyfugbh.exe
  C:\Windows\System\Oyfugbh.exe
  2⤵
  PID:9024
- C:\Windows\System\USsoTNk.exe
  C:\Windows\System\USsoTNk.exe
  2⤵
  PID:9040
- C:\Windows\System\TxICqza.exe
  C:\Windows\System\TxICqza.exe
  2⤵
  PID:9056
- C:\Windows\System\kyRHtNJ.exe
  C:\Windows\System\kyRHtNJ.exe
  2⤵
  PID:9072
- C:\Windows\System\sOupYCx.exe
  C:\Windows\System\sOupYCx.exe
  2⤵
  PID:9088
- C:\Windows\System\jZkZLpH.exe
  C:\Windows\System\jZkZLpH.exe
  2⤵
  PID:9104
- C:\Windows\System\znNDvUi.exe
  C:\Windows\System\znNDvUi.exe
  2⤵
  PID:9120
- C:\Windows\System\ZVtGERk.exe
  C:\Windows\System\ZVtGERk.exe
  2⤵
  PID:9140
- C:\Windows\System\ewGtZwQ.exe
  C:\Windows\System\ewGtZwQ.exe
  2⤵
  PID:9160
- C:\Windows\System\hMUHKAw.exe
  C:\Windows\System\hMUHKAw.exe
  2⤵
  PID:9176
- C:\Windows\System\VQpUSlB.exe
  C:\Windows\System\VQpUSlB.exe
  2⤵
  PID:9192
- C:\Windows\System\BMLixZL.exe
  C:\Windows\System\BMLixZL.exe
  2⤵
  PID:9212
- C:\Windows\System\TyyelcD.exe
  C:\Windows\System\TyyelcD.exe
  2⤵
  PID:8200
- C:\Windows\System\KgMiqOZ.exe
  C:\Windows\System\KgMiqOZ.exe
  2⤵
  PID:8236
- C:\Windows\System\prqigTS.exe
  C:\Windows\System\prqigTS.exe
  2⤵
  PID:8300
- C:\Windows\System\IOBRxdg.exe
  C:\Windows\System\IOBRxdg.exe
  2⤵
  PID:8340
- C:\Windows\System\YFMJVcT.exe
  C:\Windows\System\YFMJVcT.exe
  2⤵
  PID:7420
- C:\Windows\System\aQUNLNe.exe
  C:\Windows\System\aQUNLNe.exe
  2⤵
  PID:8408
- C:\Windows\System\qPciFON.exe
  C:\Windows\System\qPciFON.exe
  2⤵
  PID:8412
- C:\Windows\System\KsNOjgw.exe
  C:\Windows\System\KsNOjgw.exe
  2⤵
  PID:8360
- C:\Windows\System\rlTyVno.exe
  C:\Windows\System\rlTyVno.exe
  2⤵
  PID:8452
- C:\Windows\System\GWuNCVV.exe
  C:\Windows\System\GWuNCVV.exe
  2⤵
  PID:8488
- C:\Windows\System\hbjBMFv.exe
  C:\Windows\System\hbjBMFv.exe
  2⤵
  PID:8508
- C:\Windows\System\zeWwLhv.exe
  C:\Windows\System\zeWwLhv.exe
  2⤵
  PID:8552
- C:\Windows\System\MsgLHHo.exe
  C:\Windows\System\MsgLHHo.exe
  2⤵
  PID:8540
- C:\Windows\System\BlZVDxb.exe
  C:\Windows\System\BlZVDxb.exe
  2⤵
  PID:8596
- C:\Windows\System\VBoSLHc.exe
  C:\Windows\System\VBoSLHc.exe
  2⤵
  PID:8628
- C:\Windows\System\VmagZUJ.exe
  C:\Windows\System\VmagZUJ.exe
  2⤵
  PID:8664
- C:\Windows\System\JleVaRX.exe
  C:\Windows\System\JleVaRX.exe
  2⤵
  PID:8704
- C:\Windows\System\oYYLAXG.exe
  C:\Windows\System\oYYLAXG.exe
  2⤵
  PID:8612
- C:\Windows\System\wMavAuc.exe
  C:\Windows\System\wMavAuc.exe
  2⤵
  PID:8640
- C:\Windows\System\ZpfgHlz.exe
  C:\Windows\System\ZpfgHlz.exe
  2⤵
  PID:8720
- C:\Windows\System\fDGTxBQ.exe
  C:\Windows\System\fDGTxBQ.exe
  2⤵
  PID:8936
- C:\Windows\System\kMOLSdX.exe
  C:\Windows\System\kMOLSdX.exe
  2⤵
  PID:8988
- C:\Windows\System\OvlGSya.exe
  C:\Windows\System\OvlGSya.exe
  2⤵
  PID:8960
- C:\Windows\System\aVawqJS.exe
  C:\Windows\System\aVawqJS.exe
  2⤵
  PID:9004
- C:\Windows\System\UJAArEz.exe
  C:\Windows\System\UJAArEz.exe
  2⤵
  PID:9148
- C:\Windows\System\EvDRAwo.exe
  C:\Windows\System\EvDRAwo.exe
  2⤵
  PID:9184
- C:\Windows\System\EaKbcWq.exe
  C:\Windows\System\EaKbcWq.exe
  2⤵
  PID:9168
- C:\Windows\System\oHDDmwy.exe
  C:\Windows\System\oHDDmwy.exe
  2⤵
  PID:9064
- C:\Windows\System\IUGCTwZ.exe
  C:\Windows\System\IUGCTwZ.exe
  2⤵
  PID:9172
- C:\Windows\System\fDNbQpP.exe
  C:\Windows\System\fDNbQpP.exe
  2⤵
  PID:8268
- C:\Windows\System\KpPYmlJ.exe
  C:\Windows\System\KpPYmlJ.exe
  2⤵
  PID:9136
- C:\Windows\System\IfAdmsV.exe
  C:\Windows\System\IfAdmsV.exe
  2⤵
  PID:8156
- C:\Windows\System\UxJWIjR.exe
  C:\Windows\System\UxJWIjR.exe
  2⤵
  PID:8380
- C:\Windows\System\MmJDaBj.exe
  C:\Windows\System\MmJDaBj.exe
  2⤵
  PID:8356
- C:\Windows\System\qqUSAUY.exe
  C:\Windows\System\qqUSAUY.exe
  2⤵
  PID:8252
- C:\Windows\System\HkUqgmu.exe
  C:\Windows\System\HkUqgmu.exe
  2⤵
  PID:8440
- C:\Windows\System\bjYbwdx.exe
  C:\Windows\System\bjYbwdx.exe
  2⤵
  PID:8556
- C:\Windows\System\YVAcRsu.exe
  C:\Windows\System\YVAcRsu.exe
  2⤵
  PID:8672
- C:\Windows\System\XufSjCp.exe
  C:\Windows\System\XufSjCp.exe
  2⤵
  PID:8932
- C:\Windows\System\DTFUIna.exe
  C:\Windows\System\DTFUIna.exe
  2⤵
  PID:9112
- C:\Windows\System\DDOoxDK.exe
  C:\Windows\System\DDOoxDK.exe
  2⤵
  PID:9096
- C:\Windows\System\rnmurZd.exe
  C:\Windows\System\rnmurZd.exe
  2⤵
  PID:9128
- C:\Windows\System\lJeUARo.exe
  C:\Windows\System\lJeUARo.exe
  2⤵
  PID:9208
- C:\Windows\System\QDnTLSC.exe
  C:\Windows\System\QDnTLSC.exe
  2⤵
  PID:6076
- C:\Windows\System\WwHmJbL.exe
  C:\Windows\System\WwHmJbL.exe
  2⤵
  PID:8232
- C:\Windows\System\kaiNhEI.exe
  C:\Windows\System\kaiNhEI.exe
  2⤵
  PID:7896
- C:\Windows\System\kbCuucn.exe
  C:\Windows\System\kbCuucn.exe
  2⤵
  PID:8220
- C:\Windows\System\IELzvGR.exe
  C:\Windows\System\IELzvGR.exe
  2⤵
  PID:8448
- C:\Windows\System\PeXRtdS.exe
  C:\Windows\System\PeXRtdS.exe
  2⤵
  PID:8428
- C:\Windows\System\lxlLOlb.exe
  C:\Windows\System\lxlLOlb.exe
  2⤵
  PID:9080
- C:\Windows\System\jvimXvm.exe
  C:\Windows\System\jvimXvm.exe
  2⤵
  PID:9220
- C:\Windows\System\BTYzzCt.exe
  C:\Windows\System\BTYzzCt.exe
  2⤵
  PID:9236
- C:\Windows\System\ZVffrzr.exe
  C:\Windows\System\ZVffrzr.exe
  2⤵
  PID:9252
- C:\Windows\System\BkERLCj.exe
  C:\Windows\System\BkERLCj.exe
  2⤵
  PID:9268
- C:\Windows\System\yTdKnWS.exe
  C:\Windows\System\yTdKnWS.exe
  2⤵
  PID:9288
- C:\Windows\System\MSvznYf.exe
  C:\Windows\System\MSvznYf.exe
  2⤵
  PID:9308
- C:\Windows\System\hMyxgkD.exe
  C:\Windows\System\hMyxgkD.exe
  2⤵
  PID:9324
- C:\Windows\System\rpGaYFr.exe
  C:\Windows\System\rpGaYFr.exe
  2⤵
  PID:9348
- C:\Windows\System\JmPCyjy.exe
  C:\Windows\System\JmPCyjy.exe
  2⤵
  PID:9368
- C:\Windows\System\AokpIpI.exe
  C:\Windows\System\AokpIpI.exe
  2⤵
  PID:9568
- C:\Windows\System\fFayKtH.exe
  C:\Windows\System\fFayKtH.exe
  2⤵
  PID:9584
- C:\Windows\System\KCJiGYS.exe
  C:\Windows\System\KCJiGYS.exe
  2⤵
  PID:9600
- C:\Windows\System\yEcDeWg.exe
  C:\Windows\System\yEcDeWg.exe
  2⤵
  PID:9632
- C:\Windows\System\hBuuKAM.exe
  C:\Windows\System\hBuuKAM.exe
  2⤵
  PID:9664
- C:\Windows\System\wkdsVBO.exe
  C:\Windows\System\wkdsVBO.exe
  2⤵
  PID:9828
- C:\Windows\System\eqpFOSh.exe
  C:\Windows\System\eqpFOSh.exe
  2⤵
  PID:10048
- C:\Windows\System\aERJScS.exe
  C:\Windows\System\aERJScS.exe
  2⤵
  PID:10068
- C:\Windows\System\HXYtGKd.exe
  C:\Windows\System\HXYtGKd.exe
  2⤵
  PID:10084
- C:\Windows\System\MiEaBYt.exe
  C:\Windows\System\MiEaBYt.exe
  2⤵
  PID:10100
- C:\Windows\System\qGfUrFc.exe
  C:\Windows\System\qGfUrFc.exe
  2⤵
  PID:10116
- C:\Windows\System\hWgeTRA.exe
  C:\Windows\System\hWgeTRA.exe
  2⤵
  PID:10132
- C:\Windows\System\QKcHDUD.exe
  C:\Windows\System\QKcHDUD.exe
  2⤵
  PID:10148
- C:\Windows\System\qEwKQLM.exe
  C:\Windows\System\qEwKQLM.exe
  2⤵
  PID:10172
- C:\Windows\System\HBpDMyQ.exe
  C:\Windows\System\HBpDMyQ.exe
  2⤵
  PID:10192
- C:\Windows\System\jCfKPHL.exe
  C:\Windows\System\jCfKPHL.exe
  2⤵
  PID:9452
- C:\Windows\System\kMSNuHP.exe
  C:\Windows\System\kMSNuHP.exe
  2⤵
  PID:9408
- C:\Windows\System\yfEeekt.exe
  C:\Windows\System\yfEeekt.exe
  2⤵
  PID:9456
- C:\Windows\System\xSdiKDs.exe
  C:\Windows\System\xSdiKDs.exe
  2⤵
  PID:9472
- C:\Windows\System\xJIYeHW.exe
  C:\Windows\System\xJIYeHW.exe
  2⤵
  PID:9504
- C:\Windows\System\cbTqKlo.exe
  C:\Windows\System\cbTqKlo.exe
  2⤵
  PID:9520
- C:\Windows\System\xxoHZal.exe
  C:\Windows\System\xxoHZal.exe
  2⤵
  PID:9656
- C:\Windows\System\UXwaQHu.exe
  C:\Windows\System\UXwaQHu.exe
  2⤵
  PID:9680
- C:\Windows\System\ApHFNZz.exe
  C:\Windows\System\ApHFNZz.exe
  2⤵
  PID:9764
- C:\Windows\System\gXwubqf.exe
  C:\Windows\System\gXwubqf.exe
  2⤵
  PID:9800
- C:\Windows\System\yvrtdbd.exe
  C:\Windows\System\yvrtdbd.exe
  2⤵
  PID:9700
- C:\Windows\System\fZmzJqD.exe
  C:\Windows\System\fZmzJqD.exe
  2⤵
  PID:9728
- C:\Windows\System\DCpYNkS.exe
  C:\Windows\System\DCpYNkS.exe
  2⤵
  PID:9748
- C:\Windows\System\UckrGwp.exe
  C:\Windows\System\UckrGwp.exe
  2⤵
  PID:9776
- C:\Windows\System\rHMxemT.exe
  C:\Windows\System\rHMxemT.exe
  2⤵
  PID:9804
- C:\Windows\System\HTTJpwS.exe
  C:\Windows\System\HTTJpwS.exe
  2⤵
  PID:9824
- C:\Windows\System\vrQgxYY.exe
  C:\Windows\System\vrQgxYY.exe
  2⤵
  PID:9928
- C:\Windows\System\YLVlgPe.exe
  C:\Windows\System\YLVlgPe.exe
  2⤵
  PID:9892
- C:\Windows\System\jTmaydO.exe
  C:\Windows\System\jTmaydO.exe
  2⤵
  PID:9940
- C:\Windows\System\cVhYpGh.exe
  C:\Windows\System\cVhYpGh.exe
  2⤵
  PID:9924
- C:\Windows\System\yQjvSeb.exe
  C:\Windows\System\yQjvSeb.exe
  2⤵
  PID:960
- C:\Windows\System\gdlDplJ.exe
  C:\Windows\System\gdlDplJ.exe
  2⤵
  PID:10092
- C:\Windows\System\ecHCZup.exe
  C:\Windows\System\ecHCZup.exe
  2⤵
  PID:9976
- C:\Windows\System\gVedgAA.exe
  C:\Windows\System\gVedgAA.exe
  2⤵
  PID:10156
- C:\Windows\System\OXZPYqT.exe
  C:\Windows\System\OXZPYqT.exe
  2⤵
  PID:9980
- C:\Windows\System\ZxkJZEq.exe
  C:\Windows\System\ZxkJZEq.exe
  2⤵
  PID:10076
- C:\Windows\System\TgmtNTn.exe
  C:\Windows\System\TgmtNTn.exe
  2⤵
  PID:10008
- C:\Windows\System\PSLigPS.exe
  C:\Windows\System\PSLigPS.exe
  2⤵
  PID:10000
- C:\Windows\System\KziZWIN.exe
  C:\Windows\System\KziZWIN.exe
  2⤵
  PID:10016
- C:\Windows\System\LJEgPzb.exe
  C:\Windows\System\LJEgPzb.exe
  2⤵
  PID:10024
- C:\Windows\System\BKFLzEE.exe
  C:\Windows\System\BKFLzEE.exe
  2⤵
  PID:9960
- C:\Windows\System\KpqUUrz.exe
  C:\Windows\System\KpqUUrz.exe
  2⤵
  PID:8536
- C:\Windows\System\YzzEiKt.exe
  C:\Windows\System\YzzEiKt.exe
  2⤵
  PID:9336
- C:\Windows\System\meOqHTz.exe
  C:\Windows\System\meOqHTz.exe
  2⤵
  PID:8984
- C:\Windows\System\yNTHfQa.exe
  C:\Windows\System\yNTHfQa.exe
  2⤵
  PID:9512
- C:\Windows\System\cIoXKXt.exe
  C:\Windows\System\cIoXKXt.exe
  2⤵
  PID:9296
- C:\Windows\System\HXbFQVH.exe
  C:\Windows\System\HXbFQVH.exe
  2⤵
  PID:9380
- C:\Windows\System\rBeKZwk.exe
  C:\Windows\System\rBeKZwk.exe
  2⤵
  PID:9412
- C:\Windows\System\AXdFTxV.exe
  C:\Windows\System\AXdFTxV.exe
  2⤵
  PID:9304
- C:\Windows\System\FGdYIBg.exe
  C:\Windows\System\FGdYIBg.exe
  2⤵
  PID:9476
- C:\Windows\System\vcBAenQ.exe
  C:\Windows\System\vcBAenQ.exe
  2⤵
  PID:9528
- C:\Windows\System\KESxiTj.exe
  C:\Windows\System\KESxiTj.exe
  2⤵
  PID:9648
- C:\Windows\System\DiPyPin.exe
  C:\Windows\System\DiPyPin.exe
  2⤵
  PID:9868
- C:\Windows\System\STxIgKI.exe
  C:\Windows\System\STxIgKI.exe
  2⤵
  PID:9840
- C:\Windows\System\nDNGwPS.exe
  C:\Windows\System\nDNGwPS.exe
  2⤵
  PID:9784
- C:\Windows\System\cwlSvWj.exe
  C:\Windows\System\cwlSvWj.exe
  2⤵
  PID:9768
- C:\Windows\System\rRYafqt.exe
  C:\Windows\System\rRYafqt.exe
  2⤵
  PID:9792
- C:\Windows\System\tsLfjpL.exe
  C:\Windows\System\tsLfjpL.exe
  2⤵
  PID:9864
- C:\Windows\System\KFWKGVq.exe
  C:\Windows\System\KFWKGVq.exe
  2⤵
  PID:9888
- C:\Windows\System\xlalAiQ.exe
  C:\Windows\System\xlalAiQ.exe
  2⤵
  PID:9912
- C:\Windows\System\kfaWMYJ.exe
  C:\Windows\System\kfaWMYJ.exe
  2⤵
  PID:1736
- C:\Windows\System\iogYsDE.exe
  C:\Windows\System\iogYsDE.exe
  2⤵
  PID:9900
- C:\Windows\System\BSRnZPZ.exe
  C:\Windows\System\BSRnZPZ.exe
  2⤵
  PID:10168
- C:\Windows\System\knZguns.exe
  C:\Windows\System\knZguns.exe
  2⤵
  PID:1684
- C:\Windows\System\ilvqMOq.exe
  C:\Windows\System\ilvqMOq.exe
  2⤵
  PID:10184
- C:\Windows\System\zzCBaYf.exe
  C:\Windows\System\zzCBaYf.exe
  2⤵
  PID:10044
- C:\Windows\System\TngbiDU.exe
  C:\Windows\System\TngbiDU.exe
  2⤵
  PID:10028
- C:\Windows\System\BzZEidw.exe
  C:\Windows\System\BzZEidw.exe
  2⤵
  PID:8568
- C:\Windows\System\vgAsXTu.exe
  C:\Windows\System\vgAsXTu.exe
  2⤵
  PID:8924
- C:\Windows\System\eOuOxIx.exe
  C:\Windows\System\eOuOxIx.exe
  2⤵
  PID:10208
- C:\Windows\System\aRWCMyv.exe
  C:\Windows\System\aRWCMyv.exe
  2⤵
  PID:8904
- C:\Windows\System\JCbadfB.exe
  C:\Windows\System\JCbadfB.exe
  2⤵
  PID:8956
- C:\Windows\System\jVcxGpU.exe
  C:\Windows\System\jVcxGpU.exe
  2⤵
  PID:10232
- C:\Windows\System\RDRBYgM.exe
  C:\Windows\System\RDRBYgM.exe
  2⤵
  PID:8740
- C:\Windows\System\wWpsoQu.exe
  C:\Windows\System\wWpsoQu.exe
  2⤵
  PID:8980
- C:\Windows\System\CywDLCY.exe
  C:\Windows\System\CywDLCY.exe
  2⤵
  PID:1436
- C:\Windows\System\hPFGrVh.exe
  C:\Windows\System\hPFGrVh.exe
  2⤵
  PID:8284
- C:\Windows\System\EwVJQsY.exe
  C:\Windows\System\EwVJQsY.exe
  2⤵
  PID:7672
- C:\Windows\System\ylPPgIp.exe
  C:\Windows\System\ylPPgIp.exe
  2⤵
  PID:9340
- C:\Windows\System\GQJZttv.exe
  C:\Windows\System\GQJZttv.exe
  2⤵
  PID:9576
- C:\Windows\System\foxtVcF.exe
  C:\Windows\System\foxtVcF.exe
  2⤵
  PID:9384
- C:\Windows\System\cyzybZT.exe
  C:\Windows\System\cyzybZT.exe
  2⤵
  PID:9608
- C:\Windows\System\bOsYdiw.exe
  C:\Windows\System\bOsYdiw.exe
  2⤵
  PID:9492
- C:\Windows\System\bELkmor.exe
  C:\Windows\System\bELkmor.exe
  2⤵
  PID:9552
- C:\Windows\System\kQmGxAF.exe
  C:\Windows\System\kQmGxAF.exe
  2⤵
  PID:9500
- C:\Windows\System\pHzJdKN.exe
  C:\Windows\System\pHzJdKN.exe
  2⤵
  PID:9696
- C:\Windows\System\oUAaoHL.exe
  C:\Windows\System\oUAaoHL.exe
  2⤵
  PID:9876
- C:\Windows\System\pUWAhNG.exe
  C:\Windows\System\pUWAhNG.exe
  2⤵
  PID:10164
- C:\Windows\System\cHIalxQ.exe
  C:\Windows\System\cHIalxQ.exe
  2⤵
  PID:10140
- C:\Windows\System\kFNOsZB.exe
  C:\Windows\System\kFNOsZB.exe
  2⤵
  PID:9448
- C:\Windows\System\OxjvNWQ.exe
  C:\Windows\System\OxjvNWQ.exe
  2⤵
  PID:9860
- C:\Windows\System\emWaFOi.exe
  C:\Windows\System\emWaFOi.exe
  2⤵
  PID:10004
- C:\Windows\System\WEyJEgR.exe
  C:\Windows\System\WEyJEgR.exe
  2⤵
  PID:9852
- C:\Windows\System\dAdTwrS.exe
  C:\Windows\System\dAdTwrS.exe
  2⤵
  PID:9968
- C:\Windows\System\oyqHtli.exe
  C:\Windows\System\oyqHtli.exe
  2⤵
  PID:10060
- C:\Windows\System\rIvSFFM.exe
  C:\Windows\System\rIvSFFM.exe
  2⤵
  PID:9952
- C:\Windows\System\gngWOSG.exe
  C:\Windows\System\gngWOSG.exe
  2⤵
  PID:10216
- C:\Windows\System\CHdCldO.exe
  C:\Windows\System\CHdCldO.exe
  2⤵
  PID:9396
- C:\Windows\System\DyLOkHh.exe
  C:\Windows\System\DyLOkHh.exe
  2⤵
  PID:9612
- C:\Windows\System\OJHJSkX.exe
  C:\Windows\System\OJHJSkX.exe
  2⤵
  PID:9316
- C:\Windows\System\OmkpTLT.exe
  C:\Windows\System\OmkpTLT.exe
  2⤵
  PID:9688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BunowLm.exe

Filesize
2.0MB

MD5
8e54e20bfd676368da31feb20d9956b2

SHA1
747282ad7af836869e38a8a8a76ca8265c5229f9

SHA256
bd012c4cddcfd3c6922babd154c19ace1c3a4bf57d82c96bb081843a1380f43d

SHA512
ad3953840190292f2348479a1ef8a1b94e589654b64a7f42a81e6193b34b4b22bb09685145a09a80050a19548edec2c0d169f3890c87134d2e75ba1cab922ab3

Download Submit
C:\Windows\system\CaQauCn.exe

Filesize
2.0MB

MD5
06f784fc108e2c61f2bfa6358c21a7b2

SHA1
9ddf839cca7305fb3e3a49f6a5066d80f79da2c1

SHA256
72760daf5d3979ecbf5f68528938ff777d84f49275fef3e517be2c09204d54e7

SHA512
7717e982fcfb2e9df54b019c08b11012eafb0ae8342beac5ea1f7f8013b9f2f9f78ba1b5e9850c4acab136bc27de6cff05c566fa0d4a28ef88ac19a46f91bd13

Download Submit
C:\Windows\system\EytTSEf.exe

Filesize
2.0MB

MD5
c11a7316dea34e426991d30d5f47918e

SHA1
11f4e643d93cfb3cd97c14930e27429a8d3c6d6a

SHA256
072777699e3cb7a6f1c7995547fee668a00bfab6df044753beabb86021271e35

SHA512
5c05044dd73850a622ec819f300a2611771b290e594d048b2f9a2b7eee76a04a0ea9ae4cca847f4fde505658549290044a3a50420a426a3cb767c86ae91561e2

Download Submit
C:\Windows\system\InnBugs.exe

Filesize
2.0MB

MD5
023aecf78cadc535497aa62c315148a5

SHA1
2cf52f2c433c6d913e5c7e186782089c64a6be9a

SHA256
ceee73bb2e085a4c6f0f214fecad49f489f0c629ebb62ba2ba364965267d5e5c

SHA512
5cf23a2235cce9875176eea656e2efc44406a4ba20f3db40c3a92dc3aa00793c64046eaeebb4ef262dfbd85065195211bbd11ababf02353276cc47b14c3f8aa2

Download Submit
C:\Windows\system\Kpxtebd.exe

Filesize
2.0MB

MD5
3380ab2c533d374ae7742508a423fc02

SHA1
7d68cb7d4d72e539303fcb1656170e454b914aa3

SHA256
36e228d9effd4d397c02dddc96ec6d5814b5f9216f810b343cf4756b56e6b625

SHA512
93de679906950efb7b1f938ecbab459899e92213f72a20940d006a5e531930745b5a3f066ee943de9c284961033d52c52b96bb988fb5333b6a7b6b9540b9a8f8

Download Submit
C:\Windows\system\KyYAxpr.exe

Filesize
2.0MB

MD5
f4390731ff2c025f77f25f97147ea384

SHA1
b59de26afc0572251b6084aa9afacb6c20bc845d

SHA256
62b30346c6f4f5ae14dce186a6810a000a30ac8b03bdbd974fcbc558a12547df

SHA512
ddc5c8fedeef1911df7b23b2eae1015b6bf2dfdf99af22c227dae8924c3822e9aee03c3856ab6bf2ea422733aff433d9f05669794167c99eb60dfc940c5bf81d

Download Submit
C:\Windows\system\KzvzSCY.exe

Filesize
2.0MB

MD5
a93ae76c8b2bc607274c0e554b1ebaf9

SHA1
078c013759b8b5fb620ada6b8ecb329b15b4b496

SHA256
de431268281b727bf105883677bfc451d8059e3406842f7f061e00d0ccdf04e2

SHA512
69344655efa0e26cf433732aeb79369e5c884a1b4194063181748f70b8ef721e63f9a95682c0682427ea3986c1a1aa8ae3a74d6860d82b306f221cd95b2421a9

Download Submit
C:\Windows\system\LNHCPtD.exe

Filesize
2.0MB

MD5
b1ee9b3cc09e4e211eb5c62ddc29626c

SHA1
f96c4dea68c5b342d96e11453ac6f141536da8f5

SHA256
adea52f3e3b6108fd325e6e3bcb796f6d2213f41bbca9a31ff8f6bc13711f41c

SHA512
df079b02d6c68f022ac7d03c39bd410069889308fefaaf2f3c2d5c3bf60c24f5bbdc29d1a3aa5f06461b31d88526a1a285000b6ae0b25bc98861720b40686bd7

Download Submit
C:\Windows\system\LotGRMJ.exe

Filesize
2.0MB

MD5
138eeb5910273784a7f0faa853c11a8c

SHA1
a23e27359d5445e573363a763e52132df2f5c6a7

SHA256
474b44a341c2999754e9aff4683fe4f5476f5b3b6e77037224ba38728b3d8d92

SHA512
2dae67fa270393235f91f09d353eee19288ff799d6bb999816704ed43d8ca34e4d404794ba104a3fbaaaec772056559d0bff0ef6e86ff957fa5c330ee44b98ea

Download Submit
C:\Windows\system\NkWQiCu.exe

Filesize
2.0MB

MD5
6669a7f76a9fd2e8d6726271b7a3ffc8

SHA1
9a89c3a6fb88f4df776f7522acc08ed13df4fbd0

SHA256
1813d46ad3b997493368730425c2caa1184d832ce85765411616750d10f3fd93

SHA512
8577e5abb9dd89db2595b2d8fb1eeb7a66d941d18c7586d7c2432bb2e17d4da4a944c79e6b56cb6dd87b950937ca490ad7fc198ae64c4fd7c0ba669919d696c1

Download Submit
C:\Windows\system\VpNTUIa.exe

Filesize
2.0MB

MD5
deafb9b2c91f669f2c3a93be1e6ecca3

SHA1
942bfdfff635311eb58709dca4f9ff198107c632

SHA256
7175a1a5e5a776efdfd5118f9a9ef80937164e57c6001b819a5f9f4cb5016654

SHA512
107b3cb096784f1f93ac3ed26b07f214f56947551511735414f48540e8e1eb152f89fd0a3a455e501fbd3f9b864f886230ec33fc030567983f9a2938e9a19aa4

Download Submit
C:\Windows\system\YduzdUI.exe

Filesize
2.0MB

MD5
675f118372b90c1a6fd2ba2758e3c3a2

SHA1
01ed411df4d59bd385da543a451bb90b570cfc24

SHA256
13547439d6a7b8c589c0e7fe4c64823a31c26e15ec4d9659c847b18bbd253181

SHA512
cc872e1c26ac3e74449839721abf5b483134e605032b00c6750b512d36f4d8ceba223aa32e57a316db236db95ba7ed1fac08cf96ac8079252cf1b0dd617ad6ff

Download Submit
C:\Windows\system\YxDKveO.exe

Filesize
2.0MB

MD5
55e8d22744a320c317d076dfc2db894e

SHA1
bec5420a184e9234d976d5e440b4b282a34b3df9

SHA256
a7d49ed8e24a838c1270d5c63cb276d8b0220dfa4a4be7ead4ca9beb94828488

SHA512
990401594de394eb43484f1440c2085637c0c051ede8e364490f0727abb03622681977ee7732b10bed3cf19ae6ff6e44548e41d24d88b05b40e693d0ec7821b3

Download Submit
C:\Windows\system\enuipTU.exe

Filesize
2.0MB

MD5
6b6e9e160491d439f881606b35085045

SHA1
fd2271fcf1cc781d6af276ce36c2c5596c4e9379

SHA256
51ea4106ceee7a41263478aca90f543d4837d67bf440379f069b8de1d0c38976

SHA512
9e8cff4ef6f889befaf818bb78c30d7e2f7dff6b785fe7328f979694703d1466ac6088d830efd3efa82d5d48f955f981ca42d6b5cefa10be837b8cf9fca44483

Download Submit
C:\Windows\system\ezGwfRO.exe

Filesize
2.0MB

MD5
ad589817c60ba1ba08b2d080aef70d70

SHA1
eb662a857498a570e4e0f2ec650b900fd3411da2

SHA256
d9f40915a26ba43559efb2c00ae4313d16bdcb9eef6c35b24349ddcd99b446a8

SHA512
57697e37641b1aa38c4b68b6a5d49231bb3791daae5c075b92898474239a245ab666477106c533f4fef301787e0a9a652b6596ad73a66ed9ef691b6b7340511c

Download Submit
C:\Windows\system\hdmbecQ.exe

Filesize
2.0MB

MD5
920e502237b47b1c8d40a7b5abbed47b

SHA1
1465a35db6e3e660e10f170424ede6b2021fa335

SHA256
dc7ce0d44fb10e43d67103333c63ee6895bfd2b1bf2aa69091f5a0df707999ce

SHA512
b0da84626195039ec9749b2528555fc29ed9aab412f40757dfc2377415a851e1dea97c6fea38712bc7a72cfdb75834a4391bdac47916504c3bc046b3a60eb822

Download Submit
C:\Windows\system\iEiJnMt.exe

Filesize
2.0MB

MD5
fef76c2aaa0670c96ce10070f8c592f4

SHA1
867b2ffb2966e937d277e96f40d4543da84b3de9

SHA256
057352cfa7bdd4efa47d48059ac156cfd4c8f09aaca68059bb6c5812c4042ec6

SHA512
6e2915899d0b271b5ee162d9ef2998b953a3cde029e7eb6bfceb07b2de7a5cae6dc3852b23da0ca80570da618026f24cbb8d25d4c12168b83f6c902d3d458fde

Download Submit
C:\Windows\system\jcBcstT.exe

Filesize
2.0MB

MD5
d5bc987447f821d6eca7f98f20118189

SHA1
13b0a548ab7c8d63c44c215eea07760463b2b142

SHA256
c276497f37e92e0e5efe10fa5010ca7a8b2ddbe72118c4e3c1ff504f692a252d

SHA512
d69d02de50abf29cf63ab14ece1a60e60667fc73d42dd7978019e58ae77727b9db5fbe3559ba29f76e8c3083bf5eff1c196b9521dd3a4e752451231ae19cb256

Download Submit
C:\Windows\system\mRWAgtr.exe

Filesize
2.0MB

MD5
f6f236fa1b9c090007dcacc97c7e31cf

SHA1
e4ed020f78cf94aff93fedbf8a47df25e65433ed

SHA256
15058ed9dad5b59e3747de3c40f1580a6e471d738778e8da485dce0027dd31a8

SHA512
f4a70051b0ae2a9fb861e2ea22d08b29bac01d6eabb5bdc15e68e1309574c8530f2a6bb281ade6422ba4aa8824bd0f011596ef6677d114e134b4b509f874eaed

Download Submit
C:\Windows\system\mTsXWjN.exe

Filesize
2.0MB

MD5
4763c8b116c4199d110cae4a587e9ba9

SHA1
36344cf8ff8be8560d89cf0e8dc0975a44fbef06

SHA256
67379a467ec76855596131d90cbf92ab485291e2d5a3f7966a46002d5ec5f97a

SHA512
03fbeae215b40962b0c32d752d1e3959bc779b3c580ba5a005e0e496192af59d4d850e1f25d3e82207ce974e49599ee89e6d7354eb9a35e9af4f119952f4f104

Download Submit
C:\Windows\system\nORRhwz.exe

Filesize
2.0MB

MD5
71cc3355ea3b81e3ef37686f35383fa0

SHA1
c0b5d9432bad8499e8b84c46578f2622e852b904

SHA256
1bea6e47571df3510130f0b3134bca1f12c3c35c161654ac2ee3905b26b3c41b

SHA512
b79d27d3d879b7e839385a6808dc5146d76cc47eb07d650848de17952f538588754fd603d4f4798e104318e3fe9fd8f717106127403e75ee71c10271c148cc51

Download Submit
C:\Windows\system\ocTACWQ.exe

Filesize
2.0MB

MD5
ad44c95a82bced58e3ddcf742bec9205

SHA1
98f85f183babb4982f5953bb79a5da076ec7ab0c

SHA256
38dc5b0cf0c4ed08ec77c10ebbe41ca00198da60f962055d6456999d0cde1e42

SHA512
f1a860a3bc564a9c56290d63921215b4de34851fad55e482359a6ffda63a9e265a99cd8cd22c1ba91b86d3349b3c53c5db0f2d14af65f19cbbe0a739e8267588

Download Submit
C:\Windows\system\qwEeFDl.exe

Filesize
2.0MB

MD5
c2bb7b0d626cb60cb94c6fb6c76a0a21

SHA1
44bc3dc95d7e731cb7d107cb6f2229fe8846fec9

SHA256
e582dcc9976136a74878c761ae889f246be269ba87320de593f5af4eded68f1d

SHA512
2cd2a90e6662d4c085c72a39dd144d28f128b7e37cbd25989d06a7a44d35ecb2d78d6f0adfb9510d691b8f2322d13a7035a74ea2b4311018635ecdcc1156e783

Download Submit
C:\Windows\system\sZEKkwF.exe

Filesize
2.0MB

MD5
e7666286c31f932295833d45a12d8da6

SHA1
c7d2f6f50813cb415446b451fe0d2bfc1cd47020

SHA256
bab4ad9475aefee9952373a13f107e4d9261e46ac443ce530c574b5b9cd009b5

SHA512
ef3d99d158b5a4e58bd6501d93e634c61391e412626d7bb60638cd4e4aebbe22d1a77f1d624af91e1fc67faeeeaab3f883c9a09a80f6d082ed8d089bb5b5227c

Download Submit
C:\Windows\system\tNpZHHP.exe

Filesize
2.0MB

MD5
c9a3cc7967440594604cfe0038b0eb77

SHA1
21b07d83958d5a97de846de448330dac91fb2cce

SHA256
98711713fcc3387c80c3e3c8611ed4dc10b0552d9015480d2552984d871f4832

SHA512
39b246b84d95e51a635134934080cf2e26181c71e4abe33c231c4f1d96fda62dd694fec8fb07eb4f4c5720263307637c5cbe636376424ae55d8b97170284c4ed

Download Submit
C:\Windows\system\uClcDcO.exe

Filesize
2.0MB

MD5
39b3d6a4e05f0f5de89303a1defc6676

SHA1
87b175ac987ce062f8c4870a1469a0218654d9be

SHA256
60cefe1319334310bf761dbd62a73243ba611eed5e4d89d14c396ef2e1d898d2

SHA512
53adaec566b0fbd44244c570261fe8b0ba4fbc401cbe0e453db31d649962bd04492f6e818d068932f8bff83ba57b31224fcd1b07b66aeb32302e57888a68a84b

Download Submit
C:\Windows\system\vIWIvzj.exe

Filesize
2.0MB

MD5
b32a163bd5534028379e151196e59748

SHA1
bba14d9752b1a458933878105872e1b6cf9330b9

SHA256
98a25adcf4383f298434675ac7695ea4ce4be709a48033ed9cb5ba29140913d2

SHA512
a3b9093615eef7fb97d6f3356a9054a8be8bcaa7f9c0849732ea86a994aacd3e86b38335a357bae0d7324ce4fc367fa98ea6fe34f1c09eff58df6ad9718ca435

Download Submit
C:\Windows\system\xzvAsiO.exe

Filesize
2.0MB

MD5
9f157402e644b287ba779f70941eb898

SHA1
fab7a2dd1a9b271fa265830a6a9b2d4c00f4cd9b

SHA256
607cb8618321f6caa70fb55ed51a07b7ccc32c219829f198d5977dcc976c67c9

SHA512
d5024720a826f47c48b479852cda232862185f18f254d4e765dc65e329bff973154aee3732f32380787cecca96e3ea7e7cccffcd58750ce2fbd1189afce3b498

Download Submit
C:\Windows\system\zTAtxgc.exe

Filesize
2.0MB

MD5
ad4632d4a79133602b3e46670210e41a

SHA1
62b969897f0c01ef7c4740d44cd66d604200639a

SHA256
0fdd788360c9a0aec6e37d29a05daafb24260dcb090c19fba7fc0f653f811e10

SHA512
67d8619a485033f2fd1a00d4af7ea327b1f592566373412d55747180f9492411e6f821fa0bdcca2053e575d1e1890519f5404024a51334fe8b047eac297dc63a

Download Submit
\Windows\system\ANrfInx.exe

Filesize
2.0MB

MD5
e3c8e3245cee63afee58ff159af9546e

SHA1
e3f29330d7d0d58d418b678fee3a1b12d2b3c49f

SHA256
ad6d415825a0856c015bec0d279b80a6c15cca65d115978fecdd569da429e839

SHA512
6a4716483e3f162a70c2a855a44f86a92884aba1c3698fb896b9deb01cc90d0997381a185b6a3db696a906a2c790f2a602fce552e9c7820d50f0233693d12bcc

Download Submit
\Windows\system\NEVdxFA.exe

Filesize
2.0MB

MD5
0a8230d6841427d2b1aa0f43bf8ba24b

SHA1
9d638a82fc491e8dc8904fb04718556ae61935de

SHA256
aacf4521b21ab4da5ee4bdc590b281f4bb907ab781b1897f3ac275b53177841a

SHA512
8daca259c10202a389587bb4ab880b2214de9918256f165be201dd417c8baf25aacafb0c82efa26e2aa4d63d741b42fdda325c97b5e635f9fb5b930ab2fa26f6

Download Submit
\Windows\system\UWEZpAt.exe

Filesize
2.0MB

MD5
9cc338dd02a6304b4ba901ab0f6f6111

SHA1
a88c3f0ae0b6d5ef398a6518ad64057c63dc748f

SHA256
58bf2aa2e252bcc728199871220e6a955d497004e91eea29570fc71f687c96b4

SHA512
68bc47e412ef37de286d5948501e3232c08a07924e9d4eb86279425fbd6ec9067e06f2084634c681bc9d0daf1a8c4cd4cb0d16f5502cbc36f6000aa38169aa74

Download Submit
memory/372-3522-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/372-84-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/776-3552-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/776-90-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2148-3196-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2148-21-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2220-42-0x000000001B130000-0x000000001B412000-memory.dmp

Filesize
2.9MB

Download
memory/2220-43-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/2336-3523-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2336-81-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2408-78-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-3547-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-82-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-3558-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-2762-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2524-36-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2700-3501-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2700-34-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2764-83-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2764-2751-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2804-22-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-7-0x00000000029C0000-0x0000000002DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-57-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-76-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-77-0x0000000002E40000-0x0000000003232000-memory.dmp

Filesize
3.9MB

Download
memory/2804-33-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2804-27-0x00000000029C0000-0x0000000002DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-19-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2804-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2804-80-0x0000000002E40000-0x0000000003232000-memory.dmp

Filesize
3.9MB

Download
memory/2804-85-0x0000000002E40000-0x0000000003232000-memory.dmp

Filesize
3.9MB

Download
memory/2804-542-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2804-0-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2804-67-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-8-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-551-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-2760-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-3511-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-26-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-89-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-3549-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download