xmrig | 7db9a6edca1e18a9ed6f9d11e35a75e2124998619d859650d6e9a76a863a951a

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
Size

2.0MB
MD5

d42058ece6cbf7a0ca160dd7190077c1
SHA1

542ecf0befc327445a4c7f5dc786208092803588
SHA256

7db9a6edca1e18a9ed6f9d11e35a75e2124998619d859650d6e9a76a863a951a
SHA512

c24cfde082e663654fcd6b32a20d976253ded670c0b9414161e253b38ea2b5ec56b505b3f2685f57090319f894fbe42cf2c1b14f0576aa486ead021c7b16e033
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMe:NABm

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/3060-15-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/1044-13-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2880-41-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2668-51-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2260-22-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2668-91-0x0000000003740000-0x0000000003B32000-memory.dmp	xmrig
behavioral1/memory/2728-90-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2632-85-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2584-80-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2724-74-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2748-72-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2668-70-0x0000000003740000-0x0000000003B32000-memory.dmp	xmrig
behavioral1/memory/2924-442-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2724-4446-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/1044-4441-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2880-4438-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2584-4431-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2748-4449-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2632-4460-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/3060-4494-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2728-4448-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2260-4434-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2784-4627-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2032-4678-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2536	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1044	SbWhcab.exe
3060	vCiSBsI.exe
2260	jwLNggU.exe
2728	nkyWkHg.exe
2880	IMndinZ.exe
2924	rMTMvEX.exe
2748	BUUpBHe.exe
2724	wZZjFXg.exe
2584	FqVNdCM.exe
2784	WYObHHX.exe
2632	onTLziD.exe
2032	ehCcLmD.exe
1096	IoVkrsp.exe
2812	zFtUcnH.exe
2936	skyXUaZ.exe
592	VJTIhhD.exe
316	kvUfizB.exe
1068	pAtDios.exe
2948	EakWSUM.exe
1672	NThItTV.exe
2780	DmcEgjs.exe
1940	AdRwZjt.exe
1404	kZMHKgC.exe
3004	CegxYwU.exe
1860	alpTirC.exe
2004	vhqDbck.exe
2320	xdBXeDY.exe
2132	ihBxLpQ.exe
1204	ZHlaWSO.exe
536	hKurBol.exe
1448	FOYNZJX.exe
836	RMsITtH.exe
2296	cbUhMpR.exe
1376	URAYEpi.exe
884	UVxRPdq.exe
1664	lJslGEe.exe
580	zcbibZs.exe
2204	xVEPRnA.exe
2480	nKRysNx.exe
2212	aFxPTKz.exe
2100	uorkscQ.exe
2120	gdeWfnW.exe
2180	wCHkRjR.exe
2256	HCuWkaU.exe
1064	qaUHyVH.exe
892	JfgQPkr.exe
1076	fzhHwYj.exe
1348	dyeQTBO.exe
2220	edpigel.exe
1704	aUkhNJe.exe
2188	JZBbimk.exe
1588	QivOEqp.exe
1716	bmHpfAk.exe
1872	SHxRwHC.exe
2068	IeoZebA.exe
2424	CeCAvUo.exe
2316	SsJJFtY.exe
2744	yAyXzmx.exe
2616	eNHbFNB.exe
2752	mPlmuPY.exe
2144	gnqzUwj.exe
2064	dHpDGUn.exe
2428	qifKfDY.exe
2620	CJOkbZf.exe

Loads dropped DLL 64 IoCs

pid	Process
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2668-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x000c000000012281-5.dat	upx
behavioral1/files/0x00070000000186f8-12.dat	upx
behavioral1/memory/3060-15-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/1044-13-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x0006000000018731-11.dat	upx
behavioral1/files/0x0006000000018742-30.dat	upx
behavioral1/memory/2880-41-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2728-32-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-37.dat	upx
behavioral1/files/0x000700000001878c-47.dat	upx
behavioral1/memory/2668-51-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x0009000000018bf3-50.dat	upx
behavioral1/files/0x0006000000019456-57.dat	upx
behavioral1/memory/2924-49-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2260-22-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/files/0x00050000000194ef-108.dat	upx
behavioral1/files/0x000500000001962b-173.dat	upx
behavioral1/files/0x0005000000019627-171.dat	upx
behavioral1/files/0x0005000000019623-153.dat	upx
behavioral1/files/0x0005000000019621-147.dat	upx
behavioral1/files/0x000500000001961d-139.dat	upx
behavioral1/files/0x00050000000195a7-132.dat	upx
behavioral1/files/0x000500000001952f-120.dat	upx
behavioral1/files/0x0005000000019506-116.dat	upx
behavioral1/files/0x00050000000194fc-112.dat	upx
behavioral1/files/0x00050000000194d0-104.dat	upx
behavioral1/files/0x0014000000018682-100.dat	upx
behavioral1/files/0x00050000000194ad-97.dat	upx
behavioral1/memory/2032-92-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2728-90-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0005000000019496-89.dat	upx
behavioral1/files/0x000500000001945c-60.dat	upx
behavioral1/files/0x0007000000019438-54.dat	upx
behavioral1/memory/2632-85-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2784-84-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2584-80-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2724-74-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x0005000000019467-73.dat	upx
behavioral1/memory/2748-72-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x0005000000019622-184.dat	upx
behavioral1/files/0x0005000000019629-164.dat	upx
behavioral1/files/0x000500000001963b-189.dat	upx
behavioral1/memory/2924-442-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0005000000019625-156.dat	upx
behavioral1/files/0x000500000001961f-142.dat	upx
behavioral1/files/0x00050000000195e6-134.dat	upx
behavioral1/files/0x000500000001957e-124.dat	upx
behavioral1/memory/2724-4446-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/1044-4441-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2880-4438-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2584-4431-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2748-4449-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2632-4460-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/3060-4494-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2728-4448-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2260-4434-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2784-4627-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2032-4678-0x000000013F540000-0x000000013F932000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kPBOLmC.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\BGYFQpX.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\TpbjZGH.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\QLgKSZs.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\CzpZoFV.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\ohoKyvq.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\knwiZrv.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\lgojFYU.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\KcaABaJ.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\mMyNCOr.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\PiLceYX.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\rgVMhlq.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\bgVsusL.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\dQAScmR.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\KeOqYhp.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\xZteBcQ.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\DOiLXFR.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\IvcjcZi.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\mTRuJrr.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\bJKeywW.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\lnfKEyW.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\ohaoBgl.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\MoKRlkV.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\WVQSrRV.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\gkEaLoB.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\JkpBuzi.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\ZzkhGYJ.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\QKrpGCZ.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\cZhkUHl.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\foFyUTP.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\SPPvwTK.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\taDmdWB.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\MlfHeVr.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\ailjXlG.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\qypMEqI.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\cbUhMpR.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\wCHkRjR.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\waDHJoC.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\ZMxAZlo.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\MeIbKDt.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\ZBkSQKe.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\bizCLJE.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\Wikhycj.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\YXnYvkW.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\jfPlcal.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\EcCYByw.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\WQypDDw.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\omtqoZp.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\vUgzLGL.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\iDYdZYr.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\oTgVHWz.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\HHrItvs.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\VSlSVdZ.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\WRiBOIG.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\PWLXgQk.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\fbikDYy.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\QSSxFOn.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\krJEccd.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\PPxoomH.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\jCSKoXr.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\kWXgzXp.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\sldJlex.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\kHFYiJH.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
File created	C:\Windows\System\ZsMKFKd.exe	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2536	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2536	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2536	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	31
PID 2668 wrote to memory of 1044	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	32
PID 2668 wrote to memory of 1044	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	32
PID 2668 wrote to memory of 1044	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	32
PID 2668 wrote to memory of 3060	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	33
PID 2668 wrote to memory of 3060	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	33
PID 2668 wrote to memory of 3060	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	33
PID 2668 wrote to memory of 2260	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	34
PID 2668 wrote to memory of 2260	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	34
PID 2668 wrote to memory of 2260	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	34
PID 2668 wrote to memory of 2728	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	35
PID 2668 wrote to memory of 2728	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	35
PID 2668 wrote to memory of 2728	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	35
PID 2668 wrote to memory of 2880	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	36
PID 2668 wrote to memory of 2880	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	36
PID 2668 wrote to memory of 2880	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	36
PID 2668 wrote to memory of 2924	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	37
PID 2668 wrote to memory of 2924	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	37
PID 2668 wrote to memory of 2924	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	37
PID 2668 wrote to memory of 2748	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	38
PID 2668 wrote to memory of 2748	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	38
PID 2668 wrote to memory of 2748	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	38
PID 2668 wrote to memory of 2784	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	39
PID 2668 wrote to memory of 2784	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	39
PID 2668 wrote to memory of 2784	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	39
PID 2668 wrote to memory of 2724	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	40
PID 2668 wrote to memory of 2724	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	40
PID 2668 wrote to memory of 2724	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	40
PID 2668 wrote to memory of 2632	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	41
PID 2668 wrote to memory of 2632	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	41
PID 2668 wrote to memory of 2632	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	41
PID 2668 wrote to memory of 2584	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	42
PID 2668 wrote to memory of 2584	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	42
PID 2668 wrote to memory of 2584	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	42
PID 2668 wrote to memory of 2032	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	43
PID 2668 wrote to memory of 2032	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	43
PID 2668 wrote to memory of 2032	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	43
PID 2668 wrote to memory of 1096	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	44
PID 2668 wrote to memory of 1096	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	44
PID 2668 wrote to memory of 1096	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	44
PID 2668 wrote to memory of 2812	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	45
PID 2668 wrote to memory of 2812	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	45
PID 2668 wrote to memory of 2812	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	45
PID 2668 wrote to memory of 2936	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	46
PID 2668 wrote to memory of 2936	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	46
PID 2668 wrote to memory of 2936	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	46
PID 2668 wrote to memory of 592	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	47
PID 2668 wrote to memory of 592	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	47
PID 2668 wrote to memory of 592	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	47
PID 2668 wrote to memory of 316	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	48
PID 2668 wrote to memory of 316	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	48
PID 2668 wrote to memory of 316	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	48
PID 2668 wrote to memory of 1068	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	49
PID 2668 wrote to memory of 1068	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	49
PID 2668 wrote to memory of 1068	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	49
PID 2668 wrote to memory of 2948	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	50
PID 2668 wrote to memory of 2948	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	50
PID 2668 wrote to memory of 2948	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	50
PID 2668 wrote to memory of 1672	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	51
PID 2668 wrote to memory of 1672	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	51
PID 2668 wrote to memory of 1672	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	51
PID 2668 wrote to memory of 2780	2668	d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d42058ece6cbf7a0ca160dd7190077c1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System\SbWhcab.exe
  C:\Windows\System\SbWhcab.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\vCiSBsI.exe
  C:\Windows\System\vCiSBsI.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\jwLNggU.exe
  C:\Windows\System\jwLNggU.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\nkyWkHg.exe
  C:\Windows\System\nkyWkHg.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\IMndinZ.exe
  C:\Windows\System\IMndinZ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\rMTMvEX.exe
  C:\Windows\System\rMTMvEX.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\BUUpBHe.exe
  C:\Windows\System\BUUpBHe.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\WYObHHX.exe
  C:\Windows\System\WYObHHX.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\wZZjFXg.exe
  C:\Windows\System\wZZjFXg.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\onTLziD.exe
  C:\Windows\System\onTLziD.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\FqVNdCM.exe
  C:\Windows\System\FqVNdCM.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\ehCcLmD.exe
  C:\Windows\System\ehCcLmD.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\IoVkrsp.exe
  C:\Windows\System\IoVkrsp.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\zFtUcnH.exe
  C:\Windows\System\zFtUcnH.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\skyXUaZ.exe
  C:\Windows\System\skyXUaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\VJTIhhD.exe
  C:\Windows\System\VJTIhhD.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\kvUfizB.exe
  C:\Windows\System\kvUfizB.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\pAtDios.exe
  C:\Windows\System\pAtDios.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\EakWSUM.exe
  C:\Windows\System\EakWSUM.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\NThItTV.exe
  C:\Windows\System\NThItTV.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\DmcEgjs.exe
  C:\Windows\System\DmcEgjs.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\xdBXeDY.exe
  C:\Windows\System\xdBXeDY.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\AdRwZjt.exe
  C:\Windows\System\AdRwZjt.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ihBxLpQ.exe
  C:\Windows\System\ihBxLpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\kZMHKgC.exe
  C:\Windows\System\kZMHKgC.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\ZHlaWSO.exe
  C:\Windows\System\ZHlaWSO.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\CegxYwU.exe
  C:\Windows\System\CegxYwU.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\hKurBol.exe
  C:\Windows\System\hKurBol.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\alpTirC.exe
  C:\Windows\System\alpTirC.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\FOYNZJX.exe
  C:\Windows\System\FOYNZJX.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\vhqDbck.exe
  C:\Windows\System\vhqDbck.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\RMsITtH.exe
  C:\Windows\System\RMsITtH.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\cbUhMpR.exe
  C:\Windows\System\cbUhMpR.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\URAYEpi.exe
  C:\Windows\System\URAYEpi.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\UVxRPdq.exe
  C:\Windows\System\UVxRPdq.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\lJslGEe.exe
  C:\Windows\System\lJslGEe.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\zcbibZs.exe
  C:\Windows\System\zcbibZs.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\xVEPRnA.exe
  C:\Windows\System\xVEPRnA.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\nKRysNx.exe
  C:\Windows\System\nKRysNx.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\aFxPTKz.exe
  C:\Windows\System\aFxPTKz.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\uorkscQ.exe
  C:\Windows\System\uorkscQ.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\gdeWfnW.exe
  C:\Windows\System\gdeWfnW.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\wCHkRjR.exe
  C:\Windows\System\wCHkRjR.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\HCuWkaU.exe
  C:\Windows\System\HCuWkaU.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\qaUHyVH.exe
  C:\Windows\System\qaUHyVH.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\JfgQPkr.exe
  C:\Windows\System\JfgQPkr.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\fzhHwYj.exe
  C:\Windows\System\fzhHwYj.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\dyeQTBO.exe
  C:\Windows\System\dyeQTBO.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\edpigel.exe
  C:\Windows\System\edpigel.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\aUkhNJe.exe
  C:\Windows\System\aUkhNJe.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\JZBbimk.exe
  C:\Windows\System\JZBbimk.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\QivOEqp.exe
  C:\Windows\System\QivOEqp.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\bmHpfAk.exe
  C:\Windows\System\bmHpfAk.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\SHxRwHC.exe
  C:\Windows\System\SHxRwHC.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\IeoZebA.exe
  C:\Windows\System\IeoZebA.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\CeCAvUo.exe
  C:\Windows\System\CeCAvUo.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\SsJJFtY.exe
  C:\Windows\System\SsJJFtY.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\yAyXzmx.exe
  C:\Windows\System\yAyXzmx.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\eNHbFNB.exe
  C:\Windows\System\eNHbFNB.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\mPlmuPY.exe
  C:\Windows\System\mPlmuPY.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\gnqzUwj.exe
  C:\Windows\System\gnqzUwj.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\dHpDGUn.exe
  C:\Windows\System\dHpDGUn.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\qifKfDY.exe
  C:\Windows\System\qifKfDY.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\CJOkbZf.exe
  C:\Windows\System\CJOkbZf.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\Lkdlnvb.exe
  C:\Windows\System\Lkdlnvb.exe
  2⤵
  PID:784
- C:\Windows\System\pquDEQx.exe
  C:\Windows\System\pquDEQx.exe
  2⤵
  PID:2928
- C:\Windows\System\JlMaXnd.exe
  C:\Windows\System\JlMaXnd.exe
  2⤵
  PID:2020
- C:\Windows\System\HCCGJUY.exe
  C:\Windows\System\HCCGJUY.exe
  2⤵
  PID:3028
- C:\Windows\System\ZFaIoKa.exe
  C:\Windows\System\ZFaIoKa.exe
  2⤵
  PID:2604
- C:\Windows\System\WitNLxN.exe
  C:\Windows\System\WitNLxN.exe
  2⤵
  PID:2912
- C:\Windows\System\RJcBapr.exe
  C:\Windows\System\RJcBapr.exe
  2⤵
  PID:2508
- C:\Windows\System\kWSlKIi.exe
  C:\Windows\System\kWSlKIi.exe
  2⤵
  PID:2964
- C:\Windows\System\ZVhFftQ.exe
  C:\Windows\System\ZVhFftQ.exe
  2⤵
  PID:1072
- C:\Windows\System\deymdfR.exe
  C:\Windows\System\deymdfR.exe
  2⤵
  PID:1712
- C:\Windows\System\HEfgBZh.exe
  C:\Windows\System\HEfgBZh.exe
  2⤵
  PID:1924
- C:\Windows\System\AxoadDw.exe
  C:\Windows\System\AxoadDw.exe
  2⤵
  PID:1324
- C:\Windows\System\NWgURbU.exe
  C:\Windows\System\NWgURbU.exe
  2⤵
  PID:840
- C:\Windows\System\hXHHPRL.exe
  C:\Windows\System\hXHHPRL.exe
  2⤵
  PID:928
- C:\Windows\System\NZdErLj.exe
  C:\Windows\System\NZdErLj.exe
  2⤵
  PID:288
- C:\Windows\System\yGCaoMC.exe
  C:\Windows\System\yGCaoMC.exe
  2⤵
  PID:2372
- C:\Windows\System\SNraynO.exe
  C:\Windows\System\SNraynO.exe
  2⤵
  PID:2768
- C:\Windows\System\JwRGvSS.exe
  C:\Windows\System\JwRGvSS.exe
  2⤵
  PID:2284
- C:\Windows\System\BwEzZvh.exe
  C:\Windows\System\BwEzZvh.exe
  2⤵
  PID:2184
- C:\Windows\System\BoKhOFz.exe
  C:\Windows\System\BoKhOFz.exe
  2⤵
  PID:1692
- C:\Windows\System\dybgTPh.exe
  C:\Windows\System\dybgTPh.exe
  2⤵
  PID:1356
- C:\Windows\System\ZTrAEwS.exe
  C:\Windows\System\ZTrAEwS.exe
  2⤵
  PID:2716
- C:\Windows\System\VMqdAiX.exe
  C:\Windows\System\VMqdAiX.exe
  2⤵
  PID:1576
- C:\Windows\System\BeWxAUA.exe
  C:\Windows\System\BeWxAUA.exe
  2⤵
  PID:2164
- C:\Windows\System\uvJBrPE.exe
  C:\Windows\System\uvJBrPE.exe
  2⤵
  PID:1040
- C:\Windows\System\xONgYSG.exe
  C:\Windows\System\xONgYSG.exe
  2⤵
  PID:2452
- C:\Windows\System\XJHTbDT.exe
  C:\Windows\System\XJHTbDT.exe
  2⤵
  PID:2264
- C:\Windows\System\sYVBBas.exe
  C:\Windows\System\sYVBBas.exe
  2⤵
  PID:2292
- C:\Windows\System\siphZMv.exe
  C:\Windows\System\siphZMv.exe
  2⤵
  PID:1524
- C:\Windows\System\AfLMfwI.exe
  C:\Windows\System\AfLMfwI.exe
  2⤵
  PID:1304
- C:\Windows\System\FAVHzlD.exe
  C:\Windows\System\FAVHzlD.exe
  2⤵
  PID:1800
- C:\Windows\System\TAvzGiz.exe
  C:\Windows\System\TAvzGiz.exe
  2⤵
  PID:3024
- C:\Windows\System\FlhGvnN.exe
  C:\Windows\System\FlhGvnN.exe
  2⤵
  PID:1592
- C:\Windows\System\LPzncwo.exe
  C:\Windows\System\LPzncwo.exe
  2⤵
  PID:1848
- C:\Windows\System\OPyIMqo.exe
  C:\Windows\System\OPyIMqo.exe
  2⤵
  PID:2756
- C:\Windows\System\ZrKWUGB.exe
  C:\Windows\System\ZrKWUGB.exe
  2⤵
  PID:2592
- C:\Windows\System\bsIhlEr.exe
  C:\Windows\System\bsIhlEr.exe
  2⤵
  PID:2044
- C:\Windows\System\EncSmiF.exe
  C:\Windows\System\EncSmiF.exe
  2⤵
  PID:2000
- C:\Windows\System\JmherbT.exe
  C:\Windows\System\JmherbT.exe
  2⤵
  PID:2696
- C:\Windows\System\VotzYZj.exe
  C:\Windows\System\VotzYZj.exe
  2⤵
  PID:2608
- C:\Windows\System\gWXNBOR.exe
  C:\Windows\System\gWXNBOR.exe
  2⤵
  PID:2840
- C:\Windows\System\AyGlxlO.exe
  C:\Windows\System\AyGlxlO.exe
  2⤵
  PID:2956
- C:\Windows\System\KLOUdzU.exe
  C:\Windows\System\KLOUdzU.exe
  2⤵
  PID:1580
- C:\Windows\System\SoZDBvm.exe
  C:\Windows\System\SoZDBvm.exe
  2⤵
  PID:1200
- C:\Windows\System\oUWBCym.exe
  C:\Windows\System\oUWBCym.exe
  2⤵
  PID:2596
- C:\Windows\System\tUqJlWE.exe
  C:\Windows\System\tUqJlWE.exe
  2⤵
  PID:2168
- C:\Windows\System\cZGMwLA.exe
  C:\Windows\System\cZGMwLA.exe
  2⤵
  PID:2324
- C:\Windows\System\suTqOpM.exe
  C:\Windows\System\suTqOpM.exe
  2⤵
  PID:1980
- C:\Windows\System\wQjvtQS.exe
  C:\Windows\System\wQjvtQS.exe
  2⤵
  PID:1832
- C:\Windows\System\ieTmXSM.exe
  C:\Windows\System\ieTmXSM.exe
  2⤵
  PID:1956
- C:\Windows\System\fhoSfoh.exe
  C:\Windows\System\fhoSfoh.exe
  2⤵
  PID:960
- C:\Windows\System\vUrRuaT.exe
  C:\Windows\System\vUrRuaT.exe
  2⤵
  PID:2176
- C:\Windows\System\YirRdls.exe
  C:\Windows\System\YirRdls.exe
  2⤵
  PID:2984
- C:\Windows\System\quyIjOD.exe
  C:\Windows\System\quyIjOD.exe
  2⤵
  PID:2684
- C:\Windows\System\oTddctD.exe
  C:\Windows\System\oTddctD.exe
  2⤵
  PID:2828
- C:\Windows\System\yluumqQ.exe
  C:\Windows\System\yluumqQ.exe
  2⤵
  PID:2108
- C:\Windows\System\yIKWcoS.exe
  C:\Windows\System\yIKWcoS.exe
  2⤵
  PID:2196
- C:\Windows\System\lrrOonr.exe
  C:\Windows\System\lrrOonr.exe
  2⤵
  PID:1168
- C:\Windows\System\JTIhAIG.exe
  C:\Windows\System\JTIhAIG.exe
  2⤵
  PID:564
- C:\Windows\System\jzFPFNk.exe
  C:\Windows\System\jzFPFNk.exe
  2⤵
  PID:2280
- C:\Windows\System\vqhDSjQ.exe
  C:\Windows\System\vqhDSjQ.exe
  2⤵
  PID:2116
- C:\Windows\System\GWAhDqV.exe
  C:\Windows\System\GWAhDqV.exe
  2⤵
  PID:2308
- C:\Windows\System\EtpWcmW.exe
  C:\Windows\System\EtpWcmW.exe
  2⤵
  PID:2456
- C:\Windows\System\SQajuzh.exe
  C:\Windows\System\SQajuzh.exe
  2⤵
  PID:1812
- C:\Windows\System\UShvTnP.exe
  C:\Windows\System\UShvTnP.exe
  2⤵
  PID:1948
- C:\Windows\System\JeUISRi.exe
  C:\Windows\System\JeUISRi.exe
  2⤵
  PID:2552
- C:\Windows\System\wYoYGTU.exe
  C:\Windows\System\wYoYGTU.exe
  2⤵
  PID:664
- C:\Windows\System\ThqRAbK.exe
  C:\Windows\System\ThqRAbK.exe
  2⤵
  PID:3020
- C:\Windows\System\AhYvdTI.exe
  C:\Windows\System\AhYvdTI.exe
  2⤵
  PID:2960
- C:\Windows\System\lQLFyaR.exe
  C:\Windows\System\lQLFyaR.exe
  2⤵
  PID:2900
- C:\Windows\System\YCZgomG.exe
  C:\Windows\System\YCZgomG.exe
  2⤵
  PID:2160
- C:\Windows\System\cDdQqOR.exe
  C:\Windows\System\cDdQqOR.exe
  2⤵
  PID:1564
- C:\Windows\System\ZpdArSK.exe
  C:\Windows\System\ZpdArSK.exe
  2⤵
  PID:2140
- C:\Windows\System\dnTyPVo.exe
  C:\Windows\System\dnTyPVo.exe
  2⤵
  PID:1756
- C:\Windows\System\DcjLxRm.exe
  C:\Windows\System\DcjLxRm.exe
  2⤵
  PID:2468
- C:\Windows\System\kGzZoof.exe
  C:\Windows\System\kGzZoof.exe
  2⤵
  PID:1504
- C:\Windows\System\fqVoPmA.exe
  C:\Windows\System\fqVoPmA.exe
  2⤵
  PID:2788
- C:\Windows\System\mHtHwyt.exe
  C:\Windows\System\mHtHwyt.exe
  2⤵
  PID:2084
- C:\Windows\System\ZTAuPcr.exe
  C:\Windows\System\ZTAuPcr.exe
  2⤵
  PID:3064
- C:\Windows\System\QSkIekj.exe
  C:\Windows\System\QSkIekj.exe
  2⤵
  PID:2344
- C:\Windows\System\slvAfiy.exe
  C:\Windows\System\slvAfiy.exe
  2⤵
  PID:2652
- C:\Windows\System\qcsVPOl.exe
  C:\Windows\System\qcsVPOl.exe
  2⤵
  PID:2232
- C:\Windows\System\faWIwbr.exe
  C:\Windows\System\faWIwbr.exe
  2⤵
  PID:1312
- C:\Windows\System\kitdsDh.exe
  C:\Windows\System\kitdsDh.exe
  2⤵
  PID:3140
- C:\Windows\System\YlAMdBn.exe
  C:\Windows\System\YlAMdBn.exe
  2⤵
  PID:3156
- C:\Windows\System\xbKIcdu.exe
  C:\Windows\System\xbKIcdu.exe
  2⤵
  PID:3172
- C:\Windows\System\vsIwRME.exe
  C:\Windows\System\vsIwRME.exe
  2⤵
  PID:3188
- C:\Windows\System\KfmhNwN.exe
  C:\Windows\System\KfmhNwN.exe
  2⤵
  PID:3204
- C:\Windows\System\UiWBxOU.exe
  C:\Windows\System\UiWBxOU.exe
  2⤵
  PID:3220
- C:\Windows\System\PdUnUEz.exe
  C:\Windows\System\PdUnUEz.exe
  2⤵
  PID:3236
- C:\Windows\System\VStqiTm.exe
  C:\Windows\System\VStqiTm.exe
  2⤵
  PID:3252
- C:\Windows\System\noBVPoo.exe
  C:\Windows\System\noBVPoo.exe
  2⤵
  PID:3268
- C:\Windows\System\FnXDZqP.exe
  C:\Windows\System\FnXDZqP.exe
  2⤵
  PID:3288
- C:\Windows\System\kdvoySk.exe
  C:\Windows\System\kdvoySk.exe
  2⤵
  PID:3304
- C:\Windows\System\LTIYcmk.exe
  C:\Windows\System\LTIYcmk.exe
  2⤵
  PID:3320
- C:\Windows\System\KGcfikX.exe
  C:\Windows\System\KGcfikX.exe
  2⤵
  PID:3336
- C:\Windows\System\WYTScNg.exe
  C:\Windows\System\WYTScNg.exe
  2⤵
  PID:3352
- C:\Windows\System\UMQGssB.exe
  C:\Windows\System\UMQGssB.exe
  2⤵
  PID:3368
- C:\Windows\System\CYhIdBn.exe
  C:\Windows\System\CYhIdBn.exe
  2⤵
  PID:3384
- C:\Windows\System\FThSoTr.exe
  C:\Windows\System\FThSoTr.exe
  2⤵
  PID:3400
- C:\Windows\System\gwDsuJr.exe
  C:\Windows\System\gwDsuJr.exe
  2⤵
  PID:3416
- C:\Windows\System\DBhWdMM.exe
  C:\Windows\System\DBhWdMM.exe
  2⤵
  PID:3432
- C:\Windows\System\LSizRjU.exe
  C:\Windows\System\LSizRjU.exe
  2⤵
  PID:3448
- C:\Windows\System\dWnXJWS.exe
  C:\Windows\System\dWnXJWS.exe
  2⤵
  PID:3464
- C:\Windows\System\eCkLHbR.exe
  C:\Windows\System\eCkLHbR.exe
  2⤵
  PID:3480
- C:\Windows\System\ajQZbcD.exe
  C:\Windows\System\ajQZbcD.exe
  2⤵
  PID:3496
- C:\Windows\System\ggfzdIH.exe
  C:\Windows\System\ggfzdIH.exe
  2⤵
  PID:3516
- C:\Windows\System\pjYNnTO.exe
  C:\Windows\System\pjYNnTO.exe
  2⤵
  PID:3536
- C:\Windows\System\zynIFEu.exe
  C:\Windows\System\zynIFEu.exe
  2⤵
  PID:3552
- C:\Windows\System\cnpowvn.exe
  C:\Windows\System\cnpowvn.exe
  2⤵
  PID:3568
- C:\Windows\System\dQssMus.exe
  C:\Windows\System\dQssMus.exe
  2⤵
  PID:3588
- C:\Windows\System\SyKZUKX.exe
  C:\Windows\System\SyKZUKX.exe
  2⤵
  PID:3604
- C:\Windows\System\JAUpcxZ.exe
  C:\Windows\System\JAUpcxZ.exe
  2⤵
  PID:3620
- C:\Windows\System\snJYVkD.exe
  C:\Windows\System\snJYVkD.exe
  2⤵
  PID:3636
- C:\Windows\System\GQOBjfz.exe
  C:\Windows\System\GQOBjfz.exe
  2⤵
  PID:3652
- C:\Windows\System\mbIigRc.exe
  C:\Windows\System\mbIigRc.exe
  2⤵
  PID:3668
- C:\Windows\System\WQypDDw.exe
  C:\Windows\System\WQypDDw.exe
  2⤵
  PID:3684
- C:\Windows\System\COLUvQb.exe
  C:\Windows\System\COLUvQb.exe
  2⤵
  PID:3700
- C:\Windows\System\DqTrHiu.exe
  C:\Windows\System\DqTrHiu.exe
  2⤵
  PID:3716
- C:\Windows\System\QHBkdcB.exe
  C:\Windows\System\QHBkdcB.exe
  2⤵
  PID:4008
- C:\Windows\System\xawlllc.exe
  C:\Windows\System\xawlllc.exe
  2⤵
  PID:4028
- C:\Windows\System\RcvFURG.exe
  C:\Windows\System\RcvFURG.exe
  2⤵
  PID:4044
- C:\Windows\System\uoPkXUk.exe
  C:\Windows\System\uoPkXUk.exe
  2⤵
  PID:4060
- C:\Windows\System\UxJOGma.exe
  C:\Windows\System\UxJOGma.exe
  2⤵
  PID:4076
- C:\Windows\System\sAKrnIF.exe
  C:\Windows\System\sAKrnIF.exe
  2⤵
  PID:4092
- C:\Windows\System\TzkNhHe.exe
  C:\Windows\System\TzkNhHe.exe
  2⤵
  PID:1776
- C:\Windows\System\uavJmsK.exe
  C:\Windows\System\uavJmsK.exe
  2⤵
  PID:1248
- C:\Windows\System\gOpbZlQ.exe
  C:\Windows\System\gOpbZlQ.exe
  2⤵
  PID:1092
- C:\Windows\System\MmpDRhZ.exe
  C:\Windows\System\MmpDRhZ.exe
  2⤵
  PID:3092
- C:\Windows\System\DlxacgE.exe
  C:\Windows\System\DlxacgE.exe
  2⤵
  PID:3124
- C:\Windows\System\EruRkoX.exe
  C:\Windows\System\EruRkoX.exe
  2⤵
  PID:3108
- C:\Windows\System\vFjZcik.exe
  C:\Windows\System\vFjZcik.exe
  2⤵
  PID:3084
- C:\Windows\System\gtBSCsS.exe
  C:\Windows\System\gtBSCsS.exe
  2⤵
  PID:756
- C:\Windows\System\EHmDOKU.exe
  C:\Windows\System\EHmDOKU.exe
  2⤵
  PID:2844
- C:\Windows\System\oiSlpSw.exe
  C:\Windows\System\oiSlpSw.exe
  2⤵
  PID:1488
- C:\Windows\System\pXzuolB.exe
  C:\Windows\System\pXzuolB.exe
  2⤵
  PID:3200
- C:\Windows\System\YfmmEzH.exe
  C:\Windows\System\YfmmEzH.exe
  2⤵
  PID:3312
- C:\Windows\System\SYbiwwT.exe
  C:\Windows\System\SYbiwwT.exe
  2⤵
  PID:3364
- C:\Windows\System\ZoOPhHE.exe
  C:\Windows\System\ZoOPhHE.exe
  2⤵
  PID:2088
- C:\Windows\System\JsTyWgN.exe
  C:\Windows\System\JsTyWgN.exe
  2⤵
  PID:652
- C:\Windows\System\gRhIAzU.exe
  C:\Windows\System\gRhIAzU.exe
  2⤵
  PID:3460
- C:\Windows\System\XsgpSHO.exe
  C:\Windows\System\XsgpSHO.exe
  2⤵
  PID:2076
- C:\Windows\System\CzEGooW.exe
  C:\Windows\System\CzEGooW.exe
  2⤵
  PID:3472
- C:\Windows\System\khIPoCU.exe
  C:\Windows\System\khIPoCU.exe
  2⤵
  PID:3492
- C:\Windows\System\lpTDHpF.exe
  C:\Windows\System\lpTDHpF.exe
  2⤵
  PID:3544
- C:\Windows\System\xjxNGKg.exe
  C:\Windows\System\xjxNGKg.exe
  2⤵
  PID:3584
- C:\Windows\System\XujqmhF.exe
  C:\Windows\System\XujqmhF.exe
  2⤵
  PID:3648
- C:\Windows\System\qmMXwnw.exe
  C:\Windows\System\qmMXwnw.exe
  2⤵
  PID:3712
- C:\Windows\System\NLcMPvi.exe
  C:\Windows\System\NLcMPvi.exe
  2⤵
  PID:3528
- C:\Windows\System\doRJlwm.exe
  C:\Windows\System\doRJlwm.exe
  2⤵
  PID:3600
- C:\Windows\System\ESLODJg.exe
  C:\Windows\System\ESLODJg.exe
  2⤵
  PID:3696
- C:\Windows\System\xKkVWqy.exe
  C:\Windows\System\xKkVWqy.exe
  2⤵
  PID:3736
- C:\Windows\System\NyYvYPK.exe
  C:\Windows\System\NyYvYPK.exe
  2⤵
  PID:3752
- C:\Windows\System\jCJKwqp.exe
  C:\Windows\System\jCJKwqp.exe
  2⤵
  PID:3768
- C:\Windows\System\NPeANAG.exe
  C:\Windows\System\NPeANAG.exe
  2⤵
  PID:3784
- C:\Windows\System\aQmWPsM.exe
  C:\Windows\System\aQmWPsM.exe
  2⤵
  PID:3800
- C:\Windows\System\iWHmcZx.exe
  C:\Windows\System\iWHmcZx.exe
  2⤵
  PID:3816
- C:\Windows\System\WIfjDvz.exe
  C:\Windows\System\WIfjDvz.exe
  2⤵
  PID:3832
- C:\Windows\System\UgEEHVc.exe
  C:\Windows\System\UgEEHVc.exe
  2⤵
  PID:3844
- C:\Windows\System\WowKcus.exe
  C:\Windows\System\WowKcus.exe
  2⤵
  PID:3864
- C:\Windows\System\qAebPFt.exe
  C:\Windows\System\qAebPFt.exe
  2⤵
  PID:3880
- C:\Windows\System\GVBKIJc.exe
  C:\Windows\System\GVBKIJc.exe
  2⤵
  PID:3896
- C:\Windows\System\rFznpVL.exe
  C:\Windows\System\rFznpVL.exe
  2⤵
  PID:3912
- C:\Windows\System\FUwDhcw.exe
  C:\Windows\System\FUwDhcw.exe
  2⤵
  PID:3928
- C:\Windows\System\EXpYzbo.exe
  C:\Windows\System\EXpYzbo.exe
  2⤵
  PID:3944
- C:\Windows\System\dFvFWJu.exe
  C:\Windows\System\dFvFWJu.exe
  2⤵
  PID:3960
- C:\Windows\System\TEsHoPj.exe
  C:\Windows\System\TEsHoPj.exe
  2⤵
  PID:3980
- C:\Windows\System\nogziEP.exe
  C:\Windows\System\nogziEP.exe
  2⤵
  PID:3996
- C:\Windows\System\HONAXbP.exe
  C:\Windows\System\HONAXbP.exe
  2⤵
  PID:4040
- C:\Windows\System\ugeSYvt.exe
  C:\Windows\System\ugeSYvt.exe
  2⤵
  PID:860
- C:\Windows\System\ZjwnsGU.exe
  C:\Windows\System\ZjwnsGU.exe
  2⤵
  PID:3128
- C:\Windows\System\ngDNTrR.exe
  C:\Windows\System\ngDNTrR.exe
  2⤵
  PID:2980
- C:\Windows\System\NTqGEXn.exe
  C:\Windows\System\NTqGEXn.exe
  2⤵
  PID:3076
- C:\Windows\System\zyMWCud.exe
  C:\Windows\System\zyMWCud.exe
  2⤵
  PID:872
- C:\Windows\System\xEOtjHG.exe
  C:\Windows\System\xEOtjHG.exe
  2⤵
  PID:2868
- C:\Windows\System\xQXbKsy.exe
  C:\Windows\System\xQXbKsy.exe
  2⤵
  PID:4020
- C:\Windows\System\SJvCYSL.exe
  C:\Windows\System\SJvCYSL.exe
  2⤵
  PID:4084
- C:\Windows\System\cnuZeMX.exe
  C:\Windows\System\cnuZeMX.exe
  2⤵
  PID:2704
- C:\Windows\System\DuCZPvt.exe
  C:\Windows\System\DuCZPvt.exe
  2⤵
  PID:3244
- C:\Windows\System\hnqhtLr.exe
  C:\Windows\System\hnqhtLr.exe
  2⤵
  PID:3328
- C:\Windows\System\taDmdWB.exe
  C:\Windows\System\taDmdWB.exe
  2⤵
  PID:1344
- C:\Windows\System\ijYCZRa.exe
  C:\Windows\System\ijYCZRa.exe
  2⤵
  PID:3264
- C:\Windows\System\Weazljj.exe
  C:\Windows\System\Weazljj.exe
  2⤵
  PID:1144
- C:\Windows\System\vArTocj.exe
  C:\Windows\System\vArTocj.exe
  2⤵
  PID:2476
- C:\Windows\System\xJKiXys.exe
  C:\Windows\System\xJKiXys.exe
  2⤵
  PID:1804
- C:\Windows\System\fBicMYG.exe
  C:\Windows\System\fBicMYG.exe
  2⤵
  PID:3560
- C:\Windows\System\hJlnBRG.exe
  C:\Windows\System\hJlnBRG.exe
  2⤵
  PID:3728
- C:\Windows\System\kYKfRCn.exe
  C:\Windows\System\kYKfRCn.exe
  2⤵
  PID:3760
- C:\Windows\System\fxqUAhP.exe
  C:\Windows\System\fxqUAhP.exe
  2⤵
  PID:2172
- C:\Windows\System\MkEXQkC.exe
  C:\Windows\System\MkEXQkC.exe
  2⤵
  PID:3068
- C:\Windows\System\DjRaJJB.exe
  C:\Windows\System\DjRaJJB.exe
  2⤵
  PID:3792
- C:\Windows\System\fAeCIYj.exe
  C:\Windows\System\fAeCIYj.exe
  2⤵
  PID:3744
- C:\Windows\System\sCKFBTx.exe
  C:\Windows\System\sCKFBTx.exe
  2⤵
  PID:3888
- C:\Windows\System\anInpTH.exe
  C:\Windows\System\anInpTH.exe
  2⤵
  PID:3780
- C:\Windows\System\bZDGTqK.exe
  C:\Windows\System\bZDGTqK.exe
  2⤵
  PID:3892
- C:\Windows\System\DOtYKEP.exe
  C:\Windows\System\DOtYKEP.exe
  2⤵
  PID:3904
- C:\Windows\System\yHMdTuh.exe
  C:\Windows\System\yHMdTuh.exe
  2⤵
  PID:3992
- C:\Windows\System\KAuLTMh.exe
  C:\Windows\System\KAuLTMh.exe
  2⤵
  PID:3920
- C:\Windows\System\SKwIOux.exe
  C:\Windows\System\SKwIOux.exe
  2⤵
  PID:4068
- C:\Windows\System\gWUwLiO.exe
  C:\Windows\System\gWUwLiO.exe
  2⤵
  PID:3016
- C:\Windows\System\jCEGnyH.exe
  C:\Windows\System\jCEGnyH.exe
  2⤵
  PID:3968
- C:\Windows\System\gTpXBlH.exe
  C:\Windows\System\gTpXBlH.exe
  2⤵
  PID:3972
- C:\Windows\System\MrYjAhS.exe
  C:\Windows\System\MrYjAhS.exe
  2⤵
  PID:3116
- C:\Windows\System\tDDqkDJ.exe
  C:\Windows\System\tDDqkDJ.exe
  2⤵
  PID:2804
- C:\Windows\System\WYUBlhN.exe
  C:\Windows\System\WYUBlhN.exe
  2⤵
  PID:3300
- C:\Windows\System\nWkKaCh.exe
  C:\Windows\System\nWkKaCh.exe
  2⤵
  PID:4056
- C:\Windows\System\KvZszzc.exe
  C:\Windows\System\KvZszzc.exe
  2⤵
  PID:3284
- C:\Windows\System\iTrJCtJ.exe
  C:\Windows\System\iTrJCtJ.exe
  2⤵
  PID:3680
- C:\Windows\System\WLApoXa.exe
  C:\Windows\System\WLApoXa.exe
  2⤵
  PID:3576
- C:\Windows\System\elZsRwA.exe
  C:\Windows\System\elZsRwA.exe
  2⤵
  PID:1752
- C:\Windows\System\VKPDgjY.exe
  C:\Windows\System\VKPDgjY.exe
  2⤵
  PID:3632
- C:\Windows\System\JqcTdLj.exe
  C:\Windows\System\JqcTdLj.exe
  2⤵
  PID:3828
- C:\Windows\System\TpbFpPJ.exe
  C:\Windows\System\TpbFpPJ.exe
  2⤵
  PID:3812
- C:\Windows\System\MpNEUKk.exe
  C:\Windows\System\MpNEUKk.exe
  2⤵
  PID:3908
- C:\Windows\System\NYWBMNq.exe
  C:\Windows\System\NYWBMNq.exe
  2⤵
  PID:3872
- C:\Windows\System\RJpJugw.exe
  C:\Windows\System\RJpJugw.exe
  2⤵
  PID:3956
- C:\Windows\System\jnTXuXc.exe
  C:\Windows\System\jnTXuXc.exe
  2⤵
  PID:3100
- C:\Windows\System\YKpWsOH.exe
  C:\Windows\System\YKpWsOH.exe
  2⤵
  PID:4112
- C:\Windows\System\jOFLfCr.exe
  C:\Windows\System\jOFLfCr.exe
  2⤵
  PID:4128
- C:\Windows\System\gRjbIgC.exe
  C:\Windows\System\gRjbIgC.exe
  2⤵
  PID:4144
- C:\Windows\System\qYPVDhL.exe
  C:\Windows\System\qYPVDhL.exe
  2⤵
  PID:4160
- C:\Windows\System\FEQghDg.exe
  C:\Windows\System\FEQghDg.exe
  2⤵
  PID:4180
- C:\Windows\System\hCVmUYu.exe
  C:\Windows\System\hCVmUYu.exe
  2⤵
  PID:4196
- C:\Windows\System\Advufau.exe
  C:\Windows\System\Advufau.exe
  2⤵
  PID:4212
- C:\Windows\System\yVJGbld.exe
  C:\Windows\System\yVJGbld.exe
  2⤵
  PID:4228
- C:\Windows\System\CcPBvPD.exe
  C:\Windows\System\CcPBvPD.exe
  2⤵
  PID:4248
- C:\Windows\System\ekTLVNn.exe
  C:\Windows\System\ekTLVNn.exe
  2⤵
  PID:4264
- C:\Windows\System\omMTfPD.exe
  C:\Windows\System\omMTfPD.exe
  2⤵
  PID:4280
- C:\Windows\System\EBpnTyd.exe
  C:\Windows\System\EBpnTyd.exe
  2⤵
  PID:4296
- C:\Windows\System\rjRmhyP.exe
  C:\Windows\System\rjRmhyP.exe
  2⤵
  PID:4316
- C:\Windows\System\wDOREeh.exe
  C:\Windows\System\wDOREeh.exe
  2⤵
  PID:4332
- C:\Windows\System\TocUqzk.exe
  C:\Windows\System\TocUqzk.exe
  2⤵
  PID:4348
- C:\Windows\System\EQHHFik.exe
  C:\Windows\System\EQHHFik.exe
  2⤵
  PID:4364
- C:\Windows\System\IDpadxP.exe
  C:\Windows\System\IDpadxP.exe
  2⤵
  PID:4380
- C:\Windows\System\fNHrEZE.exe
  C:\Windows\System\fNHrEZE.exe
  2⤵
  PID:4396
- C:\Windows\System\VKMMllT.exe
  C:\Windows\System\VKMMllT.exe
  2⤵
  PID:4416
- C:\Windows\System\PEoFvIs.exe
  C:\Windows\System\PEoFvIs.exe
  2⤵
  PID:4444
- C:\Windows\System\VWwpphi.exe
  C:\Windows\System\VWwpphi.exe
  2⤵
  PID:4460
- C:\Windows\System\RlhwrPT.exe
  C:\Windows\System\RlhwrPT.exe
  2⤵
  PID:4476
- C:\Windows\System\ZKUuvbN.exe
  C:\Windows\System\ZKUuvbN.exe
  2⤵
  PID:4492
- C:\Windows\System\zkWpOlv.exe
  C:\Windows\System\zkWpOlv.exe
  2⤵
  PID:4508
- C:\Windows\System\mzxGjgf.exe
  C:\Windows\System\mzxGjgf.exe
  2⤵
  PID:4528
- C:\Windows\System\RXpovEQ.exe
  C:\Windows\System\RXpovEQ.exe
  2⤵
  PID:4544
- C:\Windows\System\Hosezol.exe
  C:\Windows\System\Hosezol.exe
  2⤵
  PID:4560
- C:\Windows\System\fvvKDeW.exe
  C:\Windows\System\fvvKDeW.exe
  2⤵
  PID:4576
- C:\Windows\System\dSPjxdH.exe
  C:\Windows\System\dSPjxdH.exe
  2⤵
  PID:4592
- C:\Windows\System\EXlWcGe.exe
  C:\Windows\System\EXlWcGe.exe
  2⤵
  PID:4608
- C:\Windows\System\MFTxOil.exe
  C:\Windows\System\MFTxOil.exe
  2⤵
  PID:4624
- C:\Windows\System\vBJqkqy.exe
  C:\Windows\System\vBJqkqy.exe
  2⤵
  PID:4640
- C:\Windows\System\DhbnYUb.exe
  C:\Windows\System\DhbnYUb.exe
  2⤵
  PID:4656
- C:\Windows\System\WkmtXMx.exe
  C:\Windows\System\WkmtXMx.exe
  2⤵
  PID:4672
- C:\Windows\System\IATqRCO.exe
  C:\Windows\System\IATqRCO.exe
  2⤵
  PID:4688
- C:\Windows\System\PJJIhwF.exe
  C:\Windows\System\PJJIhwF.exe
  2⤵
  PID:4704
- C:\Windows\System\wjxjdcQ.exe
  C:\Windows\System\wjxjdcQ.exe
  2⤵
  PID:4720
- C:\Windows\System\ntcRHyj.exe
  C:\Windows\System\ntcRHyj.exe
  2⤵
  PID:4736
- C:\Windows\System\sEqWmNv.exe
  C:\Windows\System\sEqWmNv.exe
  2⤵
  PID:4752
- C:\Windows\System\UEneicQ.exe
  C:\Windows\System\UEneicQ.exe
  2⤵
  PID:4768
- C:\Windows\System\TsqVSwX.exe
  C:\Windows\System\TsqVSwX.exe
  2⤵
  PID:4784
- C:\Windows\System\CanYAmX.exe
  C:\Windows\System\CanYAmX.exe
  2⤵
  PID:4800
- C:\Windows\System\mZLsFli.exe
  C:\Windows\System\mZLsFli.exe
  2⤵
  PID:4816
- C:\Windows\System\mJNpziV.exe
  C:\Windows\System\mJNpziV.exe
  2⤵
  PID:4832
- C:\Windows\System\QKrpGCZ.exe
  C:\Windows\System\QKrpGCZ.exe
  2⤵
  PID:4848
- C:\Windows\System\lLmBCQY.exe
  C:\Windows\System\lLmBCQY.exe
  2⤵
  PID:4864
- C:\Windows\System\QgPnlXj.exe
  C:\Windows\System\QgPnlXj.exe
  2⤵
  PID:4880
- C:\Windows\System\GuaIElp.exe
  C:\Windows\System\GuaIElp.exe
  2⤵
  PID:4896
- C:\Windows\System\UeybuKo.exe
  C:\Windows\System\UeybuKo.exe
  2⤵
  PID:4912
- C:\Windows\System\pRcLDJa.exe
  C:\Windows\System\pRcLDJa.exe
  2⤵
  PID:4928
- C:\Windows\System\ZIbYNls.exe
  C:\Windows\System\ZIbYNls.exe
  2⤵
  PID:4944
- C:\Windows\System\ByVaRsP.exe
  C:\Windows\System\ByVaRsP.exe
  2⤵
  PID:4960
- C:\Windows\System\btQgYpj.exe
  C:\Windows\System\btQgYpj.exe
  2⤵
  PID:4976
- C:\Windows\System\VVqFQNY.exe
  C:\Windows\System\VVqFQNY.exe
  2⤵
  PID:4992
- C:\Windows\System\CBRcLsz.exe
  C:\Windows\System\CBRcLsz.exe
  2⤵
  PID:5008
- C:\Windows\System\WqSlyUy.exe
  C:\Windows\System\WqSlyUy.exe
  2⤵
  PID:5024
- C:\Windows\System\EmAgwvM.exe
  C:\Windows\System\EmAgwvM.exe
  2⤵
  PID:5040
- C:\Windows\System\gItFRzv.exe
  C:\Windows\System\gItFRzv.exe
  2⤵
  PID:5060
- C:\Windows\System\nIAtsqc.exe
  C:\Windows\System\nIAtsqc.exe
  2⤵
  PID:5076
- C:\Windows\System\nZcheoV.exe
  C:\Windows\System\nZcheoV.exe
  2⤵
  PID:5092
- C:\Windows\System\fsKqtkw.exe
  C:\Windows\System\fsKqtkw.exe
  2⤵
  PID:5108
- C:\Windows\System\dMtLNIb.exe
  C:\Windows\System\dMtLNIb.exe
  2⤵
  PID:3164
- C:\Windows\System\DvleSYy.exe
  C:\Windows\System\DvleSYy.exe
  2⤵
  PID:3232
- C:\Windows\System\PxKyBvU.exe
  C:\Windows\System\PxKyBvU.exe
  2⤵
  PID:3564
- C:\Windows\System\austsjG.exe
  C:\Windows\System\austsjG.exe
  2⤵
  PID:2680
- C:\Windows\System\qVvGhxI.exe
  C:\Windows\System\qVvGhxI.exe
  2⤵
  PID:4108
- C:\Windows\System\BwQxzLT.exe
  C:\Windows\System\BwQxzLT.exe
  2⤵
  PID:4176
- C:\Windows\System\vmBrJut.exe
  C:\Windows\System\vmBrJut.exe
  2⤵
  PID:4236
- C:\Windows\System\bpxrtub.exe
  C:\Windows\System\bpxrtub.exe
  2⤵
  PID:3940
- C:\Windows\System\SdrCmaL.exe
  C:\Windows\System\SdrCmaL.exe
  2⤵
  PID:4308
- C:\Windows\System\YRUeBrg.exe
  C:\Windows\System\YRUeBrg.exe
  2⤵
  PID:3216
- C:\Windows\System\hnowBnD.exe
  C:\Windows\System\hnowBnD.exe
  2⤵
  PID:3508
- C:\Windows\System\MzBJyWC.exe
  C:\Windows\System\MzBJyWC.exe
  2⤵
  PID:4004
- C:\Windows\System\jCSKoXr.exe
  C:\Windows\System\jCSKoXr.exe
  2⤵
  PID:3936
- C:\Windows\System\XVFEIKx.exe
  C:\Windows\System\XVFEIKx.exe
  2⤵
  PID:4156
- C:\Windows\System\LuwunOv.exe
  C:\Windows\System\LuwunOv.exe
  2⤵
  PID:4356
- C:\Windows\System\NJYqxBW.exe
  C:\Windows\System\NJYqxBW.exe
  2⤵
  PID:4456
- C:\Windows\System\oDNlCsq.exe
  C:\Windows\System\oDNlCsq.exe
  2⤵
  PID:4524
- C:\Windows\System\wkGYmnt.exe
  C:\Windows\System\wkGYmnt.exe
  2⤵
  PID:4328
- C:\Windows\System\VyxkoAI.exe
  C:\Windows\System\VyxkoAI.exe
  2⤵
  PID:4432
- C:\Windows\System\vtoKxvO.exe
  C:\Windows\System\vtoKxvO.exe
  2⤵
  PID:4652
- C:\Windows\System\CXsTWOm.exe
  C:\Windows\System\CXsTWOm.exe
  2⤵
  PID:4680
- C:\Windows\System\rVxxITP.exe
  C:\Windows\System\rVxxITP.exe
  2⤵
  PID:4568
- C:\Windows\System\snlUxVW.exe
  C:\Windows\System\snlUxVW.exe
  2⤵
  PID:4472
- C:\Windows\System\XclzVjl.exe
  C:\Windows\System\XclzVjl.exe
  2⤵
  PID:4700
- C:\Windows\System\kfhuAbb.exe
  C:\Windows\System\kfhuAbb.exe
  2⤵
  PID:4764
- C:\Windows\System\zPHZgca.exe
  C:\Windows\System\zPHZgca.exe
  2⤵
  PID:4716
- C:\Windows\System\rnSeFvz.exe
  C:\Windows\System\rnSeFvz.exe
  2⤵
  PID:4780
- C:\Windows\System\ddrAsqY.exe
  C:\Windows\System\ddrAsqY.exe
  2⤵
  PID:4844
- C:\Windows\System\prDgHuQ.exe
  C:\Windows\System\prDgHuQ.exe
  2⤵
  PID:4668
- C:\Windows\System\IqylPYZ.exe
  C:\Windows\System\IqylPYZ.exe
  2⤵
  PID:4892
- C:\Windows\System\hPyGwoJ.exe
  C:\Windows\System\hPyGwoJ.exe
  2⤵
  PID:4908
- C:\Windows\System\jFyCjsL.exe
  C:\Windows\System\jFyCjsL.exe
  2⤵
  PID:4972
- C:\Windows\System\Oltvglk.exe
  C:\Windows\System\Oltvglk.exe
  2⤵
  PID:5004
- C:\Windows\System\vcOMMgk.exe
  C:\Windows\System\vcOMMgk.exe
  2⤵
  PID:5100
- C:\Windows\System\OtJfJBU.exe
  C:\Windows\System\OtJfJBU.exe
  2⤵
  PID:2856
- C:\Windows\System\RkIHICs.exe
  C:\Windows\System\RkIHICs.exe
  2⤵
  PID:4244
- C:\Windows\System\siZMZwM.exe
  C:\Windows\System\siZMZwM.exe
  2⤵
  PID:3664
- C:\Windows\System\DVerGkk.exe
  C:\Windows\System\DVerGkk.exe
  2⤵
  PID:3616
- C:\Windows\System\VsaxpAs.exe
  C:\Windows\System\VsaxpAs.exe
  2⤵
  PID:2356
- C:\Windows\System\wXjpcXJ.exe
  C:\Windows\System\wXjpcXJ.exe
  2⤵
  PID:4956
- C:\Windows\System\UJwyGdL.exe
  C:\Windows\System\UJwyGdL.exe
  2⤵
  PID:5048
- C:\Windows\System\vQUSkqA.exe
  C:\Windows\System\vQUSkqA.exe
  2⤵
  PID:3196
- C:\Windows\System\jLlwtZK.exe
  C:\Windows\System\jLlwtZK.exe
  2⤵
  PID:4152
- C:\Windows\System\VJLuSGe.exe
  C:\Windows\System\VJLuSGe.exe
  2⤵
  PID:4344
- C:\Windows\System\MSlqayI.exe
  C:\Windows\System\MSlqayI.exe
  2⤵
  PID:4424
- C:\Windows\System\scKnOtL.exe
  C:\Windows\System\scKnOtL.exe
  2⤵
  PID:4556
- C:\Windows\System\XdiwzbV.exe
  C:\Windows\System\XdiwzbV.exe
  2⤵
  PID:4408
- C:\Windows\System\asshvXb.exe
  C:\Windows\System\asshvXb.exe
  2⤵
  PID:4636
- C:\Windows\System\jOOobqm.exe
  C:\Windows\System\jOOobqm.exe
  2⤵
  PID:4796
- C:\Windows\System\adEhipN.exe
  C:\Windows\System\adEhipN.exe
  2⤵
  PID:4712
- C:\Windows\System\xMBUCHK.exe
  C:\Windows\System\xMBUCHK.exe
  2⤵
  PID:5036
- C:\Windows\System\ucqXCtx.exe
  C:\Windows\System\ucqXCtx.exe
  2⤵
  PID:5020
- C:\Windows\System\TzXTlOB.exe
  C:\Windows\System\TzXTlOB.exe
  2⤵
  PID:4760
- C:\Windows\System\oJkHnna.exe
  C:\Windows\System\oJkHnna.exe
  2⤵
  PID:4876
- C:\Windows\System\KHduekp.exe
  C:\Windows\System\KHduekp.exe
  2⤵
  PID:4428
- C:\Windows\System\nNZxzKY.exe
  C:\Windows\System\nNZxzKY.exe
  2⤵
  PID:4504
- C:\Windows\System\ssgMXeP.exe
  C:\Windows\System\ssgMXeP.exe
  2⤵
  PID:1156
- C:\Windows\System\zxhTMRe.exe
  C:\Windows\System\zxhTMRe.exe
  2⤵
  PID:5088
- C:\Windows\System\GiMveoF.exe
  C:\Windows\System\GiMveoF.exe
  2⤵
  PID:3168
- C:\Windows\System\AelDrsN.exe
  C:\Windows\System\AelDrsN.exe
  2⤵
  PID:4520
- C:\Windows\System\pSmzHgz.exe
  C:\Windows\System\pSmzHgz.exe
  2⤵
  PID:4924
- C:\Windows\System\UXhuwwo.exe
  C:\Windows\System\UXhuwwo.exe
  2⤵
  PID:4872
- C:\Windows\System\pYoCrah.exe
  C:\Windows\System\pYoCrah.exe
  2⤵
  PID:4376
- C:\Windows\System\NNjGXZr.exe
  C:\Windows\System\NNjGXZr.exe
  2⤵
  PID:4936
- C:\Windows\System\tQJCJmv.exe
  C:\Windows\System\tQJCJmv.exe
  2⤵
  PID:4988
- C:\Windows\System\rUjbapp.exe
  C:\Windows\System\rUjbapp.exe
  2⤵
  PID:4604
- C:\Windows\System\UJqSxdK.exe
  C:\Windows\System\UJqSxdK.exe
  2⤵
  PID:4856
- C:\Windows\System\uZiwTRJ.exe
  C:\Windows\System\uZiwTRJ.exe
  2⤵
  PID:4588
- C:\Windows\System\fPrlilW.exe
  C:\Windows\System\fPrlilW.exe
  2⤵
  PID:4168
- C:\Windows\System\SQnprJq.exe
  C:\Windows\System\SQnprJq.exe
  2⤵
  PID:4984
- C:\Windows\System\ZqRanRp.exe
  C:\Windows\System\ZqRanRp.exe
  2⤵
  PID:5124
- C:\Windows\System\cwTpvZu.exe
  C:\Windows\System\cwTpvZu.exe
  2⤵
  PID:5140
- C:\Windows\System\SFxAiHj.exe
  C:\Windows\System\SFxAiHj.exe
  2⤵
  PID:5156
- C:\Windows\System\pUsCTOb.exe
  C:\Windows\System\pUsCTOb.exe
  2⤵
  PID:5172
- C:\Windows\System\YzFvFZV.exe
  C:\Windows\System\YzFvFZV.exe
  2⤵
  PID:5188
- C:\Windows\System\HxcZoLH.exe
  C:\Windows\System\HxcZoLH.exe
  2⤵
  PID:5204
- C:\Windows\System\BQXWEag.exe
  C:\Windows\System\BQXWEag.exe
  2⤵
  PID:5220
- C:\Windows\System\RdOYiXF.exe
  C:\Windows\System\RdOYiXF.exe
  2⤵
  PID:5236
- C:\Windows\System\PKumXAK.exe
  C:\Windows\System\PKumXAK.exe
  2⤵
  PID:5252
- C:\Windows\System\nEzPiYc.exe
  C:\Windows\System\nEzPiYc.exe
  2⤵
  PID:5268
- C:\Windows\System\IAcEGdF.exe
  C:\Windows\System\IAcEGdF.exe
  2⤵
  PID:5284
- C:\Windows\System\fjLtyob.exe
  C:\Windows\System\fjLtyob.exe
  2⤵
  PID:5300
- C:\Windows\System\ZGITVZC.exe
  C:\Windows\System\ZGITVZC.exe
  2⤵
  PID:5316
- C:\Windows\System\HzVHFiG.exe
  C:\Windows\System\HzVHFiG.exe
  2⤵
  PID:5332
- C:\Windows\System\kcMjNrY.exe
  C:\Windows\System\kcMjNrY.exe
  2⤵
  PID:5348
- C:\Windows\System\wNKUBEK.exe
  C:\Windows\System\wNKUBEK.exe
  2⤵
  PID:5368
- C:\Windows\System\mtMGLIo.exe
  C:\Windows\System\mtMGLIo.exe
  2⤵
  PID:5384
- C:\Windows\System\AHuXLtv.exe
  C:\Windows\System\AHuXLtv.exe
  2⤵
  PID:5400
- C:\Windows\System\LXhqACh.exe
  C:\Windows\System\LXhqACh.exe
  2⤵
  PID:5416
- C:\Windows\System\vTkEJpf.exe
  C:\Windows\System\vTkEJpf.exe
  2⤵
  PID:5432
- C:\Windows\System\TwqNitk.exe
  C:\Windows\System\TwqNitk.exe
  2⤵
  PID:5448
- C:\Windows\System\dbACYMF.exe
  C:\Windows\System\dbACYMF.exe
  2⤵
  PID:5464
- C:\Windows\System\TuvIWZV.exe
  C:\Windows\System\TuvIWZV.exe
  2⤵
  PID:5480
- C:\Windows\System\mOKDggM.exe
  C:\Windows\System\mOKDggM.exe
  2⤵
  PID:5496
- C:\Windows\System\uuvnwWH.exe
  C:\Windows\System\uuvnwWH.exe
  2⤵
  PID:5512
- C:\Windows\System\aelXCKO.exe
  C:\Windows\System\aelXCKO.exe
  2⤵
  PID:5528
- C:\Windows\System\gxeFzXJ.exe
  C:\Windows\System\gxeFzXJ.exe
  2⤵
  PID:5544
- C:\Windows\System\HzEiZPj.exe
  C:\Windows\System\HzEiZPj.exe
  2⤵
  PID:5560
- C:\Windows\System\ogNnhvj.exe
  C:\Windows\System\ogNnhvj.exe
  2⤵
  PID:5576
- C:\Windows\System\YLSmGdy.exe
  C:\Windows\System\YLSmGdy.exe
  2⤵
  PID:5604
- C:\Windows\System\PQrsaUF.exe
  C:\Windows\System\PQrsaUF.exe
  2⤵
  PID:5668
- C:\Windows\System\ejoLOmo.exe
  C:\Windows\System\ejoLOmo.exe
  2⤵
  PID:5692
- C:\Windows\System\sKOSxpE.exe
  C:\Windows\System\sKOSxpE.exe
  2⤵
  PID:5708
- C:\Windows\System\IANCdFt.exe
  C:\Windows\System\IANCdFt.exe
  2⤵
  PID:5724
- C:\Windows\System\YiZpjIq.exe
  C:\Windows\System\YiZpjIq.exe
  2⤵
  PID:5740
- C:\Windows\System\nzSqqlt.exe
  C:\Windows\System\nzSqqlt.exe
  2⤵
  PID:5764
- C:\Windows\System\iDYdZYr.exe
  C:\Windows\System\iDYdZYr.exe
  2⤵
  PID:5780
- C:\Windows\System\BgqIeRv.exe
  C:\Windows\System\BgqIeRv.exe
  2⤵
  PID:5796
- C:\Windows\System\nJyUPcp.exe
  C:\Windows\System\nJyUPcp.exe
  2⤵
  PID:5876
- C:\Windows\System\XRyYxAv.exe
  C:\Windows\System\XRyYxAv.exe
  2⤵
  PID:5896
- C:\Windows\System\WRpEfRS.exe
  C:\Windows\System\WRpEfRS.exe
  2⤵
  PID:6088
- C:\Windows\System\rwaXqXI.exe
  C:\Windows\System\rwaXqXI.exe
  2⤵
  PID:6124
- C:\Windows\System\UhtNRyD.exe
  C:\Windows\System\UhtNRyD.exe
  2⤵
  PID:6140
- C:\Windows\System\mtcgwpc.exe
  C:\Windows\System\mtcgwpc.exe
  2⤵
  PID:4292
- C:\Windows\System\nSIiiIe.exe
  C:\Windows\System\nSIiiIe.exe
  2⤵
  PID:5824
- C:\Windows\System\WpEMaxL.exe
  C:\Windows\System\WpEMaxL.exe
  2⤵
  PID:5840
- C:\Windows\System\XHQvUAm.exe
  C:\Windows\System\XHQvUAm.exe
  2⤵
  PID:5856
- C:\Windows\System\TwqJnPS.exe
  C:\Windows\System\TwqJnPS.exe
  2⤵
  PID:5872
- C:\Windows\System\JnTDdRw.exe
  C:\Windows\System\JnTDdRw.exe
  2⤵
  PID:5808
- C:\Windows\System\zKPEcXb.exe
  C:\Windows\System\zKPEcXb.exe
  2⤵
  PID:5788
- C:\Windows\System\TMTYXil.exe
  C:\Windows\System\TMTYXil.exe
  2⤵
  PID:1928
- C:\Windows\System\NJQScrp.exe
  C:\Windows\System\NJQScrp.exe
  2⤵
  PID:5964
- C:\Windows\System\WIaoAvG.exe
  C:\Windows\System\WIaoAvG.exe
  2⤵
  PID:5940
- C:\Windows\System\VNJbVZz.exe
  C:\Windows\System\VNJbVZz.exe
  2⤵
  PID:5956
- C:\Windows\System\DHJwgik.exe
  C:\Windows\System\DHJwgik.exe
  2⤵
  PID:5976
- C:\Windows\System\lvPgKxq.exe
  C:\Windows\System\lvPgKxq.exe
  2⤵
  PID:5996
- C:\Windows\System\IbXyzFu.exe
  C:\Windows\System\IbXyzFu.exe
  2⤵
  PID:6012
- C:\Windows\System\AWZAfpd.exe
  C:\Windows\System\AWZAfpd.exe
  2⤵
  PID:6032
- C:\Windows\System\QCGQqAh.exe
  C:\Windows\System\QCGQqAh.exe
  2⤵
  PID:6048
- C:\Windows\System\wIIPpbt.exe
  C:\Windows\System\wIIPpbt.exe
  2⤵
  PID:6064
- C:\Windows\System\DSTZQfD.exe
  C:\Windows\System\DSTZQfD.exe
  2⤵
  PID:6084
- C:\Windows\System\QeJQqEp.exe
  C:\Windows\System\QeJQqEp.exe
  2⤵
  PID:6116
- C:\Windows\System\BEfQXmZ.exe
  C:\Windows\System\BEfQXmZ.exe
  2⤵
  PID:4324
- C:\Windows\System\rNSodSY.exe
  C:\Windows\System\rNSodSY.exe
  2⤵
  PID:5152
- C:\Windows\System\ueIBlUZ.exe
  C:\Windows\System\ueIBlUZ.exe
  2⤵
  PID:5216
- C:\Windows\System\ukKgCqX.exe
  C:\Windows\System\ukKgCqX.exe
  2⤵
  PID:5000
- C:\Windows\System\RKXlYfl.exe
  C:\Windows\System\RKXlYfl.exe
  2⤵
  PID:4776
- C:\Windows\System\BXyCwhG.exe
  C:\Windows\System\BXyCwhG.exe
  2⤵
  PID:5248
- C:\Windows\System\HritWys.exe
  C:\Windows\System\HritWys.exe
  2⤵
  PID:5280
- C:\Windows\System\cizEmYg.exe
  C:\Windows\System\cizEmYg.exe
  2⤵
  PID:5196
- C:\Windows\System\tJgSinO.exe
  C:\Windows\System\tJgSinO.exe
  2⤵
  PID:5292
- C:\Windows\System\EeUuBgA.exe
  C:\Windows\System\EeUuBgA.exe
  2⤵
  PID:5324
- C:\Windows\System\pKyGmWB.exe
  C:\Windows\System\pKyGmWB.exe
  2⤵
  PID:5408
- C:\Windows\System\UZHGqZR.exe
  C:\Windows\System\UZHGqZR.exe
  2⤵
  PID:5476
- C:\Windows\System\sWAIgRD.exe
  C:\Windows\System\sWAIgRD.exe
  2⤵
  PID:5540
- C:\Windows\System\bRLOZSm.exe
  C:\Windows\System\bRLOZSm.exe
  2⤵
  PID:5700
- C:\Windows\System\NPIRYuX.exe
  C:\Windows\System\NPIRYuX.exe
  2⤵
  PID:5616
- C:\Windows\System\CrQftem.exe
  C:\Windows\System\CrQftem.exe
  2⤵
  PID:5748
- C:\Windows\System\GsvzniP.exe
  C:\Windows\System\GsvzniP.exe
  2⤵
  PID:5832
- C:\Windows\System\dWQJQAg.exe
  C:\Windows\System\dWQJQAg.exe
  2⤵
  PID:5848
- C:\Windows\System\NjatlgX.exe
  C:\Windows\System\NjatlgX.exe
  2⤵
  PID:5772
- C:\Windows\System\eLAtrZI.exe
  C:\Windows\System\eLAtrZI.exe
  2⤵
  PID:5928
- C:\Windows\System\CLCYgoS.exe
  C:\Windows\System\CLCYgoS.exe
  2⤵
  PID:5684
- C:\Windows\System\tysXdsh.exe
  C:\Windows\System\tysXdsh.exe
  2⤵
  PID:6056
- C:\Windows\System\rOAulGN.exe
  C:\Windows\System\rOAulGN.exe
  2⤵
  PID:6004
- C:\Windows\System\DEnQUgP.exe
  C:\Windows\System\DEnQUgP.exe
  2⤵
  PID:6080
- C:\Windows\System\mVucMGO.exe
  C:\Windows\System\mVucMGO.exe
  2⤵
  PID:6132
- C:\Windows\System\jaqabiu.exe
  C:\Windows\System\jaqabiu.exe
  2⤵
  PID:4572
- C:\Windows\System\sAjUFiH.exe
  C:\Windows\System\sAjUFiH.exe
  2⤵
  PID:5276
- C:\Windows\System\XwldGED.exe
  C:\Windows\System\XwldGED.exe
  2⤵
  PID:5868
- C:\Windows\System\JJbeegZ.exe
  C:\Windows\System\JJbeegZ.exe
  2⤵
  PID:5792
- C:\Windows\System\JxItiAH.exe
  C:\Windows\System\JxItiAH.exe
  2⤵
  PID:5440
- C:\Windows\System\efiNGpG.exe
  C:\Windows\System\efiNGpG.exe
  2⤵
  PID:6020
- C:\Windows\System\EcPOZIw.exe
  C:\Windows\System\EcPOZIw.exe
  2⤵
  PID:5328
- C:\Windows\System\UVXXjWm.exe
  C:\Windows\System\UVXXjWm.exe
  2⤵
  PID:5084
- C:\Windows\System\NjoETjg.exe
  C:\Windows\System\NjoETjg.exe
  2⤵
  PID:5168
- C:\Windows\System\JLJrkjI.exe
  C:\Windows\System\JLJrkjI.exe
  2⤵
  PID:5392
- C:\Windows\System\DiEAXSz.exe
  C:\Windows\System\DiEAXSz.exe
  2⤵
  PID:5460
- C:\Windows\System\jzWnBBk.exe
  C:\Windows\System\jzWnBBk.exe
  2⤵
  PID:5428
- C:\Windows\System\ldBCXdz.exe
  C:\Windows\System\ldBCXdz.exe
  2⤵
  PID:6096
- C:\Windows\System\wMHgnrm.exe
  C:\Windows\System\wMHgnrm.exe
  2⤵
  PID:4696
- C:\Windows\System\rrouulk.exe
  C:\Windows\System\rrouulk.exe
  2⤵
  PID:5504
- C:\Windows\System\sDheLrL.exe
  C:\Windows\System\sDheLrL.exe
  2⤵
  PID:5536
- C:\Windows\System\sTuTuHF.exe
  C:\Windows\System\sTuTuHF.exe
  2⤵
  PID:6072
- C:\Windows\System\roqsiAw.exe
  C:\Windows\System\roqsiAw.exe
  2⤵
  PID:5200
- C:\Windows\System\UpEQCqA.exe
  C:\Windows\System\UpEQCqA.exe
  2⤵
  PID:5312
- C:\Windows\System\WGCcxCa.exe
  C:\Windows\System\WGCcxCa.exe
  2⤵
  PID:5472
- C:\Windows\System\TpbjZGH.exe
  C:\Windows\System\TpbjZGH.exe
  2⤵
  PID:5584
- C:\Windows\System\YBcCrcY.exe
  C:\Windows\System\YBcCrcY.exe
  2⤵
  PID:5612
- C:\Windows\System\ndNJRSq.exe
  C:\Windows\System\ndNJRSq.exe
  2⤵
  PID:5624
- C:\Windows\System\FygDhjj.exe
  C:\Windows\System\FygDhjj.exe
  2⤵
  PID:5888
- C:\Windows\System\qPdpcjN.exe
  C:\Windows\System\qPdpcjN.exe
  2⤵
  PID:5664
- C:\Windows\System\CiQshcL.exe
  C:\Windows\System\CiQshcL.exe
  2⤵
  PID:5732
- C:\Windows\System\mVdpnzR.exe
  C:\Windows\System\mVdpnzR.exe
  2⤵
  PID:5984
- C:\Windows\System\ytGjkGh.exe
  C:\Windows\System\ytGjkGh.exe
  2⤵
  PID:6024
- C:\Windows\System\iDFtsbB.exe
  C:\Windows\System\iDFtsbB.exe
  2⤵
  PID:5456
- C:\Windows\System\ZSGebFt.exe
  C:\Windows\System\ZSGebFt.exe
  2⤵
  PID:5588
- C:\Windows\System\sTPPPXB.exe
  C:\Windows\System\sTPPPXB.exe
  2⤵
  PID:5736
- C:\Windows\System\bHUSAFV.exe
  C:\Windows\System\bHUSAFV.exe
  2⤵
  PID:6108
- C:\Windows\System\KYtVuFz.exe
  C:\Windows\System\KYtVuFz.exe
  2⤵
  PID:5488
- C:\Windows\System\BRQXkFM.exe
  C:\Windows\System\BRQXkFM.exe
  2⤵
  PID:6196
- C:\Windows\System\xIPUIQK.exe
  C:\Windows\System\xIPUIQK.exe
  2⤵
  PID:6212
- C:\Windows\System\fJsAIku.exe
  C:\Windows\System\fJsAIku.exe
  2⤵
  PID:6228
- C:\Windows\System\OMkksqZ.exe
  C:\Windows\System\OMkksqZ.exe
  2⤵
  PID:6244
- C:\Windows\System\jvIyDIL.exe
  C:\Windows\System\jvIyDIL.exe
  2⤵
  PID:6260
- C:\Windows\System\UDYcgJW.exe
  C:\Windows\System\UDYcgJW.exe
  2⤵
  PID:6276
- C:\Windows\System\JJQjkpQ.exe
  C:\Windows\System\JJQjkpQ.exe
  2⤵
  PID:6292
- C:\Windows\System\sShEtHk.exe
  C:\Windows\System\sShEtHk.exe
  2⤵
  PID:6308
- C:\Windows\System\jZOcqBd.exe
  C:\Windows\System\jZOcqBd.exe
  2⤵
  PID:6324
- C:\Windows\System\ngFmHvC.exe
  C:\Windows\System\ngFmHvC.exe
  2⤵
  PID:6340
- C:\Windows\System\VdrnHOm.exe
  C:\Windows\System\VdrnHOm.exe
  2⤵
  PID:6356
- C:\Windows\System\lYrulBz.exe
  C:\Windows\System\lYrulBz.exe
  2⤵
  PID:6376
- C:\Windows\System\lpnhpeL.exe
  C:\Windows\System\lpnhpeL.exe
  2⤵
  PID:6392
- C:\Windows\System\WOcgsfZ.exe
  C:\Windows\System\WOcgsfZ.exe
  2⤵
  PID:6408
- C:\Windows\System\rdKeVQx.exe
  C:\Windows\System\rdKeVQx.exe
  2⤵
  PID:6424
- C:\Windows\System\FQbyegp.exe
  C:\Windows\System\FQbyegp.exe
  2⤵
  PID:6440
- C:\Windows\System\Qkhdlyl.exe
  C:\Windows\System\Qkhdlyl.exe
  2⤵
  PID:6456
- C:\Windows\System\EuYMiGc.exe
  C:\Windows\System\EuYMiGc.exe
  2⤵
  PID:6472
- C:\Windows\System\XtNizdz.exe
  C:\Windows\System\XtNizdz.exe
  2⤵
  PID:6488
- C:\Windows\System\ailjXlG.exe
  C:\Windows\System\ailjXlG.exe
  2⤵
  PID:6604
- C:\Windows\System\dtYUgyi.exe
  C:\Windows\System\dtYUgyi.exe
  2⤵
  PID:6620
- C:\Windows\System\yXrEcAH.exe
  C:\Windows\System\yXrEcAH.exe
  2⤵
  PID:6636
- C:\Windows\System\LPAbglu.exe
  C:\Windows\System\LPAbglu.exe
  2⤵
  PID:6652
- C:\Windows\System\NoLsUzk.exe
  C:\Windows\System\NoLsUzk.exe
  2⤵
  PID:6668
- C:\Windows\System\vYnwKNr.exe
  C:\Windows\System\vYnwKNr.exe
  2⤵
  PID:6684
- C:\Windows\System\fcSZsQn.exe
  C:\Windows\System\fcSZsQn.exe
  2⤵
  PID:6700
- C:\Windows\System\sVvkTNm.exe
  C:\Windows\System\sVvkTNm.exe
  2⤵
  PID:6716
- C:\Windows\System\MkbuNgH.exe
  C:\Windows\System\MkbuNgH.exe
  2⤵
  PID:6732
- C:\Windows\System\OBpidds.exe
  C:\Windows\System\OBpidds.exe
  2⤵
  PID:6748
- C:\Windows\System\zzxisti.exe
  C:\Windows\System\zzxisti.exe
  2⤵
  PID:6764
- C:\Windows\System\bjnkfrX.exe
  C:\Windows\System\bjnkfrX.exe
  2⤵
  PID:6780
- C:\Windows\System\ngewQYW.exe
  C:\Windows\System\ngewQYW.exe
  2⤵
  PID:6796
- C:\Windows\System\stuNMPr.exe
  C:\Windows\System\stuNMPr.exe
  2⤵
  PID:6812
- C:\Windows\System\tbCTJUG.exe
  C:\Windows\System\tbCTJUG.exe
  2⤵
  PID:6828
- C:\Windows\System\mfBFIQf.exe
  C:\Windows\System\mfBFIQf.exe
  2⤵
  PID:6844
- C:\Windows\System\ItzIbFE.exe
  C:\Windows\System\ItzIbFE.exe
  2⤵
  PID:6860
- C:\Windows\System\LToRdxD.exe
  C:\Windows\System\LToRdxD.exe
  2⤵
  PID:6876
- C:\Windows\System\zJPCfNX.exe
  C:\Windows\System\zJPCfNX.exe
  2⤵
  PID:6892
- C:\Windows\System\LEKiThf.exe
  C:\Windows\System\LEKiThf.exe
  2⤵
  PID:6908
- C:\Windows\System\bvPslDu.exe
  C:\Windows\System\bvPslDu.exe
  2⤵
  PID:6924
- C:\Windows\System\oAmUHON.exe
  C:\Windows\System\oAmUHON.exe
  2⤵
  PID:6940
- C:\Windows\System\GCstTag.exe
  C:\Windows\System\GCstTag.exe
  2⤵
  PID:6956
- C:\Windows\System\OSXOFqk.exe
  C:\Windows\System\OSXOFqk.exe
  2⤵
  PID:6972
- C:\Windows\System\lCcusmR.exe
  C:\Windows\System\lCcusmR.exe
  2⤵
  PID:6988
- C:\Windows\System\KSvRfMf.exe
  C:\Windows\System\KSvRfMf.exe
  2⤵
  PID:7004
- C:\Windows\System\KwwoCeO.exe
  C:\Windows\System\KwwoCeO.exe
  2⤵
  PID:7020
- C:\Windows\System\CpDUfPe.exe
  C:\Windows\System\CpDUfPe.exe
  2⤵
  PID:7036
- C:\Windows\System\CSvQgci.exe
  C:\Windows\System\CSvQgci.exe
  2⤵
  PID:7052
- C:\Windows\System\tOmrJMm.exe
  C:\Windows\System\tOmrJMm.exe
  2⤵
  PID:7068
- C:\Windows\System\oAzakZz.exe
  C:\Windows\System\oAzakZz.exe
  2⤵
  PID:7084
- C:\Windows\System\eYjeLxo.exe
  C:\Windows\System\eYjeLxo.exe
  2⤵
  PID:7100
- C:\Windows\System\OYVqpMT.exe
  C:\Windows\System\OYVqpMT.exe
  2⤵
  PID:7116
- C:\Windows\System\qmxdDnJ.exe
  C:\Windows\System\qmxdDnJ.exe
  2⤵
  PID:7132
- C:\Windows\System\uZxBdUN.exe
  C:\Windows\System\uZxBdUN.exe
  2⤵
  PID:7148
- C:\Windows\System\QpTLLAo.exe
  C:\Windows\System\QpTLLAo.exe
  2⤵
  PID:7164
- C:\Windows\System\IoosXlS.exe
  C:\Windows\System\IoosXlS.exe
  2⤵
  PID:5644
- C:\Windows\System\oQUGczX.exe
  C:\Windows\System\oQUGczX.exe
  2⤵
  PID:5972
- C:\Windows\System\cUwoved.exe
  C:\Windows\System\cUwoved.exe
  2⤵
  PID:5636
- C:\Windows\System\gLCsIcg.exe
  C:\Windows\System\gLCsIcg.exe
  2⤵
  PID:5212
- C:\Windows\System\jRJgUXK.exe
  C:\Windows\System\jRJgUXK.exe
  2⤵
  PID:5752
- C:\Windows\System\QaaCZKE.exe
  C:\Windows\System\QaaCZKE.exe
  2⤵
  PID:6120
- C:\Windows\System\FNQXsXQ.exe
  C:\Windows\System\FNQXsXQ.exe
  2⤵
  PID:6152
- C:\Windows\System\JTYNgRb.exe
  C:\Windows\System\JTYNgRb.exe
  2⤵
  PID:6172
- C:\Windows\System\TSAnAYD.exe
  C:\Windows\System\TSAnAYD.exe
  2⤵
  PID:6188
- C:\Windows\System\saUsXzW.exe
  C:\Windows\System\saUsXzW.exe
  2⤵
  PID:6252
- C:\Windows\System\fcWKXCV.exe
  C:\Windows\System\fcWKXCV.exe
  2⤵
  PID:6224
- C:\Windows\System\GhGahol.exe
  C:\Windows\System\GhGahol.exe
  2⤵
  PID:6288
- C:\Windows\System\bSyleOK.exe
  C:\Windows\System\bSyleOK.exe
  2⤵
  PID:6384
- C:\Windows\System\yCyZRcK.exe
  C:\Windows\System\yCyZRcK.exe
  2⤵
  PID:6332
- C:\Windows\System\pQZMeSL.exe
  C:\Windows\System\pQZMeSL.exe
  2⤵
  PID:6432
- C:\Windows\System\nQVDIkn.exe
  C:\Windows\System\nQVDIkn.exe
  2⤵
  PID:6316
- C:\Windows\System\seyPaCL.exe
  C:\Windows\System\seyPaCL.exe
  2⤵
  PID:6236
- C:\Windows\System\bnjbXLS.exe
  C:\Windows\System\bnjbXLS.exe
  2⤵
  PID:6480
- C:\Windows\System\rWVdCDY.exe
  C:\Windows\System\rWVdCDY.exe
  2⤵
  PID:6508
- C:\Windows\System\woXQHJJ.exe
  C:\Windows\System\woXQHJJ.exe
  2⤵
  PID:6520
- C:\Windows\System\slLKaPT.exe
  C:\Windows\System\slLKaPT.exe
  2⤵
  PID:5716
- C:\Windows\System\jYdbhNc.exe
  C:\Windows\System\jYdbhNc.exe
  2⤵
  PID:6548
- C:\Windows\System\ehQAhvL.exe
  C:\Windows\System\ehQAhvL.exe
  2⤵
  PID:6552
- C:\Windows\System\qwIKDeQ.exe
  C:\Windows\System\qwIKDeQ.exe
  2⤵
  PID:6584
- C:\Windows\System\jISFtjm.exe
  C:\Windows\System\jISFtjm.exe
  2⤵
  PID:6612
- C:\Windows\System\xaHxgmS.exe
  C:\Windows\System\xaHxgmS.exe
  2⤵
  PID:6676
- C:\Windows\System\gBdfFSB.exe
  C:\Windows\System\gBdfFSB.exe
  2⤵
  PID:6740
- C:\Windows\System\liyHLff.exe
  C:\Windows\System\liyHLff.exe
  2⤵
  PID:6776
- C:\Windows\System\lOCwauS.exe
  C:\Windows\System\lOCwauS.exe
  2⤵
  PID:6836
- C:\Windows\System\MUpdGRk.exe
  C:\Windows\System\MUpdGRk.exe
  2⤵
  PID:6868
- C:\Windows\System\buUJbnY.exe
  C:\Windows\System\buUJbnY.exe
  2⤵
  PID:6692
- C:\Windows\System\FhkIxmO.exe
  C:\Windows\System\FhkIxmO.exe
  2⤵
  PID:6824
- C:\Windows\System\prHtBJn.exe
  C:\Windows\System\prHtBJn.exe
  2⤵
  PID:6728
- C:\Windows\System\ePCcfzL.exe
  C:\Windows\System\ePCcfzL.exe
  2⤵
  PID:6792
- C:\Windows\System\bCtvXPR.exe
  C:\Windows\System\bCtvXPR.exe
  2⤵
  PID:6936
- C:\Windows\System\SoZmLpo.exe
  C:\Windows\System\SoZmLpo.exe
  2⤵
  PID:6968
- C:\Windows\System\cyMBJYy.exe
  C:\Windows\System\cyMBJYy.exe
  2⤵
  PID:7032
- C:\Windows\System\RxIzDAF.exe
  C:\Windows\System\RxIzDAF.exe
  2⤵
  PID:7096
- C:\Windows\System\hHlEbfx.exe
  C:\Windows\System\hHlEbfx.exe
  2⤵
  PID:7012
- C:\Windows\System\GTfsxqJ.exe
  C:\Windows\System\GTfsxqJ.exe
  2⤵
  PID:7048
- C:\Windows\System\YSonyJl.exe
  C:\Windows\System\YSonyJl.exe
  2⤵
  PID:5380
- C:\Windows\System\piLScdf.exe
  C:\Windows\System\piLScdf.exe
  2⤵
  PID:4372
- C:\Windows\System\uXcGpUh.exe
  C:\Windows\System\uXcGpUh.exe
  2⤵
  PID:7080
- C:\Windows\System\nJPqLPA.exe
  C:\Windows\System\nJPqLPA.exe
  2⤵
  PID:6160
- C:\Windows\System\yRUrXEV.exe
  C:\Windows\System\yRUrXEV.exe
  2⤵
  PID:7108
- C:\Windows\System\gRuzpNT.exe
  C:\Windows\System\gRuzpNT.exe
  2⤵
  PID:3316
- C:\Windows\System\HcmZNjX.exe
  C:\Windows\System\HcmZNjX.exe
  2⤵
  PID:6184
- C:\Windows\System\MfgCndh.exe
  C:\Windows\System\MfgCndh.exe
  2⤵
  PID:6272
- C:\Windows\System\tNoitGe.exe
  C:\Windows\System\tNoitGe.exe
  2⤵
  PID:6416
- C:\Windows\System\wDVZGyK.exe
  C:\Windows\System\wDVZGyK.exe
  2⤵
  PID:6352
- C:\Windows\System\oCoHAJv.exe
  C:\Windows\System\oCoHAJv.exe
  2⤵
  PID:6436
- C:\Windows\System\RCRoyen.exe
  C:\Windows\System\RCRoyen.exe
  2⤵
  PID:6484
- C:\Windows\System\iuBeIUB.exe
  C:\Windows\System\iuBeIUB.exe
  2⤵
  PID:6532
- C:\Windows\System\ktTkktw.exe
  C:\Windows\System\ktTkktw.exe
  2⤵
  PID:6560
- C:\Windows\System\PRfqdJZ.exe
  C:\Windows\System\PRfqdJZ.exe
  2⤵
  PID:6708
- C:\Windows\System\GRwyrMm.exe
  C:\Windows\System\GRwyrMm.exe
  2⤵
  PID:6772
- C:\Windows\System\ziALzFd.exe
  C:\Windows\System\ziALzFd.exe
  2⤵
  PID:6664
- C:\Windows\System\hQRjfpx.exe
  C:\Windows\System\hQRjfpx.exe
  2⤵
  PID:6632
- C:\Windows\System\gLKfbiM.exe
  C:\Windows\System\gLKfbiM.exe
  2⤵
  PID:6920
- C:\Windows\System\Xvwufrw.exe
  C:\Windows\System\Xvwufrw.exe
  2⤵
  PID:7092
- C:\Windows\System\vFFVpjf.exe
  C:\Windows\System\vFFVpjf.exe
  2⤵
  PID:6760
- C:\Windows\System\rgOiHeA.exe
  C:\Windows\System\rgOiHeA.exe
  2⤵
  PID:7000
- C:\Windows\System\OTPmnnZ.exe
  C:\Windows\System\OTPmnnZ.exe
  2⤵
  PID:7160
- C:\Windows\System\BzccEBb.exe
  C:\Windows\System\BzccEBb.exe
  2⤵
  PID:7044
- C:\Windows\System\CGwUjHG.exe
  C:\Windows\System\CGwUjHG.exe
  2⤵
  PID:6336
- C:\Windows\System\cVXTSQo.exe
  C:\Windows\System\cVXTSQo.exe
  2⤵
  PID:6512
- C:\Windows\System\TZvNRgN.exe
  C:\Windows\System\TZvNRgN.exe
  2⤵
  PID:6580
- C:\Windows\System\mKKotSV.exe
  C:\Windows\System\mKKotSV.exe
  2⤵
  PID:6600
- C:\Windows\System\vuEsXgz.exe
  C:\Windows\System\vuEsXgz.exe
  2⤵
  PID:6952
- C:\Windows\System\bSKBLLR.exe
  C:\Windows\System\bSKBLLR.exe
  2⤵
  PID:6204
- C:\Windows\System\TlILdjI.exe
  C:\Windows\System\TlILdjI.exe
  2⤵
  PID:6528
- C:\Windows\System\xJIDUee.exe
  C:\Windows\System\xJIDUee.exe
  2⤵
  PID:7124
- C:\Windows\System\PZMUbrV.exe
  C:\Windows\System\PZMUbrV.exe
  2⤵
  PID:6100
- C:\Windows\System\MmalbNR.exe
  C:\Windows\System\MmalbNR.exe
  2⤵
  PID:6496
- C:\Windows\System\wUGeAPP.exe
  C:\Windows\System\wUGeAPP.exe
  2⤵
  PID:6148
- C:\Windows\System\trpuvXH.exe
  C:\Windows\System\trpuvXH.exe
  2⤵
  PID:6564
- C:\Windows\System\RUPqkfo.exe
  C:\Windows\System\RUPqkfo.exe
  2⤵
  PID:6904
- C:\Windows\System\dKIKAnH.exe
  C:\Windows\System\dKIKAnH.exe
  2⤵
  PID:6220
- C:\Windows\System\sLNrAQR.exe
  C:\Windows\System\sLNrAQR.exe
  2⤵
  PID:7180
- C:\Windows\System\KrMiMBU.exe
  C:\Windows\System\KrMiMBU.exe
  2⤵
  PID:7196
- C:\Windows\System\kKnshZR.exe
  C:\Windows\System\kKnshZR.exe
  2⤵
  PID:7212
- C:\Windows\System\ocWzYmM.exe
  C:\Windows\System\ocWzYmM.exe
  2⤵
  PID:7228
- C:\Windows\System\LVaXWKF.exe
  C:\Windows\System\LVaXWKF.exe
  2⤵
  PID:7244
- C:\Windows\System\GBPfuWQ.exe
  C:\Windows\System\GBPfuWQ.exe
  2⤵
  PID:7260
- C:\Windows\System\vQpPauZ.exe
  C:\Windows\System\vQpPauZ.exe
  2⤵
  PID:7276
- C:\Windows\System\tIILbfL.exe
  C:\Windows\System\tIILbfL.exe
  2⤵
  PID:7292
- C:\Windows\System\cUChici.exe
  C:\Windows\System\cUChici.exe
  2⤵
  PID:7308
- C:\Windows\System\HiMfgKM.exe
  C:\Windows\System\HiMfgKM.exe
  2⤵
  PID:7324
- C:\Windows\System\kgdtydJ.exe
  C:\Windows\System\kgdtydJ.exe
  2⤵
  PID:7340
- C:\Windows\System\DfbhGAH.exe
  C:\Windows\System\DfbhGAH.exe
  2⤵
  PID:7356
- C:\Windows\System\YtPZxhy.exe
  C:\Windows\System\YtPZxhy.exe
  2⤵
  PID:7372
- C:\Windows\System\QLgKSZs.exe
  C:\Windows\System\QLgKSZs.exe
  2⤵
  PID:7388
- C:\Windows\System\fmVlsfi.exe
  C:\Windows\System\fmVlsfi.exe
  2⤵
  PID:7404
- C:\Windows\System\KEnNWWR.exe
  C:\Windows\System\KEnNWWR.exe
  2⤵
  PID:7420
- C:\Windows\System\aoPeOSK.exe
  C:\Windows\System\aoPeOSK.exe
  2⤵
  PID:7436
- C:\Windows\System\JmrkWQq.exe
  C:\Windows\System\JmrkWQq.exe
  2⤵
  PID:7452
- C:\Windows\System\JQfYVHU.exe
  C:\Windows\System\JQfYVHU.exe
  2⤵
  PID:7468
- C:\Windows\System\iCLbzGY.exe
  C:\Windows\System\iCLbzGY.exe
  2⤵
  PID:7484
- C:\Windows\System\bxlzwxl.exe
  C:\Windows\System\bxlzwxl.exe
  2⤵
  PID:7500
- C:\Windows\System\LkUSlcl.exe
  C:\Windows\System\LkUSlcl.exe
  2⤵
  PID:7516
- C:\Windows\System\bCUtMud.exe
  C:\Windows\System\bCUtMud.exe
  2⤵
  PID:7532
- C:\Windows\System\TGWnOaC.exe
  C:\Windows\System\TGWnOaC.exe
  2⤵
  PID:7548
- C:\Windows\System\YBxKKrh.exe
  C:\Windows\System\YBxKKrh.exe
  2⤵
  PID:7564
- C:\Windows\System\qnSNies.exe
  C:\Windows\System\qnSNies.exe
  2⤵
  PID:7580
- C:\Windows\System\gidtKhK.exe
  C:\Windows\System\gidtKhK.exe
  2⤵
  PID:7596
- C:\Windows\System\QFDfDAN.exe
  C:\Windows\System\QFDfDAN.exe
  2⤵
  PID:7612
- C:\Windows\System\jkybCfG.exe
  C:\Windows\System\jkybCfG.exe
  2⤵
  PID:7628
- C:\Windows\System\btiGYWD.exe
  C:\Windows\System\btiGYWD.exe
  2⤵
  PID:7644
- C:\Windows\System\YRxvzsv.exe
  C:\Windows\System\YRxvzsv.exe
  2⤵
  PID:7660
- C:\Windows\System\xjJHDsR.exe
  C:\Windows\System\xjJHDsR.exe
  2⤵
  PID:7676
- C:\Windows\System\gnfNzOH.exe
  C:\Windows\System\gnfNzOH.exe
  2⤵
  PID:7692
- C:\Windows\System\KBENXPY.exe
  C:\Windows\System\KBENXPY.exe
  2⤵
  PID:7708
- C:\Windows\System\jEtlnMt.exe
  C:\Windows\System\jEtlnMt.exe
  2⤵
  PID:7724
- C:\Windows\System\ySMrYwU.exe
  C:\Windows\System\ySMrYwU.exe
  2⤵
  PID:7740
- C:\Windows\System\CTNQvQh.exe
  C:\Windows\System\CTNQvQh.exe
  2⤵
  PID:7792
- C:\Windows\System\EAogdtM.exe
  C:\Windows\System\EAogdtM.exe
  2⤵
  PID:7808
- C:\Windows\System\NhtTcow.exe
  C:\Windows\System\NhtTcow.exe
  2⤵
  PID:7824
- C:\Windows\System\tGgZfdP.exe
  C:\Windows\System\tGgZfdP.exe
  2⤵
  PID:7840
- C:\Windows\System\RZZgnMQ.exe
  C:\Windows\System\RZZgnMQ.exe
  2⤵
  PID:7856
- C:\Windows\System\gxDoDuK.exe
  C:\Windows\System\gxDoDuK.exe
  2⤵
  PID:7872
- C:\Windows\System\UjKhQpY.exe
  C:\Windows\System\UjKhQpY.exe
  2⤵
  PID:7892
- C:\Windows\System\qojstvw.exe
  C:\Windows\System\qojstvw.exe
  2⤵
  PID:7912
- C:\Windows\System\sLjigDj.exe
  C:\Windows\System\sLjigDj.exe
  2⤵
  PID:7928
- C:\Windows\System\TXePocT.exe
  C:\Windows\System\TXePocT.exe
  2⤵
  PID:7948
- C:\Windows\System\tegQdDw.exe
  C:\Windows\System\tegQdDw.exe
  2⤵
  PID:7964
- C:\Windows\System\XHEASPm.exe
  C:\Windows\System\XHEASPm.exe
  2⤵
  PID:7980
- C:\Windows\System\gZgjqMl.exe
  C:\Windows\System\gZgjqMl.exe
  2⤵
  PID:7996
- C:\Windows\System\wsQtYUh.exe
  C:\Windows\System\wsQtYUh.exe
  2⤵
  PID:8012
- C:\Windows\System\PhoqCop.exe
  C:\Windows\System\PhoqCop.exe
  2⤵
  PID:8028
- C:\Windows\System\pOwIhKd.exe
  C:\Windows\System\pOwIhKd.exe
  2⤵
  PID:8044
- C:\Windows\System\szHBAZm.exe
  C:\Windows\System\szHBAZm.exe
  2⤵
  PID:8060
- C:\Windows\System\zbXBfvG.exe
  C:\Windows\System\zbXBfvG.exe
  2⤵
  PID:8076
- C:\Windows\System\YWtnSrN.exe
  C:\Windows\System\YWtnSrN.exe
  2⤵
  PID:8092
- C:\Windows\System\tswuLjE.exe
  C:\Windows\System\tswuLjE.exe
  2⤵
  PID:8108
- C:\Windows\System\HtXARhs.exe
  C:\Windows\System\HtXARhs.exe
  2⤵
  PID:8124
- C:\Windows\System\iTONztR.exe
  C:\Windows\System\iTONztR.exe
  2⤵
  PID:8140
- C:\Windows\System\OawjTEW.exe
  C:\Windows\System\OawjTEW.exe
  2⤵
  PID:8156
- C:\Windows\System\mJPWtxR.exe
  C:\Windows\System\mJPWtxR.exe
  2⤵
  PID:8172
- C:\Windows\System\wOqgrAT.exe
  C:\Windows\System\wOqgrAT.exe
  2⤵
  PID:8188
- C:\Windows\System\vlQJadM.exe
  C:\Windows\System\vlQJadM.exe
  2⤵
  PID:5396
- C:\Windows\System\UwisCea.exe
  C:\Windows\System\UwisCea.exe
  2⤵
  PID:6696
- C:\Windows\System\ojHpxaa.exe
  C:\Windows\System\ojHpxaa.exe
  2⤵
  PID:7172
- C:\Windows\System\whAYpYw.exe
  C:\Windows\System\whAYpYw.exe
  2⤵
  PID:6628
- C:\Windows\System\DEZaUjl.exe
  C:\Windows\System\DEZaUjl.exe
  2⤵
  PID:7220
- C:\Windows\System\PjoPyTK.exe
  C:\Windows\System\PjoPyTK.exe
  2⤵
  PID:7236
- C:\Windows\System\zMPmsWP.exe
  C:\Windows\System\zMPmsWP.exe
  2⤵
  PID:7268
- C:\Windows\System\HJbnAcM.exe
  C:\Windows\System\HJbnAcM.exe
  2⤵
  PID:7316
- C:\Windows\System\pbpLijM.exe
  C:\Windows\System\pbpLijM.exe
  2⤵
  PID:7336
- C:\Windows\System\RDyPGiT.exe
  C:\Windows\System\RDyPGiT.exe
  2⤵
  PID:7368
- C:\Windows\System\qRvmrlG.exe
  C:\Windows\System\qRvmrlG.exe
  2⤵
  PID:7400
- C:\Windows\System\DNjJOCh.exe
  C:\Windows\System\DNjJOCh.exe
  2⤵
  PID:7444
- C:\Windows\System\dHLfWPU.exe
  C:\Windows\System\dHLfWPU.exe
  2⤵
  PID:7460
- C:\Windows\System\giaDQva.exe
  C:\Windows\System\giaDQva.exe
  2⤵
  PID:7512
- C:\Windows\System\UXpuEXw.exe
  C:\Windows\System\UXpuEXw.exe
  2⤵
  PID:7572
- C:\Windows\System\MKppvvB.exe
  C:\Windows\System\MKppvvB.exe
  2⤵
  PID:7556
- C:\Windows\System\KSfjSRB.exe
  C:\Windows\System\KSfjSRB.exe
  2⤵
  PID:7592
- C:\Windows\System\GIgWluk.exe
  C:\Windows\System\GIgWluk.exe
  2⤵
  PID:7620
- C:\Windows\System\hChPTgQ.exe
  C:\Windows\System\hChPTgQ.exe
  2⤵
  PID:7624
- C:\Windows\System\DFdbcft.exe
  C:\Windows\System\DFdbcft.exe
  2⤵
  PID:7688
- C:\Windows\System\mPMxjfM.exe
  C:\Windows\System\mPMxjfM.exe
  2⤵
  PID:7736
- C:\Windows\System\MNXqebs.exe
  C:\Windows\System\MNXqebs.exe
  2⤵
  PID:7752
- C:\Windows\System\IgsPLWy.exe
  C:\Windows\System\IgsPLWy.exe
  2⤵
  PID:7768
- C:\Windows\System\nOpFOxc.exe
  C:\Windows\System\nOpFOxc.exe
  2⤵
  PID:7784
- C:\Windows\System\AdskAGM.exe
  C:\Windows\System\AdskAGM.exe
  2⤵
  PID:7820
- C:\Windows\System\fufsPFO.exe
  C:\Windows\System\fufsPFO.exe
  2⤵
  PID:7884
- C:\Windows\System\ZQiVbkR.exe
  C:\Windows\System\ZQiVbkR.exe
  2⤵
  PID:7816
- C:\Windows\System\ZOOYUXu.exe
  C:\Windows\System\ZOOYUXu.exe
  2⤵
  PID:7960
- C:\Windows\System\syXtLDU.exe
  C:\Windows\System\syXtLDU.exe
  2⤵
  PID:7864
- C:\Windows\System\zPIVXka.exe
  C:\Windows\System\zPIVXka.exe
  2⤵
  PID:7944
- C:\Windows\System\FElsmUn.exe
  C:\Windows\System\FElsmUn.exe
  2⤵
  PID:8132
- C:\Windows\System\LGsqdtO.exe
  C:\Windows\System\LGsqdtO.exe
  2⤵
  PID:8040
- C:\Windows\System\rOCvyLF.exe
  C:\Windows\System\rOCvyLF.exe
  2⤵
  PID:8104
- C:\Windows\System\RLvaGdd.exe
  C:\Windows\System\RLvaGdd.exe
  2⤵
  PID:6180
- C:\Windows\System\tTcROVW.exe
  C:\Windows\System\tTcROVW.exe
  2⤵
  PID:8052
- C:\Windows\System\HdXuwyI.exe
  C:\Windows\System\HdXuwyI.exe
  2⤵
  PID:8152
- C:\Windows\System\OjHJmdb.exe
  C:\Windows\System\OjHJmdb.exe
  2⤵
  PID:8020
- C:\Windows\System\kYPfaZT.exe
  C:\Windows\System\kYPfaZT.exe
  2⤵
  PID:8120
- C:\Windows\System\iEdkKbX.exe
  C:\Windows\System\iEdkKbX.exe
  2⤵
  PID:6916
- C:\Windows\System\EmLjoVq.exe
  C:\Windows\System\EmLjoVq.exe
  2⤵
  PID:7284
- C:\Windows\System\OGUyaLE.exe
  C:\Windows\System\OGUyaLE.exe
  2⤵
  PID:7348
- C:\Windows\System\RnPQgkp.exe
  C:\Windows\System\RnPQgkp.exe
  2⤵
  PID:7480
- C:\Windows\System\mTKcDsg.exe
  C:\Windows\System\mTKcDsg.exe
  2⤵
  PID:7364
- C:\Windows\System\CkFHKZf.exe
  C:\Windows\System\CkFHKZf.exe
  2⤵
  PID:7544
- C:\Windows\System\rkRDSBi.exe
  C:\Windows\System\rkRDSBi.exe
  2⤵
  PID:7672
- C:\Windows\System\QZxgvAE.exe
  C:\Windows\System\QZxgvAE.exe
  2⤵
  PID:7636
- C:\Windows\System\NzHQDLo.exe
  C:\Windows\System\NzHQDLo.exe
  2⤵
  PID:7804
- C:\Windows\System\XZLPOjC.exe
  C:\Windows\System\XZLPOjC.exe
  2⤵
  PID:7900
- C:\Windows\System\nwZHnkl.exe
  C:\Windows\System\nwZHnkl.exe
  2⤵
  PID:8116
- C:\Windows\System\FiZwoQa.exe
  C:\Windows\System\FiZwoQa.exe
  2⤵
  PID:7332
- C:\Windows\System\TzDFGEn.exe
  C:\Windows\System\TzDFGEn.exe
  2⤵
  PID:7732
- C:\Windows\System\UdnAAFm.exe
  C:\Windows\System\UdnAAFm.exe
  2⤵
  PID:8084
- C:\Windows\System\gsLNdnZ.exe
  C:\Windows\System\gsLNdnZ.exe
  2⤵
  PID:6452
- C:\Windows\System\AhdDhAO.exe
  C:\Windows\System\AhdDhAO.exe
  2⤵
  PID:7252
- C:\Windows\System\gNPuKgD.exe
  C:\Windows\System\gNPuKgD.exe
  2⤵
  PID:7432
- C:\Windows\System\aGsCNRv.exe
  C:\Windows\System\aGsCNRv.exe
  2⤵
  PID:7760
- C:\Windows\System\odVIzLQ.exe
  C:\Windows\System\odVIzLQ.exe
  2⤵
  PID:7976
- C:\Windows\System\zdlXluX.exe
  C:\Windows\System\zdlXluX.exe
  2⤵
  PID:7776
- C:\Windows\System\vXaZpVn.exe
  C:\Windows\System\vXaZpVn.exe
  2⤵
  PID:7924
- C:\Windows\System\ZAwwKQt.exe
  C:\Windows\System\ZAwwKQt.exe
  2⤵
  PID:7832
- C:\Windows\System\ovbEisJ.exe
  C:\Windows\System\ovbEisJ.exe
  2⤵
  PID:7476
- C:\Windows\System\aHdIttN.exe
  C:\Windows\System\aHdIttN.exe
  2⤵
  PID:7256
- C:\Windows\System\dLLMAGJ.exe
  C:\Windows\System\dLLMAGJ.exe
  2⤵
  PID:7920
- C:\Windows\System\gpPVPTO.exe
  C:\Windows\System\gpPVPTO.exe
  2⤵
  PID:8008
- C:\Windows\System\YZMljGb.exe
  C:\Windows\System\YZMljGb.exe
  2⤵
  PID:8088
- C:\Windows\System\ukYpXdx.exe
  C:\Windows\System\ukYpXdx.exe
  2⤵
  PID:7904
- C:\Windows\System\aKnHjXx.exe
  C:\Windows\System\aKnHjXx.exe
  2⤵
  PID:7656
- C:\Windows\System\KPdYadj.exe
  C:\Windows\System\KPdYadj.exe
  2⤵
  PID:1556
- C:\Windows\System\iBGuzqP.exe
  C:\Windows\System\iBGuzqP.exe
  2⤵
  PID:6448
- C:\Windows\System\eKGEcvB.exe
  C:\Windows\System\eKGEcvB.exe
  2⤵
  PID:8100
- C:\Windows\System\PcYiEfa.exe
  C:\Windows\System\PcYiEfa.exe
  2⤵
  PID:8196
- C:\Windows\System\bqVNPhO.exe
  C:\Windows\System\bqVNPhO.exe
  2⤵
  PID:8212
- C:\Windows\System\HamajGw.exe
  C:\Windows\System\HamajGw.exe
  2⤵
  PID:8228
- C:\Windows\System\MxSMSvp.exe
  C:\Windows\System\MxSMSvp.exe
  2⤵
  PID:8248
- C:\Windows\System\rzEesta.exe
  C:\Windows\System\rzEesta.exe
  2⤵
  PID:8264
- C:\Windows\System\UyjhmBB.exe
  C:\Windows\System\UyjhmBB.exe
  2⤵
  PID:8280
- C:\Windows\System\NskLPVJ.exe
  C:\Windows\System\NskLPVJ.exe
  2⤵
  PID:8296
- C:\Windows\System\khvInnu.exe
  C:\Windows\System\khvInnu.exe
  2⤵
  PID:8312
- C:\Windows\System\KWjuGzf.exe
  C:\Windows\System\KWjuGzf.exe
  2⤵
  PID:8328
- C:\Windows\System\DwZbiVS.exe
  C:\Windows\System\DwZbiVS.exe
  2⤵
  PID:8344
- C:\Windows\System\zeuGvFw.exe
  C:\Windows\System\zeuGvFw.exe
  2⤵
  PID:8360
- C:\Windows\System\WGEgyae.exe
  C:\Windows\System\WGEgyae.exe
  2⤵
  PID:8376
- C:\Windows\System\LAknKAS.exe
  C:\Windows\System\LAknKAS.exe
  2⤵
  PID:8392
- C:\Windows\System\GFSQSJg.exe
  C:\Windows\System\GFSQSJg.exe
  2⤵
  PID:8408
- C:\Windows\System\tmoSDIt.exe
  C:\Windows\System\tmoSDIt.exe
  2⤵
  PID:8424
- C:\Windows\System\nEBGovj.exe
  C:\Windows\System\nEBGovj.exe
  2⤵
  PID:8440
- C:\Windows\System\odzCXgI.exe
  C:\Windows\System\odzCXgI.exe
  2⤵
  PID:8456
- C:\Windows\System\KjyCaZK.exe
  C:\Windows\System\KjyCaZK.exe
  2⤵
  PID:8472
- C:\Windows\System\xLIJZoy.exe
  C:\Windows\System\xLIJZoy.exe
  2⤵
  PID:8488
- C:\Windows\System\cpkkBWW.exe
  C:\Windows\System\cpkkBWW.exe
  2⤵
  PID:8504
- C:\Windows\System\XsqRiIW.exe
  C:\Windows\System\XsqRiIW.exe
  2⤵
  PID:8520
- C:\Windows\System\XCXXeMz.exe
  C:\Windows\System\XCXXeMz.exe
  2⤵
  PID:8536
- C:\Windows\System\LBrCAdA.exe
  C:\Windows\System\LBrCAdA.exe
  2⤵
  PID:8552
- C:\Windows\System\KtboCmB.exe
  C:\Windows\System\KtboCmB.exe
  2⤵
  PID:8568
- C:\Windows\System\zSSlEFR.exe
  C:\Windows\System\zSSlEFR.exe
  2⤵
  PID:8584
- C:\Windows\System\TZkQqiQ.exe
  C:\Windows\System\TZkQqiQ.exe
  2⤵
  PID:8600
- C:\Windows\System\bEWTGQa.exe
  C:\Windows\System\bEWTGQa.exe
  2⤵
  PID:8616
- C:\Windows\System\LkZhRHY.exe
  C:\Windows\System\LkZhRHY.exe
  2⤵
  PID:8632
- C:\Windows\System\RYwaXim.exe
  C:\Windows\System\RYwaXim.exe
  2⤵
  PID:8648
- C:\Windows\System\IWpmQMl.exe
  C:\Windows\System\IWpmQMl.exe
  2⤵
  PID:8664
- C:\Windows\System\LndVxNz.exe
  C:\Windows\System\LndVxNz.exe
  2⤵
  PID:8680
- C:\Windows\System\VxqMHpX.exe
  C:\Windows\System\VxqMHpX.exe
  2⤵
  PID:8696
- C:\Windows\System\TBAiUeK.exe
  C:\Windows\System\TBAiUeK.exe
  2⤵
  PID:8712
- C:\Windows\System\tGtoyKB.exe
  C:\Windows\System\tGtoyKB.exe
  2⤵
  PID:8728
- C:\Windows\System\zNcqVET.exe
  C:\Windows\System\zNcqVET.exe
  2⤵
  PID:8744
- C:\Windows\System\DJQQfNx.exe
  C:\Windows\System\DJQQfNx.exe
  2⤵
  PID:8760
- C:\Windows\System\bioSNOQ.exe
  C:\Windows\System\bioSNOQ.exe
  2⤵
  PID:8776
- C:\Windows\System\PaQdsmw.exe
  C:\Windows\System\PaQdsmw.exe
  2⤵
  PID:8792
- C:\Windows\System\QWyBcFc.exe
  C:\Windows\System\QWyBcFc.exe
  2⤵
  PID:8808
- C:\Windows\System\oJAOIec.exe
  C:\Windows\System\oJAOIec.exe
  2⤵
  PID:8824
- C:\Windows\System\WeVUknh.exe
  C:\Windows\System\WeVUknh.exe
  2⤵
  PID:8848
- C:\Windows\System\CDpSHFL.exe
  C:\Windows\System\CDpSHFL.exe
  2⤵
  PID:8864
- C:\Windows\System\iyFdDEh.exe
  C:\Windows\System\iyFdDEh.exe
  2⤵
  PID:8880
- C:\Windows\System\OKhnPnI.exe
  C:\Windows\System\OKhnPnI.exe
  2⤵
  PID:8896
- C:\Windows\System\HIiYXLO.exe
  C:\Windows\System\HIiYXLO.exe
  2⤵
  PID:8912
- C:\Windows\System\xZteBcQ.exe
  C:\Windows\System\xZteBcQ.exe
  2⤵
  PID:8928
- C:\Windows\System\qLEaNcR.exe
  C:\Windows\System\qLEaNcR.exe
  2⤵
  PID:8944
- C:\Windows\System\FXbiLbO.exe
  C:\Windows\System\FXbiLbO.exe
  2⤵
  PID:8960
- C:\Windows\System\EUynUIV.exe
  C:\Windows\System\EUynUIV.exe
  2⤵
  PID:8976
- C:\Windows\System\jqReohy.exe
  C:\Windows\System\jqReohy.exe
  2⤵
  PID:8996
- C:\Windows\System\YnvWpWq.exe
  C:\Windows\System\YnvWpWq.exe
  2⤵
  PID:9012
- C:\Windows\System\LcQjnPK.exe
  C:\Windows\System\LcQjnPK.exe
  2⤵
  PID:9028
- C:\Windows\System\tvMeZrb.exe
  C:\Windows\System\tvMeZrb.exe
  2⤵
  PID:9044
- C:\Windows\System\UGTRREL.exe
  C:\Windows\System\UGTRREL.exe
  2⤵
  PID:9064
- C:\Windows\System\sTOChhB.exe
  C:\Windows\System\sTOChhB.exe
  2⤵
  PID:9080
- C:\Windows\System\luGnBpD.exe
  C:\Windows\System\luGnBpD.exe
  2⤵
  PID:9096
- C:\Windows\System\CBiJSvC.exe
  C:\Windows\System\CBiJSvC.exe
  2⤵
  PID:9116
- C:\Windows\System\sVlEEiL.exe
  C:\Windows\System\sVlEEiL.exe
  2⤵
  PID:9132
- C:\Windows\System\ydBwaeh.exe
  C:\Windows\System\ydBwaeh.exe
  2⤵
  PID:9148
- C:\Windows\System\MHZbkuI.exe
  C:\Windows\System\MHZbkuI.exe
  2⤵
  PID:9164
- C:\Windows\System\jlfezYi.exe
  C:\Windows\System\jlfezYi.exe
  2⤵
  PID:9180
- C:\Windows\System\evIsnnX.exe
  C:\Windows\System\evIsnnX.exe
  2⤵
  PID:9200
- C:\Windows\System\axYWCyJ.exe
  C:\Windows\System\axYWCyJ.exe
  2⤵
  PID:7992
- C:\Windows\System\VBpXcvu.exe
  C:\Windows\System\VBpXcvu.exe
  2⤵
  PID:8184
- C:\Windows\System\BiHlvxl.exe
  C:\Windows\System\BiHlvxl.exe
  2⤵
  PID:8320
- C:\Windows\System\WVPVURT.exe
  C:\Windows\System\WVPVURT.exe
  2⤵
  PID:8384
- C:\Windows\System\gqxrqtS.exe
  C:\Windows\System\gqxrqtS.exe
  2⤵
  PID:7880
- C:\Windows\System\NOwxJtp.exe
  C:\Windows\System\NOwxJtp.exe
  2⤵
  PID:8480
- C:\Windows\System\vyogXdu.exe
  C:\Windows\System\vyogXdu.exe
  2⤵
  PID:8544
- C:\Windows\System\zlhiyZK.exe
  C:\Windows\System\zlhiyZK.exe
  2⤵
  PID:8580
- C:\Windows\System\bXIMTYP.exe
  C:\Windows\System\bXIMTYP.exe
  2⤵
  PID:8336
- C:\Windows\System\QhkvVPh.exe
  C:\Windows\System\QhkvVPh.exe
  2⤵
  PID:8240
- C:\Windows\System\FsDvrYu.exe
  C:\Windows\System\FsDvrYu.exe
  2⤵
  PID:8272
- C:\Windows\System\ezQLXhD.exe
  C:\Windows\System\ezQLXhD.exe
  2⤵
  PID:8308
- C:\Windows\System\kOeXmkR.exe
  C:\Windows\System\kOeXmkR.exe
  2⤵
  PID:8368
- C:\Windows\System\BeMRnjc.exe
  C:\Windows\System\BeMRnjc.exe
  2⤵
  PID:8560
- C:\Windows\System\AMQJinr.exe
  C:\Windows\System\AMQJinr.exe
  2⤵
  PID:8672
- C:\Windows\System\SdZFvpI.exe
  C:\Windows\System\SdZFvpI.exe
  2⤵
  PID:8708
- C:\Windows\System\WVzXKts.exe
  C:\Windows\System\WVzXKts.exe
  2⤵
  PID:8768
- C:\Windows\System\CsLDJhU.exe
  C:\Windows\System\CsLDJhU.exe
  2⤵
  PID:8772
- C:\Windows\System\FqoCGeL.exe
  C:\Windows\System\FqoCGeL.exe
  2⤵
  PID:7588
- C:\Windows\System\dqkhXQG.exe
  C:\Windows\System\dqkhXQG.exe
  2⤵
  PID:8752
- C:\Windows\System\OOMksAf.exe
  C:\Windows\System\OOMksAf.exe
  2⤵
  PID:8800
- C:\Windows\System\IKUcDfI.exe
  C:\Windows\System\IKUcDfI.exe
  2⤵
  PID:8832
- C:\Windows\System\wQjrmLq.exe
  C:\Windows\System\wQjrmLq.exe
  2⤵
  PID:8876
- C:\Windows\System\XuqSIDx.exe
  C:\Windows\System\XuqSIDx.exe
  2⤵
  PID:8940
- C:\Windows\System\syiSkEZ.exe
  C:\Windows\System\syiSkEZ.exe
  2⤵
  PID:9008
- C:\Windows\System\NlXMLYH.exe
  C:\Windows\System\NlXMLYH.exe
  2⤵
  PID:9108
- C:\Windows\System\rfCnGow.exe
  C:\Windows\System\rfCnGow.exe
  2⤵
  PID:9172
- C:\Windows\System\jeIINmF.exe
  C:\Windows\System\jeIINmF.exe
  2⤵
  PID:7576
- C:\Windows\System\mrfQIIF.exe
  C:\Windows\System\mrfQIIF.exe
  2⤵
  PID:8860
- C:\Windows\System\itJlEOU.exe
  C:\Windows\System\itJlEOU.exe
  2⤵
  PID:8952
- C:\Windows\System\xmBsGGY.exe
  C:\Windows\System\xmBsGGY.exe
  2⤵
  PID:9020
- C:\Windows\System\LmmiJuP.exe
  C:\Windows\System\LmmiJuP.exe
  2⤵
  PID:9060
- C:\Windows\System\eitloVQ.exe
  C:\Windows\System\eitloVQ.exe
  2⤵
  PID:8260
- C:\Windows\System\SPJWWFK.exe
  C:\Windows\System\SPJWWFK.exe
  2⤵
  PID:9192
- C:\Windows\System\iNvMhDu.exe
  C:\Windows\System\iNvMhDu.exe
  2⤵
  PID:9128
- C:\Windows\System\GPsTmqz.exe
  C:\Windows\System\GPsTmqz.exe
  2⤵
  PID:8416
- C:\Windows\System\lydMlxk.exe
  C:\Windows\System\lydMlxk.exe
  2⤵
  PID:8516
- C:\Windows\System\LKDZmIb.exe
  C:\Windows\System\LKDZmIb.exe
  2⤵
  PID:8612
- C:\Windows\System\HqjWtLL.exe
  C:\Windows\System\HqjWtLL.exe
  2⤵
  PID:8372
- C:\Windows\System\zbSgppF.exe
  C:\Windows\System\zbSgppF.exe
  2⤵
  PID:8624
- C:\Windows\System\urhUfbK.exe
  C:\Windows\System\urhUfbK.exe
  2⤵
  PID:8464
- C:\Windows\System\ohoKyvq.exe
  C:\Windows\System\ohoKyvq.exe
  2⤵
  PID:8660
- C:\Windows\System\wcrFxlK.exe
  C:\Windows\System\wcrFxlK.exe
  2⤵
  PID:8844
- C:\Windows\System\hbnvgzm.exe
  C:\Windows\System\hbnvgzm.exe
  2⤵
  PID:8816
- C:\Windows\System\JSNOduA.exe
  C:\Windows\System\JSNOduA.exe
  2⤵
  PID:8704
- C:\Windows\System\FgMneGr.exe
  C:\Windows\System\FgMneGr.exe
  2⤵
  PID:9004
- C:\Windows\System\SiaFumg.exe
  C:\Windows\System\SiaFumg.exe
  2⤵
  PID:9112
- C:\Windows\System\YoiHLQK.exe
  C:\Windows\System\YoiHLQK.exe
  2⤵
  PID:9104
- C:\Windows\System\plIHMCa.exe
  C:\Windows\System\plIHMCa.exe
  2⤵
  PID:8888
- C:\Windows\System\NlhmSdF.exe
  C:\Windows\System\NlhmSdF.exe
  2⤵
  PID:8356
- C:\Windows\System\veHBpiI.exe
  C:\Windows\System\veHBpiI.exe
  2⤵
  PID:8452
- C:\Windows\System\AnbTMsX.exe
  C:\Windows\System\AnbTMsX.exe
  2⤵
  PID:8224
- C:\Windows\System\BXOWRQu.exe
  C:\Windows\System\BXOWRQu.exe
  2⤵
  PID:8236
- C:\Windows\System\VptjJdm.exe
  C:\Windows\System\VptjJdm.exe
  2⤵
  PID:8436
- C:\Windows\System\SUDtCQf.exe
  C:\Windows\System\SUDtCQf.exe
  2⤵
  PID:8908
- C:\Windows\System\xHqFRNB.exe
  C:\Windows\System\xHqFRNB.exe
  2⤵
  PID:8788
- C:\Windows\System\KqEljjS.exe
  C:\Windows\System\KqEljjS.exe
  2⤵
  PID:8656
- C:\Windows\System\bKkBvQg.exe
  C:\Windows\System\bKkBvQg.exe
  2⤵
  PID:9092
- C:\Windows\System\JRjTIyI.exe
  C:\Windows\System\JRjTIyI.exe
  2⤵
  PID:8448
- C:\Windows\System\ASrAfzk.exe
  C:\Windows\System\ASrAfzk.exe
  2⤵
  PID:9040
- C:\Windows\System\PveoKlO.exe
  C:\Windows\System\PveoKlO.exe
  2⤵
  PID:8352
- C:\Windows\System\VRskdgg.exe
  C:\Windows\System\VRskdgg.exe
  2⤵
  PID:9224
- C:\Windows\System\RNIsBDB.exe
  C:\Windows\System\RNIsBDB.exe
  2⤵
  PID:9240
- C:\Windows\System\LrDZTWn.exe
  C:\Windows\System\LrDZTWn.exe
  2⤵
  PID:9256
- C:\Windows\System\QcaCgDo.exe
  C:\Windows\System\QcaCgDo.exe
  2⤵
  PID:9272
- C:\Windows\System\zCQMyOT.exe
  C:\Windows\System\zCQMyOT.exe
  2⤵
  PID:9288
- C:\Windows\System\xsMJmou.exe
  C:\Windows\System\xsMJmou.exe
  2⤵
  PID:9304
- C:\Windows\System\QwqfrMe.exe
  C:\Windows\System\QwqfrMe.exe
  2⤵
  PID:9324
- C:\Windows\System\tPEHPny.exe
  C:\Windows\System\tPEHPny.exe
  2⤵
  PID:9340
- C:\Windows\System\zvNWUst.exe
  C:\Windows\System\zvNWUst.exe
  2⤵
  PID:9356
- C:\Windows\System\fWZhsUA.exe
  C:\Windows\System\fWZhsUA.exe
  2⤵
  PID:9372
- C:\Windows\System\nsuzZPj.exe
  C:\Windows\System\nsuzZPj.exe
  2⤵
  PID:9388
- C:\Windows\System\SKCNvgh.exe
  C:\Windows\System\SKCNvgh.exe
  2⤵
  PID:9404
- C:\Windows\System\gGWIkyq.exe
  C:\Windows\System\gGWIkyq.exe
  2⤵
  PID:9424
- C:\Windows\System\uFVbPKF.exe
  C:\Windows\System\uFVbPKF.exe
  2⤵
  PID:9440
- C:\Windows\System\gclyypN.exe
  C:\Windows\System\gclyypN.exe
  2⤵
  PID:9456
- C:\Windows\System\JoqaTaN.exe
  C:\Windows\System\JoqaTaN.exe
  2⤵
  PID:9472
- C:\Windows\System\NixHcJM.exe
  C:\Windows\System\NixHcJM.exe
  2⤵
  PID:9488
- C:\Windows\System\aJIZolK.exe
  C:\Windows\System\aJIZolK.exe
  2⤵
  PID:9504
- C:\Windows\System\bfjrgBt.exe
  C:\Windows\System\bfjrgBt.exe
  2⤵
  PID:9520
- C:\Windows\System\YrMoCDT.exe
  C:\Windows\System\YrMoCDT.exe
  2⤵
  PID:9536
- C:\Windows\System\oZpnzzY.exe
  C:\Windows\System\oZpnzzY.exe
  2⤵
  PID:9552
- C:\Windows\System\MVwatmS.exe
  C:\Windows\System\MVwatmS.exe
  2⤵
  PID:9568
- C:\Windows\System\cVaWjDl.exe
  C:\Windows\System\cVaWjDl.exe
  2⤵
  PID:9584
- C:\Windows\System\KKFUQce.exe
  C:\Windows\System\KKFUQce.exe
  2⤵
  PID:9600
- C:\Windows\System\EPzwtqm.exe
  C:\Windows\System\EPzwtqm.exe
  2⤵
  PID:9616
- C:\Windows\System\BKJzcKl.exe
  C:\Windows\System\BKJzcKl.exe
  2⤵
  PID:9632
- C:\Windows\System\NknQNfn.exe
  C:\Windows\System\NknQNfn.exe
  2⤵
  PID:9648
- C:\Windows\System\fWTnlVO.exe
  C:\Windows\System\fWTnlVO.exe
  2⤵
  PID:9664
- C:\Windows\System\LNjeJEj.exe
  C:\Windows\System\LNjeJEj.exe
  2⤵
  PID:9704
- C:\Windows\System\MrkVsfk.exe
  C:\Windows\System\MrkVsfk.exe
  2⤵
  PID:9720
- C:\Windows\System\yYEOJJM.exe
  C:\Windows\System\yYEOJJM.exe
  2⤵
  PID:9736
- C:\Windows\System\YsFkzrH.exe
  C:\Windows\System\YsFkzrH.exe
  2⤵
  PID:9752
- C:\Windows\System\kUnduXg.exe
  C:\Windows\System\kUnduXg.exe
  2⤵
  PID:9768
- C:\Windows\System\MxaBLKZ.exe
  C:\Windows\System\MxaBLKZ.exe
  2⤵
  PID:9784
- C:\Windows\System\nVqXlCa.exe
  C:\Windows\System\nVqXlCa.exe
  2⤵
  PID:9800
- C:\Windows\System\zdcJijh.exe
  C:\Windows\System\zdcJijh.exe
  2⤵
  PID:9816
- C:\Windows\System\emQaqAo.exe
  C:\Windows\System\emQaqAo.exe
  2⤵
  PID:9832
- C:\Windows\System\SEYOipX.exe
  C:\Windows\System\SEYOipX.exe
  2⤵
  PID:9848
- C:\Windows\System\aBLFHlI.exe
  C:\Windows\System\aBLFHlI.exe
  2⤵
  PID:9864
- C:\Windows\System\CkSkukI.exe
  C:\Windows\System\CkSkukI.exe
  2⤵
  PID:9880
- C:\Windows\System\klSWBsJ.exe
  C:\Windows\System\klSWBsJ.exe
  2⤵
  PID:9896
- C:\Windows\System\XjLLbDR.exe
  C:\Windows\System\XjLLbDR.exe
  2⤵
  PID:9912
- C:\Windows\System\cEmPChK.exe
  C:\Windows\System\cEmPChK.exe
  2⤵
  PID:9928
- C:\Windows\System\irfPBKs.exe
  C:\Windows\System\irfPBKs.exe
  2⤵
  PID:9944
- C:\Windows\System\DrYoiTW.exe
  C:\Windows\System\DrYoiTW.exe
  2⤵
  PID:9960
- C:\Windows\System\IRjNyQU.exe
  C:\Windows\System\IRjNyQU.exe
  2⤵
  PID:9976
- C:\Windows\System\Lcefwlw.exe
  C:\Windows\System\Lcefwlw.exe
  2⤵
  PID:9992
- C:\Windows\System\UGyAZsR.exe
  C:\Windows\System\UGyAZsR.exe
  2⤵
  PID:10008
- C:\Windows\System\mZxGUfq.exe
  C:\Windows\System\mZxGUfq.exe
  2⤵
  PID:10024
- C:\Windows\System\KJKMngp.exe
  C:\Windows\System\KJKMngp.exe
  2⤵
  PID:10040
- C:\Windows\System\sCphXtt.exe
  C:\Windows\System\sCphXtt.exe
  2⤵
  PID:10056
- C:\Windows\System\qqOkPlz.exe
  C:\Windows\System\qqOkPlz.exe
  2⤵
  PID:10080
- C:\Windows\System\BoUdbTm.exe
  C:\Windows\System\BoUdbTm.exe
  2⤵
  PID:10096
- C:\Windows\System\LzqXSQk.exe
  C:\Windows\System\LzqXSQk.exe
  2⤵
  PID:10112
- C:\Windows\System\EFWfSJI.exe
  C:\Windows\System\EFWfSJI.exe
  2⤵
  PID:10128
- C:\Windows\System\hkCrupY.exe
  C:\Windows\System\hkCrupY.exe
  2⤵
  PID:10148
- C:\Windows\System\NWdnbAP.exe
  C:\Windows\System\NWdnbAP.exe
  2⤵
  PID:10164
- C:\Windows\System\DSLGpMp.exe
  C:\Windows\System\DSLGpMp.exe
  2⤵
  PID:10180
- C:\Windows\System\zzqCoPH.exe
  C:\Windows\System\zzqCoPH.exe
  2⤵
  PID:10196
- C:\Windows\System\KEAcJiM.exe
  C:\Windows\System\KEAcJiM.exe
  2⤵
  PID:10212
- C:\Windows\System\xTTMGmz.exe
  C:\Windows\System\xTTMGmz.exe
  2⤵
  PID:10228
- C:\Windows\System\BRmUqHm.exe
  C:\Windows\System\BRmUqHm.exe
  2⤵
  PID:8984
- C:\Windows\System\vASHwke.exe
  C:\Windows\System\vASHwke.exe
  2⤵
  PID:8512
- C:\Windows\System\LmUzcwl.exe
  C:\Windows\System\LmUzcwl.exe
  2⤵
  PID:8468
- C:\Windows\System\neyulDJ.exe
  C:\Windows\System\neyulDJ.exe
  2⤵
  PID:9220
- C:\Windows\System\qLasQSL.exe
  C:\Windows\System\qLasQSL.exe
  2⤵
  PID:9264
- C:\Windows\System\eegFbSA.exe
  C:\Windows\System\eegFbSA.exe
  2⤵
  PID:9332
- C:\Windows\System\PuGGedr.exe
  C:\Windows\System\PuGGedr.exe
  2⤵
  PID:9396
- C:\Windows\System\FMIcdhe.exe
  C:\Windows\System\FMIcdhe.exe
  2⤵
  PID:9436
- C:\Windows\System\OJwlNJe.exe
  C:\Windows\System\OJwlNJe.exe
  2⤵
  PID:9500
- C:\Windows\System\zdioTjo.exe
  C:\Windows\System\zdioTjo.exe
  2⤵
  PID:9312
- C:\Windows\System\ilokSwq.exe
  C:\Windows\System\ilokSwq.exe
  2⤵
  PID:9352
- C:\Windows\System\jypLuwx.exe
  C:\Windows\System\jypLuwx.exe
  2⤵
  PID:9412
- C:\Windows\System\jEzoiSd.exe
  C:\Windows\System\jEzoiSd.exe
  2⤵
  PID:9448
- C:\Windows\System\tamkYtB.exe
  C:\Windows\System\tamkYtB.exe
  2⤵
  PID:9596
- C:\Windows\System\DjcqLdY.exe
  C:\Windows\System\DjcqLdY.exe
  2⤵
  PID:9576
- C:\Windows\System\XQhbgLa.exe
  C:\Windows\System\XQhbgLa.exe
  2⤵
  PID:9624
- C:\Windows\System\FKXAUeG.exe
  C:\Windows\System\FKXAUeG.exe
  2⤵
  PID:9660
- C:\Windows\System\KFKmyHf.exe
  C:\Windows\System\KFKmyHf.exe
  2⤵
  PID:9672
- C:\Windows\System\WELzKTI.exe
  C:\Windows\System\WELzKTI.exe
  2⤵
  PID:9688
- C:\Windows\System\KJmhMwn.exe
  C:\Windows\System\KJmhMwn.exe
  2⤵
  PID:9716
- C:\Windows\System\SnUDwvg.exe
  C:\Windows\System\SnUDwvg.exe
  2⤵
  PID:9780
- C:\Windows\System\DhgcFKO.exe
  C:\Windows\System\DhgcFKO.exe
  2⤵
  PID:9844
- C:\Windows\System\UgEJtfb.exe
  C:\Windows\System\UgEJtfb.exe
  2⤵
  PID:9908
- C:\Windows\System\uDQleAT.exe
  C:\Windows\System\uDQleAT.exe
  2⤵
  PID:9972
- C:\Windows\System\FsbCwba.exe
  C:\Windows\System\FsbCwba.exe
  2⤵
  PID:9760
- C:\Windows\System\GuBIrMr.exe
  C:\Windows\System\GuBIrMr.exe
  2⤵
  PID:9796
- C:\Windows\System\ZETrObQ.exe
  C:\Windows\System\ZETrObQ.exe
  2⤵
  PID:9860
- C:\Windows\System\vcEkihc.exe
  C:\Windows\System\vcEkihc.exe
  2⤵
  PID:9924
- C:\Windows\System\ahbpwcT.exe
  C:\Windows\System\ahbpwcT.exe
  2⤵
  PID:10004
- C:\Windows\System\wibbOHO.exe
  C:\Windows\System\wibbOHO.exe
  2⤵
  PID:10036
- C:\Windows\System\LWHocGY.exe
  C:\Windows\System\LWHocGY.exe
  2⤵
  PID:10048
- C:\Windows\System\drwzxsx.exe
  C:\Windows\System\drwzxsx.exe
  2⤵
  PID:10136
- C:\Windows\System\PmZCtgI.exe
  C:\Windows\System\PmZCtgI.exe
  2⤵
  PID:10172
- C:\Windows\System\ZGBVuUO.exe
  C:\Windows\System\ZGBVuUO.exe
  2⤵
  PID:10120
- C:\Windows\System\nNjqUdH.exe
  C:\Windows\System\nNjqUdH.exe
  2⤵
  PID:10204
- C:\Windows\System\vvUksYN.exe
  C:\Windows\System\vvUksYN.exe
  2⤵
  PID:8340
- C:\Windows\System\WlkElMg.exe
  C:\Windows\System\WlkElMg.exe
  2⤵
  PID:9364
- C:\Windows\System\sowTYGi.exe
  C:\Windows\System\sowTYGi.exe
  2⤵
  PID:9320
- C:\Windows\System\pHphASj.exe
  C:\Windows\System\pHphASj.exe
  2⤵
  PID:9248
- C:\Windows\System\VvxtIFI.exe
  C:\Windows\System\VvxtIFI.exe
  2⤵
  PID:10224
- C:\Windows\System\oOvAOMs.exe
  C:\Windows\System\oOvAOMs.exe
  2⤵
  PID:9296
- C:\Windows\System\mkzIXrn.exe
  C:\Windows\System\mkzIXrn.exe
  2⤵
  PID:9432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AdRwZjt.exe

Filesize
2.0MB

MD5
f10a51ba13a14b1ec9d834abca392f78

SHA1
6bf5a3cb7807a9db34044f46393bba1b958fe0f4

SHA256
0cee606b563c771cf5b9734102af33e9a9aefb5228bf5215a6055bafbc3ca6f3

SHA512
eac1019ecdade15a2567b09ecc928a5908062a16f133503fa824e01e004db2d8c41d4617492730c8f8cd510bf4e20d080b025cac1e8e4ecaf36c993def3a7a16

Download Submit
C:\Windows\system\DmcEgjs.exe

Filesize
2.0MB

MD5
24c0cd97e46b72a9236479851259d5d3

SHA1
2f73704b0ada8a8c0d4292434c429070652fd498

SHA256
d3fb69ecef9d1d8e360a7b5a3ebe851c2178c911e45e19eeaefd017dd83643b6

SHA512
087580180a98c377bee06af6b498385d63a3590967c71b631bff296084b2e7ae1c0d5c45217947613b28f2e27fa4fa4f6a9f8616607b8529cdfad654d96c9057

Download Submit
C:\Windows\system\EakWSUM.exe

Filesize
2.0MB

MD5
919ad60a29110c86cd6a51bc1b70da98

SHA1
1ed248a25cffb2f992f150513fc6ee116916fd94

SHA256
66ce1b42387dc7aa35c9d86ac1a805c337989a5b75b9fa1f3a54f6b0c091752a

SHA512
d9d12b1968da635dc9adc2a479c67a24bfdb3275edc19e405d05dfbe85d0ab55fc346c51e716b300d8bbff37278051f51ea1b3082a1cd3ec2588d8efabd46485

Download Submit
C:\Windows\system\FqVNdCM.exe

Filesize
2.0MB

MD5
4c7a575b05510d1b618d56717f063563

SHA1
74290e7db0cffb38b060900acbdf5817b41100a6

SHA256
3f3915b75fefe56beadf22952f868b39f106502a6beacfc80b319b4293ce3fc2

SHA512
9e68d3b28f1210ec87fd455e20144208b144e412b625869ebd23fd85641cae8c79f56270fdb8bf773e83ac981f8b3df5534fb02e19477a2a934becd22acbd4cc

Download Submit
C:\Windows\system\IMndinZ.exe

Filesize
2.0MB

MD5
505c812bf45d186ed482714b850126a1

SHA1
54bf05a5015091230c403c8b0de8309564e3f4ac

SHA256
8e18a284026003da5dac2034f99576a91c6dc209bdc0cd0018dcd5c39ba27d5e

SHA512
013934c8681ff48d53da13f1a4a90619e215edaf8db7c6b7e873dfd10cd760fdb63ed38d361c63632a2b6a52143932fc0141b442825b83cbd2c2e0a3a3d77472

Download Submit
C:\Windows\system\IoVkrsp.exe

Filesize
2.0MB

MD5
9a72fba28c4b0615a3fba89646dd59a3

SHA1
3ca9b894853498e463b006eff8304555cea336b4

SHA256
5cc237cbeafc497608cad7722d03ba258afa2332508f6d9ecb66a040430c2545

SHA512
170f94ac082f1bb5f4b2bc104a27aa47acb5901469c2cc3abf2c707411906378f17ebc10a52fabb133f331fa5f32bffdcf058bcac7e17ba142c7c9b546051f2b

Download Submit
C:\Windows\system\NThItTV.exe

Filesize
2.0MB

MD5
228746f9e6d3b381ed8070cfbd3cb5cf

SHA1
ccc5988d8c9981539b96797d8b808dd42a2fc0e9

SHA256
95406e2b7d235627ab82c5271b112abc4995e27d938aa4eda6915e37fc62b650

SHA512
bb011724ad5b2de03d799cc51ba2d9953b05291d74dcbd07284725a7eafe1b53f2855a510962740c928295e23070259d5de3f6ab107cd781b06e05be0651ac89

Download Submit
C:\Windows\system\RMsITtH.exe

Filesize
2.0MB

MD5
f891c3608942f213b12c6d0789fc5b1b

SHA1
d59f70023fd3e870585e049c38e93983303820a7

SHA256
11ea23a8633edc77b1f4c44a202df6e2ef9f6f9d52cafb282a7b358def0ef172

SHA512
c73fc5d3da8f0df715e08b74f09e6bab0e9bf9dedbb77936e31fb97b6f73c26b77c2169b2b72b0ad5466f39fd89d7d62788565e160821be44253e8dc8517026a

Download Submit
C:\Windows\system\SbWhcab.exe

Filesize
2.0MB

MD5
1529e771a4da642b6119a451fd859092

SHA1
c20d7f3a167cc9a3c19f3a8e5e7cc623eaf5b709

SHA256
dd639a6edf6699c9cc4d6e59d6b1ec3a96e05da9d700677ea995a5b0c3b584a7

SHA512
27fbaea0a1ee731157722444b451bc1473802466fc0184c7cb957837942fa7f470b7aa515c71e5347699680ca44396c4860ad890e9305ef80001306f9e74bf03

Download Submit
C:\Windows\system\VJTIhhD.exe

Filesize
2.0MB

MD5
76eea32deca99a365fc2d707fa71d6c9

SHA1
aa6a616d3475615941f165d295116d0c78d51ffd

SHA256
98d0faac02e7a53512c6c8c88110d10b882589ee8a93f7526b6bc4fddd3f7d10

SHA512
c2a0f48862c4850a58aaf3e06630876ae606926e65374e8df857141c031daefe8d703a0a112b9e8f683d262296a59cc84cb1296a540b904a1233f07ec0af871d

Download Submit
C:\Windows\system\ZAPtbcJ.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\system\ZHlaWSO.exe

Filesize
2.0MB

MD5
e383435d32156abaaad188e1d018cf42

SHA1
4fdb54a785d11cfde1c60388ce64c11e5c86278b

SHA256
9e4457a15e8b36331ac4f288a284e8be89e26ced4342146df5d64c1fbb15e0ef

SHA512
73cb28263b3dbb802b592ac09fc8644f1905cf6a236fa203a2ef9aed1da4496bc5c01459f90616d0aaf6cb59a6a4acfec68307f24e5f063f029785c41dc0631c

Download Submit
C:\Windows\system\alpTirC.exe

Filesize
2.0MB

MD5
9bcbedfb9aea41e2a038125ac5bfcc21

SHA1
b6ea00aa07e88651db1051b1acfbe2ea82146297

SHA256
e073b68d898eca7070ca4f04b11229eb839c5988a772253d0db6d781fdb8efb2

SHA512
f04775b66c053d27ab671406a98580cb13508385a6cdc52d5515d0bda7fc3eb0949f26d9ab1c1899c2ae7bcb5458f8e1677136bfe753b98abd1ec99c5ee73810

Download Submit
C:\Windows\system\ehCcLmD.exe

Filesize
2.0MB

MD5
198634ccb2a25cb433a19a5624a5c59a

SHA1
59e0eada516aacfcd77f89fb984c110e11c962f0

SHA256
8675718ed1d5cfd8db9ecec7a2ff7b65cb05c7cf4b0b6826e1f62093bc8edd77

SHA512
4d2d29a01dea56889068981dd1e64296fe2edd003d0d25a19c81cc78119bf2a126716c4b52092c8e10550b0a5ed498e7cc508b322de918da8b258afdb5b45a65

Download Submit
C:\Windows\system\jwLNggU.exe

Filesize
2.0MB

MD5
83adbf8887919d868ba65b64e02d4f9d

SHA1
d9c28e86eec7fe6b491771ed08c3b299ecc5da0a

SHA256
3daf7ca9d453e0aaa4de269f80fa0c6c7823076b92aa2d16bc294bb1af512a50

SHA512
fcc458a844db57a2e90fb5fa7ec05e8cf9fb8ddccc5279d9ecb0d9376952b51da01896d484840a45d987aea57c190e50f25104e1a7be5c6c394cd3203261519f

Download Submit
C:\Windows\system\kZMHKgC.exe

Filesize
2.0MB

MD5
e7c94b2a7b40ac2c259739f07373e5e6

SHA1
b6006a3d9d83caba54f34f5a490f66720616858b

SHA256
59d05a31576408bc4fa9820b30bfb137f46f125e68c02bea60cace4419791b57

SHA512
755faf11eb8777eda295a34fbb34bf0f48bbf6a7de13ae32d68bb7ee520186e5f1c5f04249ff35c294f5ebe1db6188b2b837f008f78d15b98e49230985483f67

Download Submit
C:\Windows\system\kvUfizB.exe

Filesize
2.0MB

MD5
6122bbc7e4e627607efe42e161ef46ba

SHA1
0e55a7fa0b284f95406a3039e44766fee59ba8b4

SHA256
173736e6c175fdd9bd66285dab2e2ed0ee2492cce830514d2f66d9b4b2cd6945

SHA512
15345e35172c5bbe09ba398226c95f73a04be8cdbe057b72f81f52555874228775fdba2cf71b6080f2217cc1177b4a16ce1885eda1fa86a5b75d2b58dbf28eaf

Download Submit
C:\Windows\system\nkyWkHg.exe

Filesize
2.0MB

MD5
436ea95db30c0b46e6cf344f275041e9

SHA1
301b927fc18115848392bbf9bc19e89d98f4601e

SHA256
52e2b28f00a6ffc2bcb14a659ed7e72fa43bfc9b66162b5cb07e11600f80fd9e

SHA512
620f0835034f079f1d1074ac60af99e9f871a3a3f4f51bf54aeac29111b50e55233506b4de4bd9eabbcedc672b9c9ab4735ba4387552881b9e367e599a138ce0

Download Submit
C:\Windows\system\pAtDios.exe

Filesize
2.0MB

MD5
637ceb1c9b632167ac6bcc46affd2765

SHA1
2b5f3a50ead60bc288a583f10e24851d851def86

SHA256
bf40afbf0385bb8debaf80b18d866a43bf728226de1be6f2aeab7e493d01ce9c

SHA512
ea19e1bcccf6ac7e47b405b727880004064ebfc46cf4757eceb5e1cc76c0b9f43fa1c85b5c3a97535df6114da661a709f0d89600f949761876f42c0d8fa04d73

Download Submit
C:\Windows\system\rMTMvEX.exe

Filesize
2.0MB

MD5
609dc4a92c6dbde2ca54fa955e0a3415

SHA1
214b7ae69aaccb73df6241d0aaac88f4b95973cd

SHA256
05ba084368f4bb97041b599f5b71fc1ab5c0fca00b56c3636982285383017359

SHA512
02069cffddf366d3ad69425759c3657d3cc7708d6f985102cec763c85ed75d41fb12b2eb3973e68862db625fbca1236c32f9c8e811cbdf442716b6bbdc8625d6

Download Submit
C:\Windows\system\skyXUaZ.exe

Filesize
2.0MB

MD5
e4c48b010be267128fe64ec20286d544

SHA1
e97ae0b21bde1eade9a47bb476bde164f9718a4b

SHA256
a52a6c480088b5fbf367f10d92026918781b9ef845297c0ae24c7d22984a2bf9

SHA512
a01635b4c66a0c39f7a43f7394cc8821afb6a3e75d93bcf34864cd60e68a32ba58311fa5e57a831014a7d64bf0219bd7660515741b81f328be8baeb36674b795

Download Submit
C:\Windows\system\vCiSBsI.exe

Filesize
2.0MB

MD5
122f27b1804c232be24bd430f2ccf3d6

SHA1
bdf4efc06c29c0ad452a524b302fc9520e815789

SHA256
839b5bff4638e6ea317048ec337c95a0208b9e41fc824f12652f3a7f562a47ac

SHA512
b3d45dc1e3d82b21714e391ae3d707661e700b523f6ba236bf3f0f1014a16a3f4e34b0cfc8b1b649b32d59db645e9290da671ec5de10b1bcfefed30d9ce48b4f

Download Submit
C:\Windows\system\vhqDbck.exe

Filesize
2.0MB

MD5
39d3145677544df427fe8e392778a362

SHA1
4a7b850ec0a1ffec5243fdebce8053a1041d1493

SHA256
92f1887a5b360bd66cf892fb41e315147ac4e5f5ce01e650638d991bebcd9b84

SHA512
c90492208f27b06708107c69998d05b34c7cdc94a1cc92f5644e161a6b7e35e5c0bf446160620227822ec5726fbc3356c36bcc10f91f820e08b2c277142222e0

Download Submit
C:\Windows\system\zFtUcnH.exe

Filesize
2.0MB

MD5
3b278eaf4aabbde46c140c258cdd8fb9

SHA1
aa7cce08af1cc7b40c4a10ac9f07dde161eda358

SHA256
c3b4bd867f969e603b6706375c4ee62e297c778e47bd8fc2fbd3e18ee28e7eda

SHA512
689a16402dd29aa1f4d34b0033f1d285bc8a308a40a27a583939749df12423473befd2bc2baacc5756d8ddd98d1be9f23e455533e1dcb9b06fc06005789ad747

Download Submit
\Windows\system\BUUpBHe.exe

Filesize
2.0MB

MD5
4d9a630e4241fda3d01538c4dd118939

SHA1
3aee8eb067e0668eaefd16e2a39e184cb5501e4e

SHA256
73e7485c0863c4190dffb88035b5c0e9f064852570404033442fa9620eba424a

SHA512
5f209b7ed902ba7d5bed0ed3e86e8bf1e3fd4d8184b7b3c85665431d53c6a62b653adb379ec75299ebdd7eda32c88c49d3741c589928a2d4e21724fb638a9ea7

Download Submit
\Windows\system\CegxYwU.exe

Filesize
2.0MB

MD5
c7b6567c170d0f383be8a4344835c4f6

SHA1
a57f3d6a2257ced4555c3c11da56c13036a265f9

SHA256
3c0552e9449f4cdbb41327c4427115ccaa0f96e0c8fd2981b5f21f8bdf109a6a

SHA512
611295a0e80f784955983b01d092a6ffea34f51b7a02316c2806069990ddcd9ab04471e264ddc14b644930fc7183652fef904895299e134cf0815d60a1b17065

Download Submit
\Windows\system\FOYNZJX.exe

Filesize
2.0MB

MD5
85cac5726b503e6ba35ad704462a547f

SHA1
339dfe8c143619b39220a89882a1f0dc51cdf462

SHA256
160a2b02d262fcdb7844fca6842be2cf2f4c956ef3b02b9b969c0834068ca6b0

SHA512
e26e0724e57c32941a5aef42e150a29ef6283080f7f5e3fbcd4c46a45207880c9fef292ad903f08fbaedf6b801c19cdc134a1fa79bf70fed83760cc959e3484e

Download Submit
\Windows\system\WYObHHX.exe

Filesize
2.0MB

MD5
943ca1b75cb648876005028c584aba39

SHA1
b3bc5bc3424b410932a9ae6fe9e7c9a943acc4f6

SHA256
d97cd80678caa883ac70d9c66381beae05b27ca5744617ec855afa6a31f19891

SHA512
d27b2bd516934033ade437230b7d7d3948cdd1bed4f03a02bc685c337b9e9d7ff71eac40d0a26955f19d4e6ee69cf23ceab972e869727eae6449a3089659697b

Download Submit
\Windows\system\hKurBol.exe

Filesize
2.0MB

MD5
8705c2d91883581f1ecee51e7b7b510c

SHA1
bbaa053544de53b63d385f993f63ae66284fc8bd

SHA256
a1a07b3e08d5d4692ac5ec4accc8aad9ef6e9f5f1080512335b5be1157f5c230

SHA512
1610bb3697f6d3183b8ed117b85acdbf4655b443fc9a2838ae8a5f50c10447817dbccc838cd09b991550105ecdccd7178af6178d50203a33da07b26b4ebd8fdb

Download Submit
\Windows\system\ihBxLpQ.exe

Filesize
2.0MB

MD5
3dedd32ba4fd8aa8317c9f792e3d37a4

SHA1
66412679aabcf73d756f3ffb8032874393fa1d70

SHA256
807f725e7ce1f688b6d9f01ea885c934b16582dd0c0db53e118f0d520aacc635

SHA512
1427f438bc96996ec35c6d7d5d1c939514472a76637243b1b7974c46d1972babc851005dab261bf54a3c9df4a8267cb9978565885407b096ce11369d6c277e6b

Download Submit
\Windows\system\onTLziD.exe

Filesize
2.0MB

MD5
8de5e26836910c46ec546f003fcf03cc

SHA1
8f4cace8eca7b7e1c4ef8b041a39f85e814b52d6

SHA256
55146a2c6f3739cf422c8b87438fb83049a6e02eed6f06e1d6ab1bcf68a3f78a

SHA512
76407bfef5a1646142cebabcfd9a4ad9becccce77f2a4bb682451ec1970620043c6779db254cc95cb8bf6b554a65847ada4635832f1753e8fbab9c7b1fbe8a65

Download Submit
\Windows\system\wZZjFXg.exe

Filesize
2.0MB

MD5
1ddde895fd43c3b2d098570b2d311679

SHA1
9fe4476d42985e78b66933b0adb8a8c9f25adb56

SHA256
82f0c9a8a982f1c24abdba3afc634247fd03f0ccdb60a4b0592eb311da6951e1

SHA512
51cdd2a20bf25ad7e7809e6ecdc89683e8407cafe7245647c91be1d93e974d7f4d552dd71f8569a2df9d1fa5ab4af1ee1e4209df2d910485009453b780df6abc

Download Submit
\Windows\system\xdBXeDY.exe

Filesize
2.0MB

MD5
dc7d3e89f2332b99f94bb3a607995603

SHA1
b710dc665a1e1d7cf767f50f4f12460614f23b60

SHA256
9bebd8cca30ae3f1f6cb0a093d9caf2aa148ee9b2e330bc921fb4638d5c94820

SHA512
fcc3e90d882b590f3a024c940081d1de8b334086003e3937fbdf5f0bcc95c038b083db60dfa4397674b2613b52026f26b1f018c9d510d46da24dc7349da8af20

Download Submit
memory/1044-4441-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1044-13-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-92-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2032-4678-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2260-22-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2260-4434-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2536-42-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2536-33-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/2536-181-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/2536-43-0x0000000002380000-0x0000000002388000-memory.dmp

Filesize
32KB

Download
memory/2584-80-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2584-4431-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2632-4460-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2632-85-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2668-31-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2668-4893-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-78-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2668-77-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-75-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-8-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2668-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-93-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2668-70-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-952-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-10086-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-51-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2668-91-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-48-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-39-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-21-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2668-79-0x0000000003740000-0x0000000003B32000-memory.dmp

Filesize
3.9MB

Download
memory/2724-4446-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2724-74-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2728-32-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2728-90-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2728-4448-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2748-72-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4449-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-4627-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-84-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-41-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-4438-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-442-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-49-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-15-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/3060-4494-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download