xmrig | d73704388efda7810fa75528ac23b8750386c1dc8fd6c10e2017fd27dc200a53

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
Size

2.1MB
MD5

dc0e149a1c03c43b955a3416dbfb2042
SHA1

ca7c66e26a82532d1d1dab8f7311e0cc94d9c3b1
SHA256

d73704388efda7810fa75528ac23b8750386c1dc8fd6c10e2017fd27dc200a53
SHA512

6956a06b93550ba8ba8003fa5daf619b50d8b834386a2af371d4496b18caeafb6aa940d759ce285243927e38c636e345e940c357555664359295922620d44273
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMc:NABU

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2552-22-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/1712-23-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2244-29-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/1280-25-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2780-59-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2584-88-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/3064-87-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2896-82-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2848-722-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2896-1446-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/1416-1457-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/1280-5076-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/1712-5077-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2780-5082-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2724-5083-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2792-5085-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2244-5088-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/1416-5094-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2896-5099-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2552-5091-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/3064-5090-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2848-5130-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1776	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1280	IcANLvW.exe
2552	PMtdacu.exe
1712	wJAaddw.exe
2244	NhnHUtX.exe
2724	zTycPym.exe
2848	QleELoB.exe
2780	dOwCbgs.exe
2792	TKlERDP.exe
2896	tMzZWsk.exe
1416	WwhBTta.exe
3064	mgFlQLK.exe
3040	savMXtO.exe
2940	ZTOftMg.exe
768	mAUXvad.exe
1756	cOPvuRD.exe
2260	IlcoLCR.exe
2548	rAIiyQu.exe
2664	GomiWMm.exe
1208	AdqxkAK.exe
844	SogpnWD.exe
1604	DerRPsR.exe
1820	ESNMMvv.exe
3056	CVgwDNA.exe
2944	gQEWCLZ.exe
1132	VDatyeG.exe
1716	nSrOygD.exe
1732	lXZrkpG.exe
2500	UVaHtvL.exe
2272	KDRWVBC.exe
2168	EWgDhOf.exe
2028	TbXQaHc.exe
1744	FbsDACG.exe
1068	OwqSPZH.exe
1788	jmyXyQu.exe
1936	MZWfhba.exe
2248	TgzmgrF.exe
1196	llrxCeT.exe
2908	iyeOrAs.exe
2508	mxDdcWf.exe
1028	uYRSqVm.exe
2064	NpuDGWZ.exe
1596	uAAtkVl.exe
1736	IwrSiOb.exe
2252	ZbslsbB.exe
1728	vXgOOLg.exe
1592	vYPQenx.exe
2104	Ugcnmno.exe
1336	FwVUKII.exe
2900	ffFxIoD.exe
2820	UwMaCWF.exe
2844	dsnIovS.exe
2608	WVNFKnN.exe
1324	GZcjyRN.exe
1332	sbpkSvL.exe
2456	QUbMGqQ.exe
3052	ZHMtOkm.exe
2384	NVXWfHb.exe
848	pzlFWyW.exe
1792	qtzdFor.exe
1260	XzIrbFh.exe
2956	NKTgIAL.exe
2208	ljTWOhr.exe
1544	segrsKQ.exe
2420	nCIoXGW.exe

Loads dropped DLL 64 IoCs

pid	Process
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2584-0-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x0007000000012119-5.dat	upx
behavioral1/files/0x0008000000015d81-14.dat	upx
behavioral1/memory/2552-22-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/1712-23-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2244-29-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x000a000000016101-45.dat	upx
behavioral1/files/0x0007000000004e74-41.dat	upx
behavioral1/files/0x0007000000015f71-38.dat	upx
behavioral1/memory/2584-37-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/1280-25-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x0008000000015d41-11.dat	upx
behavioral1/files/0x0008000000015d59-15.dat	upx
behavioral1/files/0x0009000000016241-64.dat	upx
behavioral1/memory/2792-63-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2780-59-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-58.dat	upx
behavioral1/files/0x0006000000016d63-80.dat	upx
behavioral1/files/0x0006000000016d4f-73.dat	upx
behavioral1/files/0x0005000000018742-170.dat	upx
behavioral1/memory/2848-43-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x00050000000186f8-161.dat	upx
behavioral1/files/0x000500000001868b-153.dat	upx
behavioral1/files/0x001400000001866f-145.dat	upx
behavioral1/files/0x0006000000016d3f-138.dat	upx
behavioral1/files/0x00060000000175e7-136.dat	upx
behavioral1/files/0x000600000001747d-128.dat	upx
behavioral1/files/0x0006000000017047-120.dat	upx
behavioral1/files/0x0006000000016dea-111.dat	upx
behavioral1/files/0x0006000000016dd9-104.dat	upx
behavioral1/files/0x0006000000016d6d-95.dat	upx
behavioral1/memory/2584-88-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/3064-87-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/1416-86-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2896-82-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x0006000000016d47-79.dat	upx
behavioral1/files/0x0011000000018682-188.dat	upx
behavioral1/files/0x0005000000018731-164.dat	upx
behavioral1/files/0x00050000000186f2-156.dat	upx
behavioral1/files/0x0006000000018669-140.dat	upx
behavioral1/files/0x0006000000017491-131.dat	upx
behavioral1/files/0x0006000000016eb4-114.dat	upx
behavioral1/files/0x0006000000016d72-99.dat	upx
behavioral1/files/0x000600000001743a-181.dat	upx
behavioral1/files/0x0006000000016de0-179.dat	upx
behavioral1/files/0x0006000000016d69-175.dat	upx
behavioral1/memory/2848-722-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2896-1446-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/1416-1457-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/1280-5076-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/1712-5077-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2780-5082-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2724-5083-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2792-5085-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2244-5088-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/1416-5094-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2896-5099-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2552-5091-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/3064-5090-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2848-5130-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TBwzSeA.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\cCDbLAO.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\WMcWSHT.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\uEEQhuv.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\aKwLQNM.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\ubcbuaz.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\BzROkwo.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\xfDsKOn.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\OAacoDA.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\QzsnaZl.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\xtbybSV.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\zDRsFZS.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\ckAZeRo.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\AjWFanQ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\YhCkfuS.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\eByLfyx.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\kjaqJuL.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\VeIrYGV.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\evBPjhy.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\sfMCXNC.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\vZdjhMv.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\UIvhvqQ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\QsLIEHp.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\xLDirCl.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\ggPhFRc.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\OwyJgsu.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\EZUjyix.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\qPyNBCv.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\tXewnjo.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\PFfIQRV.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\tnoLjzI.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\QlkKRXJ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\DVllaKD.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\RpqYIPo.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\bbtEJKn.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\chpVyyZ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\JYOwScP.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\HRZGKQI.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\YeaGrKW.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\yXPUAJc.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\WePMVIJ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\VSAOqGU.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\bMSGykD.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\DqQmtWf.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\fRNPmLW.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\txlqztm.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\JCRgNqV.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\zzJKedz.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\iOSbADh.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\WnXFUhZ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\gYsbLQP.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\MOyjAMP.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\heskOqu.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\VKvLKQv.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\CnRJrYJ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\TsnjPlk.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\fVJXAGv.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\GseFMYV.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\pjjBFRZ.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\iBROAjV.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\CdJQGak.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\AmMUTbf.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\XVfXkyC.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
File created	C:\Windows\System\NqqqXER.exe	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1776	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
Token: SeDebugPrivilege	1776	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1776	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	31
PID 2584 wrote to memory of 1776	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	31
PID 2584 wrote to memory of 1776	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	31
PID 2584 wrote to memory of 1280	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	32
PID 2584 wrote to memory of 1280	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	32
PID 2584 wrote to memory of 1280	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	32
PID 2584 wrote to memory of 2552	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	33
PID 2584 wrote to memory of 2552	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	33
PID 2584 wrote to memory of 2552	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	33
PID 2584 wrote to memory of 1712	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	34
PID 2584 wrote to memory of 1712	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	34
PID 2584 wrote to memory of 1712	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	34
PID 2584 wrote to memory of 2244	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	35
PID 2584 wrote to memory of 2244	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	35
PID 2584 wrote to memory of 2244	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	35
PID 2584 wrote to memory of 2724	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	36
PID 2584 wrote to memory of 2724	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	36
PID 2584 wrote to memory of 2724	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	36
PID 2584 wrote to memory of 2848	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	37
PID 2584 wrote to memory of 2848	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	37
PID 2584 wrote to memory of 2848	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	37
PID 2584 wrote to memory of 2780	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	38
PID 2584 wrote to memory of 2780	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	38
PID 2584 wrote to memory of 2780	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	38
PID 2584 wrote to memory of 2896	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	39
PID 2584 wrote to memory of 2896	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	39
PID 2584 wrote to memory of 2896	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	39
PID 2584 wrote to memory of 2792	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	40
PID 2584 wrote to memory of 2792	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	40
PID 2584 wrote to memory of 2792	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	40
PID 2584 wrote to memory of 2664	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	41
PID 2584 wrote to memory of 2664	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	41
PID 2584 wrote to memory of 2664	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	41
PID 2584 wrote to memory of 1416	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	42
PID 2584 wrote to memory of 1416	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	42
PID 2584 wrote to memory of 1416	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	42
PID 2584 wrote to memory of 3056	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	43
PID 2584 wrote to memory of 3056	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	43
PID 2584 wrote to memory of 3056	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	43
PID 2584 wrote to memory of 3064	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	44
PID 2584 wrote to memory of 3064	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	44
PID 2584 wrote to memory of 3064	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	44
PID 2584 wrote to memory of 2944	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	45
PID 2584 wrote to memory of 2944	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	45
PID 2584 wrote to memory of 2944	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	45
PID 2584 wrote to memory of 3040	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	46
PID 2584 wrote to memory of 3040	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	46
PID 2584 wrote to memory of 3040	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	46
PID 2584 wrote to memory of 1132	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	47
PID 2584 wrote to memory of 1132	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	47
PID 2584 wrote to memory of 1132	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	47
PID 2584 wrote to memory of 2940	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	48
PID 2584 wrote to memory of 2940	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	48
PID 2584 wrote to memory of 2940	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	48
PID 2584 wrote to memory of 1716	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	49
PID 2584 wrote to memory of 1716	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	49
PID 2584 wrote to memory of 1716	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	49
PID 2584 wrote to memory of 768	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	50
PID 2584 wrote to memory of 768	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	50
PID 2584 wrote to memory of 768	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	50
PID 2584 wrote to memory of 1732	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	51
PID 2584 wrote to memory of 1732	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	51
PID 2584 wrote to memory of 1732	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	51
PID 2584 wrote to memory of 1756	2584	dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dc0e149a1c03c43b955a3416dbfb2042_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- C:\Windows\System\IcANLvW.exe
  C:\Windows\System\IcANLvW.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\PMtdacu.exe
  C:\Windows\System\PMtdacu.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\wJAaddw.exe
  C:\Windows\System\wJAaddw.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\NhnHUtX.exe
  C:\Windows\System\NhnHUtX.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\zTycPym.exe
  C:\Windows\System\zTycPym.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\QleELoB.exe
  C:\Windows\System\QleELoB.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\dOwCbgs.exe
  C:\Windows\System\dOwCbgs.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\tMzZWsk.exe
  C:\Windows\System\tMzZWsk.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\TKlERDP.exe
  C:\Windows\System\TKlERDP.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\GomiWMm.exe
  C:\Windows\System\GomiWMm.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\WwhBTta.exe
  C:\Windows\System\WwhBTta.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\CVgwDNA.exe
  C:\Windows\System\CVgwDNA.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\mgFlQLK.exe
  C:\Windows\System\mgFlQLK.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\gQEWCLZ.exe
  C:\Windows\System\gQEWCLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\savMXtO.exe
  C:\Windows\System\savMXtO.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\VDatyeG.exe
  C:\Windows\System\VDatyeG.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\ZTOftMg.exe
  C:\Windows\System\ZTOftMg.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\nSrOygD.exe
  C:\Windows\System\nSrOygD.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\mAUXvad.exe
  C:\Windows\System\mAUXvad.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\lXZrkpG.exe
  C:\Windows\System\lXZrkpG.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\cOPvuRD.exe
  C:\Windows\System\cOPvuRD.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\UVaHtvL.exe
  C:\Windows\System\UVaHtvL.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\IlcoLCR.exe
  C:\Windows\System\IlcoLCR.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\KDRWVBC.exe
  C:\Windows\System\KDRWVBC.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\rAIiyQu.exe
  C:\Windows\System\rAIiyQu.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\EWgDhOf.exe
  C:\Windows\System\EWgDhOf.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\AdqxkAK.exe
  C:\Windows\System\AdqxkAK.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\TbXQaHc.exe
  C:\Windows\System\TbXQaHc.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\SogpnWD.exe
  C:\Windows\System\SogpnWD.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\FbsDACG.exe
  C:\Windows\System\FbsDACG.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\DerRPsR.exe
  C:\Windows\System\DerRPsR.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\OwqSPZH.exe
  C:\Windows\System\OwqSPZH.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\ESNMMvv.exe
  C:\Windows\System\ESNMMvv.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\jmyXyQu.exe
  C:\Windows\System\jmyXyQu.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\MZWfhba.exe
  C:\Windows\System\MZWfhba.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\TgzmgrF.exe
  C:\Windows\System\TgzmgrF.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\llrxCeT.exe
  C:\Windows\System\llrxCeT.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\iyeOrAs.exe
  C:\Windows\System\iyeOrAs.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\mxDdcWf.exe
  C:\Windows\System\mxDdcWf.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\uYRSqVm.exe
  C:\Windows\System\uYRSqVm.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\NpuDGWZ.exe
  C:\Windows\System\NpuDGWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\uAAtkVl.exe
  C:\Windows\System\uAAtkVl.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\IwrSiOb.exe
  C:\Windows\System\IwrSiOb.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\ZbslsbB.exe
  C:\Windows\System\ZbslsbB.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\vXgOOLg.exe
  C:\Windows\System\vXgOOLg.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\vYPQenx.exe
  C:\Windows\System\vYPQenx.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\Ugcnmno.exe
  C:\Windows\System\Ugcnmno.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\FwVUKII.exe
  C:\Windows\System\FwVUKII.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ffFxIoD.exe
  C:\Windows\System\ffFxIoD.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\UwMaCWF.exe
  C:\Windows\System\UwMaCWF.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\dsnIovS.exe
  C:\Windows\System\dsnIovS.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\WVNFKnN.exe
  C:\Windows\System\WVNFKnN.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\GZcjyRN.exe
  C:\Windows\System\GZcjyRN.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\sbpkSvL.exe
  C:\Windows\System\sbpkSvL.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\QUbMGqQ.exe
  C:\Windows\System\QUbMGqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\ZHMtOkm.exe
  C:\Windows\System\ZHMtOkm.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\NVXWfHb.exe
  C:\Windows\System\NVXWfHb.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\pzlFWyW.exe
  C:\Windows\System\pzlFWyW.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\qtzdFor.exe
  C:\Windows\System\qtzdFor.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\XzIrbFh.exe
  C:\Windows\System\XzIrbFh.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\NKTgIAL.exe
  C:\Windows\System\NKTgIAL.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\ljTWOhr.exe
  C:\Windows\System\ljTWOhr.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\segrsKQ.exe
  C:\Windows\System\segrsKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\nCIoXGW.exe
  C:\Windows\System\nCIoXGW.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\acFSdED.exe
  C:\Windows\System\acFSdED.exe
  2⤵
  PID:2516
- C:\Windows\System\nlQLgVK.exe
  C:\Windows\System\nlQLgVK.exe
  2⤵
  PID:316
- C:\Windows\System\ZJSOrOV.exe
  C:\Windows\System\ZJSOrOV.exe
  2⤵
  PID:1968
- C:\Windows\System\SPDqHNU.exe
  C:\Windows\System\SPDqHNU.exe
  2⤵
  PID:2596
- C:\Windows\System\mHgyvjo.exe
  C:\Windows\System\mHgyvjo.exe
  2⤵
  PID:2736
- C:\Windows\System\hoNdWdt.exe
  C:\Windows\System\hoNdWdt.exe
  2⤵
  PID:1920
- C:\Windows\System\HfAMsMG.exe
  C:\Windows\System\HfAMsMG.exe
  2⤵
  PID:2044
- C:\Windows\System\SjzXGZD.exe
  C:\Windows\System\SjzXGZD.exe
  2⤵
  PID:548
- C:\Windows\System\sxzjZaH.exe
  C:\Windows\System\sxzjZaH.exe
  2⤵
  PID:2932
- C:\Windows\System\cTduxde.exe
  C:\Windows\System\cTduxde.exe
  2⤵
  PID:900
- C:\Windows\System\VnGsuLL.exe
  C:\Windows\System\VnGsuLL.exe
  2⤵
  PID:340
- C:\Windows\System\JUpaYsX.exe
  C:\Windows\System\JUpaYsX.exe
  2⤵
  PID:2480
- C:\Windows\System\leYtZMb.exe
  C:\Windows\System\leYtZMb.exe
  2⤵
  PID:2492
- C:\Windows\System\bhXFyBY.exe
  C:\Windows\System\bhXFyBY.exe
  2⤵
  PID:2192
- C:\Windows\System\GcDWosK.exe
  C:\Windows\System\GcDWosK.exe
  2⤵
  PID:852
- C:\Windows\System\FHKuFbb.exe
  C:\Windows\System\FHKuFbb.exe
  2⤵
  PID:2408
- C:\Windows\System\ddrCMSR.exe
  C:\Windows\System\ddrCMSR.exe
  2⤵
  PID:1652
- C:\Windows\System\gBuPrYh.exe
  C:\Windows\System\gBuPrYh.exe
  2⤵
  PID:2444
- C:\Windows\System\iPjgGwx.exe
  C:\Windows\System\iPjgGwx.exe
  2⤵
  PID:2060
- C:\Windows\System\qxrKSUg.exe
  C:\Windows\System\qxrKSUg.exe
  2⤵
  PID:2328
- C:\Windows\System\uKTWlbp.exe
  C:\Windows\System\uKTWlbp.exe
  2⤵
  PID:2368
- C:\Windows\System\DhRHlKK.exe
  C:\Windows\System\DhRHlKK.exe
  2⤵
  PID:1632
- C:\Windows\System\FxmeGQn.exe
  C:\Windows\System\FxmeGQn.exe
  2⤵
  PID:688
- C:\Windows\System\kAEXlwq.exe
  C:\Windows\System\kAEXlwq.exe
  2⤵
  PID:2296
- C:\Windows\System\HSEMHxC.exe
  C:\Windows\System\HSEMHxC.exe
  2⤵
  PID:1812
- C:\Windows\System\sjLYUqZ.exe
  C:\Windows\System\sjLYUqZ.exe
  2⤵
  PID:1584
- C:\Windows\System\FyfMPup.exe
  C:\Windows\System\FyfMPup.exe
  2⤵
  PID:2360
- C:\Windows\System\SsGtNcw.exe
  C:\Windows\System\SsGtNcw.exe
  2⤵
  PID:2084
- C:\Windows\System\KbqQSKl.exe
  C:\Windows\System\KbqQSKl.exe
  2⤵
  PID:2576
- C:\Windows\System\HPRNuLF.exe
  C:\Windows\System\HPRNuLF.exe
  2⤵
  PID:2892
- C:\Windows\System\bCQaIZo.exe
  C:\Windows\System\bCQaIZo.exe
  2⤵
  PID:2320
- C:\Windows\System\Cwgslzk.exe
  C:\Windows\System\Cwgslzk.exe
  2⤵
  PID:908
- C:\Windows\System\dyQwWKl.exe
  C:\Windows\System\dyQwWKl.exe
  2⤵
  PID:2120
- C:\Windows\System\HRtUUAq.exe
  C:\Windows\System\HRtUUAq.exe
  2⤵
  PID:2176
- C:\Windows\System\BygvviY.exe
  C:\Windows\System\BygvviY.exe
  2⤵
  PID:2824
- C:\Windows\System\azyPivq.exe
  C:\Windows\System\azyPivq.exe
  2⤵
  PID:2948
- C:\Windows\System\BInYSsk.exe
  C:\Windows\System\BInYSsk.exe
  2⤵
  PID:1928
- C:\Windows\System\FewWhbg.exe
  C:\Windows\System\FewWhbg.exe
  2⤵
  PID:1320
- C:\Windows\System\sBckiNX.exe
  C:\Windows\System\sBckiNX.exe
  2⤵
  PID:1692
- C:\Windows\System\rIZoLxy.exe
  C:\Windows\System\rIZoLxy.exe
  2⤵
  PID:1912
- C:\Windows\System\WmtyIoI.exe
  C:\Windows\System\WmtyIoI.exe
  2⤵
  PID:608
- C:\Windows\System\efFDhrJ.exe
  C:\Windows\System\efFDhrJ.exe
  2⤵
  PID:1212
- C:\Windows\System\BRGjrpO.exe
  C:\Windows\System\BRGjrpO.exe
  2⤵
  PID:1328
- C:\Windows\System\tVmUisz.exe
  C:\Windows\System\tVmUisz.exe
  2⤵
  PID:1524
- C:\Windows\System\OmrFXyv.exe
  C:\Windows\System\OmrFXyv.exe
  2⤵
  PID:2144
- C:\Windows\System\yAEfHsV.exe
  C:\Windows\System\yAEfHsV.exe
  2⤵
  PID:2352
- C:\Windows\System\hvnJzLL.exe
  C:\Windows\System\hvnJzLL.exe
  2⤵
  PID:876
- C:\Windows\System\fLzSLJD.exe
  C:\Windows\System\fLzSLJD.exe
  2⤵
  PID:2184
- C:\Windows\System\GApPWAf.exe
  C:\Windows\System\GApPWAf.exe
  2⤵
  PID:1704
- C:\Windows\System\dkPrgAv.exe
  C:\Windows\System\dkPrgAv.exe
  2⤵
  PID:528
- C:\Windows\System\hdPwobn.exe
  C:\Windows\System\hdPwobn.exe
  2⤵
  PID:576
- C:\Windows\System\KzfbkEf.exe
  C:\Windows\System\KzfbkEf.exe
  2⤵
  PID:1412
- C:\Windows\System\etRYrsP.exe
  C:\Windows\System\etRYrsP.exe
  2⤵
  PID:2464
- C:\Windows\System\JEXnBTS.exe
  C:\Windows\System\JEXnBTS.exe
  2⤵
  PID:1656
- C:\Windows\System\JqFyuUw.exe
  C:\Windows\System\JqFyuUw.exe
  2⤵
  PID:2808
- C:\Windows\System\jxKHSCj.exe
  C:\Windows\System\jxKHSCj.exe
  2⤵
  PID:2840
- C:\Windows\System\KZkqSXe.exe
  C:\Windows\System\KZkqSXe.exe
  2⤵
  PID:1880
- C:\Windows\System\avKnMKg.exe
  C:\Windows\System\avKnMKg.exe
  2⤵
  PID:636
- C:\Windows\System\AhKCfmV.exe
  C:\Windows\System\AhKCfmV.exe
  2⤵
  PID:1568
- C:\Windows\System\TTMSkmW.exe
  C:\Windows\System\TTMSkmW.exe
  2⤵
  PID:2856
- C:\Windows\System\gTdLhCG.exe
  C:\Windows\System\gTdLhCG.exe
  2⤵
  PID:1044
- C:\Windows\System\chudpAj.exe
  C:\Windows\System\chudpAj.exe
  2⤵
  PID:2172
- C:\Windows\System\ASHihMm.exe
  C:\Windows\System\ASHihMm.exe
  2⤵
  PID:2636
- C:\Windows\System\paxkfYu.exe
  C:\Windows\System\paxkfYu.exe
  2⤵
  PID:2116
- C:\Windows\System\pNrgiEI.exe
  C:\Windows\System\pNrgiEI.exe
  2⤵
  PID:1888
- C:\Windows\System\qNksWTv.exe
  C:\Windows\System\qNksWTv.exe
  2⤵
  PID:2804
- C:\Windows\System\VnJdJoD.exe
  C:\Windows\System\VnJdJoD.exe
  2⤵
  PID:2692
- C:\Windows\System\EepKCDd.exe
  C:\Windows\System\EepKCDd.exe
  2⤵
  PID:1436
- C:\Windows\System\LpuDdYI.exe
  C:\Windows\System\LpuDdYI.exe
  2⤵
  PID:2212
- C:\Windows\System\rAOFQhJ.exe
  C:\Windows\System\rAOFQhJ.exe
  2⤵
  PID:2776
- C:\Windows\System\edeEEyA.exe
  C:\Windows\System\edeEEyA.exe
  2⤵
  PID:2696
- C:\Windows\System\GYnhXAE.exe
  C:\Windows\System\GYnhXAE.exe
  2⤵
  PID:1560
- C:\Windows\System\XVAgcLI.exe
  C:\Windows\System\XVAgcLI.exe
  2⤵
  PID:988
- C:\Windows\System\NAMSZjk.exe
  C:\Windows\System\NAMSZjk.exe
  2⤵
  PID:2660
- C:\Windows\System\rgXfeLF.exe
  C:\Windows\System\rgXfeLF.exe
  2⤵
  PID:1620
- C:\Windows\System\ZkdqExj.exe
  C:\Windows\System\ZkdqExj.exe
  2⤵
  PID:2632
- C:\Windows\System\jaYAPia.exe
  C:\Windows\System\jaYAPia.exe
  2⤵
  PID:1140
- C:\Windows\System\rzRNJJC.exe
  C:\Windows\System\rzRNJJC.exe
  2⤵
  PID:1660
- C:\Windows\System\mcFCUKZ.exe
  C:\Windows\System\mcFCUKZ.exe
  2⤵
  PID:2748
- C:\Windows\System\JNrZxpu.exe
  C:\Windows\System\JNrZxpu.exe
  2⤵
  PID:2156
- C:\Windows\System\PaqTGIZ.exe
  C:\Windows\System\PaqTGIZ.exe
  2⤵
  PID:1876
- C:\Windows\System\YOZrlIc.exe
  C:\Windows\System\YOZrlIc.exe
  2⤵
  PID:2216
- C:\Windows\System\JNSseWw.exe
  C:\Windows\System\JNSseWw.exe
  2⤵
  PID:884
- C:\Windows\System\dznzLuS.exe
  C:\Windows\System\dznzLuS.exe
  2⤵
  PID:1420
- C:\Windows\System\HZLptSq.exe
  C:\Windows\System\HZLptSq.exe
  2⤵
  PID:2788
- C:\Windows\System\bpmRMDh.exe
  C:\Windows\System\bpmRMDh.exe
  2⤵
  PID:2832
- C:\Windows\System\TZdJwpp.exe
  C:\Windows\System\TZdJwpp.exe
  2⤵
  PID:2612
- C:\Windows\System\pyXMxtF.exe
  C:\Windows\System\pyXMxtF.exe
  2⤵
  PID:1532
- C:\Windows\System\FMyIAJj.exe
  C:\Windows\System\FMyIAJj.exe
  2⤵
  PID:1536
- C:\Windows\System\zvHXkXG.exe
  C:\Windows\System\zvHXkXG.exe
  2⤵
  PID:1492
- C:\Windows\System\kmMrbsL.exe
  C:\Windows\System\kmMrbsL.exe
  2⤵
  PID:2624
- C:\Windows\System\KKDlLYM.exe
  C:\Windows\System\KKDlLYM.exe
  2⤵
  PID:3080
- C:\Windows\System\lxdGXCq.exe
  C:\Windows\System\lxdGXCq.exe
  2⤵
  PID:3100
- C:\Windows\System\yPtBjOz.exe
  C:\Windows\System\yPtBjOz.exe
  2⤵
  PID:3116
- C:\Windows\System\xTyExMW.exe
  C:\Windows\System\xTyExMW.exe
  2⤵
  PID:3132
- C:\Windows\System\arrBTSD.exe
  C:\Windows\System\arrBTSD.exe
  2⤵
  PID:3148
- C:\Windows\System\nnqxqnG.exe
  C:\Windows\System\nnqxqnG.exe
  2⤵
  PID:3164
- C:\Windows\System\KuBSXUF.exe
  C:\Windows\System\KuBSXUF.exe
  2⤵
  PID:3184
- C:\Windows\System\VVvaWjH.exe
  C:\Windows\System\VVvaWjH.exe
  2⤵
  PID:3200
- C:\Windows\System\PurSsnT.exe
  C:\Windows\System\PurSsnT.exe
  2⤵
  PID:3216
- C:\Windows\System\MyybelT.exe
  C:\Windows\System\MyybelT.exe
  2⤵
  PID:3232
- C:\Windows\System\WyTMjoc.exe
  C:\Windows\System\WyTMjoc.exe
  2⤵
  PID:3248
- C:\Windows\System\sNztQHH.exe
  C:\Windows\System\sNztQHH.exe
  2⤵
  PID:3264
- C:\Windows\System\Crxacpo.exe
  C:\Windows\System\Crxacpo.exe
  2⤵
  PID:3284
- C:\Windows\System\VEjYQcz.exe
  C:\Windows\System\VEjYQcz.exe
  2⤵
  PID:3300
- C:\Windows\System\dnCpodW.exe
  C:\Windows\System\dnCpodW.exe
  2⤵
  PID:3408
- C:\Windows\System\YatYRIU.exe
  C:\Windows\System\YatYRIU.exe
  2⤵
  PID:3424
- C:\Windows\System\aXKMEJM.exe
  C:\Windows\System\aXKMEJM.exe
  2⤵
  PID:3440
- C:\Windows\System\QrrFNuv.exe
  C:\Windows\System\QrrFNuv.exe
  2⤵
  PID:3456
- C:\Windows\System\WUXMsMK.exe
  C:\Windows\System\WUXMsMK.exe
  2⤵
  PID:3472
- C:\Windows\System\vHEsvbf.exe
  C:\Windows\System\vHEsvbf.exe
  2⤵
  PID:3488
- C:\Windows\System\QlKoeHp.exe
  C:\Windows\System\QlKoeHp.exe
  2⤵
  PID:3504
- C:\Windows\System\CukCPWj.exe
  C:\Windows\System\CukCPWj.exe
  2⤵
  PID:3520
- C:\Windows\System\kbmLqTb.exe
  C:\Windows\System\kbmLqTb.exe
  2⤵
  PID:3536
- C:\Windows\System\HYycZEG.exe
  C:\Windows\System\HYycZEG.exe
  2⤵
  PID:3552
- C:\Windows\System\PqqSJrN.exe
  C:\Windows\System\PqqSJrN.exe
  2⤵
  PID:3568
- C:\Windows\System\pPDtmfr.exe
  C:\Windows\System\pPDtmfr.exe
  2⤵
  PID:3584
- C:\Windows\System\QxnrIWh.exe
  C:\Windows\System\QxnrIWh.exe
  2⤵
  PID:3600
- C:\Windows\System\QtKfGYY.exe
  C:\Windows\System\QtKfGYY.exe
  2⤵
  PID:3616
- C:\Windows\System\nZVTXhK.exe
  C:\Windows\System\nZVTXhK.exe
  2⤵
  PID:3632
- C:\Windows\System\UKvORXp.exe
  C:\Windows\System\UKvORXp.exe
  2⤵
  PID:3648
- C:\Windows\System\rDMBGks.exe
  C:\Windows\System\rDMBGks.exe
  2⤵
  PID:3664
- C:\Windows\System\hshvWxl.exe
  C:\Windows\System\hshvWxl.exe
  2⤵
  PID:3680
- C:\Windows\System\PbiGXNM.exe
  C:\Windows\System\PbiGXNM.exe
  2⤵
  PID:3696
- C:\Windows\System\zaklycU.exe
  C:\Windows\System\zaklycU.exe
  2⤵
  PID:3712
- C:\Windows\System\wnuhHLU.exe
  C:\Windows\System\wnuhHLU.exe
  2⤵
  PID:3728
- C:\Windows\System\gfFQGNo.exe
  C:\Windows\System\gfFQGNo.exe
  2⤵
  PID:3744
- C:\Windows\System\eUegMDw.exe
  C:\Windows\System\eUegMDw.exe
  2⤵
  PID:3764
- C:\Windows\System\eCoQqKO.exe
  C:\Windows\System\eCoQqKO.exe
  2⤵
  PID:3780
- C:\Windows\System\NDQmGeP.exe
  C:\Windows\System\NDQmGeP.exe
  2⤵
  PID:3796
- C:\Windows\System\oMTYFOE.exe
  C:\Windows\System\oMTYFOE.exe
  2⤵
  PID:3812
- C:\Windows\System\fSswfEu.exe
  C:\Windows\System\fSswfEu.exe
  2⤵
  PID:3828
- C:\Windows\System\UGQPUGu.exe
  C:\Windows\System\UGQPUGu.exe
  2⤵
  PID:3848
- C:\Windows\System\KgxFhrZ.exe
  C:\Windows\System\KgxFhrZ.exe
  2⤵
  PID:3864
- C:\Windows\System\egLGrzi.exe
  C:\Windows\System\egLGrzi.exe
  2⤵
  PID:3880
- C:\Windows\System\dYPXaPK.exe
  C:\Windows\System\dYPXaPK.exe
  2⤵
  PID:3896
- C:\Windows\System\uhfiKvN.exe
  C:\Windows\System\uhfiKvN.exe
  2⤵
  PID:3916
- C:\Windows\System\aoDaWRB.exe
  C:\Windows\System\aoDaWRB.exe
  2⤵
  PID:3932
- C:\Windows\System\AbEyCKW.exe
  C:\Windows\System\AbEyCKW.exe
  2⤵
  PID:3948
- C:\Windows\System\nRKHrZf.exe
  C:\Windows\System\nRKHrZf.exe
  2⤵
  PID:3964
- C:\Windows\System\IJcwlwk.exe
  C:\Windows\System\IJcwlwk.exe
  2⤵
  PID:3980
- C:\Windows\System\kaFPrcs.exe
  C:\Windows\System\kaFPrcs.exe
  2⤵
  PID:3996
- C:\Windows\System\HUJUjGY.exe
  C:\Windows\System\HUJUjGY.exe
  2⤵
  PID:4016
- C:\Windows\System\cyQVGfi.exe
  C:\Windows\System\cyQVGfi.exe
  2⤵
  PID:4032
- C:\Windows\System\dBjxXAe.exe
  C:\Windows\System\dBjxXAe.exe
  2⤵
  PID:2232
- C:\Windows\System\HawPbUd.exe
  C:\Windows\System\HawPbUd.exe
  2⤵
  PID:3192
- C:\Windows\System\bNmkQtM.exe
  C:\Windows\System\bNmkQtM.exe
  2⤵
  PID:3296
- C:\Windows\System\UmqJAiF.exe
  C:\Windows\System\UmqJAiF.exe
  2⤵
  PID:3272
- C:\Windows\System\jHrfqZR.exe
  C:\Windows\System\jHrfqZR.exe
  2⤵
  PID:3364
- C:\Windows\System\lPWstcJ.exe
  C:\Windows\System\lPWstcJ.exe
  2⤵
  PID:3372
- C:\Windows\System\fGPelYr.exe
  C:\Windows\System\fGPelYr.exe
  2⤵
  PID:3380
- C:\Windows\System\lQidHSx.exe
  C:\Windows\System\lQidHSx.exe
  2⤵
  PID:3384
- C:\Windows\System\jWHJIQj.exe
  C:\Windows\System\jWHJIQj.exe
  2⤵
  PID:3244
- C:\Windows\System\Gimbiwt.exe
  C:\Windows\System\Gimbiwt.exe
  2⤵
  PID:3280
- C:\Windows\System\bQSWcfi.exe
  C:\Windows\System\bQSWcfi.exe
  2⤵
  PID:3316
- C:\Windows\System\eZapwnk.exe
  C:\Windows\System\eZapwnk.exe
  2⤵
  PID:3348
- C:\Windows\System\fNssVep.exe
  C:\Windows\System\fNssVep.exe
  2⤵
  PID:3436
- C:\Windows\System\ifiCzjq.exe
  C:\Windows\System\ifiCzjq.exe
  2⤵
  PID:3528
- C:\Windows\System\UQLMKKk.exe
  C:\Windows\System\UQLMKKk.exe
  2⤵
  PID:3624
- C:\Windows\System\ctRXulF.exe
  C:\Windows\System\ctRXulF.exe
  2⤵
  PID:2864
- C:\Windows\System\SlyMSiP.exe
  C:\Windows\System\SlyMSiP.exe
  2⤵
  PID:3824
- C:\Windows\System\QWyznhy.exe
  C:\Windows\System\QWyznhy.exe
  2⤵
  PID:3452
- C:\Windows\System\QLeUzwl.exe
  C:\Windows\System\QLeUzwl.exe
  2⤵
  PID:3516
- C:\Windows\System\tKabyFY.exe
  C:\Windows\System\tKabyFY.exe
  2⤵
  PID:3608
- C:\Windows\System\ieypjwV.exe
  C:\Windows\System\ieypjwV.exe
  2⤵
  PID:3672
- C:\Windows\System\LuFwvLp.exe
  C:\Windows\System\LuFwvLp.exe
  2⤵
  PID:3736
- C:\Windows\System\QWlYlPL.exe
  C:\Windows\System\QWlYlPL.exe
  2⤵
  PID:3804
- C:\Windows\System\doNwzDU.exe
  C:\Windows\System\doNwzDU.exe
  2⤵
  PID:3904
- C:\Windows\System\lfvnwvG.exe
  C:\Windows\System\lfvnwvG.exe
  2⤵
  PID:3944
- C:\Windows\System\bnoufgF.exe
  C:\Windows\System\bnoufgF.exe
  2⤵
  PID:4008
- C:\Windows\System\yxloFRQ.exe
  C:\Windows\System\yxloFRQ.exe
  2⤵
  PID:4052
- C:\Windows\System\MWQSBkW.exe
  C:\Windows\System\MWQSBkW.exe
  2⤵
  PID:4068
- C:\Windows\System\QsLIEHp.exe
  C:\Windows\System\QsLIEHp.exe
  2⤵
  PID:4084
- C:\Windows\System\EdkPQeW.exe
  C:\Windows\System\EdkPQeW.exe
  2⤵
  PID:2720
- C:\Windows\System\yfwAWYq.exe
  C:\Windows\System\yfwAWYq.exe
  2⤵
  PID:1164
- C:\Windows\System\FFslytZ.exe
  C:\Windows\System\FFslytZ.exe
  2⤵
  PID:3628
- C:\Windows\System\YpMEwEU.exe
  C:\Windows\System\YpMEwEU.exe
  2⤵
  PID:3692
- C:\Windows\System\rcGTRSW.exe
  C:\Windows\System\rcGTRSW.exe
  2⤵
  PID:3756
- C:\Windows\System\BdKPbNU.exe
  C:\Windows\System\BdKPbNU.exe
  2⤵
  PID:3928
- C:\Windows\System\JBroERg.exe
  C:\Windows\System\JBroERg.exe
  2⤵
  PID:3992
- C:\Windows\System\jQhNOuF.exe
  C:\Windows\System\jQhNOuF.exe
  2⤵
  PID:3224
- C:\Windows\System\IvyJlMI.exe
  C:\Windows\System\IvyJlMI.exe
  2⤵
  PID:3112
- C:\Windows\System\UoxFIWt.exe
  C:\Windows\System\UoxFIWt.exe
  2⤵
  PID:3312
- C:\Windows\System\fcEkNAI.exe
  C:\Windows\System\fcEkNAI.exe
  2⤵
  PID:3092
- C:\Windows\System\DLJxikX.exe
  C:\Windows\System\DLJxikX.exe
  2⤵
  PID:3208
- C:\Windows\System\HFJWCFe.exe
  C:\Windows\System\HFJWCFe.exe
  2⤵
  PID:3432
- C:\Windows\System\ayxTVsE.exe
  C:\Windows\System\ayxTVsE.exe
  2⤵
  PID:3344
- C:\Windows\System\khqoKTG.exe
  C:\Windows\System\khqoKTG.exe
  2⤵
  PID:3640
- C:\Windows\System\QEvvorE.exe
  C:\Windows\System\QEvvorE.exe
  2⤵
  PID:3912
- C:\Windows\System\JOVLxop.exe
  C:\Windows\System\JOVLxop.exe
  2⤵
  PID:4080
- C:\Windows\System\yZVjRoX.exe
  C:\Windows\System\yZVjRoX.exe
  2⤵
  PID:4100
- C:\Windows\System\mpWnWrV.exe
  C:\Windows\System\mpWnWrV.exe
  2⤵
  PID:4116
- C:\Windows\System\TwTCdfH.exe
  C:\Windows\System\TwTCdfH.exe
  2⤵
  PID:4132
- C:\Windows\System\aNhGnRV.exe
  C:\Windows\System\aNhGnRV.exe
  2⤵
  PID:4148
- C:\Windows\System\TvKHGCn.exe
  C:\Windows\System\TvKHGCn.exe
  2⤵
  PID:4164
- C:\Windows\System\wXWQcrw.exe
  C:\Windows\System\wXWQcrw.exe
  2⤵
  PID:4184
- C:\Windows\System\LFufwhj.exe
  C:\Windows\System\LFufwhj.exe
  2⤵
  PID:4200
- C:\Windows\System\aZWEZcu.exe
  C:\Windows\System\aZWEZcu.exe
  2⤵
  PID:4216
- C:\Windows\System\TkhBJCR.exe
  C:\Windows\System\TkhBJCR.exe
  2⤵
  PID:4236
- C:\Windows\System\HHHwxOX.exe
  C:\Windows\System\HHHwxOX.exe
  2⤵
  PID:4252
- C:\Windows\System\yjUinlh.exe
  C:\Windows\System\yjUinlh.exe
  2⤵
  PID:4268
- C:\Windows\System\dnPNAYL.exe
  C:\Windows\System\dnPNAYL.exe
  2⤵
  PID:4284
- C:\Windows\System\ISScgnV.exe
  C:\Windows\System\ISScgnV.exe
  2⤵
  PID:4300
- C:\Windows\System\eWVSZzD.exe
  C:\Windows\System\eWVSZzD.exe
  2⤵
  PID:4316
- C:\Windows\System\EXASVfH.exe
  C:\Windows\System\EXASVfH.exe
  2⤵
  PID:4336
- C:\Windows\System\ONjWNCP.exe
  C:\Windows\System\ONjWNCP.exe
  2⤵
  PID:4352
- C:\Windows\System\NZcPyps.exe
  C:\Windows\System\NZcPyps.exe
  2⤵
  PID:4460
- C:\Windows\System\mZEYomt.exe
  C:\Windows\System\mZEYomt.exe
  2⤵
  PID:4508
- C:\Windows\System\BwHKyGq.exe
  C:\Windows\System\BwHKyGq.exe
  2⤵
  PID:4600
- C:\Windows\System\phzTICZ.exe
  C:\Windows\System\phzTICZ.exe
  2⤵
  PID:4624
- C:\Windows\System\wcqbygy.exe
  C:\Windows\System\wcqbygy.exe
  2⤵
  PID:4640
- C:\Windows\System\xyyhTFD.exe
  C:\Windows\System\xyyhTFD.exe
  2⤵
  PID:4656
- C:\Windows\System\rbnFYdm.exe
  C:\Windows\System\rbnFYdm.exe
  2⤵
  PID:4672
- C:\Windows\System\rNnJmKY.exe
  C:\Windows\System\rNnJmKY.exe
  2⤵
  PID:4688
- C:\Windows\System\LkjFJeh.exe
  C:\Windows\System\LkjFJeh.exe
  2⤵
  PID:4708
- C:\Windows\System\QshRJYv.exe
  C:\Windows\System\QshRJYv.exe
  2⤵
  PID:4724
- C:\Windows\System\feFADNE.exe
  C:\Windows\System\feFADNE.exe
  2⤵
  PID:4740
- C:\Windows\System\jXdmkLy.exe
  C:\Windows\System\jXdmkLy.exe
  2⤵
  PID:4756
- C:\Windows\System\htzECbz.exe
  C:\Windows\System\htzECbz.exe
  2⤵
  PID:4772
- C:\Windows\System\wFXsgEY.exe
  C:\Windows\System\wFXsgEY.exe
  2⤵
  PID:4828
- C:\Windows\System\QVbqErS.exe
  C:\Windows\System\QVbqErS.exe
  2⤵
  PID:4844
- C:\Windows\System\npaBuEg.exe
  C:\Windows\System\npaBuEg.exe
  2⤵
  PID:4860
- C:\Windows\System\FmaqBDD.exe
  C:\Windows\System\FmaqBDD.exe
  2⤵
  PID:4876
- C:\Windows\System\KRgMrhI.exe
  C:\Windows\System\KRgMrhI.exe
  2⤵
  PID:4892
- C:\Windows\System\WrYNggR.exe
  C:\Windows\System\WrYNggR.exe
  2⤵
  PID:4908
- C:\Windows\System\pUKEICx.exe
  C:\Windows\System\pUKEICx.exe
  2⤵
  PID:4924
- C:\Windows\System\CXovAJF.exe
  C:\Windows\System\CXovAJF.exe
  2⤵
  PID:4940
- C:\Windows\System\EDDqOGp.exe
  C:\Windows\System\EDDqOGp.exe
  2⤵
  PID:4956
- C:\Windows\System\rkjXSvI.exe
  C:\Windows\System\rkjXSvI.exe
  2⤵
  PID:4972
- C:\Windows\System\OfpBTWB.exe
  C:\Windows\System\OfpBTWB.exe
  2⤵
  PID:4988
- C:\Windows\System\uEEQhuv.exe
  C:\Windows\System\uEEQhuv.exe
  2⤵
  PID:5004
- C:\Windows\System\PcxVvtC.exe
  C:\Windows\System\PcxVvtC.exe
  2⤵
  PID:5020
- C:\Windows\System\SDZfjBo.exe
  C:\Windows\System\SDZfjBo.exe
  2⤵
  PID:5036
- C:\Windows\System\MJhTojb.exe
  C:\Windows\System\MJhTojb.exe
  2⤵
  PID:5052
- C:\Windows\System\croghdi.exe
  C:\Windows\System\croghdi.exe
  2⤵
  PID:5068
- C:\Windows\System\YCxCVqx.exe
  C:\Windows\System\YCxCVqx.exe
  2⤵
  PID:5084
- C:\Windows\System\USGjUom.exe
  C:\Windows\System\USGjUom.exe
  2⤵
  PID:5100
- C:\Windows\System\XeDrjnr.exe
  C:\Windows\System\XeDrjnr.exe
  2⤵
  PID:5116
- C:\Windows\System\nMhOoVa.exe
  C:\Windows\System\nMhOoVa.exe
  2⤵
  PID:3792
- C:\Windows\System\IITWKor.exe
  C:\Windows\System\IITWKor.exe
  2⤵
  PID:3240
- C:\Windows\System\GNLjrAN.exe
  C:\Windows\System\GNLjrAN.exe
  2⤵
  PID:2432
- C:\Windows\System\JoNPiRq.exe
  C:\Windows\System\JoNPiRq.exe
  2⤵
  PID:4160
- C:\Windows\System\KSKfKmD.exe
  C:\Windows\System\KSKfKmD.exe
  2⤵
  PID:4228
- C:\Windows\System\gdLivJK.exe
  C:\Windows\System\gdLivJK.exe
  2⤵
  PID:4296
- C:\Windows\System\gHkNqOR.exe
  C:\Windows\System\gHkNqOR.exe
  2⤵
  PID:4368
- C:\Windows\System\FhORKAU.exe
  C:\Windows\System\FhORKAU.exe
  2⤵
  PID:4392
- C:\Windows\System\NAewmol.exe
  C:\Windows\System\NAewmol.exe
  2⤵
  PID:4412
- C:\Windows\System\hVrAEYz.exe
  C:\Windows\System\hVrAEYz.exe
  2⤵
  PID:3448
- C:\Windows\System\TkQczJy.exe
  C:\Windows\System\TkQczJy.exe
  2⤵
  PID:1224
- C:\Windows\System\aFnvrYW.exe
  C:\Windows\System\aFnvrYW.exe
  2⤵
  PID:2672
- C:\Windows\System\VWYnqoU.exe
  C:\Windows\System\VWYnqoU.exe
  2⤵
  PID:4044
- C:\Windows\System\LyYnHTY.exe
  C:\Windows\System\LyYnHTY.exe
  2⤵
  PID:3960
- C:\Windows\System\VIeVQfW.exe
  C:\Windows\System\VIeVQfW.exe
  2⤵
  PID:2972
- C:\Windows\System\maxHerJ.exe
  C:\Windows\System\maxHerJ.exe
  2⤵
  PID:4076
- C:\Windows\System\dTbrcGF.exe
  C:\Windows\System\dTbrcGF.exe
  2⤵
  PID:4172
- C:\Windows\System\JdDKBvj.exe
  C:\Windows\System\JdDKBvj.exe
  2⤵
  PID:4244
- C:\Windows\System\OCkFnTJ.exe
  C:\Windows\System\OCkFnTJ.exe
  2⤵
  PID:4524
- C:\Windows\System\HAlHFhp.exe
  C:\Windows\System\HAlHFhp.exe
  2⤵
  PID:4536
- C:\Windows\System\IhZhRFY.exe
  C:\Windows\System\IhZhRFY.exe
  2⤵
  PID:4348
- C:\Windows\System\BYWtERN.exe
  C:\Windows\System\BYWtERN.exe
  2⤵
  PID:4496
- C:\Windows\System\iXADRcR.exe
  C:\Windows\System\iXADRcR.exe
  2⤵
  PID:4488
- C:\Windows\System\bapQFga.exe
  C:\Windows\System\bapQFga.exe
  2⤵
  PID:4560
- C:\Windows\System\NouSbsv.exe
  C:\Windows\System\NouSbsv.exe
  2⤵
  PID:4588
- C:\Windows\System\FoTNdqy.exe
  C:\Windows\System\FoTNdqy.exe
  2⤵
  PID:4636
- C:\Windows\System\IgDHwzO.exe
  C:\Windows\System\IgDHwzO.exe
  2⤵
  PID:4696
- C:\Windows\System\AkOQjsA.exe
  C:\Windows\System\AkOQjsA.exe
  2⤵
  PID:4616
- C:\Windows\System\DnzukUK.exe
  C:\Windows\System\DnzukUK.exe
  2⤵
  PID:4716
- C:\Windows\System\OYTbzAP.exe
  C:\Windows\System\OYTbzAP.exe
  2⤵
  PID:4732
- C:\Windows\System\AbABSnx.exe
  C:\Windows\System\AbABSnx.exe
  2⤵
  PID:4768
- C:\Windows\System\RFbXJCu.exe
  C:\Windows\System\RFbXJCu.exe
  2⤵
  PID:4836
- C:\Windows\System\IOwgMHr.exe
  C:\Windows\System\IOwgMHr.exe
  2⤵
  PID:4932
- C:\Windows\System\TQxXUJK.exe
  C:\Windows\System\TQxXUJK.exe
  2⤵
  PID:4884
- C:\Windows\System\mfwDScj.exe
  C:\Windows\System\mfwDScj.exe
  2⤵
  PID:4948
- C:\Windows\System\DmfzFga.exe
  C:\Windows\System\DmfzFga.exe
  2⤵
  PID:5092
- C:\Windows\System\lCZeRUz.exe
  C:\Windows\System\lCZeRUz.exe
  2⤵
  PID:4984
- C:\Windows\System\SWRreLt.exe
  C:\Windows\System\SWRreLt.exe
  2⤵
  PID:3400
- C:\Windows\System\hdjTsKN.exe
  C:\Windows\System\hdjTsKN.exe
  2⤵
  PID:4852
- C:\Windows\System\XDLYagv.exe
  C:\Windows\System\XDLYagv.exe
  2⤵
  PID:4920
- C:\Windows\System\YydmQrM.exe
  C:\Windows\System\YydmQrM.exe
  2⤵
  PID:4028
- C:\Windows\System\qbIxNKo.exe
  C:\Windows\System\qbIxNKo.exe
  2⤵
  PID:3772
- C:\Windows\System\UCKBJpZ.exe
  C:\Windows\System\UCKBJpZ.exe
  2⤵
  PID:4196
- C:\Windows\System\vbpUUld.exe
  C:\Windows\System\vbpUUld.exe
  2⤵
  PID:4404
- C:\Windows\System\qtdRpzn.exe
  C:\Windows\System\qtdRpzn.exe
  2⤵
  PID:4124
- C:\Windows\System\wlyorwo.exe
  C:\Windows\System\wlyorwo.exe
  2⤵
  PID:3156
- C:\Windows\System\ETGUUJx.exe
  C:\Windows\System\ETGUUJx.exe
  2⤵
  PID:3088
- C:\Windows\System\GfjRofn.exe
  C:\Windows\System\GfjRofn.exe
  2⤵
  PID:3396
- C:\Windows\System\KUzpnmS.exe
  C:\Windows\System\KUzpnmS.exe
  2⤵
  PID:3580
- C:\Windows\System\vEXAgCi.exe
  C:\Windows\System\vEXAgCi.exe
  2⤵
  PID:3844
- C:\Windows\System\LWErWpT.exe
  C:\Windows\System\LWErWpT.exe
  2⤵
  PID:4004
- C:\Windows\System\dRKIDom.exe
  C:\Windows\System\dRKIDom.exe
  2⤵
  PID:4092
- C:\Windows\System\zLndDrb.exe
  C:\Windows\System\zLndDrb.exe
  2⤵
  PID:3500
- C:\Windows\System\wFyGNJn.exe
  C:\Windows\System\wFyGNJn.exe
  2⤵
  PID:3752
- C:\Windows\System\MmTFRyi.exe
  C:\Windows\System\MmTFRyi.exe
  2⤵
  PID:4140
- C:\Windows\System\ylUYqbK.exe
  C:\Windows\System\ylUYqbK.exe
  2⤵
  PID:4180
- C:\Windows\System\waCqEPk.exe
  C:\Windows\System\waCqEPk.exe
  2⤵
  PID:4364
- C:\Windows\System\ouNyYDi.exe
  C:\Windows\System\ouNyYDi.exe
  2⤵
  PID:4280
- C:\Windows\System\krVJVas.exe
  C:\Windows\System\krVJVas.exe
  2⤵
  PID:4468
- C:\Windows\System\RFDvWfu.exe
  C:\Windows\System\RFDvWfu.exe
  2⤵
  PID:4544
- C:\Windows\System\BbgMTLa.exe
  C:\Windows\System\BbgMTLa.exe
  2⤵
  PID:4704
- C:\Windows\System\cqsQAiv.exe
  C:\Windows\System\cqsQAiv.exe
  2⤵
  PID:4652
- C:\Windows\System\TMXJGek.exe
  C:\Windows\System\TMXJGek.exe
  2⤵
  PID:4796
- C:\Windows\System\iwExRys.exe
  C:\Windows\System\iwExRys.exe
  2⤵
  PID:4788
- C:\Windows\System\YuVuJrJ.exe
  C:\Windows\System\YuVuJrJ.exe
  2⤵
  PID:4872
- C:\Windows\System\TtOWkYr.exe
  C:\Windows\System\TtOWkYr.exe
  2⤵
  PID:5028
- C:\Windows\System\hMnPmyB.exe
  C:\Windows\System\hMnPmyB.exe
  2⤵
  PID:4952
- C:\Windows\System\iTQiMBN.exe
  C:\Windows\System\iTQiMBN.exe
  2⤵
  PID:4816
- C:\Windows\System\ihFdCpd.exe
  C:\Windows\System\ihFdCpd.exe
  2⤵
  PID:5012
- C:\Windows\System\YZNjyQx.exe
  C:\Windows\System\YZNjyQx.exe
  2⤵
  PID:3656
- C:\Windows\System\UNaAsjf.exe
  C:\Windows\System\UNaAsjf.exe
  2⤵
  PID:4328
- C:\Windows\System\HYlCteP.exe
  C:\Windows\System\HYlCteP.exe
  2⤵
  PID:4360
- C:\Windows\System\DRtZPAt.exe
  C:\Windows\System\DRtZPAt.exe
  2⤵
  PID:3256
- C:\Windows\System\PFfIQRV.exe
  C:\Windows\System\PFfIQRV.exe
  2⤵
  PID:3140
- C:\Windows\System\NqqqXER.exe
  C:\Windows\System\NqqqXER.exe
  2⤵
  PID:3708
- C:\Windows\System\opMjBPg.exe
  C:\Windows\System\opMjBPg.exe
  2⤵
  PID:3876
- C:\Windows\System\nFwOEJf.exe
  C:\Windows\System\nFwOEJf.exe
  2⤵
  PID:3464
- C:\Windows\System\HZIYcWv.exe
  C:\Windows\System\HZIYcWv.exe
  2⤵
  PID:4064
- C:\Windows\System\NjlWJvS.exe
  C:\Windows\System\NjlWJvS.exe
  2⤵
  PID:3484
- C:\Windows\System\uaQgVyK.exe
  C:\Windows\System\uaQgVyK.exe
  2⤵
  PID:4520
- C:\Windows\System\VWzVWLM.exe
  C:\Windows\System\VWzVWLM.exe
  2⤵
  PID:4504
- C:\Windows\System\ULIoxsI.exe
  C:\Windows\System\ULIoxsI.exe
  2⤵
  PID:3260
- C:\Windows\System\aCTmFdz.exe
  C:\Windows\System\aCTmFdz.exe
  2⤵
  PID:4664
- C:\Windows\System\KzpnApv.exe
  C:\Windows\System\KzpnApv.exe
  2⤵
  PID:4684
- C:\Windows\System\VlEiAGH.exe
  C:\Windows\System\VlEiAGH.exe
  2⤵
  PID:4900
- C:\Windows\System\YCNUfWW.exe
  C:\Windows\System\YCNUfWW.exe
  2⤵
  PID:3724
- C:\Windows\System\UoLjbYG.exe
  C:\Windows\System\UoLjbYG.exe
  2⤵
  PID:2936
- C:\Windows\System\qkiaPaL.exe
  C:\Windows\System\qkiaPaL.exe
  2⤵
  PID:4608
- C:\Windows\System\cgohrBe.exe
  C:\Windows\System\cgohrBe.exe
  2⤵
  PID:4128
- C:\Windows\System\lvbGvHo.exe
  C:\Windows\System\lvbGvHo.exe
  2⤵
  PID:3336
- C:\Windows\System\DzomTmM.exe
  C:\Windows\System\DzomTmM.exe
  2⤵
  PID:3512
- C:\Windows\System\uUmeAwj.exe
  C:\Windows\System\uUmeAwj.exe
  2⤵
  PID:4596
- C:\Windows\System\lWVHQKp.exe
  C:\Windows\System\lWVHQKp.exe
  2⤵
  PID:5124
- C:\Windows\System\PjXpvsb.exe
  C:\Windows\System\PjXpvsb.exe
  2⤵
  PID:5140
- C:\Windows\System\KCkfkbk.exe
  C:\Windows\System\KCkfkbk.exe
  2⤵
  PID:5156
- C:\Windows\System\yhRmBBp.exe
  C:\Windows\System\yhRmBBp.exe
  2⤵
  PID:5176
- C:\Windows\System\cITLczn.exe
  C:\Windows\System\cITLczn.exe
  2⤵
  PID:5192
- C:\Windows\System\jMCpYRi.exe
  C:\Windows\System\jMCpYRi.exe
  2⤵
  PID:5208
- C:\Windows\System\IkQvQkM.exe
  C:\Windows\System\IkQvQkM.exe
  2⤵
  PID:5224
- C:\Windows\System\TmGqPia.exe
  C:\Windows\System\TmGqPia.exe
  2⤵
  PID:5244
- C:\Windows\System\UqBpmVy.exe
  C:\Windows\System\UqBpmVy.exe
  2⤵
  PID:5260
- C:\Windows\System\FbmSrPQ.exe
  C:\Windows\System\FbmSrPQ.exe
  2⤵
  PID:5276
- C:\Windows\System\rfsMcnq.exe
  C:\Windows\System\rfsMcnq.exe
  2⤵
  PID:5292
- C:\Windows\System\jPpsmcr.exe
  C:\Windows\System\jPpsmcr.exe
  2⤵
  PID:5312
- C:\Windows\System\vRRQfWO.exe
  C:\Windows\System\vRRQfWO.exe
  2⤵
  PID:5328
- C:\Windows\System\EgHMGdX.exe
  C:\Windows\System\EgHMGdX.exe
  2⤵
  PID:5344
- C:\Windows\System\maQjTfX.exe
  C:\Windows\System\maQjTfX.exe
  2⤵
  PID:5360
- C:\Windows\System\DOdPEVy.exe
  C:\Windows\System\DOdPEVy.exe
  2⤵
  PID:5376
- C:\Windows\System\KHCryEd.exe
  C:\Windows\System\KHCryEd.exe
  2⤵
  PID:5392
- C:\Windows\System\oKDuSuY.exe
  C:\Windows\System\oKDuSuY.exe
  2⤵
  PID:5408
- C:\Windows\System\LrJpKMG.exe
  C:\Windows\System\LrJpKMG.exe
  2⤵
  PID:5424
- C:\Windows\System\mVfjRkC.exe
  C:\Windows\System\mVfjRkC.exe
  2⤵
  PID:5440
- C:\Windows\System\ckCCZYE.exe
  C:\Windows\System\ckCCZYE.exe
  2⤵
  PID:5456
- C:\Windows\System\bRqlbDy.exe
  C:\Windows\System\bRqlbDy.exe
  2⤵
  PID:5472
- C:\Windows\System\pNaDTJB.exe
  C:\Windows\System\pNaDTJB.exe
  2⤵
  PID:5488
- C:\Windows\System\kNPsDTp.exe
  C:\Windows\System\kNPsDTp.exe
  2⤵
  PID:5504
- C:\Windows\System\TMWiTSM.exe
  C:\Windows\System\TMWiTSM.exe
  2⤵
  PID:5532
- C:\Windows\System\FDPLwLI.exe
  C:\Windows\System\FDPLwLI.exe
  2⤵
  PID:5548
- C:\Windows\System\nqbSCby.exe
  C:\Windows\System\nqbSCby.exe
  2⤵
  PID:5564
- C:\Windows\System\bPARAuu.exe
  C:\Windows\System\bPARAuu.exe
  2⤵
  PID:5580
- C:\Windows\System\AFdRubc.exe
  C:\Windows\System\AFdRubc.exe
  2⤵
  PID:5596
- C:\Windows\System\ozlKeeQ.exe
  C:\Windows\System\ozlKeeQ.exe
  2⤵
  PID:5616
- C:\Windows\System\zoflidL.exe
  C:\Windows\System\zoflidL.exe
  2⤵
  PID:5632
- C:\Windows\System\gAtcNoo.exe
  C:\Windows\System\gAtcNoo.exe
  2⤵
  PID:5648
- C:\Windows\System\lmHzmNU.exe
  C:\Windows\System\lmHzmNU.exe
  2⤵
  PID:5664
- C:\Windows\System\uvcDGNV.exe
  C:\Windows\System\uvcDGNV.exe
  2⤵
  PID:5680
- C:\Windows\System\RIfjVdV.exe
  C:\Windows\System\RIfjVdV.exe
  2⤵
  PID:5700
- C:\Windows\System\vzflaxx.exe
  C:\Windows\System\vzflaxx.exe
  2⤵
  PID:5716
- C:\Windows\System\HQCHhxN.exe
  C:\Windows\System\HQCHhxN.exe
  2⤵
  PID:5732
- C:\Windows\System\hFxvPxS.exe
  C:\Windows\System\hFxvPxS.exe
  2⤵
  PID:5748
- C:\Windows\System\iFqKIbW.exe
  C:\Windows\System\iFqKIbW.exe
  2⤵
  PID:5764
- C:\Windows\System\GkMZPqW.exe
  C:\Windows\System\GkMZPqW.exe
  2⤵
  PID:5780
- C:\Windows\System\hWVAzwJ.exe
  C:\Windows\System\hWVAzwJ.exe
  2⤵
  PID:5800
- C:\Windows\System\KbYhbeb.exe
  C:\Windows\System\KbYhbeb.exe
  2⤵
  PID:5816
- C:\Windows\System\DacnXUr.exe
  C:\Windows\System\DacnXUr.exe
  2⤵
  PID:5836
- C:\Windows\System\PLydALH.exe
  C:\Windows\System\PLydALH.exe
  2⤵
  PID:5852
- C:\Windows\System\mCiEPWW.exe
  C:\Windows\System\mCiEPWW.exe
  2⤵
  PID:5868
- C:\Windows\System\AcOrOqN.exe
  C:\Windows\System\AcOrOqN.exe
  2⤵
  PID:5884
- C:\Windows\System\zhaNKGp.exe
  C:\Windows\System\zhaNKGp.exe
  2⤵
  PID:5900
- C:\Windows\System\xDOTdzc.exe
  C:\Windows\System\xDOTdzc.exe
  2⤵
  PID:6060
- C:\Windows\System\BHIyTCU.exe
  C:\Windows\System\BHIyTCU.exe
  2⤵
  PID:6120
- C:\Windows\System\vUKyIop.exe
  C:\Windows\System\vUKyIop.exe
  2⤵
  PID:6140
- C:\Windows\System\IpUrPDg.exe
  C:\Windows\System\IpUrPDg.exe
  2⤵
  PID:5252
- C:\Windows\System\yzpLgGL.exe
  C:\Windows\System\yzpLgGL.exe
  2⤵
  PID:5152
- C:\Windows\System\iVJJrCz.exe
  C:\Windows\System\iVJJrCz.exe
  2⤵
  PID:4048
- C:\Windows\System\FAxiuev.exe
  C:\Windows\System\FAxiuev.exe
  2⤵
  PID:5388
- C:\Windows\System\zpABxuh.exe
  C:\Windows\System\zpABxuh.exe
  2⤵
  PID:5452
- C:\Windows\System\JEmvsSo.exe
  C:\Windows\System\JEmvsSo.exe
  2⤵
  PID:5528
- C:\Windows\System\tsXQtHh.exe
  C:\Windows\System\tsXQtHh.exe
  2⤵
  PID:3892
- C:\Windows\System\nMhQRtw.exe
  C:\Windows\System\nMhQRtw.exe
  2⤵
  PID:5624
- C:\Windows\System\BblGall.exe
  C:\Windows\System\BblGall.exe
  2⤵
  PID:5692
- C:\Windows\System\BbRxEDE.exe
  C:\Windows\System\BbRxEDE.exe
  2⤵
  PID:5760
- C:\Windows\System\BFpxzMA.exe
  C:\Windows\System\BFpxzMA.exe
  2⤵
  PID:5796
- C:\Windows\System\hqjWWIb.exe
  C:\Windows\System\hqjWWIb.exe
  2⤵
  PID:5828
- C:\Windows\System\GqDnqNx.exe
  C:\Windows\System\GqDnqNx.exe
  2⤵
  PID:4824
- C:\Windows\System\zfqgZRr.exe
  C:\Windows\System\zfqgZRr.exe
  2⤵
  PID:4212
- C:\Windows\System\zpzspcz.exe
  C:\Windows\System\zpzspcz.exe
  2⤵
  PID:4332
- C:\Windows\System\xGRRnik.exe
  C:\Windows\System\xGRRnik.exe
  2⤵
  PID:4736
- C:\Windows\System\EzoVHoi.exe
  C:\Windows\System\EzoVHoi.exe
  2⤵
  PID:3420
- C:\Windows\System\jmCmHiQ.exe
  C:\Windows\System\jmCmHiQ.exe
  2⤵
  PID:3160
- C:\Windows\System\FPMfkyn.exe
  C:\Windows\System\FPMfkyn.exe
  2⤵
  PID:5168
- C:\Windows\System\HcsDaGn.exe
  C:\Windows\System\HcsDaGn.exe
  2⤵
  PID:5232
- C:\Windows\System\fZWYRCR.exe
  C:\Windows\System\fZWYRCR.exe
  2⤵
  PID:5300
- C:\Windows\System\fVeYuOI.exe
  C:\Windows\System\fVeYuOI.exe
  2⤵
  PID:5372
- C:\Windows\System\DhyTUCL.exe
  C:\Windows\System\DhyTUCL.exe
  2⤵
  PID:5612
- C:\Windows\System\BFFfMqr.exe
  C:\Windows\System\BFFfMqr.exe
  2⤵
  PID:5708
- C:\Windows\System\YrgtWYR.exe
  C:\Windows\System\YrgtWYR.exe
  2⤵
  PID:5032
- C:\Windows\System\lOtBsCb.exe
  C:\Windows\System\lOtBsCb.exe
  2⤵
  PID:5920
- C:\Windows\System\LUnTgol.exe
  C:\Windows\System\LUnTgol.exe
  2⤵
  PID:5268
- C:\Windows\System\kILMIgs.exe
  C:\Windows\System\kILMIgs.exe
  2⤵
  PID:5304
- C:\Windows\System\dspzncc.exe
  C:\Windows\System\dspzncc.exe
  2⤵
  PID:5908
- C:\Windows\System\OfhVOVq.exe
  C:\Windows\System\OfhVOVq.exe
  2⤵
  PID:6072
- C:\Windows\System\lkQEUCB.exe
  C:\Windows\System\lkQEUCB.exe
  2⤵
  PID:5944
- C:\Windows\System\dHalLvR.exe
  C:\Windows\System\dHalLvR.exe
  2⤵
  PID:5976
- C:\Windows\System\iOMlEzl.exe
  C:\Windows\System\iOMlEzl.exe
  2⤵
  PID:5992
- C:\Windows\System\KcJzuwB.exe
  C:\Windows\System\KcJzuwB.exe
  2⤵
  PID:6008
- C:\Windows\System\wDfpFAv.exe
  C:\Windows\System\wDfpFAv.exe
  2⤵
  PID:5500
- C:\Windows\System\SeRdTNI.exe
  C:\Windows\System\SeRdTNI.exe
  2⤵
  PID:6024
- C:\Windows\System\NdKcnzz.exe
  C:\Windows\System\NdKcnzz.exe
  2⤵
  PID:6040
- C:\Windows\System\KzTEPzf.exe
  C:\Windows\System\KzTEPzf.exe
  2⤵
  PID:6056
- C:\Windows\System\ihZPMhS.exe
  C:\Windows\System\ihZPMhS.exe
  2⤵
  PID:5464
- C:\Windows\System\ziuHdUq.exe
  C:\Windows\System\ziuHdUq.exe
  2⤵
  PID:6092
- C:\Windows\System\WNYXwfn.exe
  C:\Windows\System\WNYXwfn.exe
  2⤵
  PID:6108
- C:\Windows\System\VaabRdz.exe
  C:\Windows\System\VaabRdz.exe
  2⤵
  PID:6128
- C:\Windows\System\xtbybSV.exe
  C:\Windows\System\xtbybSV.exe
  2⤵
  PID:5048
- C:\Windows\System\kjGWFCY.exe
  C:\Windows\System\kjGWFCY.exe
  2⤵
  PID:5420
- C:\Windows\System\wtoGOfO.exe
  C:\Windows\System\wtoGOfO.exe
  2⤵
  PID:5560
- C:\Windows\System\DibPtlk.exe
  C:\Windows\System\DibPtlk.exe
  2⤵
  PID:5788
- C:\Windows\System\MrbquIt.exe
  C:\Windows\System\MrbquIt.exe
  2⤵
  PID:4376
- C:\Windows\System\cojwbTo.exe
  C:\Windows\System\cojwbTo.exe
  2⤵
  PID:5240
- C:\Windows\System\HXHhsMk.exe
  C:\Windows\System\HXHhsMk.exe
  2⤵
  PID:5740
- C:\Windows\System\pepWmtq.exe
  C:\Windows\System\pepWmtq.exe
  2⤵
  PID:5948
- C:\Windows\System\nDqyhFB.exe
  C:\Windows\System\nDqyhFB.exe
  2⤵
  PID:5356
- C:\Windows\System\iYZGvCu.exe
  C:\Windows\System\iYZGvCu.exe
  2⤵
  PID:5812
- C:\Windows\System\YmnNYjv.exe
  C:\Windows\System\YmnNYjv.exe
  2⤵
  PID:5880
- C:\Windows\System\FwfkDwZ.exe
  C:\Windows\System\FwfkDwZ.exe
  2⤵
  PID:5964
- C:\Windows\System\vOeKJDb.exe
  C:\Windows\System\vOeKJDb.exe
  2⤵
  PID:5980
- C:\Windows\System\gZCFXaW.exe
  C:\Windows\System\gZCFXaW.exe
  2⤵
  PID:6104
- C:\Windows\System\NNHenOp.exe
  C:\Windows\System\NNHenOp.exe
  2⤵
  PID:5932
- C:\Windows\System\PENpGXT.exe
  C:\Windows\System\PENpGXT.exe
  2⤵
  PID:4420
- C:\Windows\System\CvZFaIz.exe
  C:\Windows\System\CvZFaIz.exe
  2⤵
  PID:5972
- C:\Windows\System\sJCascb.exe
  C:\Windows\System\sJCascb.exe
  2⤵
  PID:4996
- C:\Windows\System\fVbKMOI.exe
  C:\Windows\System\fVbKMOI.exe
  2⤵
  PID:5592
- C:\Windows\System\pzYDdDT.exe
  C:\Windows\System\pzYDdDT.exe
  2⤵
  PID:5516
- C:\Windows\System\STYcvkn.exe
  C:\Windows\System\STYcvkn.exe
  2⤵
  PID:5076
- C:\Windows\System\VLjmLQI.exe
  C:\Windows\System\VLjmLQI.exe
  2⤵
  PID:5112
- C:\Windows\System\iCQPypt.exe
  C:\Windows\System\iCQPypt.exe
  2⤵
  PID:5200
- C:\Windows\System\TBwzSeA.exe
  C:\Windows\System\TBwzSeA.exe
  2⤵
  PID:5672
- C:\Windows\System\URVnLkm.exe
  C:\Windows\System\URVnLkm.exe
  2⤵
  PID:5400
- C:\Windows\System\anTIRUA.exe
  C:\Windows\System\anTIRUA.exe
  2⤵
  PID:5220
- C:\Windows\System\puoxlBX.exe
  C:\Windows\System\puoxlBX.exe
  2⤵
  PID:5952
- C:\Windows\System\nvjGVIW.exe
  C:\Windows\System\nvjGVIW.exe
  2⤵
  PID:6016
- C:\Windows\System\cuaxyhE.exe
  C:\Windows\System\cuaxyhE.exe
  2⤵
  PID:6084
- C:\Windows\System\ofzKKXq.exe
  C:\Windows\System\ofzKKXq.exe
  2⤵
  PID:3176
- C:\Windows\System\xNoALqK.exe
  C:\Windows\System\xNoALqK.exe
  2⤵
  PID:5696
- C:\Windows\System\aavSFnl.exe
  C:\Windows\System\aavSFnl.exe
  2⤵
  PID:5608
- C:\Windows\System\ubcbuaz.exe
  C:\Windows\System\ubcbuaz.exe
  2⤵
  PID:5524
- C:\Windows\System\IPoqRCE.exe
  C:\Windows\System\IPoqRCE.exe
  2⤵
  PID:4208
- C:\Windows\System\bCxdYKa.exe
  C:\Windows\System\bCxdYKa.exe
  2⤵
  PID:5916
- C:\Windows\System\rgGmYLO.exe
  C:\Windows\System\rgGmYLO.exe
  2⤵
  PID:5848
- C:\Windows\System\XJlBkLi.exe
  C:\Windows\System\XJlBkLi.exe
  2⤵
  PID:5484
- C:\Windows\System\UaNLqjI.exe
  C:\Windows\System\UaNLqjI.exe
  2⤵
  PID:5540
- C:\Windows\System\FvUuslG.exe
  C:\Windows\System\FvUuslG.exe
  2⤵
  PID:6152
- C:\Windows\System\KsEMVyT.exe
  C:\Windows\System\KsEMVyT.exe
  2⤵
  PID:6180
- C:\Windows\System\YeeZTvn.exe
  C:\Windows\System\YeeZTvn.exe
  2⤵
  PID:6200
- C:\Windows\System\ZyRhsTL.exe
  C:\Windows\System\ZyRhsTL.exe
  2⤵
  PID:6216
- C:\Windows\System\kuibWrC.exe
  C:\Windows\System\kuibWrC.exe
  2⤵
  PID:6232
- C:\Windows\System\pKFbfpE.exe
  C:\Windows\System\pKFbfpE.exe
  2⤵
  PID:6248
- C:\Windows\System\IOqxjMZ.exe
  C:\Windows\System\IOqxjMZ.exe
  2⤵
  PID:6264
- C:\Windows\System\OPyisAJ.exe
  C:\Windows\System\OPyisAJ.exe
  2⤵
  PID:6280
- C:\Windows\System\EZNeobX.exe
  C:\Windows\System\EZNeobX.exe
  2⤵
  PID:6300
- C:\Windows\System\YXLBZXv.exe
  C:\Windows\System\YXLBZXv.exe
  2⤵
  PID:6316
- C:\Windows\System\sMAxpZk.exe
  C:\Windows\System\sMAxpZk.exe
  2⤵
  PID:6332
- C:\Windows\System\ULqSzdX.exe
  C:\Windows\System\ULqSzdX.exe
  2⤵
  PID:6352
- C:\Windows\System\VZMZboB.exe
  C:\Windows\System\VZMZboB.exe
  2⤵
  PID:6368
- C:\Windows\System\MXNKpCP.exe
  C:\Windows\System\MXNKpCP.exe
  2⤵
  PID:6384
- C:\Windows\System\XUOMyoT.exe
  C:\Windows\System\XUOMyoT.exe
  2⤵
  PID:6400
- C:\Windows\System\cJsaUrt.exe
  C:\Windows\System\cJsaUrt.exe
  2⤵
  PID:6416
- C:\Windows\System\LQTaYGX.exe
  C:\Windows\System\LQTaYGX.exe
  2⤵
  PID:6436
- C:\Windows\System\YUlotDI.exe
  C:\Windows\System\YUlotDI.exe
  2⤵
  PID:6452
- C:\Windows\System\xwrtJYq.exe
  C:\Windows\System\xwrtJYq.exe
  2⤵
  PID:6468
- C:\Windows\System\pEtUcrQ.exe
  C:\Windows\System\pEtUcrQ.exe
  2⤵
  PID:6484
- C:\Windows\System\SCVIvAB.exe
  C:\Windows\System\SCVIvAB.exe
  2⤵
  PID:6500
- C:\Windows\System\QokXJHC.exe
  C:\Windows\System\QokXJHC.exe
  2⤵
  PID:6520
- C:\Windows\System\VsxoaJv.exe
  C:\Windows\System\VsxoaJv.exe
  2⤵
  PID:6536
- C:\Windows\System\yNsEKbM.exe
  C:\Windows\System\yNsEKbM.exe
  2⤵
  PID:6552
- C:\Windows\System\QGJvDVH.exe
  C:\Windows\System\QGJvDVH.exe
  2⤵
  PID:6568
- C:\Windows\System\YOzrZVU.exe
  C:\Windows\System\YOzrZVU.exe
  2⤵
  PID:6584
- C:\Windows\System\DlrFYnS.exe
  C:\Windows\System\DlrFYnS.exe
  2⤵
  PID:6608
- C:\Windows\System\itaCiqv.exe
  C:\Windows\System\itaCiqv.exe
  2⤵
  PID:6624
- C:\Windows\System\VfSlKXx.exe
  C:\Windows\System\VfSlKXx.exe
  2⤵
  PID:6640
- C:\Windows\System\MbpDWbq.exe
  C:\Windows\System\MbpDWbq.exe
  2⤵
  PID:6656
- C:\Windows\System\yDfMDfT.exe
  C:\Windows\System\yDfMDfT.exe
  2⤵
  PID:6672
- C:\Windows\System\obgmMDm.exe
  C:\Windows\System\obgmMDm.exe
  2⤵
  PID:6688
- C:\Windows\System\LUniRMN.exe
  C:\Windows\System\LUniRMN.exe
  2⤵
  PID:6704
- C:\Windows\System\NqcIZBD.exe
  C:\Windows\System\NqcIZBD.exe
  2⤵
  PID:6724
- C:\Windows\System\onAbnAh.exe
  C:\Windows\System\onAbnAh.exe
  2⤵
  PID:6744
- C:\Windows\System\udMuNLt.exe
  C:\Windows\System\udMuNLt.exe
  2⤵
  PID:6760
- C:\Windows\System\bMSzomd.exe
  C:\Windows\System\bMSzomd.exe
  2⤵
  PID:6776
- C:\Windows\System\THzWkWK.exe
  C:\Windows\System\THzWkWK.exe
  2⤵
  PID:6792
- C:\Windows\System\gJigJXL.exe
  C:\Windows\System\gJigJXL.exe
  2⤵
  PID:6808
- C:\Windows\System\ojCinVB.exe
  C:\Windows\System\ojCinVB.exe
  2⤵
  PID:6824
- C:\Windows\System\nHORlVW.exe
  C:\Windows\System\nHORlVW.exe
  2⤵
  PID:6844
- C:\Windows\System\pECMnCP.exe
  C:\Windows\System\pECMnCP.exe
  2⤵
  PID:6860
- C:\Windows\System\jiPLgAc.exe
  C:\Windows\System\jiPLgAc.exe
  2⤵
  PID:6880
- C:\Windows\System\rBhpEyX.exe
  C:\Windows\System\rBhpEyX.exe
  2⤵
  PID:6896
- C:\Windows\System\cRXFNtD.exe
  C:\Windows\System\cRXFNtD.exe
  2⤵
  PID:6912
- C:\Windows\System\xaSCfov.exe
  C:\Windows\System\xaSCfov.exe
  2⤵
  PID:6928
- C:\Windows\System\OiwvRik.exe
  C:\Windows\System\OiwvRik.exe
  2⤵
  PID:6948
- C:\Windows\System\oIlQZDa.exe
  C:\Windows\System\oIlQZDa.exe
  2⤵
  PID:6964
- C:\Windows\System\TZTQyPj.exe
  C:\Windows\System\TZTQyPj.exe
  2⤵
  PID:6988
- C:\Windows\System\eHhJTsK.exe
  C:\Windows\System\eHhJTsK.exe
  2⤵
  PID:7004
- C:\Windows\System\bqcWTsF.exe
  C:\Windows\System\bqcWTsF.exe
  2⤵
  PID:7024
- C:\Windows\System\SZgRwzb.exe
  C:\Windows\System\SZgRwzb.exe
  2⤵
  PID:7040
- C:\Windows\System\crVLgfR.exe
  C:\Windows\System\crVLgfR.exe
  2⤵
  PID:7060
- C:\Windows\System\AxoRzmz.exe
  C:\Windows\System\AxoRzmz.exe
  2⤵
  PID:7076
- C:\Windows\System\GLRBxDq.exe
  C:\Windows\System\GLRBxDq.exe
  2⤵
  PID:7092
- C:\Windows\System\ePoGGbM.exe
  C:\Windows\System\ePoGGbM.exe
  2⤵
  PID:7112
- C:\Windows\System\ZmezIsx.exe
  C:\Windows\System\ZmezIsx.exe
  2⤵
  PID:7128
- C:\Windows\System\sGHVNxq.exe
  C:\Windows\System\sGHVNxq.exe
  2⤵
  PID:7148
- C:\Windows\System\VelXITq.exe
  C:\Windows\System\VelXITq.exe
  2⤵
  PID:7164
- C:\Windows\System\uaBiyBs.exe
  C:\Windows\System\uaBiyBs.exe
  2⤵
  PID:5496
- C:\Windows\System\NiQFtOw.exe
  C:\Windows\System\NiQFtOw.exe
  2⤵
  PID:5860
- C:\Windows\System\iwOfEtj.exe
  C:\Windows\System\iwOfEtj.exe
  2⤵
  PID:6224
- C:\Windows\System\XlLdLzM.exe
  C:\Windows\System\XlLdLzM.exe
  2⤵
  PID:6288
- C:\Windows\System\QGvCcjN.exe
  C:\Windows\System\QGvCcjN.exe
  2⤵
  PID:6328
- C:\Windows\System\texzBkk.exe
  C:\Windows\System\texzBkk.exe
  2⤵
  PID:5876
- C:\Windows\System\qSRzOBu.exe
  C:\Windows\System\qSRzOBu.exe
  2⤵
  PID:6496
- C:\Windows\System\LKXEVzb.exe
  C:\Windows\System\LKXEVzb.exe
  2⤵
  PID:6160
- C:\Windows\System\LTaaUpU.exe
  C:\Windows\System\LTaaUpU.exe
  2⤵
  PID:6528
- C:\Windows\System\VYsvJXv.exe
  C:\Windows\System\VYsvJXv.exe
  2⤵
  PID:6208
- C:\Windows\System\XeJNRSC.exe
  C:\Windows\System\XeJNRSC.exe
  2⤵
  PID:6592
- C:\Windows\System\dSKWnCf.exe
  C:\Windows\System\dSKWnCf.exe
  2⤵
  PID:6344
- C:\Windows\System\dWpyfEM.exe
  C:\Windows\System\dWpyfEM.exe
  2⤵
  PID:6544
- C:\Windows\System\PnieICu.exe
  C:\Windows\System\PnieICu.exe
  2⤵
  PID:6448
- C:\Windows\System\AkzSWrv.exe
  C:\Windows\System\AkzSWrv.exe
  2⤵
  PID:6516
- C:\Windows\System\NJeMRwD.exe
  C:\Windows\System\NJeMRwD.exe
  2⤵
  PID:6580
- C:\Windows\System\fMOlHZs.exe
  C:\Windows\System\fMOlHZs.exe
  2⤵
  PID:6668
- C:\Windows\System\LEZoKuL.exe
  C:\Windows\System\LEZoKuL.exe
  2⤵
  PID:6736
- C:\Windows\System\tthLtnj.exe
  C:\Windows\System\tthLtnj.exe
  2⤵
  PID:6868
- C:\Windows\System\VmckCLr.exe
  C:\Windows\System\VmckCLr.exe
  2⤵
  PID:6936
- C:\Windows\System\fckdfBC.exe
  C:\Windows\System\fckdfBC.exe
  2⤵
  PID:6944
- C:\Windows\System\sYrdxXq.exe
  C:\Windows\System\sYrdxXq.exe
  2⤵
  PID:6856
- C:\Windows\System\nFvzEIY.exe
  C:\Windows\System\nFvzEIY.exe
  2⤵
  PID:6788
- C:\Windows\System\HNETsFa.exe
  C:\Windows\System\HNETsFa.exe
  2⤵
  PID:6720
- C:\Windows\System\yyUvmyK.exe
  C:\Windows\System\yyUvmyK.exe
  2⤵
  PID:6680
- C:\Windows\System\bLdExDb.exe
  C:\Windows\System\bLdExDb.exe
  2⤵
  PID:6972
- C:\Windows\System\NYFmYTk.exe
  C:\Windows\System\NYFmYTk.exe
  2⤵
  PID:6956
- C:\Windows\System\yaMsWWh.exe
  C:\Windows\System\yaMsWWh.exe
  2⤵
  PID:7052
- C:\Windows\System\fBsqSNC.exe
  C:\Windows\System\fBsqSNC.exe
  2⤵
  PID:7120
- C:\Windows\System\MCxvnXS.exe
  C:\Windows\System\MCxvnXS.exe
  2⤵
  PID:7156
- C:\Windows\System\pWCsYRl.exe
  C:\Windows\System\pWCsYRl.exe
  2⤵
  PID:7016
- C:\Windows\System\PipRDLD.exe
  C:\Windows\System\PipRDLD.exe
  2⤵
  PID:7000
- C:\Windows\System\LurVLXE.exe
  C:\Windows\System\LurVLXE.exe
  2⤵
  PID:7072
- C:\Windows\System\kmDCEOZ.exe
  C:\Windows\System\kmDCEOZ.exe
  2⤵
  PID:6256
- C:\Windows\System\JeXmwVu.exe
  C:\Windows\System\JeXmwVu.exe
  2⤵
  PID:5324
- C:\Windows\System\zaIeBXM.exe
  C:\Windows\System\zaIeBXM.exe
  2⤵
  PID:6296
- C:\Windows\System\RJcubuB.exe
  C:\Windows\System\RJcubuB.exe
  2⤵
  PID:5164
- C:\Windows\System\HUYzfsQ.exe
  C:\Windows\System\HUYzfsQ.exe
  2⤵
  PID:6324
- C:\Windows\System\pTSNwPY.exe
  C:\Windows\System\pTSNwPY.exe
  2⤵
  PID:6172
- C:\Windows\System\GfgNxtR.exe
  C:\Windows\System\GfgNxtR.exe
  2⤵
  PID:6428
- C:\Windows\System\lpsNnqp.exe
  C:\Windows\System\lpsNnqp.exe
  2⤵
  PID:6492
- C:\Windows\System\rzHmYza.exe
  C:\Windows\System\rzHmYza.exe
  2⤵
  PID:6380
- C:\Windows\System\NADHuVZ.exe
  C:\Windows\System\NADHuVZ.exe
  2⤵
  PID:6412
- C:\Windows\System\ISKFRsh.exe
  C:\Windows\System\ISKFRsh.exe
  2⤵
  PID:6732
- C:\Windows\System\ZmZROuY.exe
  C:\Windows\System\ZmZROuY.exe
  2⤵
  PID:6800
- C:\Windows\System\kAwzPMJ.exe
  C:\Windows\System\kAwzPMJ.exe
  2⤵
  PID:7012
- C:\Windows\System\PetfDTP.exe
  C:\Windows\System\PetfDTP.exe
  2⤵
  PID:7160
- C:\Windows\System\alKjCCh.exe
  C:\Windows\System\alKjCCh.exe
  2⤵
  PID:5340
- C:\Windows\System\uAVftRl.exe
  C:\Windows\System\uAVftRl.exe
  2⤵
  PID:7108
- C:\Windows\System\qmWBNrb.exe
  C:\Windows\System\qmWBNrb.exe
  2⤵
  PID:7140
- C:\Windows\System\nMgNlCO.exe
  C:\Windows\System\nMgNlCO.exe
  2⤵
  PID:4572
- C:\Windows\System\VTQpnxz.exe
  C:\Windows\System\VTQpnxz.exe
  2⤵
  PID:6740
- C:\Windows\System\BJOEWld.exe
  C:\Windows\System\BJOEWld.exe
  2⤵
  PID:7036
- C:\Windows\System\LOrXPJc.exe
  C:\Windows\System\LOrXPJc.exe
  2⤵
  PID:6872
- C:\Windows\System\lpMlwBH.exe
  C:\Windows\System\lpMlwBH.exe
  2⤵
  PID:6892
- C:\Windows\System\XTxSZzM.exe
  C:\Windows\System\XTxSZzM.exe
  2⤵
  PID:4804
- C:\Windows\System\JyqWlWM.exe
  C:\Windows\System\JyqWlWM.exe
  2⤵
  PID:5544
- C:\Windows\System\koZvmMI.exe
  C:\Windows\System\koZvmMI.exe
  2⤵
  PID:6560
- C:\Windows\System\liEwzhx.exe
  C:\Windows\System\liEwzhx.exe
  2⤵
  PID:6080
- C:\Windows\System\DiRNhCl.exe
  C:\Windows\System\DiRNhCl.exe
  2⤵
  PID:6340
- C:\Windows\System\dPDTmrG.exe
  C:\Windows\System\dPDTmrG.exe
  2⤵
  PID:6976
- C:\Windows\System\zVpNzyC.exe
  C:\Windows\System\zVpNzyC.exe
  2⤵
  PID:6196
- C:\Windows\System\jnYpgqn.exe
  C:\Windows\System\jnYpgqn.exe
  2⤵
  PID:7104
- C:\Windows\System\ldEYJiZ.exe
  C:\Windows\System\ldEYJiZ.exe
  2⤵
  PID:6396
- C:\Windows\System\TFthEAS.exe
  C:\Windows\System\TFthEAS.exe
  2⤵
  PID:6508
- C:\Windows\System\QTaaNEx.exe
  C:\Windows\System\QTaaNEx.exe
  2⤵
  PID:6636
- C:\Windows\System\FiiMUfX.exe
  C:\Windows\System\FiiMUfX.exe
  2⤵
  PID:6920
- C:\Windows\System\inpRcvc.exe
  C:\Windows\System\inpRcvc.exe
  2⤵
  PID:6148
- C:\Windows\System\mzDrxhK.exe
  C:\Windows\System\mzDrxhK.exe
  2⤵
  PID:7084
- C:\Windows\System\kzNMsis.exe
  C:\Windows\System\kzNMsis.exe
  2⤵
  PID:6600
- C:\Windows\System\qdAISye.exe
  C:\Windows\System\qdAISye.exe
  2⤵
  PID:6176
- C:\Windows\System\YmTqrmE.exe
  C:\Windows\System\YmTqrmE.exe
  2⤵
  PID:6752
- C:\Windows\System\oGczZQc.exe
  C:\Windows\System\oGczZQc.exe
  2⤵
  PID:4576
- C:\Windows\System\EnwBQVl.exe
  C:\Windows\System\EnwBQVl.exe
  2⤵
  PID:5824
- C:\Windows\System\cBduTjG.exe
  C:\Windows\System\cBduTjG.exe
  2⤵
  PID:6648
- C:\Windows\System\ZJnHIdS.exe
  C:\Windows\System\ZJnHIdS.exe
  2⤵
  PID:6712
- C:\Windows\System\kVODGvn.exe
  C:\Windows\System\kVODGvn.exe
  2⤵
  PID:6376
- C:\Windows\System\ZXuqlxI.exe
  C:\Windows\System\ZXuqlxI.exe
  2⤵
  PID:5628
- C:\Windows\System\mOdkCCb.exe
  C:\Windows\System\mOdkCCb.exe
  2⤵
  PID:5136
- C:\Windows\System\dGXgTmm.exe
  C:\Windows\System\dGXgTmm.exe
  2⤵
  PID:7180
- C:\Windows\System\lUuTgTj.exe
  C:\Windows\System\lUuTgTj.exe
  2⤵
  PID:7196
- C:\Windows\System\BzItfrI.exe
  C:\Windows\System\BzItfrI.exe
  2⤵
  PID:7212
- C:\Windows\System\xapMONp.exe
  C:\Windows\System\xapMONp.exe
  2⤵
  PID:7228
- C:\Windows\System\xXjgXyd.exe
  C:\Windows\System\xXjgXyd.exe
  2⤵
  PID:7244
- C:\Windows\System\cvNlKyv.exe
  C:\Windows\System\cvNlKyv.exe
  2⤵
  PID:7264
- C:\Windows\System\MjrBWEE.exe
  C:\Windows\System\MjrBWEE.exe
  2⤵
  PID:7280
- C:\Windows\System\vesTmdP.exe
  C:\Windows\System\vesTmdP.exe
  2⤵
  PID:7296
- C:\Windows\System\KyYjOud.exe
  C:\Windows\System\KyYjOud.exe
  2⤵
  PID:7312
- C:\Windows\System\Gywulam.exe
  C:\Windows\System\Gywulam.exe
  2⤵
  PID:7452
- C:\Windows\System\mtoHClq.exe
  C:\Windows\System\mtoHClq.exe
  2⤵
  PID:7468
- C:\Windows\System\AGWwYML.exe
  C:\Windows\System\AGWwYML.exe
  2⤵
  PID:7484
- C:\Windows\System\rCrMerq.exe
  C:\Windows\System\rCrMerq.exe
  2⤵
  PID:7500
- C:\Windows\System\xdZSBRo.exe
  C:\Windows\System\xdZSBRo.exe
  2⤵
  PID:7520
- C:\Windows\System\cQSfwqG.exe
  C:\Windows\System\cQSfwqG.exe
  2⤵
  PID:7536
- C:\Windows\System\GnDLvvy.exe
  C:\Windows\System\GnDLvvy.exe
  2⤵
  PID:7556
- C:\Windows\System\bfFfmVw.exe
  C:\Windows\System\bfFfmVw.exe
  2⤵
  PID:7572
- C:\Windows\System\EesUqNW.exe
  C:\Windows\System\EesUqNW.exe
  2⤵
  PID:7588
- C:\Windows\System\chCsucR.exe
  C:\Windows\System\chCsucR.exe
  2⤵
  PID:7604
- C:\Windows\System\xQRsAYk.exe
  C:\Windows\System\xQRsAYk.exe
  2⤵
  PID:7624
- C:\Windows\System\XUwMwMj.exe
  C:\Windows\System\XUwMwMj.exe
  2⤵
  PID:7640
- C:\Windows\System\zZZsmMU.exe
  C:\Windows\System\zZZsmMU.exe
  2⤵
  PID:7656
- C:\Windows\System\RTRHupV.exe
  C:\Windows\System\RTRHupV.exe
  2⤵
  PID:7672
- C:\Windows\System\yIKzFwW.exe
  C:\Windows\System\yIKzFwW.exe
  2⤵
  PID:7688
- C:\Windows\System\JDuReVu.exe
  C:\Windows\System\JDuReVu.exe
  2⤵
  PID:7704
- C:\Windows\System\ncLnzZo.exe
  C:\Windows\System\ncLnzZo.exe
  2⤵
  PID:7720
- C:\Windows\System\cyWnWiH.exe
  C:\Windows\System\cyWnWiH.exe
  2⤵
  PID:7740
- C:\Windows\System\Fwztdoe.exe
  C:\Windows\System\Fwztdoe.exe
  2⤵
  PID:7764
- C:\Windows\System\gKDGrJJ.exe
  C:\Windows\System\gKDGrJJ.exe
  2⤵
  PID:7780
- C:\Windows\System\HuNZjuH.exe
  C:\Windows\System\HuNZjuH.exe
  2⤵
  PID:7796
- C:\Windows\System\zTHAHgZ.exe
  C:\Windows\System\zTHAHgZ.exe
  2⤵
  PID:7812
- C:\Windows\System\bIzdiDr.exe
  C:\Windows\System\bIzdiDr.exe
  2⤵
  PID:7832
- C:\Windows\System\SogAuzm.exe
  C:\Windows\System\SogAuzm.exe
  2⤵
  PID:7848
- C:\Windows\System\rJRhnll.exe
  C:\Windows\System\rJRhnll.exe
  2⤵
  PID:7864
- C:\Windows\System\FfauhTj.exe
  C:\Windows\System\FfauhTj.exe
  2⤵
  PID:7880
- C:\Windows\System\ZEHkNEL.exe
  C:\Windows\System\ZEHkNEL.exe
  2⤵
  PID:7900
- C:\Windows\System\vMQWfFk.exe
  C:\Windows\System\vMQWfFk.exe
  2⤵
  PID:7916
- C:\Windows\System\iSRJrlM.exe
  C:\Windows\System\iSRJrlM.exe
  2⤵
  PID:7932
- C:\Windows\System\SGeHeJn.exe
  C:\Windows\System\SGeHeJn.exe
  2⤵
  PID:7948
- C:\Windows\System\CdeaDgM.exe
  C:\Windows\System\CdeaDgM.exe
  2⤵
  PID:7964
- C:\Windows\System\JhDBrhA.exe
  C:\Windows\System\JhDBrhA.exe
  2⤵
  PID:7980
- C:\Windows\System\XhTrDCv.exe
  C:\Windows\System\XhTrDCv.exe
  2⤵
  PID:8000
- C:\Windows\System\BLnAzrq.exe
  C:\Windows\System\BLnAzrq.exe
  2⤵
  PID:8016
- C:\Windows\System\kSmSIVS.exe
  C:\Windows\System\kSmSIVS.exe
  2⤵
  PID:8032
- C:\Windows\System\zHgZOdv.exe
  C:\Windows\System\zHgZOdv.exe
  2⤵
  PID:8048
- C:\Windows\System\hMsywQY.exe
  C:\Windows\System\hMsywQY.exe
  2⤵
  PID:8064
- C:\Windows\System\RHgSLtF.exe
  C:\Windows\System\RHgSLtF.exe
  2⤵
  PID:8084
- C:\Windows\System\TcAvulA.exe
  C:\Windows\System\TcAvulA.exe
  2⤵
  PID:8100
- C:\Windows\System\yVNbhgg.exe
  C:\Windows\System\yVNbhgg.exe
  2⤵
  PID:8116
- C:\Windows\System\LxGosYq.exe
  C:\Windows\System\LxGosYq.exe
  2⤵
  PID:8132
- C:\Windows\System\lwyhcVf.exe
  C:\Windows\System\lwyhcVf.exe
  2⤵
  PID:8152
- C:\Windows\System\OHzkCzs.exe
  C:\Windows\System\OHzkCzs.exe
  2⤵
  PID:8168
- C:\Windows\System\AwrEaYd.exe
  C:\Windows\System\AwrEaYd.exe
  2⤵
  PID:8184
- C:\Windows\System\YRFpBWz.exe
  C:\Windows\System\YRFpBWz.exe
  2⤵
  PID:7176
- C:\Windows\System\SjWAvmn.exe
  C:\Windows\System\SjWAvmn.exe
  2⤵
  PID:7236
- C:\Windows\System\gklLlWN.exe
  C:\Windows\System\gklLlWN.exe
  2⤵
  PID:7188
- C:\Windows\System\WDckTQo.exe
  C:\Windows\System\WDckTQo.exe
  2⤵
  PID:6032
- C:\Windows\System\HAprrDu.exe
  C:\Windows\System\HAprrDu.exe
  2⤵
  PID:7220
- C:\Windows\System\buugySq.exe
  C:\Windows\System\buugySq.exe
  2⤵
  PID:7308
- C:\Windows\System\IixPXBs.exe
  C:\Windows\System\IixPXBs.exe
  2⤵
  PID:7384
- C:\Windows\System\MSLAOFH.exe
  C:\Windows\System\MSLAOFH.exe
  2⤵
  PID:7396
- C:\Windows\System\EhdTHgG.exe
  C:\Windows\System\EhdTHgG.exe
  2⤵
  PID:7416
- C:\Windows\System\GZfyrmk.exe
  C:\Windows\System\GZfyrmk.exe
  2⤵
  PID:7432
- C:\Windows\System\gomZIPP.exe
  C:\Windows\System\gomZIPP.exe
  2⤵
  PID:7460
- C:\Windows\System\xEeSFqB.exe
  C:\Windows\System\xEeSFqB.exe
  2⤵
  PID:7528
- C:\Windows\System\Cfqtrxw.exe
  C:\Windows\System\Cfqtrxw.exe
  2⤵
  PID:7596
- C:\Windows\System\ZXqQIzu.exe
  C:\Windows\System\ZXqQIzu.exe
  2⤵
  PID:7636
- C:\Windows\System\syBYBjw.exe
  C:\Windows\System\syBYBjw.exe
  2⤵
  PID:7548
- C:\Windows\System\JCRgNqV.exe
  C:\Windows\System\JCRgNqV.exe
  2⤵
  PID:7664
- C:\Windows\System\GrJDEFE.exe
  C:\Windows\System\GrJDEFE.exe
  2⤵
  PID:7668
- C:\Windows\System\rNqwVdY.exe
  C:\Windows\System\rNqwVdY.exe
  2⤵
  PID:7620
- C:\Windows\System\pbimjPP.exe
  C:\Windows\System\pbimjPP.exe
  2⤵
  PID:7648
- C:\Windows\System\qMGsTpI.exe
  C:\Windows\System\qMGsTpI.exe
  2⤵
  PID:7752
- C:\Windows\System\OMAEKbU.exe
  C:\Windows\System\OMAEKbU.exe
  2⤵
  PID:7684
- C:\Windows\System\GQlPvWw.exe
  C:\Windows\System\GQlPvWw.exe
  2⤵
  PID:7840
- C:\Windows\System\Pyzylqp.exe
  C:\Windows\System\Pyzylqp.exe
  2⤵
  PID:7748
- C:\Windows\System\rpHskVR.exe
  C:\Windows\System\rpHskVR.exe
  2⤵
  PID:7944
- C:\Windows\System\DjZUfIe.exe
  C:\Windows\System\DjZUfIe.exe
  2⤵
  PID:8008
- C:\Windows\System\DBTuXxc.exe
  C:\Windows\System\DBTuXxc.exe
  2⤵
  PID:7856
- C:\Windows\System\RplENkc.exe
  C:\Windows\System\RplENkc.exe
  2⤵
  PID:7892
- C:\Windows\System\QxsrYql.exe
  C:\Windows\System\QxsrYql.exe
  2⤵
  PID:8080
- C:\Windows\System\gItzGTH.exe
  C:\Windows\System\gItzGTH.exe
  2⤵
  PID:7896
- C:\Windows\System\klaojQd.exe
  C:\Windows\System\klaojQd.exe
  2⤵
  PID:7960
- C:\Windows\System\YszDMgh.exe
  C:\Windows\System\YszDMgh.exe
  2⤵
  PID:8176
- C:\Windows\System\DgQSJpo.exe
  C:\Windows\System\DgQSJpo.exe
  2⤵
  PID:8128
- C:\Windows\System\SVgfckL.exe
  C:\Windows\System\SVgfckL.exe
  2⤵
  PID:8060
- C:\Windows\System\vQCzjjh.exe
  C:\Windows\System\vQCzjjh.exe
  2⤵
  PID:6908
- C:\Windows\System\NmQqGLz.exe
  C:\Windows\System\NmQqGLz.exe
  2⤵
  PID:1556
- C:\Windows\System\SFfvaEG.exe
  C:\Windows\System\SFfvaEG.exe
  2⤵
  PID:7192
- C:\Windows\System\wxHOTIB.exe
  C:\Windows\System\wxHOTIB.exe
  2⤵
  PID:7392
- C:\Windows\System\ahIBXJB.exe
  C:\Windows\System\ahIBXJB.exe
  2⤵
  PID:7400
- C:\Windows\System\BqTmKQJ.exe
  C:\Windows\System\BqTmKQJ.exe
  2⤵
  PID:7492
- C:\Windows\System\GFTCavI.exe
  C:\Windows\System\GFTCavI.exe
  2⤵
  PID:7508
- C:\Windows\System\WSDMchm.exe
  C:\Windows\System\WSDMchm.exe
  2⤵
  PID:7700
- C:\Windows\System\SBWCnpc.exe
  C:\Windows\System\SBWCnpc.exe
  2⤵
  PID:7804
- C:\Windows\System\YyGMhRM.exe
  C:\Windows\System\YyGMhRM.exe
  2⤵
  PID:7480
- C:\Windows\System\yIoPqXz.exe
  C:\Windows\System\yIoPqXz.exe
  2⤵
  PID:7736
- C:\Windows\System\YFdeaOc.exe
  C:\Windows\System\YFdeaOc.exe
  2⤵
  PID:7808
- C:\Windows\System\NtcuDuT.exe
  C:\Windows\System\NtcuDuT.exe
  2⤵
  PID:7872
- C:\Windows\System\uTRqmry.exe
  C:\Windows\System\uTRqmry.exe
  2⤵
  PID:8012
- C:\Windows\System\YehYnpE.exe
  C:\Windows\System\YehYnpE.exe
  2⤵
  PID:7888
- C:\Windows\System\UYanqAL.exe
  C:\Windows\System\UYanqAL.exe
  2⤵
  PID:8200
- C:\Windows\System\BNWeJhY.exe
  C:\Windows\System\BNWeJhY.exe
  2⤵
  PID:8216
- C:\Windows\System\YtlByOi.exe
  C:\Windows\System\YtlByOi.exe
  2⤵
  PID:8256
- C:\Windows\System\kswMUNr.exe
  C:\Windows\System\kswMUNr.exe
  2⤵
  PID:8272
- C:\Windows\System\kbNbyrB.exe
  C:\Windows\System\kbNbyrB.exe
  2⤵
  PID:8288
- C:\Windows\System\sJfjHFt.exe
  C:\Windows\System\sJfjHFt.exe
  2⤵
  PID:8304
- C:\Windows\System\KsLkxxR.exe
  C:\Windows\System\KsLkxxR.exe
  2⤵
  PID:8320
- C:\Windows\System\HLUFYGD.exe
  C:\Windows\System\HLUFYGD.exe
  2⤵
  PID:8364
- C:\Windows\System\DRLzCZu.exe
  C:\Windows\System\DRLzCZu.exe
  2⤵
  PID:8380
- C:\Windows\System\lrbHApL.exe
  C:\Windows\System\lrbHApL.exe
  2⤵
  PID:8396
- C:\Windows\System\gOyGDTd.exe
  C:\Windows\System\gOyGDTd.exe
  2⤵
  PID:8412
- C:\Windows\System\wdxLlwz.exe
  C:\Windows\System\wdxLlwz.exe
  2⤵
  PID:8440
- C:\Windows\System\yhTaApY.exe
  C:\Windows\System\yhTaApY.exe
  2⤵
  PID:8456
- C:\Windows\System\OzUWqIJ.exe
  C:\Windows\System\OzUWqIJ.exe
  2⤵
  PID:8472
- C:\Windows\System\PLLIaHT.exe
  C:\Windows\System\PLLIaHT.exe
  2⤵
  PID:8488
- C:\Windows\System\xXecZGp.exe
  C:\Windows\System\xXecZGp.exe
  2⤵
  PID:8504
- C:\Windows\System\ELidhSk.exe
  C:\Windows\System\ELidhSk.exe
  2⤵
  PID:8520
- C:\Windows\System\TdHgUqr.exe
  C:\Windows\System\TdHgUqr.exe
  2⤵
  PID:8536
- C:\Windows\System\IZIYgdV.exe
  C:\Windows\System\IZIYgdV.exe
  2⤵
  PID:8552
- C:\Windows\System\FZzlGnM.exe
  C:\Windows\System\FZzlGnM.exe
  2⤵
  PID:8568
- C:\Windows\System\yIPzTva.exe
  C:\Windows\System\yIPzTva.exe
  2⤵
  PID:8584
- C:\Windows\System\gKDdrWc.exe
  C:\Windows\System\gKDdrWc.exe
  2⤵
  PID:8604
- C:\Windows\System\EqmsojN.exe
  C:\Windows\System\EqmsojN.exe
  2⤵
  PID:8652
- C:\Windows\System\ymItddX.exe
  C:\Windows\System\ymItddX.exe
  2⤵
  PID:8668
- C:\Windows\System\WanIzcG.exe
  C:\Windows\System\WanIzcG.exe
  2⤵
  PID:8684
- C:\Windows\System\HSdBTaq.exe
  C:\Windows\System\HSdBTaq.exe
  2⤵
  PID:8700
- C:\Windows\System\APwvqyA.exe
  C:\Windows\System\APwvqyA.exe
  2⤵
  PID:8716
- C:\Windows\System\OqziHRw.exe
  C:\Windows\System\OqziHRw.exe
  2⤵
  PID:8744
- C:\Windows\System\awCanDo.exe
  C:\Windows\System\awCanDo.exe
  2⤵
  PID:8764
- C:\Windows\System\ZXlIdtI.exe
  C:\Windows\System\ZXlIdtI.exe
  2⤵
  PID:8780
- C:\Windows\System\HciwYum.exe
  C:\Windows\System\HciwYum.exe
  2⤵
  PID:8796
- C:\Windows\System\EoLjxvI.exe
  C:\Windows\System\EoLjxvI.exe
  2⤵
  PID:8812
- C:\Windows\System\pvLSNUZ.exe
  C:\Windows\System\pvLSNUZ.exe
  2⤵
  PID:8832
- C:\Windows\System\BBCHqzK.exe
  C:\Windows\System\BBCHqzK.exe
  2⤵
  PID:8848
- C:\Windows\System\rCTxvMu.exe
  C:\Windows\System\rCTxvMu.exe
  2⤵
  PID:8864
- C:\Windows\System\nruzwmI.exe
  C:\Windows\System\nruzwmI.exe
  2⤵
  PID:8880
- C:\Windows\System\BBXOfYp.exe
  C:\Windows\System\BBXOfYp.exe
  2⤵
  PID:8896
- C:\Windows\System\HngwbxL.exe
  C:\Windows\System\HngwbxL.exe
  2⤵
  PID:8916
- C:\Windows\System\tGsUIRl.exe
  C:\Windows\System\tGsUIRl.exe
  2⤵
  PID:8932
- C:\Windows\System\KvTLOYS.exe
  C:\Windows\System\KvTLOYS.exe
  2⤵
  PID:8948
- C:\Windows\System\nMzjgGk.exe
  C:\Windows\System\nMzjgGk.exe
  2⤵
  PID:8964
- C:\Windows\System\GFcdCVF.exe
  C:\Windows\System\GFcdCVF.exe
  2⤵
  PID:8980
- C:\Windows\System\xHTCBPt.exe
  C:\Windows\System\xHTCBPt.exe
  2⤵
  PID:8996
- C:\Windows\System\TQYYFam.exe
  C:\Windows\System\TQYYFam.exe
  2⤵
  PID:9016
- C:\Windows\System\LxiFPuS.exe
  C:\Windows\System\LxiFPuS.exe
  2⤵
  PID:9136
- C:\Windows\System\yFpSTzQ.exe
  C:\Windows\System\yFpSTzQ.exe
  2⤵
  PID:9152
- C:\Windows\System\WnelKYL.exe
  C:\Windows\System\WnelKYL.exe
  2⤵
  PID:9168
- C:\Windows\System\BitzibL.exe
  C:\Windows\System\BitzibL.exe
  2⤵
  PID:9184
- C:\Windows\System\KNmsgfy.exe
  C:\Windows\System\KNmsgfy.exe
  2⤵
  PID:8096
- C:\Windows\System\QEirAyC.exe
  C:\Windows\System\QEirAyC.exe
  2⤵
  PID:5432
- C:\Windows\System\xcQfiNx.exe
  C:\Windows\System\xcQfiNx.exe
  2⤵
  PID:7292
- C:\Windows\System\njlqBdf.exe
  C:\Windows\System\njlqBdf.exe
  2⤵
  PID:7380
- C:\Windows\System\VtLMJAY.exe
  C:\Windows\System\VtLMJAY.exe
  2⤵
  PID:7824
- C:\Windows\System\WSnlYuT.exe
  C:\Windows\System\WSnlYuT.exe
  2⤵
  PID:8148
- C:\Windows\System\QnsWfZX.exe
  C:\Windows\System\QnsWfZX.exe
  2⤵
  PID:7512
- C:\Windows\System\MOgLWyc.exe
  C:\Windows\System\MOgLWyc.exe
  2⤵
  PID:8248
- C:\Windows\System\uzcTMrR.exe
  C:\Windows\System\uzcTMrR.exe
  2⤵
  PID:8252
- C:\Windows\System\UxSXhKp.exe
  C:\Windows\System\UxSXhKp.exe
  2⤵
  PID:7324
- C:\Windows\System\eaAxuSA.exe
  C:\Windows\System\eaAxuSA.exe
  2⤵
  PID:8232
- C:\Windows\System\Ixqgcxw.exe
  C:\Windows\System\Ixqgcxw.exe
  2⤵
  PID:7440
- C:\Windows\System\HPxfabU.exe
  C:\Windows\System\HPxfabU.exe
  2⤵
  PID:6460
- C:\Windows\System\GYZjpMX.exe
  C:\Windows\System\GYZjpMX.exe
  2⤵
  PID:8300
- C:\Windows\System\alAgUmj.exe
  C:\Windows\System\alAgUmj.exe
  2⤵
  PID:8280
- C:\Windows\System\tklNNOF.exe
  C:\Windows\System\tklNNOF.exe
  2⤵
  PID:8340
- C:\Windows\System\oTRvBZO.exe
  C:\Windows\System\oTRvBZO.exe
  2⤵
  PID:8360
- C:\Windows\System\nrOgCRj.exe
  C:\Windows\System\nrOgCRj.exe
  2⤵
  PID:8388
- C:\Windows\System\jhzKnLM.exe
  C:\Windows\System\jhzKnLM.exe
  2⤵
  PID:8424
- C:\Windows\System\vPDCXEL.exe
  C:\Windows\System\vPDCXEL.exe
  2⤵
  PID:8464
- C:\Windows\System\MUvHSkA.exe
  C:\Windows\System\MUvHSkA.exe
  2⤵
  PID:8528
- C:\Windows\System\YhRjOmv.exe
  C:\Windows\System\YhRjOmv.exe
  2⤵
  PID:8596
- C:\Windows\System\shsGwai.exe
  C:\Windows\System\shsGwai.exe
  2⤵
  PID:8544
- C:\Windows\System\lyUwLSJ.exe
  C:\Windows\System\lyUwLSJ.exe
  2⤵
  PID:8576
- C:\Windows\System\lssljEx.exe
  C:\Windows\System\lssljEx.exe
  2⤵
  PID:8452
- C:\Windows\System\BPHweBq.exe
  C:\Windows\System\BPHweBq.exe
  2⤵
  PID:8724
- C:\Windows\System\XMabXAr.exe
  C:\Windows\System\XMabXAr.exe
  2⤵
  PID:8728
- C:\Windows\System\bqSJjTH.exe
  C:\Windows\System\bqSJjTH.exe
  2⤵
  PID:8772
- C:\Windows\System\hTxYFuc.exe
  C:\Windows\System\hTxYFuc.exe
  2⤵
  PID:8616
- C:\Windows\System\NdUQsLb.exe
  C:\Windows\System\NdUQsLb.exe
  2⤵
  PID:8648
- C:\Windows\System\utsUioh.exe
  C:\Windows\System\utsUioh.exe
  2⤵
  PID:8752
- C:\Windows\System\RpIGpYP.exe
  C:\Windows\System\RpIGpYP.exe
  2⤵
  PID:8788
- C:\Windows\System\xCwXfIJ.exe
  C:\Windows\System\xCwXfIJ.exe
  2⤵
  PID:8856
- C:\Windows\System\cHQcmeq.exe
  C:\Windows\System\cHQcmeq.exe
  2⤵
  PID:8940
- C:\Windows\System\UFtmBaR.exe
  C:\Windows\System\UFtmBaR.exe
  2⤵
  PID:9004
- C:\Windows\System\hjlnJGh.exe
  C:\Windows\System\hjlnJGh.exe
  2⤵
  PID:8924
- C:\Windows\System\YANzffQ.exe
  C:\Windows\System\YANzffQ.exe
  2⤵
  PID:9040
- C:\Windows\System\CnFUnkW.exe
  C:\Windows\System\CnFUnkW.exe
  2⤵
  PID:9072
- C:\Windows\System\WICFrOX.exe
  C:\Windows\System\WICFrOX.exe
  2⤵
  PID:9104
- C:\Windows\System\wZVZeWc.exe
  C:\Windows\System\wZVZeWc.exe
  2⤵
  PID:9120
- C:\Windows\System\xHyWHvh.exe
  C:\Windows\System\xHyWHvh.exe
  2⤵
  PID:9160
- C:\Windows\System\quKXLca.exe
  C:\Windows\System\quKXLca.exe
  2⤵
  PID:8432
- C:\Windows\System\QzdKftw.exe
  C:\Windows\System\QzdKftw.exe
  2⤵
  PID:7956
- C:\Windows\System\dBOXbLT.exe
  C:\Windows\System\dBOXbLT.exe
  2⤵
  PID:8140
- C:\Windows\System\NEePHHZ.exe
  C:\Windows\System\NEePHHZ.exe
  2⤵
  PID:7328
- C:\Windows\System\jQHOkyi.exe
  C:\Windows\System\jQHOkyi.exe
  2⤵
  PID:8296
- C:\Windows\System\MlCsNWz.exe
  C:\Windows\System\MlCsNWz.exe
  2⤵
  PID:7792
- C:\Windows\System\SlOlZsk.exe
  C:\Windows\System\SlOlZsk.exe
  2⤵
  PID:6464
- C:\Windows\System\BgjPCIO.exe
  C:\Windows\System\BgjPCIO.exe
  2⤵
  PID:8436
- C:\Windows\System\OEyZXaS.exe
  C:\Windows\System\OEyZXaS.exe
  2⤵
  PID:8056
- C:\Windows\System\zZBTeYK.exe
  C:\Windows\System\zZBTeYK.exe
  2⤵
  PID:8392
- C:\Windows\System\hHkjXHI.exe
  C:\Windows\System\hHkjXHI.exe
  2⤵
  PID:8352
- C:\Windows\System\TVjYKRM.exe
  C:\Windows\System\TVjYKRM.exe
  2⤵
  PID:8420
- C:\Windows\System\xXJjWve.exe
  C:\Windows\System\xXJjWve.exe
  2⤵
  PID:8448
- C:\Windows\System\SYqpDAD.exe
  C:\Windows\System\SYqpDAD.exe
  2⤵
  PID:8692
- C:\Windows\System\kLbiqjt.exe
  C:\Windows\System\kLbiqjt.exe
  2⤵
  PID:8840
- C:\Windows\System\EPMMZaH.exe
  C:\Windows\System\EPMMZaH.exe
  2⤵
  PID:8516
- C:\Windows\System\nsWQPej.exe
  C:\Windows\System\nsWQPej.exe
  2⤵
  PID:8484
- C:\Windows\System\WCqyhxz.exe
  C:\Windows\System\WCqyhxz.exe
  2⤵
  PID:8804
- C:\Windows\System\HDzrloU.exe
  C:\Windows\System\HDzrloU.exe
  2⤵
  PID:8760
- C:\Windows\System\xETbVVL.exe
  C:\Windows\System\xETbVVL.exe
  2⤵
  PID:8712
- C:\Windows\System\yHjhmwc.exe
  C:\Windows\System\yHjhmwc.exe
  2⤵
  PID:8828
- C:\Windows\System\bJtGFxY.exe
  C:\Windows\System\bJtGFxY.exe
  2⤵
  PID:9204
- C:\Windows\System\jgdzdZI.exe
  C:\Windows\System\jgdzdZI.exe
  2⤵
  PID:9052
- C:\Windows\System\srZCIkB.exe
  C:\Windows\System\srZCIkB.exe
  2⤵
  PID:9088
- C:\Windows\System\QWYGTQm.exe
  C:\Windows\System\QWYGTQm.exe
  2⤵
  PID:9092
- C:\Windows\System\xjKilRz.exe
  C:\Windows\System\xjKilRz.exe
  2⤵
  PID:9032
- C:\Windows\System\uuaDXJD.exe
  C:\Windows\System\uuaDXJD.exe
  2⤵
  PID:9080
- C:\Windows\System\FknFMBB.exe
  C:\Windows\System\FknFMBB.exe
  2⤵
  PID:9196
- C:\Windows\System\GHJnvNV.exe
  C:\Windows\System\GHJnvNV.exe
  2⤵
  PID:9208
- C:\Windows\System\aroHuCz.exe
  C:\Windows\System\aroHuCz.exe
  2⤵
  PID:6840
- C:\Windows\System\BiBiDZX.exe
  C:\Windows\System\BiBiDZX.exe
  2⤵
  PID:7652
- C:\Windows\System\fxDpPnp.exe
  C:\Windows\System\fxDpPnp.exe
  2⤵
  PID:7256
- C:\Windows\System\hklnIIM.exe
  C:\Windows\System\hklnIIM.exe
  2⤵
  PID:8072
- C:\Windows\System\qeArPKF.exe
  C:\Windows\System\qeArPKF.exe
  2⤵
  PID:8240
- C:\Windows\System\XXOCKya.exe
  C:\Windows\System\XXOCKya.exe
  2⤵
  PID:8336
- C:\Windows\System\ScZQvkD.exe
  C:\Windows\System\ScZQvkD.exe
  2⤵
  PID:8372
- C:\Windows\System\wvrBCkP.exe
  C:\Windows\System\wvrBCkP.exe
  2⤵
  PID:8500
- C:\Windows\System\dFaVjeC.exe
  C:\Windows\System\dFaVjeC.exe
  2⤵
  PID:8904
- C:\Windows\System\cfChwwx.exe
  C:\Windows\System\cfChwwx.exe
  2⤵
  PID:7564
- C:\Windows\System\RfWNPlp.exe
  C:\Windows\System\RfWNPlp.exe
  2⤵
  PID:8408
- C:\Windows\System\Xjeewyc.exe
  C:\Windows\System\Xjeewyc.exe
  2⤵
  PID:7940
- C:\Windows\System\jDSQwmS.exe
  C:\Windows\System\jDSQwmS.exe
  2⤵
  PID:8660
- C:\Windows\System\YDwNqGq.exe
  C:\Windows\System\YDwNqGq.exe
  2⤵
  PID:9060
- C:\Windows\System\IHhGDeS.exe
  C:\Windows\System\IHhGDeS.exe
  2⤵
  PID:9048
- C:\Windows\System\kVthltK.exe
  C:\Windows\System\kVthltK.exe
  2⤵
  PID:8988
- C:\Windows\System\pMZbAHd.exe
  C:\Windows\System\pMZbAHd.exe
  2⤵
  PID:6308
- C:\Windows\System\vQcDvQV.exe
  C:\Windows\System\vQcDvQV.exe
  2⤵
  PID:6768
- C:\Windows\System\FWbZzRL.exe
  C:\Windows\System\FWbZzRL.exe
  2⤵
  PID:8680
- C:\Windows\System\ksuRxek.exe
  C:\Windows\System\ksuRxek.exe
  2⤵
  PID:9132
- C:\Windows\System\OvJSzzl.exe
  C:\Windows\System\OvJSzzl.exe
  2⤵
  PID:7732
- C:\Windows\System\HsydRZe.exe
  C:\Windows\System\HsydRZe.exe
  2⤵
  PID:9116
- C:\Windows\System\XgGCwMq.exe
  C:\Windows\System\XgGCwMq.exe
  2⤵
  PID:7276
- C:\Windows\System\YVasMDp.exe
  C:\Windows\System\YVasMDp.exe
  2⤵
  PID:7208
- C:\Windows\System\NiQDfVR.exe
  C:\Windows\System\NiQDfVR.exe
  2⤵
  PID:8348
- C:\Windows\System\EeXFWTA.exe
  C:\Windows\System\EeXFWTA.exe
  2⤵
  PID:8404
- C:\Windows\System\fyNqhpK.exe
  C:\Windows\System\fyNqhpK.exe
  2⤵
  PID:8892
- C:\Windows\System\EmBLZYi.exe
  C:\Windows\System\EmBLZYi.exe
  2⤵
  PID:9036
- C:\Windows\System\RPYJGGU.exe
  C:\Windows\System\RPYJGGU.exe
  2⤵
  PID:9096
- C:\Windows\System\ayYeTHS.exe
  C:\Windows\System\ayYeTHS.exe
  2⤵
  PID:9012
- C:\Windows\System\WVLiAxE.exe
  C:\Windows\System\WVLiAxE.exe
  2⤵
  PID:9148
- C:\Windows\System\ZgStOdH.exe
  C:\Windows\System\ZgStOdH.exe
  2⤵
  PID:8044
- C:\Windows\System\PtKpOWE.exe
  C:\Windows\System\PtKpOWE.exe
  2⤵
  PID:7756
- C:\Windows\System\smyMkAc.exe
  C:\Windows\System\smyMkAc.exe
  2⤵
  PID:8268
- C:\Windows\System\ttIXupJ.exe
  C:\Windows\System\ttIXupJ.exe
  2⤵
  PID:9212
- C:\Windows\System\xYHuMOo.exe
  C:\Windows\System\xYHuMOo.exe
  2⤵
  PID:8580
- C:\Windows\System\iDsPAKZ.exe
  C:\Windows\System\iDsPAKZ.exe
  2⤵
  PID:9236
- C:\Windows\System\UJDiiPH.exe
  C:\Windows\System\UJDiiPH.exe
  2⤵
  PID:9252
- C:\Windows\System\DeqHtnh.exe
  C:\Windows\System\DeqHtnh.exe
  2⤵
  PID:9268
- C:\Windows\System\SabhGVI.exe
  C:\Windows\System\SabhGVI.exe
  2⤵
  PID:9284
- C:\Windows\System\tpPDizB.exe
  C:\Windows\System\tpPDizB.exe
  2⤵
  PID:9300
- C:\Windows\System\vExAPqf.exe
  C:\Windows\System\vExAPqf.exe
  2⤵
  PID:9316
- C:\Windows\System\OCSOlIT.exe
  C:\Windows\System\OCSOlIT.exe
  2⤵
  PID:9332
- C:\Windows\System\btCXNFc.exe
  C:\Windows\System\btCXNFc.exe
  2⤵
  PID:9348
- C:\Windows\System\PQOegTW.exe
  C:\Windows\System\PQOegTW.exe
  2⤵
  PID:9364
- C:\Windows\System\dvAtqun.exe
  C:\Windows\System\dvAtqun.exe
  2⤵
  PID:9380
- C:\Windows\System\gcDRWLI.exe
  C:\Windows\System\gcDRWLI.exe
  2⤵
  PID:9396
- C:\Windows\System\dTkAIIl.exe
  C:\Windows\System\dTkAIIl.exe
  2⤵
  PID:9412
- C:\Windows\System\PFjeIYE.exe
  C:\Windows\System\PFjeIYE.exe
  2⤵
  PID:9428
- C:\Windows\System\RCvlfKK.exe
  C:\Windows\System\RCvlfKK.exe
  2⤵
  PID:9444
- C:\Windows\System\aaaDURx.exe
  C:\Windows\System\aaaDURx.exe
  2⤵
  PID:9460
- C:\Windows\System\ghTyxvg.exe
  C:\Windows\System\ghTyxvg.exe
  2⤵
  PID:9476
- C:\Windows\System\EhfHEqc.exe
  C:\Windows\System\EhfHEqc.exe
  2⤵
  PID:9492
- C:\Windows\System\wTXbElV.exe
  C:\Windows\System\wTXbElV.exe
  2⤵
  PID:9508
- C:\Windows\System\KaRgYNP.exe
  C:\Windows\System\KaRgYNP.exe
  2⤵
  PID:9524
- C:\Windows\System\yUGGMYx.exe
  C:\Windows\System\yUGGMYx.exe
  2⤵
  PID:9540
- C:\Windows\System\MhnTdTz.exe
  C:\Windows\System\MhnTdTz.exe
  2⤵
  PID:9556
- C:\Windows\System\AguPdMv.exe
  C:\Windows\System\AguPdMv.exe
  2⤵
  PID:9572
- C:\Windows\System\WRbSMcc.exe
  C:\Windows\System\WRbSMcc.exe
  2⤵
  PID:9588
- C:\Windows\System\nrRxakg.exe
  C:\Windows\System\nrRxakg.exe
  2⤵
  PID:9604
- C:\Windows\System\bnLjfNJ.exe
  C:\Windows\System\bnLjfNJ.exe
  2⤵
  PID:9620
- C:\Windows\System\KFtBkQk.exe
  C:\Windows\System\KFtBkQk.exe
  2⤵
  PID:9636
- C:\Windows\System\jlLqoOQ.exe
  C:\Windows\System\jlLqoOQ.exe
  2⤵
  PID:9652
- C:\Windows\System\AcxeenC.exe
  C:\Windows\System\AcxeenC.exe
  2⤵
  PID:9668
- C:\Windows\System\zhlDiIM.exe
  C:\Windows\System\zhlDiIM.exe
  2⤵
  PID:9684
- C:\Windows\System\pBimdpg.exe
  C:\Windows\System\pBimdpg.exe
  2⤵
  PID:9700
- C:\Windows\System\irvMalV.exe
  C:\Windows\System\irvMalV.exe
  2⤵
  PID:9716
- C:\Windows\System\WSYrgem.exe
  C:\Windows\System\WSYrgem.exe
  2⤵
  PID:9732
- C:\Windows\System\CKlnykh.exe
  C:\Windows\System\CKlnykh.exe
  2⤵
  PID:9748
- C:\Windows\System\TdcCXej.exe
  C:\Windows\System\TdcCXej.exe
  2⤵
  PID:9764
- C:\Windows\System\YsuYNGg.exe
  C:\Windows\System\YsuYNGg.exe
  2⤵
  PID:9780
- C:\Windows\System\MvUNBKD.exe
  C:\Windows\System\MvUNBKD.exe
  2⤵
  PID:9796
- C:\Windows\System\zAFmXrz.exe
  C:\Windows\System\zAFmXrz.exe
  2⤵
  PID:9812
- C:\Windows\System\DOjlcyv.exe
  C:\Windows\System\DOjlcyv.exe
  2⤵
  PID:9828
- C:\Windows\System\GXuxwcN.exe
  C:\Windows\System\GXuxwcN.exe
  2⤵
  PID:9844
- C:\Windows\System\bKrEXMf.exe
  C:\Windows\System\bKrEXMf.exe
  2⤵
  PID:9860
- C:\Windows\System\wBEkUEY.exe
  C:\Windows\System\wBEkUEY.exe
  2⤵
  PID:9876
- C:\Windows\System\urzOFem.exe
  C:\Windows\System\urzOFem.exe
  2⤵
  PID:9892
- C:\Windows\System\WQDltBC.exe
  C:\Windows\System\WQDltBC.exe
  2⤵
  PID:9908
- C:\Windows\System\CSjVuHJ.exe
  C:\Windows\System\CSjVuHJ.exe
  2⤵
  PID:9924
- C:\Windows\System\VaLEhZH.exe
  C:\Windows\System\VaLEhZH.exe
  2⤵
  PID:9940
- C:\Windows\System\bIUJRyc.exe
  C:\Windows\System\bIUJRyc.exe
  2⤵
  PID:9956
- C:\Windows\System\xewLyqG.exe
  C:\Windows\System\xewLyqG.exe
  2⤵
  PID:9972
- C:\Windows\System\WNFVRUA.exe
  C:\Windows\System\WNFVRUA.exe
  2⤵
  PID:9988
- C:\Windows\System\vzBalNu.exe
  C:\Windows\System\vzBalNu.exe
  2⤵
  PID:10004
- C:\Windows\System\henquti.exe
  C:\Windows\System\henquti.exe
  2⤵
  PID:10020
- C:\Windows\System\bjLXkiC.exe
  C:\Windows\System\bjLXkiC.exe
  2⤵
  PID:10036
- C:\Windows\System\JJmWwDL.exe
  C:\Windows\System\JJmWwDL.exe
  2⤵
  PID:10052
- C:\Windows\System\nVBqifa.exe
  C:\Windows\System\nVBqifa.exe
  2⤵
  PID:10072
- C:\Windows\System\rNSnpOm.exe
  C:\Windows\System\rNSnpOm.exe
  2⤵
  PID:10088
- C:\Windows\System\yGUXFwI.exe
  C:\Windows\System\yGUXFwI.exe
  2⤵
  PID:10104
- C:\Windows\System\eZSRFSN.exe
  C:\Windows\System\eZSRFSN.exe
  2⤵
  PID:10120
- C:\Windows\System\QhybRdd.exe
  C:\Windows\System\QhybRdd.exe
  2⤵
  PID:10136
- C:\Windows\System\wOCzsjf.exe
  C:\Windows\System\wOCzsjf.exe
  2⤵
  PID:10152
- C:\Windows\System\umVJPOW.exe
  C:\Windows\System\umVJPOW.exe
  2⤵
  PID:10168
- C:\Windows\System\ZKJPodF.exe
  C:\Windows\System\ZKJPodF.exe
  2⤵
  PID:10184
- C:\Windows\System\YRHgaWL.exe
  C:\Windows\System\YRHgaWL.exe
  2⤵
  PID:10200
- C:\Windows\System\oSPviWi.exe
  C:\Windows\System\oSPviWi.exe
  2⤵
  PID:10216
- C:\Windows\System\OXAhMsg.exe
  C:\Windows\System\OXAhMsg.exe
  2⤵
  PID:10232
- C:\Windows\System\TNdUDBh.exe
  C:\Windows\System\TNdUDBh.exe
  2⤵
  PID:7204
- C:\Windows\System\VEpWjlm.exe
  C:\Windows\System\VEpWjlm.exe
  2⤵
  PID:9308
- C:\Windows\System\lqCDNKD.exe
  C:\Windows\System\lqCDNKD.exe
  2⤵
  PID:9372
- C:\Windows\System\pTnPcDT.exe
  C:\Windows\System\pTnPcDT.exe
  2⤵
  PID:8560
- C:\Windows\System\qEYuoPD.exe
  C:\Windows\System\qEYuoPD.exe
  2⤵
  PID:9260
- C:\Windows\System\knEiNwl.exe
  C:\Windows\System\knEiNwl.exe
  2⤵
  PID:9388
- C:\Windows\System\LigOhxM.exe
  C:\Windows\System\LigOhxM.exe
  2⤵
  PID:9468
- C:\Windows\System\llCCASh.exe
  C:\Windows\System\llCCASh.exe
  2⤵
  PID:9420
- C:\Windows\System\CVnxZel.exe
  C:\Windows\System\CVnxZel.exe
  2⤵
  PID:9516
- C:\Windows\System\RwpfOse.exe
  C:\Windows\System\RwpfOse.exe
  2⤵
  PID:9548
- C:\Windows\System\JUiBPLj.exe
  C:\Windows\System\JUiBPLj.exe
  2⤵
  PID:9600
- C:\Windows\System\YFkKSuf.exe
  C:\Windows\System\YFkKSuf.exe
  2⤵
  PID:9628
- C:\Windows\System\FkCPNDc.exe
  C:\Windows\System\FkCPNDc.exe
  2⤵
  PID:9664
- C:\Windows\System\uQRLhoG.exe
  C:\Windows\System\uQRLhoG.exe
  2⤵
  PID:9728
- C:\Windows\System\avrLtXe.exe
  C:\Windows\System\avrLtXe.exe
  2⤵
  PID:9648
- C:\Windows\System\iSunXbk.exe
  C:\Windows\System\iSunXbk.exe
  2⤵
  PID:9676
- C:\Windows\System\PUpcDFT.exe
  C:\Windows\System\PUpcDFT.exe
  2⤵
  PID:9740
- C:\Windows\System\HJbOiFK.exe
  C:\Windows\System\HJbOiFK.exe
  2⤵
  PID:9824
- C:\Windows\System\igadWJH.exe
  C:\Windows\System\igadWJH.exe
  2⤵
  PID:9856
- C:\Windows\System\WzaFMik.exe
  C:\Windows\System\WzaFMik.exe
  2⤵
  PID:9884
- C:\Windows\System\XHnghvN.exe
  C:\Windows\System\XHnghvN.exe
  2⤵
  PID:9904
- C:\Windows\System\zkSoGJM.exe
  C:\Windows\System\zkSoGJM.exe
  2⤵
  PID:9952
- C:\Windows\System\EWnXmcU.exe
  C:\Windows\System\EWnXmcU.exe
  2⤵
  PID:10016
- C:\Windows\System\OHbgijQ.exe
  C:\Windows\System\OHbgijQ.exe
  2⤵
  PID:10032
- C:\Windows\System\lrCkPkI.exe
  C:\Windows\System\lrCkPkI.exe
  2⤵
  PID:9936
- C:\Windows\System\ScNREqP.exe
  C:\Windows\System\ScNREqP.exe
  2⤵
  PID:10000
- C:\Windows\System\CNpdJxB.exe
  C:\Windows\System\CNpdJxB.exe
  2⤵
  PID:10116
- C:\Windows\System\FxnvZwy.exe
  C:\Windows\System\FxnvZwy.exe
  2⤵
  PID:10180
- C:\Windows\System\eOGDYAV.exe
  C:\Windows\System\eOGDYAV.exe
  2⤵
  PID:10192
- C:\Windows\System\vypKnPo.exe
  C:\Windows\System\vypKnPo.exe
  2⤵
  PID:10160
- C:\Windows\System\UOLBIKm.exe
  C:\Windows\System\UOLBIKm.exe
  2⤵
  PID:10228
- C:\Windows\System\NeiBLiA.exe
  C:\Windows\System\NeiBLiA.exe
  2⤵
  PID:9340
- C:\Windows\System\xmQHxdF.exe
  C:\Windows\System\xmQHxdF.exe
  2⤵
  PID:9408
- C:\Windows\System\zDRsFZS.exe
  C:\Windows\System\zDRsFZS.exe
  2⤵
  PID:9276
- C:\Windows\System\xApbHEJ.exe
  C:\Windows\System\xApbHEJ.exe
  2⤵
  PID:9360
- C:\Windows\System\ZmagVZj.exe
  C:\Windows\System\ZmagVZj.exe
  2⤵
  PID:9500
- C:\Windows\System\NobDlUT.exe
  C:\Windows\System\NobDlUT.exe
  2⤵
  PID:9552
- C:\Windows\System\ZOwfxxH.exe
  C:\Windows\System\ZOwfxxH.exe
  2⤵
  PID:9760
- C:\Windows\System\QnsZeRD.exe
  C:\Windows\System\QnsZeRD.exe
  2⤵
  PID:9712
- C:\Windows\System\NbHCgVk.exe
  C:\Windows\System\NbHCgVk.exe
  2⤵
  PID:9696
- C:\Windows\System\ujPCbul.exe
  C:\Windows\System\ujPCbul.exe
  2⤵
  PID:9520
- C:\Windows\System\CLoqjMW.exe
  C:\Windows\System\CLoqjMW.exe
  2⤵
  PID:9868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AdqxkAK.exe

Filesize
2.1MB

MD5
9c9549460edb18bbd086367809a541e6

SHA1
99e70ed4638ba875c186c4628fc6b1178f420065

SHA256
2c46875c341da8cd3bd53b629216cff68a658d2a735a6394349b6bb984eed264

SHA512
d2103646571e4534b2d622857ad207f3e3c78683e6779b772371456005cd7e54c00632cd143efe12b0abc96c9acd93ff4e0c4bf8d153df52d868c1027cf62fe0

Download Submit
C:\Windows\system\DerRPsR.exe

Filesize
2.1MB

MD5
bb9d4494274d190587d94844dfd5482a

SHA1
68428329d88f73af391563173235509ebf66fe71

SHA256
9b053e60e39836e75ec2407df902a9b201308a8fed14afdf82412d4984e1fdbc

SHA512
b0f96188ed340bb48c35c20b552c574074bbbcc347d3619c67e052af018955301f40a0d23dc0e7e9f3354276f5228e4295428ced69c5b14614c08d86953c1ad4

Download Submit
C:\Windows\system\ESNMMvv.exe

Filesize
2.1MB

MD5
ba3952c627b241af3aa0022920a3a7ca

SHA1
b1a54958288b5b379a8ef0e5270d2c44722909bd

SHA256
89c106bcb69eccb4611218d4664af00303d8084f7fbecc4c836e72e6a4951d3d

SHA512
7e7d4bedf11e28f10e0b421b5bf9280ca9a79004cd8456c6fa1ed8e18feaa0267bbc2d223fe491936538ee40a8d90342ee5b8ad44542ad060803cf1a1ae91973

Download Submit
C:\Windows\system\GomiWMm.exe

Filesize
2.1MB

MD5
4df65d7cbdd79bd77ccc3d0114652876

SHA1
2e4d971aeca995ad95eaafc19682de27b56aaaa0

SHA256
eb5461294f6b9f9a467ab6a1b7f20a36ce98f1651da8ca25f3fb4a1798ed0e57

SHA512
51ad3952498161f0737177cf7eb0d4561dc97204ea0f18964945c564f28969972aeecf2a44a2d1e404f10a5b56fc16851bc6fb8dfd27912448dfe1f70ec19573

Download Submit
C:\Windows\system\IcANLvW.exe

Filesize
2.1MB

MD5
ac2621fdd4e0764f743f21f7a27c1303

SHA1
49bdac37231a193ece43f92097d127957478d851

SHA256
4dd51813dd2c3480e5d8c5530dbf1b188cb34c6a190603fa6dac00a16ea18bb6

SHA512
22f4d5fbc72965f76c1c9770022f48a25fe4a16a00acce75d114c9516352b8d8b62fb3d99ac549a7673baa713fdba0d6d3760643a2bb9dd37af5113cc7e20ead

Download Submit
C:\Windows\system\IlcoLCR.exe

Filesize
2.1MB

MD5
3fa298f996c6a6537da43cb82d3f2488

SHA1
60fd4fdc536192c7e05bb82f559a93d2eb49397a

SHA256
179aecaf12cce3e248ccacdc1746161aa09db9d68296d5702015feea90a114e8

SHA512
9e8c953570f3dfce854500ffb75ac2aa1111fca4a1613c7625368a6f3388fef938f2ab6e5b330a57fa2a92966ba0052b5e2355694702f81d9b14c895311f8d92

Download Submit
C:\Windows\system\NhnHUtX.exe

Filesize
2.1MB

MD5
df27361ffc2b37f9a0b9e652378c6379

SHA1
68ec6ab9cf9ee49b0431e96ee954952a88795d4f

SHA256
38e7d44a4e8d0f3232ef2680a8ec2baf4723cebaae0159a8aace8e2d5f4d310c

SHA512
b1306f4319fb1a78a01f3c8a5f69831c1d175adacfa4e99758e259e2774c1dc81e7ce49df6ea15c57bf3425d9d3d51a68b9a3cf55dc65d36ac9db945f51cb801

Download Submit
C:\Windows\system\PMtdacu.exe

Filesize
2.1MB

MD5
d21668a3588ac6e6baf685fbf5bbc22a

SHA1
f5088f2bf6f3d4282323816d4f44e53146856f7a

SHA256
92498e3c275fba2499bb87f21cb0cc19a45af586ef5c36228d28a18af90e5f6c

SHA512
df1c35a589e9835901769baceebd58aec17b4e6d9edb48aff8640a6773880f766511f98c463801e412bde7b6d4203c2c9e7a18060be9affef307dc7445a954b4

Download Submit
C:\Windows\system\QleELoB.exe

Filesize
2.1MB

MD5
fdb170639fdf70b00f00d36f2cf0a6e9

SHA1
fbd3d761bbb7aaf546c398e95252f674495d5361

SHA256
905c7029ec5fada067f9025611ec2292e99cc0ec9d08e85d6834da844a51dc28

SHA512
5033569018883e6f5c9eadf563ee4169af10f5d5281f5ffb27a49ba4f065427ac3a19054cc109bcbe0571b24714aa9326cfb4884352e931a9144960cedfb2740

Download Submit
C:\Windows\system\SogpnWD.exe

Filesize
2.1MB

MD5
d2fc43523fe4c461ea5ca0f75c50799a

SHA1
a8e0d2bfe2309cc2d6e264a9727a61685e5b12d3

SHA256
84c86985be911f693024cd68a2931f156f2fe5561d7cff311834f3d80e48ef24

SHA512
db32a2d0d7ff2b7e0b379c7ef10674a447f751c8003b6e6b4aceb64841ba5ead9fce14463c8906cb69b706826073da2fb291292cfd075feefd340fa7c8cc1009

Download Submit
C:\Windows\system\TKlERDP.exe

Filesize
2.1MB

MD5
d7539767bec5b8dccd767a0db138c7a4

SHA1
86421cf717bbb7da3fbd432b646e1a6a94f171b9

SHA256
dfda73c9580f22c80f6df24e2b6144568a73a063ecc271fcf656751d10cde292

SHA512
6dc16fbe17696beb15034dd9f13a80f86bd59d767a5cc0e795fb91ec2582cfc01c44181f36bfc493ef63209ab2ff1f64f2c2a833f84278c0989a0d368972b20e

Download Submit
C:\Windows\system\TbXQaHc.exe

Filesize
2.1MB

MD5
2bf3825a2b738ccd7ee3c303b241ed7f

SHA1
6769829c68bf2a224aa4861dca82671d59434694

SHA256
14827d2045fb6c99e3c87ff10cfa4efc6630e1710969e5f322e1de42afe3487d

SHA512
6ff481ebf1129f376b5ba3c6c88d343883cec9e4dfa1a2a8158f81a2e05d67fc0c2c3f1f6ee2f19a30c19a9ed6a5d37c54f06778dad2d57194aa9b3fc6317138

Download Submit
C:\Windows\system\UVaHtvL.exe

Filesize
2.1MB

MD5
ef5d274e3fb67e79198a4a96b86970ad

SHA1
32e17ad1d170aadc516757f262be555350974205

SHA256
3d621e483065c1417174ecd7948dc6936642699d87f7ffc21bdcb14677c21456

SHA512
66d9f7f87a7869f87d931ace0f1b5d66a3e3ef2dede4e6bf183275615b74a67c4d804847b135e90a975bbf39d6d8e68ae37da1ea1bb11d24e31addc2e1045d65

Download Submit
C:\Windows\system\WwhBTta.exe

Filesize
2.1MB

MD5
899ea28f31d2e66ba2b78dc463683f4b

SHA1
f708459f9590cbbf4750f0a59f454b4aa23eac93

SHA256
08ce9b8c5d0ddf1d2434d752402144cdd06752f19fa6c983bb6ba9f05acb45d9

SHA512
fd1581d7ce3ce44cec73eef281df44a16c46a674c86bb806c20583885145d4cab6d98f36c0b158f41f944ecc05c81f4dfbd27ca24e90e648f89a5c4e1aee82e0

Download Submit
C:\Windows\system\ZTOftMg.exe

Filesize
2.1MB

MD5
55b752e0d6c9e4ecc8ba08ec4f56e126

SHA1
220487a1d301655d05c482bea6f5922c5edb553f

SHA256
d9861d1eeb5f3fbd06c4181d0f2645dddaf1ae1790a14ee6812ee44717ef1fb5

SHA512
8abe173e326732bdcf9828351fcc46f5c93e55f1d56ee5a7bd9dbc4edbb05a4481b9ad8bf8796153684f3479f4a3118cc9c617fb5c6892b5275e890972ff83bd

Download Submit
C:\Windows\system\cOPvuRD.exe

Filesize
2.1MB

MD5
0b47b6f6c9b1dbc07cc19e7b86345238

SHA1
e3df9f8456a7a6d35b1423c0bcdc72a31437bb00

SHA256
36af611327766a62b0aa5a3ea7bee340933e4f8c83a5c1a135a87d71e7d22ce1

SHA512
eaf965868fcee71fb77ba2eb84a97af772aea510d3a2474baf0f69da5c4119ee1fadaa6f11c53c3fc3bf817e1c62f69e443064d5cc6453c4b575bdb0a2825045

Download Submit
C:\Windows\system\gQEWCLZ.exe

Filesize
2.1MB

MD5
c86156757f796cf40953ec87cb524989

SHA1
93faea59f6e9540809f9de208b7b371cf52837d9

SHA256
70c646dac13279d848ae4955aa9656bc95e894e7269977a9d7ce664b300009cd

SHA512
7d423ef9f9cd44e3ac3c33316a72533f5f2823041d103c89fe6e750cff474842a6ed04a8a2192ab766c7789176d9dd31d5c0f747ff78969b2d01d56bef4185f3

Download Submit
C:\Windows\system\mAUXvad.exe

Filesize
2.1MB

MD5
b1777676e0a72bf9c246c5e15114d81a

SHA1
3e3d1788454a155c0752fd7f14f9ab6cfd259a3b

SHA256
d837376392cdfa90cadb981de99692947b2a3fa2328f2c5e50d58fa9812d2371

SHA512
378ce87a6153a6babf9688e3db8efbd298f63397a8f2b270e374f0e455e0b573488cb7b71a419f8d090b8e525817db3618a2a43a98a224a7635dbc42f876ccfa

Download Submit
C:\Windows\system\mgFlQLK.exe

Filesize
2.1MB

MD5
34db3d95ba86c171a72fdc36b1a7a202

SHA1
40c2a1170214c88429be648b3038249ffb0e5301

SHA256
3fbee4e21cf50312c8e7d9fd5620b40916fc9fc7eb34a310b2b90b2fa035572e

SHA512
3f9e5c7ca137d4f4fbdb6158e696c513f03dcdef6195f7e9bf638ce2f98397b26dbb20f7f8fa59fa7ce7fa5ed734b48f3f64cbcb064bcaa97457c70a4827a51d

Download Submit
C:\Windows\system\nSrOygD.exe

Filesize
2.1MB

MD5
84bea319b4bf6f51efacc570de39e77a

SHA1
2dc0ed59ad5723f549376d7e51e9ef974898fc9a

SHA256
f70d22dee7c5ffac7df4fb47207caf464e520f65c3333638d30f12316b5043b5

SHA512
351994b557c74df81f94e3d1971e4e131c9eac3030a2379d9b48d3f163828ce51079c5c044537dcc7b7ae2e3363088a9f38305e45b0cf67da78bc1110e2ed34d

Download Submit
C:\Windows\system\rAIiyQu.exe

Filesize
2.1MB

MD5
8b4b147ca919eb0e26b8d85e8676c699

SHA1
3de30cc792548b1615f608e4b90e58293ce18639

SHA256
c0206774e0b503b06c827bbc91c5da3a623cfd28bf13811db052b5a44af848ac

SHA512
c876f89c0ecdcce09f37813be154170f1fa8af5b676c0619a84bd691ad4522ee4543c92ec1c4bc3b6865bd9687e749b8597fb27eee72ef4525b854982084ffb4

Download Submit
C:\Windows\system\savMXtO.exe

Filesize
2.1MB

MD5
4e76119762222048be534eca659385e8

SHA1
01df640baa4e4352955b917b301637a016ca2615

SHA256
67276381f5d81fb2be74acc9e42ffcbdc216cce97e8623ff7787838f36c7e4c3

SHA512
a38004f0a700e4987f095f504882f015f8ee441d7ea96ec93ebdc67b7fcc5734a307f21297b401ae866000dcbc76a11b6f3d7b8efe0dee9f04e2d2426467e884

Download Submit
C:\Windows\system\tMzZWsk.exe

Filesize
2.1MB

MD5
fcd1bc849d793f595cf5f803b5c5df4b

SHA1
690c8b095b689a35afb9bc5d2097685f691e0b3f

SHA256
d339a427212b09f87998088e935e79a1167d55b120a257cd3c7de752cce61e1b

SHA512
569ef38750fc62624d40a8360732bc81e5d3ba02e975220c8162507dfecba18f9ad79f80056584d4b93a6b1b6841c4ad1295fb01625066f3950936b9be369690

Download Submit
C:\Windows\system\wJAaddw.exe

Filesize
2.1MB

MD5
6e63c82b931cf386ee70379e38c55688

SHA1
837f224d0f4fd0bba7b1d73ca4de395d5f00bd81

SHA256
783c20b3fdd7f36066a45f81e12b68f2551164c0a596c03a8e844f6c83b7e12f

SHA512
92bf944fed267e45ffc74564cf6776322384fe6082b7c81b5ed351841abeb0d9f41be87e40c542de2fd87daa353e11712d619eb95dd53687d1eabdfae837e7bc

Download Submit
C:\Windows\system\zTycPym.exe

Filesize
2.1MB

MD5
a828f06f4c746ed1c8a5ba78a3593830

SHA1
8a25573d24b4984e5782c6d52faa8e16d36f173f

SHA256
35bee5dd44207ea44472b0f36dc07a3f108a006db3bd342332aeb2a57e4ca8d7

SHA512
694be98b1e96197a0faafcdf7e0744460681df41b9cf7dde14cbc04cd08b1a026cfa9398ca1d164f1986d24bd9ab106680feb675b5583c8cc09b05fe41e9e607

Download Submit
C:\Windows\system\zgedmWD.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
\Windows\system\CVgwDNA.exe

Filesize
2.1MB

MD5
93d44519ea6a9d489c5b0fdde03a1128

SHA1
132361bdaee8a85e16332d73ccabf7bd7efb364c

SHA256
ed4b53e178c2ec7b102a19d85a539186e17105351146673811cd04a4ec931eda

SHA512
ce817aea3ba306316203766c1efabb788cd2c82dd1ffee75dc5f94bb7fbaa8e98f24c265bbe7c7eed2a327dd4438608caca5f8607e995e4bd9ff97505af1908f

Download Submit
\Windows\system\EWgDhOf.exe

Filesize
2.1MB

MD5
d7beaded0ca1b5ad43ef62b1642c7562

SHA1
5636b05526361bfc295ed503ebe490bc315d775c

SHA256
e61a957d8032ec3e8b1c8feac5b4b334224332939bfcaa9951bfa8527534e6a6

SHA512
6646997c35fb4722d493b12e7d7f60c7211b41dcad40c310a07c7a36e6999872afcfaf589487e4bb64e5bee8e3e647304e10c7facb225c7f9f7e726d7141733a

Download Submit
\Windows\system\FbsDACG.exe

Filesize
2.1MB

MD5
91b668fb9abf347bc5105f0c3f59647c

SHA1
58b00533438c4d18d1bcb94cc8380a8aead281d5

SHA256
9a7146be8fbc91a623b0c941c07cf1131055b9ec177e3cb246dd49e36cfff379

SHA512
856360e0e0449cc5b865b3d99d4da59119133147b2807a0f5761adffad8ed59c50f26abfc94d954707da7ffa290ae4b0e728fc0cc63f526f828fcd427ce7e0a5

Download Submit
\Windows\system\KDRWVBC.exe

Filesize
2.1MB

MD5
2c77c6bc1419f74b0f39366170ee40b1

SHA1
8b139c07e25e5f6eeb5d50fcbe991cc1a34d9a6f

SHA256
9a7002f7379d414cc45693b356efeecbe4ba63b5ad3a823a8087dca5db5efed4

SHA512
9c05c8ffe062226dc16524566fb7f11f2cbc0521485e5476fac96363802a00a4ab77c697e9f91c88a34fb492dd4a345cbb575b9c62a8a2ca70c2e66824790d4d

Download Submit
\Windows\system\OwqSPZH.exe

Filesize
2.1MB

MD5
c85a19c642b9629633e5bffd9dc5dc82

SHA1
e756f32107a993cc401b34ce2873a3077cabbefe

SHA256
70b2d19a84bf24c858d2821c080398c15fc4fc6b2396c1e481c72cec024366d3

SHA512
8b62e3b50668649f2cd31ded6b3886f46e52723af7ad24b0322066c455a724699078597deea09b39bd5a7508bb7fc4b5907e94e68f663bb296228ed2d3d15f8f

Download Submit
\Windows\system\VDatyeG.exe

Filesize
2.1MB

MD5
6edb2f15f271a5e747df711a638f0eee

SHA1
3c9d490e98b01c7832fa6266f039f004a9285955

SHA256
7bb20d4fa3c3b952a6cb7904b5209bc34a2c31f55e3e16a1aece0fb3eb2032f3

SHA512
4e3c98fcb0b296a0829c879ceaecc225627f1bb0a326bf08576977323df9d455077b84fb5c0adb15db3de17e98182b646f9cc0f2e903766f9639f7ada06ae2a2

Download Submit
\Windows\system\dOwCbgs.exe

Filesize
2.1MB

MD5
69ee77dfb77601716a2cdc9b54558abe

SHA1
9855c64a1108bad051f5a05af962b32bff2bfb7d

SHA256
5fd16542d1683daf78867e107009f12a53e865b6a07cf147c3875b3f999f38e6

SHA512
706ab9657fa83ba88a6eeaef8e02723cf629d615520888f967386d909391007639163127264204d3c371a68742073ae21ec17fc7bb0953406402068c644b4f5b

Download Submit
\Windows\system\lXZrkpG.exe

Filesize
2.1MB

MD5
a90d8cff633e4a308a8d9a2cef660845

SHA1
11e6fd5ff3622aa5baeb5b70b0d83ce4a53a7a02

SHA256
2f1159dc615018564356c2b4b2c285af6da25ee7f66bd6228a69b195e8156f8a

SHA512
2bbd932823a4f2d65d7b7046a534eeef65bf529931cdcf2275cb7e6eadcbee6164adcc2610069e3814be94b7502e7da2229349eb3c5be3062a2ab7923f0ba74a

Download Submit
memory/1280-25-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/1280-5076-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/1416-86-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1416-5094-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1416-1457-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1712-23-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/1712-5077-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/1776-65-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/1776-66-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2244-29-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-5088-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-22-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2552-5091-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2584-84-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-1406-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2584-26-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2584-27-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-350-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2584-37-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2584-52-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2584-83-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-0-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2584-60-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2584-85-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2584-42-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2584-17-0x0000000002F80000-0x0000000003372000-memory.dmp

Filesize
3.9MB

Download
memory/2584-88-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2724-5083-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2780-5082-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2780-59-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2792-5085-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2792-63-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2848-43-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-722-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-5130-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-1446-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2896-5099-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2896-82-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/3064-87-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/3064-5090-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download