xmrig | f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
Size

1.5MB
MD5

9b5480eb34324286fc42f8dcd25c985a
SHA1

d3c4bd08f1add351048accf617e2b2fac002531d
SHA256

f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1
SHA512

a5ee4f11155b613fdfdd6a228e983c295e7234fb1d31d804a43757c611a2de2d9c1f15c2b577aaa69c59b97ff187165f15c60b4954a6a23cca00be822153a7ff
SSDEEP

24576:EnCbLE/tyK3yt0mFdfE0bLBgDOph4THCGLQTfwlKjoIdBF672l6i2Ncb2ygupgre:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgy

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 62 IoCs

miner

resource	yara_rule
behavioral1/memory/2356-0-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/files/0x000b000000012260-3.dat	xmrig
behavioral1/files/0x0008000000016cf0-10.dat	xmrig
behavioral1/files/0x0007000000016d5a-18.dat	xmrig
behavioral1/files/0x0007000000016d71-22.dat	xmrig
behavioral1/files/0x000a000000016e1d-25.dat	xmrig
behavioral1/files/0x000500000001948d-37.dat	xmrig
behavioral1/files/0x00050000000195ce-77.dat	xmrig
behavioral1/files/0x00050000000196a0-97.dat	xmrig
behavioral1/files/0x0005000000019cd5-121.dat	xmrig
behavioral1/memory/2052-939-0x000000013FA40000-0x000000013FD94000-memory.dmp	xmrig
behavioral1/memory/2060-947-0x000000013F460000-0x000000013F7B4000-memory.dmp	xmrig
behavioral1/memory/2528-965-0x000000013FE40000-0x0000000140194000-memory.dmp	xmrig
behavioral1/memory/2940-963-0x000000013F0B0000-0x000000013F404000-memory.dmp	xmrig
behavioral1/memory/2780-961-0x000000013FEC0000-0x0000000140214000-memory.dmp	xmrig
behavioral1/memory/2944-959-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2820-957-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2792-955-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2172-953-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/memory/2456-951-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/3044-949-0x000000013F680000-0x000000013F9D4000-memory.dmp	xmrig
behavioral1/memory/2028-945-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/1096-943-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/1956-941-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/files/0x0005000000019d5c-129.dat	xmrig
behavioral1/files/0x0005000000019cfc-125.dat	xmrig
behavioral1/files/0x0005000000019c0b-117.dat	xmrig
behavioral1/files/0x0005000000019bf2-113.dat	xmrig
behavioral1/files/0x0005000000019bf0-110.dat	xmrig
behavioral1/files/0x0005000000019bec-105.dat	xmrig
behavioral1/files/0x0005000000019931-101.dat	xmrig
behavioral1/files/0x0005000000019665-93.dat	xmrig
behavioral1/files/0x0005000000019624-89.dat	xmrig
behavioral1/files/0x00050000000195e0-85.dat	xmrig
behavioral1/files/0x00050000000195d0-81.dat	xmrig
behavioral1/files/0x00050000000195cc-74.dat	xmrig
behavioral1/files/0x00050000000195ca-69.dat	xmrig
behavioral1/files/0x00050000000195c8-66.dat	xmrig
behavioral1/files/0x00050000000195c7-61.dat	xmrig
behavioral1/files/0x00050000000195c6-58.dat	xmrig
behavioral1/files/0x00050000000195c4-54.dat	xmrig
behavioral1/files/0x00050000000195c2-49.dat	xmrig
behavioral1/files/0x000500000001958b-45.dat	xmrig
behavioral1/files/0x00050000000194e2-41.dat	xmrig
behavioral1/files/0x0007000000018634-33.dat	xmrig
behavioral1/files/0x0009000000016f45-30.dat	xmrig
behavioral1/files/0x0007000000016d49-14.dat	xmrig
behavioral1/memory/2356-4035-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/memory/2528-4051-0x000000013FE40000-0x0000000140194000-memory.dmp	xmrig
behavioral1/memory/2028-4052-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/3044-4057-0x000000013F680000-0x000000013F9D4000-memory.dmp	xmrig
behavioral1/memory/2820-4056-0x000000013F2B0000-0x000000013F604000-memory.dmp	xmrig
behavioral1/memory/2172-4055-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/memory/2780-4054-0x000000013FEC0000-0x0000000140214000-memory.dmp	xmrig
behavioral1/memory/1956-4053-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2792-4061-0x000000013FC00000-0x000000013FF54000-memory.dmp	xmrig
behavioral1/memory/2456-4064-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/2944-4063-0x000000013FDA0000-0x00000001400F4000-memory.dmp	xmrig
behavioral1/memory/2940-4062-0x000000013F0B0000-0x000000013F404000-memory.dmp	xmrig
behavioral1/memory/1096-4060-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/2060-4059-0x000000013F460000-0x000000013F7B4000-memory.dmp	xmrig
behavioral1/memory/2052-4058-0x000000013FA40000-0x000000013FD94000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2528	GdIESJd.exe
2052	RssHfKd.exe
1956	KrysZRh.exe
1096	jDWhIkH.exe
2028	xCBQgFG.exe
2060	WwCJMpW.exe
3044	tYkGLBn.exe
2456	jaEgMVv.exe
2172	lGkcDZX.exe
2792	pKaqlai.exe
2820	oJZzsyR.exe
2944	TetHWjX.exe
2780	pZcAqqf.exe
2940	JXDImIo.exe
2220	zEdYobi.exe
2748	xDWASdY.exe
2728	YvwPJrU.exe
1404	LlwLIEy.exe
2576	OtNhIYM.exe
2632	SUQivNr.exe
2608	qiSQPWW.exe
2732	wnCAeGZ.exe
2044	pEdoUnv.exe
1496	LbmjPPt.exe
1696	aLXCEVx.exe
1984	pJhbYRJ.exe
1456	tvzAOLd.exe
1588	TiwxeQy.exe
2620	uSSUcWb.exe
2868	ouXtFdG.exe
1908	JpmJONj.exe
2276	zFKzNaY.exe
2900	FrNlDCg.exe
2396	sKqLDgu.exe
2156	EaRUTUy.exe
1304	yovOBKF.exe
852	LyKrfTy.exe
2848	ZBxJdxE.exe
448	wLuEfnp.exe
2080	XjJjANI.exe
2168	TBdJpta.exe
1632	hjAkJzb.exe
1368	GkdUeMs.exe
1852	TOuWnAp.exe
2300	HNftMNs.exe
488	XmtqDlL.exe
2020	QihfWuX.exe
1648	GNkebiM.exe
352	VYJXkud.exe
2448	EuUjmHG.exe
2076	LPndxxJ.exe
1980	PlLSrhz.exe
1508	eODokIS.exe
1132	ocmUiPd.exe
2368	eGtzMAD.exe
1576	xbFqdIC.exe
1604	ygJgISG.exe
2348	PjNLLii.exe
2096	ynRDXVU.exe
2928	VvgReWu.exe
1748	JlvNIns.exe
2716	ehzdNot.exe
2768	gZaZDBO.exe
3040	bVUUFDh.exe

Loads dropped DLL 64 IoCs

pid	Process
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-0-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/files/0x000b000000012260-3.dat	upx
behavioral1/files/0x0008000000016cf0-10.dat	upx
behavioral1/files/0x0007000000016d5a-18.dat	upx
behavioral1/files/0x0007000000016d71-22.dat	upx
behavioral1/files/0x000a000000016e1d-25.dat	upx
behavioral1/files/0x000500000001948d-37.dat	upx
behavioral1/files/0x00050000000195ce-77.dat	upx
behavioral1/files/0x00050000000196a0-97.dat	upx
behavioral1/files/0x0005000000019cd5-121.dat	upx
behavioral1/memory/2052-939-0x000000013FA40000-0x000000013FD94000-memory.dmp	upx
behavioral1/memory/2060-947-0x000000013F460000-0x000000013F7B4000-memory.dmp	upx
behavioral1/memory/2528-965-0x000000013FE40000-0x0000000140194000-memory.dmp	upx
behavioral1/memory/2940-963-0x000000013F0B0000-0x000000013F404000-memory.dmp	upx
behavioral1/memory/2780-961-0x000000013FEC0000-0x0000000140214000-memory.dmp	upx
behavioral1/memory/2944-959-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2820-957-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2792-955-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2172-953-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/memory/2456-951-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/3044-949-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx
behavioral1/memory/2028-945-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/1096-943-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/memory/1956-941-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/files/0x0005000000019d5c-129.dat	upx
behavioral1/files/0x0005000000019cfc-125.dat	upx
behavioral1/files/0x0005000000019c0b-117.dat	upx
behavioral1/files/0x0005000000019bf2-113.dat	upx
behavioral1/files/0x0005000000019bf0-110.dat	upx
behavioral1/files/0x0005000000019bec-105.dat	upx
behavioral1/files/0x0005000000019931-101.dat	upx
behavioral1/files/0x0005000000019665-93.dat	upx
behavioral1/files/0x0005000000019624-89.dat	upx
behavioral1/files/0x00050000000195e0-85.dat	upx
behavioral1/files/0x00050000000195d0-81.dat	upx
behavioral1/files/0x00050000000195cc-74.dat	upx
behavioral1/files/0x00050000000195ca-69.dat	upx
behavioral1/files/0x00050000000195c8-66.dat	upx
behavioral1/files/0x00050000000195c7-61.dat	upx
behavioral1/files/0x00050000000195c6-58.dat	upx
behavioral1/files/0x00050000000195c4-54.dat	upx
behavioral1/files/0x00050000000195c2-49.dat	upx
behavioral1/files/0x000500000001958b-45.dat	upx
behavioral1/files/0x00050000000194e2-41.dat	upx
behavioral1/files/0x0007000000018634-33.dat	upx
behavioral1/files/0x0009000000016f45-30.dat	upx
behavioral1/files/0x0007000000016d49-14.dat	upx
behavioral1/memory/2356-4035-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2528-4051-0x000000013FE40000-0x0000000140194000-memory.dmp	upx
behavioral1/memory/2028-4052-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/3044-4057-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx
behavioral1/memory/2820-4056-0x000000013F2B0000-0x000000013F604000-memory.dmp	upx
behavioral1/memory/2172-4055-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/memory/2780-4054-0x000000013FEC0000-0x0000000140214000-memory.dmp	upx
behavioral1/memory/1956-4053-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2792-4061-0x000000013FC00000-0x000000013FF54000-memory.dmp	upx
behavioral1/memory/2456-4064-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/2944-4063-0x000000013FDA0000-0x00000001400F4000-memory.dmp	upx
behavioral1/memory/2940-4062-0x000000013F0B0000-0x000000013F404000-memory.dmp	upx
behavioral1/memory/1096-4060-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/memory/2060-4059-0x000000013F460000-0x000000013F7B4000-memory.dmp	upx
behavioral1/memory/2052-4058-0x000000013FA40000-0x000000013FD94000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KwrBPDp.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\AESTIqn.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\GKwUQYq.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\XnmcaTL.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\VpeSMhE.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\CaCjGuu.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\zckewOF.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\TLDuKnY.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\rhnQSQi.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\cmoOIPV.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\yqUDTXR.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\SrGWZHe.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\VoFylMx.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\ytxklJw.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\DrpKQqq.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\mrYAdkl.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\krRUOOO.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\FsPkpRK.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\WqjYgEX.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\SQiatRW.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\cgrGQME.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\DCrKjpi.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\SUQivNr.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\jnRptMO.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\wmAnNlw.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\zlerTsO.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\HPnoJyd.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\DyEuSet.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\GqURabd.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\jjYOQQf.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\VmYeTjw.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\KdDVaTx.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\TSEOAlZ.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\PsdzUAJ.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\hkAqAae.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\MZvfBdZ.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\vDkmlJt.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\HhJAZSR.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\QLVZcKH.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\zjayJfv.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\cdMthUf.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\dzWbibj.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\QBKQYWj.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\qgyIFFo.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\VJGNTgz.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\rWSqHbX.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\XhBsNGq.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\pxFyqvw.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\VYoZsJz.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\XqFOHIZ.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\LaWzvFe.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\qEbgktD.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\IrgIgqC.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\zRQMKnF.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\zYdRHWK.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\XJtNSnR.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\qwUhKOu.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\kzBOeZw.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\YuQgXEt.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\OMKDpUI.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\LprrMkn.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\XHzWnZl.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\KrbWsaM.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
File created	C:\Windows\System\DsInXVb.exe	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2528	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	31
PID 2356 wrote to memory of 2528	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	31
PID 2356 wrote to memory of 2528	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	31
PID 2356 wrote to memory of 2052	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	32
PID 2356 wrote to memory of 2052	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	32
PID 2356 wrote to memory of 2052	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	32
PID 2356 wrote to memory of 1956	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	33
PID 2356 wrote to memory of 1956	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	33
PID 2356 wrote to memory of 1956	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	33
PID 2356 wrote to memory of 1096	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	34
PID 2356 wrote to memory of 1096	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	34
PID 2356 wrote to memory of 1096	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	34
PID 2356 wrote to memory of 2028	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	35
PID 2356 wrote to memory of 2028	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	35
PID 2356 wrote to memory of 2028	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	35
PID 2356 wrote to memory of 2060	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	36
PID 2356 wrote to memory of 2060	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	36
PID 2356 wrote to memory of 2060	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	36
PID 2356 wrote to memory of 3044	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	37
PID 2356 wrote to memory of 3044	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	37
PID 2356 wrote to memory of 3044	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	37
PID 2356 wrote to memory of 2456	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	38
PID 2356 wrote to memory of 2456	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	38
PID 2356 wrote to memory of 2456	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	38
PID 2356 wrote to memory of 2172	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	39
PID 2356 wrote to memory of 2172	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	39
PID 2356 wrote to memory of 2172	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	39
PID 2356 wrote to memory of 2792	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	40
PID 2356 wrote to memory of 2792	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	40
PID 2356 wrote to memory of 2792	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	40
PID 2356 wrote to memory of 2820	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	41
PID 2356 wrote to memory of 2820	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	41
PID 2356 wrote to memory of 2820	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	41
PID 2356 wrote to memory of 2944	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	42
PID 2356 wrote to memory of 2944	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	42
PID 2356 wrote to memory of 2944	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	42
PID 2356 wrote to memory of 2780	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	43
PID 2356 wrote to memory of 2780	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	43
PID 2356 wrote to memory of 2780	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	43
PID 2356 wrote to memory of 2940	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	44
PID 2356 wrote to memory of 2940	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	44
PID 2356 wrote to memory of 2940	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	44
PID 2356 wrote to memory of 2220	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	45
PID 2356 wrote to memory of 2220	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	45
PID 2356 wrote to memory of 2220	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	45
PID 2356 wrote to memory of 2748	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	46
PID 2356 wrote to memory of 2748	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	46
PID 2356 wrote to memory of 2748	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	46
PID 2356 wrote to memory of 2728	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	47
PID 2356 wrote to memory of 2728	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	47
PID 2356 wrote to memory of 2728	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	47
PID 2356 wrote to memory of 1404	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	48
PID 2356 wrote to memory of 1404	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	48
PID 2356 wrote to memory of 1404	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	48
PID 2356 wrote to memory of 2576	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	49
PID 2356 wrote to memory of 2576	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	49
PID 2356 wrote to memory of 2576	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	49
PID 2356 wrote to memory of 2632	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	50
PID 2356 wrote to memory of 2632	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	50
PID 2356 wrote to memory of 2632	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	50
PID 2356 wrote to memory of 2608	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	51
PID 2356 wrote to memory of 2608	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	51
PID 2356 wrote to memory of 2608	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	51
PID 2356 wrote to memory of 2732	2356	JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f58ed0f75f1841a8daf6c064a4aa0ff2c384e9585cfcf602363d290be90d47b1.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\System\GdIESJd.exe
  C:\Windows\System\GdIESJd.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\RssHfKd.exe
  C:\Windows\System\RssHfKd.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\KrysZRh.exe
  C:\Windows\System\KrysZRh.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\jDWhIkH.exe
  C:\Windows\System\jDWhIkH.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\xCBQgFG.exe
  C:\Windows\System\xCBQgFG.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\WwCJMpW.exe
  C:\Windows\System\WwCJMpW.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\tYkGLBn.exe
  C:\Windows\System\tYkGLBn.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\jaEgMVv.exe
  C:\Windows\System\jaEgMVv.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\lGkcDZX.exe
  C:\Windows\System\lGkcDZX.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\pKaqlai.exe
  C:\Windows\System\pKaqlai.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\oJZzsyR.exe
  C:\Windows\System\oJZzsyR.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\TetHWjX.exe
  C:\Windows\System\TetHWjX.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\pZcAqqf.exe
  C:\Windows\System\pZcAqqf.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JXDImIo.exe
  C:\Windows\System\JXDImIo.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\zEdYobi.exe
  C:\Windows\System\zEdYobi.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\xDWASdY.exe
  C:\Windows\System\xDWASdY.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\YvwPJrU.exe
  C:\Windows\System\YvwPJrU.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\LlwLIEy.exe
  C:\Windows\System\LlwLIEy.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\OtNhIYM.exe
  C:\Windows\System\OtNhIYM.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\SUQivNr.exe
  C:\Windows\System\SUQivNr.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\qiSQPWW.exe
  C:\Windows\System\qiSQPWW.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wnCAeGZ.exe
  C:\Windows\System\wnCAeGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\pEdoUnv.exe
  C:\Windows\System\pEdoUnv.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\LbmjPPt.exe
  C:\Windows\System\LbmjPPt.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\aLXCEVx.exe
  C:\Windows\System\aLXCEVx.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\pJhbYRJ.exe
  C:\Windows\System\pJhbYRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\tvzAOLd.exe
  C:\Windows\System\tvzAOLd.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\TiwxeQy.exe
  C:\Windows\System\TiwxeQy.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\uSSUcWb.exe
  C:\Windows\System\uSSUcWb.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\ouXtFdG.exe
  C:\Windows\System\ouXtFdG.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\JpmJONj.exe
  C:\Windows\System\JpmJONj.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\zFKzNaY.exe
  C:\Windows\System\zFKzNaY.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\FrNlDCg.exe
  C:\Windows\System\FrNlDCg.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\sKqLDgu.exe
  C:\Windows\System\sKqLDgu.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\EaRUTUy.exe
  C:\Windows\System\EaRUTUy.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ZBxJdxE.exe
  C:\Windows\System\ZBxJdxE.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\yovOBKF.exe
  C:\Windows\System\yovOBKF.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\wLuEfnp.exe
  C:\Windows\System\wLuEfnp.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\LyKrfTy.exe
  C:\Windows\System\LyKrfTy.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\XjJjANI.exe
  C:\Windows\System\XjJjANI.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\TBdJpta.exe
  C:\Windows\System\TBdJpta.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\hjAkJzb.exe
  C:\Windows\System\hjAkJzb.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\GkdUeMs.exe
  C:\Windows\System\GkdUeMs.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\TOuWnAp.exe
  C:\Windows\System\TOuWnAp.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\HNftMNs.exe
  C:\Windows\System\HNftMNs.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\XmtqDlL.exe
  C:\Windows\System\XmtqDlL.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\QihfWuX.exe
  C:\Windows\System\QihfWuX.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\GNkebiM.exe
  C:\Windows\System\GNkebiM.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\VYJXkud.exe
  C:\Windows\System\VYJXkud.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\EuUjmHG.exe
  C:\Windows\System\EuUjmHG.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\LPndxxJ.exe
  C:\Windows\System\LPndxxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\PlLSrhz.exe
  C:\Windows\System\PlLSrhz.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\eODokIS.exe
  C:\Windows\System\eODokIS.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\ocmUiPd.exe
  C:\Windows\System\ocmUiPd.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\eGtzMAD.exe
  C:\Windows\System\eGtzMAD.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\xbFqdIC.exe
  C:\Windows\System\xbFqdIC.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ygJgISG.exe
  C:\Windows\System\ygJgISG.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\PjNLLii.exe
  C:\Windows\System\PjNLLii.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ynRDXVU.exe
  C:\Windows\System\ynRDXVU.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\VvgReWu.exe
  C:\Windows\System\VvgReWu.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\JlvNIns.exe
  C:\Windows\System\JlvNIns.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\ehzdNot.exe
  C:\Windows\System\ehzdNot.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gZaZDBO.exe
  C:\Windows\System\gZaZDBO.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\bVUUFDh.exe
  C:\Windows\System\bVUUFDh.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\FTjsRUM.exe
  C:\Windows\System\FTjsRUM.exe
  2⤵
  PID:2564
- C:\Windows\System\RKFrAmY.exe
  C:\Windows\System\RKFrAmY.exe
  2⤵
  PID:2232
- C:\Windows\System\MLAUXuX.exe
  C:\Windows\System\MLAUXuX.exe
  2⤵
  PID:684
- C:\Windows\System\DBUTSfu.exe
  C:\Windows\System\DBUTSfu.exe
  2⤵
  PID:2108
- C:\Windows\System\GSsdSKn.exe
  C:\Windows\System\GSsdSKn.exe
  2⤵
  PID:2884
- C:\Windows\System\PjifKLQ.exe
  C:\Windows\System\PjifKLQ.exe
  2⤵
  PID:2184
- C:\Windows\System\DivMXdF.exe
  C:\Windows\System\DivMXdF.exe
  2⤵
  PID:2892
- C:\Windows\System\RsYBvzX.exe
  C:\Windows\System\RsYBvzX.exe
  2⤵
  PID:1088
- C:\Windows\System\iEAAYwa.exe
  C:\Windows\System\iEAAYwa.exe
  2⤵
  PID:280
- C:\Windows\System\vDDEMsm.exe
  C:\Windows\System\vDDEMsm.exe
  2⤵
  PID:2740
- C:\Windows\System\lskQhBa.exe
  C:\Windows\System\lskQhBa.exe
  2⤵
  PID:1108
- C:\Windows\System\WLVhYZv.exe
  C:\Windows\System\WLVhYZv.exe
  2⤵
  PID:2032
- C:\Windows\System\ZPOmDMe.exe
  C:\Windows\System\ZPOmDMe.exe
  2⤵
  PID:1616
- C:\Windows\System\DVQGdhg.exe
  C:\Windows\System\DVQGdhg.exe
  2⤵
  PID:1680
- C:\Windows\System\UQXdoEC.exe
  C:\Windows\System\UQXdoEC.exe
  2⤵
  PID:1624
- C:\Windows\System\ktYofXa.exe
  C:\Windows\System\ktYofXa.exe
  2⤵
  PID:876
- C:\Windows\System\VeIhild.exe
  C:\Windows\System\VeIhild.exe
  2⤵
  PID:640
- C:\Windows\System\hmvgEAm.exe
  C:\Windows\System\hmvgEAm.exe
  2⤵
  PID:1552
- C:\Windows\System\zlerTsO.exe
  C:\Windows\System\zlerTsO.exe
  2⤵
  PID:908
- C:\Windows\System\uoUcZoh.exe
  C:\Windows\System\uoUcZoh.exe
  2⤵
  PID:1032
- C:\Windows\System\ksBdDzs.exe
  C:\Windows\System\ksBdDzs.exe
  2⤵
  PID:2416
- C:\Windows\System\jqsXSrc.exe
  C:\Windows\System\jqsXSrc.exe
  2⤵
  PID:760
- C:\Windows\System\hYihffY.exe
  C:\Windows\System\hYihffY.exe
  2⤵
  PID:1820
- C:\Windows\System\bgPxBdf.exe
  C:\Windows\System\bgPxBdf.exe
  2⤵
  PID:2440
- C:\Windows\System\lSRacDi.exe
  C:\Windows\System\lSRacDi.exe
  2⤵
  PID:2116
- C:\Windows\System\KeMCPpT.exe
  C:\Windows\System\KeMCPpT.exe
  2⤵
  PID:884
- C:\Windows\System\YNvXjUV.exe
  C:\Windows\System\YNvXjUV.exe
  2⤵
  PID:1600
- C:\Windows\System\MZObbys.exe
  C:\Windows\System\MZObbys.exe
  2⤵
  PID:2024
- C:\Windows\System\nWeDPpo.exe
  C:\Windows\System\nWeDPpo.exe
  2⤵
  PID:2840
- C:\Windows\System\QthJuYY.exe
  C:\Windows\System\QthJuYY.exe
  2⤵
  PID:2248
- C:\Windows\System\IFFvwoo.exe
  C:\Windows\System\IFFvwoo.exe
  2⤵
  PID:2804
- C:\Windows\System\XENrLPa.exe
  C:\Windows\System\XENrLPa.exe
  2⤵
  PID:2832
- C:\Windows\System\WfAzYAt.exe
  C:\Windows\System\WfAzYAt.exe
  2⤵
  PID:2636
- C:\Windows\System\CMYirDm.exe
  C:\Windows\System\CMYirDm.exe
  2⤵
  PID:1328
- C:\Windows\System\MZvfBdZ.exe
  C:\Windows\System\MZvfBdZ.exe
  2⤵
  PID:1488
- C:\Windows\System\SJOSxjX.exe
  C:\Windows\System\SJOSxjX.exe
  2⤵
  PID:1936
- C:\Windows\System\DZgAkZK.exe
  C:\Windows\System\DZgAkZK.exe
  2⤵
  PID:1480
- C:\Windows\System\TzGnWcb.exe
  C:\Windows\System\TzGnWcb.exe
  2⤵
  PID:1460
- C:\Windows\System\YMzhzfH.exe
  C:\Windows\System\YMzhzfH.exe
  2⤵
  PID:2844
- C:\Windows\System\SwJrqyq.exe
  C:\Windows\System\SwJrqyq.exe
  2⤵
  PID:1928
- C:\Windows\System\nHjuZow.exe
  C:\Windows\System\nHjuZow.exe
  2⤵
  PID:3088
- C:\Windows\System\iubAeya.exe
  C:\Windows\System\iubAeya.exe
  2⤵
  PID:3108
- C:\Windows\System\rstzxdI.exe
  C:\Windows\System\rstzxdI.exe
  2⤵
  PID:3128
- C:\Windows\System\pfDRhvH.exe
  C:\Windows\System\pfDRhvH.exe
  2⤵
  PID:3152
- C:\Windows\System\cpOqznJ.exe
  C:\Windows\System\cpOqznJ.exe
  2⤵
  PID:3172
- C:\Windows\System\MPTHdSi.exe
  C:\Windows\System\MPTHdSi.exe
  2⤵
  PID:3192
- C:\Windows\System\LXvGMin.exe
  C:\Windows\System\LXvGMin.exe
  2⤵
  PID:3208
- C:\Windows\System\FQdjdoR.exe
  C:\Windows\System\FQdjdoR.exe
  2⤵
  PID:3232
- C:\Windows\System\LQsmSOO.exe
  C:\Windows\System\LQsmSOO.exe
  2⤵
  PID:3248
- C:\Windows\System\UhrzlPg.exe
  C:\Windows\System\UhrzlPg.exe
  2⤵
  PID:3268
- C:\Windows\System\Obcbzpg.exe
  C:\Windows\System\Obcbzpg.exe
  2⤵
  PID:3288
- C:\Windows\System\EzzKDft.exe
  C:\Windows\System\EzzKDft.exe
  2⤵
  PID:3308
- C:\Windows\System\YkMeQnk.exe
  C:\Windows\System\YkMeQnk.exe
  2⤵
  PID:3328
- C:\Windows\System\AhTBgKF.exe
  C:\Windows\System\AhTBgKF.exe
  2⤵
  PID:3352
- C:\Windows\System\yxbVzIW.exe
  C:\Windows\System\yxbVzIW.exe
  2⤵
  PID:3368
- C:\Windows\System\GCGiaKK.exe
  C:\Windows\System\GCGiaKK.exe
  2⤵
  PID:3388
- C:\Windows\System\YuQgXEt.exe
  C:\Windows\System\YuQgXEt.exe
  2⤵
  PID:3412
- C:\Windows\System\cIWoznU.exe
  C:\Windows\System\cIWoznU.exe
  2⤵
  PID:3428
- C:\Windows\System\RCbnZXD.exe
  C:\Windows\System\RCbnZXD.exe
  2⤵
  PID:3452
- C:\Windows\System\JiYDmYi.exe
  C:\Windows\System\JiYDmYi.exe
  2⤵
  PID:3472
- C:\Windows\System\cHTqNxr.exe
  C:\Windows\System\cHTqNxr.exe
  2⤵
  PID:3492
- C:\Windows\System\hHqhqFG.exe
  C:\Windows\System\hHqhqFG.exe
  2⤵
  PID:3512
- C:\Windows\System\EDYKSPb.exe
  C:\Windows\System\EDYKSPb.exe
  2⤵
  PID:3528
- C:\Windows\System\GNVxIVP.exe
  C:\Windows\System\GNVxIVP.exe
  2⤵
  PID:3548
- C:\Windows\System\eVUIwVh.exe
  C:\Windows\System\eVUIwVh.exe
  2⤵
  PID:3568
- C:\Windows\System\tuTVfRN.exe
  C:\Windows\System\tuTVfRN.exe
  2⤵
  PID:3584
- C:\Windows\System\pFGODbY.exe
  C:\Windows\System\pFGODbY.exe
  2⤵
  PID:3608
- C:\Windows\System\pLMVBMh.exe
  C:\Windows\System\pLMVBMh.exe
  2⤵
  PID:3624
- C:\Windows\System\IzLBqbX.exe
  C:\Windows\System\IzLBqbX.exe
  2⤵
  PID:3648
- C:\Windows\System\iVGwHbu.exe
  C:\Windows\System\iVGwHbu.exe
  2⤵
  PID:3672
- C:\Windows\System\jURWrGk.exe
  C:\Windows\System\jURWrGk.exe
  2⤵
  PID:3692
- C:\Windows\System\irADkDb.exe
  C:\Windows\System\irADkDb.exe
  2⤵
  PID:3708
- C:\Windows\System\tVuZwja.exe
  C:\Windows\System\tVuZwja.exe
  2⤵
  PID:3728
- C:\Windows\System\EywEFFw.exe
  C:\Windows\System\EywEFFw.exe
  2⤵
  PID:3748
- C:\Windows\System\NkTMJXe.exe
  C:\Windows\System\NkTMJXe.exe
  2⤵
  PID:3768
- C:\Windows\System\DEQEFYP.exe
  C:\Windows\System\DEQEFYP.exe
  2⤵
  PID:3792
- C:\Windows\System\AFdiNCF.exe
  C:\Windows\System\AFdiNCF.exe
  2⤵
  PID:3812
- C:\Windows\System\aGrrzah.exe
  C:\Windows\System\aGrrzah.exe
  2⤵
  PID:3832
- C:\Windows\System\HHwubKG.exe
  C:\Windows\System\HHwubKG.exe
  2⤵
  PID:3848
- C:\Windows\System\rJjuNTq.exe
  C:\Windows\System\rJjuNTq.exe
  2⤵
  PID:3872
- C:\Windows\System\zvuXmYe.exe
  C:\Windows\System\zvuXmYe.exe
  2⤵
  PID:3888
- C:\Windows\System\OMKDpUI.exe
  C:\Windows\System\OMKDpUI.exe
  2⤵
  PID:3912
- C:\Windows\System\ALrIHrq.exe
  C:\Windows\System\ALrIHrq.exe
  2⤵
  PID:3932
- C:\Windows\System\HIzDvJA.exe
  C:\Windows\System\HIzDvJA.exe
  2⤵
  PID:3952
- C:\Windows\System\WagAEUJ.exe
  C:\Windows\System\WagAEUJ.exe
  2⤵
  PID:3968
- C:\Windows\System\bscilZY.exe
  C:\Windows\System\bscilZY.exe
  2⤵
  PID:3988
- C:\Windows\System\TqxChbB.exe
  C:\Windows\System\TqxChbB.exe
  2⤵
  PID:4012
- C:\Windows\System\Cxwckfg.exe
  C:\Windows\System\Cxwckfg.exe
  2⤵
  PID:4032
- C:\Windows\System\GQhqXqg.exe
  C:\Windows\System\GQhqXqg.exe
  2⤵
  PID:4048
- C:\Windows\System\SIjULch.exe
  C:\Windows\System\SIjULch.exe
  2⤵
  PID:4072
- C:\Windows\System\ocIUqwf.exe
  C:\Windows\System\ocIUqwf.exe
  2⤵
  PID:4088
- C:\Windows\System\numEXkK.exe
  C:\Windows\System\numEXkK.exe
  2⤵
  PID:1772
- C:\Windows\System\sjmHMfA.exe
  C:\Windows\System\sjmHMfA.exe
  2⤵
  PID:1860
- C:\Windows\System\amSlzVz.exe
  C:\Windows\System\amSlzVz.exe
  2⤵
  PID:1064
- C:\Windows\System\YfbSlQy.exe
  C:\Windows\System\YfbSlQy.exe
  2⤵
  PID:1596
- C:\Windows\System\GBMVLPH.exe
  C:\Windows\System\GBMVLPH.exe
  2⤵
  PID:2260
- C:\Windows\System\DyIZgvt.exe
  C:\Windows\System\DyIZgvt.exe
  2⤵
  PID:2436
- C:\Windows\System\IqCkJGU.exe
  C:\Windows\System\IqCkJGU.exe
  2⤵
  PID:560
- C:\Windows\System\qdNsHho.exe
  C:\Windows\System\qdNsHho.exe
  2⤵
  PID:2932
- C:\Windows\System\kceGJmz.exe
  C:\Windows\System\kceGJmz.exe
  2⤵
  PID:2100
- C:\Windows\System\MuFJAgt.exe
  C:\Windows\System\MuFJAgt.exe
  2⤵
  PID:2836
- C:\Windows\System\DbFKByy.exe
  C:\Windows\System\DbFKByy.exe
  2⤵
  PID:2568
- C:\Windows\System\SpWjOVk.exe
  C:\Windows\System\SpWjOVk.exe
  2⤵
  PID:2132
- C:\Windows\System\txyZWCK.exe
  C:\Windows\System\txyZWCK.exe
  2⤵
  PID:1040
- C:\Windows\System\QQDLREW.exe
  C:\Windows\System\QQDLREW.exe
  2⤵
  PID:2324
- C:\Windows\System\URmxnwg.exe
  C:\Windows\System\URmxnwg.exe
  2⤵
  PID:2240
- C:\Windows\System\fULghko.exe
  C:\Windows\System\fULghko.exe
  2⤵
  PID:2772
- C:\Windows\System\YvUvKqi.exe
  C:\Windows\System\YvUvKqi.exe
  2⤵
  PID:3084
- C:\Windows\System\hCFRBgx.exe
  C:\Windows\System\hCFRBgx.exe
  2⤵
  PID:3148
- C:\Windows\System\qAMkTUB.exe
  C:\Windows\System\qAMkTUB.exe
  2⤵
  PID:3160
- C:\Windows\System\bsHZJKc.exe
  C:\Windows\System\bsHZJKc.exe
  2⤵
  PID:3188
- C:\Windows\System\vkKysSx.exe
  C:\Windows\System\vkKysSx.exe
  2⤵
  PID:3204
- C:\Windows\System\ifanxIQ.exe
  C:\Windows\System\ifanxIQ.exe
  2⤵
  PID:3296
- C:\Windows\System\AueAxzM.exe
  C:\Windows\System\AueAxzM.exe
  2⤵
  PID:3304
- C:\Windows\System\tnZXSsi.exe
  C:\Windows\System\tnZXSsi.exe
  2⤵
  PID:3340
- C:\Windows\System\eANDvDs.exe
  C:\Windows\System\eANDvDs.exe
  2⤵
  PID:3320
- C:\Windows\System\SnxavJs.exe
  C:\Windows\System\SnxavJs.exe
  2⤵
  PID:3396
- C:\Windows\System\poiDlTN.exe
  C:\Windows\System\poiDlTN.exe
  2⤵
  PID:3424
- C:\Windows\System\vDkmlJt.exe
  C:\Windows\System\vDkmlJt.exe
  2⤵
  PID:3460
- C:\Windows\System\LanBUHw.exe
  C:\Windows\System\LanBUHw.exe
  2⤵
  PID:3500
- C:\Windows\System\EApEWYG.exe
  C:\Windows\System\EApEWYG.exe
  2⤵
  PID:3536
- C:\Windows\System\QfnzMfB.exe
  C:\Windows\System\QfnzMfB.exe
  2⤵
  PID:3524
- C:\Windows\System\IJTaFlt.exe
  C:\Windows\System\IJTaFlt.exe
  2⤵
  PID:3560
- C:\Windows\System\XnmcaTL.exe
  C:\Windows\System\XnmcaTL.exe
  2⤵
  PID:3596
- C:\Windows\System\nyfqpLQ.exe
  C:\Windows\System\nyfqpLQ.exe
  2⤵
  PID:3660
- C:\Windows\System\uIxOXKM.exe
  C:\Windows\System\uIxOXKM.exe
  2⤵
  PID:3704
- C:\Windows\System\prBcyqN.exe
  C:\Windows\System\prBcyqN.exe
  2⤵
  PID:3716
- C:\Windows\System\SGugBnz.exe
  C:\Windows\System\SGugBnz.exe
  2⤵
  PID:3724
- C:\Windows\System\xmMUGbu.exe
  C:\Windows\System\xmMUGbu.exe
  2⤵
  PID:3760
- C:\Windows\System\cvhdYrY.exe
  C:\Windows\System\cvhdYrY.exe
  2⤵
  PID:3824
- C:\Windows\System\dnlKVzk.exe
  C:\Windows\System\dnlKVzk.exe
  2⤵
  PID:3860
- C:\Windows\System\IUXsOyR.exe
  C:\Windows\System\IUXsOyR.exe
  2⤵
  PID:3844
- C:\Windows\System\AyuTvvG.exe
  C:\Windows\System\AyuTvvG.exe
  2⤵
  PID:3884
- C:\Windows\System\bHcOgve.exe
  C:\Windows\System\bHcOgve.exe
  2⤵
  PID:3924
- C:\Windows\System\YIOYmQw.exe
  C:\Windows\System\YIOYmQw.exe
  2⤵
  PID:3984
- C:\Windows\System\rnNATvB.exe
  C:\Windows\System\rnNATvB.exe
  2⤵
  PID:4000
- C:\Windows\System\lifmsYe.exe
  C:\Windows\System\lifmsYe.exe
  2⤵
  PID:4028
- C:\Windows\System\ZKKyARx.exe
  C:\Windows\System\ZKKyARx.exe
  2⤵
  PID:4064
- C:\Windows\System\JxqiSgV.exe
  C:\Windows\System\JxqiSgV.exe
  2⤵
  PID:2152
- C:\Windows\System\louPKos.exe
  C:\Windows\System\louPKos.exe
  2⤵
  PID:2880
- C:\Windows\System\HhJAZSR.exe
  C:\Windows\System\HhJAZSR.exe
  2⤵
  PID:1204
- C:\Windows\System\nVNwANH.exe
  C:\Windows\System\nVNwANH.exe
  2⤵
  PID:656
- C:\Windows\System\wyAzelL.exe
  C:\Windows\System\wyAzelL.exe
  2⤵
  PID:1736
- C:\Windows\System\VVbvtbp.exe
  C:\Windows\System\VVbvtbp.exe
  2⤵
  PID:2524
- C:\Windows\System\PAvxawJ.exe
  C:\Windows\System\PAvxawJ.exe
  2⤵
  PID:2744
- C:\Windows\System\cTdAAbF.exe
  C:\Windows\System\cTdAAbF.exe
  2⤵
  PID:2808
- C:\Windows\System\tWNTxaZ.exe
  C:\Windows\System\tWNTxaZ.exe
  2⤵
  PID:2920
- C:\Windows\System\uCpJBYf.exe
  C:\Windows\System\uCpJBYf.exe
  2⤵
  PID:2660
- C:\Windows\System\oWYxvYA.exe
  C:\Windows\System\oWYxvYA.exe
  2⤵
  PID:1080
- C:\Windows\System\FNCKAoM.exe
  C:\Windows\System\FNCKAoM.exe
  2⤵
  PID:3116
- C:\Windows\System\PrQwIdv.exe
  C:\Windows\System\PrQwIdv.exe
  2⤵
  PID:3168
- C:\Windows\System\NreVFzE.exe
  C:\Windows\System\NreVFzE.exe
  2⤵
  PID:3228
- C:\Windows\System\BKIGGiv.exe
  C:\Windows\System\BKIGGiv.exe
  2⤵
  PID:3260
- C:\Windows\System\qTHgVqN.exe
  C:\Windows\System\qTHgVqN.exe
  2⤵
  PID:3284
- C:\Windows\System\KZGkSTt.exe
  C:\Windows\System\KZGkSTt.exe
  2⤵
  PID:3364
- C:\Windows\System\IXyCTnJ.exe
  C:\Windows\System\IXyCTnJ.exe
  2⤵
  PID:3360
- C:\Windows\System\FFyCCtm.exe
  C:\Windows\System\FFyCCtm.exe
  2⤵
  PID:3440
- C:\Windows\System\yDGmHvf.exe
  C:\Windows\System\yDGmHvf.exe
  2⤵
  PID:3480
- C:\Windows\System\nhLuqSU.exe
  C:\Windows\System\nhLuqSU.exe
  2⤵
  PID:3616
- C:\Windows\System\ZfAVsqH.exe
  C:\Windows\System\ZfAVsqH.exe
  2⤵
  PID:3636
- C:\Windows\System\PgwfYvr.exe
  C:\Windows\System\PgwfYvr.exe
  2⤵
  PID:3664
- C:\Windows\System\FmlHgrx.exe
  C:\Windows\System\FmlHgrx.exe
  2⤵
  PID:3784
- C:\Windows\System\taoQEMM.exe
  C:\Windows\System\taoQEMM.exe
  2⤵
  PID:3756
- C:\Windows\System\BrEbBzb.exe
  C:\Windows\System\BrEbBzb.exe
  2⤵
  PID:3840
- C:\Windows\System\tRnnnZD.exe
  C:\Windows\System\tRnnnZD.exe
  2⤵
  PID:3880
- C:\Windows\System\olmWEiu.exe
  C:\Windows\System\olmWEiu.exe
  2⤵
  PID:3940
- C:\Windows\System\qhEGegi.exe
  C:\Windows\System\qhEGegi.exe
  2⤵
  PID:3976
- C:\Windows\System\YgXhzKC.exe
  C:\Windows\System\YgXhzKC.exe
  2⤵
  PID:4004
- C:\Windows\System\bMpHtGM.exe
  C:\Windows\System\bMpHtGM.exe
  2⤵
  PID:620
- C:\Windows\System\RKigCeN.exe
  C:\Windows\System\RKigCeN.exe
  2⤵
  PID:4080
- C:\Windows\System\CNhuLzK.exe
  C:\Windows\System\CNhuLzK.exe
  2⤵
  PID:1520
- C:\Windows\System\GjXWHrp.exe
  C:\Windows\System\GjXWHrp.exe
  2⤵
  PID:2068
- C:\Windows\System\SxVnnYH.exe
  C:\Windows\System\SxVnnYH.exe
  2⤵
  PID:2144
- C:\Windows\System\OrPiMbt.exe
  C:\Windows\System\OrPiMbt.exe
  2⤵
  PID:592
- C:\Windows\System\sIHsaAh.exe
  C:\Windows\System\sIHsaAh.exe
  2⤵
  PID:2364
- C:\Windows\System\dxUkVnH.exe
  C:\Windows\System\dxUkVnH.exe
  2⤵
  PID:3220
- C:\Windows\System\jRWjHnL.exe
  C:\Windows\System\jRWjHnL.exe
  2⤵
  PID:2708
- C:\Windows\System\fwyEjxu.exe
  C:\Windows\System\fwyEjxu.exe
  2⤵
  PID:3344
- C:\Windows\System\rsLsDuH.exe
  C:\Windows\System\rsLsDuH.exe
  2⤵
  PID:3384
- C:\Windows\System\NliTzAY.exe
  C:\Windows\System\NliTzAY.exe
  2⤵
  PID:3408
- C:\Windows\System\bTPsGjG.exe
  C:\Windows\System\bTPsGjG.exe
  2⤵
  PID:3464
- C:\Windows\System\QzIYVQG.exe
  C:\Windows\System\QzIYVQG.exe
  2⤵
  PID:3604
- C:\Windows\System\dIonszR.exe
  C:\Windows\System\dIonszR.exe
  2⤵
  PID:4116
- C:\Windows\System\AvytcTt.exe
  C:\Windows\System\AvytcTt.exe
  2⤵
  PID:4136
- C:\Windows\System\tJVchAz.exe
  C:\Windows\System\tJVchAz.exe
  2⤵
  PID:4156
- C:\Windows\System\cPaAnLM.exe
  C:\Windows\System\cPaAnLM.exe
  2⤵
  PID:4176
- C:\Windows\System\zWXiGZq.exe
  C:\Windows\System\zWXiGZq.exe
  2⤵
  PID:4196
- C:\Windows\System\TDmemXE.exe
  C:\Windows\System\TDmemXE.exe
  2⤵
  PID:4216
- C:\Windows\System\CPAsCcD.exe
  C:\Windows\System\CPAsCcD.exe
  2⤵
  PID:4236
- C:\Windows\System\pUeCrIS.exe
  C:\Windows\System\pUeCrIS.exe
  2⤵
  PID:4256
- C:\Windows\System\QLVZcKH.exe
  C:\Windows\System\QLVZcKH.exe
  2⤵
  PID:4276
- C:\Windows\System\dBwNXwC.exe
  C:\Windows\System\dBwNXwC.exe
  2⤵
  PID:4292
- C:\Windows\System\VGfcQeQ.exe
  C:\Windows\System\VGfcQeQ.exe
  2⤵
  PID:4312
- C:\Windows\System\vSwISkz.exe
  C:\Windows\System\vSwISkz.exe
  2⤵
  PID:4336
- C:\Windows\System\hnIJgVq.exe
  C:\Windows\System\hnIJgVq.exe
  2⤵
  PID:4356
- C:\Windows\System\SshyUhi.exe
  C:\Windows\System\SshyUhi.exe
  2⤵
  PID:4376
- C:\Windows\System\RtCOWaj.exe
  C:\Windows\System\RtCOWaj.exe
  2⤵
  PID:4396
- C:\Windows\System\uzIjRJy.exe
  C:\Windows\System\uzIjRJy.exe
  2⤵
  PID:4416
- C:\Windows\System\vQFbJUk.exe
  C:\Windows\System\vQFbJUk.exe
  2⤵
  PID:4436
- C:\Windows\System\IUXoXCN.exe
  C:\Windows\System\IUXoXCN.exe
  2⤵
  PID:4456
- C:\Windows\System\GRbXQKn.exe
  C:\Windows\System\GRbXQKn.exe
  2⤵
  PID:4472
- C:\Windows\System\eXMTEoJ.exe
  C:\Windows\System\eXMTEoJ.exe
  2⤵
  PID:4496
- C:\Windows\System\YLSydZC.exe
  C:\Windows\System\YLSydZC.exe
  2⤵
  PID:4516
- C:\Windows\System\GXaaPeF.exe
  C:\Windows\System\GXaaPeF.exe
  2⤵
  PID:4536
- C:\Windows\System\GiNYfep.exe
  C:\Windows\System\GiNYfep.exe
  2⤵
  PID:4556
- C:\Windows\System\CgqdSwx.exe
  C:\Windows\System\CgqdSwx.exe
  2⤵
  PID:4576
- C:\Windows\System\HPnoJyd.exe
  C:\Windows\System\HPnoJyd.exe
  2⤵
  PID:4592
- C:\Windows\System\HHbBLFv.exe
  C:\Windows\System\HHbBLFv.exe
  2⤵
  PID:4616
- C:\Windows\System\pfeHyRH.exe
  C:\Windows\System\pfeHyRH.exe
  2⤵
  PID:4632
- C:\Windows\System\lERfZlp.exe
  C:\Windows\System\lERfZlp.exe
  2⤵
  PID:4656
- C:\Windows\System\ByQYtHL.exe
  C:\Windows\System\ByQYtHL.exe
  2⤵
  PID:4676
- C:\Windows\System\HkRkLnf.exe
  C:\Windows\System\HkRkLnf.exe
  2⤵
  PID:4696
- C:\Windows\System\dikEMiS.exe
  C:\Windows\System\dikEMiS.exe
  2⤵
  PID:4712
- C:\Windows\System\hFLiSMi.exe
  C:\Windows\System\hFLiSMi.exe
  2⤵
  PID:4732
- C:\Windows\System\UMtddrZ.exe
  C:\Windows\System\UMtddrZ.exe
  2⤵
  PID:4752
- C:\Windows\System\EjtZwfm.exe
  C:\Windows\System\EjtZwfm.exe
  2⤵
  PID:4776
- C:\Windows\System\FKxKYvm.exe
  C:\Windows\System\FKxKYvm.exe
  2⤵
  PID:4796
- C:\Windows\System\OLfWwLD.exe
  C:\Windows\System\OLfWwLD.exe
  2⤵
  PID:4816
- C:\Windows\System\dGtxoJI.exe
  C:\Windows\System\dGtxoJI.exe
  2⤵
  PID:4836
- C:\Windows\System\LPTMzEl.exe
  C:\Windows\System\LPTMzEl.exe
  2⤵
  PID:4856
- C:\Windows\System\iQsPGhb.exe
  C:\Windows\System\iQsPGhb.exe
  2⤵
  PID:4876
- C:\Windows\System\nbUaQyw.exe
  C:\Windows\System\nbUaQyw.exe
  2⤵
  PID:4896
- C:\Windows\System\WHnFfge.exe
  C:\Windows\System\WHnFfge.exe
  2⤵
  PID:4916
- C:\Windows\System\siwjDFZ.exe
  C:\Windows\System\siwjDFZ.exe
  2⤵
  PID:4932
- C:\Windows\System\smeOsdJ.exe
  C:\Windows\System\smeOsdJ.exe
  2⤵
  PID:4948
- C:\Windows\System\mrYAdkl.exe
  C:\Windows\System\mrYAdkl.exe
  2⤵
  PID:4964
- C:\Windows\System\vZkpSCk.exe
  C:\Windows\System\vZkpSCk.exe
  2⤵
  PID:5116
- C:\Windows\System\jUhzYYQ.exe
  C:\Windows\System\jUhzYYQ.exe
  2⤵
  PID:3644
- C:\Windows\System\RdhAPGE.exe
  C:\Windows\System\RdhAPGE.exe
  2⤵
  PID:3864
- C:\Windows\System\fPGGGGW.exe
  C:\Windows\System\fPGGGGW.exe
  2⤵
  PID:2952
- C:\Windows\System\IMtoQkF.exe
  C:\Windows\System\IMtoQkF.exe
  2⤵
  PID:3904
- C:\Windows\System\fEdPqcM.exe
  C:\Windows\System\fEdPqcM.exe
  2⤵
  PID:4040
- C:\Windows\System\XPexcIo.exe
  C:\Windows\System\XPexcIo.exe
  2⤵
  PID:920
- C:\Windows\System\ZTfKDvo.exe
  C:\Windows\System\ZTfKDvo.exe
  2⤵
  PID:2180
- C:\Windows\System\GoTHipa.exe
  C:\Windows\System\GoTHipa.exe
  2⤵
  PID:2412
- C:\Windows\System\BKYRTtZ.exe
  C:\Windows\System\BKYRTtZ.exe
  2⤵
  PID:1176
- C:\Windows\System\KgBqAQb.exe
  C:\Windows\System\KgBqAQb.exe
  2⤵
  PID:2736
- C:\Windows\System\AFRzFou.exe
  C:\Windows\System\AFRzFou.exe
  2⤵
  PID:1952
- C:\Windows\System\bPwwXLL.exe
  C:\Windows\System\bPwwXLL.exe
  2⤵
  PID:1916
- C:\Windows\System\rffMjow.exe
  C:\Windows\System\rffMjow.exe
  2⤵
  PID:2764
- C:\Windows\System\NSFzkWG.exe
  C:\Windows\System\NSFzkWG.exe
  2⤵
  PID:3124
- C:\Windows\System\OfXiCev.exe
  C:\Windows\System\OfXiCev.exe
  2⤵
  PID:2852
- C:\Windows\System\NviYdvW.exe
  C:\Windows\System\NviYdvW.exe
  2⤵
  PID:2588
- C:\Windows\System\zEGUWVI.exe
  C:\Windows\System\zEGUWVI.exe
  2⤵
  PID:3420
- C:\Windows\System\gUChATE.exe
  C:\Windows\System\gUChATE.exe
  2⤵
  PID:3580
- C:\Windows\System\FsBimDz.exe
  C:\Windows\System\FsBimDz.exe
  2⤵
  PID:4132
- C:\Windows\System\xMepJGS.exe
  C:\Windows\System\xMepJGS.exe
  2⤵
  PID:4108
- C:\Windows\System\dlVMlfs.exe
  C:\Windows\System\dlVMlfs.exe
  2⤵
  PID:4152
- C:\Windows\System\QRcYHyE.exe
  C:\Windows\System\QRcYHyE.exe
  2⤵
  PID:4204
- C:\Windows\System\QwcvDpS.exe
  C:\Windows\System\QwcvDpS.exe
  2⤵
  PID:2788
- C:\Windows\System\dcXFRJd.exe
  C:\Windows\System\dcXFRJd.exe
  2⤵
  PID:2824
- C:\Windows\System\QfdcqcO.exe
  C:\Windows\System\QfdcqcO.exe
  2⤵
  PID:4228
- C:\Windows\System\ccNEpoq.exe
  C:\Windows\System\ccNEpoq.exe
  2⤵
  PID:2592
- C:\Windows\System\FrdHbEp.exe
  C:\Windows\System\FrdHbEp.exe
  2⤵
  PID:4288
- C:\Windows\System\RJomjby.exe
  C:\Windows\System\RJomjby.exe
  2⤵
  PID:4328
- C:\Windows\System\gMTUTsA.exe
  C:\Windows\System\gMTUTsA.exe
  2⤵
  PID:4300
- C:\Windows\System\XhBsNGq.exe
  C:\Windows\System\XhBsNGq.exe
  2⤵
  PID:4344
- C:\Windows\System\WFUJSMP.exe
  C:\Windows\System\WFUJSMP.exe
  2⤵
  PID:4348
- C:\Windows\System\VAshRDb.exe
  C:\Windows\System\VAshRDb.exe
  2⤵
  PID:1976
- C:\Windows\System\cDdBVJX.exe
  C:\Windows\System\cDdBVJX.exe
  2⤵
  PID:4408
- C:\Windows\System\tyLITAr.exe
  C:\Windows\System\tyLITAr.exe
  2⤵
  PID:4448
- C:\Windows\System\GuAJxAe.exe
  C:\Windows\System\GuAJxAe.exe
  2⤵
  PID:4524
- C:\Windows\System\gfzxcAN.exe
  C:\Windows\System\gfzxcAN.exe
  2⤵
  PID:4428
- C:\Windows\System\Vntppco.exe
  C:\Windows\System\Vntppco.exe
  2⤵
  PID:4572
- C:\Windows\System\VAaMfNp.exe
  C:\Windows\System\VAaMfNp.exe
  2⤵
  PID:4544
- C:\Windows\System\ThrJlOI.exe
  C:\Windows\System\ThrJlOI.exe
  2⤵
  PID:2004
- C:\Windows\System\narIlQm.exe
  C:\Windows\System\narIlQm.exe
  2⤵
  PID:4600
- C:\Windows\System\fWVFzcT.exe
  C:\Windows\System\fWVFzcT.exe
  2⤵
  PID:1912
- C:\Windows\System\QcZXWlH.exe
  C:\Windows\System\QcZXWlH.exe
  2⤵
  PID:1292
- C:\Windows\System\fKpPThM.exe
  C:\Windows\System\fKpPThM.exe
  2⤵
  PID:4644
- C:\Windows\System\HHIeTjr.exe
  C:\Windows\System\HHIeTjr.exe
  2⤵
  PID:4588
- C:\Windows\System\lqgSeHH.exe
  C:\Windows\System\lqgSeHH.exe
  2⤵
  PID:4624
- C:\Windows\System\Iaoipvz.exe
  C:\Windows\System\Iaoipvz.exe
  2⤵
  PID:4672
- C:\Windows\System\upyofaw.exe
  C:\Windows\System\upyofaw.exe
  2⤵
  PID:4728
- C:\Windows\System\tLvXKoP.exe
  C:\Windows\System\tLvXKoP.exe
  2⤵
  PID:4708
- C:\Windows\System\lZofUvX.exe
  C:\Windows\System\lZofUvX.exe
  2⤵
  PID:4768
- C:\Windows\System\qUdeSsP.exe
  C:\Windows\System\qUdeSsP.exe
  2⤵
  PID:4744
- C:\Windows\System\XUrtgBD.exe
  C:\Windows\System\XUrtgBD.exe
  2⤵
  PID:4812
- C:\Windows\System\rPIzjzw.exe
  C:\Windows\System\rPIzjzw.exe
  2⤵
  PID:4824
- C:\Windows\System\uIQjAmT.exe
  C:\Windows\System\uIQjAmT.exe
  2⤵
  PID:1156
- C:\Windows\System\WxWuWtG.exe
  C:\Windows\System\WxWuWtG.exe
  2⤵
  PID:4864
- C:\Windows\System\pxFyqvw.exe
  C:\Windows\System\pxFyqvw.exe
  2⤵
  PID:2876
- C:\Windows\System\rZYFQav.exe
  C:\Windows\System\rZYFQav.exe
  2⤵
  PID:4928
- C:\Windows\System\DyEuSet.exe
  C:\Windows\System\DyEuSet.exe
  2⤵
  PID:816
- C:\Windows\System\aIFOoZr.exe
  C:\Windows\System\aIFOoZr.exe
  2⤵
  PID:4908
- C:\Windows\System\KVdDnml.exe
  C:\Windows\System\KVdDnml.exe
  2⤵
  PID:1932
- C:\Windows\System\cHcInce.exe
  C:\Windows\System\cHcInce.exe
  2⤵
  PID:2628
- C:\Windows\System\XOxnweO.exe
  C:\Windows\System\XOxnweO.exe
  2⤵
  PID:4992
- C:\Windows\System\urvAXkz.exe
  C:\Windows\System\urvAXkz.exe
  2⤵
  PID:4988
- C:\Windows\System\PYIowUH.exe
  C:\Windows\System\PYIowUH.exe
  2⤵
  PID:3740
- C:\Windows\System\xQUFGIm.exe
  C:\Windows\System\xQUFGIm.exe
  2⤵
  PID:3804
- C:\Windows\System\eZdETnq.exe
  C:\Windows\System\eZdETnq.exe
  2⤵
  PID:4068
- C:\Windows\System\xugfgGn.exe
  C:\Windows\System\xugfgGn.exe
  2⤵
  PID:1016
- C:\Windows\System\IEBCkET.exe
  C:\Windows\System\IEBCkET.exe
  2⤵
  PID:2784
- C:\Windows\System\zLQDjVI.exe
  C:\Windows\System\zLQDjVI.exe
  2⤵
  PID:2796
- C:\Windows\System\tlXsPKM.exe
  C:\Windows\System\tlXsPKM.exe
  2⤵
  PID:3280
- C:\Windows\System\ZBWmTLs.exe
  C:\Windows\System\ZBWmTLs.exe
  2⤵
  PID:2120
- C:\Windows\System\GqURabd.exe
  C:\Windows\System\GqURabd.exe
  2⤵
  PID:3468
- C:\Windows\System\NYSfEKF.exe
  C:\Windows\System\NYSfEKF.exe
  2⤵
  PID:4164
- C:\Windows\System\BXQkDIF.exe
  C:\Windows\System\BXQkDIF.exe
  2⤵
  PID:4192
- C:\Windows\System\eASjqOn.exe
  C:\Windows\System\eASjqOn.exe
  2⤵
  PID:4244
- C:\Windows\System\vvmxGVz.exe
  C:\Windows\System\vvmxGVz.exe
  2⤵
  PID:4268
- C:\Windows\System\sRRfvnG.exe
  C:\Windows\System\sRRfvnG.exe
  2⤵
  PID:4308
- C:\Windows\System\xfSRfnI.exe
  C:\Windows\System\xfSRfnI.exe
  2⤵
  PID:4412
- C:\Windows\System\pDevqXi.exe
  C:\Windows\System\pDevqXi.exe
  2⤵
  PID:4388
- C:\Windows\System\MHYyrXn.exe
  C:\Windows\System\MHYyrXn.exe
  2⤵
  PID:4492
- C:\Windows\System\zLOXefM.exe
  C:\Windows\System\zLOXefM.exe
  2⤵
  PID:4468
- C:\Windows\System\qWsdRAc.exe
  C:\Windows\System\qWsdRAc.exe
  2⤵
  PID:4548
- C:\Windows\System\BfBjbTg.exe
  C:\Windows\System\BfBjbTg.exe
  2⤵
  PID:4976
- C:\Windows\System\zRQMKnF.exe
  C:\Windows\System\zRQMKnF.exe
  2⤵
  PID:3032
- C:\Windows\System\vfvTrPk.exe
  C:\Windows\System\vfvTrPk.exe
  2⤵
  PID:4648
- C:\Windows\System\VYoZsJz.exe
  C:\Windows\System\VYoZsJz.exe
  2⤵
  PID:4664
- C:\Windows\System\EEewNES.exe
  C:\Windows\System\EEewNES.exe
  2⤵
  PID:4704
- C:\Windows\System\LWsoZPu.exe
  C:\Windows\System\LWsoZPu.exe
  2⤵
  PID:4788
- C:\Windows\System\rbdZtUj.exe
  C:\Windows\System\rbdZtUj.exe
  2⤵
  PID:1988
- C:\Windows\System\DdHCZaF.exe
  C:\Windows\System\DdHCZaF.exe
  2⤵
  PID:4832
- C:\Windows\System\Wrcqdvv.exe
  C:\Windows\System\Wrcqdvv.exe
  2⤵
  PID:4872
- C:\Windows\System\eysDDJU.exe
  C:\Windows\System\eysDDJU.exe
  2⤵
  PID:4960
- C:\Windows\System\fLRwBSG.exe
  C:\Windows\System\fLRwBSG.exe
  2⤵
  PID:1940
- C:\Windows\System\ihedZvE.exe
  C:\Windows\System\ihedZvE.exe
  2⤵
  PID:3684
- C:\Windows\System\efZJyzJ.exe
  C:\Windows\System\efZJyzJ.exe
  2⤵
  PID:2720
- C:\Windows\System\YJcbnrj.exe
  C:\Windows\System\YJcbnrj.exe
  2⤵
  PID:764
- C:\Windows\System\hidUTAS.exe
  C:\Windows\System\hidUTAS.exe
  2⤵
  PID:2244
- C:\Windows\System\FJgciOt.exe
  C:\Windows\System\FJgciOt.exe
  2⤵
  PID:2712
- C:\Windows\System\krRUOOO.exe
  C:\Windows\System\krRUOOO.exe
  2⤵
  PID:4172
- C:\Windows\System\TpZPVMg.exe
  C:\Windows\System\TpZPVMg.exe
  2⤵
  PID:2616
- C:\Windows\System\uxAsCmu.exe
  C:\Windows\System\uxAsCmu.exe
  2⤵
  PID:4284
- C:\Windows\System\ZXTAMpy.exe
  C:\Windows\System\ZXTAMpy.exe
  2⤵
  PID:4352
- C:\Windows\System\qmjZGVo.exe
  C:\Windows\System\qmjZGVo.exe
  2⤵
  PID:4488
- C:\Windows\System\HFCiFsx.exe
  C:\Windows\System\HFCiFsx.exe
  2⤵
  PID:1400
- C:\Windows\System\mKNUDjk.exe
  C:\Windows\System\mKNUDjk.exe
  2⤵
  PID:2496
- C:\Windows\System\rrOIHsy.exe
  C:\Windows\System\rrOIHsy.exe
  2⤵
  PID:4688
- C:\Windows\System\mfrzPjY.exe
  C:\Windows\System\mfrzPjY.exe
  2⤵
  PID:4784
- C:\Windows\System\RMHlvnL.exe
  C:\Windows\System\RMHlvnL.exe
  2⤵
  PID:4828
- C:\Windows\System\AzrvNqq.exe
  C:\Windows\System\AzrvNqq.exe
  2⤵
  PID:4940
- C:\Windows\System\OSypDcu.exe
  C:\Windows\System\OSypDcu.exe
  2⤵
  PID:3800
- C:\Windows\System\RQhQwnP.exe
  C:\Windows\System\RQhQwnP.exe
  2⤵
  PID:3136
- C:\Windows\System\Cknnrqt.exe
  C:\Windows\System\Cknnrqt.exe
  2⤵
  PID:3380
- C:\Windows\System\sljQdYb.exe
  C:\Windows\System\sljQdYb.exe
  2⤵
  PID:5136
- C:\Windows\System\VpeSMhE.exe
  C:\Windows\System\VpeSMhE.exe
  2⤵
  PID:5152
- C:\Windows\System\azzVeam.exe
  C:\Windows\System\azzVeam.exe
  2⤵
  PID:5168
- C:\Windows\System\eHGdifW.exe
  C:\Windows\System\eHGdifW.exe
  2⤵
  PID:5184
- C:\Windows\System\AajdgEI.exe
  C:\Windows\System\AajdgEI.exe
  2⤵
  PID:5200
- C:\Windows\System\UaAHSoz.exe
  C:\Windows\System\UaAHSoz.exe
  2⤵
  PID:5216
- C:\Windows\System\aMMqsMu.exe
  C:\Windows\System\aMMqsMu.exe
  2⤵
  PID:5232
- C:\Windows\System\EXmUwWk.exe
  C:\Windows\System\EXmUwWk.exe
  2⤵
  PID:5248
- C:\Windows\System\gcrSxDE.exe
  C:\Windows\System\gcrSxDE.exe
  2⤵
  PID:5264
- C:\Windows\System\FsPkpRK.exe
  C:\Windows\System\FsPkpRK.exe
  2⤵
  PID:5280
- C:\Windows\System\qFMDPPh.exe
  C:\Windows\System\qFMDPPh.exe
  2⤵
  PID:5296
- C:\Windows\System\uLFQHrO.exe
  C:\Windows\System\uLFQHrO.exe
  2⤵
  PID:5312
- C:\Windows\System\jCZojpW.exe
  C:\Windows\System\jCZojpW.exe
  2⤵
  PID:5328
- C:\Windows\System\ZgDKGLO.exe
  C:\Windows\System\ZgDKGLO.exe
  2⤵
  PID:5344
- C:\Windows\System\reOGCrj.exe
  C:\Windows\System\reOGCrj.exe
  2⤵
  PID:5360
- C:\Windows\System\HfgKMXc.exe
  C:\Windows\System\HfgKMXc.exe
  2⤵
  PID:5376
- C:\Windows\System\uhhOnJr.exe
  C:\Windows\System\uhhOnJr.exe
  2⤵
  PID:5392
- C:\Windows\System\EIHFaDQ.exe
  C:\Windows\System\EIHFaDQ.exe
  2⤵
  PID:5408
- C:\Windows\System\sxcgfRl.exe
  C:\Windows\System\sxcgfRl.exe
  2⤵
  PID:5424
- C:\Windows\System\DMaSuaU.exe
  C:\Windows\System\DMaSuaU.exe
  2⤵
  PID:5440
- C:\Windows\System\YwCWVjI.exe
  C:\Windows\System\YwCWVjI.exe
  2⤵
  PID:5456
- C:\Windows\System\zjayJfv.exe
  C:\Windows\System\zjayJfv.exe
  2⤵
  PID:5472
- C:\Windows\System\ZSoHmIo.exe
  C:\Windows\System\ZSoHmIo.exe
  2⤵
  PID:5488
- C:\Windows\System\CaCjGuu.exe
  C:\Windows\System\CaCjGuu.exe
  2⤵
  PID:5504
- C:\Windows\System\LVaYOSv.exe
  C:\Windows\System\LVaYOSv.exe
  2⤵
  PID:5520
- C:\Windows\System\rgrsTIC.exe
  C:\Windows\System\rgrsTIC.exe
  2⤵
  PID:5536
- C:\Windows\System\qysbmvh.exe
  C:\Windows\System\qysbmvh.exe
  2⤵
  PID:5552
- C:\Windows\System\wQNquUt.exe
  C:\Windows\System\wQNquUt.exe
  2⤵
  PID:5568
- C:\Windows\System\ryMTzIJ.exe
  C:\Windows\System\ryMTzIJ.exe
  2⤵
  PID:5584
- C:\Windows\System\FfmFVBC.exe
  C:\Windows\System\FfmFVBC.exe
  2⤵
  PID:5600
- C:\Windows\System\LWGgOlm.exe
  C:\Windows\System\LWGgOlm.exe
  2⤵
  PID:5620
- C:\Windows\System\GQJVuzu.exe
  C:\Windows\System\GQJVuzu.exe
  2⤵
  PID:5636
- C:\Windows\System\ofqLDew.exe
  C:\Windows\System\ofqLDew.exe
  2⤵
  PID:5652
- C:\Windows\System\jwdivQu.exe
  C:\Windows\System\jwdivQu.exe
  2⤵
  PID:5668
- C:\Windows\System\xKxsnZK.exe
  C:\Windows\System\xKxsnZK.exe
  2⤵
  PID:5684
- C:\Windows\System\bpCKxQI.exe
  C:\Windows\System\bpCKxQI.exe
  2⤵
  PID:5700
- C:\Windows\System\GJXNQom.exe
  C:\Windows\System\GJXNQom.exe
  2⤵
  PID:5716
- C:\Windows\System\MhAQZjz.exe
  C:\Windows\System\MhAQZjz.exe
  2⤵
  PID:5732
- C:\Windows\System\GSaEjYB.exe
  C:\Windows\System\GSaEjYB.exe
  2⤵
  PID:5748
- C:\Windows\System\SFQPccd.exe
  C:\Windows\System\SFQPccd.exe
  2⤵
  PID:5764
- C:\Windows\System\Ufnower.exe
  C:\Windows\System\Ufnower.exe
  2⤵
  PID:5780
- C:\Windows\System\wbQJfSI.exe
  C:\Windows\System\wbQJfSI.exe
  2⤵
  PID:5796
- C:\Windows\System\QHGKwty.exe
  C:\Windows\System\QHGKwty.exe
  2⤵
  PID:5812
- C:\Windows\System\ObFgyeQ.exe
  C:\Windows\System\ObFgyeQ.exe
  2⤵
  PID:5828
- C:\Windows\System\bowJjRS.exe
  C:\Windows\System\bowJjRS.exe
  2⤵
  PID:5844
- C:\Windows\System\QTqJQtX.exe
  C:\Windows\System\QTqJQtX.exe
  2⤵
  PID:5860
- C:\Windows\System\LgPdzdF.exe
  C:\Windows\System\LgPdzdF.exe
  2⤵
  PID:5876
- C:\Windows\System\KHNASeZ.exe
  C:\Windows\System\KHNASeZ.exe
  2⤵
  PID:5892
- C:\Windows\System\klSZMUU.exe
  C:\Windows\System\klSZMUU.exe
  2⤵
  PID:5908
- C:\Windows\System\HLqfalj.exe
  C:\Windows\System\HLqfalj.exe
  2⤵
  PID:5924
- C:\Windows\System\kmbLmiX.exe
  C:\Windows\System\kmbLmiX.exe
  2⤵
  PID:5940
- C:\Windows\System\mLiFUKF.exe
  C:\Windows\System\mLiFUKF.exe
  2⤵
  PID:5956
- C:\Windows\System\merTwJA.exe
  C:\Windows\System\merTwJA.exe
  2⤵
  PID:5972
- C:\Windows\System\EPvmdeH.exe
  C:\Windows\System\EPvmdeH.exe
  2⤵
  PID:5988
- C:\Windows\System\lvbTMmu.exe
  C:\Windows\System\lvbTMmu.exe
  2⤵
  PID:6004
- C:\Windows\System\OhjRyFo.exe
  C:\Windows\System\OhjRyFo.exe
  2⤵
  PID:6020
- C:\Windows\System\cwfGCht.exe
  C:\Windows\System\cwfGCht.exe
  2⤵
  PID:6036
- C:\Windows\System\wTevXJh.exe
  C:\Windows\System\wTevXJh.exe
  2⤵
  PID:6052
- C:\Windows\System\jLVKFQT.exe
  C:\Windows\System\jLVKFQT.exe
  2⤵
  PID:6068
- C:\Windows\System\JEsOvWU.exe
  C:\Windows\System\JEsOvWU.exe
  2⤵
  PID:6084
- C:\Windows\System\zmiJXtZ.exe
  C:\Windows\System\zmiJXtZ.exe
  2⤵
  PID:6100
- C:\Windows\System\nDcOJsE.exe
  C:\Windows\System\nDcOJsE.exe
  2⤵
  PID:6116
- C:\Windows\System\DhYfrnI.exe
  C:\Windows\System\DhYfrnI.exe
  2⤵
  PID:6132
- C:\Windows\System\OsmMUpt.exe
  C:\Windows\System\OsmMUpt.exe
  2⤵
  PID:3484
- C:\Windows\System\Dpnzxjs.exe
  C:\Windows\System\Dpnzxjs.exe
  2⤵
  PID:4248
- C:\Windows\System\iUSZhPe.exe
  C:\Windows\System\iUSZhPe.exe
  2⤵
  PID:4444
- C:\Windows\System\XHpzras.exe
  C:\Windows\System\XHpzras.exe
  2⤵
  PID:2572
- C:\Windows\System\KwrBPDp.exe
  C:\Windows\System\KwrBPDp.exe
  2⤵
  PID:4724
- C:\Windows\System\CwHflSQ.exe
  C:\Windows\System\CwHflSQ.exe
  2⤵
  PID:4944
- C:\Windows\System\eVtptBp.exe
  C:\Windows\System\eVtptBp.exe
  2⤵
  PID:3964
- C:\Windows\System\HimjFtj.exe
  C:\Windows\System\HimjFtj.exe
  2⤵
  PID:5144
- C:\Windows\System\nnFhBMu.exe
  C:\Windows\System\nnFhBMu.exe
  2⤵
  PID:5176
- C:\Windows\System\iNnWEWo.exe
  C:\Windows\System\iNnWEWo.exe
  2⤵
  PID:5208
- C:\Windows\System\MhBXIxb.exe
  C:\Windows\System\MhBXIxb.exe
  2⤵
  PID:5228
- C:\Windows\System\pkvmgZS.exe
  C:\Windows\System\pkvmgZS.exe
  2⤵
  PID:5260
- C:\Windows\System\BBvAeiV.exe
  C:\Windows\System\BBvAeiV.exe
  2⤵
  PID:5304
- C:\Windows\System\bljknbG.exe
  C:\Windows\System\bljknbG.exe
  2⤵
  PID:5336
- C:\Windows\System\iWFKqGg.exe
  C:\Windows\System\iWFKqGg.exe
  2⤵
  PID:5352
- C:\Windows\System\cdMthUf.exe
  C:\Windows\System\cdMthUf.exe
  2⤵
  PID:5384
- C:\Windows\System\LEOSyRT.exe
  C:\Windows\System\LEOSyRT.exe
  2⤵
  PID:5436
- C:\Windows\System\vKbWGEG.exe
  C:\Windows\System\vKbWGEG.exe
  2⤵
  PID:5448
- C:\Windows\System\jjYOQQf.exe
  C:\Windows\System\jjYOQQf.exe
  2⤵
  PID:5480
- C:\Windows\System\zUJHADl.exe
  C:\Windows\System\zUJHADl.exe
  2⤵
  PID:5532
- C:\Windows\System\nUmuDCO.exe
  C:\Windows\System\nUmuDCO.exe
  2⤵
  PID:5560
- C:\Windows\System\fpHtLCE.exe
  C:\Windows\System\fpHtLCE.exe
  2⤵
  PID:5592
- C:\Windows\System\IDiDhTJ.exe
  C:\Windows\System\IDiDhTJ.exe
  2⤵
  PID:5612
- C:\Windows\System\WjNIUqC.exe
  C:\Windows\System\WjNIUqC.exe
  2⤵
  PID:5660
- C:\Windows\System\RzFHQUp.exe
  C:\Windows\System\RzFHQUp.exe
  2⤵
  PID:5692
- C:\Windows\System\BLefLOs.exe
  C:\Windows\System\BLefLOs.exe
  2⤵
  PID:5724
- C:\Windows\System\ncIjDpg.exe
  C:\Windows\System\ncIjDpg.exe
  2⤵
  PID:5756
- C:\Windows\System\JFiJncV.exe
  C:\Windows\System\JFiJncV.exe
  2⤵
  PID:5776
- C:\Windows\System\GkHgmfz.exe
  C:\Windows\System\GkHgmfz.exe
  2⤵
  PID:5820
- C:\Windows\System\nKpmOig.exe
  C:\Windows\System\nKpmOig.exe
  2⤵
  PID:5852
- C:\Windows\System\SxDPgrf.exe
  C:\Windows\System\SxDPgrf.exe
  2⤵
  PID:5884
- C:\Windows\System\adMBLAY.exe
  C:\Windows\System\adMBLAY.exe
  2⤵
  PID:5904
- C:\Windows\System\QzoZGJP.exe
  C:\Windows\System\QzoZGJP.exe
  2⤵
  PID:5948
- C:\Windows\System\JZWtnRn.exe
  C:\Windows\System\JZWtnRn.exe
  2⤵
  PID:5968
- C:\Windows\System\dlEjBBU.exe
  C:\Windows\System\dlEjBBU.exe
  2⤵
  PID:6016
- C:\Windows\System\dzWbibj.exe
  C:\Windows\System\dzWbibj.exe
  2⤵
  PID:6044
- C:\Windows\System\EwGEciD.exe
  C:\Windows\System\EwGEciD.exe
  2⤵
  PID:6076
- C:\Windows\System\XDpnkDw.exe
  C:\Windows\System\XDpnkDw.exe
  2⤵
  PID:6108
- C:\Windows\System\kOxxHjn.exe
  C:\Windows\System\kOxxHjn.exe
  2⤵
  PID:6128
- C:\Windows\System\KXotQlw.exe
  C:\Windows\System\KXotQlw.exe
  2⤵
  PID:4208
- C:\Windows\System\kxlRFUn.exe
  C:\Windows\System\kxlRFUn.exe
  2⤵
  PID:4772
- C:\Windows\System\BlVdHzO.exe
  C:\Windows\System\BlVdHzO.exe
  2⤵
  PID:2872
- C:\Windows\System\OAnTmek.exe
  C:\Windows\System\OAnTmek.exe
  2⤵
  PID:5148
- C:\Windows\System\VUOMjHR.exe
  C:\Windows\System\VUOMjHR.exe
  2⤵
  PID:5212
- C:\Windows\System\ngwNRRF.exe
  C:\Windows\System\ngwNRRF.exe
  2⤵
  PID:5276
- C:\Windows\System\AESTIqn.exe
  C:\Windows\System\AESTIqn.exe
  2⤵
  PID:5368
- C:\Windows\System\RqDeIGF.exe
  C:\Windows\System\RqDeIGF.exe
  2⤵
  PID:5400
- C:\Windows\System\qRUWLNN.exe
  C:\Windows\System\qRUWLNN.exe
  2⤵
  PID:5420
- C:\Windows\System\cVCHPny.exe
  C:\Windows\System\cVCHPny.exe
  2⤵
  PID:5528
- C:\Windows\System\vxIYdoJ.exe
  C:\Windows\System\vxIYdoJ.exe
  2⤵
  PID:5576
- C:\Windows\System\vHymKky.exe
  C:\Windows\System\vHymKky.exe
  2⤵
  PID:5664
- C:\Windows\System\iiSjTCb.exe
  C:\Windows\System\iiSjTCb.exe
  2⤵
  PID:5708
- C:\Windows\System\vrxfjgU.exe
  C:\Windows\System\vrxfjgU.exe
  2⤵
  PID:5792
- C:\Windows\System\fadKdhf.exe
  C:\Windows\System\fadKdhf.exe
  2⤵
  PID:5808
- C:\Windows\System\nZTVUFy.exe
  C:\Windows\System\nZTVUFy.exe
  2⤵
  PID:5900
- C:\Windows\System\FPFUOsK.exe
  C:\Windows\System\FPFUOsK.exe
  2⤵
  PID:5964
- C:\Windows\System\OTQagYf.exe
  C:\Windows\System\OTQagYf.exe
  2⤵
  PID:6048
- C:\Windows\System\eqVPwaB.exe
  C:\Windows\System\eqVPwaB.exe
  2⤵
  PID:6096
- C:\Windows\System\GLhrSup.exe
  C:\Windows\System\GLhrSup.exe
  2⤵
  PID:4512
- C:\Windows\System\YcDHiUt.exe
  C:\Windows\System\YcDHiUt.exe
  2⤵
  PID:4056
- C:\Windows\System\CPjcvHQ.exe
  C:\Windows\System\CPjcvHQ.exe
  2⤵
  PID:5224
- C:\Windows\System\sYDbsmC.exe
  C:\Windows\System\sYDbsmC.exe
  2⤵
  PID:5288
- C:\Windows\System\DtWdqrc.exe
  C:\Windows\System\DtWdqrc.exe
  2⤵
  PID:5516
- C:\Windows\System\LpKCBBx.exe
  C:\Windows\System\LpKCBBx.exe
  2⤵
  PID:5008
- C:\Windows\System\NBIwPHz.exe
  C:\Windows\System\NBIwPHz.exe
  2⤵
  PID:4980
- C:\Windows\System\aNglzdp.exe
  C:\Windows\System\aNglzdp.exe
  2⤵
  PID:5740
- C:\Windows\System\CSZYJfo.exe
  C:\Windows\System\CSZYJfo.exe
  2⤵
  PID:5804
- C:\Windows\System\qokzSZt.exe
  C:\Windows\System\qokzSZt.exe
  2⤵
  PID:5012
- C:\Windows\System\plvuwYY.exe
  C:\Windows\System\plvuwYY.exe
  2⤵
  PID:5952
- C:\Windows\System\KxvNphB.exe
  C:\Windows\System\KxvNphB.exe
  2⤵
  PID:6080
- C:\Windows\System\vhOhKdO.exe
  C:\Windows\System\vhOhKdO.exe
  2⤵
  PID:2012
- C:\Windows\System\NqSnGmV.exe
  C:\Windows\System\NqSnGmV.exe
  2⤵
  PID:5404
- C:\Windows\System\RMknjqv.exe
  C:\Windows\System\RMknjqv.exe
  2⤵
  PID:5628
- C:\Windows\System\iDAQVxa.exe
  C:\Windows\System\iDAQVxa.exe
  2⤵
  PID:6156
- C:\Windows\System\pWFximS.exe
  C:\Windows\System\pWFximS.exe
  2⤵
  PID:6172
- C:\Windows\System\cMvUqau.exe
  C:\Windows\System\cMvUqau.exe
  2⤵
  PID:6188
- C:\Windows\System\ABQBUNg.exe
  C:\Windows\System\ABQBUNg.exe
  2⤵
  PID:6204
- C:\Windows\System\GedDKuI.exe
  C:\Windows\System\GedDKuI.exe
  2⤵
  PID:6220
- C:\Windows\System\INkBPxB.exe
  C:\Windows\System\INkBPxB.exe
  2⤵
  PID:6236
- C:\Windows\System\MrhUnuv.exe
  C:\Windows\System\MrhUnuv.exe
  2⤵
  PID:6252
- C:\Windows\System\mlfEZuR.exe
  C:\Windows\System\mlfEZuR.exe
  2⤵
  PID:6268
- C:\Windows\System\YdhUGzw.exe
  C:\Windows\System\YdhUGzw.exe
  2⤵
  PID:6284
- C:\Windows\System\fxvoKWu.exe
  C:\Windows\System\fxvoKWu.exe
  2⤵
  PID:6300
- C:\Windows\System\esqdPAY.exe
  C:\Windows\System\esqdPAY.exe
  2⤵
  PID:6316
- C:\Windows\System\cmoOIPV.exe
  C:\Windows\System\cmoOIPV.exe
  2⤵
  PID:6332
- C:\Windows\System\jpCYcLN.exe
  C:\Windows\System\jpCYcLN.exe
  2⤵
  PID:6348
- C:\Windows\System\trChaSh.exe
  C:\Windows\System\trChaSh.exe
  2⤵
  PID:6364
- C:\Windows\System\xfFWSlk.exe
  C:\Windows\System\xfFWSlk.exe
  2⤵
  PID:6380
- C:\Windows\System\ctExLNK.exe
  C:\Windows\System\ctExLNK.exe
  2⤵
  PID:6396
- C:\Windows\System\PWLBNsj.exe
  C:\Windows\System\PWLBNsj.exe
  2⤵
  PID:6412
- C:\Windows\System\FnUmmUq.exe
  C:\Windows\System\FnUmmUq.exe
  2⤵
  PID:6428
- C:\Windows\System\gxBpCMd.exe
  C:\Windows\System\gxBpCMd.exe
  2⤵
  PID:6444
- C:\Windows\System\rLkmqwD.exe
  C:\Windows\System\rLkmqwD.exe
  2⤵
  PID:6460
- C:\Windows\System\IaxGleZ.exe
  C:\Windows\System\IaxGleZ.exe
  2⤵
  PID:6476
- C:\Windows\System\qYIcVIz.exe
  C:\Windows\System\qYIcVIz.exe
  2⤵
  PID:6492
- C:\Windows\System\bzGFnVh.exe
  C:\Windows\System\bzGFnVh.exe
  2⤵
  PID:6508
- C:\Windows\System\xaDkoHG.exe
  C:\Windows\System\xaDkoHG.exe
  2⤵
  PID:6524
- C:\Windows\System\hQQiYSx.exe
  C:\Windows\System\hQQiYSx.exe
  2⤵
  PID:6540
- C:\Windows\System\dYDcTcu.exe
  C:\Windows\System\dYDcTcu.exe
  2⤵
  PID:6556
- C:\Windows\System\lsfblsH.exe
  C:\Windows\System\lsfblsH.exe
  2⤵
  PID:6572
- C:\Windows\System\DuNqTJb.exe
  C:\Windows\System\DuNqTJb.exe
  2⤵
  PID:6588
- C:\Windows\System\GnSdxCT.exe
  C:\Windows\System\GnSdxCT.exe
  2⤵
  PID:6604
- C:\Windows\System\vlfwHvp.exe
  C:\Windows\System\vlfwHvp.exe
  2⤵
  PID:6620
- C:\Windows\System\AACNpgw.exe
  C:\Windows\System\AACNpgw.exe
  2⤵
  PID:6636
- C:\Windows\System\SDSIUXH.exe
  C:\Windows\System\SDSIUXH.exe
  2⤵
  PID:6652
- C:\Windows\System\mrMwBjU.exe
  C:\Windows\System\mrMwBjU.exe
  2⤵
  PID:6668
- C:\Windows\System\KEoWogM.exe
  C:\Windows\System\KEoWogM.exe
  2⤵
  PID:6684
- C:\Windows\System\yOegZHK.exe
  C:\Windows\System\yOegZHK.exe
  2⤵
  PID:6700
- C:\Windows\System\BgmScCu.exe
  C:\Windows\System\BgmScCu.exe
  2⤵
  PID:6716
- C:\Windows\System\AbPNdbp.exe
  C:\Windows\System\AbPNdbp.exe
  2⤵
  PID:6732
- C:\Windows\System\GyAmbrx.exe
  C:\Windows\System\GyAmbrx.exe
  2⤵
  PID:6748
- C:\Windows\System\KsAjzNG.exe
  C:\Windows\System\KsAjzNG.exe
  2⤵
  PID:6764
- C:\Windows\System\hhJgRot.exe
  C:\Windows\System\hhJgRot.exe
  2⤵
  PID:6780
- C:\Windows\System\ZqeBdCo.exe
  C:\Windows\System\ZqeBdCo.exe
  2⤵
  PID:6796
- C:\Windows\System\QzcWCty.exe
  C:\Windows\System\QzcWCty.exe
  2⤵
  PID:6812
- C:\Windows\System\pjBtHIu.exe
  C:\Windows\System\pjBtHIu.exe
  2⤵
  PID:6828
- C:\Windows\System\GrvpaXL.exe
  C:\Windows\System\GrvpaXL.exe
  2⤵
  PID:6844
- C:\Windows\System\CVmNnaX.exe
  C:\Windows\System\CVmNnaX.exe
  2⤵
  PID:6860
- C:\Windows\System\GkXLEks.exe
  C:\Windows\System\GkXLEks.exe
  2⤵
  PID:6876
- C:\Windows\System\jqqWwUq.exe
  C:\Windows\System\jqqWwUq.exe
  2⤵
  PID:6892
- C:\Windows\System\JtVZdjY.exe
  C:\Windows\System\JtVZdjY.exe
  2⤵
  PID:6908
- C:\Windows\System\IOFNiyw.exe
  C:\Windows\System\IOFNiyw.exe
  2⤵
  PID:6924
- C:\Windows\System\TmSGZli.exe
  C:\Windows\System\TmSGZli.exe
  2⤵
  PID:6940
- C:\Windows\System\ZTemfXt.exe
  C:\Windows\System\ZTemfXt.exe
  2⤵
  PID:6956
- C:\Windows\System\NKROqIK.exe
  C:\Windows\System\NKROqIK.exe
  2⤵
  PID:6972
- C:\Windows\System\jdOhxUG.exe
  C:\Windows\System\jdOhxUG.exe
  2⤵
  PID:6988
- C:\Windows\System\XhyOvBr.exe
  C:\Windows\System\XhyOvBr.exe
  2⤵
  PID:7004
- C:\Windows\System\txDonsj.exe
  C:\Windows\System\txDonsj.exe
  2⤵
  PID:7020
- C:\Windows\System\YTgNgpI.exe
  C:\Windows\System\YTgNgpI.exe
  2⤵
  PID:7040
- C:\Windows\System\EbOsTKH.exe
  C:\Windows\System\EbOsTKH.exe
  2⤵
  PID:7056
- C:\Windows\System\mfiTQoT.exe
  C:\Windows\System\mfiTQoT.exe
  2⤵
  PID:7072
- C:\Windows\System\unQxzUc.exe
  C:\Windows\System\unQxzUc.exe
  2⤵
  PID:7088
- C:\Windows\System\hkpKNRc.exe
  C:\Windows\System\hkpKNRc.exe
  2⤵
  PID:7104
- C:\Windows\System\zFlnKyz.exe
  C:\Windows\System\zFlnKyz.exe
  2⤵
  PID:7120
- C:\Windows\System\HuwHlNl.exe
  C:\Windows\System\HuwHlNl.exe
  2⤵
  PID:7136
- C:\Windows\System\hCsQnFP.exe
  C:\Windows\System\hCsQnFP.exe
  2⤵
  PID:7152
- C:\Windows\System\PiLQWjH.exe
  C:\Windows\System\PiLQWjH.exe
  2⤵
  PID:5580
- C:\Windows\System\niuYjPb.exe
  C:\Windows\System\niuYjPb.exe
  2⤵
  PID:5760
- C:\Windows\System\QVIUfYM.exe
  C:\Windows\System\QVIUfYM.exe
  2⤵
  PID:5996
- C:\Windows\System\fwjfWmw.exe
  C:\Windows\System\fwjfWmw.exe
  2⤵
  PID:2724
- C:\Windows\System\Cwvmnir.exe
  C:\Windows\System\Cwvmnir.exe
  2⤵
  PID:6152
- C:\Windows\System\OPFnxia.exe
  C:\Windows\System\OPFnxia.exe
  2⤵
  PID:6216
- C:\Windows\System\VmYeTjw.exe
  C:\Windows\System\VmYeTjw.exe
  2⤵
  PID:6248
- C:\Windows\System\VwonhNM.exe
  C:\Windows\System\VwonhNM.exe
  2⤵
  PID:6280
- C:\Windows\System\JHKwyam.exe
  C:\Windows\System\JHKwyam.exe
  2⤵
  PID:6420
- C:\Windows\System\MpoAoZN.exe
  C:\Windows\System\MpoAoZN.exe
  2⤵
  PID:6536
- C:\Windows\System\JXtZbJm.exe
  C:\Windows\System\JXtZbJm.exe
  2⤵
  PID:6628
- C:\Windows\System\smPYzIK.exe
  C:\Windows\System\smPYzIK.exe
  2⤵
  PID:6676
- C:\Windows\System\gTRGEhF.exe
  C:\Windows\System\gTRGEhF.exe
  2⤵
  PID:6708
- C:\Windows\System\dMkHFhD.exe
  C:\Windows\System\dMkHFhD.exe
  2⤵
  PID:6740
- C:\Windows\System\GoLiNYR.exe
  C:\Windows\System\GoLiNYR.exe
  2⤵
  PID:6772
- C:\Windows\System\qRjQQly.exe
  C:\Windows\System\qRjQQly.exe
  2⤵
  PID:6804
- C:\Windows\System\XYjhMqn.exe
  C:\Windows\System\XYjhMqn.exe
  2⤵
  PID:6836
- C:\Windows\System\kOtIAeI.exe
  C:\Windows\System\kOtIAeI.exe
  2⤵
  PID:6868
- C:\Windows\System\UOPGMbl.exe
  C:\Windows\System\UOPGMbl.exe
  2⤵
  PID:6900
- C:\Windows\System\LqsDSzD.exe
  C:\Windows\System\LqsDSzD.exe
  2⤵
  PID:6936
- C:\Windows\System\wtrgFuS.exe
  C:\Windows\System\wtrgFuS.exe
  2⤵
  PID:6996
- C:\Windows\System\EQkqYCi.exe
  C:\Windows\System\EQkqYCi.exe
  2⤵
  PID:6948
- C:\Windows\System\yANWoDV.exe
  C:\Windows\System\yANWoDV.exe
  2⤵
  PID:5040
- C:\Windows\System\tnKaDSI.exe
  C:\Windows\System\tnKaDSI.exe
  2⤵
  PID:5052
- C:\Windows\System\GbuQXoF.exe
  C:\Windows\System\GbuQXoF.exe
  2⤵
  PID:5068
- C:\Windows\System\exmMOfV.exe
  C:\Windows\System\exmMOfV.exe
  2⤵
  PID:5084
- C:\Windows\System\evDykDe.exe
  C:\Windows\System\evDykDe.exe
  2⤵
  PID:5104
- C:\Windows\System\QHJGjUC.exe
  C:\Windows\System\QHJGjUC.exe
  2⤵
  PID:7032
- C:\Windows\System\cHvVFtI.exe
  C:\Windows\System\cHvVFtI.exe
  2⤵
  PID:7048
- C:\Windows\System\aHVnEHL.exe
  C:\Windows\System\aHVnEHL.exe
  2⤵
  PID:7096
- C:\Windows\System\NBdKFim.exe
  C:\Windows\System\NBdKFim.exe
  2⤵
  PID:7116
- C:\Windows\System\fPamxfp.exe
  C:\Windows\System\fPamxfp.exe
  2⤵
  PID:7160
- C:\Windows\System\AtkeVtq.exe
  C:\Windows\System\AtkeVtq.exe
  2⤵
  PID:5020
- C:\Windows\System\ejwlYzE.exe
  C:\Windows\System\ejwlYzE.exe
  2⤵
  PID:6124
- C:\Windows\System\rzRYtrZ.exe
  C:\Windows\System\rzRYtrZ.exe
  2⤵
  PID:6212
- C:\Windows\System\qeCbofR.exe
  C:\Windows\System\qeCbofR.exe
  2⤵
  PID:5164
- C:\Windows\System\OirzKvg.exe
  C:\Windows\System\OirzKvg.exe
  2⤵
  PID:6260
- C:\Windows\System\EqTPpOL.exe
  C:\Windows\System\EqTPpOL.exe
  2⤵
  PID:6292
- C:\Windows\System\TvmsfKg.exe
  C:\Windows\System\TvmsfKg.exe
  2⤵
  PID:6340
- C:\Windows\System\obTcrzH.exe
  C:\Windows\System\obTcrzH.exe
  2⤵
  PID:6392
- C:\Windows\System\GKHXtAP.exe
  C:\Windows\System\GKHXtAP.exe
  2⤵
  PID:6328
- C:\Windows\System\XRNoeky.exe
  C:\Windows\System\XRNoeky.exe
  2⤵
  PID:6468
- C:\Windows\System\LNiRtOb.exe
  C:\Windows\System\LNiRtOb.exe
  2⤵
  PID:6580
- C:\Windows\System\zpleUuf.exe
  C:\Windows\System\zpleUuf.exe
  2⤵
  PID:6532
- C:\Windows\System\WqjYgEX.exe
  C:\Windows\System\WqjYgEX.exe
  2⤵
  PID:6596
- C:\Windows\System\TMpsTsj.exe
  C:\Windows\System\TMpsTsj.exe
  2⤵
  PID:6612
- C:\Windows\System\RwUXKdM.exe
  C:\Windows\System\RwUXKdM.exe
  2⤵
  PID:6692
- C:\Windows\System\qUBTVwD.exe
  C:\Windows\System\qUBTVwD.exe
  2⤵
  PID:6712
- C:\Windows\System\HlfCWpr.exe
  C:\Windows\System\HlfCWpr.exe
  2⤵
  PID:6724
- C:\Windows\System\RTZmLVJ.exe
  C:\Windows\System\RTZmLVJ.exe
  2⤵
  PID:6964
- C:\Windows\System\goGGvBb.exe
  C:\Windows\System\goGGvBb.exe
  2⤵
  PID:6788
- C:\Windows\System\pamXryY.exe
  C:\Windows\System\pamXryY.exe
  2⤵
  PID:5072
- C:\Windows\System\dLVEduo.exe
  C:\Windows\System\dLVEduo.exe
  2⤵
  PID:7016
- C:\Windows\System\vBoDZfE.exe
  C:\Windows\System\vBoDZfE.exe
  2⤵
  PID:7164
- C:\Windows\System\vFymPmA.exe
  C:\Windows\System\vFymPmA.exe
  2⤵
  PID:6164
- C:\Windows\System\oTmvZQS.exe
  C:\Windows\System\oTmvZQS.exe
  2⤵
  PID:4128
- C:\Windows\System\nyvJSKQ.exe
  C:\Windows\System\nyvJSKQ.exe
  2⤵
  PID:5088
- C:\Windows\System\iSIGVSF.exe
  C:\Windows\System\iSIGVSF.exe
  2⤵
  PID:7080
- C:\Windows\System\xgejPKy.exe
  C:\Windows\System\xgejPKy.exe
  2⤵
  PID:5888
- C:\Windows\System\ZaEFlBR.exe
  C:\Windows\System\ZaEFlBR.exe
  2⤵
  PID:5048
- C:\Windows\System\mfWKRsJ.exe
  C:\Windows\System\mfWKRsJ.exe
  2⤵
  PID:6404
- C:\Windows\System\jUOtdvp.exe
  C:\Windows\System\jUOtdvp.exe
  2⤵
  PID:6548
- C:\Windows\System\cZGPVHT.exe
  C:\Windows\System\cZGPVHT.exe
  2⤵
  PID:6488
- C:\Windows\System\HiiYrhu.exe
  C:\Windows\System\HiiYrhu.exe
  2⤵
  PID:6664
- C:\Windows\System\kZwHYex.exe
  C:\Windows\System\kZwHYex.exe
  2⤵
  PID:7012
- C:\Windows\System\TesanMf.exe
  C:\Windows\System\TesanMf.exe
  2⤵
  PID:6440
- C:\Windows\System\kcGXBXI.exe
  C:\Windows\System\kcGXBXI.exe
  2⤵
  PID:5044
- C:\Windows\System\FqMJgKZ.exe
  C:\Windows\System\FqMJgKZ.exe
  2⤵
  PID:6312
- C:\Windows\System\pvdoRAX.exe
  C:\Windows\System\pvdoRAX.exe
  2⤵
  PID:6760
- C:\Windows\System\jfMjLTY.exe
  C:\Windows\System\jfMjLTY.exe
  2⤵
  PID:6648
- C:\Windows\System\JUwNvgj.exe
  C:\Windows\System\JUwNvgj.exe
  2⤵
  PID:6884
- C:\Windows\System\IgeqOdC.exe
  C:\Windows\System\IgeqOdC.exe
  2⤵
  PID:6184
- C:\Windows\System\wjFahGF.exe
  C:\Windows\System\wjFahGF.exe
  2⤵
  PID:6920
- C:\Windows\System\saTDUuw.exe
  C:\Windows\System\saTDUuw.exe
  2⤵
  PID:6756
- C:\Windows\System\NDiOoZP.exe
  C:\Windows\System\NDiOoZP.exe
  2⤵
  PID:2332
- C:\Windows\System\yReypvL.exe
  C:\Windows\System\yReypvL.exe
  2⤵
  PID:6360
- C:\Windows\System\FQRHpol.exe
  C:\Windows\System\FQRHpol.exe
  2⤵
  PID:6856
- C:\Windows\System\omUumnx.exe
  C:\Windows\System\omUumnx.exe
  2⤵
  PID:7068
- C:\Windows\System\qXURiNG.exe
  C:\Windows\System\qXURiNG.exe
  2⤵
  PID:2104
- C:\Windows\System\ULsFtCl.exe
  C:\Windows\System\ULsFtCl.exe
  2⤵
  PID:6584
- C:\Windows\System\VJIEbtR.exe
  C:\Windows\System\VJIEbtR.exe
  2⤵
  PID:5308
- C:\Windows\System\eMrGCHh.exe
  C:\Windows\System\eMrGCHh.exe
  2⤵
  PID:6376
- C:\Windows\System\MXUKrUN.exe
  C:\Windows\System\MXUKrUN.exe
  2⤵
  PID:7184
- C:\Windows\System\ZMAjolP.exe
  C:\Windows\System\ZMAjolP.exe
  2⤵
  PID:7200
- C:\Windows\System\oekXgxr.exe
  C:\Windows\System\oekXgxr.exe
  2⤵
  PID:7216
- C:\Windows\System\BmaiOAr.exe
  C:\Windows\System\BmaiOAr.exe
  2⤵
  PID:7232
- C:\Windows\System\uxkOoGC.exe
  C:\Windows\System\uxkOoGC.exe
  2⤵
  PID:7248
- C:\Windows\System\CzMvuZX.exe
  C:\Windows\System\CzMvuZX.exe
  2⤵
  PID:7264
- C:\Windows\System\rQHPcNS.exe
  C:\Windows\System\rQHPcNS.exe
  2⤵
  PID:7280
- C:\Windows\System\FCchCbE.exe
  C:\Windows\System\FCchCbE.exe
  2⤵
  PID:7296
- C:\Windows\System\ptTTZkB.exe
  C:\Windows\System\ptTTZkB.exe
  2⤵
  PID:7312
- C:\Windows\System\PvoUyDL.exe
  C:\Windows\System\PvoUyDL.exe
  2⤵
  PID:7328
- C:\Windows\System\eYnbjnR.exe
  C:\Windows\System\eYnbjnR.exe
  2⤵
  PID:7344
- C:\Windows\System\ASThotc.exe
  C:\Windows\System\ASThotc.exe
  2⤵
  PID:7360
- C:\Windows\System\rCPxoQd.exe
  C:\Windows\System\rCPxoQd.exe
  2⤵
  PID:7376
- C:\Windows\System\vSUHtHy.exe
  C:\Windows\System\vSUHtHy.exe
  2⤵
  PID:7392
- C:\Windows\System\dNSaniH.exe
  C:\Windows\System\dNSaniH.exe
  2⤵
  PID:7408
- C:\Windows\System\yAlowdf.exe
  C:\Windows\System\yAlowdf.exe
  2⤵
  PID:7424
- C:\Windows\System\vhPHmff.exe
  C:\Windows\System\vhPHmff.exe
  2⤵
  PID:7440
- C:\Windows\System\GicIEWv.exe
  C:\Windows\System\GicIEWv.exe
  2⤵
  PID:7456
- C:\Windows\System\PwXgTBO.exe
  C:\Windows\System\PwXgTBO.exe
  2⤵
  PID:7472
- C:\Windows\System\vLxBqOR.exe
  C:\Windows\System\vLxBqOR.exe
  2⤵
  PID:7488
- C:\Windows\System\DZVsgVF.exe
  C:\Windows\System\DZVsgVF.exe
  2⤵
  PID:7504
- C:\Windows\System\ABYRiKV.exe
  C:\Windows\System\ABYRiKV.exe
  2⤵
  PID:7520
- C:\Windows\System\rADFqns.exe
  C:\Windows\System\rADFqns.exe
  2⤵
  PID:7536
- C:\Windows\System\lcZBYUq.exe
  C:\Windows\System\lcZBYUq.exe
  2⤵
  PID:7552
- C:\Windows\System\PbaZgNo.exe
  C:\Windows\System\PbaZgNo.exe
  2⤵
  PID:7568
- C:\Windows\System\RZWcGrq.exe
  C:\Windows\System\RZWcGrq.exe
  2⤵
  PID:7584
- C:\Windows\System\osaSqKb.exe
  C:\Windows\System\osaSqKb.exe
  2⤵
  PID:7600
- C:\Windows\System\peOsMbn.exe
  C:\Windows\System\peOsMbn.exe
  2⤵
  PID:7616
- C:\Windows\System\fVyFueH.exe
  C:\Windows\System\fVyFueH.exe
  2⤵
  PID:7632
- C:\Windows\System\jiENSiA.exe
  C:\Windows\System\jiENSiA.exe
  2⤵
  PID:7648
- C:\Windows\System\xWuWuOZ.exe
  C:\Windows\System\xWuWuOZ.exe
  2⤵
  PID:7664
- C:\Windows\System\qFhlNPM.exe
  C:\Windows\System\qFhlNPM.exe
  2⤵
  PID:7680
- C:\Windows\System\YdZmCvV.exe
  C:\Windows\System\YdZmCvV.exe
  2⤵
  PID:7696
- C:\Windows\System\VvLugHS.exe
  C:\Windows\System\VvLugHS.exe
  2⤵
  PID:7712
- C:\Windows\System\IIIbUmn.exe
  C:\Windows\System\IIIbUmn.exe
  2⤵
  PID:7728
- C:\Windows\System\JQpFZPy.exe
  C:\Windows\System\JQpFZPy.exe
  2⤵
  PID:7744
- C:\Windows\System\WrjbcLE.exe
  C:\Windows\System\WrjbcLE.exe
  2⤵
  PID:7760
- C:\Windows\System\xFEvudl.exe
  C:\Windows\System\xFEvudl.exe
  2⤵
  PID:7776
- C:\Windows\System\WuwXyJK.exe
  C:\Windows\System\WuwXyJK.exe
  2⤵
  PID:7792
- C:\Windows\System\kdjyYKR.exe
  C:\Windows\System\kdjyYKR.exe
  2⤵
  PID:7808
- C:\Windows\System\pAtyShT.exe
  C:\Windows\System\pAtyShT.exe
  2⤵
  PID:7824
- C:\Windows\System\nfcrlKa.exe
  C:\Windows\System\nfcrlKa.exe
  2⤵
  PID:7840
- C:\Windows\System\NVqDVYH.exe
  C:\Windows\System\NVqDVYH.exe
  2⤵
  PID:7856
- C:\Windows\System\ffRnZOk.exe
  C:\Windows\System\ffRnZOk.exe
  2⤵
  PID:7872
- C:\Windows\System\goByHxA.exe
  C:\Windows\System\goByHxA.exe
  2⤵
  PID:7888
- C:\Windows\System\zYdRHWK.exe
  C:\Windows\System\zYdRHWK.exe
  2⤵
  PID:7904
- C:\Windows\System\tFATOBG.exe
  C:\Windows\System\tFATOBG.exe
  2⤵
  PID:7920
- C:\Windows\System\XHKrEMx.exe
  C:\Windows\System\XHKrEMx.exe
  2⤵
  PID:7936
- C:\Windows\System\eCKFOkg.exe
  C:\Windows\System\eCKFOkg.exe
  2⤵
  PID:7952
- C:\Windows\System\LxScbwA.exe
  C:\Windows\System\LxScbwA.exe
  2⤵
  PID:7968
- C:\Windows\System\NUuFGng.exe
  C:\Windows\System\NUuFGng.exe
  2⤵
  PID:7984
- C:\Windows\System\mCxPZGf.exe
  C:\Windows\System\mCxPZGf.exe
  2⤵
  PID:8000
- C:\Windows\System\CbBSqRv.exe
  C:\Windows\System\CbBSqRv.exe
  2⤵
  PID:8016
- C:\Windows\System\oQqZjDl.exe
  C:\Windows\System\oQqZjDl.exe
  2⤵
  PID:8032
- C:\Windows\System\yHVXRkP.exe
  C:\Windows\System\yHVXRkP.exe
  2⤵
  PID:8048
- C:\Windows\System\bcnPiOq.exe
  C:\Windows\System\bcnPiOq.exe
  2⤵
  PID:8064
- C:\Windows\System\uOdwZik.exe
  C:\Windows\System\uOdwZik.exe
  2⤵
  PID:8080
- C:\Windows\System\LtFSUGi.exe
  C:\Windows\System\LtFSUGi.exe
  2⤵
  PID:8096
- C:\Windows\System\rUPTsVF.exe
  C:\Windows\System\rUPTsVF.exe
  2⤵
  PID:8112
- C:\Windows\System\SbfNGTs.exe
  C:\Windows\System\SbfNGTs.exe
  2⤵
  PID:8128
- C:\Windows\System\SXmWpBH.exe
  C:\Windows\System\SXmWpBH.exe
  2⤵
  PID:8144
- C:\Windows\System\MIETSEx.exe
  C:\Windows\System\MIETSEx.exe
  2⤵
  PID:8160
- C:\Windows\System\vKlsjcX.exe
  C:\Windows\System\vKlsjcX.exe
  2⤵
  PID:8176
- C:\Windows\System\eWeyRvb.exe
  C:\Windows\System\eWeyRvb.exe
  2⤵
  PID:7180
- C:\Windows\System\zckewOF.exe
  C:\Windows\System\zckewOF.exe
  2⤵
  PID:7208
- C:\Windows\System\fTJBkOu.exe
  C:\Windows\System\fTJBkOu.exe
  2⤵
  PID:7036
- C:\Windows\System\hONdulw.exe
  C:\Windows\System\hONdulw.exe
  2⤵
  PID:7272
- C:\Windows\System\bfKCQai.exe
  C:\Windows\System\bfKCQai.exe
  2⤵
  PID:7308
- C:\Windows\System\pPflaUJ.exe
  C:\Windows\System\pPflaUJ.exe
  2⤵
  PID:7288
- C:\Windows\System\jnRptMO.exe
  C:\Windows\System\jnRptMO.exe
  2⤵
  PID:7404
- C:\Windows\System\zHzADgN.exe
  C:\Windows\System\zHzADgN.exe
  2⤵
  PID:7468
- C:\Windows\System\REnQkyl.exe
  C:\Windows\System\REnQkyl.exe
  2⤵
  PID:7500
- C:\Windows\System\mfRROhK.exe
  C:\Windows\System\mfRROhK.exe
  2⤵
  PID:7516
- C:\Windows\System\tBzrnZC.exe
  C:\Windows\System\tBzrnZC.exe
  2⤵
  PID:7448
- C:\Windows\System\ODyOZNT.exe
  C:\Windows\System\ODyOZNT.exe
  2⤵
  PID:7356
- C:\Windows\System\sQEwfVB.exe
  C:\Windows\System\sQEwfVB.exe
  2⤵
  PID:7544
- C:\Windows\System\hUTrUBz.exe
  C:\Windows\System\hUTrUBz.exe
  2⤵
  PID:7624
- C:\Windows\System\pQtwJVs.exe
  C:\Windows\System\pQtwJVs.exe
  2⤵
  PID:7660
- C:\Windows\System\WmKYGXo.exe
  C:\Windows\System\WmKYGXo.exe
  2⤵
  PID:7580
- C:\Windows\System\ixiWLTl.exe
  C:\Windows\System\ixiWLTl.exe
  2⤵
  PID:7752
- C:\Windows\System\XqFOHIZ.exe
  C:\Windows\System\XqFOHIZ.exe
  2⤵
  PID:7612
- C:\Windows\System\araKaAg.exe
  C:\Windows\System\araKaAg.exe
  2⤵
  PID:7676
- C:\Windows\System\zClqBNh.exe
  C:\Windows\System\zClqBNh.exe
  2⤵
  PID:7768
- C:\Windows\System\vUSjZbp.exe
  C:\Windows\System\vUSjZbp.exe
  2⤵
  PID:7820
- C:\Windows\System\chsKIDh.exe
  C:\Windows\System\chsKIDh.exe
  2⤵
  PID:7884
- C:\Windows\System\JigWxhI.exe
  C:\Windows\System\JigWxhI.exe
  2⤵
  PID:7948
- C:\Windows\System\LTrgOlP.exe
  C:\Windows\System\LTrgOlP.exe
  2⤵
  PID:7864
- C:\Windows\System\OxtAZEG.exe
  C:\Windows\System\OxtAZEG.exe
  2⤵
  PID:8076
- C:\Windows\System\SYYMvdR.exe
  C:\Windows\System\SYYMvdR.exe
  2⤵
  PID:7836
- C:\Windows\System\KdDVaTx.exe
  C:\Windows\System\KdDVaTx.exe
  2⤵
  PID:8172
- C:\Windows\System\LCctkFI.exe
  C:\Windows\System\LCctkFI.exe
  2⤵
  PID:7900
- C:\Windows\System\RqbXwrM.exe
  C:\Windows\System\RqbXwrM.exe
  2⤵
  PID:7964
- C:\Windows\System\QIJtPip.exe
  C:\Windows\System\QIJtPip.exe
  2⤵
  PID:8188
- C:\Windows\System\OCNbfBv.exe
  C:\Windows\System\OCNbfBv.exe
  2⤵
  PID:8120
- C:\Windows\System\fYdzHyu.exe
  C:\Windows\System\fYdzHyu.exe
  2⤵
  PID:8056
- C:\Windows\System\SQiatRW.exe
  C:\Windows\System\SQiatRW.exe
  2⤵
  PID:7028
- C:\Windows\System\pZWqjVM.exe
  C:\Windows\System\pZWqjVM.exe
  2⤵
  PID:7304
- C:\Windows\System\RFErOQD.exe
  C:\Windows\System\RFErOQD.exe
  2⤵
  PID:7464
- C:\Windows\System\YMCpeTW.exe
  C:\Windows\System\YMCpeTW.exe
  2⤵
  PID:7372
- C:\Windows\System\wmAnNlw.exe
  C:\Windows\System\wmAnNlw.exe
  2⤵
  PID:7420
- C:\Windows\System\ZNkjCmv.exe
  C:\Windows\System\ZNkjCmv.exe
  2⤵
  PID:7388
- C:\Windows\System\gpcKTDd.exe
  C:\Windows\System\gpcKTDd.exe
  2⤵
  PID:7788
- C:\Windows\System\kIBfPkP.exe
  C:\Windows\System\kIBfPkP.exe
  2⤵
  PID:7724
- C:\Windows\System\BeGskEk.exe
  C:\Windows\System\BeGskEk.exe
  2⤵
  PID:7740
- C:\Windows\System\KKyWpZP.exe
  C:\Windows\System\KKyWpZP.exe
  2⤵
  PID:7736
- C:\Windows\System\aJivDmN.exe
  C:\Windows\System\aJivDmN.exe
  2⤵
  PID:8008
- C:\Windows\System\uecQshV.exe
  C:\Windows\System\uecQshV.exe
  2⤵
  PID:8156
- C:\Windows\System\eQPinOP.exe
  C:\Windows\System\eQPinOP.exe
  2⤵
  PID:8060
- C:\Windows\System\TxAPTOD.exe
  C:\Windows\System\TxAPTOD.exe
  2⤵
  PID:7400
- C:\Windows\System\EpQuqAi.exe
  C:\Windows\System\EpQuqAi.exe
  2⤵
  PID:7528
- C:\Windows\System\ueuqnbt.exe
  C:\Windows\System\ueuqnbt.exe
  2⤵
  PID:8072
- C:\Windows\System\OSOpDHK.exe
  C:\Windows\System\OSOpDHK.exe
  2⤵
  PID:7960
- C:\Windows\System\SaFgiSQ.exe
  C:\Windows\System\SaFgiSQ.exe
  2⤵
  PID:5064
- C:\Windows\System\kBwSpxq.exe
  C:\Windows\System\kBwSpxq.exe
  2⤵
  PID:7592
- C:\Windows\System\IBeOrju.exe
  C:\Windows\System\IBeOrju.exe
  2⤵
  PID:7352
- C:\Windows\System\zYCIjBv.exe
  C:\Windows\System\zYCIjBv.exe
  2⤵
  PID:7784
- C:\Windows\System\JDSxmMf.exe
  C:\Windows\System\JDSxmMf.exe
  2⤵
  PID:7976
- C:\Windows\System\yWRIgJo.exe
  C:\Windows\System\yWRIgJo.exe
  2⤵
  PID:7228
- C:\Windows\System\UJJhris.exe
  C:\Windows\System\UJJhris.exe
  2⤵
  PID:7832
- C:\Windows\System\mzMhBmm.exe
  C:\Windows\System\mzMhBmm.exe
  2⤵
  PID:7608
- C:\Windows\System\ddbyBRm.exe
  C:\Windows\System\ddbyBRm.exe
  2⤵
  PID:8196
- C:\Windows\System\xSkbNjf.exe
  C:\Windows\System\xSkbNjf.exe
  2⤵
  PID:8212
- C:\Windows\System\sTsQwyT.exe
  C:\Windows\System\sTsQwyT.exe
  2⤵
  PID:8228
- C:\Windows\System\QrJtyIw.exe
  C:\Windows\System\QrJtyIw.exe
  2⤵
  PID:8244
- C:\Windows\System\qQxBZJB.exe
  C:\Windows\System\qQxBZJB.exe
  2⤵
  PID:8260
- C:\Windows\System\hQixWvF.exe
  C:\Windows\System\hQixWvF.exe
  2⤵
  PID:8276
- C:\Windows\System\BdPXtOb.exe
  C:\Windows\System\BdPXtOb.exe
  2⤵
  PID:8292
- C:\Windows\System\eyGMNKR.exe
  C:\Windows\System\eyGMNKR.exe
  2⤵
  PID:8308
- C:\Windows\System\PvTauJx.exe
  C:\Windows\System\PvTauJx.exe
  2⤵
  PID:8324
- C:\Windows\System\kzGhqGA.exe
  C:\Windows\System\kzGhqGA.exe
  2⤵
  PID:8340
- C:\Windows\System\kaInwPV.exe
  C:\Windows\System\kaInwPV.exe
  2⤵
  PID:8356
- C:\Windows\System\zPFXtyp.exe
  C:\Windows\System\zPFXtyp.exe
  2⤵
  PID:8376
- C:\Windows\System\UqCeJFD.exe
  C:\Windows\System\UqCeJFD.exe
  2⤵
  PID:8392
- C:\Windows\System\vhBaHpu.exe
  C:\Windows\System\vhBaHpu.exe
  2⤵
  PID:8408
- C:\Windows\System\HDRzDGb.exe
  C:\Windows\System\HDRzDGb.exe
  2⤵
  PID:8424
- C:\Windows\System\UEvBgkx.exe
  C:\Windows\System\UEvBgkx.exe
  2⤵
  PID:8440
- C:\Windows\System\JfFOykP.exe
  C:\Windows\System\JfFOykP.exe
  2⤵
  PID:8456
- C:\Windows\System\ETKMVfB.exe
  C:\Windows\System\ETKMVfB.exe
  2⤵
  PID:8472
- C:\Windows\System\EiogWhZ.exe
  C:\Windows\System\EiogWhZ.exe
  2⤵
  PID:8488
- C:\Windows\System\hpfGSJW.exe
  C:\Windows\System\hpfGSJW.exe
  2⤵
  PID:8504
- C:\Windows\System\bvHCjug.exe
  C:\Windows\System\bvHCjug.exe
  2⤵
  PID:8520
- C:\Windows\System\hIpJsjr.exe
  C:\Windows\System\hIpJsjr.exe
  2⤵
  PID:8536
- C:\Windows\System\KfRYIiu.exe
  C:\Windows\System\KfRYIiu.exe
  2⤵
  PID:8552
- C:\Windows\System\BUzVPsB.exe
  C:\Windows\System\BUzVPsB.exe
  2⤵
  PID:8568
- C:\Windows\System\GPlZcGo.exe
  C:\Windows\System\GPlZcGo.exe
  2⤵
  PID:8584
- C:\Windows\System\liMDKZT.exe
  C:\Windows\System\liMDKZT.exe
  2⤵
  PID:8608
- C:\Windows\System\sCdvWld.exe
  C:\Windows\System\sCdvWld.exe
  2⤵
  PID:8624
- C:\Windows\System\cLhdJBN.exe
  C:\Windows\System\cLhdJBN.exe
  2⤵
  PID:8640
- C:\Windows\System\jdIqQQs.exe
  C:\Windows\System\jdIqQQs.exe
  2⤵
  PID:8656
- C:\Windows\System\cyWjUWL.exe
  C:\Windows\System\cyWjUWL.exe
  2⤵
  PID:8672
- C:\Windows\System\qIbOaGF.exe
  C:\Windows\System\qIbOaGF.exe
  2⤵
  PID:8688
- C:\Windows\System\fbWGOTH.exe
  C:\Windows\System\fbWGOTH.exe
  2⤵
  PID:8712
- C:\Windows\System\ZQuYVSr.exe
  C:\Windows\System\ZQuYVSr.exe
  2⤵
  PID:8728
- C:\Windows\System\XTVgAqK.exe
  C:\Windows\System\XTVgAqK.exe
  2⤵
  PID:8744
- C:\Windows\System\cKkUlVp.exe
  C:\Windows\System\cKkUlVp.exe
  2⤵
  PID:8764
- C:\Windows\System\LaWzvFe.exe
  C:\Windows\System\LaWzvFe.exe
  2⤵
  PID:8780
- C:\Windows\System\CvcXShx.exe
  C:\Windows\System\CvcXShx.exe
  2⤵
  PID:8796
- C:\Windows\System\iCYBTtV.exe
  C:\Windows\System\iCYBTtV.exe
  2⤵
  PID:8812
- C:\Windows\System\drpniGa.exe
  C:\Windows\System\drpniGa.exe
  2⤵
  PID:8828
- C:\Windows\System\yooJWtD.exe
  C:\Windows\System\yooJWtD.exe
  2⤵
  PID:8844
- C:\Windows\System\ooeOtpD.exe
  C:\Windows\System\ooeOtpD.exe
  2⤵
  PID:8860
- C:\Windows\System\AcxPCcK.exe
  C:\Windows\System\AcxPCcK.exe
  2⤵
  PID:8876
- C:\Windows\System\hHOMwNK.exe
  C:\Windows\System\hHOMwNK.exe
  2⤵
  PID:8892
- C:\Windows\System\ZkiFFjn.exe
  C:\Windows\System\ZkiFFjn.exe
  2⤵
  PID:8908
- C:\Windows\System\ApCZjFN.exe
  C:\Windows\System\ApCZjFN.exe
  2⤵
  PID:8924
- C:\Windows\System\kRvxTyW.exe
  C:\Windows\System\kRvxTyW.exe
  2⤵
  PID:8940
- C:\Windows\System\lWfhrSK.exe
  C:\Windows\System\lWfhrSK.exe
  2⤵
  PID:8956
- C:\Windows\System\qRmsKql.exe
  C:\Windows\System\qRmsKql.exe
  2⤵
  PID:8972
- C:\Windows\System\xcyiPDh.exe
  C:\Windows\System\xcyiPDh.exe
  2⤵
  PID:8988
- C:\Windows\System\PnkWiNu.exe
  C:\Windows\System\PnkWiNu.exe
  2⤵
  PID:9004
- C:\Windows\System\ZuRIPoI.exe
  C:\Windows\System\ZuRIPoI.exe
  2⤵
  PID:9020
- C:\Windows\System\qpgpqeT.exe
  C:\Windows\System\qpgpqeT.exe
  2⤵
  PID:9036
- C:\Windows\System\zCthARp.exe
  C:\Windows\System\zCthARp.exe
  2⤵
  PID:9052
- C:\Windows\System\GSZvdPD.exe
  C:\Windows\System\GSZvdPD.exe
  2⤵
  PID:9068
- C:\Windows\System\WNIUxQr.exe
  C:\Windows\System\WNIUxQr.exe
  2⤵
  PID:9084
- C:\Windows\System\ZVuOABF.exe
  C:\Windows\System\ZVuOABF.exe
  2⤵
  PID:9100
- C:\Windows\System\TXazjUW.exe
  C:\Windows\System\TXazjUW.exe
  2⤵
  PID:9116
- C:\Windows\System\pqbmnCn.exe
  C:\Windows\System\pqbmnCn.exe
  2⤵
  PID:9132
- C:\Windows\System\IRwEAYM.exe
  C:\Windows\System\IRwEAYM.exe
  2⤵
  PID:9148
- C:\Windows\System\qmsoUWv.exe
  C:\Windows\System\qmsoUWv.exe
  2⤵
  PID:9164
- C:\Windows\System\pYgazfJ.exe
  C:\Windows\System\pYgazfJ.exe
  2⤵
  PID:9180
- C:\Windows\System\qEbgktD.exe
  C:\Windows\System\qEbgktD.exe
  2⤵
  PID:9196
- C:\Windows\System\ucSiHnP.exe
  C:\Windows\System\ucSiHnP.exe
  2⤵
  PID:9212
- C:\Windows\System\VoFylMx.exe
  C:\Windows\System\VoFylMx.exe
  2⤵
  PID:8224
- C:\Windows\System\WuYAtZR.exe
  C:\Windows\System\WuYAtZR.exe
  2⤵
  PID:8316
- C:\Windows\System\ZkojPgA.exe
  C:\Windows\System\ZkojPgA.exe
  2⤵
  PID:8352
- C:\Windows\System\pBUpHMQ.exe
  C:\Windows\System\pBUpHMQ.exe
  2⤵
  PID:8420
- C:\Windows\System\dbtBZao.exe
  C:\Windows\System\dbtBZao.exe
  2⤵
  PID:8484
- C:\Windows\System\ZKVfWsL.exe
  C:\Windows\System\ZKVfWsL.exe
  2⤵
  PID:8548
- C:\Windows\System\YQzwuoG.exe
  C:\Windows\System\YQzwuoG.exe
  2⤵
  PID:7436
- C:\Windows\System\uEFDlLu.exe
  C:\Windows\System\uEFDlLu.exe
  2⤵
  PID:7932
- C:\Windows\System\GnWMjQJ.exe
  C:\Windows\System\GnWMjQJ.exe
  2⤵
  PID:7452
- C:\Windows\System\oiAGvpH.exe
  C:\Windows\System\oiAGvpH.exe
  2⤵
  PID:7672
- C:\Windows\System\dNIoNyI.exe
  C:\Windows\System\dNIoNyI.exe
  2⤵
  PID:8332
- C:\Windows\System\ExtKylz.exe
  C:\Windows\System\ExtKylz.exe
  2⤵
  PID:8372
- C:\Windows\System\hWmzjTM.exe
  C:\Windows\System\hWmzjTM.exe
  2⤵
  PID:8468
- C:\Windows\System\qjrAqmQ.exe
  C:\Windows\System\qjrAqmQ.exe
  2⤵
  PID:8532
- C:\Windows\System\AeXLiXb.exe
  C:\Windows\System\AeXLiXb.exe
  2⤵
  PID:7692
- C:\Windows\System\uELMlgU.exe
  C:\Windows\System\uELMlgU.exe
  2⤵
  PID:8240
- C:\Windows\System\ClksVhU.exe
  C:\Windows\System\ClksVhU.exe
  2⤵
  PID:8636
- C:\Windows\System\VGkIKYB.exe
  C:\Windows\System\VGkIKYB.exe
  2⤵
  PID:8648
- C:\Windows\System\lSjUJTW.exe
  C:\Windows\System\lSjUJTW.exe
  2⤵
  PID:8696
- C:\Windows\System\DEYfXGk.exe
  C:\Windows\System\DEYfXGk.exe
  2⤵
  PID:8724
- C:\Windows\System\gRpVQqh.exe
  C:\Windows\System\gRpVQqh.exe
  2⤵
  PID:8704
- C:\Windows\System\Mvnwnlv.exe
  C:\Windows\System\Mvnwnlv.exe
  2⤵
  PID:8824
- C:\Windows\System\LgEaPzC.exe
  C:\Windows\System\LgEaPzC.exe
  2⤵
  PID:8884
- C:\Windows\System\zCqSLRQ.exe
  C:\Windows\System\zCqSLRQ.exe
  2⤵
  PID:8920
- C:\Windows\System\UMhjosY.exe
  C:\Windows\System\UMhjosY.exe
  2⤵
  PID:8984
- C:\Windows\System\WqIAYtA.exe
  C:\Windows\System\WqIAYtA.exe
  2⤵
  PID:9044
- C:\Windows\System\QGPyQVR.exe
  C:\Windows\System\QGPyQVR.exe
  2⤵
  PID:9108
- C:\Windows\System\XJtNSnR.exe
  C:\Windows\System\XJtNSnR.exe
  2⤵
  PID:9172
- C:\Windows\System\ryzcgMa.exe
  C:\Windows\System\ryzcgMa.exe
  2⤵
  PID:8256
- C:\Windows\System\eLwJXYt.exe
  C:\Windows\System\eLwJXYt.exe
  2⤵
  PID:8772
- C:\Windows\System\khzRKBn.exe
  C:\Windows\System\khzRKBn.exe
  2⤵
  PID:8836
- C:\Windows\System\qNxVxXl.exe
  C:\Windows\System\qNxVxXl.exe
  2⤵
  PID:9028
- C:\Windows\System\LiQuqNk.exe
  C:\Windows\System\LiQuqNk.exe
  2⤵
  PID:8964
- C:\Windows\System\XHlMrwq.exe
  C:\Windows\System\XHlMrwq.exe
  2⤵
  PID:8416
- C:\Windows\System\UdzZbVt.exe
  C:\Windows\System\UdzZbVt.exe
  2⤵
  PID:7868
- C:\Windows\System\LSrbKmk.exe
  C:\Windows\System\LSrbKmk.exe
  2⤵
  PID:8368
- C:\Windows\System\qZXPbMR.exe
  C:\Windows\System\qZXPbMR.exe
  2⤵
  PID:9032
- C:\Windows\System\vUssGIo.exe
  C:\Windows\System\vUssGIo.exe
  2⤵
  PID:9096
- C:\Windows\System\Ypqwfad.exe
  C:\Windows\System\Ypqwfad.exe
  2⤵
  PID:9188
- C:\Windows\System\SwGsSQY.exe
  C:\Windows\System\SwGsSQY.exe
  2⤵
  PID:8284
- C:\Windows\System\yqDqVdH.exe
  C:\Windows\System\yqDqVdH.exe
  2⤵
  PID:8684
- C:\Windows\System\MaciihG.exe
  C:\Windows\System\MaciihG.exe
  2⤵
  PID:8792
- C:\Windows\System\TYkcIjL.exe
  C:\Windows\System\TYkcIjL.exe
  2⤵
  PID:9016
- C:\Windows\System\Utlquki.exe
  C:\Windows\System\Utlquki.exe
  2⤵
  PID:9140
- C:\Windows\System\INXMsvX.exe
  C:\Windows\System\INXMsvX.exe
  2⤵
  PID:8872
- C:\Windows\System\KeEpNPc.exe
  C:\Windows\System\KeEpNPc.exe
  2⤵
  PID:8480
- C:\Windows\System\KcFpvfj.exe
  C:\Windows\System\KcFpvfj.exe
  2⤵
  PID:8580
- C:\Windows\System\WatdvzV.exe
  C:\Windows\System\WatdvzV.exe
  2⤵
  PID:8432
- C:\Windows\System\WwTSqbp.exe
  C:\Windows\System\WwTSqbp.exe
  2⤵
  PID:8632
- C:\Windows\System\uJcawdD.exe
  C:\Windows\System\uJcawdD.exe
  2⤵
  PID:9208
- C:\Windows\System\lLTODrz.exe
  C:\Windows\System\lLTODrz.exe
  2⤵
  PID:8364
- C:\Windows\System\dOppqLT.exe
  C:\Windows\System\dOppqLT.exe
  2⤵
  PID:9204
- C:\Windows\System\vdbHsMM.exe
  C:\Windows\System\vdbHsMM.exe
  2⤵
  PID:7212
- C:\Windows\System\KFeuPwN.exe
  C:\Windows\System\KFeuPwN.exe
  2⤵
  PID:8400
- C:\Windows\System\rxlxYMY.exe
  C:\Windows\System\rxlxYMY.exe
  2⤵
  PID:8272
- C:\Windows\System\OoDfllw.exe
  C:\Windows\System\OoDfllw.exe
  2⤵
  PID:8980
- C:\Windows\System\EOClPLQ.exe
  C:\Windows\System\EOClPLQ.exe
  2⤵
  PID:8528
- C:\Windows\System\ymKzLcT.exe
  C:\Windows\System\ymKzLcT.exe
  2⤵
  PID:8204
- C:\Windows\System\utiAbue.exe
  C:\Windows\System\utiAbue.exe
  2⤵
  PID:9012
- C:\Windows\System\hkAqAae.exe
  C:\Windows\System\hkAqAae.exe
  2⤵
  PID:8564
- C:\Windows\System\GeSRxwY.exe
  C:\Windows\System\GeSRxwY.exe
  2⤵
  PID:9080
- C:\Windows\System\QSLaLUB.exe
  C:\Windows\System\QSLaLUB.exe
  2⤵
  PID:8304
- C:\Windows\System\vdzDgmE.exe
  C:\Windows\System\vdzDgmE.exe
  2⤵
  PID:8900
- C:\Windows\System\ToURUek.exe
  C:\Windows\System\ToURUek.exe
  2⤵
  PID:9220
- C:\Windows\System\blLFEKH.exe
  C:\Windows\System\blLFEKH.exe
  2⤵
  PID:9240
- C:\Windows\System\UnLNBlI.exe
  C:\Windows\System\UnLNBlI.exe
  2⤵
  PID:9256
- C:\Windows\System\GvZFYMi.exe
  C:\Windows\System\GvZFYMi.exe
  2⤵
  PID:9272
- C:\Windows\System\NWCKNQv.exe
  C:\Windows\System\NWCKNQv.exe
  2⤵
  PID:9296
- C:\Windows\System\HlENEdd.exe
  C:\Windows\System\HlENEdd.exe
  2⤵
  PID:9388
- C:\Windows\System\URNmFNn.exe
  C:\Windows\System\URNmFNn.exe
  2⤵
  PID:9404
- C:\Windows\System\xGGOaOM.exe
  C:\Windows\System\xGGOaOM.exe
  2⤵
  PID:9420
- C:\Windows\System\XlwOePr.exe
  C:\Windows\System\XlwOePr.exe
  2⤵
  PID:9436
- C:\Windows\System\mZSGjRo.exe
  C:\Windows\System\mZSGjRo.exe
  2⤵
  PID:9452
- C:\Windows\System\MsTigON.exe
  C:\Windows\System\MsTigON.exe
  2⤵
  PID:9472
- C:\Windows\System\GorgpwH.exe
  C:\Windows\System\GorgpwH.exe
  2⤵
  PID:9488
- C:\Windows\System\imGVjJe.exe
  C:\Windows\System\imGVjJe.exe
  2⤵
  PID:9504
- C:\Windows\System\dQywzBc.exe
  C:\Windows\System\dQywzBc.exe
  2⤵
  PID:9520
- C:\Windows\System\cAvtlpv.exe
  C:\Windows\System\cAvtlpv.exe
  2⤵
  PID:9536
- C:\Windows\System\yDgBXCR.exe
  C:\Windows\System\yDgBXCR.exe
  2⤵
  PID:9552
- C:\Windows\System\xDuMZxU.exe
  C:\Windows\System\xDuMZxU.exe
  2⤵
  PID:9568
- C:\Windows\System\AmpZXSK.exe
  C:\Windows\System\AmpZXSK.exe
  2⤵
  PID:9584
- C:\Windows\System\yNuGptT.exe
  C:\Windows\System\yNuGptT.exe
  2⤵
  PID:9600
- C:\Windows\System\XnsRfvJ.exe
  C:\Windows\System\XnsRfvJ.exe
  2⤵
  PID:9616
- C:\Windows\System\cgrGQME.exe
  C:\Windows\System\cgrGQME.exe
  2⤵
  PID:9632
- C:\Windows\System\MoOwalo.exe
  C:\Windows\System\MoOwalo.exe
  2⤵
  PID:9648
- C:\Windows\System\cxMEpYV.exe
  C:\Windows\System\cxMEpYV.exe
  2⤵
  PID:9664
- C:\Windows\System\SUZjxAq.exe
  C:\Windows\System\SUZjxAq.exe
  2⤵
  PID:9680
- C:\Windows\System\KfXunLg.exe
  C:\Windows\System\KfXunLg.exe
  2⤵
  PID:9696
- C:\Windows\System\yqUDTXR.exe
  C:\Windows\System\yqUDTXR.exe
  2⤵
  PID:9712
- C:\Windows\System\fdBHHms.exe
  C:\Windows\System\fdBHHms.exe
  2⤵
  PID:9728
- C:\Windows\System\bHvrfgS.exe
  C:\Windows\System\bHvrfgS.exe
  2⤵
  PID:9744
- C:\Windows\System\PYKqHWa.exe
  C:\Windows\System\PYKqHWa.exe
  2⤵
  PID:9760
- C:\Windows\System\MQYrHxn.exe
  C:\Windows\System\MQYrHxn.exe
  2⤵
  PID:9776
- C:\Windows\System\xqBdnTp.exe
  C:\Windows\System\xqBdnTp.exe
  2⤵
  PID:9792
- C:\Windows\System\GLbCrsw.exe
  C:\Windows\System\GLbCrsw.exe
  2⤵
  PID:9808
- C:\Windows\System\VIjLdiI.exe
  C:\Windows\System\VIjLdiI.exe
  2⤵
  PID:9828
- C:\Windows\System\wqSfPaD.exe
  C:\Windows\System\wqSfPaD.exe
  2⤵
  PID:9844
- C:\Windows\System\GKwUQYq.exe
  C:\Windows\System\GKwUQYq.exe
  2⤵
  PID:9860
- C:\Windows\System\QBKQYWj.exe
  C:\Windows\System\QBKQYWj.exe
  2⤵
  PID:9876
- C:\Windows\System\zwcyegy.exe
  C:\Windows\System\zwcyegy.exe
  2⤵
  PID:9892
- C:\Windows\System\TLDuKnY.exe
  C:\Windows\System\TLDuKnY.exe
  2⤵
  PID:9908
- C:\Windows\System\TSEOAlZ.exe
  C:\Windows\System\TSEOAlZ.exe
  2⤵
  PID:9924
- C:\Windows\System\kXzmygg.exe
  C:\Windows\System\kXzmygg.exe
  2⤵
  PID:9940
- C:\Windows\System\WhjMUWw.exe
  C:\Windows\System\WhjMUWw.exe
  2⤵
  PID:9956
- C:\Windows\System\tUypBUp.exe
  C:\Windows\System\tUypBUp.exe
  2⤵
  PID:9972
- C:\Windows\System\GodeKnP.exe
  C:\Windows\System\GodeKnP.exe
  2⤵
  PID:9988
- C:\Windows\System\pRrwYhU.exe
  C:\Windows\System\pRrwYhU.exe
  2⤵
  PID:10004
- C:\Windows\System\BnXhnwf.exe
  C:\Windows\System\BnXhnwf.exe
  2⤵
  PID:10020
- C:\Windows\System\wcqrKPg.exe
  C:\Windows\System\wcqrKPg.exe
  2⤵
  PID:10036
- C:\Windows\System\osQfMwj.exe
  C:\Windows\System\osQfMwj.exe
  2⤵
  PID:10052
- C:\Windows\System\hapEbgp.exe
  C:\Windows\System\hapEbgp.exe
  2⤵
  PID:10068
- C:\Windows\System\zjwAmst.exe
  C:\Windows\System\zjwAmst.exe
  2⤵
  PID:10084
- C:\Windows\System\CgVugnQ.exe
  C:\Windows\System\CgVugnQ.exe
  2⤵
  PID:10100
- C:\Windows\System\NNOGSRu.exe
  C:\Windows\System\NNOGSRu.exe
  2⤵
  PID:10116
- C:\Windows\System\OYCNNMe.exe
  C:\Windows\System\OYCNNMe.exe
  2⤵
  PID:10132
- C:\Windows\System\qcPCArD.exe
  C:\Windows\System\qcPCArD.exe
  2⤵
  PID:10152
- C:\Windows\System\agJOOTp.exe
  C:\Windows\System\agJOOTp.exe
  2⤵
  PID:10168
- C:\Windows\System\EtrNnzh.exe
  C:\Windows\System\EtrNnzh.exe
  2⤵
  PID:10184
- C:\Windows\System\pITmrdO.exe
  C:\Windows\System\pITmrdO.exe
  2⤵
  PID:10200
- C:\Windows\System\OFCAqUn.exe
  C:\Windows\System\OFCAqUn.exe
  2⤵
  PID:10216
- C:\Windows\System\aoYdfbE.exe
  C:\Windows\System\aoYdfbE.exe
  2⤵
  PID:10232
- C:\Windows\System\GcpWShO.exe
  C:\Windows\System\GcpWShO.exe
  2⤵
  PID:9228
- C:\Windows\System\qgyIFFo.exe
  C:\Windows\System\qgyIFFo.exe
  2⤵
  PID:8856
- C:\Windows\System\syPrNpq.exe
  C:\Windows\System\syPrNpq.exe
  2⤵
  PID:8604
- C:\Windows\System\HpWphXa.exe
  C:\Windows\System\HpWphXa.exe
  2⤵
  PID:7496
- C:\Windows\System\LmWLYdc.exe
  C:\Windows\System\LmWLYdc.exe
  2⤵
  PID:9128
- C:\Windows\System\qQuzgwF.exe
  C:\Windows\System\qQuzgwF.exe
  2⤵
  PID:9264
- C:\Windows\System\cxKhfVh.exe
  C:\Windows\System\cxKhfVh.exe
  2⤵
  PID:9304
- C:\Windows\System\JEWSsqb.exe
  C:\Windows\System\JEWSsqb.exe
  2⤵
  PID:9320
- C:\Windows\System\czZEknE.exe
  C:\Windows\System\czZEknE.exe
  2⤵
  PID:9336
- C:\Windows\System\aXHGOTA.exe
  C:\Windows\System\aXHGOTA.exe
  2⤵
  PID:9352
- C:\Windows\System\eevrAlS.exe
  C:\Windows\System\eevrAlS.exe
  2⤵
  PID:9368
- C:\Windows\System\ODyYzye.exe
  C:\Windows\System\ODyYzye.exe
  2⤵
  PID:9400
- C:\Windows\System\OlZwGWS.exe
  C:\Windows\System\OlZwGWS.exe
  2⤵
  PID:9560
- C:\Windows\System\rvwoZYy.exe
  C:\Windows\System\rvwoZYy.exe
  2⤵
  PID:9544
- C:\Windows\System\sDTvNWD.exe
  C:\Windows\System\sDTvNWD.exe
  2⤵
  PID:10080
- C:\Windows\System\hsojwBV.exe
  C:\Windows\System\hsojwBV.exe
  2⤵
  PID:10148
- C:\Windows\System\sNKyIAU.exe
  C:\Windows\System\sNKyIAU.exe
  2⤵
  PID:10160
- C:\Windows\System\ubKHEeF.exe
  C:\Windows\System\ubKHEeF.exe
  2⤵
  PID:10208
- C:\Windows\System\NbBQIhu.exe
  C:\Windows\System\NbBQIhu.exe
  2⤵
  PID:10228
- C:\Windows\System\qJJsMVd.exe
  C:\Windows\System\qJJsMVd.exe
  2⤵
  PID:8852
- C:\Windows\System\RrlIRYV.exe
  C:\Windows\System\RrlIRYV.exe
  2⤵
  PID:8948
- C:\Windows\System\vSYLFmX.exe
  C:\Windows\System\vSYLFmX.exe
  2⤵
  PID:9376
- C:\Windows\System\QmVlSse.exe
  C:\Windows\System\QmVlSse.exe
  2⤵
  PID:9316
- C:\Windows\System\mRPpwJy.exe
  C:\Windows\System\mRPpwJy.exe
  2⤵
  PID:9468
- C:\Windows\System\FvfElTy.exe
  C:\Windows\System\FvfElTy.exe
  2⤵
  PID:9384
- C:\Windows\System\IoNdqeb.exe
  C:\Windows\System\IoNdqeb.exe
  2⤵
  PID:9660
- C:\Windows\System\zMshgPQ.exe
  C:\Windows\System\zMshgPQ.exe
  2⤵
  PID:9676
- C:\Windows\System\OzlncMT.exe
  C:\Windows\System\OzlncMT.exe
  2⤵
  PID:9644
- C:\Windows\System\dPqqshB.exe
  C:\Windows\System\dPqqshB.exe
  2⤵
  PID:9688
- C:\Windows\System\vGcBIme.exe
  C:\Windows\System\vGcBIme.exe
  2⤵
  PID:9720
- C:\Windows\System\qkpBlwO.exe
  C:\Windows\System\qkpBlwO.exe
  2⤵
  PID:9768
- C:\Windows\System\wwIxcNx.exe
  C:\Windows\System\wwIxcNx.exe
  2⤵
  PID:9820
- C:\Windows\System\GPNPDfZ.exe
  C:\Windows\System\GPNPDfZ.exe
  2⤵
  PID:9852
- C:\Windows\System\plEDrLZ.exe
  C:\Windows\System\plEDrLZ.exe
  2⤵
  PID:9884
- C:\Windows\System\plXsCyM.exe
  C:\Windows\System\plXsCyM.exe
  2⤵
  PID:9916
- C:\Windows\System\XVfJtah.exe
  C:\Windows\System\XVfJtah.exe
  2⤵
  PID:9984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\JXDImIo.exe

Filesize
1.5MB

MD5
49ee7bccbb5b6ac9fab4987f6dab877d

SHA1
3b02ca4ee6c32136ca8e590c6aa01784beeb8dca

SHA256
6ecb26cf90410cde8a6097050e3cb9413570a64396f9a884024d41df0d0b2638

SHA512
0745668519916193adad69ec97b58b0c18cc2fc2eda9321e84dbdec6fcf9de022444dc06a13a6c12078ea23f4d442ead9aaa430af9ad1d2d6f78751d50ae2513

Download Submit
C:\Windows\system\JpmJONj.exe

Filesize
1.5MB

MD5
ab261c9239ef3d8b46ce4b2569494ee6

SHA1
383f77072e8206a46ea259aa1d7033ee25630a97

SHA256
112bff6d5d3e7bf7bbc96ff7f2afa791c369900d81c4b6bb658d0727c2c57154

SHA512
b1790799bbbd3204f69262e96cdb230da759e901c7328d128fdf1c39c84b7b18e7f0cc41216fc92de2c6711afc1ec3aba9599a514201fd14fbc85a0c1a93194a

Download Submit
C:\Windows\system\KrysZRh.exe

Filesize
1.5MB

MD5
20780a681ce3a56b2815deda5f52bc30

SHA1
44bdb55e3e9bc4f2051ea53f04542e00f4ba6289

SHA256
b67531d4c3c7522f3f54de3f4e889c44b98a206f0443eb7c275e78a113d9ca04

SHA512
addfc62ae3242d1fbbc485b1a369b0f4a8aebd297b0b9725e5c2143e2f3aa3dd068c201fd6832a8a1267228b2e826ce9e4a78dd186d7a3d3e55c50e7045881c2

Download Submit
C:\Windows\system\LbmjPPt.exe

Filesize
1.5MB

MD5
a843e4ad853a76387f4c42a7329be8a6

SHA1
6bb737bd872419852ea5bd4f016b362468ad35b1

SHA256
1f5d8fe4967254c4fa150d5c033b1e7f8d021150e21c1fa94cc557d032e0e0d4

SHA512
20d40550289df58ee8c41ab3ab82002dbd105fce634287214d687a51e1a627de23c522156a3874590b5d673f2567ab3c0c94c9dfebbee7def3d7f8c6446717ed

Download Submit
C:\Windows\system\LlwLIEy.exe

Filesize
1.5MB

MD5
b2bc16d5c7d6c8232cb0ef38f7678bf8

SHA1
363e8ace17d363fa8646a8dfd4cd4dd6a1bc0577

SHA256
a4dbf909835ae6bfe093852ebc7cc60cf51afddf69a5396cc1574a255a879183

SHA512
ec45d52deb0ece0322633e8bb54c8688d1d8cd2942f52b5fc9e65568f560364ddedbee61b4b73a721cd9674a002b0ca67477a4c2e8b47248da73cd8ee8c7734d

Download Submit
C:\Windows\system\OtNhIYM.exe

Filesize
1.5MB

MD5
dd568f686fd9605710bedba811c79a3a

SHA1
cc84136be5d83ec7c6def553bd37348f33860435

SHA256
d0ebee28a1f20c6fd5f0864e47555b21c137484a83da6078642589ba2c284ad9

SHA512
86bdea47e3727e9f02b4c8b11ac5f06e524714e65d168f5a984e103f6e83efdd7e70d6365fb2933e5b6331e9329958b42bf17575fc282f15eb75ac33abbacb7b

Download Submit
C:\Windows\system\RssHfKd.exe

Filesize
1.5MB

MD5
38aa4aa418a0428f7b68e20f962f9d69

SHA1
9e6b54362f7c09fbbe7e65505e13f31bcbf5ba12

SHA256
171945ba8361751720df6b31eb04b5804c140d96693d7a480a26bd57044a6e13

SHA512
632bee75f72d1f8039eae430ef1dd4215c3aef58e1650474d1fa562174052e541fa02c2da069786772fda2670d9cc0458a07db1f3ca7f649dab049572703b125

Download Submit
C:\Windows\system\SUQivNr.exe

Filesize
1.5MB

MD5
dd9104d84d829464e1c211f0193892ed

SHA1
c984efac140a88cf6c6e03132c29267b651215d8

SHA256
35068fd39ced9707bc4ec2dc52934b11530da48f50e8f806fa55133b1dc32ad6

SHA512
a4722a3253021bf3d8a2a61e30e87769bf542cc63a3288481b078db3639f51e42759d464c3e3fb36d32c9b4bd4d48f272d5d277afd60cedae57178b65ef6168e

Download Submit
C:\Windows\system\TetHWjX.exe

Filesize
1.5MB

MD5
7e1b921ee9a3498b32aa7f06ab6cc497

SHA1
e3e25a2b064747ee4e441580178b6c8d062efdd1

SHA256
b34a8e48c13e2417e6b07891d14eda06a7918574796e232505bf6d154eb0c8f7

SHA512
c26ae73090ef43059a5e570290d83ac64168cc50b576b65c11281e5f98c2fb8fd687e10a24f2ba1d774677adc52c922b808b2002bcadb8329bbf9e32029d6042

Download Submit
C:\Windows\system\TiwxeQy.exe

Filesize
1.5MB

MD5
c5c7ce69fdff8006f2b78ce5ae9754ad

SHA1
8e00bcec2e924501fc75147dbc386b3fc1307029

SHA256
c5a66a56799ddfb0fe393fd68913ea5ac4fa3604c338be294577643fdb7c7491

SHA512
a7c526308fa522e159408ac5699c46801949626f3469e9ad8d93721bbeafda5734121446bc83162fb58acdf05c555b77302d8165e0175cb4f3944013edc52c88

Download Submit
C:\Windows\system\WwCJMpW.exe

Filesize
1.5MB

MD5
f3f8d4bf324ae46a55124ec54972259b

SHA1
c6b11b498b2211b7980c47c5002a59d9b5a136ff

SHA256
f521d6142604252f1081763104b2cdd2a03d5011d44db7b7fe2a0f9bf4065009

SHA512
bb95c8350a17763f2f51a2672e9a25fb2c72b1e0b5b83ae41f062a6090e96e2c6b4c7efca252cc8b5cf02bd378d28d60d2f2b8c7299ae27a1ad0f857379436a6

Download Submit
C:\Windows\system\YvwPJrU.exe

Filesize
1.5MB

MD5
2f86f1fb34b8390152d5f990965892b5

SHA1
8c5b03f5201229fd3c0c078383620a27eec48cd0

SHA256
35afa1eb4e8f9a7c707f0e36c40ad8e83b541be6799d5894ee664fa09b129346

SHA512
e707577adc4a240f5bc27dd4c40ab9a7bcd4b76ab80e0c749130e49f369bf04fe5d96abc2176b0d265439d23a75ee323dd21e3688c92856a282d46cd122c78d8

Download Submit
C:\Windows\system\aLXCEVx.exe

Filesize
1.5MB

MD5
8e64f46c553201f390c5e5e579161a34

SHA1
5e9df6cb318e8a5eb3f56dc782db6b783146f647

SHA256
fcc65b3085231afeb915c723c6b581da75a67c6d1d48c21d883ff1c21d2dd79b

SHA512
deaf97203669ece8907fe55fa23802323befe60f26a03ff76eb0a8fadccc37f4cd00cb9df89af913ce1f159c2ef890971a7ecfd554ffa2828b18c7eea87bb610

Download Submit
C:\Windows\system\jDWhIkH.exe

Filesize
1.5MB

MD5
0e525b20f814dcdd78686107acea1edf

SHA1
7bb5b2977ab90a2a83480809e3099c118d8b08c8

SHA256
6a1a5ad3525cac421d08ebd5a000c27e7e835a24d8e0db2b53e1f75833944470

SHA512
ec733527a9eb4aa398ef4a387c213685c884924435d039b618c95f463aaf3bff81b86859c0838b9cca1c0947117a252c891e09a749c528ef6dbd5241998dc629

Download Submit
C:\Windows\system\jaEgMVv.exe

Filesize
1.5MB

MD5
b0817b0a85345feed9a2dd10f390c8ad

SHA1
8aa66e95fc2561fcb777dec38b9fc907ced1b3ed

SHA256
2ea7a8b8708af219acae980764fa18fee8d828a7d0345868fd67af7db5527a03

SHA512
c3ac0dff7cb0fcbc072aa2e49c7dfdaee0775978c37848e30faacda563dee87d257d60130322fe4a7aa93154b3fd8fd7a71e1e52626deb796dccefce76f3b5f6

Download Submit
C:\Windows\system\lGkcDZX.exe

Filesize
1.5MB

MD5
c3f572cea7bba10048c4a81bfdfb7f50

SHA1
0d42b1036a491112fd1d9ef8ddcbaf92586a2a71

SHA256
2af13efddeac175568f51dd09282a786b9403b5f713c28b75e63b466fece8172

SHA512
8408eb5d6247d96deda704d63d6b6d70b198211c365548829f7f18bee571adb4ed4848a83cdf90d773dd2661d9dcc5a1a0416d1eea3d0428b67d280a2dbcc4f8

Download Submit
C:\Windows\system\oJZzsyR.exe

Filesize
1.5MB

MD5
6da445a5847468096ec3ab18e81438cd

SHA1
857bee1af4becefe72883f934b94aa4b16199eab

SHA256
6455a88f47a3b1538f2875855c938851469a7d5f3b7c7425ff9280c77fefa2dc

SHA512
3d66e040d2da178731e8c043a0faf3bd0ee8a4525510fe425b34897380ec3ef8a2142dc2ae0125b4d9466b626987cc2e16967f3367e949c93133d8c0ef4fbfaa

Download Submit
C:\Windows\system\ouXtFdG.exe

Filesize
1.5MB

MD5
9d0c36061e7e3a864e8319211db5a087

SHA1
ddfb33a83d1a9f35e7acf96ac2de0da4aa7e7938

SHA256
01da57c98878525395278fd7320b8fbac854b3708ce3f4a020cb0ca9f41a21d6

SHA512
12f1787b7173350430974b9b8ae629f7af98e7e9fdf6a70dc7d862795f08eee2e60de0e1ffa773bc6536923402f53f36848ae7e22c0f1c7495064c80b31357c1

Download Submit
C:\Windows\system\pEdoUnv.exe

Filesize
1.5MB

MD5
0429a066f50fbce92d45056b8a9446cc

SHA1
67cdaf0c42e2590641da5038e0403df2a7b6b97f

SHA256
5ed9eb0160709ddddf39e78f3ff14b83fc6c9ec72fb2bff522cfa4a857637b18

SHA512
491ebcb85b82600ed80c1005bb9962d718ea79fe710707b3a1abc9a96a53942ae61fe4e9299a311f56699a22ee9e4d4f4bd083697b1f1384d7f69101f3537840

Download Submit
C:\Windows\system\pJhbYRJ.exe

Filesize
1.5MB

MD5
f9fcc7542a912c0aa1c936c6a157df74

SHA1
9a6ffda452c40e292c8b9abd93ae5c865b61267e

SHA256
74dfe916a689b271f116ec0549a31d465fa276d0432c6921ffaf00a53acac4f4

SHA512
86ce830a92f64a745d779808d0870e85f065b6291319db7e1e552cd4ac181df855f56a30beeead8b387fb36e0499e5f90452a86ebdfb2205effa54dd06faaedd

Download Submit
C:\Windows\system\pKaqlai.exe

Filesize
1.5MB

MD5
b08017b8b14bbc74e05c15f0be734039

SHA1
319c198f47afb991f27155df27093a41526e0762

SHA256
c4220257c6eeec31500a36e9dfba03f1ed3445876a42dea0b2997139b8557410

SHA512
0a85ec35df399b22a32617a3f0962ff9bb02b455df3681e86bdb4837c30728e0471d28ed5c75eac12b6bad6250f3320871634a18c1c5dbb3642604d4e5c0ee7f

Download Submit
C:\Windows\system\pZcAqqf.exe

Filesize
1.5MB

MD5
4eb94cff1928ae0a34fadb14c720e279

SHA1
a56eb17eab068b28245647e7ee1b3348bf3936cc

SHA256
852ba62d0e33d7cc848aa8fdbbfa90c8df215519fe6a76c24a7e3847bb95e9a3

SHA512
1d2c7d6ab7a7bae75521b406a01034dd6f75fc69cc8bcc8e1bc409418ffe14227912cabb0661c2639eda92bafb5881802dd6c4436299c4bddddb1a661cd0eba0

Download Submit
C:\Windows\system\qiSQPWW.exe

Filesize
1.5MB

MD5
f1a3b6db8fb7624b84c961b614a06d12

SHA1
a7f2bf1a8a9dbd101b28653f35b2fe4610f7ee97

SHA256
06039b85cabf1e23c17f2f4dd676da8cdabec255e0753cdd0d660319a25c7fe6

SHA512
a2eeac1ef35e2ff35e4a7c1e91c8be1d250cc6e67e9a05150017d3613ed7f11fd519dd84f4355cb99041eb1d848f34dcf0cc6e2994db6da133a91cb3e9305e9d

Download Submit
C:\Windows\system\tYkGLBn.exe

Filesize
1.5MB

MD5
e0cd15b6d3f8962fb5328b6a84ce3780

SHA1
319e30c54ab1e10072c1a7090849995853f75507

SHA256
dc212b7b7f331cf8975618cc1c2037e7ed92946d8412bcf0b1d431fcfa28aabf

SHA512
8e0bac0be5c4979008702774accc2d68a9669887a0baf0c302f0064cccb3ea9e9894fb15f24b0eb775e392a37fa027564132573c22c7e30a82d926199d7e6dc7

Download Submit
C:\Windows\system\tvzAOLd.exe

Filesize
1.5MB

MD5
3a2d204898aac9938eb65f36fea3aeba

SHA1
aada86406bfaa6c5e70cb9f507d9614f2ae34a53

SHA256
657614d7458581504af8d2cfd54356bcbfe74731e141a72301db9ee9b768f455

SHA512
bccb69cf068de9ff38a665fc1a3bf055127364f22387c26d080c27eb150fedd99e7d90d007b6eeca798168a24a20467c6e369b1d510b91417916e1ba177a180d

Download Submit
C:\Windows\system\uSSUcWb.exe

Filesize
1.5MB

MD5
36a4a4baea14e815e6ebc8f24c65fcc2

SHA1
d7f48d1cd30b37a8093bbc68dfc99ea913812bc9

SHA256
591dcec7652c1b06508c367ba86f1d37d47e42496677f79d272d1a8e49348a8e

SHA512
6f4bee6d0d1646f0a81f88b8a6e92088c26b69bd97ba4fc0710c13837763445257685293f26fbeb3fd7b503eb5dcb6cd4fa8081c4949b7aae56bf3744876f280

Download Submit
C:\Windows\system\wnCAeGZ.exe

Filesize
1.5MB

MD5
9034c36cb16512d6e079ebee97be079a

SHA1
774c6696d226ee5ee69828d34095c2126a025cfc

SHA256
fab2d90c0b71d00eae0580a5cab5899205d9ed2df84a0f64cd29b1e99d3119eb

SHA512
6d6dc3e11907987f525b0fefee75451b105469977aec1562703b8d39c87dfc88cc188bc870e8ab85e0900d8c44981603b4f2ca42e753afaf734e76cebf65e811

Download Submit
C:\Windows\system\xCBQgFG.exe

Filesize
1.5MB

MD5
227bbe5120ada8f139e788d53c092f7b

SHA1
19dd805c4e2e0cf7b97175040cfdb4162a2410ce

SHA256
2f7e429c6f03d42dfe22c9b7cfcc8a7f44c0a9420bdc208a1cbaed07a13af854

SHA512
66074961945f9bf5deeb5ec3f968993703d10d07b9b277e67a0b7a91a2f8da1e99a3d19a83f0b6b0bec49ea29bd7ccd9074049f43a087e38f22ec52abd0bfc9b

Download Submit
C:\Windows\system\xDWASdY.exe

Filesize
1.5MB

MD5
d0c67a9aba0c67e100862e0476601be3

SHA1
b12e5f357e598cdf837ad2daad69bb30da227560

SHA256
889a39043eaf70d07e2e6ac359543230fab5350ed564f4283cf63cf106c999be

SHA512
1b855c236e58a45b7f4409391d33ff0cb5d48ac1340587bc1020a54d1939f43643ef1bf1957fe62019ead3e4f757dc75764f633c6e82e555884a47b4d2419926

Download Submit
C:\Windows\system\zEdYobi.exe

Filesize
1.5MB

MD5
88c24447c2f3f7977af219a8f10184ca

SHA1
baa96d5eff39228fc0534e61d30b3a66adc690ee

SHA256
979c8897733d26e733e9054c5fe4ae921352002692dd1eacbf6dea57bc0740a6

SHA512
b5a85051d8ebdc0f1c872f1f7c99f1a9a05fe872c8ef17cbdfd409d3761faf6edbf625aa5d0ef74cab379a682fae29aec16ec67cdd27c388773a014622caed95

Download Submit
C:\Windows\system\zFKzNaY.exe

Filesize
1.5MB

MD5
86fd8d8565e945678dff2322368e59b2

SHA1
df7ef9a6aa44a684dc3c3d528eaeb006d326d9dc

SHA256
b13c9984c214583b28e37c28b79ba13d056ba17927e8d7c0e824b07e7bd1f4ae

SHA512
5bf572a170fe131f820e33c895c4f8fba21f253c96a281ad475dd590ffb947b04bbf5103f544c302024ed7fca64a55441ae66e38cbd0cbb30c853f74bc83be01

Download Submit
\Windows\system\GdIESJd.exe

Filesize
1.5MB

MD5
2c2ed7e5244d4059e6cfe0eb6cc10444

SHA1
dd009ef8e1c48aa511b78ddca39ea548711a0cd2

SHA256
98c185a3f3b71df2026efd171738b61e45d7ac2026b783acc1c8f5fb2344182d

SHA512
9c1f1f241a0e9780129f1edefa0fbaa45541b04b64344943106bbc5097aa2685b6b0c51d7e847a1bda88be22933dd64c8599a310e47502efb7edce995e0073af

Download Submit
memory/1096-943-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/1096-4060-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/1956-4053-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/1956-941-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2028-945-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/2028-4052-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/2052-4058-0x000000013FA40000-0x000000013FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2052-939-0x000000013FA40000-0x000000013FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2060-4059-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2060-947-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2172-953-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download
memory/2172-4055-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Filesize
3.3MB

Download
memory/2356-956-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4047-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/2356-942-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-944-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-946-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2356-948-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2356-950-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-964-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/2356-952-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-954-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-936-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-0-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2356-940-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-958-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/2356-932-0x000000013FE40000-0x0000000140194000-memory.dmp

Filesize
3.3MB

Download
memory/2356-960-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4048-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/2356-962-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4035-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4036-0x000000013FE40000-0x0000000140194000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4037-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4038-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4039-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4040-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4043-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4042-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4041-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4045-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4044-0x0000000001ED0000-0x0000000002224000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4046-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4049-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2356-4050-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/2456-4064-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/2456-951-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Filesize
3.3MB

Download
memory/2528-965-0x000000013FE40000-0x0000000140194000-memory.dmp

Filesize
3.3MB

Download
memory/2528-4051-0x000000013FE40000-0x0000000140194000-memory.dmp

Filesize
3.3MB

Download
memory/2780-961-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/2780-4054-0x000000013FEC0000-0x0000000140214000-memory.dmp

Filesize
3.3MB

Download
memory/2792-955-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2792-4061-0x000000013FC00000-0x000000013FF54000-memory.dmp

Filesize
3.3MB

Download
memory/2820-957-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2820-4056-0x000000013F2B0000-0x000000013F604000-memory.dmp

Filesize
3.3MB

Download
memory/2940-4062-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2940-963-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/2944-4063-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/2944-959-0x000000013FDA0000-0x00000001400F4000-memory.dmp

Filesize
3.3MB

Download
memory/3044-4057-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/3044-949-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download