xmrig | 3be37de983205eb7124c8b77d3ce7c06104f75e9922668128c1c93db70d605c8

Analysis

max time kernel
47s
max time network
48s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
Size

1.8MB
MD5

00d175378c9889449b980aa3ee3d8b8c
SHA1

5bf2d2d1584fd237584580bb0583e67a94bee31e
SHA256

3be37de983205eb7124c8b77d3ce7c06104f75e9922668128c1c93db70d605c8
SHA512

d9fa8bf77cede5eb845a27fa2340ba111f9c0ab0a2c00b81e4b762af459f52640c1a6bc41b47a178c95b29b03ad51ccbe20bddea989ca0f2964ec9744e26a890
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlS:NABB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2832-8-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2276-33-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/1848-230-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/3040-227-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/3068-253-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2744-251-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2748-248-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2572-244-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/3028-225-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2804-214-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/1720-1779-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2832-1858-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2660-3564-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2820-3704-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2832-3733-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2660-3799-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/3028-4009-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/2804-4011-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/1848-4010-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/3068-4018-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2744-4017-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2748-4013-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/3040-4057-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2832	mvwYEgf.exe
2660	ggrTwaT.exe
2820	ThsWicY.exe
2276	uEsruAx.exe
2804	iWmERYE.exe
3068	MZmBrMp.exe
3028	JUAWOjZ.exe
3040	KnTILoh.exe
1848	bqCRDUC.exe
2572	pNiQqBG.exe
2748	Mwumrnw.exe
2744	ChiHXvi.exe
2708	IvOrpcR.exe
1492	aEPJvJQ.exe
2876	BCtDhzb.exe
996	bGRRWfl.exe
744	VGAdvTA.exe
1780	xIHcFXL.exe
1728	YLwjHBR.exe
1616	fuRZtLJ.exe
2864	zXlITwb.exe
1368	XJkaJCH.exe
2888	BKMOAdx.exe
1412	NSAqaNs.exe
824	GGMyPBt.exe
3052	kWlDJLp.exe
2896	GnCmmMO.exe
2608	sCoUkkV.exe
2008	CzHufZq.exe
2916	ZqGCdOR.exe
2452	WVTKjGv.exe
528	QuWCSYU.exe
548	JAxgtnM.exe
1400	zVjNhQn.exe
1408	TNhXkRq.exe
1396	JSwATOe.exe
676	HWteBYX.exe
2884	AaAcCcb.exe
1884	lSQxwMw.exe
1104	vmKVxbX.exe
1464	nogJbcB.exe
1304	urJoIdb.exe
1776	xpvaJbR.exe
1644	sspiaKC.exe
348	wLFzeCs.exe
2196	xvbZnWn.exe
2020	VFrgmIx.exe
1896	OiGtAUq.exe
1912	uVrMGpe.exe
2956	oYZKYPD.exe
2160	UQBGzMC.exe
2108	SbIjMaW.exe
1088	WfIqJnW.exe
1456	CXrEDwC.exe
1508	uibFuUP.exe
2636	AezHKph.exe
2112	JlkUlkV.exe
1632	kLwaZHy.exe
2236	fhjKbHJ.exe
2760	UWeWaKK.exe
2524	cIXLbfX.exe
2656	WtKFQkF.exe
2168	IZPTUnT.exe
2532	xwjIRAy.exe

Loads dropped DLL 64 IoCs

pid	Process
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2832-8-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/files/0x002f000000015a15-12.dat	upx
behavioral1/memory/2276-33-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x0007000000015ca9-35.dat	upx
behavioral1/files/0x0007000000015cc2-34.dat	upx
behavioral1/files/0x0007000000015c9b-24.dat	upx
behavioral1/memory/2820-22-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2660-19-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x0008000000015c91-18.dat	upx
behavioral1/files/0x000b00000001226e-6.dat	upx
behavioral1/memory/1720-1-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0008000000016228-57.dat	upx
behavioral1/files/0x000600000001650f-65.dat	upx
behavioral1/files/0x0006000000016c3a-81.dat	upx
behavioral1/files/0x0006000000016c57-85.dat	upx
behavioral1/files/0x0006000000016cf2-101.dat	upx
behavioral1/files/0x0006000000016d2d-121.dat	upx
behavioral1/files/0x0006000000016d73-149.dat	upx
behavioral1/memory/1848-230-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/3040-227-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/3068-253-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2744-251-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2748-248-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2572-244-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/3028-225-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/2804-214-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0006000000016d5f-145.dat	upx
behavioral1/files/0x0006000000016d57-141.dat	upx
behavioral1/files/0x0006000000016d4f-137.dat	upx
behavioral1/files/0x0006000000016d46-133.dat	upx
behavioral1/files/0x0006000000016d3e-129.dat	upx
behavioral1/files/0x0006000000016d36-125.dat	upx
behavioral1/files/0x0006000000016d21-117.dat	upx
behavioral1/files/0x0006000000016d19-113.dat	upx
behavioral1/files/0x0006000000016d10-109.dat	upx
behavioral1/files/0x0006000000016d01-105.dat	upx
behavioral1/files/0x0006000000016ccd-97.dat	upx
behavioral1/files/0x0006000000016ca1-93.dat	upx
behavioral1/files/0x0006000000016c5b-89.dat	upx
behavioral1/files/0x0006000000016a3a-77.dat	upx
behavioral1/files/0x00060000000167e8-73.dat	upx
behavioral1/files/0x0006000000016591-69.dat	upx
behavioral1/files/0x000600000001640f-61.dat	upx
behavioral1/files/0x0008000000015cca-54.dat	upx
behavioral1/files/0x00130000000054a8-50.dat	upx
behavioral1/memory/1720-1779-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2832-1858-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2660-3564-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2820-3704-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2832-3733-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2660-3799-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/3028-4009-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/2804-4011-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/1848-4010-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/3068-4018-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2744-4017-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2748-4013-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/3040-4057-0x000000013F070000-0x000000013F462000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EfZHnhQ.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\Omxdscx.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\tiIIlCp.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\zzMqmVr.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\PPIsGVo.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\hAEHtVj.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\aqPLsaK.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\gpLMeeB.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\vSwKKhJ.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\xwjIRAy.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\yPdRNek.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\uFaZyAP.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\YEfNAfQ.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\kqCMfTy.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\SbIjMaW.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\paBPGwl.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\OBsfGAb.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\HLqETcE.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\CGqrutO.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\KUxUOTN.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ZDGbehn.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\MEOHstC.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\IQqjWmy.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\hVMuIOV.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\VLLPppL.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\IdfxQJT.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\gRvdxUt.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\AAlAeVc.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\hooxGCW.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\jHSWYgZ.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\THRliRd.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\mWRtICH.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\gFpVJlX.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\ZqGCdOR.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\IunJGaV.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\bZJGXTI.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\OhWHKKb.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\iuMDZvd.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\iouaqcx.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\DEXgMtt.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\tOGHaLn.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\sspiaKC.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\WnMRnvs.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\TsfAHHG.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\YczjIdz.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\VlPzFgO.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\bhSVbTI.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\aEPkBCC.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\RmwFFKl.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\EMcjNbG.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\YvhVFau.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\XVXFTKO.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\VhtwTxx.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\bvWBOVC.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\SDASyEM.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\iSsyzcu.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\oYEeiVR.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\pnGnyXv.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\BCtDhzb.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\cZjcnHL.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\vMoeSPR.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\dZHVkDe.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\oxsLSiK.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
File created	C:\Windows\System\sxqiGeo.exe	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1952	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
Token: SeDebugPrivilege	1952	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1952	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	29
PID 1720 wrote to memory of 1952	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	29
PID 1720 wrote to memory of 1952	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	29
PID 1720 wrote to memory of 2832	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	30
PID 1720 wrote to memory of 2832	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	30
PID 1720 wrote to memory of 2832	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	30
PID 1720 wrote to memory of 2660	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2660	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2660	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	31
PID 1720 wrote to memory of 2820	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	32
PID 1720 wrote to memory of 2820	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	32
PID 1720 wrote to memory of 2820	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	32
PID 1720 wrote to memory of 2276	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	33
PID 1720 wrote to memory of 2276	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	33
PID 1720 wrote to memory of 2276	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	33
PID 1720 wrote to memory of 2804	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	34
PID 1720 wrote to memory of 2804	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	34
PID 1720 wrote to memory of 2804	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	34
PID 1720 wrote to memory of 3068	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	35
PID 1720 wrote to memory of 3068	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	35
PID 1720 wrote to memory of 3068	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	35
PID 1720 wrote to memory of 3028	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	36
PID 1720 wrote to memory of 3028	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	36
PID 1720 wrote to memory of 3028	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	36
PID 1720 wrote to memory of 3040	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	37
PID 1720 wrote to memory of 3040	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	37
PID 1720 wrote to memory of 3040	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	37
PID 1720 wrote to memory of 1848	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	38
PID 1720 wrote to memory of 1848	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	38
PID 1720 wrote to memory of 1848	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	38
PID 1720 wrote to memory of 2572	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	39
PID 1720 wrote to memory of 2572	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	39
PID 1720 wrote to memory of 2572	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	39
PID 1720 wrote to memory of 2748	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	40
PID 1720 wrote to memory of 2748	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	40
PID 1720 wrote to memory of 2748	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	40
PID 1720 wrote to memory of 2744	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	41
PID 1720 wrote to memory of 2744	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	41
PID 1720 wrote to memory of 2744	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	41
PID 1720 wrote to memory of 2708	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	42
PID 1720 wrote to memory of 2708	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	42
PID 1720 wrote to memory of 2708	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	42
PID 1720 wrote to memory of 1492	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	43
PID 1720 wrote to memory of 1492	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	43
PID 1720 wrote to memory of 1492	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	43
PID 1720 wrote to memory of 2876	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	44
PID 1720 wrote to memory of 2876	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	44
PID 1720 wrote to memory of 2876	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	44
PID 1720 wrote to memory of 996	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	45
PID 1720 wrote to memory of 996	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	45
PID 1720 wrote to memory of 996	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	45
PID 1720 wrote to memory of 744	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	46
PID 1720 wrote to memory of 744	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	46
PID 1720 wrote to memory of 744	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	46
PID 1720 wrote to memory of 1780	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	47
PID 1720 wrote to memory of 1780	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	47
PID 1720 wrote to memory of 1780	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	47
PID 1720 wrote to memory of 1728	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	48
PID 1720 wrote to memory of 1728	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	48
PID 1720 wrote to memory of 1728	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	48
PID 1720 wrote to memory of 1616	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	49
PID 1720 wrote to memory of 1616	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	49
PID 1720 wrote to memory of 1616	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	49
PID 1720 wrote to memory of 2864	1720	00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00d175378c9889449b980aa3ee3d8b8c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\System\mvwYEgf.exe
  C:\Windows\System\mvwYEgf.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ggrTwaT.exe
  C:\Windows\System\ggrTwaT.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ThsWicY.exe
  C:\Windows\System\ThsWicY.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\uEsruAx.exe
  C:\Windows\System\uEsruAx.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\iWmERYE.exe
  C:\Windows\System\iWmERYE.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\MZmBrMp.exe
  C:\Windows\System\MZmBrMp.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\JUAWOjZ.exe
  C:\Windows\System\JUAWOjZ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\KnTILoh.exe
  C:\Windows\System\KnTILoh.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\bqCRDUC.exe
  C:\Windows\System\bqCRDUC.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\pNiQqBG.exe
  C:\Windows\System\pNiQqBG.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\Mwumrnw.exe
  C:\Windows\System\Mwumrnw.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ChiHXvi.exe
  C:\Windows\System\ChiHXvi.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\IvOrpcR.exe
  C:\Windows\System\IvOrpcR.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\aEPJvJQ.exe
  C:\Windows\System\aEPJvJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\BCtDhzb.exe
  C:\Windows\System\BCtDhzb.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\bGRRWfl.exe
  C:\Windows\System\bGRRWfl.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\VGAdvTA.exe
  C:\Windows\System\VGAdvTA.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\xIHcFXL.exe
  C:\Windows\System\xIHcFXL.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\YLwjHBR.exe
  C:\Windows\System\YLwjHBR.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\fuRZtLJ.exe
  C:\Windows\System\fuRZtLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\zXlITwb.exe
  C:\Windows\System\zXlITwb.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\XJkaJCH.exe
  C:\Windows\System\XJkaJCH.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\BKMOAdx.exe
  C:\Windows\System\BKMOAdx.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\NSAqaNs.exe
  C:\Windows\System\NSAqaNs.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\GGMyPBt.exe
  C:\Windows\System\GGMyPBt.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\kWlDJLp.exe
  C:\Windows\System\kWlDJLp.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\GnCmmMO.exe
  C:\Windows\System\GnCmmMO.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\sCoUkkV.exe
  C:\Windows\System\sCoUkkV.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\CzHufZq.exe
  C:\Windows\System\CzHufZq.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\ZqGCdOR.exe
  C:\Windows\System\ZqGCdOR.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\WVTKjGv.exe
  C:\Windows\System\WVTKjGv.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\QuWCSYU.exe
  C:\Windows\System\QuWCSYU.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\JAxgtnM.exe
  C:\Windows\System\JAxgtnM.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\zVjNhQn.exe
  C:\Windows\System\zVjNhQn.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\TNhXkRq.exe
  C:\Windows\System\TNhXkRq.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\JSwATOe.exe
  C:\Windows\System\JSwATOe.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\HWteBYX.exe
  C:\Windows\System\HWteBYX.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\AaAcCcb.exe
  C:\Windows\System\AaAcCcb.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\lSQxwMw.exe
  C:\Windows\System\lSQxwMw.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\vmKVxbX.exe
  C:\Windows\System\vmKVxbX.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\nogJbcB.exe
  C:\Windows\System\nogJbcB.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\urJoIdb.exe
  C:\Windows\System\urJoIdb.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\xpvaJbR.exe
  C:\Windows\System\xpvaJbR.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\sspiaKC.exe
  C:\Windows\System\sspiaKC.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\wLFzeCs.exe
  C:\Windows\System\wLFzeCs.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\uVrMGpe.exe
  C:\Windows\System\uVrMGpe.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\xvbZnWn.exe
  C:\Windows\System\xvbZnWn.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\oYZKYPD.exe
  C:\Windows\System\oYZKYPD.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\VFrgmIx.exe
  C:\Windows\System\VFrgmIx.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\SbIjMaW.exe
  C:\Windows\System\SbIjMaW.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\OiGtAUq.exe
  C:\Windows\System\OiGtAUq.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\WfIqJnW.exe
  C:\Windows\System\WfIqJnW.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\UQBGzMC.exe
  C:\Windows\System\UQBGzMC.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\CXrEDwC.exe
  C:\Windows\System\CXrEDwC.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\uibFuUP.exe
  C:\Windows\System\uibFuUP.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\AezHKph.exe
  C:\Windows\System\AezHKph.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\JlkUlkV.exe
  C:\Windows\System\JlkUlkV.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\kLwaZHy.exe
  C:\Windows\System\kLwaZHy.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\fhjKbHJ.exe
  C:\Windows\System\fhjKbHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\UWeWaKK.exe
  C:\Windows\System\UWeWaKK.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\cIXLbfX.exe
  C:\Windows\System\cIXLbfX.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\WtKFQkF.exe
  C:\Windows\System\WtKFQkF.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\IZPTUnT.exe
  C:\Windows\System\IZPTUnT.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\xwjIRAy.exe
  C:\Windows\System\xwjIRAy.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\omZHkCm.exe
  C:\Windows\System\omZHkCm.exe
  2⤵
  PID:2632
- C:\Windows\System\fOwGgRd.exe
  C:\Windows\System\fOwGgRd.exe
  2⤵
  PID:2868
- C:\Windows\System\bxnlrtN.exe
  C:\Windows\System\bxnlrtN.exe
  2⤵
  PID:1856
- C:\Windows\System\eVlMFXD.exe
  C:\Windows\System\eVlMFXD.exe
  2⤵
  PID:1476
- C:\Windows\System\pFLlKdr.exe
  C:\Windows\System\pFLlKdr.exe
  2⤵
  PID:1664
- C:\Windows\System\BEOuTIG.exe
  C:\Windows\System\BEOuTIG.exe
  2⤵
  PID:1548
- C:\Windows\System\xMWrGzY.exe
  C:\Windows\System\xMWrGzY.exe
  2⤵
  PID:1436
- C:\Windows\System\MvQZOrt.exe
  C:\Windows\System\MvQZOrt.exe
  2⤵
  PID:2932
- C:\Windows\System\mkbalZq.exe
  C:\Windows\System\mkbalZq.exe
  2⤵
  PID:2012
- C:\Windows\System\OdiuApD.exe
  C:\Windows\System\OdiuApD.exe
  2⤵
  PID:2488
- C:\Windows\System\shoAUkj.exe
  C:\Windows\System\shoAUkj.exe
  2⤵
  PID:568
- C:\Windows\System\ZfAFNcW.exe
  C:\Windows\System\ZfAFNcW.exe
  2⤵
  PID:2292
- C:\Windows\System\yPdRNek.exe
  C:\Windows\System\yPdRNek.exe
  2⤵
  PID:1704
- C:\Windows\System\VAMwECe.exe
  C:\Windows\System\VAMwECe.exe
  2⤵
  PID:940
- C:\Windows\System\ZrnkBTG.exe
  C:\Windows\System\ZrnkBTG.exe
  2⤵
  PID:2712
- C:\Windows\System\TmvPCxQ.exe
  C:\Windows\System\TmvPCxQ.exe
  2⤵
  PID:2188
- C:\Windows\System\AbfFyjp.exe
  C:\Windows\System\AbfFyjp.exe
  2⤵
  PID:1552
- C:\Windows\System\XKvmMdz.exe
  C:\Windows\System\XKvmMdz.exe
  2⤵
  PID:1312
- C:\Windows\System\ICfPinb.exe
  C:\Windows\System\ICfPinb.exe
  2⤵
  PID:1976
- C:\Windows\System\PrVghFa.exe
  C:\Windows\System\PrVghFa.exe
  2⤵
  PID:680
- C:\Windows\System\jGjKGbn.exe
  C:\Windows\System\jGjKGbn.exe
  2⤵
  PID:2280
- C:\Windows\System\nFgMkfC.exe
  C:\Windows\System\nFgMkfC.exe
  2⤵
  PID:1936
- C:\Windows\System\cZjcnHL.exe
  C:\Windows\System\cZjcnHL.exe
  2⤵
  PID:2156
- C:\Windows\System\lbSiwXW.exe
  C:\Windows\System\lbSiwXW.exe
  2⤵
  PID:1236
- C:\Windows\System\EnHdVTQ.exe
  C:\Windows\System\EnHdVTQ.exe
  2⤵
  PID:1184
- C:\Windows\System\gkvlDUG.exe
  C:\Windows\System\gkvlDUG.exe
  2⤵
  PID:760
- C:\Windows\System\lXjMzhX.exe
  C:\Windows\System\lXjMzhX.exe
  2⤵
  PID:2144
- C:\Windows\System\SIUoqGF.exe
  C:\Windows\System\SIUoqGF.exe
  2⤵
  PID:2216
- C:\Windows\System\Cjxbehn.exe
  C:\Windows\System\Cjxbehn.exe
  2⤵
  PID:1684
- C:\Windows\System\fFOCloR.exe
  C:\Windows\System\fFOCloR.exe
  2⤵
  PID:1888
- C:\Windows\System\XBDbezT.exe
  C:\Windows\System\XBDbezT.exe
  2⤵
  PID:920
- C:\Windows\System\ZCUigJl.exe
  C:\Windows\System\ZCUigJl.exe
  2⤵
  PID:2680
- C:\Windows\System\kGTGNVo.exe
  C:\Windows\System\kGTGNVo.exe
  2⤵
  PID:2584
- C:\Windows\System\hCOgtPb.exe
  C:\Windows\System\hCOgtPb.exe
  2⤵
  PID:1520
- C:\Windows\System\eUiCBjt.exe
  C:\Windows\System\eUiCBjt.exe
  2⤵
  PID:1608
- C:\Windows\System\nBODtUp.exe
  C:\Windows\System\nBODtUp.exe
  2⤵
  PID:2296
- C:\Windows\System\bnZFAwa.exe
  C:\Windows\System\bnZFAwa.exe
  2⤵
  PID:1140
- C:\Windows\System\MCLpJHi.exe
  C:\Windows\System\MCLpJHi.exe
  2⤵
  PID:2060
- C:\Windows\System\VLLPppL.exe
  C:\Windows\System\VLLPppL.exe
  2⤵
  PID:2248
- C:\Windows\System\EqlWjfF.exe
  C:\Windows\System\EqlWjfF.exe
  2⤵
  PID:2340
- C:\Windows\System\jfIQCfl.exe
  C:\Windows\System\jfIQCfl.exe
  2⤵
  PID:2768
- C:\Windows\System\BwQQEYt.exe
  C:\Windows\System\BwQQEYt.exe
  2⤵
  PID:2552
- C:\Windows\System\ycdGMfs.exe
  C:\Windows\System\ycdGMfs.exe
  2⤵
  PID:2652
- C:\Windows\System\rDhOBwm.exe
  C:\Windows\System\rDhOBwm.exe
  2⤵
  PID:2792
- C:\Windows\System\NbWtGAB.exe
  C:\Windows\System\NbWtGAB.exe
  2⤵
  PID:2428
- C:\Windows\System\FmHwgcP.exe
  C:\Windows\System\FmHwgcP.exe
  2⤵
  PID:1828
- C:\Windows\System\fraFCxX.exe
  C:\Windows\System\fraFCxX.exe
  2⤵
  PID:1528
- C:\Windows\System\UVPujTT.exe
  C:\Windows\System\UVPujTT.exe
  2⤵
  PID:3048
- C:\Windows\System\XdCjwDX.exe
  C:\Windows\System\XdCjwDX.exe
  2⤵
  PID:2036
- C:\Windows\System\foUlPgs.exe
  C:\Windows\System\foUlPgs.exe
  2⤵
  PID:444
- C:\Windows\System\uYihiOu.exe
  C:\Windows\System\uYihiOu.exe
  2⤵
  PID:832
- C:\Windows\System\TCocPUB.exe
  C:\Windows\System\TCocPUB.exe
  2⤵
  PID:2976
- C:\Windows\System\lVbasiG.exe
  C:\Windows\System\lVbasiG.exe
  2⤵
  PID:1668
- C:\Windows\System\TGsaEQq.exe
  C:\Windows\System\TGsaEQq.exe
  2⤵
  PID:1840
- C:\Windows\System\wLVULHw.exe
  C:\Windows\System\wLVULHw.exe
  2⤵
  PID:1844
- C:\Windows\System\ovjjgoZ.exe
  C:\Windows\System\ovjjgoZ.exe
  2⤵
  PID:2724
- C:\Windows\System\ImeYQkf.exe
  C:\Windows\System\ImeYQkf.exe
  2⤵
  PID:2016
- C:\Windows\System\JStaemb.exe
  C:\Windows\System\JStaemb.exe
  2⤵
  PID:736
- C:\Windows\System\XdgupTz.exe
  C:\Windows\System\XdgupTz.exe
  2⤵
  PID:236
- C:\Windows\System\KgYbIaJ.exe
  C:\Windows\System\KgYbIaJ.exe
  2⤵
  PID:2104
- C:\Windows\System\jElQBsO.exe
  C:\Windows\System\jElQBsO.exe
  2⤵
  PID:2384
- C:\Windows\System\jZUudcB.exe
  C:\Windows\System\jZUudcB.exe
  2⤵
  PID:2316
- C:\Windows\System\DzTTxLF.exe
  C:\Windows\System\DzTTxLF.exe
  2⤵
  PID:2376
- C:\Windows\System\DaZdxDH.exe
  C:\Windows\System\DaZdxDH.exe
  2⤵
  PID:1084
- C:\Windows\System\yKccPEP.exe
  C:\Windows\System\yKccPEP.exe
  2⤵
  PID:1872
- C:\Windows\System\wCARUoT.exe
  C:\Windows\System\wCARUoT.exe
  2⤵
  PID:296
- C:\Windows\System\tQBIYKb.exe
  C:\Windows\System\tQBIYKb.exe
  2⤵
  PID:2140
- C:\Windows\System\BCOzqlT.exe
  C:\Windows\System\BCOzqlT.exe
  2⤵
  PID:1428
- C:\Windows\System\qznZGMm.exe
  C:\Windows\System\qznZGMm.exe
  2⤵
  PID:2928
- C:\Windows\System\XjZiILy.exe
  C:\Windows\System\XjZiILy.exe
  2⤵
  PID:1660
- C:\Windows\System\pmwqUqu.exe
  C:\Windows\System\pmwqUqu.exe
  2⤵
  PID:1568
- C:\Windows\System\oHAixkp.exe
  C:\Windows\System\oHAixkp.exe
  2⤵
  PID:1452
- C:\Windows\System\FTBeFJJ.exe
  C:\Windows\System\FTBeFJJ.exe
  2⤵
  PID:2472
- C:\Windows\System\NQHxPSt.exe
  C:\Windows\System\NQHxPSt.exe
  2⤵
  PID:300
- C:\Windows\System\BelyVby.exe
  C:\Windows\System\BelyVby.exe
  2⤵
  PID:1264
- C:\Windows\System\gbOVBjm.exe
  C:\Windows\System\gbOVBjm.exe
  2⤵
  PID:2468
- C:\Windows\System\tuXjIcs.exe
  C:\Windows\System\tuXjIcs.exe
  2⤵
  PID:1900
- C:\Windows\System\vFuNKHf.exe
  C:\Windows\System\vFuNKHf.exe
  2⤵
  PID:2424
- C:\Windows\System\wGvnzKD.exe
  C:\Windows\System\wGvnzKD.exe
  2⤵
  PID:1692
- C:\Windows\System\wRYdWVw.exe
  C:\Windows\System\wRYdWVw.exe
  2⤵
  PID:2940
- C:\Windows\System\wSDDqVQ.exe
  C:\Windows\System\wSDDqVQ.exe
  2⤵
  PID:2568
- C:\Windows\System\KIQUXkP.exe
  C:\Windows\System\KIQUXkP.exe
  2⤵
  PID:2780
- C:\Windows\System\iocnjOJ.exe
  C:\Windows\System\iocnjOJ.exe
  2⤵
  PID:2752
- C:\Windows\System\GsaSOpS.exe
  C:\Windows\System\GsaSOpS.exe
  2⤵
  PID:1592
- C:\Windows\System\doUtgYv.exe
  C:\Windows\System\doUtgYv.exe
  2⤵
  PID:2484
- C:\Windows\System\DPFVjPI.exe
  C:\Windows\System\DPFVjPI.exe
  2⤵
  PID:2492
- C:\Windows\System\HWbNJof.exe
  C:\Windows\System\HWbNJof.exe
  2⤵
  PID:2404
- C:\Windows\System\kvXuVPZ.exe
  C:\Windows\System\kvXuVPZ.exe
  2⤵
  PID:2824
- C:\Windows\System\zGbZcpy.exe
  C:\Windows\System\zGbZcpy.exe
  2⤵
  PID:480
- C:\Windows\System\vMjsdVv.exe
  C:\Windows\System\vMjsdVv.exe
  2⤵
  PID:2064
- C:\Windows\System\GtamfIZ.exe
  C:\Windows\System\GtamfIZ.exe
  2⤵
  PID:1716
- C:\Windows\System\jTJypzP.exe
  C:\Windows\System\jTJypzP.exe
  2⤵
  PID:2540
- C:\Windows\System\TfwFAvN.exe
  C:\Windows\System\TfwFAvN.exe
  2⤵
  PID:1496
- C:\Windows\System\UNmZzfB.exe
  C:\Windows\System\UNmZzfB.exe
  2⤵
  PID:2268
- C:\Windows\System\NWTyiHn.exe
  C:\Windows\System\NWTyiHn.exe
  2⤵
  PID:1560
- C:\Windows\System\ksquSCS.exe
  C:\Windows\System\ksquSCS.exe
  2⤵
  PID:1532
- C:\Windows\System\kUZmKWj.exe
  C:\Windows\System\kUZmKWj.exe
  2⤵
  PID:1572
- C:\Windows\System\pmDUpIA.exe
  C:\Windows\System\pmDUpIA.exe
  2⤵
  PID:2644
- C:\Windows\System\KLpxWdB.exe
  C:\Windows\System\KLpxWdB.exe
  2⤵
  PID:2576
- C:\Windows\System\IdfxQJT.exe
  C:\Windows\System\IdfxQJT.exe
  2⤵
  PID:2664
- C:\Windows\System\huFvahu.exe
  C:\Windows\System\huFvahu.exe
  2⤵
  PID:2720
- C:\Windows\System\DMMIpmL.exe
  C:\Windows\System\DMMIpmL.exe
  2⤵
  PID:1576
- C:\Windows\System\BFXLICo.exe
  C:\Windows\System\BFXLICo.exe
  2⤵
  PID:2180
- C:\Windows\System\LhpDiAY.exe
  C:\Windows\System\LhpDiAY.exe
  2⤵
  PID:3036
- C:\Windows\System\WSYQHUn.exe
  C:\Windows\System\WSYQHUn.exe
  2⤵
  PID:2516
- C:\Windows\System\kYpEsDL.exe
  C:\Windows\System\kYpEsDL.exe
  2⤵
  PID:2948
- C:\Windows\System\QmZWaMs.exe
  C:\Windows\System\QmZWaMs.exe
  2⤵
  PID:2544
- C:\Windows\System\VjSvaVF.exe
  C:\Windows\System\VjSvaVF.exe
  2⤵
  PID:2368
- C:\Windows\System\vJJTBaD.exe
  C:\Windows\System\vJJTBaD.exe
  2⤵
  PID:1212
- C:\Windows\System\bjXnDqP.exe
  C:\Windows\System\bjXnDqP.exe
  2⤵
  PID:900
- C:\Windows\System\MQFXHsa.exe
  C:\Windows\System\MQFXHsa.exe
  2⤵
  PID:1820
- C:\Windows\System\bOuyJtj.exe
  C:\Windows\System\bOuyJtj.exe
  2⤵
  PID:1672
- C:\Windows\System\UGeAMNT.exe
  C:\Windows\System\UGeAMNT.exe
  2⤵
  PID:768
- C:\Windows\System\ldLcOAK.exe
  C:\Windows\System\ldLcOAK.exe
  2⤵
  PID:2416
- C:\Windows\System\DdNVQyy.exe
  C:\Windows\System\DdNVQyy.exe
  2⤵
  PID:1100
- C:\Windows\System\EqhdzAu.exe
  C:\Windows\System\EqhdzAu.exe
  2⤵
  PID:3084
- C:\Windows\System\soCXUlD.exe
  C:\Windows\System\soCXUlD.exe
  2⤵
  PID:3104
- C:\Windows\System\ZaNlKTF.exe
  C:\Windows\System\ZaNlKTF.exe
  2⤵
  PID:3120
- C:\Windows\System\HsTShBc.exe
  C:\Windows\System\HsTShBc.exe
  2⤵
  PID:3136
- C:\Windows\System\FORnlAm.exe
  C:\Windows\System\FORnlAm.exe
  2⤵
  PID:3152
- C:\Windows\System\VlgaJYk.exe
  C:\Windows\System\VlgaJYk.exe
  2⤵
  PID:3220
- C:\Windows\System\toVjmSQ.exe
  C:\Windows\System\toVjmSQ.exe
  2⤵
  PID:3240
- C:\Windows\System\YtaSwpK.exe
  C:\Windows\System\YtaSwpK.exe
  2⤵
  PID:3264
- C:\Windows\System\PojKNAe.exe
  C:\Windows\System\PojKNAe.exe
  2⤵
  PID:3284
- C:\Windows\System\HrOanua.exe
  C:\Windows\System\HrOanua.exe
  2⤵
  PID:3300
- C:\Windows\System\gKPuooA.exe
  C:\Windows\System\gKPuooA.exe
  2⤵
  PID:3316
- C:\Windows\System\TuUNgmN.exe
  C:\Windows\System\TuUNgmN.exe
  2⤵
  PID:3332
- C:\Windows\System\WSyPJLc.exe
  C:\Windows\System\WSyPJLc.exe
  2⤵
  PID:3348
- C:\Windows\System\XvrIrpr.exe
  C:\Windows\System\XvrIrpr.exe
  2⤵
  PID:3364
- C:\Windows\System\XyLUUpC.exe
  C:\Windows\System\XyLUUpC.exe
  2⤵
  PID:3380
- C:\Windows\System\lCtgtxN.exe
  C:\Windows\System\lCtgtxN.exe
  2⤵
  PID:3400
- C:\Windows\System\oERckVm.exe
  C:\Windows\System\oERckVm.exe
  2⤵
  PID:3420
- C:\Windows\System\oMKCjzS.exe
  C:\Windows\System\oMKCjzS.exe
  2⤵
  PID:3436
- C:\Windows\System\YjWtvpV.exe
  C:\Windows\System\YjWtvpV.exe
  2⤵
  PID:3452
- C:\Windows\System\wImjIsi.exe
  C:\Windows\System\wImjIsi.exe
  2⤵
  PID:3468
- C:\Windows\System\OJePTJW.exe
  C:\Windows\System\OJePTJW.exe
  2⤵
  PID:3488
- C:\Windows\System\wjzXDcv.exe
  C:\Windows\System\wjzXDcv.exe
  2⤵
  PID:3504
- C:\Windows\System\mJHHsQU.exe
  C:\Windows\System\mJHHsQU.exe
  2⤵
  PID:3520
- C:\Windows\System\UpEkRuV.exe
  C:\Windows\System\UpEkRuV.exe
  2⤵
  PID:3536
- C:\Windows\System\GoNozhs.exe
  C:\Windows\System\GoNozhs.exe
  2⤵
  PID:3552
- C:\Windows\System\eQIWLTs.exe
  C:\Windows\System\eQIWLTs.exe
  2⤵
  PID:3572
- C:\Windows\System\BgJoeSW.exe
  C:\Windows\System\BgJoeSW.exe
  2⤵
  PID:3588
- C:\Windows\System\HxGAegr.exe
  C:\Windows\System\HxGAegr.exe
  2⤵
  PID:3604
- C:\Windows\System\ffXrSpA.exe
  C:\Windows\System\ffXrSpA.exe
  2⤵
  PID:3620
- C:\Windows\System\blbfFfu.exe
  C:\Windows\System\blbfFfu.exe
  2⤵
  PID:3636
- C:\Windows\System\bMdvdsM.exe
  C:\Windows\System\bMdvdsM.exe
  2⤵
  PID:3652
- C:\Windows\System\qIEIhiv.exe
  C:\Windows\System\qIEIhiv.exe
  2⤵
  PID:3668
- C:\Windows\System\ZbHpsxB.exe
  C:\Windows\System\ZbHpsxB.exe
  2⤵
  PID:3684
- C:\Windows\System\RVvEHGQ.exe
  C:\Windows\System\RVvEHGQ.exe
  2⤵
  PID:3704
- C:\Windows\System\xVfgliM.exe
  C:\Windows\System\xVfgliM.exe
  2⤵
  PID:3720
- C:\Windows\System\NcgjYnC.exe
  C:\Windows\System\NcgjYnC.exe
  2⤵
  PID:3736
- C:\Windows\System\Eyraaso.exe
  C:\Windows\System\Eyraaso.exe
  2⤵
  PID:3752
- C:\Windows\System\UFwRVZK.exe
  C:\Windows\System\UFwRVZK.exe
  2⤵
  PID:3772
- C:\Windows\System\PLinLIB.exe
  C:\Windows\System\PLinLIB.exe
  2⤵
  PID:3788
- C:\Windows\System\NqEwjAA.exe
  C:\Windows\System\NqEwjAA.exe
  2⤵
  PID:3804
- C:\Windows\System\kPyWCDg.exe
  C:\Windows\System\kPyWCDg.exe
  2⤵
  PID:3820
- C:\Windows\System\XRXiqVj.exe
  C:\Windows\System\XRXiqVj.exe
  2⤵
  PID:3952
- C:\Windows\System\MXTpOwe.exe
  C:\Windows\System\MXTpOwe.exe
  2⤵
  PID:3968
- C:\Windows\System\BYYAAiA.exe
  C:\Windows\System\BYYAAiA.exe
  2⤵
  PID:3988
- C:\Windows\System\hSFWQNj.exe
  C:\Windows\System\hSFWQNj.exe
  2⤵
  PID:4004
- C:\Windows\System\bsNZljN.exe
  C:\Windows\System\bsNZljN.exe
  2⤵
  PID:4020
- C:\Windows\System\qlPrAdd.exe
  C:\Windows\System\qlPrAdd.exe
  2⤵
  PID:4036
- C:\Windows\System\VsbMSsW.exe
  C:\Windows\System\VsbMSsW.exe
  2⤵
  PID:4052
- C:\Windows\System\tKmuNub.exe
  C:\Windows\System\tKmuNub.exe
  2⤵
  PID:4068
- C:\Windows\System\AlLeQPm.exe
  C:\Windows\System\AlLeQPm.exe
  2⤵
  PID:4084
- C:\Windows\System\qfcJLEn.exe
  C:\Windows\System\qfcJLEn.exe
  2⤵
  PID:2684
- C:\Windows\System\sUMpgFc.exe
  C:\Windows\System\sUMpgFc.exe
  2⤵
  PID:1624
- C:\Windows\System\APdEzGk.exe
  C:\Windows\System\APdEzGk.exe
  2⤵
  PID:3112
- C:\Windows\System\kzoPqsM.exe
  C:\Windows\System\kzoPqsM.exe
  2⤵
  PID:2716
- C:\Windows\System\GTwxwsq.exe
  C:\Windows\System\GTwxwsq.exe
  2⤵
  PID:3148
- C:\Windows\System\gUgiQOz.exe
  C:\Windows\System\gUgiQOz.exe
  2⤵
  PID:1524
- C:\Windows\System\jRDnwhH.exe
  C:\Windows\System\jRDnwhH.exe
  2⤵
  PID:3228
- C:\Windows\System\OfreAuu.exe
  C:\Windows\System\OfreAuu.exe
  2⤵
  PID:3216
- C:\Windows\System\cGYDwHC.exe
  C:\Windows\System\cGYDwHC.exe
  2⤵
  PID:2084
- C:\Windows\System\humXBhj.exe
  C:\Windows\System\humXBhj.exe
  2⤵
  PID:3092
- C:\Windows\System\TFhKyEE.exe
  C:\Windows\System\TFhKyEE.exe
  2⤵
  PID:3276
- C:\Windows\System\xQmbNaP.exe
  C:\Windows\System\xQmbNaP.exe
  2⤵
  PID:3184
- C:\Windows\System\lplmoNe.exe
  C:\Windows\System\lplmoNe.exe
  2⤵
  PID:3200
- C:\Windows\System\tNWaZGb.exe
  C:\Windows\System\tNWaZGb.exe
  2⤵
  PID:3248
- C:\Windows\System\dPHcBHe.exe
  C:\Windows\System\dPHcBHe.exe
  2⤵
  PID:3256
- C:\Windows\System\xzxQUqU.exe
  C:\Windows\System\xzxQUqU.exe
  2⤵
  PID:3356
- C:\Windows\System\NXDLnuP.exe
  C:\Windows\System\NXDLnuP.exe
  2⤵
  PID:3392
- C:\Windows\System\dCuJdiP.exe
  C:\Windows\System\dCuJdiP.exe
  2⤵
  PID:3676
- C:\Windows\System\shqLaGs.exe
  C:\Windows\System\shqLaGs.exe
  2⤵
  PID:3396
- C:\Windows\System\HhHaXSU.exe
  C:\Windows\System\HhHaXSU.exe
  2⤵
  PID:3376
- C:\Windows\System\hhrPdTG.exe
  C:\Windows\System\hhrPdTG.exe
  2⤵
  PID:3416
- C:\Windows\System\vMoeSPR.exe
  C:\Windows\System\vMoeSPR.exe
  2⤵
  PID:3480
- C:\Windows\System\EEWvfau.exe
  C:\Windows\System\EEWvfau.exe
  2⤵
  PID:3584
- C:\Windows\System\liCTVVT.exe
  C:\Windows\System\liCTVVT.exe
  2⤵
  PID:3716
- C:\Windows\System\NMuXsDZ.exe
  C:\Windows\System\NMuXsDZ.exe
  2⤵
  PID:3500
- C:\Windows\System\NqdKNJQ.exe
  C:\Windows\System\NqdKNJQ.exe
  2⤵
  PID:3692
- C:\Windows\System\UBFpsou.exe
  C:\Windows\System\UBFpsou.exe
  2⤵
  PID:3856
- C:\Windows\System\bKyaQxe.exe
  C:\Windows\System\bKyaQxe.exe
  2⤵
  PID:3876
- C:\Windows\System\TccAzjx.exe
  C:\Windows\System\TccAzjx.exe
  2⤵
  PID:3896
- C:\Windows\System\ejkTFVw.exe
  C:\Windows\System\ejkTFVw.exe
  2⤵
  PID:3916
- C:\Windows\System\DonTsJg.exe
  C:\Windows\System\DonTsJg.exe
  2⤵
  PID:3936
- C:\Windows\System\UpXzjAm.exe
  C:\Windows\System\UpXzjAm.exe
  2⤵
  PID:3940
- C:\Windows\System\dZHVkDe.exe
  C:\Windows\System\dZHVkDe.exe
  2⤵
  PID:3996
- C:\Windows\System\fIBOtFh.exe
  C:\Windows\System\fIBOtFh.exe
  2⤵
  PID:4060
- C:\Windows\System\hHDBAMg.exe
  C:\Windows\System\hHDBAMg.exe
  2⤵
  PID:4092
- C:\Windows\System\PYarLaL.exe
  C:\Windows\System\PYarLaL.exe
  2⤵
  PID:3192
- C:\Windows\System\omiSmsn.exe
  C:\Windows\System\omiSmsn.exe
  2⤵
  PID:4032
- C:\Windows\System\AgSWBvS.exe
  C:\Windows\System\AgSWBvS.exe
  2⤵
  PID:2184
- C:\Windows\System\YKBZuPx.exe
  C:\Windows\System\YKBZuPx.exe
  2⤵
  PID:2176
- C:\Windows\System\EVnYewQ.exe
  C:\Windows\System\EVnYewQ.exe
  2⤵
  PID:1696
- C:\Windows\System\CfNSMVg.exe
  C:\Windows\System\CfNSMVg.exe
  2⤵
  PID:3160
- C:\Windows\System\CanvfBK.exe
  C:\Windows\System\CanvfBK.exe
  2⤵
  PID:1652
- C:\Windows\System\EAJxluG.exe
  C:\Windows\System\EAJxluG.exe
  2⤵
  PID:1924
- C:\Windows\System\NKQBpvq.exe
  C:\Windows\System\NKQBpvq.exe
  2⤵
  PID:3172
- C:\Windows\System\aEwhrpO.exe
  C:\Windows\System\aEwhrpO.exe
  2⤵
  PID:3632
- C:\Windows\System\cwLsCbi.exe
  C:\Windows\System\cwLsCbi.exe
  2⤵
  PID:3328
- C:\Windows\System\IDtTIzq.exe
  C:\Windows\System\IDtTIzq.exe
  2⤵
  PID:3532
- C:\Windows\System\HdlPxZO.exe
  C:\Windows\System\HdlPxZO.exe
  2⤵
  PID:3372
- C:\Windows\System\MxZIAsH.exe
  C:\Windows\System\MxZIAsH.exe
  2⤵
  PID:3872
- C:\Windows\System\DblMcuA.exe
  C:\Windows\System\DblMcuA.exe
  2⤵
  PID:4012
- C:\Windows\System\aYGaDGI.exe
  C:\Windows\System\aYGaDGI.exe
  2⤵
  PID:3700
- C:\Windows\System\uZRSoJt.exe
  C:\Windows\System\uZRSoJt.exe
  2⤵
  PID:3252
- C:\Windows\System\QWQtAHX.exe
  C:\Windows\System\QWQtAHX.exe
  2⤵
  PID:3100
- C:\Windows\System\EfZHnhQ.exe
  C:\Windows\System\EfZHnhQ.exe
  2⤵
  PID:3476
- C:\Windows\System\JkMEJiz.exe
  C:\Windows\System\JkMEJiz.exe
  2⤵
  PID:3128
- C:\Windows\System\kXQssVW.exe
  C:\Windows\System\kXQssVW.exe
  2⤵
  PID:3444
- C:\Windows\System\NFgcvwD.exe
  C:\Windows\System\NFgcvwD.exe
  2⤵
  PID:3812
- C:\Windows\System\CXGYbYN.exe
  C:\Windows\System\CXGYbYN.exe
  2⤵
  PID:3132
- C:\Windows\System\vfUydxt.exe
  C:\Windows\System\vfUydxt.exe
  2⤵
  PID:3832
- C:\Windows\System\hNcOJGN.exe
  C:\Windows\System\hNcOJGN.exe
  2⤵
  PID:1072
- C:\Windows\System\BDuDLYP.exe
  C:\Windows\System\BDuDLYP.exe
  2⤵
  PID:3568
- C:\Windows\System\xdzYawD.exe
  C:\Windows\System\xdzYawD.exe
  2⤵
  PID:3728
- C:\Windows\System\dktgIBi.exe
  C:\Windows\System\dktgIBi.exe
  2⤵
  PID:3928
- C:\Windows\System\hLfxSiD.exe
  C:\Windows\System\hLfxSiD.exe
  2⤵
  PID:3292
- C:\Windows\System\QzqAfdu.exe
  C:\Windows\System\QzqAfdu.exe
  2⤵
  PID:3964
- C:\Windows\System\uFaZyAP.exe
  C:\Windows\System\uFaZyAP.exe
  2⤵
  PID:4076
- C:\Windows\System\WgnpRNs.exe
  C:\Windows\System\WgnpRNs.exe
  2⤵
  PID:3784
- C:\Windows\System\nwNLuoU.exe
  C:\Windows\System\nwNLuoU.exe
  2⤵
  PID:3344
- C:\Windows\System\hamCrSG.exe
  C:\Windows\System\hamCrSG.exe
  2⤵
  PID:3324
- C:\Windows\System\lEdLeRk.exe
  C:\Windows\System\lEdLeRk.exe
  2⤵
  PID:3932
- C:\Windows\System\xXFddQn.exe
  C:\Windows\System\xXFddQn.exe
  2⤵
  PID:3892
- C:\Windows\System\QngBaUp.exe
  C:\Windows\System\QngBaUp.exe
  2⤵
  PID:2972
- C:\Windows\System\VqiZSDf.exe
  C:\Windows\System\VqiZSDf.exe
  2⤵
  PID:3496
- C:\Windows\System\NdKFtab.exe
  C:\Windows\System\NdKFtab.exe
  2⤵
  PID:3612
- C:\Windows\System\MMaCDUt.exe
  C:\Windows\System\MMaCDUt.exe
  2⤵
  PID:3796
- C:\Windows\System\pXHUUmk.exe
  C:\Windows\System\pXHUUmk.exe
  2⤵
  PID:3800
- C:\Windows\System\uoFEuvO.exe
  C:\Windows\System\uoFEuvO.exe
  2⤵
  PID:3432
- C:\Windows\System\aNySasI.exe
  C:\Windows\System\aNySasI.exe
  2⤵
  PID:3768
- C:\Windows\System\RKNMkCh.exe
  C:\Windows\System\RKNMkCh.exe
  2⤵
  PID:4104
- C:\Windows\System\XpipwLW.exe
  C:\Windows\System\XpipwLW.exe
  2⤵
  PID:4124
- C:\Windows\System\CWlHtET.exe
  C:\Windows\System\CWlHtET.exe
  2⤵
  PID:4140
- C:\Windows\System\OuKDCjI.exe
  C:\Windows\System\OuKDCjI.exe
  2⤵
  PID:4156
- C:\Windows\System\JbiwqgK.exe
  C:\Windows\System\JbiwqgK.exe
  2⤵
  PID:4216
- C:\Windows\System\kuaMinK.exe
  C:\Windows\System\kuaMinK.exe
  2⤵
  PID:4232
- C:\Windows\System\kOYAoJl.exe
  C:\Windows\System\kOYAoJl.exe
  2⤵
  PID:4248
- C:\Windows\System\cegufLp.exe
  C:\Windows\System\cegufLp.exe
  2⤵
  PID:4264
- C:\Windows\System\QWGSezR.exe
  C:\Windows\System\QWGSezR.exe
  2⤵
  PID:4284
- C:\Windows\System\xTYtiug.exe
  C:\Windows\System\xTYtiug.exe
  2⤵
  PID:4304
- C:\Windows\System\BPeDGkl.exe
  C:\Windows\System\BPeDGkl.exe
  2⤵
  PID:4328
- C:\Windows\System\sELVrqK.exe
  C:\Windows\System\sELVrqK.exe
  2⤵
  PID:4348
- C:\Windows\System\TsjjPSl.exe
  C:\Windows\System\TsjjPSl.exe
  2⤵
  PID:4364
- C:\Windows\System\ARbtrQM.exe
  C:\Windows\System\ARbtrQM.exe
  2⤵
  PID:4384
- C:\Windows\System\FGArKqB.exe
  C:\Windows\System\FGArKqB.exe
  2⤵
  PID:4408
- C:\Windows\System\pHeDJuT.exe
  C:\Windows\System\pHeDJuT.exe
  2⤵
  PID:4432
- C:\Windows\System\BdroBQw.exe
  C:\Windows\System\BdroBQw.exe
  2⤵
  PID:4452
- C:\Windows\System\iYHMWib.exe
  C:\Windows\System\iYHMWib.exe
  2⤵
  PID:4472
- C:\Windows\System\dbZXuXG.exe
  C:\Windows\System\dbZXuXG.exe
  2⤵
  PID:4488
- C:\Windows\System\mhlrQBf.exe
  C:\Windows\System\mhlrQBf.exe
  2⤵
  PID:4508
- C:\Windows\System\yfaOZbO.exe
  C:\Windows\System\yfaOZbO.exe
  2⤵
  PID:4532
- C:\Windows\System\NPSBQra.exe
  C:\Windows\System\NPSBQra.exe
  2⤵
  PID:4552
- C:\Windows\System\wekJjYT.exe
  C:\Windows\System\wekJjYT.exe
  2⤵
  PID:4568
- C:\Windows\System\vuXIoRT.exe
  C:\Windows\System\vuXIoRT.exe
  2⤵
  PID:4584
- C:\Windows\System\yBNEnQo.exe
  C:\Windows\System\yBNEnQo.exe
  2⤵
  PID:4600
- C:\Windows\System\shVLkqO.exe
  C:\Windows\System\shVLkqO.exe
  2⤵
  PID:4620
- C:\Windows\System\HvBRXqo.exe
  C:\Windows\System\HvBRXqo.exe
  2⤵
  PID:4656
- C:\Windows\System\woYIOZP.exe
  C:\Windows\System\woYIOZP.exe
  2⤵
  PID:4672
- C:\Windows\System\iFBHEVH.exe
  C:\Windows\System\iFBHEVH.exe
  2⤵
  PID:4688
- C:\Windows\System\goRtOLB.exe
  C:\Windows\System\goRtOLB.exe
  2⤵
  PID:4704
- C:\Windows\System\GaNEpQI.exe
  C:\Windows\System\GaNEpQI.exe
  2⤵
  PID:4728
- C:\Windows\System\DXMdbde.exe
  C:\Windows\System\DXMdbde.exe
  2⤵
  PID:4744
- C:\Windows\System\eIjnmVy.exe
  C:\Windows\System\eIjnmVy.exe
  2⤵
  PID:4772
- C:\Windows\System\mNROSJk.exe
  C:\Windows\System\mNROSJk.exe
  2⤵
  PID:4792
- C:\Windows\System\SagvpJZ.exe
  C:\Windows\System\SagvpJZ.exe
  2⤵
  PID:4812
- C:\Windows\System\MTbHiEx.exe
  C:\Windows\System\MTbHiEx.exe
  2⤵
  PID:4828
- C:\Windows\System\ZWHvjRB.exe
  C:\Windows\System\ZWHvjRB.exe
  2⤵
  PID:4844
- C:\Windows\System\rnnxpwr.exe
  C:\Windows\System\rnnxpwr.exe
  2⤵
  PID:4864
- C:\Windows\System\YowQtIe.exe
  C:\Windows\System\YowQtIe.exe
  2⤵
  PID:4880
- C:\Windows\System\WnMRnvs.exe
  C:\Windows\System\WnMRnvs.exe
  2⤵
  PID:4900
- C:\Windows\System\CvWNCph.exe
  C:\Windows\System\CvWNCph.exe
  2⤵
  PID:4916
- C:\Windows\System\eEXeNWS.exe
  C:\Windows\System\eEXeNWS.exe
  2⤵
  PID:4936
- C:\Windows\System\ZBTFqEC.exe
  C:\Windows\System\ZBTFqEC.exe
  2⤵
  PID:4972
- C:\Windows\System\SXsxQxs.exe
  C:\Windows\System\SXsxQxs.exe
  2⤵
  PID:4988
- C:\Windows\System\Hzlmqhw.exe
  C:\Windows\System\Hzlmqhw.exe
  2⤵
  PID:5008
- C:\Windows\System\LXphbRf.exe
  C:\Windows\System\LXphbRf.exe
  2⤵
  PID:5024
- C:\Windows\System\qNDGCzN.exe
  C:\Windows\System\qNDGCzN.exe
  2⤵
  PID:5040
- C:\Windows\System\ahKQaWx.exe
  C:\Windows\System\ahKQaWx.exe
  2⤵
  PID:5060
- C:\Windows\System\JzlwgAE.exe
  C:\Windows\System\JzlwgAE.exe
  2⤵
  PID:5100
- C:\Windows\System\jEOUPfw.exe
  C:\Windows\System\jEOUPfw.exe
  2⤵
  PID:5116
- C:\Windows\System\uUUqElj.exe
  C:\Windows\System\uUUqElj.exe
  2⤵
  PID:4100
- C:\Windows\System\JCIIiSg.exe
  C:\Windows\System\JCIIiSg.exe
  2⤵
  PID:4136
- C:\Windows\System\yMwreic.exe
  C:\Windows\System\yMwreic.exe
  2⤵
  PID:3912
- C:\Windows\System\sHLSgDC.exe
  C:\Windows\System\sHLSgDC.exe
  2⤵
  PID:3204
- C:\Windows\System\lTnztpu.exe
  C:\Windows\System\lTnztpu.exe
  2⤵
  PID:4120
- C:\Windows\System\EnNTYmJ.exe
  C:\Windows\System\EnNTYmJ.exe
  2⤵
  PID:4172
- C:\Windows\System\SjMBOOV.exe
  C:\Windows\System\SjMBOOV.exe
  2⤵
  PID:3852
- C:\Windows\System\rfnnIOY.exe
  C:\Windows\System\rfnnIOY.exe
  2⤵
  PID:4204
- C:\Windows\System\KbMCCOz.exe
  C:\Windows\System\KbMCCOz.exe
  2⤵
  PID:4228
- C:\Windows\System\tqQZKKS.exe
  C:\Windows\System\tqQZKKS.exe
  2⤵
  PID:4276
- C:\Windows\System\POWGMhf.exe
  C:\Windows\System\POWGMhf.exe
  2⤵
  PID:4300
- C:\Windows\System\dntksOx.exe
  C:\Windows\System\dntksOx.exe
  2⤵
  PID:4340
- C:\Windows\System\qSQrMSK.exe
  C:\Windows\System\qSQrMSK.exe
  2⤵
  PID:4324
- C:\Windows\System\sYNDXnK.exe
  C:\Windows\System\sYNDXnK.exe
  2⤵
  PID:4420
- C:\Windows\System\RdADULK.exe
  C:\Windows\System\RdADULK.exe
  2⤵
  PID:4444
- C:\Windows\System\PdeebiI.exe
  C:\Windows\System\PdeebiI.exe
  2⤵
  PID:4468
- C:\Windows\System\OZpdkhW.exe
  C:\Windows\System\OZpdkhW.exe
  2⤵
  PID:4484
- C:\Windows\System\MnWrlWH.exe
  C:\Windows\System\MnWrlWH.exe
  2⤵
  PID:4524
- C:\Windows\System\bUQAWAt.exe
  C:\Windows\System\bUQAWAt.exe
  2⤵
  PID:4628
- C:\Windows\System\tIyVown.exe
  C:\Windows\System\tIyVown.exe
  2⤵
  PID:4648
- C:\Windows\System\wVwJrEk.exe
  C:\Windows\System\wVwJrEk.exe
  2⤵
  PID:2592
- C:\Windows\System\OEPndvp.exe
  C:\Windows\System\OEPndvp.exe
  2⤵
  PID:4712
- C:\Windows\System\ZtXArfW.exe
  C:\Windows\System\ZtXArfW.exe
  2⤵
  PID:4724
- C:\Windows\System\afVfrjG.exe
  C:\Windows\System\afVfrjG.exe
  2⤵
  PID:4736
- C:\Windows\System\obKVSRH.exe
  C:\Windows\System\obKVSRH.exe
  2⤵
  PID:4756
- C:\Windows\System\KnWqLXS.exe
  C:\Windows\System\KnWqLXS.exe
  2⤵
  PID:4800
- C:\Windows\System\XuXWWqQ.exe
  C:\Windows\System\XuXWWqQ.exe
  2⤵
  PID:4824
- C:\Windows\System\wasTsaM.exe
  C:\Windows\System\wasTsaM.exe
  2⤵
  PID:4876
- C:\Windows\System\cznbMXa.exe
  C:\Windows\System\cznbMXa.exe
  2⤵
  PID:4856
- C:\Windows\System\tnWuAgY.exe
  C:\Windows\System\tnWuAgY.exe
  2⤵
  PID:4896
- C:\Windows\System\jjbEwPn.exe
  C:\Windows\System\jjbEwPn.exe
  2⤵
  PID:4928
- C:\Windows\System\JLFxdpN.exe
  C:\Windows\System\JLFxdpN.exe
  2⤵
  PID:4964
- C:\Windows\System\RrbcefB.exe
  C:\Windows\System\RrbcefB.exe
  2⤵
  PID:5000
- C:\Windows\System\UzZjgVM.exe
  C:\Windows\System\UzZjgVM.exe
  2⤵
  PID:5020
- C:\Windows\System\FjcMCkd.exe
  C:\Windows\System\FjcMCkd.exe
  2⤵
  PID:5048
- C:\Windows\System\qaKlvXg.exe
  C:\Windows\System\qaKlvXg.exe
  2⤵
  PID:5076
- C:\Windows\System\ptwMTiD.exe
  C:\Windows\System\ptwMTiD.exe
  2⤵
  PID:5096
- C:\Windows\System\GbyLIsY.exe
  C:\Windows\System\GbyLIsY.exe
  2⤵
  PID:3448
- C:\Windows\System\HpiVGLe.exe
  C:\Windows\System\HpiVGLe.exe
  2⤵
  PID:4148
- C:\Windows\System\qcquKcw.exe
  C:\Windows\System\qcquKcw.exe
  2⤵
  PID:3600
- C:\Windows\System\QdRTEnX.exe
  C:\Windows\System\QdRTEnX.exe
  2⤵
  PID:4312
- C:\Windows\System\eTOsKtv.exe
  C:\Windows\System\eTOsKtv.exe
  2⤵
  PID:4292
- C:\Windows\System\iQExHxm.exe
  C:\Windows\System\iQExHxm.exe
  2⤵
  PID:4192
- C:\Windows\System\iyrohuD.exe
  C:\Windows\System\iyrohuD.exe
  2⤵
  PID:4380
- C:\Windows\System\IEeTavL.exe
  C:\Windows\System\IEeTavL.exe
  2⤵
  PID:4404
- C:\Windows\System\AaIVDJG.exe
  C:\Windows\System\AaIVDJG.exe
  2⤵
  PID:4440
- C:\Windows\System\IunJGaV.exe
  C:\Windows\System\IunJGaV.exe
  2⤵
  PID:4560
- C:\Windows\System\KLYRzSb.exe
  C:\Windows\System\KLYRzSb.exe
  2⤵
  PID:4516
- C:\Windows\System\gALYzmh.exe
  C:\Windows\System\gALYzmh.exe
  2⤵
  PID:4608
- C:\Windows\System\plikWdA.exe
  C:\Windows\System\plikWdA.exe
  2⤵
  PID:4640
- C:\Windows\System\mCmLrty.exe
  C:\Windows\System\mCmLrty.exe
  2⤵
  PID:4944
- C:\Windows\System\jaxHPyj.exe
  C:\Windows\System\jaxHPyj.exe
  2⤵
  PID:5004
- C:\Windows\System\wxrXFKO.exe
  C:\Windows\System\wxrXFKO.exe
  2⤵
  PID:4984
- C:\Windows\System\xSOnKDw.exe
  C:\Windows\System\xSOnKDw.exe
  2⤵
  PID:5052
- C:\Windows\System\GSpbzuW.exe
  C:\Windows\System\GSpbzuW.exe
  2⤵
  PID:4212
- C:\Windows\System\CYhAKcW.exe
  C:\Windows\System\CYhAKcW.exe
  2⤵
  PID:4132
- C:\Windows\System\sGtoGGU.exe
  C:\Windows\System\sGtoGGU.exe
  2⤵
  PID:4164
- C:\Windows\System\ucPNzFV.exe
  C:\Windows\System\ucPNzFV.exe
  2⤵
  PID:4256
- C:\Windows\System\kXNOvbM.exe
  C:\Windows\System\kXNOvbM.exe
  2⤵
  PID:4684
- C:\Windows\System\JmyZvrk.exe
  C:\Windows\System\JmyZvrk.exe
  2⤵
  PID:4788
- C:\Windows\System\ApXOsAc.exe
  C:\Windows\System\ApXOsAc.exe
  2⤵
  PID:4892
- C:\Windows\System\BcHDVRD.exe
  C:\Windows\System\BcHDVRD.exe
  2⤵
  PID:5068
- C:\Windows\System\RjFXKJw.exe
  C:\Windows\System\RjFXKJw.exe
  2⤵
  PID:4636
- C:\Windows\System\fIwPkUq.exe
  C:\Windows\System\fIwPkUq.exe
  2⤵
  PID:4396
- C:\Windows\System\EfWprUX.exe
  C:\Windows\System\EfWprUX.exe
  2⤵
  PID:4592
- C:\Windows\System\TJyAzKP.exe
  C:\Windows\System\TJyAzKP.exe
  2⤵
  PID:4112
- C:\Windows\System\TsfAHHG.exe
  C:\Windows\System\TsfAHHG.exe
  2⤵
  PID:4980
- C:\Windows\System\CfOTIZv.exe
  C:\Windows\System\CfOTIZv.exe
  2⤵
  PID:3780
- C:\Windows\System\IojkIif.exe
  C:\Windows\System\IojkIif.exe
  2⤵
  PID:4852
- C:\Windows\System\pysgdrr.exe
  C:\Windows\System\pysgdrr.exe
  2⤵
  PID:4416
- C:\Windows\System\rITvGwj.exe
  C:\Windows\System\rITvGwj.exe
  2⤵
  PID:4760
- C:\Windows\System\rOdmuRt.exe
  C:\Windows\System\rOdmuRt.exe
  2⤵
  PID:5112
- C:\Windows\System\bZbwIdN.exe
  C:\Windows\System\bZbwIdN.exe
  2⤵
  PID:4960
- C:\Windows\System\pTCkBZT.exe
  C:\Windows\System\pTCkBZT.exe
  2⤵
  PID:5092
- C:\Windows\System\YLIncwa.exe
  C:\Windows\System\YLIncwa.exe
  2⤵
  PID:4948
- C:\Windows\System\dxPFOsX.exe
  C:\Windows\System\dxPFOsX.exe
  2⤵
  PID:4576
- C:\Windows\System\mPqatuT.exe
  C:\Windows\System\mPqatuT.exe
  2⤵
  PID:4840
- C:\Windows\System\vBuAPrF.exe
  C:\Windows\System\vBuAPrF.exe
  2⤵
  PID:4768
- C:\Windows\System\BazQLvu.exe
  C:\Windows\System\BazQLvu.exe
  2⤵
  PID:4664
- C:\Windows\System\cygnKyH.exe
  C:\Windows\System\cygnKyH.exe
  2⤵
  PID:5128
- C:\Windows\System\FWAFNdX.exe
  C:\Windows\System\FWAFNdX.exe
  2⤵
  PID:5144
- C:\Windows\System\IBbNihi.exe
  C:\Windows\System\IBbNihi.exe
  2⤵
  PID:5160
- C:\Windows\System\rQFtOIQ.exe
  C:\Windows\System\rQFtOIQ.exe
  2⤵
  PID:5176
- C:\Windows\System\xrbfDDb.exe
  C:\Windows\System\xrbfDDb.exe
  2⤵
  PID:5196
- C:\Windows\System\KHCSFxc.exe
  C:\Windows\System\KHCSFxc.exe
  2⤵
  PID:5212
- C:\Windows\System\PccDOZe.exe
  C:\Windows\System\PccDOZe.exe
  2⤵
  PID:5228
- C:\Windows\System\oxsLSiK.exe
  C:\Windows\System\oxsLSiK.exe
  2⤵
  PID:5244
- C:\Windows\System\dvwlkqN.exe
  C:\Windows\System\dvwlkqN.exe
  2⤵
  PID:5260
- C:\Windows\System\Uxsljms.exe
  C:\Windows\System\Uxsljms.exe
  2⤵
  PID:5280
- C:\Windows\System\TKBNxrd.exe
  C:\Windows\System\TKBNxrd.exe
  2⤵
  PID:5296
- C:\Windows\System\uPOQQCc.exe
  C:\Windows\System\uPOQQCc.exe
  2⤵
  PID:5312
- C:\Windows\System\zjxzCzC.exe
  C:\Windows\System\zjxzCzC.exe
  2⤵
  PID:5328
- C:\Windows\System\FTIbqsz.exe
  C:\Windows\System\FTIbqsz.exe
  2⤵
  PID:5352
- C:\Windows\System\bZJGXTI.exe
  C:\Windows\System\bZJGXTI.exe
  2⤵
  PID:5368
- C:\Windows\System\wOzFxEZ.exe
  C:\Windows\System\wOzFxEZ.exe
  2⤵
  PID:5384
- C:\Windows\System\mNWeIRX.exe
  C:\Windows\System\mNWeIRX.exe
  2⤵
  PID:5400
- C:\Windows\System\cYiuceu.exe
  C:\Windows\System\cYiuceu.exe
  2⤵
  PID:5416
- C:\Windows\System\uKGwGPr.exe
  C:\Windows\System\uKGwGPr.exe
  2⤵
  PID:5436
- C:\Windows\System\tCIBTyR.exe
  C:\Windows\System\tCIBTyR.exe
  2⤵
  PID:5452
- C:\Windows\System\kjDDLrs.exe
  C:\Windows\System\kjDDLrs.exe
  2⤵
  PID:5468
- C:\Windows\System\EHvfXtN.exe
  C:\Windows\System\EHvfXtN.exe
  2⤵
  PID:5484
- C:\Windows\System\cPMtGkG.exe
  C:\Windows\System\cPMtGkG.exe
  2⤵
  PID:5500
- C:\Windows\System\Dmrsmmf.exe
  C:\Windows\System\Dmrsmmf.exe
  2⤵
  PID:5516
- C:\Windows\System\JPBFggT.exe
  C:\Windows\System\JPBFggT.exe
  2⤵
  PID:5532
- C:\Windows\System\cAbmrzF.exe
  C:\Windows\System\cAbmrzF.exe
  2⤵
  PID:5548
- C:\Windows\System\HTkVsHm.exe
  C:\Windows\System\HTkVsHm.exe
  2⤵
  PID:5564
- C:\Windows\System\QvSgJmV.exe
  C:\Windows\System\QvSgJmV.exe
  2⤵
  PID:5584
- C:\Windows\System\fSSougX.exe
  C:\Windows\System\fSSougX.exe
  2⤵
  PID:5600
- C:\Windows\System\gVUVLIv.exe
  C:\Windows\System\gVUVLIv.exe
  2⤵
  PID:5756
- C:\Windows\System\mDjurpf.exe
  C:\Windows\System\mDjurpf.exe
  2⤵
  PID:5772
- C:\Windows\System\pJGRnGy.exe
  C:\Windows\System\pJGRnGy.exe
  2⤵
  PID:5788
- C:\Windows\System\xROoEgW.exe
  C:\Windows\System\xROoEgW.exe
  2⤵
  PID:5804
- C:\Windows\System\CjzYjdw.exe
  C:\Windows\System\CjzYjdw.exe
  2⤵
  PID:5820
- C:\Windows\System\WPRfwap.exe
  C:\Windows\System\WPRfwap.exe
  2⤵
  PID:5836
- C:\Windows\System\NmNQuaI.exe
  C:\Windows\System\NmNQuaI.exe
  2⤵
  PID:5856
- C:\Windows\System\HBAyDbS.exe
  C:\Windows\System\HBAyDbS.exe
  2⤵
  PID:5872
- C:\Windows\System\TJAqSpm.exe
  C:\Windows\System\TJAqSpm.exe
  2⤵
  PID:5888
- C:\Windows\System\GbTSUre.exe
  C:\Windows\System\GbTSUre.exe
  2⤵
  PID:5908
- C:\Windows\System\RDdobbR.exe
  C:\Windows\System\RDdobbR.exe
  2⤵
  PID:5924
- C:\Windows\System\YoeumQn.exe
  C:\Windows\System\YoeumQn.exe
  2⤵
  PID:5940
- C:\Windows\System\PUldIIc.exe
  C:\Windows\System\PUldIIc.exe
  2⤵
  PID:5956
- C:\Windows\System\VGjDzwS.exe
  C:\Windows\System\VGjDzwS.exe
  2⤵
  PID:5976
- C:\Windows\System\jJbrHjM.exe
  C:\Windows\System\jJbrHjM.exe
  2⤵
  PID:5992
- C:\Windows\System\XywFcAM.exe
  C:\Windows\System\XywFcAM.exe
  2⤵
  PID:6008
- C:\Windows\System\sxqiGeo.exe
  C:\Windows\System\sxqiGeo.exe
  2⤵
  PID:6024
- C:\Windows\System\uacbcIr.exe
  C:\Windows\System\uacbcIr.exe
  2⤵
  PID:6044
- C:\Windows\System\kNSniSz.exe
  C:\Windows\System\kNSniSz.exe
  2⤵
  PID:6060
- C:\Windows\System\hkYuBXd.exe
  C:\Windows\System\hkYuBXd.exe
  2⤵
  PID:6076
- C:\Windows\System\diCvjvW.exe
  C:\Windows\System\diCvjvW.exe
  2⤵
  PID:6092
- C:\Windows\System\IMmjGrS.exe
  C:\Windows\System\IMmjGrS.exe
  2⤵
  PID:6112
- C:\Windows\System\umNqjZg.exe
  C:\Windows\System\umNqjZg.exe
  2⤵
  PID:6128
- C:\Windows\System\bwhChKv.exe
  C:\Windows\System\bwhChKv.exe
  2⤵
  PID:4296
- C:\Windows\System\EkRVqvk.exe
  C:\Windows\System\EkRVqvk.exe
  2⤵
  PID:5272
- C:\Windows\System\fwFUlCe.exe
  C:\Windows\System\fwFUlCe.exe
  2⤵
  PID:5336
- C:\Windows\System\QBTfnwK.exe
  C:\Windows\System\QBTfnwK.exe
  2⤵
  PID:5380
- C:\Windows\System\hUdtvWW.exe
  C:\Windows\System\hUdtvWW.exe
  2⤵
  PID:5448
- C:\Windows\System\XVXFTKO.exe
  C:\Windows\System\XVXFTKO.exe
  2⤵
  PID:5540
- C:\Windows\System\QKkkenD.exe
  C:\Windows\System\QKkkenD.exe
  2⤵
  PID:5608
- C:\Windows\System\jrlDMLB.exe
  C:\Windows\System\jrlDMLB.exe
  2⤵
  PID:5208
- C:\Windows\System\ATGdSqt.exe
  C:\Windows\System\ATGdSqt.exe
  2⤵
  PID:5072
- C:\Windows\System\xUiVpbF.exe
  C:\Windows\System\xUiVpbF.exe
  2⤵
  PID:5428
- C:\Windows\System\YGydzQA.exe
  C:\Windows\System\YGydzQA.exe
  2⤵
  PID:5360
- C:\Windows\System\oMHMXvI.exe
  C:\Windows\System\oMHMXvI.exe
  2⤵
  PID:5288
- C:\Windows\System\vtykVbr.exe
  C:\Windows\System\vtykVbr.exe
  2⤵
  PID:5192
- C:\Windows\System\BLZDcYL.exe
  C:\Windows\System\BLZDcYL.exe
  2⤵
  PID:5152
- C:\Windows\System\lsQFYzr.exe
  C:\Windows\System\lsQFYzr.exe
  2⤵
  PID:3828
- C:\Windows\System\YgNJdWM.exe
  C:\Windows\System\YgNJdWM.exe
  2⤵
  PID:5492
- C:\Windows\System\ZAIMDyd.exe
  C:\Windows\System\ZAIMDyd.exe
  2⤵
  PID:5592
- C:\Windows\System\FBHTvzt.exe
  C:\Windows\System\FBHTvzt.exe
  2⤵
  PID:5340
- C:\Windows\System\owYcmML.exe
  C:\Windows\System\owYcmML.exe
  2⤵
  PID:5620
- C:\Windows\System\YeqBSth.exe
  C:\Windows\System\YeqBSth.exe
  2⤵
  PID:5640
- C:\Windows\System\eCjzsaw.exe
  C:\Windows\System\eCjzsaw.exe
  2⤵
  PID:5816
- C:\Windows\System\jYRgWVk.exe
  C:\Windows\System\jYRgWVk.exe
  2⤵
  PID:5952
- C:\Windows\System\sHFWkar.exe
  C:\Windows\System\sHFWkar.exe
  2⤵
  PID:6124
- C:\Windows\System\RqcbSgw.exe
  C:\Windows\System\RqcbSgw.exe
  2⤵
  PID:5376
- C:\Windows\System\neHxqwf.exe
  C:\Windows\System\neHxqwf.exe
  2⤵
  PID:5204
- C:\Windows\System\UCMDcvN.exe
  C:\Windows\System\UCMDcvN.exe
  2⤵
  PID:5764
- C:\Windows\System\rHfeqQu.exe
  C:\Windows\System\rHfeqQu.exe
  2⤵
  PID:5320
- C:\Windows\System\VOdJkkV.exe
  C:\Windows\System\VOdJkkV.exe
  2⤵
  PID:5156
- C:\Windows\System\USCQfOW.exe
  C:\Windows\System\USCQfOW.exe
  2⤵
  PID:5832
- C:\Windows\System\waRrrDy.exe
  C:\Windows\System\waRrrDy.exe
  2⤵
  PID:5904
- C:\Windows\System\PPIsGVo.exe
  C:\Windows\System\PPIsGVo.exe
  2⤵
  PID:5964
- C:\Windows\System\mEgrzhh.exe
  C:\Windows\System\mEgrzhh.exe
  2⤵
  PID:6004
- C:\Windows\System\hAEHtVj.exe
  C:\Windows\System\hAEHtVj.exe
  2⤵
  PID:5984
- C:\Windows\System\FBIyfgO.exe
  C:\Windows\System\FBIyfgO.exe
  2⤵
  PID:5636
- C:\Windows\System\fvtUFxt.exe
  C:\Windows\System\fvtUFxt.exe
  2⤵
  PID:6036
- C:\Windows\System\oxVFoNq.exe
  C:\Windows\System\oxVFoNq.exe
  2⤵
  PID:5304
- C:\Windows\System\aMSwJNW.exe
  C:\Windows\System\aMSwJNW.exe
  2⤵
  PID:5572
- C:\Windows\System\MIccjWp.exe
  C:\Windows\System\MIccjWp.exe
  2⤵
  PID:5560
- C:\Windows\System\wsXdAxb.exe
  C:\Windows\System\wsXdAxb.exe
  2⤵
  PID:5716
- C:\Windows\System\rAiSjMU.exe
  C:\Windows\System\rAiSjMU.exe
  2⤵
  PID:4180
- C:\Windows\System\QzlDdhK.exe
  C:\Windows\System\QzlDdhK.exe
  2⤵
  PID:5844
- C:\Windows\System\ppeQkSL.exe
  C:\Windows\System\ppeQkSL.exe
  2⤵
  PID:5460
- C:\Windows\System\ObYDLXJ.exe
  C:\Windows\System\ObYDLXJ.exe
  2⤵
  PID:5916
- C:\Windows\System\GOnrqei.exe
  C:\Windows\System\GOnrqei.exe
  2⤵
  PID:6020
- C:\Windows\System\gZnnIMO.exe
  C:\Windows\System\gZnnIMO.exe
  2⤵
  PID:5664
- C:\Windows\System\vjAVhMl.exe
  C:\Windows\System\vjAVhMl.exe
  2⤵
  PID:5412
- C:\Windows\System\qTJwflu.exe
  C:\Windows\System\qTJwflu.exe
  2⤵
  PID:5720
- C:\Windows\System\hNNdNoq.exe
  C:\Windows\System\hNNdNoq.exe
  2⤵
  PID:5708
- C:\Windows\System\naIQUMD.exe
  C:\Windows\System\naIQUMD.exe
  2⤵
  PID:6068
- C:\Windows\System\bUZmVBb.exe
  C:\Windows\System\bUZmVBb.exe
  2⤵
  PID:6016
- C:\Windows\System\ZRepvMg.exe
  C:\Windows\System\ZRepvMg.exe
  2⤵
  PID:5740
- C:\Windows\System\oIdnwzr.exe
  C:\Windows\System\oIdnwzr.exe
  2⤵
  PID:5512
- C:\Windows\System\jmSMqIg.exe
  C:\Windows\System\jmSMqIg.exe
  2⤵
  PID:4888
- C:\Windows\System\eLJtUlL.exe
  C:\Windows\System\eLJtUlL.exe
  2⤵
  PID:5444
- C:\Windows\System\kKXgFDN.exe
  C:\Windows\System\kKXgFDN.exe
  2⤵
  PID:5168
- C:\Windows\System\UjYXGTx.exe
  C:\Windows\System\UjYXGTx.exe
  2⤵
  PID:5464
- C:\Windows\System\IrWujMT.exe
  C:\Windows\System\IrWujMT.exe
  2⤵
  PID:5748
- C:\Windows\System\CIfeoJc.exe
  C:\Windows\System\CIfeoJc.exe
  2⤵
  PID:5224
- C:\Windows\System\dHKXylC.exe
  C:\Windows\System\dHKXylC.exe
  2⤵
  PID:5184
- C:\Windows\System\TQLKXmY.exe
  C:\Windows\System\TQLKXmY.exe
  2⤵
  PID:5972
- C:\Windows\System\ASLWlLU.exe
  C:\Windows\System\ASLWlLU.exe
  2⤵
  PID:5668
- C:\Windows\System\ujBrRAP.exe
  C:\Windows\System\ujBrRAP.exe
  2⤵
  PID:5724
- C:\Windows\System\OhWHKKb.exe
  C:\Windows\System\OhWHKKb.exe
  2⤵
  PID:5268
- C:\Windows\System\CQtwTdG.exe
  C:\Windows\System\CQtwTdG.exe
  2⤵
  PID:5828
- C:\Windows\System\oHlwzyR.exe
  C:\Windows\System\oHlwzyR.exe
  2⤵
  PID:6000
- C:\Windows\System\NryGoha.exe
  C:\Windows\System\NryGoha.exe
  2⤵
  PID:5432
- C:\Windows\System\PNJFNSR.exe
  C:\Windows\System\PNJFNSR.exe
  2⤵
  PID:5348
- C:\Windows\System\gRvdxUt.exe
  C:\Windows\System\gRvdxUt.exe
  2⤵
  PID:5556
- C:\Windows\System\RZApUXz.exe
  C:\Windows\System\RZApUXz.exe
  2⤵
  PID:5688
- C:\Windows\System\eNHcUna.exe
  C:\Windows\System\eNHcUna.exe
  2⤵
  PID:6148
- C:\Windows\System\nGILddC.exe
  C:\Windows\System\nGILddC.exe
  2⤵
  PID:6164
- C:\Windows\System\XaJMIzB.exe
  C:\Windows\System\XaJMIzB.exe
  2⤵
  PID:6180
- C:\Windows\System\HXaXXPl.exe
  C:\Windows\System\HXaXXPl.exe
  2⤵
  PID:6196
- C:\Windows\System\VHJcqhr.exe
  C:\Windows\System\VHJcqhr.exe
  2⤵
  PID:6212
- C:\Windows\System\DaoKaiw.exe
  C:\Windows\System\DaoKaiw.exe
  2⤵
  PID:6228
- C:\Windows\System\jbsxoWe.exe
  C:\Windows\System\jbsxoWe.exe
  2⤵
  PID:6248
- C:\Windows\System\MnNaXJc.exe
  C:\Windows\System\MnNaXJc.exe
  2⤵
  PID:6264
- C:\Windows\System\keakFqO.exe
  C:\Windows\System\keakFqO.exe
  2⤵
  PID:6280
- C:\Windows\System\RseDoom.exe
  C:\Windows\System\RseDoom.exe
  2⤵
  PID:6296
- C:\Windows\System\zSzaIdt.exe
  C:\Windows\System\zSzaIdt.exe
  2⤵
  PID:6316
- C:\Windows\System\VBafBcW.exe
  C:\Windows\System\VBafBcW.exe
  2⤵
  PID:6332
- C:\Windows\System\SmmVZha.exe
  C:\Windows\System\SmmVZha.exe
  2⤵
  PID:6348
- C:\Windows\System\Piqdesa.exe
  C:\Windows\System\Piqdesa.exe
  2⤵
  PID:6364
- C:\Windows\System\rtNhgCa.exe
  C:\Windows\System\rtNhgCa.exe
  2⤵
  PID:6380
- C:\Windows\System\YEfNAfQ.exe
  C:\Windows\System\YEfNAfQ.exe
  2⤵
  PID:6396
- C:\Windows\System\JHIMeDu.exe
  C:\Windows\System\JHIMeDu.exe
  2⤵
  PID:6420
- C:\Windows\System\VlJFtAn.exe
  C:\Windows\System\VlJFtAn.exe
  2⤵
  PID:6436
- C:\Windows\System\zSkJMjF.exe
  C:\Windows\System\zSkJMjF.exe
  2⤵
  PID:6452
- C:\Windows\System\xKSqgvP.exe
  C:\Windows\System\xKSqgvP.exe
  2⤵
  PID:6468
- C:\Windows\System\RRSjViE.exe
  C:\Windows\System\RRSjViE.exe
  2⤵
  PID:6484
- C:\Windows\System\oIHewpI.exe
  C:\Windows\System\oIHewpI.exe
  2⤵
  PID:6504
- C:\Windows\System\yjOjPIc.exe
  C:\Windows\System\yjOjPIc.exe
  2⤵
  PID:6520
- C:\Windows\System\keYNdEK.exe
  C:\Windows\System\keYNdEK.exe
  2⤵
  PID:6540
- C:\Windows\System\yROKEoA.exe
  C:\Windows\System\yROKEoA.exe
  2⤵
  PID:6556
- C:\Windows\System\okKtflV.exe
  C:\Windows\System\okKtflV.exe
  2⤵
  PID:6572
- C:\Windows\System\SJiZbxG.exe
  C:\Windows\System\SJiZbxG.exe
  2⤵
  PID:6588
- C:\Windows\System\xXuNUjY.exe
  C:\Windows\System\xXuNUjY.exe
  2⤵
  PID:6660
- C:\Windows\System\DhMBzmN.exe
  C:\Windows\System\DhMBzmN.exe
  2⤵
  PID:6676
- C:\Windows\System\IlkzvHA.exe
  C:\Windows\System\IlkzvHA.exe
  2⤵
  PID:6692
- C:\Windows\System\EIQMvqU.exe
  C:\Windows\System\EIQMvqU.exe
  2⤵
  PID:6708
- C:\Windows\System\xVrzCoi.exe
  C:\Windows\System\xVrzCoi.exe
  2⤵
  PID:6724
- C:\Windows\System\DxXstAk.exe
  C:\Windows\System\DxXstAk.exe
  2⤵
  PID:6744
- C:\Windows\System\FimjxCb.exe
  C:\Windows\System\FimjxCb.exe
  2⤵
  PID:6760
- C:\Windows\System\glpFkbQ.exe
  C:\Windows\System\glpFkbQ.exe
  2⤵
  PID:6776
- C:\Windows\System\hWVsdCf.exe
  C:\Windows\System\hWVsdCf.exe
  2⤵
  PID:6792
- C:\Windows\System\UgSfIhX.exe
  C:\Windows\System\UgSfIhX.exe
  2⤵
  PID:6808
- C:\Windows\System\kjMsiSj.exe
  C:\Windows\System\kjMsiSj.exe
  2⤵
  PID:6824
- C:\Windows\System\bnAMSUo.exe
  C:\Windows\System\bnAMSUo.exe
  2⤵
  PID:6840
- C:\Windows\System\exWXwpb.exe
  C:\Windows\System\exWXwpb.exe
  2⤵
  PID:6856
- C:\Windows\System\DlakYuC.exe
  C:\Windows\System\DlakYuC.exe
  2⤵
  PID:6872
- C:\Windows\System\KfFXnkl.exe
  C:\Windows\System\KfFXnkl.exe
  2⤵
  PID:6892
- C:\Windows\System\bztSgAJ.exe
  C:\Windows\System\bztSgAJ.exe
  2⤵
  PID:6908
- C:\Windows\System\zFEoPPL.exe
  C:\Windows\System\zFEoPPL.exe
  2⤵
  PID:6924
- C:\Windows\System\deDhhDd.exe
  C:\Windows\System\deDhhDd.exe
  2⤵
  PID:6940
- C:\Windows\System\JhUotjC.exe
  C:\Windows\System\JhUotjC.exe
  2⤵
  PID:6960
- C:\Windows\System\HjGrXij.exe
  C:\Windows\System\HjGrXij.exe
  2⤵
  PID:6976
- C:\Windows\System\UDsSGZu.exe
  C:\Windows\System\UDsSGZu.exe
  2⤵
  PID:6992
- C:\Windows\System\BUKORhd.exe
  C:\Windows\System\BUKORhd.exe
  2⤵
  PID:7008
- C:\Windows\System\TujKRVu.exe
  C:\Windows\System\TujKRVu.exe
  2⤵
  PID:7024
- C:\Windows\System\qHcEyEm.exe
  C:\Windows\System\qHcEyEm.exe
  2⤵
  PID:7044
- C:\Windows\System\cSNNXfk.exe
  C:\Windows\System\cSNNXfk.exe
  2⤵
  PID:7060
- C:\Windows\System\RGfaxah.exe
  C:\Windows\System\RGfaxah.exe
  2⤵
  PID:7076
- C:\Windows\System\NwcLcHH.exe
  C:\Windows\System\NwcLcHH.exe
  2⤵
  PID:7092
- C:\Windows\System\OzqDOxg.exe
  C:\Windows\System\OzqDOxg.exe
  2⤵
  PID:7108
- C:\Windows\System\dElxlXM.exe
  C:\Windows\System\dElxlXM.exe
  2⤵
  PID:7124
- C:\Windows\System\fYiVZpy.exe
  C:\Windows\System\fYiVZpy.exe
  2⤵
  PID:7140
- C:\Windows\System\CvOiMIa.exe
  C:\Windows\System\CvOiMIa.exe
  2⤵
  PID:7156
- C:\Windows\System\ltBSjyp.exe
  C:\Windows\System\ltBSjyp.exe
  2⤵
  PID:5744
- C:\Windows\System\oSRfApt.exe
  C:\Windows\System\oSRfApt.exe
  2⤵
  PID:5712
- C:\Windows\System\UppcdZR.exe
  C:\Windows\System\UppcdZR.exe
  2⤵
  PID:5800
- C:\Windows\System\BxLGlnA.exe
  C:\Windows\System\BxLGlnA.exe
  2⤵
  PID:5652
- C:\Windows\System\zJQuCjO.exe
  C:\Windows\System\zJQuCjO.exe
  2⤵
  PID:6240
- C:\Windows\System\iJSMByx.exe
  C:\Windows\System\iJSMByx.exe
  2⤵
  PID:6304
- C:\Windows\System\WbUxfPY.exe
  C:\Windows\System\WbUxfPY.exe
  2⤵
  PID:6088
- C:\Windows\System\qicsRtX.exe
  C:\Windows\System\qicsRtX.exe
  2⤵
  PID:6172
- C:\Windows\System\olPFPFm.exe
  C:\Windows\System\olPFPFm.exe
  2⤵
  PID:6584
- C:\Windows\System\GMuKKfU.exe
  C:\Windows\System\GMuKKfU.exe
  2⤵
  PID:6412
- C:\Windows\System\CGqrutO.exe
  C:\Windows\System\CGqrutO.exe
  2⤵
  PID:6480
- C:\Windows\System\IpxDJCl.exe
  C:\Windows\System\IpxDJCl.exe
  2⤵
  PID:6552
- C:\Windows\System\JPiUPwZ.exe
  C:\Windows\System\JPiUPwZ.exe
  2⤵
  PID:5220
- C:\Windows\System\yMgLksp.exe
  C:\Windows\System\yMgLksp.exe
  2⤵
  PID:5616
- C:\Windows\System\GizufzM.exe
  C:\Windows\System\GizufzM.exe
  2⤵
  PID:5684
- C:\Windows\System\hhtMtEF.exe
  C:\Windows\System\hhtMtEF.exe
  2⤵
  PID:6220
- C:\Windows\System\UcQvuda.exe
  C:\Windows\System\UcQvuda.exe
  2⤵
  PID:6288
- C:\Windows\System\AsZDVlh.exe
  C:\Windows\System\AsZDVlh.exe
  2⤵
  PID:6496
- C:\Windows\System\EBASiFE.exe
  C:\Windows\System\EBASiFE.exe
  2⤵
  PID:6564
- C:\Windows\System\oYEeiVR.exe
  C:\Windows\System\oYEeiVR.exe
  2⤵
  PID:6620
- C:\Windows\System\WscDQvu.exe
  C:\Windows\System\WscDQvu.exe
  2⤵
  PID:6636
- C:\Windows\System\gRrrkBg.exe
  C:\Windows\System\gRrrkBg.exe
  2⤵
  PID:6672
- C:\Windows\System\YczjIdz.exe
  C:\Windows\System\YczjIdz.exe
  2⤵
  PID:6740
- C:\Windows\System\aNuejhu.exe
  C:\Windows\System\aNuejhu.exe
  2⤵
  PID:6836
- C:\Windows\System\GYvAdvv.exe
  C:\Windows\System\GYvAdvv.exe
  2⤵
  PID:6832
- C:\Windows\System\YDhIXiq.exe
  C:\Windows\System\YDhIXiq.exe
  2⤵
  PID:6932
- C:\Windows\System\bmvvefn.exe
  C:\Windows\System\bmvvefn.exe
  2⤵
  PID:7000
- C:\Windows\System\zbOWyob.exe
  C:\Windows\System\zbOWyob.exe
  2⤵
  PID:6652
- C:\Windows\System\rxNnBHh.exe
  C:\Windows\System\rxNnBHh.exe
  2⤵
  PID:6720
- C:\Windows\System\iVVHKYG.exe
  C:\Windows\System\iVVHKYG.exe
  2⤵
  PID:6788
- C:\Windows\System\xxevuBF.exe
  C:\Windows\System\xxevuBF.exe
  2⤵
  PID:6880
- C:\Windows\System\pTRRONg.exe
  C:\Windows\System\pTRRONg.exe
  2⤵
  PID:6920
- C:\Windows\System\vGWrWDY.exe
  C:\Windows\System\vGWrWDY.exe
  2⤵
  PID:6984
- C:\Windows\System\RDlBagI.exe
  C:\Windows\System\RDlBagI.exe
  2⤵
  PID:7040
- C:\Windows\System\HBDNqgU.exe
  C:\Windows\System\HBDNqgU.exe
  2⤵
  PID:7132
- C:\Windows\System\aTKKZHM.exe
  C:\Windows\System\aTKKZHM.exe
  2⤵
  PID:1248
- C:\Windows\System\DhDiEqw.exe
  C:\Windows\System\DhDiEqw.exe
  2⤵
  PID:6372
- C:\Windows\System\ZtKnaDy.exe
  C:\Windows\System\ZtKnaDy.exe
  2⤵
  PID:6204
- C:\Windows\System\mTeiEum.exe
  C:\Windows\System\mTeiEum.exe
  2⤵
  PID:6156
- C:\Windows\System\aqPLsaK.exe
  C:\Windows\System\aqPLsaK.exe
  2⤵
  PID:6256
- C:\Windows\System\zdLohnJ.exe
  C:\Windows\System\zdLohnJ.exe
  2⤵
  PID:6312
- C:\Windows\System\ZdBrKtn.exe
  C:\Windows\System\ZdBrKtn.exe
  2⤵
  PID:6360
- C:\Windows\System\kqFPoVZ.exe
  C:\Windows\System\kqFPoVZ.exe
  2⤵
  PID:6460
- C:\Windows\System\HySNxWy.exe
  C:\Windows\System\HySNxWy.exe
  2⤵
  PID:5252
- C:\Windows\System\TeBGYlN.exe
  C:\Windows\System\TeBGYlN.exe
  2⤵
  PID:6308
- C:\Windows\System\FQnbkiY.exe
  C:\Windows\System\FQnbkiY.exe
  2⤵
  PID:6600
- C:\Windows\System\cbMapjo.exe
  C:\Windows\System\cbMapjo.exe
  2⤵
  PID:6324
- C:\Windows\System\GtGlBhi.exe
  C:\Windows\System\GtGlBhi.exe
  2⤵
  PID:6632
- C:\Windows\System\OUXvecx.exe
  C:\Windows\System\OUXvecx.exe
  2⤵
  PID:6704
- C:\Windows\System\qgNSkCq.exe
  C:\Windows\System\qgNSkCq.exe
  2⤵
  PID:6772
- C:\Windows\System\MHhIsdL.exe
  C:\Windows\System\MHhIsdL.exe
  2⤵
  PID:6972
- C:\Windows\System\eEdvSnl.exe
  C:\Windows\System\eEdvSnl.exe
  2⤵
  PID:5696
- C:\Windows\System\yXbasMy.exe
  C:\Windows\System\yXbasMy.exe
  2⤵
  PID:6956
- C:\Windows\System\TkwERgx.exe
  C:\Windows\System\TkwERgx.exe
  2⤵
  PID:7032
- C:\Windows\System\LRnqQMp.exe
  C:\Windows\System\LRnqQMp.exe
  2⤵
  PID:7072
- C:\Windows\System\tIdGOJe.exe
  C:\Windows\System\tIdGOJe.exe
  2⤵
  PID:5392
- C:\Windows\System\mfWpBzU.exe
  C:\Windows\System\mfWpBzU.exe
  2⤵
  PID:6236
- C:\Windows\System\VmxDVJI.exe
  C:\Windows\System\VmxDVJI.exe
  2⤵
  PID:5308
- C:\Windows\System\GTpalnK.exe
  C:\Windows\System\GTpalnK.exe
  2⤵
  PID:6476
- C:\Windows\System\GDEbKHQ.exe
  C:\Windows\System\GDEbKHQ.exe
  2⤵
  PID:5680
- C:\Windows\System\EgYKSwf.exe
  C:\Windows\System\EgYKSwf.exe
  2⤵
  PID:6408
- C:\Windows\System\IdBNVRg.exe
  C:\Windows\System\IdBNVRg.exe
  2⤵
  PID:6388
- C:\Windows\System\vLPNiYJ.exe
  C:\Windows\System\vLPNiYJ.exe
  2⤵
  PID:5796
- C:\Windows\System\najzwRw.exe
  C:\Windows\System\najzwRw.exe
  2⤵
  PID:6536
- C:\Windows\System\RRWgKMB.exe
  C:\Windows\System\RRWgKMB.exe
  2⤵
  PID:6968
- C:\Windows\System\EWqQSAh.exe
  C:\Windows\System\EWqQSAh.exe
  2⤵
  PID:6952
- C:\Windows\System\xKLNOWs.exe
  C:\Windows\System\xKLNOWs.exe
  2⤵
  PID:7016
- C:\Windows\System\kMVXVJF.exe
  C:\Windows\System\kMVXVJF.exe
  2⤵
  PID:6900
- C:\Windows\System\TGKkjkC.exe
  C:\Windows\System\TGKkjkC.exe
  2⤵
  PID:6444
- C:\Windows\System\ZBOjdOY.exe
  C:\Windows\System\ZBOjdOY.exe
  2⤵
  PID:5480
- C:\Windows\System\VhtwTxx.exe
  C:\Windows\System\VhtwTxx.exe
  2⤵
  PID:6464
- C:\Windows\System\oIEDqRv.exe
  C:\Windows\System\oIEDqRv.exe
  2⤵
  PID:6516
- C:\Windows\System\cqMZWkf.exe
  C:\Windows\System\cqMZWkf.exe
  2⤵
  PID:6716
- C:\Windows\System\gpLMeeB.exe
  C:\Windows\System\gpLMeeB.exe
  2⤵
  PID:7116
- C:\Windows\System\lYuSZBW.exe
  C:\Windows\System\lYuSZBW.exe
  2⤵
  PID:6644
- C:\Windows\System\OsFEsyK.exe
  C:\Windows\System\OsFEsyK.exe
  2⤵
  PID:6852
- C:\Windows\System\IAceQZw.exe
  C:\Windows\System\IAceQZw.exe
  2⤵
  PID:6668
- C:\Windows\System\mhQZWEC.exe
  C:\Windows\System\mhQZWEC.exe
  2⤵
  PID:7088
- C:\Windows\System\AbGjeUg.exe
  C:\Windows\System\AbGjeUg.exe
  2⤵
  PID:7120
- C:\Windows\System\gPgKEjq.exe
  C:\Windows\System\gPgKEjq.exe
  2⤵
  PID:7172
- C:\Windows\System\GonoMCQ.exe
  C:\Windows\System\GonoMCQ.exe
  2⤵
  PID:7188
- C:\Windows\System\HUYanxb.exe
  C:\Windows\System\HUYanxb.exe
  2⤵
  PID:7204
- C:\Windows\System\soRIbeG.exe
  C:\Windows\System\soRIbeG.exe
  2⤵
  PID:7220
- C:\Windows\System\ndznNUQ.exe
  C:\Windows\System\ndznNUQ.exe
  2⤵
  PID:7236
- C:\Windows\System\YBcDxyB.exe
  C:\Windows\System\YBcDxyB.exe
  2⤵
  PID:7252
- C:\Windows\System\VtNmvYN.exe
  C:\Windows\System\VtNmvYN.exe
  2⤵
  PID:7316
- C:\Windows\System\taOjIhf.exe
  C:\Windows\System\taOjIhf.exe
  2⤵
  PID:7332
- C:\Windows\System\ehgOLBH.exe
  C:\Windows\System\ehgOLBH.exe
  2⤵
  PID:7352
- C:\Windows\System\rlVziIJ.exe
  C:\Windows\System\rlVziIJ.exe
  2⤵
  PID:7368
- C:\Windows\System\GlNtkYH.exe
  C:\Windows\System\GlNtkYH.exe
  2⤵
  PID:7384
- C:\Windows\System\eLzLfdn.exe
  C:\Windows\System\eLzLfdn.exe
  2⤵
  PID:7400
- C:\Windows\System\zafDQcK.exe
  C:\Windows\System\zafDQcK.exe
  2⤵
  PID:7420
- C:\Windows\System\fFQRgZp.exe
  C:\Windows\System\fFQRgZp.exe
  2⤵
  PID:7436
- C:\Windows\System\WvZEIAr.exe
  C:\Windows\System\WvZEIAr.exe
  2⤵
  PID:7456
- C:\Windows\System\DacefcN.exe
  C:\Windows\System\DacefcN.exe
  2⤵
  PID:7472
- C:\Windows\System\paBPGwl.exe
  C:\Windows\System\paBPGwl.exe
  2⤵
  PID:7488
- C:\Windows\System\yVJVptC.exe
  C:\Windows\System\yVJVptC.exe
  2⤵
  PID:7504
- C:\Windows\System\BwgYZUv.exe
  C:\Windows\System\BwgYZUv.exe
  2⤵
  PID:7520
- C:\Windows\System\VgAwNrf.exe
  C:\Windows\System\VgAwNrf.exe
  2⤵
  PID:7536
- C:\Windows\System\KjDZSUx.exe
  C:\Windows\System\KjDZSUx.exe
  2⤵
  PID:7552
- C:\Windows\System\KrTxfCT.exe
  C:\Windows\System\KrTxfCT.exe
  2⤵
  PID:7568
- C:\Windows\System\LQUiKzj.exe
  C:\Windows\System\LQUiKzj.exe
  2⤵
  PID:7588
- C:\Windows\System\RGOidmC.exe
  C:\Windows\System\RGOidmC.exe
  2⤵
  PID:7604
- C:\Windows\System\FmkRAJn.exe
  C:\Windows\System\FmkRAJn.exe
  2⤵
  PID:7620
- C:\Windows\System\TonGucv.exe
  C:\Windows\System\TonGucv.exe
  2⤵
  PID:7636
- C:\Windows\System\BZrwSUm.exe
  C:\Windows\System\BZrwSUm.exe
  2⤵
  PID:7652
- C:\Windows\System\GkSqfOz.exe
  C:\Windows\System\GkSqfOz.exe
  2⤵
  PID:7668
- C:\Windows\System\MXDzDbt.exe
  C:\Windows\System\MXDzDbt.exe
  2⤵
  PID:7684
- C:\Windows\System\HKsXIqB.exe
  C:\Windows\System\HKsXIqB.exe
  2⤵
  PID:7700
- C:\Windows\System\GyDyDti.exe
  C:\Windows\System\GyDyDti.exe
  2⤵
  PID:7716
- C:\Windows\System\snexvTy.exe
  C:\Windows\System\snexvTy.exe
  2⤵
  PID:7736
- C:\Windows\System\hoQMdav.exe
  C:\Windows\System\hoQMdav.exe
  2⤵
  PID:7752
- C:\Windows\System\XcAYYeF.exe
  C:\Windows\System\XcAYYeF.exe
  2⤵
  PID:7768
- C:\Windows\System\hwiKCEP.exe
  C:\Windows\System\hwiKCEP.exe
  2⤵
  PID:7784
- C:\Windows\System\NkVkuZG.exe
  C:\Windows\System\NkVkuZG.exe
  2⤵
  PID:7800
- C:\Windows\System\eTUqLgt.exe
  C:\Windows\System\eTUqLgt.exe
  2⤵
  PID:7816
- C:\Windows\System\AAlAeVc.exe
  C:\Windows\System\AAlAeVc.exe
  2⤵
  PID:7832
- C:\Windows\System\LIAfEoM.exe
  C:\Windows\System\LIAfEoM.exe
  2⤵
  PID:7848
- C:\Windows\System\YzpjAGw.exe
  C:\Windows\System\YzpjAGw.exe
  2⤵
  PID:7864
- C:\Windows\System\TvjRhVN.exe
  C:\Windows\System\TvjRhVN.exe
  2⤵
  PID:7880
- C:\Windows\System\EGLKHSv.exe
  C:\Windows\System\EGLKHSv.exe
  2⤵
  PID:7896
- C:\Windows\System\IiBSpuq.exe
  C:\Windows\System\IiBSpuq.exe
  2⤵
  PID:7912
- C:\Windows\System\ILazqVs.exe
  C:\Windows\System\ILazqVs.exe
  2⤵
  PID:7928
- C:\Windows\System\GqDkYPx.exe
  C:\Windows\System\GqDkYPx.exe
  2⤵
  PID:7944
- C:\Windows\System\CCELAFc.exe
  C:\Windows\System\CCELAFc.exe
  2⤵
  PID:7960
- C:\Windows\System\kFgxgpV.exe
  C:\Windows\System\kFgxgpV.exe
  2⤵
  PID:7976
- C:\Windows\System\DTljNDS.exe
  C:\Windows\System\DTljNDS.exe
  2⤵
  PID:7992
- C:\Windows\System\nfVOxaB.exe
  C:\Windows\System\nfVOxaB.exe
  2⤵
  PID:8008
- C:\Windows\System\SsHeZbm.exe
  C:\Windows\System\SsHeZbm.exe
  2⤵
  PID:8024
- C:\Windows\System\QUgMmdv.exe
  C:\Windows\System\QUgMmdv.exe
  2⤵
  PID:8040
- C:\Windows\System\feIDGAE.exe
  C:\Windows\System\feIDGAE.exe
  2⤵
  PID:8056
- C:\Windows\System\AuMUcEa.exe
  C:\Windows\System\AuMUcEa.exe
  2⤵
  PID:8072
- C:\Windows\System\uAYNrdU.exe
  C:\Windows\System\uAYNrdU.exe
  2⤵
  PID:8088
- C:\Windows\System\azJXxvs.exe
  C:\Windows\System\azJXxvs.exe
  2⤵
  PID:8104
- C:\Windows\System\rJMxxvt.exe
  C:\Windows\System\rJMxxvt.exe
  2⤵
  PID:8156
- C:\Windows\System\KUxUOTN.exe
  C:\Windows\System\KUxUOTN.exe
  2⤵
  PID:8180
- C:\Windows\System\pzUORYh.exe
  C:\Windows\System\pzUORYh.exe
  2⤵
  PID:6608
- C:\Windows\System\ewstAUq.exe
  C:\Windows\System\ewstAUq.exe
  2⤵
  PID:7244
- C:\Windows\System\CRdaRrG.exe
  C:\Windows\System\CRdaRrG.exe
  2⤵
  PID:7104
- C:\Windows\System\eBMZiEM.exe
  C:\Windows\System\eBMZiEM.exe
  2⤵
  PID:7232
- C:\Windows\System\pOGGjVJ.exe
  C:\Windows\System\pOGGjVJ.exe
  2⤵
  PID:7276
- C:\Windows\System\gMELfhx.exe
  C:\Windows\System\gMELfhx.exe
  2⤵
  PID:7292
- C:\Windows\System\SyRmQAW.exe
  C:\Windows\System\SyRmQAW.exe
  2⤵
  PID:7308
- C:\Windows\System\njUzlyV.exe
  C:\Windows\System\njUzlyV.exe
  2⤵
  PID:7360
- C:\Windows\System\yoVCGcL.exe
  C:\Windows\System\yoVCGcL.exe
  2⤵
  PID:7732
- C:\Windows\System\uNAsOlc.exe
  C:\Windows\System\uNAsOlc.exe
  2⤵
  PID:7544
- C:\Windows\System\iaUJfsp.exe
  C:\Windows\System\iaUJfsp.exe
  2⤵
  PID:7412
- C:\Windows\System\rdeQoXw.exe
  C:\Windows\System\rdeQoXw.exe
  2⤵
  PID:7936
- C:\Windows\System\OGMZIhe.exe
  C:\Windows\System\OGMZIhe.exe
  2⤵
  PID:7584
- C:\Windows\System\sstgVUD.exe
  C:\Windows\System\sstgVUD.exe
  2⤵
  PID:7708
- C:\Windows\System\rJPeNxV.exe
  C:\Windows\System\rJPeNxV.exe
  2⤵
  PID:7840
- C:\Windows\System\pOyblpX.exe
  C:\Windows\System\pOyblpX.exe
  2⤵
  PID:7908
- C:\Windows\System\BdNaeqM.exe
  C:\Windows\System\BdNaeqM.exe
  2⤵
  PID:8112
- C:\Windows\System\cVSDzBu.exe
  C:\Windows\System\cVSDzBu.exe
  2⤵
  PID:8036
- C:\Windows\System\jnFMfwL.exe
  C:\Windows\System\jnFMfwL.exe
  2⤵
  PID:7216
- C:\Windows\System\VlPzFgO.exe
  C:\Windows\System\VlPzFgO.exe
  2⤵
  PID:7284
- C:\Windows\System\OFYlVVM.exe
  C:\Windows\System\OFYlVVM.exe
  2⤵
  PID:7272
- C:\Windows\System\vprqRiY.exe
  C:\Windows\System\vprqRiY.exe
  2⤵
  PID:7496
- C:\Windows\System\kxyMgGj.exe
  C:\Windows\System\kxyMgGj.exe
  2⤵
  PID:7560
- C:\Windows\System\hzBzkqJ.exe
  C:\Windows\System\hzBzkqJ.exe
  2⤵
  PID:7628
- C:\Windows\System\KcroAxR.exe
  C:\Windows\System\KcroAxR.exe
  2⤵
  PID:7692
- C:\Windows\System\JaoBZrc.exe
  C:\Windows\System\JaoBZrc.exe
  2⤵
  PID:7764
- C:\Windows\System\kJAYTfk.exe
  C:\Windows\System\kJAYTfk.exe
  2⤵
  PID:7824
- C:\Windows\System\DLOAXJi.exe
  C:\Windows\System\DLOAXJi.exe
  2⤵
  PID:7616
- C:\Windows\System\JSkjPUN.exe
  C:\Windows\System\JSkjPUN.exe
  2⤵
  PID:7860
- C:\Windows\System\vSwKKhJ.exe
  C:\Windows\System\vSwKKhJ.exe
  2⤵
  PID:7888
- C:\Windows\System\TaOoUCF.exe
  C:\Windows\System\TaOoUCF.exe
  2⤵
  PID:7952
- C:\Windows\System\ZMZFWvL.exe
  C:\Windows\System\ZMZFWvL.exe
  2⤵
  PID:7988
- C:\Windows\System\VfSquDV.exe
  C:\Windows\System\VfSquDV.exe
  2⤵
  PID:7380
- C:\Windows\System\NzAbDBw.exe
  C:\Windows\System\NzAbDBw.exe
  2⤵
  PID:7744
- C:\Windows\System\iouaqcx.exe
  C:\Windows\System\iouaqcx.exe
  2⤵
  PID:7512
- C:\Windows\System\rcvoNRx.exe
  C:\Windows\System\rcvoNRx.exe
  2⤵
  PID:8052
- C:\Windows\System\SCDixan.exe
  C:\Windows\System\SCDixan.exe
  2⤵
  PID:7748
- C:\Windows\System\AveaGRt.exe
  C:\Windows\System\AveaGRt.exe
  2⤵
  PID:7972
- C:\Windows\System\bEdHXKJ.exe
  C:\Windows\System\bEdHXKJ.exe
  2⤵
  PID:7676
- C:\Windows\System\AoSabyR.exe
  C:\Windows\System\AoSabyR.exe
  2⤵
  PID:8096
- C:\Windows\System\CoLxSJW.exe
  C:\Windows\System\CoLxSJW.exe
  2⤵
  PID:8124
- C:\Windows\System\TuksKsX.exe
  C:\Windows\System\TuksKsX.exe
  2⤵
  PID:7196
- C:\Windows\System\UkLwRNJ.exe
  C:\Windows\System\UkLwRNJ.exe
  2⤵
  PID:7268
- C:\Windows\System\DkKVUyR.exe
  C:\Windows\System\DkKVUyR.exe
  2⤵
  PID:8176
- C:\Windows\System\WDMftON.exe
  C:\Windows\System\WDMftON.exe
  2⤵
  PID:6528
- C:\Windows\System\Rfierpo.exe
  C:\Windows\System\Rfierpo.exe
  2⤵
  PID:7528
- C:\Windows\System\xDHzyLK.exe
  C:\Windows\System\xDHzyLK.exe
  2⤵
  PID:7532
- C:\Windows\System\JbBlmoe.exe
  C:\Windows\System\JbBlmoe.exe
  2⤵
  PID:7796
- C:\Windows\System\LUSnany.exe
  C:\Windows\System\LUSnany.exe
  2⤵
  PID:7580
- C:\Windows\System\MUSICbb.exe
  C:\Windows\System\MUSICbb.exe
  2⤵
  PID:7376
- C:\Windows\System\kqmnqpX.exe
  C:\Windows\System\kqmnqpX.exe
  2⤵
  PID:8000
- C:\Windows\System\TzcsFMA.exe
  C:\Windows\System\TzcsFMA.exe
  2⤵
  PID:7920
- C:\Windows\System\DVwTEyw.exe
  C:\Windows\System\DVwTEyw.exe
  2⤵
  PID:7844
- C:\Windows\System\iUKFLhD.exe
  C:\Windows\System\iUKFLhD.exe
  2⤵
  PID:7348
- C:\Windows\System\HcPDZlJ.exe
  C:\Windows\System\HcPDZlJ.exe
  2⤵
  PID:7452
- C:\Windows\System\rEIvICN.exe
  C:\Windows\System\rEIvICN.exe
  2⤵
  PID:8148
- C:\Windows\System\JCihvTL.exe
  C:\Windows\System\JCihvTL.exe
  2⤵
  PID:7260
- C:\Windows\System\ffqefSr.exe
  C:\Windows\System\ffqefSr.exe
  2⤵
  PID:7432
- C:\Windows\System\bujJfjB.exe
  C:\Windows\System\bujJfjB.exe
  2⤵
  PID:7648
- C:\Windows\System\fvvdHYT.exe
  C:\Windows\System\fvvdHYT.exe
  2⤵
  PID:8140
- C:\Windows\System\pMbEwCl.exe
  C:\Windows\System\pMbEwCl.exe
  2⤵
  PID:7180
- C:\Windows\System\IRbrMBI.exe
  C:\Windows\System\IRbrMBI.exe
  2⤵
  PID:7724
- C:\Windows\System\uaqUdpj.exe
  C:\Windows\System\uaqUdpj.exe
  2⤵
  PID:7812
- C:\Windows\System\nMLDmdq.exe
  C:\Windows\System\nMLDmdq.exe
  2⤵
  PID:7612
- C:\Windows\System\HXSsLVL.exe
  C:\Windows\System\HXSsLVL.exe
  2⤵
  PID:7968
- C:\Windows\System\XlSzEVg.exe
  C:\Windows\System\XlSzEVg.exe
  2⤵
  PID:7892
- C:\Windows\System\lFyVkuv.exe
  C:\Windows\System\lFyVkuv.exe
  2⤵
  PID:8208
- C:\Windows\System\PpZrAaC.exe
  C:\Windows\System\PpZrAaC.exe
  2⤵
  PID:8224
- C:\Windows\System\PeJbnIA.exe
  C:\Windows\System\PeJbnIA.exe
  2⤵
  PID:8240
- C:\Windows\System\HvOBEwz.exe
  C:\Windows\System\HvOBEwz.exe
  2⤵
  PID:8256
- C:\Windows\System\LZoyGyD.exe
  C:\Windows\System\LZoyGyD.exe
  2⤵
  PID:8272
- C:\Windows\System\uYJxnDj.exe
  C:\Windows\System\uYJxnDj.exe
  2⤵
  PID:8288
- C:\Windows\System\zPmnfkG.exe
  C:\Windows\System\zPmnfkG.exe
  2⤵
  PID:8304
- C:\Windows\System\ULUDmXn.exe
  C:\Windows\System\ULUDmXn.exe
  2⤵
  PID:8320
- C:\Windows\System\eQePjwh.exe
  C:\Windows\System\eQePjwh.exe
  2⤵
  PID:8336
- C:\Windows\System\NQXJrAp.exe
  C:\Windows\System\NQXJrAp.exe
  2⤵
  PID:8352
- C:\Windows\System\rpFpdPB.exe
  C:\Windows\System\rpFpdPB.exe
  2⤵
  PID:8368
- C:\Windows\System\dDFLsZt.exe
  C:\Windows\System\dDFLsZt.exe
  2⤵
  PID:8384
- C:\Windows\System\ERPXscm.exe
  C:\Windows\System\ERPXscm.exe
  2⤵
  PID:8400
- C:\Windows\System\ZdtTEQO.exe
  C:\Windows\System\ZdtTEQO.exe
  2⤵
  PID:8416
- C:\Windows\System\NNPdmdk.exe
  C:\Windows\System\NNPdmdk.exe
  2⤵
  PID:8432
- C:\Windows\System\JhDQfBl.exe
  C:\Windows\System\JhDQfBl.exe
  2⤵
  PID:8456
- C:\Windows\System\WRukqIQ.exe
  C:\Windows\System\WRukqIQ.exe
  2⤵
  PID:8472
- C:\Windows\System\ZqSgGGq.exe
  C:\Windows\System\ZqSgGGq.exe
  2⤵
  PID:8524
- C:\Windows\System\WzscwaF.exe
  C:\Windows\System\WzscwaF.exe
  2⤵
  PID:8540
- C:\Windows\System\BNkcptO.exe
  C:\Windows\System\BNkcptO.exe
  2⤵
  PID:8560
- C:\Windows\System\aIxDIIM.exe
  C:\Windows\System\aIxDIIM.exe
  2⤵
  PID:8576
- C:\Windows\System\QhhGcII.exe
  C:\Windows\System\QhhGcII.exe
  2⤵
  PID:8596
- C:\Windows\System\EejWuJQ.exe
  C:\Windows\System\EejWuJQ.exe
  2⤵
  PID:8672
- C:\Windows\System\gWJTvFc.exe
  C:\Windows\System\gWJTvFc.exe
  2⤵
  PID:8688
- C:\Windows\System\pGzwtFV.exe
  C:\Windows\System\pGzwtFV.exe
  2⤵
  PID:8704
- C:\Windows\System\bubjzEE.exe
  C:\Windows\System\bubjzEE.exe
  2⤵
  PID:8720
- C:\Windows\System\EqRHxqy.exe
  C:\Windows\System\EqRHxqy.exe
  2⤵
  PID:8736
- C:\Windows\System\UrLRtUc.exe
  C:\Windows\System\UrLRtUc.exe
  2⤵
  PID:8752
- C:\Windows\System\hQnJosf.exe
  C:\Windows\System\hQnJosf.exe
  2⤵
  PID:8768
- C:\Windows\System\YbPPqBZ.exe
  C:\Windows\System\YbPPqBZ.exe
  2⤵
  PID:8784
- C:\Windows\System\IgfVqeb.exe
  C:\Windows\System\IgfVqeb.exe
  2⤵
  PID:8800
- C:\Windows\System\EqfUZeQ.exe
  C:\Windows\System\EqfUZeQ.exe
  2⤵
  PID:8816
- C:\Windows\System\LIplBQh.exe
  C:\Windows\System\LIplBQh.exe
  2⤵
  PID:8832
- C:\Windows\System\LMZynYm.exe
  C:\Windows\System\LMZynYm.exe
  2⤵
  PID:8848
- C:\Windows\System\eYujglQ.exe
  C:\Windows\System\eYujglQ.exe
  2⤵
  PID:8864
- C:\Windows\System\ZMESMKc.exe
  C:\Windows\System\ZMESMKc.exe
  2⤵
  PID:8880
- C:\Windows\System\OddjFUA.exe
  C:\Windows\System\OddjFUA.exe
  2⤵
  PID:8900
- C:\Windows\System\GFtauRH.exe
  C:\Windows\System\GFtauRH.exe
  2⤵
  PID:8916
- C:\Windows\System\SGJPftM.exe
  C:\Windows\System\SGJPftM.exe
  2⤵
  PID:8932
- C:\Windows\System\BsPYbsC.exe
  C:\Windows\System\BsPYbsC.exe
  2⤵
  PID:8948
- C:\Windows\System\saQkPnB.exe
  C:\Windows\System\saQkPnB.exe
  2⤵
  PID:8964
- C:\Windows\System\BtOMddL.exe
  C:\Windows\System\BtOMddL.exe
  2⤵
  PID:8980
- C:\Windows\System\fyXErBM.exe
  C:\Windows\System\fyXErBM.exe
  2⤵
  PID:8996
- C:\Windows\System\FdScZfp.exe
  C:\Windows\System\FdScZfp.exe
  2⤵
  PID:9012
- C:\Windows\System\qMPluEO.exe
  C:\Windows\System\qMPluEO.exe
  2⤵
  PID:9028
- C:\Windows\System\OkNQMDS.exe
  C:\Windows\System\OkNQMDS.exe
  2⤵
  PID:9044
- C:\Windows\System\ARcMcpS.exe
  C:\Windows\System\ARcMcpS.exe
  2⤵
  PID:9060
- C:\Windows\System\bzkEdiH.exe
  C:\Windows\System\bzkEdiH.exe
  2⤵
  PID:9076
- C:\Windows\System\uUgAdqP.exe
  C:\Windows\System\uUgAdqP.exe
  2⤵
  PID:9092
- C:\Windows\System\hgoNRja.exe
  C:\Windows\System\hgoNRja.exe
  2⤵
  PID:9112
- C:\Windows\System\JWhwxpr.exe
  C:\Windows\System\JWhwxpr.exe
  2⤵
  PID:9128
- C:\Windows\System\deylpKm.exe
  C:\Windows\System\deylpKm.exe
  2⤵
  PID:9144
- C:\Windows\System\mOSinCs.exe
  C:\Windows\System\mOSinCs.exe
  2⤵
  PID:9160
- C:\Windows\System\uKvrpYj.exe
  C:\Windows\System\uKvrpYj.exe
  2⤵
  PID:9176
- C:\Windows\System\CnnzZgQ.exe
  C:\Windows\System\CnnzZgQ.exe
  2⤵
  PID:8332
- C:\Windows\System\SnhSyJD.exe
  C:\Windows\System\SnhSyJD.exe
  2⤵
  PID:8020
- C:\Windows\System\xcdGCnC.exe
  C:\Windows\System\xcdGCnC.exe
  2⤵
  PID:7780
- C:\Windows\System\HkwvxWJ.exe
  C:\Windows\System\HkwvxWJ.exe
  2⤵
  PID:8220
- C:\Windows\System\HJKFjlR.exe
  C:\Windows\System\HJKFjlR.exe
  2⤵
  PID:8312
- C:\Windows\System\EJPGItA.exe
  C:\Windows\System\EJPGItA.exe
  2⤵
  PID:8380
- C:\Windows\System\TQyaORQ.exe
  C:\Windows\System\TQyaORQ.exe
  2⤵
  PID:8424
- C:\Windows\System\IFdElGG.exe
  C:\Windows\System\IFdElGG.exe
  2⤵
  PID:8444
- C:\Windows\System\HmelhnG.exe
  C:\Windows\System\HmelhnG.exe
  2⤵
  PID:8532
- C:\Windows\System\EetnFZd.exe
  C:\Windows\System\EetnFZd.exe
  2⤵
  PID:8572
- C:\Windows\System\BUyFyaR.exe
  C:\Windows\System\BUyFyaR.exe
  2⤵
  PID:8624
- C:\Windows\System\OJAFKiR.exe
  C:\Windows\System\OJAFKiR.exe
  2⤵
  PID:8640
- C:\Windows\System\wChPsLb.exe
  C:\Windows\System\wChPsLb.exe
  2⤵
  PID:8452
- C:\Windows\System\INDToMz.exe
  C:\Windows\System\INDToMz.exe
  2⤵
  PID:8496
- C:\Windows\System\IxodHMb.exe
  C:\Windows\System\IxodHMb.exe
  2⤵
  PID:8556
- C:\Windows\System\sxKeLsc.exe
  C:\Windows\System\sxKeLsc.exe
  2⤵
  PID:8480
- C:\Windows\System\vVNdMkC.exe
  C:\Windows\System\vVNdMkC.exe
  2⤵
  PID:8500
- C:\Windows\System\qupotRF.exe
  C:\Windows\System\qupotRF.exe
  2⤵
  PID:8552
- C:\Windows\System\fQyZHIa.exe
  C:\Windows\System\fQyZHIa.exe
  2⤵
  PID:8696
- C:\Windows\System\ICXCJZu.exe
  C:\Windows\System\ICXCJZu.exe
  2⤵
  PID:8760
- C:\Windows\System\NJvUTsc.exe
  C:\Windows\System\NJvUTsc.exe
  2⤵
  PID:8856
- C:\Windows\System\HAiSeog.exe
  C:\Windows\System\HAiSeog.exe
  2⤵
  PID:8892
- C:\Windows\System\BnNagWp.exe
  C:\Windows\System\BnNagWp.exe
  2⤵
  PID:8956
- C:\Windows\System\YYZpxFb.exe
  C:\Windows\System\YYZpxFb.exe
  2⤵
  PID:9020
- C:\Windows\System\rENMqSw.exe
  C:\Windows\System\rENMqSw.exe
  2⤵
  PID:8780
- C:\Windows\System\WLtfxIy.exe
  C:\Windows\System\WLtfxIy.exe
  2⤵
  PID:9056
- C:\Windows\System\bvWBOVC.exe
  C:\Windows\System\bvWBOVC.exe
  2⤵
  PID:8844
- C:\Windows\System\aSnETRo.exe
  C:\Windows\System\aSnETRo.exe
  2⤵
  PID:8912
- C:\Windows\System\YWdQwxN.exe
  C:\Windows\System\YWdQwxN.exe
  2⤵
  PID:9008
- C:\Windows\System\KlPGVdZ.exe
  C:\Windows\System\KlPGVdZ.exe
  2⤵
  PID:9088
- C:\Windows\System\jdQcZgc.exe
  C:\Windows\System\jdQcZgc.exe
  2⤵
  PID:9120
- C:\Windows\System\AoTaKop.exe
  C:\Windows\System\AoTaKop.exe
  2⤵
  PID:9140
- C:\Windows\System\DqGggzU.exe
  C:\Windows\System\DqGggzU.exe
  2⤵
  PID:9184
- C:\Windows\System\eWGAbmH.exe
  C:\Windows\System\eWGAbmH.exe
  2⤵
  PID:9204
- C:\Windows\System\MjcIbQa.exe
  C:\Windows\System\MjcIbQa.exe
  2⤵
  PID:7328
- C:\Windows\System\bUUvXIH.exe
  C:\Windows\System\bUUvXIH.exe
  2⤵
  PID:8236
- C:\Windows\System\ibTdRnw.exe
  C:\Windows\System\ibTdRnw.exe
  2⤵
  PID:8300
- C:\Windows\System\KwANMsT.exe
  C:\Windows\System\KwANMsT.exe
  2⤵
  PID:7448
- C:\Windows\System\LeRriyz.exe
  C:\Windows\System\LeRriyz.exe
  2⤵
  PID:8796
- C:\Windows\System\XHSDzNe.exe
  C:\Windows\System\XHSDzNe.exe
  2⤵
  PID:8776
- C:\Windows\System\ZUTMerz.exe
  C:\Windows\System\ZUTMerz.exe
  2⤵
  PID:8568
- C:\Windows\System\zdewhqS.exe
  C:\Windows\System\zdewhqS.exe
  2⤵
  PID:8664
- C:\Windows\System\qGqtDok.exe
  C:\Windows\System\qGqtDok.exe
  2⤵
  PID:8824
- C:\Windows\System\EcKvZUf.exe
  C:\Windows\System\EcKvZUf.exe
  2⤵
  PID:8876
- C:\Windows\System\MnOaYHs.exe
  C:\Windows\System\MnOaYHs.exe
  2⤵
  PID:8976
- C:\Windows\System\SDASyEM.exe
  C:\Windows\System\SDASyEM.exe
  2⤵
  PID:8908
- C:\Windows\System\JkeVQyB.exe
  C:\Windows\System\JkeVQyB.exe
  2⤵
  PID:8716
- C:\Windows\System\gQcfbnD.exe
  C:\Windows\System\gQcfbnD.exe
  2⤵
  PID:9168
- C:\Windows\System\AISMwuK.exe
  C:\Windows\System\AISMwuK.exe
  2⤵
  PID:9124
- C:\Windows\System\GcyXjEv.exe
  C:\Windows\System\GcyXjEv.exe
  2⤵
  PID:8200
- C:\Windows\System\OMoQUuW.exe
  C:\Windows\System\OMoQUuW.exe
  2⤵
  PID:8232
- C:\Windows\System\GlZARds.exe
  C:\Windows\System\GlZARds.exe
  2⤵
  PID:7516
- C:\Windows\System\gHbgmEN.exe
  C:\Windows\System\gHbgmEN.exe
  2⤵
  PID:8408
- C:\Windows\System\iCJLnCK.exe
  C:\Windows\System\iCJLnCK.exe
  2⤵
  PID:8168
- C:\Windows\System\namNHbh.exe
  C:\Windows\System\namNHbh.exe
  2⤵
  PID:8440
- C:\Windows\System\qmtZAkF.exe
  C:\Windows\System\qmtZAkF.exe
  2⤵
  PID:8668
- C:\Windows\System\eRJpRcS.exe
  C:\Windows\System\eRJpRcS.exe
  2⤵
  PID:8792
- C:\Windows\System\SjiiuxF.exe
  C:\Windows\System\SjiiuxF.exe
  2⤵
  PID:8684
- C:\Windows\System\xmtJETL.exe
  C:\Windows\System\xmtJETL.exe
  2⤵
  PID:8520
- C:\Windows\System\RgjqiSO.exe
  C:\Windows\System\RgjqiSO.exe
  2⤵
  PID:8728
- C:\Windows\System\dvqAwwo.exe
  C:\Windows\System\dvqAwwo.exe
  2⤵
  PID:9084
- C:\Windows\System\qnVdHRx.exe
  C:\Windows\System\qnVdHRx.exe
  2⤵
  PID:8992
- C:\Windows\System\FxOWjqU.exe
  C:\Windows\System\FxOWjqU.exe
  2⤵
  PID:8296
- C:\Windows\System\BSSITiQ.exe
  C:\Windows\System\BSSITiQ.exe
  2⤵
  PID:8284
- C:\Windows\System\gXECbbr.exe
  C:\Windows\System\gXECbbr.exe
  2⤵
  PID:8464
- C:\Windows\System\ZMwQago.exe
  C:\Windows\System\ZMwQago.exe
  2⤵
  PID:8652
- C:\Windows\System\sWNxios.exe
  C:\Windows\System\sWNxios.exe
  2⤵
  PID:8348
- C:\Windows\System\wPrwHkE.exe
  C:\Windows\System\wPrwHkE.exe
  2⤵
  PID:8604
- C:\Windows\System\FSiAHTD.exe
  C:\Windows\System\FSiAHTD.exe
  2⤵
  PID:9196
- C:\Windows\System\KJuuiNm.exe
  C:\Windows\System\KJuuiNm.exe
  2⤵
  PID:8188
- C:\Windows\System\hDCdsMf.exe
  C:\Windows\System\hDCdsMf.exe
  2⤵
  PID:8468
- C:\Windows\System\pswgNCY.exe
  C:\Windows\System\pswgNCY.exe
  2⤵
  PID:8840
- C:\Windows\System\ZEiOmSS.exe
  C:\Windows\System\ZEiOmSS.exe
  2⤵
  PID:8928
- C:\Windows\System\dAUqYBB.exe
  C:\Windows\System\dAUqYBB.exe
  2⤵
  PID:8660
- C:\Windows\System\LSNJQDf.exe
  C:\Windows\System\LSNJQDf.exe
  2⤵
  PID:9228
- C:\Windows\System\OcieznR.exe
  C:\Windows\System\OcieznR.exe
  2⤵
  PID:9336
- C:\Windows\System\wsSFIcE.exe
  C:\Windows\System\wsSFIcE.exe
  2⤵
  PID:9352
- C:\Windows\System\raeVYwT.exe
  C:\Windows\System\raeVYwT.exe
  2⤵
  PID:9368
- C:\Windows\System\lblLNVm.exe
  C:\Windows\System\lblLNVm.exe
  2⤵
  PID:9384
- C:\Windows\System\awYJhLf.exe
  C:\Windows\System\awYJhLf.exe
  2⤵
  PID:9400
- C:\Windows\System\bmLSJmK.exe
  C:\Windows\System\bmLSJmK.exe
  2⤵
  PID:9416
- C:\Windows\System\LeHcBhd.exe
  C:\Windows\System\LeHcBhd.exe
  2⤵
  PID:9436
- C:\Windows\System\ZDGbehn.exe
  C:\Windows\System\ZDGbehn.exe
  2⤵
  PID:9452
- C:\Windows\System\pclEzoc.exe
  C:\Windows\System\pclEzoc.exe
  2⤵
  PID:9468
- C:\Windows\System\FeBkzkJ.exe
  C:\Windows\System\FeBkzkJ.exe
  2⤵
  PID:9484
- C:\Windows\System\rhnNzon.exe
  C:\Windows\System\rhnNzon.exe
  2⤵
  PID:9500
- C:\Windows\System\VpznqHv.exe
  C:\Windows\System\VpznqHv.exe
  2⤵
  PID:9516
- C:\Windows\System\eRtlLSb.exe
  C:\Windows\System\eRtlLSb.exe
  2⤵
  PID:9584
- C:\Windows\System\mqBwxjt.exe
  C:\Windows\System\mqBwxjt.exe
  2⤵
  PID:9600
- C:\Windows\System\bZrAgyJ.exe
  C:\Windows\System\bZrAgyJ.exe
  2⤵
  PID:9620
- C:\Windows\System\lwYClEM.exe
  C:\Windows\System\lwYClEM.exe
  2⤵
  PID:9636
- C:\Windows\System\VGTtnGl.exe
  C:\Windows\System\VGTtnGl.exe
  2⤵
  PID:9652
- C:\Windows\System\vybztHY.exe
  C:\Windows\System\vybztHY.exe
  2⤵
  PID:9668
- C:\Windows\System\UwahJuw.exe
  C:\Windows\System\UwahJuw.exe
  2⤵
  PID:9684
- C:\Windows\System\jrcsHUO.exe
  C:\Windows\System\jrcsHUO.exe
  2⤵
  PID:9700
- C:\Windows\System\CQBFdzx.exe
  C:\Windows\System\CQBFdzx.exe
  2⤵
  PID:9716
- C:\Windows\System\FKMXayJ.exe
  C:\Windows\System\FKMXayJ.exe
  2⤵
  PID:9748
- C:\Windows\System\lkszYHE.exe
  C:\Windows\System\lkszYHE.exe
  2⤵
  PID:9764
- C:\Windows\System\oOYQAXI.exe
  C:\Windows\System\oOYQAXI.exe
  2⤵
  PID:9784
- C:\Windows\System\elbCDVC.exe
  C:\Windows\System\elbCDVC.exe
  2⤵
  PID:9824
- C:\Windows\System\oiBpyza.exe
  C:\Windows\System\oiBpyza.exe
  2⤵
  PID:9840
- C:\Windows\System\rHRpWdC.exe
  C:\Windows\System\rHRpWdC.exe
  2⤵
  PID:9856
- C:\Windows\System\AmjcpLh.exe
  C:\Windows\System\AmjcpLh.exe
  2⤵
  PID:9872
- C:\Windows\System\iEhqilO.exe
  C:\Windows\System\iEhqilO.exe
  2⤵
  PID:9888
- C:\Windows\System\EwCXVNL.exe
  C:\Windows\System\EwCXVNL.exe
  2⤵
  PID:9904
- C:\Windows\System\ymlNftb.exe
  C:\Windows\System\ymlNftb.exe
  2⤵
  PID:9920
- C:\Windows\System\LcCZVyV.exe
  C:\Windows\System\LcCZVyV.exe
  2⤵
  PID:9936
- C:\Windows\System\oCaJiap.exe
  C:\Windows\System\oCaJiap.exe
  2⤵
  PID:9952
- C:\Windows\System\TwTvDkG.exe
  C:\Windows\System\TwTvDkG.exe
  2⤵
  PID:9968
- C:\Windows\System\FunXYkJ.exe
  C:\Windows\System\FunXYkJ.exe
  2⤵
  PID:9984
- C:\Windows\System\ghTBxKh.exe
  C:\Windows\System\ghTBxKh.exe
  2⤵
  PID:10000
- C:\Windows\System\eDtnFsq.exe
  C:\Windows\System\eDtnFsq.exe
  2⤵
  PID:10016
- C:\Windows\System\MhVOgYc.exe
  C:\Windows\System\MhVOgYc.exe
  2⤵
  PID:10032
- C:\Windows\System\gJCXPan.exe
  C:\Windows\System\gJCXPan.exe
  2⤵
  PID:10048
- C:\Windows\System\tBrchWj.exe
  C:\Windows\System\tBrchWj.exe
  2⤵
  PID:10064
- C:\Windows\System\jgHzNrS.exe
  C:\Windows\System\jgHzNrS.exe
  2⤵
  PID:10080
- C:\Windows\System\hooxGCW.exe
  C:\Windows\System\hooxGCW.exe
  2⤵
  PID:10096
- C:\Windows\System\AOLyIes.exe
  C:\Windows\System\AOLyIes.exe
  2⤵
  PID:10112
- C:\Windows\System\vhrrqWO.exe
  C:\Windows\System\vhrrqWO.exe
  2⤵
  PID:10132
- C:\Windows\System\bFJAVMO.exe
  C:\Windows\System\bFJAVMO.exe
  2⤵
  PID:10148
- C:\Windows\System\OBsfGAb.exe
  C:\Windows\System\OBsfGAb.exe
  2⤵
  PID:10164
- C:\Windows\System\UURiYjK.exe
  C:\Windows\System\UURiYjK.exe
  2⤵
  PID:10180
- C:\Windows\System\mzARDav.exe
  C:\Windows\System\mzARDav.exe
  2⤵
  PID:10196
- C:\Windows\System\LPsTODu.exe
  C:\Windows\System\LPsTODu.exe
  2⤵
  PID:10212
- C:\Windows\System\SOIlQaI.exe
  C:\Windows\System\SOIlQaI.exe
  2⤵
  PID:10228
- C:\Windows\System\dDipZIo.exe
  C:\Windows\System\dDipZIo.exe
  2⤵
  PID:9220
- C:\Windows\System\jeCVYWI.exe
  C:\Windows\System\jeCVYWI.exe
  2⤵
  PID:8648
- C:\Windows\System\srTgrLL.exe
  C:\Windows\System\srTgrLL.exe
  2⤵
  PID:9172
- C:\Windows\System\UrrkweS.exe
  C:\Windows\System\UrrkweS.exe
  2⤵
  PID:9236
- C:\Windows\System\PekIBSN.exe
  C:\Windows\System\PekIBSN.exe
  2⤵
  PID:9256
- C:\Windows\System\RXcvZSq.exe
  C:\Windows\System\RXcvZSq.exe
  2⤵
  PID:9268
- C:\Windows\System\EeCSBIE.exe
  C:\Windows\System\EeCSBIE.exe
  2⤵
  PID:9288
- C:\Windows\System\SlLFFRs.exe
  C:\Windows\System\SlLFFRs.exe
  2⤵
  PID:9312
- C:\Windows\System\BQEWNyc.exe
  C:\Windows\System\BQEWNyc.exe
  2⤵
  PID:9512
- C:\Windows\System\CTCPxDZ.exe
  C:\Windows\System\CTCPxDZ.exe
  2⤵
  PID:9424
- C:\Windows\System\lXsljhx.exe
  C:\Windows\System\lXsljhx.exe
  2⤵
  PID:9492
- C:\Windows\System\JBIgzHW.exe
  C:\Windows\System\JBIgzHW.exe
  2⤵
  PID:9540
- C:\Windows\System\ZgIyFcs.exe
  C:\Windows\System\ZgIyFcs.exe
  2⤵
  PID:9556
- C:\Windows\System\mMalaZO.exe
  C:\Windows\System\mMalaZO.exe
  2⤵
  PID:9576
- C:\Windows\System\ZqPocxF.exe
  C:\Windows\System\ZqPocxF.exe
  2⤵
  PID:9660
- C:\Windows\System\oHHilJj.exe
  C:\Windows\System\oHHilJj.exe
  2⤵
  PID:9616
- C:\Windows\System\fqEnTuA.exe
  C:\Windows\System\fqEnTuA.exe
  2⤵
  PID:9644
- C:\Windows\System\hiDGVRb.exe
  C:\Windows\System\hiDGVRb.exe
  2⤵
  PID:9676
- C:\Windows\System\bQmGAqx.exe
  C:\Windows\System\bQmGAqx.exe
  2⤵
  PID:9740
- C:\Windows\System\CTwgdtc.exe
  C:\Windows\System\CTwgdtc.exe
  2⤵
  PID:9776
- C:\Windows\System\EgppyFI.exe
  C:\Windows\System\EgppyFI.exe
  2⤵
  PID:9796
- C:\Windows\System\yafJNUo.exe
  C:\Windows\System\yafJNUo.exe
  2⤵
  PID:9816
- C:\Windows\System\QoGWBUn.exe
  C:\Windows\System\QoGWBUn.exe
  2⤵
  PID:9832
- C:\Windows\System\WQAzUYA.exe
  C:\Windows\System\WQAzUYA.exe
  2⤵
  PID:9932
- C:\Windows\System\BJCQNIz.exe
  C:\Windows\System\BJCQNIz.exe
  2⤵
  PID:9992
- C:\Windows\System\BReuiHs.exe
  C:\Windows\System\BReuiHs.exe
  2⤵
  PID:10056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BCtDhzb.exe

Filesize
1.8MB

MD5
3026949a9f57eb5341bdb9b9a72910d3

SHA1
f9cd6d13b848e33979041201502cbec35d8cf317

SHA256
ffe9bebe6665259b49126b234941f0cb1c890e02d868f059999219f3833d6bfe

SHA512
4e6c54b6bb17f2061be679cceb7067a38ae91047572819fa71edeb1d15d50c86ca22eb1d898286b89923a1f28d60c42f9777f691b8ba4220abff13f59b2a37f0

Download Submit
C:\Windows\system\BKMOAdx.exe

Filesize
1.8MB

MD5
c0aed269c17537d9a7942838df062ccc

SHA1
1b0624339b9c5e4016a99bdfa50108700c42c766

SHA256
f36081e18c3ced3383be7a1a32142f200522cdf7575bfcd116b1d52420d2ae82

SHA512
91c9c446629e93cb375cb735e1027c2db1c87dee2b28cfd1b6cb319cf16a0471458c61a1eb6bb652bb563dcdbd6dd2a1cd69ac417ad23a037bcc1538e210047d

Download Submit
C:\Windows\system\ChiHXvi.exe

Filesize
1.8MB

MD5
c31bd24df85bde5b7deae1dd50e2f73b

SHA1
f210c29cf57a7fc77f0f9becb3ccc8ff97e104e9

SHA256
4291906b3f16dc9df5a49ea8a0e2a62e220dfb4e8dab848b64ee57c4ee3fa975

SHA512
692219d893a2679571de566855f56e64af170479aa795fbdcd93eabd3ddfbf993f19e7103d3bbb1ac838a802a97412f4629f671f5d9044a7a562738d75bdf328

Download Submit
C:\Windows\system\CzHufZq.exe

Filesize
1.8MB

MD5
0fa1220b4d623403b4d1688b006ae159

SHA1
922eb4ca5a9ac6fdac6f351221e9a72e2c858d4c

SHA256
3f9490e9c74b82bf3d7a76733d01938745777f8e2fdcc18f63bb77f5c7334e20

SHA512
082b827f03563ce7ddd764641019e02ad43cc73f6af11c835b71fba3e81c9e42e38009a6c48a721b494d368dee4c038b087697fe0911fb7d75bc54380ce3eaf1

Download Submit
C:\Windows\system\GGMyPBt.exe

Filesize
1.8MB

MD5
3322b82a4ab44c876433110c859381f4

SHA1
41ca1af3a9a5d177da4a4a3d26a422e1086f71a0

SHA256
22831ed47e37bd4f531abdbb9678078fc40368fd3f0b89eb5baaf03eafeb6aab

SHA512
e5478a700f67ba5b67d7d9d5bec6e57188ce8a7a0a4e0a0c3cfaa5ed657e59ff033fe566b280b190ea3d40ff380e5b767c225d6d53fb6603e04aa1217e5f91e7

Download Submit
C:\Windows\system\GnCmmMO.exe

Filesize
1.8MB

MD5
26ed76eed3c83d987d37301a96d59072

SHA1
14f53518787321e87eee6722be4e4dd52c7be328

SHA256
30a6cf3d045a9b493bf222b887469275991f8e65066cdc980e5358f8ffe81aa0

SHA512
65e75df9c227b2c09412293f23584b50ba1b3d3becd79051a9d46dad989a4a79b18b8e4a747e77e87c85a442294e2e12e9087b7d57d774b51f051a030a772a59

Download Submit
C:\Windows\system\IvOrpcR.exe

Filesize
1.8MB

MD5
c7de265214a4d218427986abebf904aa

SHA1
2267b6d20db978bf0b671acf5503835f4de3b06e

SHA256
971e9a06b3360b5416894d811946a9ce96c00797166aefb3b01b2da22265ef75

SHA512
3c3e9834f92d151f86f46c435805ae79ac00a5b57ca1914ae17d148e7a2f78cb84b86db720ffb313d64d8349686db397eb257b2cba3582afab7d8988dca9f360

Download Submit
C:\Windows\system\JUAWOjZ.exe

Filesize
1.8MB

MD5
12e9fcdc7c2205b018f22b43d0e64026

SHA1
cce30e2f8b506aaa6cf6995bd6308529938f0721

SHA256
91d6ce2449f396ecad2b1f616177a8eb58f020d74cf3db7ab827d74e7bcd29b3

SHA512
39edcf126618a55524db93da47aaa19f073aec5e492cdfd615849b9b92f99b7c2f99bcc6c40946ebdf14effb5522a887bc9ccc190ec2256345e6a515b8823c50

Download Submit
C:\Windows\system\KnTILoh.exe

Filesize
1.8MB

MD5
b119029a615a9247f26911562ecfe071

SHA1
2773726604b9d7e079bccb62ecb240e0e2aebf0e

SHA256
63536e7319f9cc71e758c543e28eb47f1c1bc48a12f07cb072f90540b9de2866

SHA512
207e89c03b9ac5f1f59d11655071ceebb78192cda3da126b18e24a6967cb377af47785e362f8877409393e841425e80c6d0c69ece5a542a8c3edc74293a5d4f5

Download Submit
C:\Windows\system\Mwumrnw.exe

Filesize
1.8MB

MD5
6f15207b0bf2ac5edbf66b19b9108a05

SHA1
31b51477ae6bdafc496378f2b12ba8299f380fb6

SHA256
6cb26736651c7971a0d55e9db84ec6f92c3366add1189e99539013e700e4c378

SHA512
5eb283ce9f007f333e2bea51199ee508a81bf88d323cfceea4d800e801b426f87d9a6f22573d5ba60e0619bff7cf716578fd2b052de6fa941166cfa46ae9b5df

Download Submit
C:\Windows\system\NSAqaNs.exe

Filesize
1.8MB

MD5
891af1de981de23c671180fa8be14e08

SHA1
186e16ab7bb32f7995b1a1bce73e4ff941d44eb3

SHA256
67db5e7c54d9e8646829bbbc1242df270e891a9b5b98d9388c220d319a68f9d1

SHA512
801febe84d113496d5e70c8be54fbc9e928558533a6672eb01640aec0c390884459ea4ca28638892a61236386f58316189bd67c47f3e0b71074859e44976e809

Download Submit
C:\Windows\system\QuWCSYU.exe

Filesize
1.8MB

MD5
88a04df59e617555583b025a4e1f3f19

SHA1
3da4ef9ab427cbca49ccdffbada80f6b3328a291

SHA256
7ac9dc44e62eb3479e0085ced30cf283878701c79a74fe407596da89ded0a907

SHA512
8689ce84c0993387b9cedc6b2c3c328602b82c00ce1bd77fee3ee732d3938e505ff1a3b26ab1bc4382ee644a89e69d99a522dcaaef008af5dc680c442b72e835

Download Submit
C:\Windows\system\ThsWicY.exe

Filesize
1.8MB

MD5
bce03eb00c93fcbf89bdbad3a7b09e9d

SHA1
e3c44717cd937fe011381cf8ef4eca5669a2a8a2

SHA256
cb550a1b05d28895f139ec2bfaf14714f758c9dfdf041777f62320bdc6d610ad

SHA512
1c5e7ac3b22838eb1ae3e1ee1ffff5663e4c0375f52fefd672b53cd6460a2eaf5b0def04a72ecc38c5bd44594314cfb940d5db4148f85564342d4bf0219ae548

Download Submit
C:\Windows\system\VGAdvTA.exe

Filesize
1.8MB

MD5
30eb7ca3f230735558b8b5fd8a355f5e

SHA1
3194f269da32bf500471e4a30b4cd65c41594885

SHA256
a680047563d61d915d7a148a8d9c1c786f9cf4f64d2b790ee7bb41df9c2c56a2

SHA512
9af74ca8108069ccc8df458d5c15e2cc316d96d728a2f6544ff8252fd6a2a8c171b5f4fe4071e660eadc9a9014bb7825c8afd7fd29690da94fddcb8b495d1aff

Download Submit
C:\Windows\system\WVTKjGv.exe

Filesize
1.8MB

MD5
92a1b1636ded8967615e81bc3b395825

SHA1
24867dac727e22286e898e98d90e88101d7bbf10

SHA256
3cad9acc57d54be15d76aad49be9a07af0da260e70a7aeda84ec08cdf739e544

SHA512
928cc68b5d43047ce969e8a4661e6a219419c78e15ad8b2499b309ce9043d53108fee42f5df0b75e0933ac2bdd9cd6c8bd82e67525108fba45ba4a9016871f02

Download Submit
C:\Windows\system\XJkaJCH.exe

Filesize
1.8MB

MD5
1678ab346a2e97cdd74b63d2c201cd7c

SHA1
37a42902aa80db62af06ef00e3647e3401c7afb9

SHA256
10d51a1211e984af4b7140891237fc9f7f6cd5619fb5c5a95a0ce1714876f6b5

SHA512
61362b004a3244aa759e7de4cd025de57b01722dbd4947a71fdd6a720cb7ab365c125b63cd4f80519ed20cd8d6bcba527f7c7bd3ddfe7bc038d521f180b9d3f0

Download Submit
C:\Windows\system\YLwjHBR.exe

Filesize
1.8MB

MD5
75be81fddd5d2041762db1ba834d4712

SHA1
8208612c69c6ba48a8311ad2e97ffd53e65b5e3b

SHA256
b1bd9423b5b0f0dee729678b8c4f05fcc74c80abbfc87938ece69ce291a0ef49

SHA512
114d4e534e7261da5b3c76ada4a3b9d4039e2c35bffb11b5f829789835089b854edff1ce1ea6c8fd2871ad63cf30f55bbce02b575e61124ff8cf7eb1b0c57fd9

Download Submit
C:\Windows\system\ZqGCdOR.exe

Filesize
1.8MB

MD5
32959a01ea54a202b567de34ec7bc560

SHA1
7836e4ab65780666c84f58be280371a548163e2b

SHA256
24a1236c9e43e6f5161200ad39adec6b265c5481b37879e46e9e7a9e975298f2

SHA512
67db0623d1e3645a098369e9e15a98611984d13fc81cc01891f3cd1096601d720c9102780edf7a3d622c58ece79eb2302a069e07c79194c0639976d0ee454f8b

Download Submit
C:\Windows\system\aEPJvJQ.exe

Filesize
1.8MB

MD5
23968980f346f12306be9a8212281b91

SHA1
c555251929d2b56723eb590a7492c67a1a529ade

SHA256
9888b1fb4640c1c8eda0b1e0e0826c03d825b6c8ae74a61272479f95547270d4

SHA512
2ac6b46c731f63ba6214a84243390fb0f170b007500c50444d4ba2a8184b45c1939bf0e9d9d3f6d7327c5caccb930e1d570d20ef2211e05e5078a292eeadebcc

Download Submit
C:\Windows\system\bGRRWfl.exe

Filesize
1.8MB

MD5
34ed79585b3c030df477d182219f11ee

SHA1
e01cd4313feceeb081886a42156934367b522e93

SHA256
46769155205ceb5d96e09b50ab11d41f6bea5fe67bbe04b3798584eac68eb167

SHA512
2da9e0430738edb79e640375d5e51399eafffd8cfd1fd24b4b3fecc9c0e7dc2621263545c76bcf5b41155e1ee631a33ca039d1a0298d20e9f33382b18e2d261f

Download Submit
C:\Windows\system\bqCRDUC.exe

Filesize
1.8MB

MD5
7e6f4e4567eada7391cdebe896855cd0

SHA1
0fa198055185d7b37ed69b59afd129c23ae4e327

SHA256
c01203b3c0afbbf38498b9b00c64da4a81f752a6faf0361486dd2380e8576539

SHA512
5f4fa00158a82b29a0996bc1be1ff171b822db66dd3bbcdfa2a3ecd4307c2e42edf6f8da403cb375898e40d9c2038d55c3066acb58492039a136a06af872d851

Download Submit
C:\Windows\system\fuRZtLJ.exe

Filesize
1.8MB

MD5
59282fdab3f9b8787b4e0a1a8ca1f98a

SHA1
8d857c1c2f9b36931fc03a3ad4d631c43db41a7a

SHA256
2946eb59005479679988f57b74325b175341add829591c8dd12ddc89ac43e20a

SHA512
0e960ae48e8cb36a45104e8b1eedc186847a9a3621d4b73ceca67987ca2c0588f91ca304fea47d8e88ea1c53c2a26372bd0bcdca2f1f79caddb9faf7232b1940

Download Submit
C:\Windows\system\ggrTwaT.exe

Filesize
1.8MB

MD5
38e599731fd4d6d752335dfcc2684b79

SHA1
9d3253be623bad6567bdba2c10a850197d7650e8

SHA256
77cbbac125b573e8b26daf9c999e97968bd2113a2a5c7354974ff25ef96c7962

SHA512
6d4c1dac21a0dbac58fad7622c11cb10b4720c447590cb1abb5379a7aa841275f247971b3622f2a6207f5b590226f7be5175ff1b0642c87120e854d860391db2

Download Submit
C:\Windows\system\iWmERYE.exe

Filesize
1.8MB

MD5
d2a08ad8ed7e50bbc3e2be66f5208d91

SHA1
aca6dbd9623417a054c780363a69a1e206cfd307

SHA256
c18d8980436a3c11c6d133f182095321b4d88224dc8bbd87fee1d5fae02b35b0

SHA512
97a1c27f4d0ae45a8129ebe30408b4c9612c1ebab448ef47d1a713a803ef606148fed050d8070a98fd09cce3792ac5fad02515af27ceb38c72d87c5b0d1ddccf

Download Submit
C:\Windows\system\kWlDJLp.exe

Filesize
1.8MB

MD5
48600d846a5185fcb0107d657e6407a7

SHA1
60a794fd1244af10a1aed63ae08a128d472d491b

SHA256
7b69685117c09e34fca9e9d190f3d30e40bc1f12c551ea91bfa7b9197499533f

SHA512
371009e7dc889ce5bb7662869719dbbfae234620f7c9d850ac6896384a7c904aafbbccc0dad48d0b360dca24448762ca692ac14d5095674755bc31f19ffe3911

Download Submit
C:\Windows\system\mvwYEgf.exe

Filesize
1.8MB

MD5
8de5f7406c9bf52b0f7cbb5eee45a7fe

SHA1
3e7b384fcb05b41dd7d83713e5993f0bb2f8f32f

SHA256
597a02bc57e215fa30ab219ddf188ede69b007009820df655b7557038fadffba

SHA512
8a37af62d464d5bb12b222a337c160c27f307cd547f237746a09a25afba0a2dd10294d92a36eff6aa48e80adb4d6ff74779f9efc5dcb7a7286f54afd5ad25fe1

Download Submit
C:\Windows\system\pNiQqBG.exe

Filesize
1.8MB

MD5
2b5cb184607397f73f92c6f948ddcaf6

SHA1
82bfd8793ba1e775a057b2a430cee49ee167c7e5

SHA256
dec0a4bdacb8335f07d380c5fd305f214cfaf7d131cdd3b1dab6c9c512c51f9f

SHA512
cc7ec48d014a41f7bee77f0d1bfe9afe97f51e88bf47f0941b237c8b72412dcbec2800676c4fd966c992c207ce85f92d8fe4b2c27f60255359745c3588ed15f2

Download Submit
C:\Windows\system\sCoUkkV.exe

Filesize
1.8MB

MD5
6d13df3fdd23f5e7b820b2bf73f50450

SHA1
6e8bc607c25bb065c7eef808b8e635932839b86d

SHA256
41204409fd9d527253ad4e6a96259c6c904610d608d50c88dcba60e28e2db626

SHA512
a4c994b2c2695a8e5fd44d49e7887a1ce30621347f3bfd92acdef2bff37d32c842848f2294072cba1474d375a92e36b58b1a425cd3cc6256d2dbf405f4103911

Download Submit
C:\Windows\system\xIHcFXL.exe

Filesize
1.8MB

MD5
5e22e33b78bfcb7a5ae384adb3cf4a61

SHA1
a7dc83fce1b7cd0d6e3e77bd3fa6810a179c79f9

SHA256
7bd81feecaa44ac645a02e2afa2add1112528210d25a7ea2ed0e93db0204103c

SHA512
622baadee35a80ecaa576520cd70d2ff7f8db9e2c0f77ffa7f7d22208b34ba5298b14149e2ad0960fb5df593ee2126237af2897767007459a57d5efa3891a075

Download Submit
C:\Windows\system\zXlITwb.exe

Filesize
1.8MB

MD5
dbc8813e8d652c9fc77f35e037eca8e4

SHA1
428bd028392b29111fde556a32f727599eeb1dea

SHA256
2d392747daf5f85b93b918337d495d8398445be18249b00d59e7bb2bec45945a

SHA512
e658f608e142e52de097307748cad94376036a289f432edcb5beda433ff8be13201ca6e2f1e436b4c08809990f22fa8a9e839abb1bbdbfd239115db402961d20

Download Submit
\Windows\system\MZmBrMp.exe

Filesize
1.8MB

MD5
89ddcf5677b6097f3006796bf47d7a9b

SHA1
0ca5fc9ba1408e2c909bfbc8dd27496744b9927e

SHA256
dd318e2548cda2c91d3e876d6b6d18a620aebd54d2aec3fbbe8aedfb8be935a4

SHA512
dc1bb63bb4a59c1276de10c0ee19a8acb6ac2bc5992b69dbb9fc9cb4f1a7fc2e892bebafed72cebbfbef8d850fd4c34f6c5a5f40cf6608342acac34efdb10632

Download Submit
\Windows\system\uEsruAx.exe

Filesize
1.8MB

MD5
235c256856151a3158bc25fda9115cd1

SHA1
5391ae621c0e02120710da7b74b2ef3e78a63259

SHA256
15f93b1ffaa6b56fcbf8db122c88fdf3f4a8f44a6fe81767d91afb6322c5f069

SHA512
411121d13cfa9e0510aa0c049caa280cdbccaa306b914fdde3222178959b6779aca36e84d679337c0c701e6fb04f388fa54e8a045725ebb625f04f72f30d204b

Download Submit
memory/1720-228-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-28-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-7-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/1720-226-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1720-1779-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-43-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-1-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-246-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1720-234-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-252-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-14-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-23-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/1848-230-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1848-4010-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1952-42-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/1952-41-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2276-33-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2572-244-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2660-19-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-3564-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-3799-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4017-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2744-251-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2748-248-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4013-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-4011-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2804-214-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2820-22-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2820-3704-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2832-8-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-3733-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-1858-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-4009-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/3028-225-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/3040-227-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/3040-4057-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/3068-253-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-4018-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download