xmrig | a433e43ae8fc2a0215f02409bc1bf9cda6c751106ca9603127d06d75fd359ab8

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
Size

1.9MB
MD5

018038a1c98f481f5fd563e4c3cf9737
SHA1

fa558cbac9f30b14b9f964845a590bc13e1f681e
SHA256

a433e43ae8fc2a0215f02409bc1bf9cda6c751106ca9603127d06d75fd359ab8
SHA512

0f966d7d4065df8291d455d07e191e4a10cc875ee832313411164da53cb62df67710346eb38d3da6caaf6177c19bdb8efbf9f357a4ddf5be63723e077dd330b7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U4:NABr

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral1/memory/2940-9-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2524-26-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2888-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/576-70-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2008-243-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2640-226-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/1524-262-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2040-248-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2320-247-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2700-236-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/1960-245-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2864-238-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/1576-235-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/240-234-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2524-227-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/1524-224-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/1412-242-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2444-240-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2384-64-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2424-62-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2844-43-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2544-51-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2888-1601-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2544-1681-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2524-1760-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2940-1752-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/576-1746-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2424-2168-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2844-2248-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2384-2252-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2640-2990-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2940	GgOCjax.exe
2640	zgTLEyF.exe
2524	sSZyWRb.exe
2844	vIoXWTf.exe
2544	zCgKhYd.exe
2888	oDOyTEi.exe
2424	SeUqdOs.exe
2384	mQTXtDm.exe
576	VCEUhyP.exe
240	rdstabE.exe
1576	fPiQzTe.exe
2700	nBShOOG.exe
2864	qZoaiuL.exe
2444	tJzNPpA.exe
1412	OtcwLwr.exe
2008	eTdhsMx.exe
1960	vZwSZer.exe
2320	VQWlpRb.exe
2040	DCsBAED.exe
1344	EhMflKb.exe
1980	bAkXmtY.exe
656	ToFOqxb.exe
2644	DJisoHf.exe
2280	rOFtMbR.exe
1776	GLcAgpM.exe
1748	SzkDRHa.exe
320	nNhChGA.exe
928	ufLMypx.exe
2112	WiYNziM.exe
1728	QPQTRTy.exe
2772	evuibje.exe
1812	uOtuKPw.exe
640	oyxPOMC.exe
2136	FSDaHmc.exe
2272	fJoUvhL.exe
1828	oRXHUtS.exe
1836	PdMINwp.exe
1532	DXWHigh.exe
1680	OvOzkLp.exe
1632	HivLpiP.exe
1116	PpTsqLM.exe
1656	xBEsaHt.exe
284	aXOCyqE.exe
956	RIUynhz.exe
2064	HGouCws.exe
1744	xAWyaAs.exe
2332	yDHODks.exe
1624	mmEIPKR.exe
2948	NCGFABp.exe
3016	FKMcOYy.exe
1080	dPwwWGG.exe
2584	rCLsMqr.exe
2752	iWUgRFt.exe
2564	wxorZmB.exe
2520	ORKMDXH.exe
2620	ziKNSzT.exe
2876	vMKfXFd.exe
2836	nLRUDpD.exe
524	DogPmOF.exe
1004	GRLPUGw.exe
1040	HotXKHa.exe
2840	kQLEkNO.exe
1452	uQlhzYH.exe
1664	dARkPVN.exe

Loads dropped DLL 64 IoCs

pid	Process
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1524-0-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x000c0000000132c6-3.dat	upx
behavioral1/memory/2940-9-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x002d0000000134ad-10.dat	upx
behavioral1/memory/2640-15-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x000a0000000139d6-24.dat	upx
behavioral1/memory/2524-26-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-30.dat	upx
behavioral1/files/0x0009000000013a4d-31.dat	upx
behavioral1/memory/2888-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x0013000000013721-58.dat	upx
behavioral1/memory/576-70-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/files/0x0006000000015cb9-84.dat	upx
behavioral1/files/0x0006000000015db4-94.dat	upx
behavioral1/files/0x0006000000015e41-104.dat	upx
behavioral1/files/0x0006000000015e5b-109.dat	upx
behavioral1/files/0x0006000000015e7c-119.dat	upx
behavioral1/files/0x0006000000015eaf-124.dat	upx
behavioral1/files/0x0006000000016c10-186.dat	upx
behavioral1/memory/2008-243-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2640-226-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/1524-262-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2040-248-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2320-247-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2700-236-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/1960-245-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2864-238-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/1576-235-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/240-234-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2524-227-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/1524-224-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/1412-242-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/memory/2444-240-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0006000000016b5e-174.dat	upx
behavioral1/files/0x0006000000016b96-181.dat	upx
behavioral1/files/0x00060000000167db-171.dat	upx
behavioral1/files/0x000600000001663d-166.dat	upx
behavioral1/files/0x0006000000016283-155.dat	upx
behavioral1/files/0x0006000000016476-151.dat	upx
behavioral1/files/0x0006000000016042-145.dat	upx
behavioral1/files/0x00060000000165ae-159.dat	upx
behavioral1/files/0x0006000000016332-148.dat	upx
behavioral1/files/0x000600000001604b-139.dat	upx
behavioral1/files/0x0006000000015ec0-129.dat	upx
behavioral1/files/0x0006000000015e6f-114.dat	upx
behavioral1/files/0x0006000000015e02-99.dat	upx
behavioral1/files/0x0006000000015d88-89.dat	upx
behavioral1/files/0x0006000000015c7c-75.dat	upx
behavioral1/files/0x0006000000015c87-79.dat	upx
behavioral1/memory/2384-64-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2424-62-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x0006000000015c69-67.dat	upx
behavioral1/memory/2844-43-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x00070000000140f2-38.dat	upx
behavioral1/memory/2544-51-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x000800000001450f-50.dat	upx
behavioral1/memory/2888-1601-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2544-1681-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2524-1760-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2940-1752-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/576-1746-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2424-2168-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2844-2248-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2384-2252-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vEbmJvr.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\krtyqOO.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\HbXZiAY.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\NXIataw.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\njHBfpm.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\VYLRxbF.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\vQSpSec.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\KQwaEvG.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\VJLjBAp.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\cTVEWXv.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\MNskQTg.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\esfyAAd.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\GUXaRwT.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\PpTsqLM.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\WIMwZLb.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\wPjwpoj.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\VZJchfN.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\UcXkNyr.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\XnLuJDj.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\dnXyXiN.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\ZpyyGMD.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\UxLBKWr.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\cclryIr.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\QAeZMQN.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\eyYkqqd.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\oVpvWPj.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\imiGtev.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\FfmcDbt.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\avcnyuj.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\DogPmOF.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\crbSMzS.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\EQQpwAg.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\GOGLMUu.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\psNytnF.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\UYAIDkx.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\DMqydlM.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\JsulhxB.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\uFprBjB.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\FAGwvph.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\sRxZzBw.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\qIxzhCC.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\qGYNJyU.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\huyATwF.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\bwhYteX.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\aFJljTs.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\fJAwabi.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\wJfDTmm.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\NQcWddn.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\pckhdHB.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\MjhEbbk.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\KxrATYz.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\VnlDAoT.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\OLjqgHv.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\TPNkCNt.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\SLAcIJg.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\mvjLLVI.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\kXyyMbS.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\iKeKZpr.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\uWJUYVC.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\mkDAYYv.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\pGrFXVS.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\wdFQCyl.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\GLiLOGm.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
File created	C:\Windows\System\qZoaiuL.exe	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2152	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
Token: SeDebugPrivilege	2152	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2152	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	29
PID 1524 wrote to memory of 2152	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	29
PID 1524 wrote to memory of 2152	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	29
PID 1524 wrote to memory of 2940	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	30
PID 1524 wrote to memory of 2940	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	30
PID 1524 wrote to memory of 2940	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	30
PID 1524 wrote to memory of 2640	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	31
PID 1524 wrote to memory of 2640	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	31
PID 1524 wrote to memory of 2640	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	31
PID 1524 wrote to memory of 2524	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	32
PID 1524 wrote to memory of 2524	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	32
PID 1524 wrote to memory of 2524	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	32
PID 1524 wrote to memory of 2844	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	33
PID 1524 wrote to memory of 2844	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	33
PID 1524 wrote to memory of 2844	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	33
PID 1524 wrote to memory of 2544	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	34
PID 1524 wrote to memory of 2544	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	34
PID 1524 wrote to memory of 2544	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	34
PID 1524 wrote to memory of 2424	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	35
PID 1524 wrote to memory of 2424	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	35
PID 1524 wrote to memory of 2424	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	35
PID 1524 wrote to memory of 2888	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	36
PID 1524 wrote to memory of 2888	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	36
PID 1524 wrote to memory of 2888	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	36
PID 1524 wrote to memory of 2384	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	37
PID 1524 wrote to memory of 2384	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	37
PID 1524 wrote to memory of 2384	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	37
PID 1524 wrote to memory of 576	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	38
PID 1524 wrote to memory of 576	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	38
PID 1524 wrote to memory of 576	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	38
PID 1524 wrote to memory of 240	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	39
PID 1524 wrote to memory of 240	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	39
PID 1524 wrote to memory of 240	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	39
PID 1524 wrote to memory of 1576	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	40
PID 1524 wrote to memory of 1576	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	40
PID 1524 wrote to memory of 1576	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	40
PID 1524 wrote to memory of 2700	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	41
PID 1524 wrote to memory of 2700	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	41
PID 1524 wrote to memory of 2700	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	41
PID 1524 wrote to memory of 2864	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	42
PID 1524 wrote to memory of 2864	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	42
PID 1524 wrote to memory of 2864	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	42
PID 1524 wrote to memory of 2444	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	43
PID 1524 wrote to memory of 2444	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	43
PID 1524 wrote to memory of 2444	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	43
PID 1524 wrote to memory of 1412	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	44
PID 1524 wrote to memory of 1412	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	44
PID 1524 wrote to memory of 1412	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	44
PID 1524 wrote to memory of 2008	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	45
PID 1524 wrote to memory of 2008	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	45
PID 1524 wrote to memory of 2008	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	45
PID 1524 wrote to memory of 1960	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	46
PID 1524 wrote to memory of 1960	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	46
PID 1524 wrote to memory of 1960	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	46
PID 1524 wrote to memory of 2320	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	47
PID 1524 wrote to memory of 2320	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	47
PID 1524 wrote to memory of 2320	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	47
PID 1524 wrote to memory of 2040	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	48
PID 1524 wrote to memory of 2040	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	48
PID 1524 wrote to memory of 2040	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	48
PID 1524 wrote to memory of 1344	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	49
PID 1524 wrote to memory of 1344	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	49
PID 1524 wrote to memory of 1344	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	49
PID 1524 wrote to memory of 1980	1524	018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\018038a1c98f481f5fd563e4c3cf9737_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\System\GgOCjax.exe
  C:\Windows\System\GgOCjax.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\zgTLEyF.exe
  C:\Windows\System\zgTLEyF.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\sSZyWRb.exe
  C:\Windows\System\sSZyWRb.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\vIoXWTf.exe
  C:\Windows\System\vIoXWTf.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\zCgKhYd.exe
  C:\Windows\System\zCgKhYd.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\SeUqdOs.exe
  C:\Windows\System\SeUqdOs.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\oDOyTEi.exe
  C:\Windows\System\oDOyTEi.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\mQTXtDm.exe
  C:\Windows\System\mQTXtDm.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\VCEUhyP.exe
  C:\Windows\System\VCEUhyP.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\rdstabE.exe
  C:\Windows\System\rdstabE.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\fPiQzTe.exe
  C:\Windows\System\fPiQzTe.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\nBShOOG.exe
  C:\Windows\System\nBShOOG.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\qZoaiuL.exe
  C:\Windows\System\qZoaiuL.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\tJzNPpA.exe
  C:\Windows\System\tJzNPpA.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\OtcwLwr.exe
  C:\Windows\System\OtcwLwr.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\eTdhsMx.exe
  C:\Windows\System\eTdhsMx.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\vZwSZer.exe
  C:\Windows\System\vZwSZer.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\VQWlpRb.exe
  C:\Windows\System\VQWlpRb.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\DCsBAED.exe
  C:\Windows\System\DCsBAED.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\EhMflKb.exe
  C:\Windows\System\EhMflKb.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\bAkXmtY.exe
  C:\Windows\System\bAkXmtY.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\DJisoHf.exe
  C:\Windows\System\DJisoHf.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ToFOqxb.exe
  C:\Windows\System\ToFOqxb.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\GLcAgpM.exe
  C:\Windows\System\GLcAgpM.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\rOFtMbR.exe
  C:\Windows\System\rOFtMbR.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\nNhChGA.exe
  C:\Windows\System\nNhChGA.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\SzkDRHa.exe
  C:\Windows\System\SzkDRHa.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\ufLMypx.exe
  C:\Windows\System\ufLMypx.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\WiYNziM.exe
  C:\Windows\System\WiYNziM.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\QPQTRTy.exe
  C:\Windows\System\QPQTRTy.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\evuibje.exe
  C:\Windows\System\evuibje.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\uOtuKPw.exe
  C:\Windows\System\uOtuKPw.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\oyxPOMC.exe
  C:\Windows\System\oyxPOMC.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\fJoUvhL.exe
  C:\Windows\System\fJoUvhL.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\FSDaHmc.exe
  C:\Windows\System\FSDaHmc.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\oRXHUtS.exe
  C:\Windows\System\oRXHUtS.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\PdMINwp.exe
  C:\Windows\System\PdMINwp.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\DXWHigh.exe
  C:\Windows\System\DXWHigh.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\OvOzkLp.exe
  C:\Windows\System\OvOzkLp.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\HivLpiP.exe
  C:\Windows\System\HivLpiP.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\PpTsqLM.exe
  C:\Windows\System\PpTsqLM.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\xBEsaHt.exe
  C:\Windows\System\xBEsaHt.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\aXOCyqE.exe
  C:\Windows\System\aXOCyqE.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\RIUynhz.exe
  C:\Windows\System\RIUynhz.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\HGouCws.exe
  C:\Windows\System\HGouCws.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\xAWyaAs.exe
  C:\Windows\System\xAWyaAs.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\yDHODks.exe
  C:\Windows\System\yDHODks.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\mmEIPKR.exe
  C:\Windows\System\mmEIPKR.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\NCGFABp.exe
  C:\Windows\System\NCGFABp.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\FKMcOYy.exe
  C:\Windows\System\FKMcOYy.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\dPwwWGG.exe
  C:\Windows\System\dPwwWGG.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\rCLsMqr.exe
  C:\Windows\System\rCLsMqr.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\iWUgRFt.exe
  C:\Windows\System\iWUgRFt.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\wxorZmB.exe
  C:\Windows\System\wxorZmB.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ORKMDXH.exe
  C:\Windows\System\ORKMDXH.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ziKNSzT.exe
  C:\Windows\System\ziKNSzT.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\vMKfXFd.exe
  C:\Windows\System\vMKfXFd.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\nLRUDpD.exe
  C:\Windows\System\nLRUDpD.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\DogPmOF.exe
  C:\Windows\System\DogPmOF.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\GRLPUGw.exe
  C:\Windows\System\GRLPUGw.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\HotXKHa.exe
  C:\Windows\System\HotXKHa.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\kQLEkNO.exe
  C:\Windows\System\kQLEkNO.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\uQlhzYH.exe
  C:\Windows\System\uQlhzYH.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\dARkPVN.exe
  C:\Windows\System\dARkPVN.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\PzzJOFq.exe
  C:\Windows\System\PzzJOFq.exe
  2⤵
  PID:1948
- C:\Windows\System\UNsJUcW.exe
  C:\Windows\System\UNsJUcW.exe
  2⤵
  PID:1984
- C:\Windows\System\ioYrLnh.exe
  C:\Windows\System\ioYrLnh.exe
  2⤵
  PID:1832
- C:\Windows\System\XptSGDj.exe
  C:\Windows\System\XptSGDj.exe
  2⤵
  PID:2608
- C:\Windows\System\WTxsPaE.exe
  C:\Windows\System\WTxsPaE.exe
  2⤵
  PID:1876
- C:\Windows\System\doNJYZw.exe
  C:\Windows\System\doNJYZw.exe
  2⤵
  PID:1988
- C:\Windows\System\BIagUwi.exe
  C:\Windows\System\BIagUwi.exe
  2⤵
  PID:1216
- C:\Windows\System\eFxCVHe.exe
  C:\Windows\System\eFxCVHe.exe
  2⤵
  PID:1580
- C:\Windows\System\kvDFMsA.exe
  C:\Windows\System\kvDFMsA.exe
  2⤵
  PID:2784
- C:\Windows\System\tBMNZnt.exe
  C:\Windows\System\tBMNZnt.exe
  2⤵
  PID:2100
- C:\Windows\System\QRMITAf.exe
  C:\Windows\System\QRMITAf.exe
  2⤵
  PID:436
- C:\Windows\System\swBWXal.exe
  C:\Windows\System\swBWXal.exe
  2⤵
  PID:632
- C:\Windows\System\spruBdK.exe
  C:\Windows\System\spruBdK.exe
  2⤵
  PID:1512
- C:\Windows\System\cTVEWXv.exe
  C:\Windows\System\cTVEWXv.exe
  2⤵
  PID:2852
- C:\Windows\System\dOlSaJN.exe
  C:\Windows\System\dOlSaJN.exe
  2⤵
  PID:944
- C:\Windows\System\YiAlBgr.exe
  C:\Windows\System\YiAlBgr.exe
  2⤵
  PID:2324
- C:\Windows\System\DMqydlM.exe
  C:\Windows\System\DMqydlM.exe
  2⤵
  PID:2084
- C:\Windows\System\QdGZIAR.exe
  C:\Windows\System\QdGZIAR.exe
  2⤵
  PID:1640
- C:\Windows\System\UqdVIZk.exe
  C:\Windows\System\UqdVIZk.exe
  2⤵
  PID:2108
- C:\Windows\System\xAkIhMM.exe
  C:\Windows\System\xAkIhMM.exe
  2⤵
  PID:2780
- C:\Windows\System\GgMaPqU.exe
  C:\Windows\System\GgMaPqU.exe
  2⤵
  PID:1096
- C:\Windows\System\ITUIdGb.exe
  C:\Windows\System\ITUIdGb.exe
  2⤵
  PID:3020
- C:\Windows\System\vqjbpCb.exe
  C:\Windows\System\vqjbpCb.exe
  2⤵
  PID:1268
- C:\Windows\System\EnGMfVD.exe
  C:\Windows\System\EnGMfVD.exe
  2⤵
  PID:2464
- C:\Windows\System\ZzScphi.exe
  C:\Windows\System\ZzScphi.exe
  2⤵
  PID:932
- C:\Windows\System\DSmdivp.exe
  C:\Windows\System\DSmdivp.exe
  2⤵
  PID:2284
- C:\Windows\System\BWvVadz.exe
  C:\Windows\System\BWvVadz.exe
  2⤵
  PID:1592
- C:\Windows\System\ijsPwfL.exe
  C:\Windows\System\ijsPwfL.exe
  2⤵
  PID:2680
- C:\Windows\System\GrfHKas.exe
  C:\Windows\System\GrfHKas.exe
  2⤵
  PID:1732
- C:\Windows\System\eyYkqqd.exe
  C:\Windows\System\eyYkqqd.exe
  2⤵
  PID:2012
- C:\Windows\System\IfUNocj.exe
  C:\Windows\System\IfUNocj.exe
  2⤵
  PID:2392
- C:\Windows\System\gMTuBvj.exe
  C:\Windows\System\gMTuBvj.exe
  2⤵
  PID:1188
- C:\Windows\System\czyWyJo.exe
  C:\Windows\System\czyWyJo.exe
  2⤵
  PID:2044
- C:\Windows\System\lAejIHO.exe
  C:\Windows\System\lAejIHO.exe
  2⤵
  PID:1328
- C:\Windows\System\zKLUCQL.exe
  C:\Windows\System\zKLUCQL.exe
  2⤵
  PID:1076
- C:\Windows\System\cIoZhIi.exe
  C:\Windows\System\cIoZhIi.exe
  2⤵
  PID:616
- C:\Windows\System\FmwNmTE.exe
  C:\Windows\System\FmwNmTE.exe
  2⤵
  PID:1400
- C:\Windows\System\VrHSWmC.exe
  C:\Windows\System\VrHSWmC.exe
  2⤵
  PID:2648
- C:\Windows\System\IrYQQsY.exe
  C:\Windows\System\IrYQQsY.exe
  2⤵
  PID:884
- C:\Windows\System\kBznddN.exe
  C:\Windows\System\kBznddN.exe
  2⤵
  PID:2080
- C:\Windows\System\nAwiYNX.exe
  C:\Windows\System\nAwiYNX.exe
  2⤵
  PID:1708
- C:\Windows\System\OxYTwnb.exe
  C:\Windows\System\OxYTwnb.exe
  2⤵
  PID:2908
- C:\Windows\System\KRbteIW.exe
  C:\Windows\System\KRbteIW.exe
  2⤵
  PID:3068
- C:\Windows\System\supseBs.exe
  C:\Windows\System\supseBs.exe
  2⤵
  PID:1264
- C:\Windows\System\GAlTvnE.exe
  C:\Windows\System\GAlTvnE.exe
  2⤵
  PID:1604
- C:\Windows\System\dJWDzum.exe
  C:\Windows\System\dJWDzum.exe
  2⤵
  PID:808
- C:\Windows\System\NhYoTjS.exe
  C:\Windows\System\NhYoTjS.exe
  2⤵
  PID:1684
- C:\Windows\System\fFzPngv.exe
  C:\Windows\System\fFzPngv.exe
  2⤵
  PID:1976
- C:\Windows\System\EToRcqP.exe
  C:\Windows\System\EToRcqP.exe
  2⤵
  PID:2536
- C:\Windows\System\VBNdzqf.exe
  C:\Windows\System\VBNdzqf.exe
  2⤵
  PID:2628
- C:\Windows\System\CqCBSOp.exe
  C:\Windows\System\CqCBSOp.exe
  2⤵
  PID:2580
- C:\Windows\System\AevVMDd.exe
  C:\Windows\System\AevVMDd.exe
  2⤵
  PID:2468
- C:\Windows\System\YyHVNsl.exe
  C:\Windows\System\YyHVNsl.exe
  2⤵
  PID:784
- C:\Windows\System\txODmEB.exe
  C:\Windows\System\txODmEB.exe
  2⤵
  PID:2712
- C:\Windows\System\IjquldT.exe
  C:\Windows\System\IjquldT.exe
  2⤵
  PID:1636
- C:\Windows\System\pppyiDD.exe
  C:\Windows\System\pppyiDD.exe
  2⤵
  PID:1724
- C:\Windows\System\zoRTXAR.exe
  C:\Windows\System\zoRTXAR.exe
  2⤵
  PID:1084
- C:\Windows\System\OwFJSDj.exe
  C:\Windows\System\OwFJSDj.exe
  2⤵
  PID:836
- C:\Windows\System\xolJzeK.exe
  C:\Windows\System\xolJzeK.exe
  2⤵
  PID:2672
- C:\Windows\System\FAWYiMy.exe
  C:\Windows\System\FAWYiMy.exe
  2⤵
  PID:2976
- C:\Windows\System\bnFlPrx.exe
  C:\Windows\System\bnFlPrx.exe
  2⤵
  PID:1968
- C:\Windows\System\gJtnLEJ.exe
  C:\Windows\System\gJtnLEJ.exe
  2⤵
  PID:1700
- C:\Windows\System\sNyYETh.exe
  C:\Windows\System\sNyYETh.exe
  2⤵
  PID:1672
- C:\Windows\System\aiifyfZ.exe
  C:\Windows\System\aiifyfZ.exe
  2⤵
  PID:2808
- C:\Windows\System\jSgEyUF.exe
  C:\Windows\System\jSgEyUF.exe
  2⤵
  PID:3004
- C:\Windows\System\njHBfpm.exe
  C:\Windows\System\njHBfpm.exe
  2⤵
  PID:2748
- C:\Windows\System\VTZegwy.exe
  C:\Windows\System\VTZegwy.exe
  2⤵
  PID:1476
- C:\Windows\System\vdGUMwE.exe
  C:\Windows\System\vdGUMwE.exe
  2⤵
  PID:2016
- C:\Windows\System\iEhwYjv.exe
  C:\Windows\System\iEhwYjv.exe
  2⤵
  PID:2372
- C:\Windows\System\OZKvcqr.exe
  C:\Windows\System\OZKvcqr.exe
  2⤵
  PID:2552
- C:\Windows\System\QAWeCBA.exe
  C:\Windows\System\QAWeCBA.exe
  2⤵
  PID:1556
- C:\Windows\System\cOJSTOX.exe
  C:\Windows\System\cOJSTOX.exe
  2⤵
  PID:2856
- C:\Windows\System\deSNsiq.exe
  C:\Windows\System\deSNsiq.exe
  2⤵
  PID:2268
- C:\Windows\System\QVnGkdG.exe
  C:\Windows\System\QVnGkdG.exe
  2⤵
  PID:828
- C:\Windows\System\DwEyrPB.exe
  C:\Windows\System\DwEyrPB.exe
  2⤵
  PID:2448
- C:\Windows\System\kSEuEPN.exe
  C:\Windows\System\kSEuEPN.exe
  2⤵
  PID:2248
- C:\Windows\System\cqdMIgA.exe
  C:\Windows\System\cqdMIgA.exe
  2⤵
  PID:2532
- C:\Windows\System\ODoLxBo.exe
  C:\Windows\System\ODoLxBo.exe
  2⤵
  PID:2260
- C:\Windows\System\Qstcibg.exe
  C:\Windows\System\Qstcibg.exe
  2⤵
  PID:1432
- C:\Windows\System\PJlmcTp.exe
  C:\Windows\System\PJlmcTp.exe
  2⤵
  PID:2676
- C:\Windows\System\xGESWAu.exe
  C:\Windows\System\xGESWAu.exe
  2⤵
  PID:2764
- C:\Windows\System\sXZHPyI.exe
  C:\Windows\System\sXZHPyI.exe
  2⤵
  PID:2956
- C:\Windows\System\eeUvGJO.exe
  C:\Windows\System\eeUvGJO.exe
  2⤵
  PID:1660
- C:\Windows\System\aNgtCzX.exe
  C:\Windows\System\aNgtCzX.exe
  2⤵
  PID:2488
- C:\Windows\System\jpKueDc.exe
  C:\Windows\System\jpKueDc.exe
  2⤵
  PID:2892
- C:\Windows\System\JHKDOfl.exe
  C:\Windows\System\JHKDOfl.exe
  2⤵
  PID:1324
- C:\Windows\System\LThfdsy.exe
  C:\Windows\System\LThfdsy.exe
  2⤵
  PID:2312
- C:\Windows\System\KFqWVwB.exe
  C:\Windows\System\KFqWVwB.exe
  2⤵
  PID:2932
- C:\Windows\System\tjAOERt.exe
  C:\Windows\System\tjAOERt.exe
  2⤵
  PID:2124
- C:\Windows\System\UElxViV.exe
  C:\Windows\System\UElxViV.exe
  2⤵
  PID:1716
- C:\Windows\System\SmodbGU.exe
  C:\Windows\System\SmodbGU.exe
  2⤵
  PID:1992
- C:\Windows\System\uZhhkZg.exe
  C:\Windows\System\uZhhkZg.exe
  2⤵
  PID:1352
- C:\Windows\System\WMYelNU.exe
  C:\Windows\System\WMYelNU.exe
  2⤵
  PID:1608
- C:\Windows\System\fnVwkxK.exe
  C:\Windows\System\fnVwkxK.exe
  2⤵
  PID:2652
- C:\Windows\System\CmxHFxG.exe
  C:\Windows\System\CmxHFxG.exe
  2⤵
  PID:3080
- C:\Windows\System\EGCIMZP.exe
  C:\Windows\System\EGCIMZP.exe
  2⤵
  PID:3148
- C:\Windows\System\YjPpuys.exe
  C:\Windows\System\YjPpuys.exe
  2⤵
  PID:3496
- C:\Windows\System\FsWElHI.exe
  C:\Windows\System\FsWElHI.exe
  2⤵
  PID:3512
- C:\Windows\System\yzpcoIf.exe
  C:\Windows\System\yzpcoIf.exe
  2⤵
  PID:3528
- C:\Windows\System\XAFXHLQ.exe
  C:\Windows\System\XAFXHLQ.exe
  2⤵
  PID:3544
- C:\Windows\System\fkfrrVL.exe
  C:\Windows\System\fkfrrVL.exe
  2⤵
  PID:3560
- C:\Windows\System\yBEcThG.exe
  C:\Windows\System\yBEcThG.exe
  2⤵
  PID:3580
- C:\Windows\System\BfegEhV.exe
  C:\Windows\System\BfegEhV.exe
  2⤵
  PID:3596
- C:\Windows\System\qIgYRTv.exe
  C:\Windows\System\qIgYRTv.exe
  2⤵
  PID:3616
- C:\Windows\System\VLiAWfF.exe
  C:\Windows\System\VLiAWfF.exe
  2⤵
  PID:3632
- C:\Windows\System\omdnzbY.exe
  C:\Windows\System\omdnzbY.exe
  2⤵
  PID:3648
- C:\Windows\System\zQbBWFY.exe
  C:\Windows\System\zQbBWFY.exe
  2⤵
  PID:3700
- C:\Windows\System\JTavurP.exe
  C:\Windows\System\JTavurP.exe
  2⤵
  PID:3716
- C:\Windows\System\ikXlMwc.exe
  C:\Windows\System\ikXlMwc.exe
  2⤵
  PID:3736
- C:\Windows\System\tNGMNtu.exe
  C:\Windows\System\tNGMNtu.exe
  2⤵
  PID:3752
- C:\Windows\System\fVgpoTT.exe
  C:\Windows\System\fVgpoTT.exe
  2⤵
  PID:3768
- C:\Windows\System\NNPHuMq.exe
  C:\Windows\System\NNPHuMq.exe
  2⤵
  PID:3784
- C:\Windows\System\uqSMyge.exe
  C:\Windows\System\uqSMyge.exe
  2⤵
  PID:3800
- C:\Windows\System\BpZfQPM.exe
  C:\Windows\System\BpZfQPM.exe
  2⤵
  PID:3816
- C:\Windows\System\xoWAOlh.exe
  C:\Windows\System\xoWAOlh.exe
  2⤵
  PID:3832
- C:\Windows\System\XoAOmkp.exe
  C:\Windows\System\XoAOmkp.exe
  2⤵
  PID:3848
- C:\Windows\System\HYFAsKF.exe
  C:\Windows\System\HYFAsKF.exe
  2⤵
  PID:3864
- C:\Windows\System\BOwOpzo.exe
  C:\Windows\System\BOwOpzo.exe
  2⤵
  PID:3884
- C:\Windows\System\kjSgDjo.exe
  C:\Windows\System\kjSgDjo.exe
  2⤵
  PID:3900
- C:\Windows\System\MYatWdX.exe
  C:\Windows\System\MYatWdX.exe
  2⤵
  PID:3916
- C:\Windows\System\RPBnArr.exe
  C:\Windows\System\RPBnArr.exe
  2⤵
  PID:3932
- C:\Windows\System\WWnYhQM.exe
  C:\Windows\System\WWnYhQM.exe
  2⤵
  PID:3952
- C:\Windows\System\tkZnLwv.exe
  C:\Windows\System\tkZnLwv.exe
  2⤵
  PID:3968
- C:\Windows\System\aZJUESG.exe
  C:\Windows\System\aZJUESG.exe
  2⤵
  PID:4036
- C:\Windows\System\gmHmHxT.exe
  C:\Windows\System\gmHmHxT.exe
  2⤵
  PID:4052
- C:\Windows\System\fCLRcQx.exe
  C:\Windows\System\fCLRcQx.exe
  2⤵
  PID:4076
- C:\Windows\System\tpwCHbh.exe
  C:\Windows\System\tpwCHbh.exe
  2⤵
  PID:2380
- C:\Windows\System\VpRwfPk.exe
  C:\Windows\System\VpRwfPk.exe
  2⤵
  PID:2188
- C:\Windows\System\anSyPoG.exe
  C:\Windows\System\anSyPoG.exe
  2⤵
  PID:1804
- C:\Windows\System\PFoztBv.exe
  C:\Windows\System\PFoztBv.exe
  2⤵
  PID:2776
- C:\Windows\System\lWMevMM.exe
  C:\Windows\System\lWMevMM.exe
  2⤵
  PID:2300
- C:\Windows\System\VHIxKpH.exe
  C:\Windows\System\VHIxKpH.exe
  2⤵
  PID:2528
- C:\Windows\System\ATmKrqa.exe
  C:\Windows\System\ATmKrqa.exe
  2⤵
  PID:2848
- C:\Windows\System\PcjJmTv.exe
  C:\Windows\System\PcjJmTv.exe
  2⤵
  PID:2420
- C:\Windows\System\DrKslDg.exe
  C:\Windows\System\DrKslDg.exe
  2⤵
  PID:1584
- C:\Windows\System\WIMwZLb.exe
  C:\Windows\System\WIMwZLb.exe
  2⤵
  PID:516
- C:\Windows\System\ZfWZmEL.exe
  C:\Windows\System\ZfWZmEL.exe
  2⤵
  PID:1940
- C:\Windows\System\QiQStVg.exe
  C:\Windows\System\QiQStVg.exe
  2⤵
  PID:2292
- C:\Windows\System\jnfxmxn.exe
  C:\Windows\System\jnfxmxn.exe
  2⤵
  PID:1964
- C:\Windows\System\XCvXXdD.exe
  C:\Windows\System\XCvXXdD.exe
  2⤵
  PID:1436
- C:\Windows\System\MYZLqQS.exe
  C:\Windows\System\MYZLqQS.exe
  2⤵
  PID:3132
- C:\Windows\System\OmiNSET.exe
  C:\Windows\System\OmiNSET.exe
  2⤵
  PID:1800
- C:\Windows\System\CaVZgtG.exe
  C:\Windows\System\CaVZgtG.exe
  2⤵
  PID:3444
- C:\Windows\System\sRxZzBw.exe
  C:\Windows\System\sRxZzBw.exe
  2⤵
  PID:3188
- C:\Windows\System\LniNwgX.exe
  C:\Windows\System\LniNwgX.exe
  2⤵
  PID:3204
- C:\Windows\System\RldyRGL.exe
  C:\Windows\System\RldyRGL.exe
  2⤵
  PID:3220
- C:\Windows\System\FIhvPjg.exe
  C:\Windows\System\FIhvPjg.exe
  2⤵
  PID:3236
- C:\Windows\System\dVRdojs.exe
  C:\Windows\System\dVRdojs.exe
  2⤵
  PID:3252
- C:\Windows\System\gmugNlI.exe
  C:\Windows\System\gmugNlI.exe
  2⤵
  PID:3284
- C:\Windows\System\ACgqFUJ.exe
  C:\Windows\System\ACgqFUJ.exe
  2⤵
  PID:3304
- C:\Windows\System\VHcbbvr.exe
  C:\Windows\System\VHcbbvr.exe
  2⤵
  PID:3320
- C:\Windows\System\erstiOr.exe
  C:\Windows\System\erstiOr.exe
  2⤵
  PID:3336
- C:\Windows\System\OhJDIke.exe
  C:\Windows\System\OhJDIke.exe
  2⤵
  PID:3352
- C:\Windows\System\HKbvPFK.exe
  C:\Windows\System\HKbvPFK.exe
  2⤵
  PID:3368
- C:\Windows\System\sezniuR.exe
  C:\Windows\System\sezniuR.exe
  2⤵
  PID:3384
- C:\Windows\System\JWyMhMX.exe
  C:\Windows\System\JWyMhMX.exe
  2⤵
  PID:3408
- C:\Windows\System\sGbbfuB.exe
  C:\Windows\System\sGbbfuB.exe
  2⤵
  PID:3428
- C:\Windows\System\MGhUDRO.exe
  C:\Windows\System\MGhUDRO.exe
  2⤵
  PID:3472
- C:\Windows\System\mjfBQoL.exe
  C:\Windows\System\mjfBQoL.exe
  2⤵
  PID:1408
- C:\Windows\System\tdNrdDe.exe
  C:\Windows\System\tdNrdDe.exe
  2⤵
  PID:1780
- C:\Windows\System\yasvnIq.exe
  C:\Windows\System\yasvnIq.exe
  2⤵
  PID:3568
- C:\Windows\System\JEBTwmb.exe
  C:\Windows\System\JEBTwmb.exe
  2⤵
  PID:3504
- C:\Windows\System\PcadRfP.exe
  C:\Windows\System\PcadRfP.exe
  2⤵
  PID:3572
- C:\Windows\System\tQuAemB.exe
  C:\Windows\System\tQuAemB.exe
  2⤵
  PID:3612
- C:\Windows\System\vbPQGdu.exe
  C:\Windows\System\vbPQGdu.exe
  2⤵
  PID:3680
- C:\Windows\System\WSaWFsn.exe
  C:\Windows\System\WSaWFsn.exe
  2⤵
  PID:3708
- C:\Windows\System\lNBHaXB.exe
  C:\Windows\System\lNBHaXB.exe
  2⤵
  PID:3728
- C:\Windows\System\lMwzkQa.exe
  C:\Windows\System\lMwzkQa.exe
  2⤵
  PID:3780
- C:\Windows\System\vcTqSSN.exe
  C:\Windows\System\vcTqSSN.exe
  2⤵
  PID:3880
- C:\Windows\System\GDVRcBa.exe
  C:\Windows\System\GDVRcBa.exe
  2⤵
  PID:3988
- C:\Windows\System\lAssgIe.exe
  C:\Windows\System\lAssgIe.exe
  2⤵
  PID:4004
- C:\Windows\System\iqPBjVF.exe
  C:\Windows\System\iqPBjVF.exe
  2⤵
  PID:3760
- C:\Windows\System\KgICLEF.exe
  C:\Windows\System\KgICLEF.exe
  2⤵
  PID:3824
- C:\Windows\System\LDjcZMs.exe
  C:\Windows\System\LDjcZMs.exe
  2⤵
  PID:3764
- C:\Windows\System\YLxyyou.exe
  C:\Windows\System\YLxyyou.exe
  2⤵
  PID:4064
- C:\Windows\System\oRypwfA.exe
  C:\Windows\System\oRypwfA.exe
  2⤵
  PID:4048
- C:\Windows\System\EpNExuU.exe
  C:\Windows\System\EpNExuU.exe
  2⤵
  PID:4084
- C:\Windows\System\nmHrvnd.exe
  C:\Windows\System\nmHrvnd.exe
  2⤵
  PID:1240
- C:\Windows\System\QkUxdmF.exe
  C:\Windows\System\QkUxdmF.exe
  2⤵
  PID:4088
- C:\Windows\System\WdEaMOn.exe
  C:\Windows\System\WdEaMOn.exe
  2⤵
  PID:2860
- C:\Windows\System\zdcBOyh.exe
  C:\Windows\System\zdcBOyh.exe
  2⤵
  PID:1548
- C:\Windows\System\MjKtUTp.exe
  C:\Windows\System\MjKtUTp.exe
  2⤵
  PID:2336
- C:\Windows\System\UGOSnSI.exe
  C:\Windows\System\UGOSnSI.exe
  2⤵
  PID:3468
- C:\Windows\System\FgRpleM.exe
  C:\Windows\System\FgRpleM.exe
  2⤵
  PID:2560
- C:\Windows\System\TddfObz.exe
  C:\Windows\System\TddfObz.exe
  2⤵
  PID:1088
- C:\Windows\System\vkYVfMI.exe
  C:\Windows\System\vkYVfMI.exe
  2⤵
  PID:2920
- C:\Windows\System\tBzoCdI.exe
  C:\Windows\System\tBzoCdI.exe
  2⤵
  PID:3184
- C:\Windows\System\qpcArhI.exe
  C:\Windows\System\qpcArhI.exe
  2⤵
  PID:2164
- C:\Windows\System\qavfXqx.exe
  C:\Windows\System\qavfXqx.exe
  2⤵
  PID:3244
- C:\Windows\System\iRaDRoM.exe
  C:\Windows\System\iRaDRoM.exe
  2⤵
  PID:3232
- C:\Windows\System\lfhwCsf.exe
  C:\Windows\System\lfhwCsf.exe
  2⤵
  PID:3276
- C:\Windows\System\AoyyMJs.exe
  C:\Windows\System\AoyyMJs.exe
  2⤵
  PID:3300
- C:\Windows\System\gvbkpwp.exe
  C:\Windows\System\gvbkpwp.exe
  2⤵
  PID:3360
- C:\Windows\System\vLgLevM.exe
  C:\Windows\System\vLgLevM.exe
  2⤵
  PID:3436
- C:\Windows\System\dxekiKy.exe
  C:\Windows\System\dxekiKy.exe
  2⤵
  PID:3552
- C:\Windows\System\rHBimrV.exe
  C:\Windows\System\rHBimrV.exe
  2⤵
  PID:3344
- C:\Windows\System\GuStWrh.exe
  C:\Windows\System\GuStWrh.exe
  2⤵
  PID:3628
- C:\Windows\System\jeATgMG.exe
  C:\Windows\System\jeATgMG.exe
  2⤵
  PID:2816
- C:\Windows\System\EwueVhz.exe
  C:\Windows\System\EwueVhz.exe
  2⤵
  PID:3488
- C:\Windows\System\uCEYZOD.exe
  C:\Windows\System\uCEYZOD.exe
  2⤵
  PID:3672
- C:\Windows\System\EgKEUQS.exe
  C:\Windows\System\EgKEUQS.exe
  2⤵
  PID:3668
- C:\Windows\System\msaruZW.exe
  C:\Windows\System\msaruZW.exe
  2⤵
  PID:3856
- C:\Windows\System\zLnuIiS.exe
  C:\Windows\System\zLnuIiS.exe
  2⤵
  PID:3724
- C:\Windows\System\eNyGWvk.exe
  C:\Windows\System\eNyGWvk.exe
  2⤵
  PID:3844
- C:\Windows\System\huyATwF.exe
  C:\Windows\System\huyATwF.exe
  2⤵
  PID:3940
- C:\Windows\System\GohbAcA.exe
  C:\Windows\System\GohbAcA.exe
  2⤵
  PID:4012
- C:\Windows\System\fSyZCQG.exe
  C:\Windows\System\fSyZCQG.exe
  2⤵
  PID:3796
- C:\Windows\System\iKeKZpr.exe
  C:\Windows\System\iKeKZpr.exe
  2⤵
  PID:3896
- C:\Windows\System\QXdsLly.exe
  C:\Windows\System\QXdsLly.exe
  2⤵
  PID:4032
- C:\Windows\System\fYEbGVO.exe
  C:\Windows\System\fYEbGVO.exe
  2⤵
  PID:2140
- C:\Windows\System\qposYMO.exe
  C:\Windows\System\qposYMO.exe
  2⤵
  PID:1020
- C:\Windows\System\HfNxvPD.exe
  C:\Windows\System\HfNxvPD.exe
  2⤵
  PID:4092
- C:\Windows\System\LgxwqTo.exe
  C:\Windows\System\LgxwqTo.exe
  2⤵
  PID:3452
- C:\Windows\System\vUmRpaj.exe
  C:\Windows\System\vUmRpaj.exe
  2⤵
  PID:400
- C:\Windows\System\GdiGZKR.exe
  C:\Windows\System\GdiGZKR.exe
  2⤵
  PID:3172
- C:\Windows\System\vVIafWa.exe
  C:\Windows\System\vVIafWa.exe
  2⤵
  PID:3248
- C:\Windows\System\tivZUpR.exe
  C:\Windows\System\tivZUpR.exe
  2⤵
  PID:3316
- C:\Windows\System\ipumFKn.exe
  C:\Windows\System\ipumFKn.exe
  2⤵
  PID:3420
- C:\Windows\System\HLcGppu.exe
  C:\Windows\System\HLcGppu.exe
  2⤵
  PID:3176
- C:\Windows\System\fhXaTno.exe
  C:\Windows\System\fhXaTno.exe
  2⤵
  PID:3440
- C:\Windows\System\PwoCQqt.exe
  C:\Windows\System\PwoCQqt.exe
  2⤵
  PID:3348
- C:\Windows\System\gFmUzOz.exe
  C:\Windows\System\gFmUzOz.exe
  2⤵
  PID:4104
- C:\Windows\System\GmkeYfq.exe
  C:\Windows\System\GmkeYfq.exe
  2⤵
  PID:4124
- C:\Windows\System\LVdsWrW.exe
  C:\Windows\System\LVdsWrW.exe
  2⤵
  PID:4140
- C:\Windows\System\kKadqfz.exe
  C:\Windows\System\kKadqfz.exe
  2⤵
  PID:4156
- C:\Windows\System\SFhLvju.exe
  C:\Windows\System\SFhLvju.exe
  2⤵
  PID:4176
- C:\Windows\System\kKQAqFL.exe
  C:\Windows\System\kKQAqFL.exe
  2⤵
  PID:4192
- C:\Windows\System\GWsdPTk.exe
  C:\Windows\System\GWsdPTk.exe
  2⤵
  PID:4208
- C:\Windows\System\ASiuggR.exe
  C:\Windows\System\ASiuggR.exe
  2⤵
  PID:4224
- C:\Windows\System\WlPjAIX.exe
  C:\Windows\System\WlPjAIX.exe
  2⤵
  PID:4240
- C:\Windows\System\USzrgRq.exe
  C:\Windows\System\USzrgRq.exe
  2⤵
  PID:4260
- C:\Windows\System\lxpTPfE.exe
  C:\Windows\System\lxpTPfE.exe
  2⤵
  PID:4276
- C:\Windows\System\AXlnLlC.exe
  C:\Windows\System\AXlnLlC.exe
  2⤵
  PID:4296
- C:\Windows\System\uxzJUVI.exe
  C:\Windows\System\uxzJUVI.exe
  2⤵
  PID:4312
- C:\Windows\System\hkgnduR.exe
  C:\Windows\System\hkgnduR.exe
  2⤵
  PID:4328
- C:\Windows\System\egAPxDN.exe
  C:\Windows\System\egAPxDN.exe
  2⤵
  PID:4344
- C:\Windows\System\soPkmjN.exe
  C:\Windows\System\soPkmjN.exe
  2⤵
  PID:4384
- C:\Windows\System\QcnbpoU.exe
  C:\Windows\System\QcnbpoU.exe
  2⤵
  PID:4408
- C:\Windows\System\ptZGRpr.exe
  C:\Windows\System\ptZGRpr.exe
  2⤵
  PID:4504
- C:\Windows\System\QSugNID.exe
  C:\Windows\System\QSugNID.exe
  2⤵
  PID:4524
- C:\Windows\System\tNvfhpY.exe
  C:\Windows\System\tNvfhpY.exe
  2⤵
  PID:4556
- C:\Windows\System\CPDJRtK.exe
  C:\Windows\System\CPDJRtK.exe
  2⤵
  PID:4572
- C:\Windows\System\pAsbjzV.exe
  C:\Windows\System\pAsbjzV.exe
  2⤵
  PID:4588
- C:\Windows\System\UpNykgP.exe
  C:\Windows\System\UpNykgP.exe
  2⤵
  PID:4604
- C:\Windows\System\schcPEi.exe
  C:\Windows\System\schcPEi.exe
  2⤵
  PID:4620
- C:\Windows\System\yCZvsnk.exe
  C:\Windows\System\yCZvsnk.exe
  2⤵
  PID:4636
- C:\Windows\System\zzTPASK.exe
  C:\Windows\System\zzTPASK.exe
  2⤵
  PID:4656
- C:\Windows\System\WxGnDCo.exe
  C:\Windows\System\WxGnDCo.exe
  2⤵
  PID:4676
- C:\Windows\System\shkOdQh.exe
  C:\Windows\System\shkOdQh.exe
  2⤵
  PID:4720
- C:\Windows\System\RfanwiV.exe
  C:\Windows\System\RfanwiV.exe
  2⤵
  PID:4736
- C:\Windows\System\XuzqMNC.exe
  C:\Windows\System\XuzqMNC.exe
  2⤵
  PID:4752
- C:\Windows\System\yYMAoxg.exe
  C:\Windows\System\yYMAoxg.exe
  2⤵
  PID:4768
- C:\Windows\System\tLyjxdk.exe
  C:\Windows\System\tLyjxdk.exe
  2⤵
  PID:4788
- C:\Windows\System\DiwQUFs.exe
  C:\Windows\System\DiwQUFs.exe
  2⤵
  PID:4804
- C:\Windows\System\oQPpCxg.exe
  C:\Windows\System\oQPpCxg.exe
  2⤵
  PID:4820
- C:\Windows\System\QElypSc.exe
  C:\Windows\System\QElypSc.exe
  2⤵
  PID:4836
- C:\Windows\System\OpJGctz.exe
  C:\Windows\System\OpJGctz.exe
  2⤵
  PID:4856
- C:\Windows\System\yzFwSYt.exe
  C:\Windows\System\yzFwSYt.exe
  2⤵
  PID:4872
- C:\Windows\System\MqqQoDQ.exe
  C:\Windows\System\MqqQoDQ.exe
  2⤵
  PID:4888
- C:\Windows\System\IDXbbqJ.exe
  C:\Windows\System\IDXbbqJ.exe
  2⤵
  PID:4908
- C:\Windows\System\KtwigcZ.exe
  C:\Windows\System\KtwigcZ.exe
  2⤵
  PID:4952
- C:\Windows\System\yzeIwXG.exe
  C:\Windows\System\yzeIwXG.exe
  2⤵
  PID:4968
- C:\Windows\System\tUXnPzD.exe
  C:\Windows\System\tUXnPzD.exe
  2⤵
  PID:4988
- C:\Windows\System\XBvNZJI.exe
  C:\Windows\System\XBvNZJI.exe
  2⤵
  PID:5036
- C:\Windows\System\rvGfofb.exe
  C:\Windows\System\rvGfofb.exe
  2⤵
  PID:5064
- C:\Windows\System\QmTpyvw.exe
  C:\Windows\System\QmTpyvw.exe
  2⤵
  PID:5084
- C:\Windows\System\pLmkNhY.exe
  C:\Windows\System\pLmkNhY.exe
  2⤵
  PID:5100
- C:\Windows\System\viJWzeP.exe
  C:\Windows\System\viJWzeP.exe
  2⤵
  PID:1652
- C:\Windows\System\cxyLPSn.exe
  C:\Windows\System\cxyLPSn.exe
  2⤵
  PID:2924
- C:\Windows\System\hQTIXgL.exe
  C:\Windows\System\hQTIXgL.exe
  2⤵
  PID:888
- C:\Windows\System\zETdiXc.exe
  C:\Windows\System\zETdiXc.exe
  2⤵
  PID:3388
- C:\Windows\System\QTOUdIO.exe
  C:\Windows\System\QTOUdIO.exe
  2⤵
  PID:3964
- C:\Windows\System\VUrTACn.exe
  C:\Windows\System\VUrTACn.exe
  2⤵
  PID:3588
- C:\Windows\System\mPlGmmR.exe
  C:\Windows\System\mPlGmmR.exe
  2⤵
  PID:3524
- C:\Windows\System\nAlzELc.exe
  C:\Windows\System\nAlzELc.exe
  2⤵
  PID:3692
- C:\Windows\System\xwOpzrg.exe
  C:\Windows\System\xwOpzrg.exe
  2⤵
  PID:3812
- C:\Windows\System\PnJlfvx.exe
  C:\Windows\System\PnJlfvx.exe
  2⤵
  PID:4292
- C:\Windows\System\cclryIr.exe
  C:\Windows\System\cclryIr.exe
  2⤵
  PID:2828
- C:\Windows\System\ztQlxyG.exe
  C:\Windows\System\ztQlxyG.exe
  2⤵
  PID:3332
- C:\Windows\System\FkilSxU.exe
  C:\Windows\System\FkilSxU.exe
  2⤵
  PID:3980
- C:\Windows\System\XGJdCCX.exe
  C:\Windows\System\XGJdCCX.exe
  2⤵
  PID:2704
- C:\Windows\System\HgsrpZQ.exe
  C:\Windows\System\HgsrpZQ.exe
  2⤵
  PID:3416
- C:\Windows\System\slnXjmP.exe
  C:\Windows\System\slnXjmP.exe
  2⤵
  PID:4356
- C:\Windows\System\YrZzGPg.exe
  C:\Windows\System\YrZzGPg.exe
  2⤵
  PID:4100
- C:\Windows\System\Crcynhq.exe
  C:\Windows\System\Crcynhq.exe
  2⤵
  PID:3604
- C:\Windows\System\DqyMBrr.exe
  C:\Windows\System\DqyMBrr.exe
  2⤵
  PID:4132
- C:\Windows\System\ZkKLFPY.exe
  C:\Windows\System\ZkKLFPY.exe
  2⤵
  PID:4304
- C:\Windows\System\WuHXVtS.exe
  C:\Windows\System\WuHXVtS.exe
  2⤵
  PID:4172
- C:\Windows\System\pucDWWt.exe
  C:\Windows\System\pucDWWt.exe
  2⤵
  PID:4236
- C:\Windows\System\drYxNwx.exe
  C:\Windows\System\drYxNwx.exe
  2⤵
  PID:4340
- C:\Windows\System\LYBYpxn.exe
  C:\Windows\System\LYBYpxn.exe
  2⤵
  PID:4152
- C:\Windows\System\XKNugks.exe
  C:\Windows\System\XKNugks.exe
  2⤵
  PID:4288
- C:\Windows\System\jKXVqmw.exe
  C:\Windows\System\jKXVqmw.exe
  2⤵
  PID:4468
- C:\Windows\System\UzgkQhA.exe
  C:\Windows\System\UzgkQhA.exe
  2⤵
  PID:3960
- C:\Windows\System\jZqeAAO.exe
  C:\Windows\System\jZqeAAO.exe
  2⤵
  PID:4532
- C:\Windows\System\fKJBMUn.exe
  C:\Windows\System\fKJBMUn.exe
  2⤵
  PID:4500
- C:\Windows\System\slLUJWm.exe
  C:\Windows\System\slLUJWm.exe
  2⤵
  PID:4584
- C:\Windows\System\jTDWbsq.exe
  C:\Windows\System\jTDWbsq.exe
  2⤵
  PID:4648
- C:\Windows\System\BVKpSjb.exe
  C:\Windows\System\BVKpSjb.exe
  2⤵
  PID:4564
- C:\Windows\System\xROUVzb.exe
  C:\Windows\System\xROUVzb.exe
  2⤵
  PID:4632
- C:\Windows\System\DVsLkwO.exe
  C:\Windows\System\DVsLkwO.exe
  2⤵
  PID:4696
- C:\Windows\System\RMYHzgq.exe
  C:\Windows\System\RMYHzgq.exe
  2⤵
  PID:4708
- C:\Windows\System\MQuOJHy.exe
  C:\Windows\System\MQuOJHy.exe
  2⤵
  PID:4748
- C:\Windows\System\qMlZiNy.exe
  C:\Windows\System\qMlZiNy.exe
  2⤵
  PID:4812
- C:\Windows\System\oUeheNK.exe
  C:\Windows\System\oUeheNK.exe
  2⤵
  PID:4800
- C:\Windows\System\mNVIbqv.exe
  C:\Windows\System\mNVIbqv.exe
  2⤵
  PID:4904
- C:\Windows\System\DteaRNh.exe
  C:\Windows\System\DteaRNh.exe
  2⤵
  PID:4848
- C:\Windows\System\FHhipTh.exe
  C:\Windows\System\FHhipTh.exe
  2⤵
  PID:4884
- C:\Windows\System\LPBwvSe.exe
  C:\Windows\System\LPBwvSe.exe
  2⤵
  PID:4940
- C:\Windows\System\HEzZmDi.exe
  C:\Windows\System\HEzZmDi.exe
  2⤵
  PID:4980
- C:\Windows\System\WDHEKKW.exe
  C:\Windows\System\WDHEKKW.exe
  2⤵
  PID:5048
- C:\Windows\System\dGtLMEx.exe
  C:\Windows\System\dGtLMEx.exe
  2⤵
  PID:5092
- C:\Windows\System\roIMCJe.exe
  C:\Windows\System\roIMCJe.exe
  2⤵
  PID:3196
- C:\Windows\System\crbSMzS.exe
  C:\Windows\System\crbSMzS.exe
  2⤵
  PID:5020
- C:\Windows\System\moKGRnL.exe
  C:\Windows\System\moKGRnL.exe
  2⤵
  PID:4964
- C:\Windows\System\VOXvmur.exe
  C:\Windows\System\VOXvmur.exe
  2⤵
  PID:3376
- C:\Windows\System\KsKsLfX.exe
  C:\Windows\System\KsKsLfX.exe
  2⤵
  PID:1104
- C:\Windows\System\fKruQHn.exe
  C:\Windows\System\fKruQHn.exe
  2⤵
  PID:4168
- C:\Windows\System\XQFCAXD.exe
  C:\Windows\System\XQFCAXD.exe
  2⤵
  PID:3624
- C:\Windows\System\ydCPMWU.exe
  C:\Windows\System\ydCPMWU.exe
  2⤵
  PID:3540
- C:\Windows\System\ieiswDe.exe
  C:\Windows\System\ieiswDe.exe
  2⤵
  PID:4120
- C:\Windows\System\FntzSLv.exe
  C:\Windows\System\FntzSLv.exe
  2⤵
  PID:4392
- C:\Windows\System\fjrFVCm.exe
  C:\Windows\System\fjrFVCm.exe
  2⤵
  PID:4148
- C:\Windows\System\nxYEdhT.exe
  C:\Windows\System\nxYEdhT.exe
  2⤵
  PID:3168
- C:\Windows\System\XZUUWnY.exe
  C:\Windows\System\XZUUWnY.exe
  2⤵
  PID:4248
- C:\Windows\System\AKHxJmh.exe
  C:\Windows\System\AKHxJmh.exe
  2⤵
  PID:4232
- C:\Windows\System\BLjvpXy.exe
  C:\Windows\System\BLjvpXy.exe
  2⤵
  PID:4516
- C:\Windows\System\VsUoMit.exe
  C:\Windows\System\VsUoMit.exe
  2⤵
  PID:4668
- C:\Windows\System\JkGyMEO.exe
  C:\Windows\System\JkGyMEO.exe
  2⤵
  PID:4700
- C:\Windows\System\sFXBlry.exe
  C:\Windows\System\sFXBlry.exe
  2⤵
  PID:4672
- C:\Windows\System\MRHcVHO.exe
  C:\Windows\System\MRHcVHO.exe
  2⤵
  PID:4600
- C:\Windows\System\vOBBBNE.exe
  C:\Windows\System\vOBBBNE.exe
  2⤵
  PID:4852
- C:\Windows\System\fNkgzuW.exe
  C:\Windows\System\fNkgzuW.exe
  2⤵
  PID:4732
- C:\Windows\System\YXKJUoE.exe
  C:\Windows\System\YXKJUoE.exe
  2⤵
  PID:4844
- C:\Windows\System\ydIlvbk.exe
  C:\Windows\System\ydIlvbk.exe
  2⤵
  PID:5008
- C:\Windows\System\MVoMxiA.exe
  C:\Windows\System\MVoMxiA.exe
  2⤵
  PID:5044
- C:\Windows\System\wBKlpMW.exe
  C:\Windows\System\wBKlpMW.exe
  2⤵
  PID:4996
- C:\Windows\System\DrwyhmM.exe
  C:\Windows\System\DrwyhmM.exe
  2⤵
  PID:5112
- C:\Windows\System\dvsYalK.exe
  C:\Windows\System\dvsYalK.exe
  2⤵
  PID:1692
- C:\Windows\System\hPzdxFr.exe
  C:\Windows\System\hPzdxFr.exe
  2⤵
  PID:3892
- C:\Windows\System\oKMszit.exe
  C:\Windows\System\oKMszit.exe
  2⤵
  PID:3688
- C:\Windows\System\pTTNAcJ.exe
  C:\Windows\System\pTTNAcJ.exe
  2⤵
  PID:3876
- C:\Windows\System\bVnkhCK.exe
  C:\Windows\System\bVnkhCK.exe
  2⤵
  PID:4220
- C:\Windows\System\tYPBtnv.exe
  C:\Windows\System\tYPBtnv.exe
  2⤵
  PID:4420
- C:\Windows\System\pcTiBjy.exe
  C:\Windows\System\pcTiBjy.exe
  2⤵
  PID:2904
- C:\Windows\System\VYLRxbF.exe
  C:\Windows\System\VYLRxbF.exe
  2⤵
  PID:4284
- C:\Windows\System\RYMmwRV.exe
  C:\Windows\System\RYMmwRV.exe
  2⤵
  PID:4476
- C:\Windows\System\UEaoacl.exe
  C:\Windows\System\UEaoacl.exe
  2⤵
  PID:4784
- C:\Windows\System\nDpQzSj.exe
  C:\Windows\System\nDpQzSj.exe
  2⤵
  PID:5032
- C:\Windows\System\hhbfPJp.exe
  C:\Windows\System\hhbfPJp.exe
  2⤵
  PID:4960
- C:\Windows\System\flUgvzY.exe
  C:\Windows\System\flUgvzY.exe
  2⤵
  PID:108
- C:\Windows\System\mfHHgCC.exe
  C:\Windows\System\mfHHgCC.exe
  2⤵
  PID:4976
- C:\Windows\System\VMZwjWS.exe
  C:\Windows\System\VMZwjWS.exe
  2⤵
  PID:4948
- C:\Windows\System\FZkMZCl.exe
  C:\Windows\System\FZkMZCl.exe
  2⤵
  PID:4252
- C:\Windows\System\LEUCQAX.exe
  C:\Windows\System\LEUCQAX.exe
  2⤵
  PID:5072
- C:\Windows\System\GqbyPxX.exe
  C:\Windows\System\GqbyPxX.exe
  2⤵
  PID:4000
- C:\Windows\System\OzWLLeE.exe
  C:\Windows\System\OzWLLeE.exe
  2⤵
  PID:5024
- C:\Windows\System\WEutKuc.exe
  C:\Windows\System\WEutKuc.exe
  2⤵
  PID:4396
- C:\Windows\System\IvQARML.exe
  C:\Windows\System\IvQARML.exe
  2⤵
  PID:4896
- C:\Windows\System\ZYjZIcV.exe
  C:\Windows\System\ZYjZIcV.exe
  2⤵
  PID:5076
- C:\Windows\System\oeRIVeA.exe
  C:\Windows\System\oeRIVeA.exe
  2⤵
  PID:4688
- C:\Windows\System\xmtlKKY.exe
  C:\Windows\System\xmtlKKY.exe
  2⤵
  PID:5000
- C:\Windows\System\TPVLymq.exe
  C:\Windows\System\TPVLymq.exe
  2⤵
  PID:4616
- C:\Windows\System\fcXttKG.exe
  C:\Windows\System\fcXttKG.exe
  2⤵
  PID:4764
- C:\Windows\System\wPjwpoj.exe
  C:\Windows\System\wPjwpoj.exe
  2⤵
  PID:5124
- C:\Windows\System\lmpNGdy.exe
  C:\Windows\System\lmpNGdy.exe
  2⤵
  PID:5144
- C:\Windows\System\TDPWqlP.exe
  C:\Windows\System\TDPWqlP.exe
  2⤵
  PID:5160
- C:\Windows\System\EeKchTp.exe
  C:\Windows\System\EeKchTp.exe
  2⤵
  PID:5184
- C:\Windows\System\fqVDYZC.exe
  C:\Windows\System\fqVDYZC.exe
  2⤵
  PID:5208
- C:\Windows\System\DDZVYpo.exe
  C:\Windows\System\DDZVYpo.exe
  2⤵
  PID:5224
- C:\Windows\System\iePQJvx.exe
  C:\Windows\System\iePQJvx.exe
  2⤵
  PID:5240
- C:\Windows\System\RMSJPHS.exe
  C:\Windows\System\RMSJPHS.exe
  2⤵
  PID:5260
- C:\Windows\System\HSStneX.exe
  C:\Windows\System\HSStneX.exe
  2⤵
  PID:5276
- C:\Windows\System\jMuLVlJ.exe
  C:\Windows\System\jMuLVlJ.exe
  2⤵
  PID:5292
- C:\Windows\System\LCkYKLg.exe
  C:\Windows\System\LCkYKLg.exe
  2⤵
  PID:5308
- C:\Windows\System\lgPMgVy.exe
  C:\Windows\System\lgPMgVy.exe
  2⤵
  PID:5324
- C:\Windows\System\yqkbTzY.exe
  C:\Windows\System\yqkbTzY.exe
  2⤵
  PID:5340
- C:\Windows\System\VvtkkuL.exe
  C:\Windows\System\VvtkkuL.exe
  2⤵
  PID:5392
- C:\Windows\System\GTWPOAc.exe
  C:\Windows\System\GTWPOAc.exe
  2⤵
  PID:5408
- C:\Windows\System\nqnaVTz.exe
  C:\Windows\System\nqnaVTz.exe
  2⤵
  PID:5456
- C:\Windows\System\DClKbbJ.exe
  C:\Windows\System\DClKbbJ.exe
  2⤵
  PID:5472
- C:\Windows\System\LlmqRRk.exe
  C:\Windows\System\LlmqRRk.exe
  2⤵
  PID:5488
- C:\Windows\System\cSHveav.exe
  C:\Windows\System\cSHveav.exe
  2⤵
  PID:5508
- C:\Windows\System\hmiiCxA.exe
  C:\Windows\System\hmiiCxA.exe
  2⤵
  PID:5580
- C:\Windows\System\mtcZJNA.exe
  C:\Windows\System\mtcZJNA.exe
  2⤵
  PID:5632
- C:\Windows\System\NPyPwBk.exe
  C:\Windows\System\NPyPwBk.exe
  2⤵
  PID:5648
- C:\Windows\System\jUfzVFB.exe
  C:\Windows\System\jUfzVFB.exe
  2⤵
  PID:5688
- C:\Windows\System\KRqEFdH.exe
  C:\Windows\System\KRqEFdH.exe
  2⤵
  PID:5704
- C:\Windows\System\tmKcmko.exe
  C:\Windows\System\tmKcmko.exe
  2⤵
  PID:5720
- C:\Windows\System\FYJFTxW.exe
  C:\Windows\System\FYJFTxW.exe
  2⤵
  PID:5740
- C:\Windows\System\YQQEBLW.exe
  C:\Windows\System\YQQEBLW.exe
  2⤵
  PID:5756
- C:\Windows\System\QtDEiRF.exe
  C:\Windows\System\QtDEiRF.exe
  2⤵
  PID:5772
- C:\Windows\System\FMuoWhD.exe
  C:\Windows\System\FMuoWhD.exe
  2⤵
  PID:5788
- C:\Windows\System\kcAnHOk.exe
  C:\Windows\System\kcAnHOk.exe
  2⤵
  PID:5804
- C:\Windows\System\RPuqscV.exe
  C:\Windows\System\RPuqscV.exe
  2⤵
  PID:5820
- C:\Windows\System\HNEAIyD.exe
  C:\Windows\System\HNEAIyD.exe
  2⤵
  PID:5836
- C:\Windows\System\QNwWNFZ.exe
  C:\Windows\System\QNwWNFZ.exe
  2⤵
  PID:5852
- C:\Windows\System\tYVWNGE.exe
  C:\Windows\System\tYVWNGE.exe
  2⤵
  PID:5880
- C:\Windows\System\gJpZUcO.exe
  C:\Windows\System\gJpZUcO.exe
  2⤵
  PID:5900
- C:\Windows\System\lbcBlqU.exe
  C:\Windows\System\lbcBlqU.exe
  2⤵
  PID:5920
- C:\Windows\System\uIFDQGz.exe
  C:\Windows\System\uIFDQGz.exe
  2⤵
  PID:5936
- C:\Windows\System\dUSvjtY.exe
  C:\Windows\System\dUSvjtY.exe
  2⤵
  PID:5952
- C:\Windows\System\VjuKAqs.exe
  C:\Windows\System\VjuKAqs.exe
  2⤵
  PID:5968
- C:\Windows\System\hWvwzrx.exe
  C:\Windows\System\hWvwzrx.exe
  2⤵
  PID:5984
- C:\Windows\System\iegAyza.exe
  C:\Windows\System\iegAyza.exe
  2⤵
  PID:6004
- C:\Windows\System\xxySnjG.exe
  C:\Windows\System\xxySnjG.exe
  2⤵
  PID:6020
- C:\Windows\System\OCuuTbL.exe
  C:\Windows\System\OCuuTbL.exe
  2⤵
  PID:6040
- C:\Windows\System\ZYZXWzW.exe
  C:\Windows\System\ZYZXWzW.exe
  2⤵
  PID:6056
- C:\Windows\System\hxZWFqE.exe
  C:\Windows\System\hxZWFqE.exe
  2⤵
  PID:6072
- C:\Windows\System\cgJKYkG.exe
  C:\Windows\System\cgJKYkG.exe
  2⤵
  PID:6092
- C:\Windows\System\sTEmMcS.exe
  C:\Windows\System\sTEmMcS.exe
  2⤵
  PID:6112
- C:\Windows\System\krgZIpx.exe
  C:\Windows\System\krgZIpx.exe
  2⤵
  PID:6132
- C:\Windows\System\VTVTBSP.exe
  C:\Windows\System\VTVTBSP.exe
  2⤵
  PID:5140
- C:\Windows\System\enohHMp.exe
  C:\Windows\System\enohHMp.exe
  2⤵
  PID:3860
- C:\Windows\System\UdilSMp.exe
  C:\Windows\System\UdilSMp.exe
  2⤵
  PID:5156
- C:\Windows\System\zcmxKCu.exe
  C:\Windows\System\zcmxKCu.exe
  2⤵
  PID:5204
- C:\Windows\System\dprVhTg.exe
  C:\Windows\System\dprVhTg.exe
  2⤵
  PID:5332
- C:\Windows\System\qAPOCUg.exe
  C:\Windows\System\qAPOCUg.exe
  2⤵
  PID:5484
- C:\Windows\System\gsZRmVX.exe
  C:\Windows\System\gsZRmVX.exe
  2⤵
  PID:5216
- C:\Windows\System\hzparjc.exe
  C:\Windows\System\hzparjc.exe
  2⤵
  PID:5288
- C:\Windows\System\WQvezFc.exe
  C:\Windows\System\WQvezFc.exe
  2⤵
  PID:5380
- C:\Windows\System\CrQVgAa.exe
  C:\Windows\System\CrQVgAa.exe
  2⤵
  PID:5428
- C:\Windows\System\VDXufkn.exe
  C:\Windows\System\VDXufkn.exe
  2⤵
  PID:5448
- C:\Windows\System\lmLCwzA.exe
  C:\Windows\System\lmLCwzA.exe
  2⤵
  PID:5500
- C:\Windows\System\CeXElUp.exe
  C:\Windows\System\CeXElUp.exe
  2⤵
  PID:5524
- C:\Windows\System\peiCIPe.exe
  C:\Windows\System\peiCIPe.exe
  2⤵
  PID:5644
- C:\Windows\System\eRXoMAg.exe
  C:\Windows\System\eRXoMAg.exe
  2⤵
  PID:5620
- C:\Windows\System\cORiDrl.exe
  C:\Windows\System\cORiDrl.exe
  2⤵
  PID:5660
- C:\Windows\System\VWoPRic.exe
  C:\Windows\System\VWoPRic.exe
  2⤵
  PID:5732
- C:\Windows\System\MfuseHp.exe
  C:\Windows\System\MfuseHp.exe
  2⤵
  PID:5672
- C:\Windows\System\ZgEOBoK.exe
  C:\Windows\System\ZgEOBoK.exe
  2⤵
  PID:5764
- C:\Windows\System\oFpUcRU.exe
  C:\Windows\System\oFpUcRU.exe
  2⤵
  PID:5828
- C:\Windows\System\lXXZrBU.exe
  C:\Windows\System\lXXZrBU.exe
  2⤵
  PID:5784
- C:\Windows\System\RKDgcbi.exe
  C:\Windows\System\RKDgcbi.exe
  2⤵
  PID:5864
- C:\Windows\System\KQhjkvK.exe
  C:\Windows\System\KQhjkvK.exe
  2⤵
  PID:5812
- C:\Windows\System\NcDIOrI.exe
  C:\Windows\System\NcDIOrI.exe
  2⤵
  PID:5872
- C:\Windows\System\LXqlRIT.exe
  C:\Windows\System\LXqlRIT.exe
  2⤵
  PID:5944
- C:\Windows\System\PDIsczD.exe
  C:\Windows\System\PDIsczD.exe
  2⤵
  PID:6000
- C:\Windows\System\DThEOox.exe
  C:\Windows\System\DThEOox.exe
  2⤵
  PID:6016
- C:\Windows\System\WfmejpD.exe
  C:\Windows\System\WfmejpD.exe
  2⤵
  PID:5928
- C:\Windows\System\tuthmap.exe
  C:\Windows\System\tuthmap.exe
  2⤵
  PID:5992
- C:\Windows\System\SkyXGYQ.exe
  C:\Windows\System\SkyXGYQ.exe
  2⤵
  PID:6036
- C:\Windows\System\DqJOyYS.exe
  C:\Windows\System\DqJOyYS.exe
  2⤵
  PID:6120
- C:\Windows\System\sIuwYgW.exe
  C:\Windows\System\sIuwYgW.exe
  2⤵
  PID:6068
- C:\Windows\System\udFOPjY.exe
  C:\Windows\System\udFOPjY.exe
  2⤵
  PID:5168
- C:\Windows\System\VnlDAoT.exe
  C:\Windows\System\VnlDAoT.exe
  2⤵
  PID:5108
- C:\Windows\System\VLlvmlC.exe
  C:\Windows\System\VLlvmlC.exe
  2⤵
  PID:5480
- C:\Windows\System\ZEkDwWk.exe
  C:\Windows\System\ZEkDwWk.exe
  2⤵
  PID:5252
- C:\Windows\System\lMmVocA.exe
  C:\Windows\System\lMmVocA.exe
  2⤵
  PID:5236
- C:\Windows\System\udydKGp.exe
  C:\Windows\System\udydKGp.exe
  2⤵
  PID:5284
- C:\Windows\System\JKZclFb.exe
  C:\Windows\System\JKZclFb.exe
  2⤵
  PID:5424
- C:\Windows\System\BwwkpNV.exe
  C:\Windows\System\BwwkpNV.exe
  2⤵
  PID:5444
- C:\Windows\System\UrqmFJE.exe
  C:\Windows\System\UrqmFJE.exe
  2⤵
  PID:5404
- C:\Windows\System\txDmGdp.exe
  C:\Windows\System\txDmGdp.exe
  2⤵
  PID:5496
- C:\Windows\System\uExgJHJ.exe
  C:\Windows\System\uExgJHJ.exe
  2⤵
  PID:5600
- C:\Windows\System\QNoPvvS.exe
  C:\Windows\System\QNoPvvS.exe
  2⤵
  PID:5568
- C:\Windows\System\pTaeNzy.exe
  C:\Windows\System\pTaeNzy.exe
  2⤵
  PID:5564
- C:\Windows\System\ecjyowm.exe
  C:\Windows\System\ecjyowm.exe
  2⤵
  PID:5596
- C:\Windows\System\qJbtfng.exe
  C:\Windows\System\qJbtfng.exe
  2⤵
  PID:5736
- C:\Windows\System\WScqtGA.exe
  C:\Windows\System\WScqtGA.exe
  2⤵
  PID:5680
- C:\Windows\System\SyfhTnI.exe
  C:\Windows\System\SyfhTnI.exe
  2⤵
  PID:5608
- C:\Windows\System\FsMvbol.exe
  C:\Windows\System\FsMvbol.exe
  2⤵
  PID:5860
- C:\Windows\System\BomswlL.exe
  C:\Windows\System\BomswlL.exe
  2⤵
  PID:5876
- C:\Windows\System\zSKUrpb.exe
  C:\Windows\System\zSKUrpb.exe
  2⤵
  PID:5916
- C:\Windows\System\IyExwOK.exe
  C:\Windows\System\IyExwOK.exe
  2⤵
  PID:5896
- C:\Windows\System\XOtLpmX.exe
  C:\Windows\System\XOtLpmX.exe
  2⤵
  PID:6100
- C:\Windows\System\SXhKtND.exe
  C:\Windows\System\SXhKtND.exe
  2⤵
  PID:6064
- C:\Windows\System\QzMivVx.exe
  C:\Windows\System\QzMivVx.exe
  2⤵
  PID:5132
- C:\Windows\System\OLjqgHv.exe
  C:\Windows\System\OLjqgHv.exe
  2⤵
  PID:5388
- C:\Windows\System\oNZfMIE.exe
  C:\Windows\System\oNZfMIE.exe
  2⤵
  PID:5304
- C:\Windows\System\UzlsiFy.exe
  C:\Windows\System\UzlsiFy.exe
  2⤵
  PID:5416
- C:\Windows\System\bNuebKB.exe
  C:\Windows\System\bNuebKB.exe
  2⤵
  PID:5504
- C:\Windows\System\ZgXqSFc.exe
  C:\Windows\System\ZgXqSFc.exe
  2⤵
  PID:5532
- C:\Windows\System\QuZbiUL.exe
  C:\Windows\System\QuZbiUL.exe
  2⤵
  PID:5716
- C:\Windows\System\bCxAjhg.exe
  C:\Windows\System\bCxAjhg.exe
  2⤵
  PID:5536
- C:\Windows\System\ipqhiTe.exe
  C:\Windows\System\ipqhiTe.exe
  2⤵
  PID:5800
- C:\Windows\System\ZgDwWdM.exe
  C:\Windows\System\ZgDwWdM.exe
  2⤵
  PID:5268
- C:\Windows\System\WcZvIjn.exe
  C:\Windows\System\WcZvIjn.exe
  2⤵
  PID:5888
- C:\Windows\System\cvEtuJB.exe
  C:\Windows\System\cvEtuJB.exe
  2⤵
  PID:5464
- C:\Windows\System\FHfAToO.exe
  C:\Windows\System\FHfAToO.exe
  2⤵
  PID:6084
- C:\Windows\System\LJZZEgl.exe
  C:\Windows\System\LJZZEgl.exe
  2⤵
  PID:5556
- C:\Windows\System\gAEMJkY.exe
  C:\Windows\System\gAEMJkY.exe
  2⤵
  PID:5436
- C:\Windows\System\eAQHiBM.exe
  C:\Windows\System\eAQHiBM.exe
  2⤵
  PID:5668
- C:\Windows\System\OkHVomf.exe
  C:\Windows\System\OkHVomf.exe
  2⤵
  PID:5780
- C:\Windows\System\kBTmafj.exe
  C:\Windows\System\kBTmafj.exe
  2⤵
  PID:5816
- C:\Windows\System\ydulcym.exe
  C:\Windows\System\ydulcym.exe
  2⤵
  PID:6164
- C:\Windows\System\hLqkWlx.exe
  C:\Windows\System\hLqkWlx.exe
  2⤵
  PID:6180
- C:\Windows\System\OxFJrJz.exe
  C:\Windows\System\OxFJrJz.exe
  2⤵
  PID:6196
- C:\Windows\System\bcdkimf.exe
  C:\Windows\System\bcdkimf.exe
  2⤵
  PID:6212
- C:\Windows\System\NWMsVGw.exe
  C:\Windows\System\NWMsVGw.exe
  2⤵
  PID:6228
- C:\Windows\System\mMoeGdL.exe
  C:\Windows\System\mMoeGdL.exe
  2⤵
  PID:6244
- C:\Windows\System\QvimSUh.exe
  C:\Windows\System\QvimSUh.exe
  2⤵
  PID:6260
- C:\Windows\System\QJsEIIx.exe
  C:\Windows\System\QJsEIIx.exe
  2⤵
  PID:6276
- C:\Windows\System\OybiLpt.exe
  C:\Windows\System\OybiLpt.exe
  2⤵
  PID:6292
- C:\Windows\System\ugJIAEI.exe
  C:\Windows\System\ugJIAEI.exe
  2⤵
  PID:6308
- C:\Windows\System\kAqqeNj.exe
  C:\Windows\System\kAqqeNj.exe
  2⤵
  PID:6324
- C:\Windows\System\uqmCnDN.exe
  C:\Windows\System\uqmCnDN.exe
  2⤵
  PID:6340
- C:\Windows\System\kqkMiMD.exe
  C:\Windows\System\kqkMiMD.exe
  2⤵
  PID:6356
- C:\Windows\System\cnGjvqy.exe
  C:\Windows\System\cnGjvqy.exe
  2⤵
  PID:6372
- C:\Windows\System\POsGaQZ.exe
  C:\Windows\System\POsGaQZ.exe
  2⤵
  PID:6388
- C:\Windows\System\NzEmHmM.exe
  C:\Windows\System\NzEmHmM.exe
  2⤵
  PID:6404
- C:\Windows\System\ysvJhFW.exe
  C:\Windows\System\ysvJhFW.exe
  2⤵
  PID:6420
- C:\Windows\System\XPiUECn.exe
  C:\Windows\System\XPiUECn.exe
  2⤵
  PID:6436
- C:\Windows\System\wmwPaTQ.exe
  C:\Windows\System\wmwPaTQ.exe
  2⤵
  PID:6456
- C:\Windows\System\GYFSqZw.exe
  C:\Windows\System\GYFSqZw.exe
  2⤵
  PID:6472
- C:\Windows\System\tNZnIFy.exe
  C:\Windows\System\tNZnIFy.exe
  2⤵
  PID:6488
- C:\Windows\System\lqtLoWU.exe
  C:\Windows\System\lqtLoWU.exe
  2⤵
  PID:6504
- C:\Windows\System\QlOnKSC.exe
  C:\Windows\System\QlOnKSC.exe
  2⤵
  PID:6520
- C:\Windows\System\SwAMqUj.exe
  C:\Windows\System\SwAMqUj.exe
  2⤵
  PID:6536
- C:\Windows\System\LvULzDI.exe
  C:\Windows\System\LvULzDI.exe
  2⤵
  PID:6552
- C:\Windows\System\YKTjnxT.exe
  C:\Windows\System\YKTjnxT.exe
  2⤵
  PID:6568
- C:\Windows\System\CnHNYSo.exe
  C:\Windows\System\CnHNYSo.exe
  2⤵
  PID:6588
- C:\Windows\System\TcwCEgh.exe
  C:\Windows\System\TcwCEgh.exe
  2⤵
  PID:6604
- C:\Windows\System\lOUUGlL.exe
  C:\Windows\System\lOUUGlL.exe
  2⤵
  PID:6624
- C:\Windows\System\jpRSfBq.exe
  C:\Windows\System\jpRSfBq.exe
  2⤵
  PID:6640
- C:\Windows\System\euaXmut.exe
  C:\Windows\System\euaXmut.exe
  2⤵
  PID:6660
- C:\Windows\System\AVVJYAj.exe
  C:\Windows\System\AVVJYAj.exe
  2⤵
  PID:6676
- C:\Windows\System\VcBBKOG.exe
  C:\Windows\System\VcBBKOG.exe
  2⤵
  PID:6692
- C:\Windows\System\sfmvHQu.exe
  C:\Windows\System\sfmvHQu.exe
  2⤵
  PID:6708
- C:\Windows\System\KHnSDYT.exe
  C:\Windows\System\KHnSDYT.exe
  2⤵
  PID:6732
- C:\Windows\System\UESXZNI.exe
  C:\Windows\System\UESXZNI.exe
  2⤵
  PID:6748
- C:\Windows\System\ZVVDVgA.exe
  C:\Windows\System\ZVVDVgA.exe
  2⤵
  PID:6764
- C:\Windows\System\IYmyYdG.exe
  C:\Windows\System\IYmyYdG.exe
  2⤵
  PID:6844
- C:\Windows\System\QqsQmUf.exe
  C:\Windows\System\QqsQmUf.exe
  2⤵
  PID:6860
- C:\Windows\System\tPHzHYT.exe
  C:\Windows\System\tPHzHYT.exe
  2⤵
  PID:6880
- C:\Windows\System\dnXyXiN.exe
  C:\Windows\System\dnXyXiN.exe
  2⤵
  PID:6900
- C:\Windows\System\CFLDIfx.exe
  C:\Windows\System\CFLDIfx.exe
  2⤵
  PID:6920
- C:\Windows\System\DmuVouC.exe
  C:\Windows\System\DmuVouC.exe
  2⤵
  PID:6940
- C:\Windows\System\dvfyBpg.exe
  C:\Windows\System\dvfyBpg.exe
  2⤵
  PID:6956
- C:\Windows\System\TwvctSn.exe
  C:\Windows\System\TwvctSn.exe
  2⤵
  PID:6976
- C:\Windows\System\QonDizR.exe
  C:\Windows\System\QonDizR.exe
  2⤵
  PID:6992
- C:\Windows\System\uWJUYVC.exe
  C:\Windows\System\uWJUYVC.exe
  2⤵
  PID:7008
- C:\Windows\System\WIEmidA.exe
  C:\Windows\System\WIEmidA.exe
  2⤵
  PID:7024
- C:\Windows\System\TwMotsF.exe
  C:\Windows\System\TwMotsF.exe
  2⤵
  PID:7040
- C:\Windows\System\tqwxaDY.exe
  C:\Windows\System\tqwxaDY.exe
  2⤵
  PID:7056
- C:\Windows\System\FLxErgw.exe
  C:\Windows\System\FLxErgw.exe
  2⤵
  PID:7072
- C:\Windows\System\oSWdNka.exe
  C:\Windows\System\oSWdNka.exe
  2⤵
  PID:7088
- C:\Windows\System\NTLrviI.exe
  C:\Windows\System\NTLrviI.exe
  2⤵
  PID:6188
- C:\Windows\System\MXdzBwy.exe
  C:\Windows\System\MXdzBwy.exe
  2⤵
  PID:6028
- C:\Windows\System\QaHpSCS.exe
  C:\Windows\System\QaHpSCS.exe
  2⤵
  PID:6284
- C:\Windows\System\ZhPDrOu.exe
  C:\Windows\System\ZhPDrOu.exe
  2⤵
  PID:6240
- C:\Windows\System\JjiNmGL.exe
  C:\Windows\System\JjiNmGL.exe
  2⤵
  PID:6352
- C:\Windows\System\fMyAYvv.exe
  C:\Windows\System\fMyAYvv.exe
  2⤵
  PID:6412
- C:\Windows\System\pydNreO.exe
  C:\Windows\System\pydNreO.exe
  2⤵
  PID:6544
- C:\Windows\System\MrvSwKM.exe
  C:\Windows\System\MrvSwKM.exe
  2⤵
  PID:6516
- C:\Windows\System\zUvBvqn.exe
  C:\Windows\System\zUvBvqn.exe
  2⤵
  PID:6332
- C:\Windows\System\ZxdWOkU.exe
  C:\Windows\System\ZxdWOkU.exe
  2⤵
  PID:6396
- C:\Windows\System\TPNkCNt.exe
  C:\Windows\System\TPNkCNt.exe
  2⤵
  PID:6528
- C:\Windows\System\DUEgovr.exe
  C:\Windows\System\DUEgovr.exe
  2⤵
  PID:6468
- C:\Windows\System\ZxQNtlh.exe
  C:\Windows\System\ZxQNtlh.exe
  2⤵
  PID:5136
- C:\Windows\System\HANlnaZ.exe
  C:\Windows\System\HANlnaZ.exe
  2⤵
  PID:6600
- C:\Windows\System\QlqqMxy.exe
  C:\Windows\System\QlqqMxy.exe
  2⤵
  PID:6648
- C:\Windows\System\MxEnxlM.exe
  C:\Windows\System\MxEnxlM.exe
  2⤵
  PID:6704
- C:\Windows\System\ibhsYLm.exe
  C:\Windows\System\ibhsYLm.exe
  2⤵
  PID:6700
- C:\Windows\System\jreuEIy.exe
  C:\Windows\System\jreuEIy.exe
  2⤵
  PID:6740
- C:\Windows\System\gSEqxuv.exe
  C:\Windows\System\gSEqxuv.exe
  2⤵
  PID:6760
- C:\Windows\System\PQVSOHy.exe
  C:\Windows\System\PQVSOHy.exe
  2⤵
  PID:6892
- C:\Windows\System\TwIIREo.exe
  C:\Windows\System\TwIIREo.exe
  2⤵
  PID:6788
- C:\Windows\System\qyXrZkP.exe
  C:\Windows\System\qyXrZkP.exe
  2⤵
  PID:6808
- C:\Windows\System\KoWRuAv.exe
  C:\Windows\System\KoWRuAv.exe
  2⤵
  PID:6824
- C:\Windows\System\nYCfpdb.exe
  C:\Windows\System\nYCfpdb.exe
  2⤵
  PID:6828
- C:\Windows\System\MCeKRHh.exe
  C:\Windows\System\MCeKRHh.exe
  2⤵
  PID:6908
- C:\Windows\System\SmQaRnD.exe
  C:\Windows\System\SmQaRnD.exe
  2⤵
  PID:6968
- C:\Windows\System\ZjNQoOw.exe
  C:\Windows\System\ZjNQoOw.exe
  2⤵
  PID:6728
- C:\Windows\System\MRAAcWt.exe
  C:\Windows\System\MRAAcWt.exe
  2⤵
  PID:7004
- C:\Windows\System\jceZHVA.exe
  C:\Windows\System\jceZHVA.exe
  2⤵
  PID:7068
- C:\Windows\System\pNzriFA.exe
  C:\Windows\System\pNzriFA.exe
  2⤵
  PID:7116
- C:\Windows\System\nyMBLIp.exe
  C:\Windows\System\nyMBLIp.exe
  2⤵
  PID:7128
- C:\Windows\System\uqhjzJB.exe
  C:\Windows\System\uqhjzJB.exe
  2⤵
  PID:7136
- C:\Windows\System\RsCuFtn.exe
  C:\Windows\System\RsCuFtn.exe
  2⤵
  PID:7156
- C:\Windows\System\YvYBObm.exe
  C:\Windows\System\YvYBObm.exe
  2⤵
  PID:6156
- C:\Windows\System\zhKkElt.exe
  C:\Windows\System\zhKkElt.exe
  2⤵
  PID:5964
- C:\Windows\System\qURMsZT.exe
  C:\Windows\System\qURMsZT.exe
  2⤵
  PID:5560
- C:\Windows\System\gWQnvIj.exe
  C:\Windows\System\gWQnvIj.exe
  2⤵
  PID:6316
- C:\Windows\System\zcBWtZS.exe
  C:\Windows\System\zcBWtZS.exe
  2⤵
  PID:6300
- C:\Windows\System\YGVBwcF.exe
  C:\Windows\System\YGVBwcF.exe
  2⤵
  PID:6348
- C:\Windows\System\QAeZMQN.exe
  C:\Windows\System\QAeZMQN.exe
  2⤵
  PID:7080
- C:\Windows\System\xFcKOTN.exe
  C:\Windows\System\xFcKOTN.exe
  2⤵
  PID:6236
- C:\Windows\System\bMQqwWs.exe
  C:\Windows\System\bMQqwWs.exe
  2⤵
  PID:6384
- C:\Windows\System\ijsWRwH.exe
  C:\Windows\System\ijsWRwH.exe
  2⤵
  PID:6368
- C:\Windows\System\JINWJtH.exe
  C:\Windows\System\JINWJtH.exe
  2⤵
  PID:6428
- C:\Windows\System\nWLhsLa.exe
  C:\Windows\System\nWLhsLa.exe
  2⤵
  PID:6532
- C:\Windows\System\gwbauOB.exe
  C:\Windows\System\gwbauOB.exe
  2⤵
  PID:6688
- C:\Windows\System\EhVAiYh.exe
  C:\Windows\System\EhVAiYh.exe
  2⤵
  PID:6596
- C:\Windows\System\WADAegj.exe
  C:\Windows\System\WADAegj.exe
  2⤵
  PID:6632
- C:\Windows\System\tWcuAnv.exe
  C:\Windows\System\tWcuAnv.exe
  2⤵
  PID:6724
- C:\Windows\System\MwbZlCp.exe
  C:\Windows\System\MwbZlCp.exe
  2⤵
  PID:6872
- C:\Windows\System\ZIsuoyg.exe
  C:\Windows\System\ZIsuoyg.exe
  2⤵
  PID:6912
- C:\Windows\System\xlSBLnu.exe
  C:\Windows\System\xlSBLnu.exe
  2⤵
  PID:6952
- C:\Windows\System\wRTSEiP.exe
  C:\Windows\System\wRTSEiP.exe
  2⤵
  PID:7120
- C:\Windows\System\pAIhZOK.exe
  C:\Windows\System\pAIhZOK.exe
  2⤵
  PID:7152
- C:\Windows\System\jvpnFKh.exe
  C:\Windows\System\jvpnFKh.exe
  2⤵
  PID:6616
- C:\Windows\System\oCuvbKj.exe
  C:\Windows\System\oCuvbKj.exe
  2⤵
  PID:6936
- C:\Windows\System\IKWapJW.exe
  C:\Windows\System\IKWapJW.exe
  2⤵
  PID:5572
- C:\Windows\System\HhralYs.exe
  C:\Windows\System\HhralYs.exe
  2⤵
  PID:6252
- C:\Windows\System\fMnqWwy.exe
  C:\Windows\System\fMnqWwy.exe
  2⤵
  PID:6268
- C:\Windows\System\YSLzyiV.exe
  C:\Windows\System\YSLzyiV.exe
  2⤵
  PID:6484
- C:\Windows\System\EaHAYKU.exe
  C:\Windows\System\EaHAYKU.exe
  2⤵
  PID:6176
- C:\Windows\System\xUPWnOL.exe
  C:\Windows\System\xUPWnOL.exe
  2⤵
  PID:6576
- C:\Windows\System\ZpyyGMD.exe
  C:\Windows\System\ZpyyGMD.exe
  2⤵
  PID:6772
- C:\Windows\System\qLsMMEW.exe
  C:\Windows\System\qLsMMEW.exe
  2⤵
  PID:6876
- C:\Windows\System\oOvEQWm.exe
  C:\Windows\System\oOvEQWm.exe
  2⤵
  PID:7000
- C:\Windows\System\KHvMzuo.exe
  C:\Windows\System\KHvMzuo.exe
  2⤵
  PID:6836
- C:\Windows\System\hxRVbRc.exe
  C:\Windows\System\hxRVbRc.exe
  2⤵
  PID:7144
- C:\Windows\System\uwpPmmn.exe
  C:\Windows\System\uwpPmmn.exe
  2⤵
  PID:6984
- C:\Windows\System\YGsDxXB.exe
  C:\Windows\System\YGsDxXB.exe
  2⤵
  PID:6208
- C:\Windows\System\BDBwWWP.exe
  C:\Windows\System\BDBwWWP.exe
  2⤵
  PID:6320
- C:\Windows\System\yRSgixr.exe
  C:\Windows\System\yRSgixr.exe
  2⤵
  PID:6512
- C:\Windows\System\JsulhxB.exe
  C:\Windows\System\JsulhxB.exe
  2⤵
  PID:6444
- C:\Windows\System\nZMjgLn.exe
  C:\Windows\System\nZMjgLn.exe
  2⤵
  PID:7100
- C:\Windows\System\VvlOxpB.exe
  C:\Windows\System\VvlOxpB.exe
  2⤵
  PID:6780
- C:\Windows\System\DZLDtJQ.exe
  C:\Windows\System\DZLDtJQ.exe
  2⤵
  PID:6564
- C:\Windows\System\nHwUtGD.exe
  C:\Windows\System\nHwUtGD.exe
  2⤵
  PID:7064
- C:\Windows\System\DJqUHxx.exe
  C:\Windows\System\DJqUHxx.exe
  2⤵
  PID:7104
- C:\Windows\System\GtIOocD.exe
  C:\Windows\System\GtIOocD.exe
  2⤵
  PID:7180
- C:\Windows\System\buYAZcO.exe
  C:\Windows\System\buYAZcO.exe
  2⤵
  PID:7196
- C:\Windows\System\sUieFsm.exe
  C:\Windows\System\sUieFsm.exe
  2⤵
  PID:7212
- C:\Windows\System\VFnSIAV.exe
  C:\Windows\System\VFnSIAV.exe
  2⤵
  PID:7228
- C:\Windows\System\xjqzwml.exe
  C:\Windows\System\xjqzwml.exe
  2⤵
  PID:7244
- C:\Windows\System\qgSpXgn.exe
  C:\Windows\System\qgSpXgn.exe
  2⤵
  PID:7260
- C:\Windows\System\IJtyDOD.exe
  C:\Windows\System\IJtyDOD.exe
  2⤵
  PID:7276
- C:\Windows\System\TpqFUQB.exe
  C:\Windows\System\TpqFUQB.exe
  2⤵
  PID:7292
- C:\Windows\System\RPsZHpJ.exe
  C:\Windows\System\RPsZHpJ.exe
  2⤵
  PID:7312
- C:\Windows\System\hlvLnRO.exe
  C:\Windows\System\hlvLnRO.exe
  2⤵
  PID:7328
- C:\Windows\System\CcBwrXU.exe
  C:\Windows\System\CcBwrXU.exe
  2⤵
  PID:7344
- C:\Windows\System\uDnpuZr.exe
  C:\Windows\System\uDnpuZr.exe
  2⤵
  PID:7364
- C:\Windows\System\GGtSurs.exe
  C:\Windows\System\GGtSurs.exe
  2⤵
  PID:7436
- C:\Windows\System\FueKisl.exe
  C:\Windows\System\FueKisl.exe
  2⤵
  PID:7452
- C:\Windows\System\MrGocoy.exe
  C:\Windows\System\MrGocoy.exe
  2⤵
  PID:7476
- C:\Windows\System\MPCxPps.exe
  C:\Windows\System\MPCxPps.exe
  2⤵
  PID:7492
- C:\Windows\System\DSUWGoz.exe
  C:\Windows\System\DSUWGoz.exe
  2⤵
  PID:7508
- C:\Windows\System\bPmUEvW.exe
  C:\Windows\System\bPmUEvW.exe
  2⤵
  PID:7524
- C:\Windows\System\aiaQpFY.exe
  C:\Windows\System\aiaQpFY.exe
  2⤵
  PID:7540
- C:\Windows\System\yqFyorp.exe
  C:\Windows\System\yqFyorp.exe
  2⤵
  PID:7556
- C:\Windows\System\VwhVveg.exe
  C:\Windows\System\VwhVveg.exe
  2⤵
  PID:7572
- C:\Windows\System\lECGLta.exe
  C:\Windows\System\lECGLta.exe
  2⤵
  PID:7592
- C:\Windows\System\tUMBVUm.exe
  C:\Windows\System\tUMBVUm.exe
  2⤵
  PID:7608
- C:\Windows\System\EnrOVAx.exe
  C:\Windows\System\EnrOVAx.exe
  2⤵
  PID:7624
- C:\Windows\System\JhYxwur.exe
  C:\Windows\System\JhYxwur.exe
  2⤵
  PID:7640
- C:\Windows\System\rGRefdx.exe
  C:\Windows\System\rGRefdx.exe
  2⤵
  PID:7656
- C:\Windows\System\ImxhSxE.exe
  C:\Windows\System\ImxhSxE.exe
  2⤵
  PID:7672
- C:\Windows\System\tYvUtsy.exe
  C:\Windows\System\tYvUtsy.exe
  2⤵
  PID:7688
- C:\Windows\System\UoIDxzz.exe
  C:\Windows\System\UoIDxzz.exe
  2⤵
  PID:7704
- C:\Windows\System\iaLphGw.exe
  C:\Windows\System\iaLphGw.exe
  2⤵
  PID:7720
- C:\Windows\System\ffcRuNz.exe
  C:\Windows\System\ffcRuNz.exe
  2⤵
  PID:7736
- C:\Windows\System\xCRgmpL.exe
  C:\Windows\System\xCRgmpL.exe
  2⤵
  PID:7804
- C:\Windows\System\skwRupn.exe
  C:\Windows\System\skwRupn.exe
  2⤵
  PID:7820
- C:\Windows\System\oHwzhCW.exe
  C:\Windows\System\oHwzhCW.exe
  2⤵
  PID:7836
- C:\Windows\System\oDzFAsN.exe
  C:\Windows\System\oDzFAsN.exe
  2⤵
  PID:7852
- C:\Windows\System\iYqCHtx.exe
  C:\Windows\System\iYqCHtx.exe
  2⤵
  PID:7868
- C:\Windows\System\NIbtZZY.exe
  C:\Windows\System\NIbtZZY.exe
  2⤵
  PID:7884
- C:\Windows\System\RxkzYVY.exe
  C:\Windows\System\RxkzYVY.exe
  2⤵
  PID:7900
- C:\Windows\System\nDSWWsh.exe
  C:\Windows\System\nDSWWsh.exe
  2⤵
  PID:7916
- C:\Windows\System\ZVSVWSb.exe
  C:\Windows\System\ZVSVWSb.exe
  2⤵
  PID:7932
- C:\Windows\System\ozmzTFI.exe
  C:\Windows\System\ozmzTFI.exe
  2⤵
  PID:7952
- C:\Windows\System\kYBHUZZ.exe
  C:\Windows\System\kYBHUZZ.exe
  2⤵
  PID:7968
- C:\Windows\System\TfGzaap.exe
  C:\Windows\System\TfGzaap.exe
  2⤵
  PID:7984
- C:\Windows\System\KFQjgCi.exe
  C:\Windows\System\KFQjgCi.exe
  2⤵
  PID:8000
- C:\Windows\System\bgFzTXD.exe
  C:\Windows\System\bgFzTXD.exe
  2⤵
  PID:8016
- C:\Windows\System\ThAIFZQ.exe
  C:\Windows\System\ThAIFZQ.exe
  2⤵
  PID:8032
- C:\Windows\System\WEoyOyu.exe
  C:\Windows\System\WEoyOyu.exe
  2⤵
  PID:8048
- C:\Windows\System\EWqgEod.exe
  C:\Windows\System\EWqgEod.exe
  2⤵
  PID:8064
- C:\Windows\System\cQOTKuZ.exe
  C:\Windows\System\cQOTKuZ.exe
  2⤵
  PID:8080
- C:\Windows\System\qIxzhCC.exe
  C:\Windows\System\qIxzhCC.exe
  2⤵
  PID:8096
- C:\Windows\System\vWPDxtA.exe
  C:\Windows\System\vWPDxtA.exe
  2⤵
  PID:8112
- C:\Windows\System\fdNfPqP.exe
  C:\Windows\System\fdNfPqP.exe
  2⤵
  PID:8128
- C:\Windows\System\tZDnvTe.exe
  C:\Windows\System\tZDnvTe.exe
  2⤵
  PID:8184
- C:\Windows\System\ZeAYJZU.exe
  C:\Windows\System\ZeAYJZU.exe
  2⤵
  PID:6776
- C:\Windows\System\xuxhZAo.exe
  C:\Windows\System\xuxhZAo.exe
  2⤵
  PID:7172
- C:\Windows\System\tSFcFwa.exe
  C:\Windows\System\tSFcFwa.exe
  2⤵
  PID:7164
- C:\Windows\System\PdPbiiu.exe
  C:\Windows\System\PdPbiiu.exe
  2⤵
  PID:7252
- C:\Windows\System\jpZYFAH.exe
  C:\Windows\System\jpZYFAH.exe
  2⤵
  PID:7204
- C:\Windows\System\VfMNkQc.exe
  C:\Windows\System\VfMNkQc.exe
  2⤵
  PID:7268
- C:\Windows\System\AuruxvX.exe
  C:\Windows\System\AuruxvX.exe
  2⤵
  PID:7324
- C:\Windows\System\ixiMgBy.exe
  C:\Windows\System\ixiMgBy.exe
  2⤵
  PID:7444
- C:\Windows\System\KVemROC.exe
  C:\Windows\System\KVemROC.exe
  2⤵
  PID:7484
- C:\Windows\System\oGKdZjA.exe
  C:\Windows\System\oGKdZjA.exe
  2⤵
  PID:7380
- C:\Windows\System\hOkfuVT.exe
  C:\Windows\System\hOkfuVT.exe
  2⤵
  PID:7488
- C:\Windows\System\PIzbLnI.exe
  C:\Windows\System\PIzbLnI.exe
  2⤵
  PID:7548
- C:\Windows\System\vzNgxdR.exe
  C:\Windows\System\vzNgxdR.exe
  2⤵
  PID:7580
- C:\Windows\System\DyNVaIn.exe
  C:\Windows\System\DyNVaIn.exe
  2⤵
  PID:7564
- C:\Windows\System\lDEdmzg.exe
  C:\Windows\System\lDEdmzg.exe
  2⤵
  PID:7616
- C:\Windows\System\YAZaXfo.exe
  C:\Windows\System\YAZaXfo.exe
  2⤵
  PID:7604
- C:\Windows\System\IUYsdTC.exe
  C:\Windows\System\IUYsdTC.exe
  2⤵
  PID:7636
- C:\Windows\System\OOmnkDR.exe
  C:\Windows\System\OOmnkDR.exe
  2⤵
  PID:7716
- C:\Windows\System\vYjaRUo.exe
  C:\Windows\System\vYjaRUo.exe
  2⤵
  PID:7748
- C:\Windows\System\HLCbenl.exe
  C:\Windows\System\HLCbenl.exe
  2⤵
  PID:7756
- C:\Windows\System\RuHtilW.exe
  C:\Windows\System\RuHtilW.exe
  2⤵
  PID:7772
- C:\Windows\System\MbQQzjX.exe
  C:\Windows\System\MbQQzjX.exe
  2⤵
  PID:7924
- C:\Windows\System\RliyeJt.exe
  C:\Windows\System\RliyeJt.exe
  2⤵
  PID:7964
- C:\Windows\System\GOYDetB.exe
  C:\Windows\System\GOYDetB.exe
  2⤵
  PID:7948
- C:\Windows\System\BwcXijA.exe
  C:\Windows\System\BwcXijA.exe
  2⤵
  PID:8024
- C:\Windows\System\qOimTVD.exe
  C:\Windows\System\qOimTVD.exe
  2⤵
  PID:8028
- C:\Windows\System\kBhJHFO.exe
  C:\Windows\System\kBhJHFO.exe
  2⤵
  PID:8092
- C:\Windows\System\gedRXsT.exe
  C:\Windows\System\gedRXsT.exe
  2⤵
  PID:8104
- C:\Windows\System\pcaugNr.exe
  C:\Windows\System\pcaugNr.exe
  2⤵
  PID:8136
- C:\Windows\System\MIDtYXx.exe
  C:\Windows\System\MIDtYXx.exe
  2⤵
  PID:6784
- C:\Windows\System\oyfDPfe.exe
  C:\Windows\System\oyfDPfe.exe
  2⤵
  PID:7320
- C:\Windows\System\ayEGjxC.exe
  C:\Windows\System\ayEGjxC.exe
  2⤵
  PID:8152
- C:\Windows\System\TZqjstp.exe
  C:\Windows\System\TZqjstp.exe
  2⤵
  PID:8172
- C:\Windows\System\MxCcVaJ.exe
  C:\Windows\System\MxCcVaJ.exe
  2⤵
  PID:7224
- C:\Windows\System\rzXxUWY.exe
  C:\Windows\System\rzXxUWY.exe
  2⤵
  PID:6916
- C:\Windows\System\mkDAYYv.exe
  C:\Windows\System\mkDAYYv.exe
  2⤵
  PID:7448
- C:\Windows\System\zuHiVtC.exe
  C:\Windows\System\zuHiVtC.exe
  2⤵
  PID:7396
- C:\Windows\System\jLfsVGE.exe
  C:\Windows\System\jLfsVGE.exe
  2⤵
  PID:7372
- C:\Windows\System\bsbFDLI.exe
  C:\Windows\System\bsbFDLI.exe
  2⤵
  PID:7400
- C:\Windows\System\KRjaFyy.exe
  C:\Windows\System\KRjaFyy.exe
  2⤵
  PID:7532
- C:\Windows\System\IXdTOlK.exe
  C:\Windows\System\IXdTOlK.exe
  2⤵
  PID:7632
- C:\Windows\System\nLxtagE.exe
  C:\Windows\System\nLxtagE.exe
  2⤵
  PID:7764
- C:\Windows\System\GFfWmsy.exe
  C:\Windows\System\GFfWmsy.exe
  2⤵
  PID:7460
- C:\Windows\System\GGWgDMe.exe
  C:\Windows\System\GGWgDMe.exe
  2⤵
  PID:7620
- C:\Windows\System\xDOniOv.exe
  C:\Windows\System\xDOniOv.exe
  2⤵
  PID:7892
- C:\Windows\System\EQQpwAg.exe
  C:\Windows\System\EQQpwAg.exe
  2⤵
  PID:7500
- C:\Windows\System\hrSckBQ.exe
  C:\Windows\System\hrSckBQ.exe
  2⤵
  PID:7800
- C:\Windows\System\jRYrnjf.exe
  C:\Windows\System\jRYrnjf.exe
  2⤵
  PID:7896
- C:\Windows\System\whwohUe.exe
  C:\Windows\System\whwohUe.exe
  2⤵
  PID:7816
- C:\Windows\System\BnhUMxN.exe
  C:\Windows\System\BnhUMxN.exe
  2⤵
  PID:7876
- C:\Windows\System\uPacheJ.exe
  C:\Windows\System\uPacheJ.exe
  2⤵
  PID:8088
- C:\Windows\System\mcnRHdZ.exe
  C:\Windows\System\mcnRHdZ.exe
  2⤵
  PID:7300
- C:\Windows\System\ndYtvmV.exe
  C:\Windows\System\ndYtvmV.exe
  2⤵
  PID:7240
- C:\Windows\System\BIBXKsx.exe
  C:\Windows\System\BIBXKsx.exe
  2⤵
  PID:8044
- C:\Windows\System\NZQhNye.exe
  C:\Windows\System\NZQhNye.exe
  2⤵
  PID:6840
- C:\Windows\System\UCNthFu.exe
  C:\Windows\System\UCNthFu.exe
  2⤵
  PID:8180
- C:\Windows\System\zkpBFqw.exe
  C:\Windows\System\zkpBFqw.exe
  2⤵
  PID:7472
- C:\Windows\System\qnIbspn.exe
  C:\Windows\System\qnIbspn.exe
  2⤵
  PID:3000
- C:\Windows\System\MMFEVro.exe
  C:\Windows\System\MMFEVro.exe
  2⤵
  PID:952
- C:\Windows\System\LrWzdOV.exe
  C:\Windows\System\LrWzdOV.exe
  2⤵
  PID:1924
- C:\Windows\System\kLKxiAq.exe
  C:\Windows\System\kLKxiAq.exe
  2⤵
  PID:1212
- C:\Windows\System\vQSpSec.exe
  C:\Windows\System\vQSpSec.exe
  2⤵
  PID:7336
- C:\Windows\System\oVWvebd.exe
  C:\Windows\System\oVWvebd.exe
  2⤵
  PID:7236
- C:\Windows\System\FvZvfjM.exe
  C:\Windows\System\FvZvfjM.exe
  2⤵
  PID:7432
- C:\Windows\System\kTyDghu.exe
  C:\Windows\System\kTyDghu.exe
  2⤵
  PID:7784
- C:\Windows\System\pGrFXVS.exe
  C:\Windows\System\pGrFXVS.exe
  2⤵
  PID:8076
- C:\Windows\System\aSXNChw.exe
  C:\Windows\System\aSXNChw.exe
  2⤵
  PID:7188
- C:\Windows\System\HGONHGW.exe
  C:\Windows\System\HGONHGW.exe
  2⤵
  PID:7376
- C:\Windows\System\myLqCAk.exe
  C:\Windows\System\myLqCAk.exe
  2⤵
  PID:2656
- C:\Windows\System\npeEjTS.exe
  C:\Windows\System\npeEjTS.exe
  2⤵
  PID:7504
- C:\Windows\System\bwhYteX.exe
  C:\Windows\System\bwhYteX.exe
  2⤵
  PID:7388
- C:\Windows\System\xAawdnD.exe
  C:\Windows\System\xAawdnD.exe
  2⤵
  PID:7912
- C:\Windows\System\gcwsSvl.exe
  C:\Windows\System\gcwsSvl.exe
  2⤵
  PID:7340
- C:\Windows\System\CvVEdPo.exe
  C:\Windows\System\CvVEdPo.exe
  2⤵
  PID:8196
- C:\Windows\System\dnqZWiY.exe
  C:\Windows\System\dnqZWiY.exe
  2⤵
  PID:8212
- C:\Windows\System\vqnPvyC.exe
  C:\Windows\System\vqnPvyC.exe
  2⤵
  PID:8312
- C:\Windows\System\kQPRQtJ.exe
  C:\Windows\System\kQPRQtJ.exe
  2⤵
  PID:8516
- C:\Windows\System\dCUXUoS.exe
  C:\Windows\System\dCUXUoS.exe
  2⤵
  PID:8532
- C:\Windows\System\mSHpnMy.exe
  C:\Windows\System\mSHpnMy.exe
  2⤵
  PID:8548
- C:\Windows\System\URVXWaf.exe
  C:\Windows\System\URVXWaf.exe
  2⤵
  PID:8564
- C:\Windows\System\JQDjUvb.exe
  C:\Windows\System\JQDjUvb.exe
  2⤵
  PID:8580
- C:\Windows\System\FbGKvuC.exe
  C:\Windows\System\FbGKvuC.exe
  2⤵
  PID:8652
- C:\Windows\System\daNraYR.exe
  C:\Windows\System\daNraYR.exe
  2⤵
  PID:8668
- C:\Windows\System\VlPBOFv.exe
  C:\Windows\System\VlPBOFv.exe
  2⤵
  PID:8684
- C:\Windows\System\CExicAG.exe
  C:\Windows\System\CExicAG.exe
  2⤵
  PID:8700
- C:\Windows\System\iRIgsnT.exe
  C:\Windows\System\iRIgsnT.exe
  2⤵
  PID:8716
- C:\Windows\System\MbDleAz.exe
  C:\Windows\System\MbDleAz.exe
  2⤵
  PID:8732
- C:\Windows\System\wopexGW.exe
  C:\Windows\System\wopexGW.exe
  2⤵
  PID:8752
- C:\Windows\System\wdFQCyl.exe
  C:\Windows\System\wdFQCyl.exe
  2⤵
  PID:8776
- C:\Windows\System\UFRluZd.exe
  C:\Windows\System\UFRluZd.exe
  2⤵
  PID:8792
- C:\Windows\System\fdAscGq.exe
  C:\Windows\System\fdAscGq.exe
  2⤵
  PID:8808
- C:\Windows\System\IsDbhIy.exe
  C:\Windows\System\IsDbhIy.exe
  2⤵
  PID:8824
- C:\Windows\System\biocfmp.exe
  C:\Windows\System\biocfmp.exe
  2⤵
  PID:8840
- C:\Windows\System\qCrxcYd.exe
  C:\Windows\System\qCrxcYd.exe
  2⤵
  PID:8856
- C:\Windows\System\nKuCxGA.exe
  C:\Windows\System\nKuCxGA.exe
  2⤵
  PID:8872
- C:\Windows\System\RcplrVI.exe
  C:\Windows\System\RcplrVI.exe
  2⤵
  PID:8232
- C:\Windows\System\fFePdiD.exe
  C:\Windows\System\fFePdiD.exe
  2⤵
  PID:8260
- C:\Windows\System\YPBYVuR.exe
  C:\Windows\System\YPBYVuR.exe
  2⤵
  PID:8276
- C:\Windows\System\GOGLMUu.exe
  C:\Windows\System\GOGLMUu.exe
  2⤵
  PID:8300
- C:\Windows\System\yyBCGOI.exe
  C:\Windows\System\yyBCGOI.exe
  2⤵
  PID:8328
- C:\Windows\System\tsTCanL.exe
  C:\Windows\System\tsTCanL.exe
  2⤵
  PID:8336
- C:\Windows\System\mSafBEu.exe
  C:\Windows\System\mSafBEu.exe
  2⤵
  PID:8356
- C:\Windows\System\GMpXlNj.exe
  C:\Windows\System\GMpXlNj.exe
  2⤵
  PID:8444
- C:\Windows\System\VqLGUst.exe
  C:\Windows\System\VqLGUst.exe
  2⤵
  PID:8472
- C:\Windows\System\GEsNYNj.exe
  C:\Windows\System\GEsNYNj.exe
  2⤵
  PID:8480
- C:\Windows\System\kQQzZJY.exe
  C:\Windows\System\kQQzZJY.exe
  2⤵
  PID:8508
- C:\Windows\System\eLatHfs.exe
  C:\Windows\System\eLatHfs.exe
  2⤵
  PID:8572
- C:\Windows\System\IDjGRLQ.exe
  C:\Windows\System\IDjGRLQ.exe
  2⤵
  PID:8468
- C:\Windows\System\KTauvqV.exe
  C:\Windows\System\KTauvqV.exe
  2⤵
  PID:8612
- C:\Windows\System\gYNtoha.exe
  C:\Windows\System\gYNtoha.exe
  2⤵
  PID:8696
- C:\Windows\System\wCgsBoX.exe
  C:\Windows\System\wCgsBoX.exe
  2⤵
  PID:8528
- C:\Windows\System\SnoLiDH.exe
  C:\Windows\System\SnoLiDH.exe
  2⤵
  PID:8592
- C:\Windows\System\ikkRPMB.exe
  C:\Windows\System\ikkRPMB.exe
  2⤵
  PID:8744
- C:\Windows\System\pTKgBIB.exe
  C:\Windows\System\pTKgBIB.exe
  2⤵
  PID:8788
- C:\Windows\System\uFprBjB.exe
  C:\Windows\System\uFprBjB.exe
  2⤵
  PID:8868
- C:\Windows\System\DzJWkSk.exe
  C:\Windows\System\DzJWkSk.exe
  2⤵
  PID:8800
- C:\Windows\System\jfxcpax.exe
  C:\Windows\System\jfxcpax.exe
  2⤵
  PID:8332
- C:\Windows\System\irhfwub.exe
  C:\Windows\System\irhfwub.exe
  2⤵
  PID:8364
- C:\Windows\System\aKCYupq.exe
  C:\Windows\System\aKCYupq.exe
  2⤵
  PID:8848
- C:\Windows\System\eazZluV.exe
  C:\Windows\System\eazZluV.exe
  2⤵
  PID:8908
- C:\Windows\System\RenymAH.exe
  C:\Windows\System\RenymAH.exe
  2⤵
  PID:8400
- C:\Windows\System\bPdpOyY.exe
  C:\Windows\System\bPdpOyY.exe
  2⤵
  PID:8956
- C:\Windows\System\PylvPaV.exe
  C:\Windows\System\PylvPaV.exe
  2⤵
  PID:8996
- C:\Windows\System\oVpvWPj.exe
  C:\Windows\System\oVpvWPj.exe
  2⤵
  PID:9108
- C:\Windows\System\zDNAXkp.exe
  C:\Windows\System\zDNAXkp.exe
  2⤵
  PID:9132
- C:\Windows\System\ydUPxYX.exe
  C:\Windows\System\ydUPxYX.exe
  2⤵
  PID:9156
- C:\Windows\System\ZZIRTEb.exe
  C:\Windows\System\ZZIRTEb.exe
  2⤵
  PID:9172
- C:\Windows\System\GetVuZa.exe
  C:\Windows\System\GetVuZa.exe
  2⤵
  PID:9188
- C:\Windows\System\iaUFUOG.exe
  C:\Windows\System\iaUFUOG.exe
  2⤵
  PID:9208
- C:\Windows\System\ZakeYpL.exe
  C:\Windows\System\ZakeYpL.exe
  2⤵
  PID:7844
- C:\Windows\System\CHdFcEl.exe
  C:\Windows\System\CHdFcEl.exe
  2⤵
  PID:8220
- C:\Windows\System\zlpnJWN.exe
  C:\Windows\System\zlpnJWN.exe
  2⤵
  PID:7668
- C:\Windows\System\CHuqnsV.exe
  C:\Windows\System\CHuqnsV.exe
  2⤵
  PID:8272
- C:\Windows\System\JehygMd.exe
  C:\Windows\System\JehygMd.exe
  2⤵
  PID:8408
- C:\Windows\System\GfQnnvD.exe
  C:\Windows\System\GfQnnvD.exe
  2⤵
  PID:4928
- C:\Windows\System\RAXlBwY.exe
  C:\Windows\System\RAXlBwY.exe
  2⤵
  PID:8412
- C:\Windows\System\JijFVFH.exe
  C:\Windows\System\JijFVFH.exe
  2⤵
  PID:8476
- C:\Windows\System\FDfVXas.exe
  C:\Windows\System\FDfVXas.exe
  2⤵
  PID:8912
- C:\Windows\System\cCNkLIz.exe
  C:\Windows\System\cCNkLIz.exe
  2⤵
  PID:8944
- C:\Windows\System\aKyXfGX.exe
  C:\Windows\System\aKyXfGX.exe
  2⤵
  PID:9008
- C:\Windows\System\vKQobso.exe
  C:\Windows\System\vKQobso.exe
  2⤵
  PID:9076
- C:\Windows\System\WartrZT.exe
  C:\Windows\System\WartrZT.exe
  2⤵
  PID:7648
- C:\Windows\System\QmgsHtx.exe
  C:\Windows\System\QmgsHtx.exe
  2⤵
  PID:7944
- C:\Windows\System\WvMdrfG.exe
  C:\Windows\System\WvMdrfG.exe
  2⤵
  PID:8728
- C:\Windows\System\ZxxaADt.exe
  C:\Windows\System\ZxxaADt.exe
  2⤵
  PID:8864
- C:\Windows\System\lFMueFk.exe
  C:\Windows\System\lFMueFk.exe
  2⤵
  PID:9004
- C:\Windows\System\Xrbvhao.exe
  C:\Windows\System\Xrbvhao.exe
  2⤵
  PID:8288
- C:\Windows\System\NmZmPwX.exe
  C:\Windows\System\NmZmPwX.exe
  2⤵
  PID:8588
- C:\Windows\System\NPIIxFO.exe
  C:\Windows\System\NPIIxFO.exe
  2⤵
  PID:8632
- C:\Windows\System\fJAwabi.exe
  C:\Windows\System\fJAwabi.exe
  2⤵
  PID:8404
- C:\Windows\System\VauhsuJ.exe
  C:\Windows\System\VauhsuJ.exe
  2⤵
  PID:8448
- C:\Windows\System\PhtXDij.exe
  C:\Windows\System\PhtXDij.exe
  2⤵
  PID:8256
- C:\Windows\System\iUbdIqA.exe
  C:\Windows\System\iUbdIqA.exe
  2⤵
  PID:8252
- C:\Windows\System\rlJTrrq.exe
  C:\Windows\System\rlJTrrq.exe
  2⤵
  PID:8392
- C:\Windows\System\abIPrcs.exe
  C:\Windows\System\abIPrcs.exe
  2⤵
  PID:8772
- C:\Windows\System\jtgtIBT.exe
  C:\Windows\System\jtgtIBT.exe
  2⤵
  PID:8924
- C:\Windows\System\XwBxtln.exe
  C:\Windows\System\XwBxtln.exe
  2⤵
  PID:8372
- C:\Windows\System\Tlwwhzy.exe
  C:\Windows\System\Tlwwhzy.exe
  2⤵
  PID:8948
- C:\Windows\System\rGAbfkS.exe
  C:\Windows\System\rGAbfkS.exe
  2⤵
  PID:9128
- C:\Windows\System\xnUiVlP.exe
  C:\Windows\System\xnUiVlP.exe
  2⤵
  PID:9200
- C:\Windows\System\HPTggvq.exe
  C:\Windows\System\HPTggvq.exe
  2⤵
  PID:9064
- C:\Windows\System\JCTSzBV.exe
  C:\Windows\System\JCTSzBV.exe
  2⤵
  PID:8884
- C:\Windows\System\fLGqxSa.exe
  C:\Windows\System\fLGqxSa.exe
  2⤵
  PID:9056
- C:\Windows\System\SLAcIJg.exe
  C:\Windows\System\SLAcIJg.exe
  2⤵
  PID:9072
- C:\Windows\System\zBGVios.exe
  C:\Windows\System\zBGVios.exe
  2⤵
  PID:8268
- C:\Windows\System\DkglLDb.exe
  C:\Windows\System\DkglLDb.exe
  2⤵
  PID:1696
- C:\Windows\System\PpGbtlJ.exe
  C:\Windows\System\PpGbtlJ.exe
  2⤵
  PID:3028
- C:\Windows\System\lIikmYE.exe
  C:\Windows\System\lIikmYE.exe
  2⤵
  PID:8936
- C:\Windows\System\PrKeblK.exe
  C:\Windows\System\PrKeblK.exe
  2⤵
  PID:976
- C:\Windows\System\tVRenJc.exe
  C:\Windows\System\tVRenJc.exe
  2⤵
  PID:8436
- C:\Windows\System\NfAKsnQ.exe
  C:\Windows\System\NfAKsnQ.exe
  2⤵
  PID:9036
- C:\Windows\System\RnpndsL.exe
  C:\Windows\System\RnpndsL.exe
  2⤵
  PID:8960
- C:\Windows\System\hvTlvge.exe
  C:\Windows\System\hvTlvge.exe
  2⤵
  PID:9044
- C:\Windows\System\ubqJWWS.exe
  C:\Windows\System\ubqJWWS.exe
  2⤵
  PID:9100
- C:\Windows\System\xycZpCO.exe
  C:\Windows\System\xycZpCO.exe
  2⤵
  PID:8680
- C:\Windows\System\ilycvqy.exe
  C:\Windows\System\ilycvqy.exe
  2⤵
  PID:9144
- C:\Windows\System\QJFdGcH.exe
  C:\Windows\System\QJFdGcH.exe
  2⤵
  PID:8352
- C:\Windows\System\ZnJpGdc.exe
  C:\Windows\System\ZnJpGdc.exe
  2⤵
  PID:8972
- C:\Windows\System\mwFJitv.exe
  C:\Windows\System\mwFJitv.exe
  2⤵
  PID:8624
- C:\Windows\System\zeHLVPZ.exe
  C:\Windows\System\zeHLVPZ.exe
  2⤵
  PID:8464
- C:\Windows\System\YSIFGUx.exe
  C:\Windows\System\YSIFGUx.exe
  2⤵
  PID:8292
- C:\Windows\System\jwkOmpL.exe
  C:\Windows\System\jwkOmpL.exe
  2⤵
  PID:8384
- C:\Windows\System\PXChnCP.exe
  C:\Windows\System\PXChnCP.exe
  2⤵
  PID:9012
- C:\Windows\System\yCfvFpI.exe
  C:\Windows\System\yCfvFpI.exe
  2⤵
  PID:8980
- C:\Windows\System\DHViAmX.exe
  C:\Windows\System\DHViAmX.exe
  2⤵
  PID:8360
- C:\Windows\System\VzNdblK.exe
  C:\Windows\System\VzNdblK.exe
  2⤵
  PID:9140
- C:\Windows\System\RqwWKDM.exe
  C:\Windows\System\RqwWKDM.exe
  2⤵
  PID:8424
- C:\Windows\System\dNlLHIT.exe
  C:\Windows\System\dNlLHIT.exe
  2⤵
  PID:9032
- C:\Windows\System\XkHGyqZ.exe
  C:\Windows\System\XkHGyqZ.exe
  2⤵
  PID:8144
- C:\Windows\System\hMnpVbr.exe
  C:\Windows\System\hMnpVbr.exe
  2⤵
  PID:8440
- C:\Windows\System\saNFsLZ.exe
  C:\Windows\System\saNFsLZ.exe
  2⤵
  PID:8280
- C:\Windows\System\chnIYht.exe
  C:\Windows\System\chnIYht.exe
  2⤵
  PID:8304
- C:\Windows\System\DMjnRsp.exe
  C:\Windows\System\DMjnRsp.exe
  2⤵
  PID:9196
- C:\Windows\System\nSWtgvZ.exe
  C:\Windows\System\nSWtgvZ.exe
  2⤵
  PID:8616
- C:\Windows\System\JUSRkHo.exe
  C:\Windows\System\JUSRkHo.exe
  2⤵
  PID:8648
- C:\Windows\System\qHwZsAt.exe
  C:\Windows\System\qHwZsAt.exe
  2⤵
  PID:8932
- C:\Windows\System\wJfDTmm.exe
  C:\Windows\System\wJfDTmm.exe
  2⤵
  PID:8820
- C:\Windows\System\udssyVf.exe
  C:\Windows\System\udssyVf.exe
  2⤵
  PID:7356
- C:\Windows\System\LumLVvj.exe
  C:\Windows\System\LumLVvj.exe
  2⤵
  PID:9184
- C:\Windows\System\FcrMVwx.exe
  C:\Windows\System\FcrMVwx.exe
  2⤵
  PID:4920
- C:\Windows\System\OGyvVsr.exe
  C:\Windows\System\OGyvVsr.exe
  2⤵
  PID:9000
- C:\Windows\System\tpPnpfV.exe
  C:\Windows\System\tpPnpfV.exe
  2⤵
  PID:8348
- C:\Windows\System\fXfZKyw.exe
  C:\Windows\System\fXfZKyw.exe
  2⤵
  PID:8940
- C:\Windows\System\hxOzhDF.exe
  C:\Windows\System\hxOzhDF.exe
  2⤵
  PID:9124
- C:\Windows\System\OBzdcNQ.exe
  C:\Windows\System\OBzdcNQ.exe
  2⤵
  PID:8204
- C:\Windows\System\CXyKvTu.exe
  C:\Windows\System\CXyKvTu.exe
  2⤵
  PID:8660
- C:\Windows\System\byTkLDY.exe
  C:\Windows\System\byTkLDY.exe
  2⤵
  PID:8640
- C:\Windows\System\ZZdNgMu.exe
  C:\Windows\System\ZZdNgMu.exe
  2⤵
  PID:8432
- C:\Windows\System\QmgYuMm.exe
  C:\Windows\System\QmgYuMm.exe
  2⤵
  PID:9224
- C:\Windows\System\OssxQim.exe
  C:\Windows\System\OssxQim.exe
  2⤵
  PID:9244
- C:\Windows\System\vqsDtQm.exe
  C:\Windows\System\vqsDtQm.exe
  2⤵
  PID:9260
- C:\Windows\System\pibmKnF.exe
  C:\Windows\System\pibmKnF.exe
  2⤵
  PID:9276
- C:\Windows\System\UKafapK.exe
  C:\Windows\System\UKafapK.exe
  2⤵
  PID:9352
- C:\Windows\System\TovbVIs.exe
  C:\Windows\System\TovbVIs.exe
  2⤵
  PID:9372
- C:\Windows\System\rtrXSHf.exe
  C:\Windows\System\rtrXSHf.exe
  2⤵
  PID:9388
- C:\Windows\System\jQGNElM.exe
  C:\Windows\System\jQGNElM.exe
  2⤵
  PID:9404
- C:\Windows\System\fypJrDa.exe
  C:\Windows\System\fypJrDa.exe
  2⤵
  PID:9420
- C:\Windows\System\IKIFDEo.exe
  C:\Windows\System\IKIFDEo.exe
  2⤵
  PID:9436
- C:\Windows\System\bhPCPql.exe
  C:\Windows\System\bhPCPql.exe
  2⤵
  PID:9452
- C:\Windows\System\iNGCwzH.exe
  C:\Windows\System\iNGCwzH.exe
  2⤵
  PID:9468
- C:\Windows\System\MLHDmjA.exe
  C:\Windows\System\MLHDmjA.exe
  2⤵
  PID:9484
- C:\Windows\System\XItwIuy.exe
  C:\Windows\System\XItwIuy.exe
  2⤵
  PID:9508
- C:\Windows\System\hkoBPFw.exe
  C:\Windows\System\hkoBPFw.exe
  2⤵
  PID:9528
- C:\Windows\System\ibqIOrp.exe
  C:\Windows\System\ibqIOrp.exe
  2⤵
  PID:9544
- C:\Windows\System\CgfIQZT.exe
  C:\Windows\System\CgfIQZT.exe
  2⤵
  PID:9560
- C:\Windows\System\YIeidWB.exe
  C:\Windows\System\YIeidWB.exe
  2⤵
  PID:9576
- C:\Windows\System\QjKzbtr.exe
  C:\Windows\System\QjKzbtr.exe
  2⤵
  PID:9592
- C:\Windows\System\girqAVZ.exe
  C:\Windows\System\girqAVZ.exe
  2⤵
  PID:9608
- C:\Windows\System\HoWZVTh.exe
  C:\Windows\System\HoWZVTh.exe
  2⤵
  PID:9624
- C:\Windows\System\UovnNud.exe
  C:\Windows\System\UovnNud.exe
  2⤵
  PID:9640
- C:\Windows\System\IrpAAMz.exe
  C:\Windows\System\IrpAAMz.exe
  2⤵
  PID:9660
- C:\Windows\System\SrjwLQn.exe
  C:\Windows\System\SrjwLQn.exe
  2⤵
  PID:9676
- C:\Windows\System\zkFbLWr.exe
  C:\Windows\System\zkFbLWr.exe
  2⤵
  PID:9692
- C:\Windows\System\MzkvJoV.exe
  C:\Windows\System\MzkvJoV.exe
  2⤵
  PID:9708
- C:\Windows\System\bmDgjMK.exe
  C:\Windows\System\bmDgjMK.exe
  2⤵
  PID:9724
- C:\Windows\System\xBCRdVt.exe
  C:\Windows\System\xBCRdVt.exe
  2⤵
  PID:9740
- C:\Windows\System\CojHiEg.exe
  C:\Windows\System\CojHiEg.exe
  2⤵
  PID:9756
- C:\Windows\System\AovMlsV.exe
  C:\Windows\System\AovMlsV.exe
  2⤵
  PID:9772
- C:\Windows\System\WOKYwml.exe
  C:\Windows\System\WOKYwml.exe
  2⤵
  PID:9788
- C:\Windows\System\LECiTEq.exe
  C:\Windows\System\LECiTEq.exe
  2⤵
  PID:9804
- C:\Windows\System\oQFhydz.exe
  C:\Windows\System\oQFhydz.exe
  2⤵
  PID:9820
- C:\Windows\System\zQWUVqs.exe
  C:\Windows\System\zQWUVqs.exe
  2⤵
  PID:9836
- C:\Windows\System\MDZioXU.exe
  C:\Windows\System\MDZioXU.exe
  2⤵
  PID:9852
- C:\Windows\System\yWZokpJ.exe
  C:\Windows\System\yWZokpJ.exe
  2⤵
  PID:9868
- C:\Windows\System\iqZnuuh.exe
  C:\Windows\System\iqZnuuh.exe
  2⤵
  PID:9884
- C:\Windows\System\OcolykF.exe
  C:\Windows\System\OcolykF.exe
  2⤵
  PID:9900
- C:\Windows\System\exsEmNT.exe
  C:\Windows\System\exsEmNT.exe
  2⤵
  PID:9920
- C:\Windows\System\WvCOwyH.exe
  C:\Windows\System\WvCOwyH.exe
  2⤵
  PID:9936
- C:\Windows\System\YyLewlt.exe
  C:\Windows\System\YyLewlt.exe
  2⤵
  PID:9952
- C:\Windows\System\MUyfzAD.exe
  C:\Windows\System\MUyfzAD.exe
  2⤵
  PID:9968
- C:\Windows\System\WoEIeHW.exe
  C:\Windows\System\WoEIeHW.exe
  2⤵
  PID:9984
- C:\Windows\System\RUAaCeq.exe
  C:\Windows\System\RUAaCeq.exe
  2⤵
  PID:10000
- C:\Windows\System\hRaBRoJ.exe
  C:\Windows\System\hRaBRoJ.exe
  2⤵
  PID:10016
- C:\Windows\System\myKCmCq.exe
  C:\Windows\System\myKCmCq.exe
  2⤵
  PID:10036
- C:\Windows\System\kzECINT.exe
  C:\Windows\System\kzECINT.exe
  2⤵
  PID:10056
- C:\Windows\System\cFIJplT.exe
  C:\Windows\System\cFIJplT.exe
  2⤵
  PID:10072
- C:\Windows\System\PsxNQeh.exe
  C:\Windows\System\PsxNQeh.exe
  2⤵
  PID:10088
- C:\Windows\System\aUHZvMX.exe
  C:\Windows\System\aUHZvMX.exe
  2⤵
  PID:10104
- C:\Windows\System\THYdlqN.exe
  C:\Windows\System\THYdlqN.exe
  2⤵
  PID:10120
- C:\Windows\System\ITXfMWM.exe
  C:\Windows\System\ITXfMWM.exe
  2⤵
  PID:10136
- C:\Windows\System\WkfSWHH.exe
  C:\Windows\System\WkfSWHH.exe
  2⤵
  PID:10152
- C:\Windows\System\zjfmVCG.exe
  C:\Windows\System\zjfmVCG.exe
  2⤵
  PID:10180
- C:\Windows\System\VyuFGpk.exe
  C:\Windows\System\VyuFGpk.exe
  2⤵
  PID:8636
- C:\Windows\System\PNhVkjX.exe
  C:\Windows\System\PNhVkjX.exe
  2⤵
  PID:9256
- C:\Windows\System\VZJchfN.exe
  C:\Windows\System\VZJchfN.exe
  2⤵
  PID:9180
- C:\Windows\System\ffmrqfl.exe
  C:\Windows\System\ffmrqfl.exe
  2⤵
  PID:9288
- C:\Windows\System\JQuLddH.exe
  C:\Windows\System\JQuLddH.exe
  2⤵
  PID:9300
- C:\Windows\System\uHqWUEK.exe
  C:\Windows\System\uHqWUEK.exe
  2⤵
  PID:9324
- C:\Windows\System\bdIvtxY.exe
  C:\Windows\System\bdIvtxY.exe
  2⤵
  PID:9340
- C:\Windows\System\hcFrUin.exe
  C:\Windows\System\hcFrUin.exe
  2⤵
  PID:9384
- C:\Windows\System\zSBxqhE.exe
  C:\Windows\System\zSBxqhE.exe
  2⤵
  PID:9476
- C:\Windows\System\sRgHkTW.exe
  C:\Windows\System\sRgHkTW.exe
  2⤵
  PID:9432
- C:\Windows\System\eBelhBZ.exe
  C:\Windows\System\eBelhBZ.exe
  2⤵
  PID:9368
- C:\Windows\System\sjDsxpI.exe
  C:\Windows\System\sjDsxpI.exe
  2⤵
  PID:9520
- C:\Windows\System\HECziTh.exe
  C:\Windows\System\HECziTh.exe
  2⤵
  PID:9584
- C:\Windows\System\vUljhDZ.exe
  C:\Windows\System\vUljhDZ.exe
  2⤵
  PID:9568
- C:\Windows\System\RWKlWfK.exe
  C:\Windows\System\RWKlWfK.exe
  2⤵
  PID:9620
- C:\Windows\System\iyLdtOD.exe
  C:\Windows\System\iyLdtOD.exe
  2⤵
  PID:9656
- C:\Windows\System\KJOfbie.exe
  C:\Windows\System\KJOfbie.exe
  2⤵
  PID:9720
- C:\Windows\System\graVtCR.exe
  C:\Windows\System\graVtCR.exe
  2⤵
  PID:9752
- C:\Windows\System\QHqNLsC.exe
  C:\Windows\System\QHqNLsC.exe
  2⤵
  PID:9704
- C:\Windows\System\ejQZDsp.exe
  C:\Windows\System\ejQZDsp.exe
  2⤵
  PID:9780
- C:\Windows\System\QtTwsJT.exe
  C:\Windows\System\QtTwsJT.exe
  2⤵
  PID:9796
- C:\Windows\System\zbUfKSg.exe
  C:\Windows\System\zbUfKSg.exe
  2⤵
  PID:9896
- C:\Windows\System\ynwvfgu.exe
  C:\Windows\System\ynwvfgu.exe
  2⤵
  PID:9932
- C:\Windows\System\mVHLkBw.exe
  C:\Windows\System\mVHLkBw.exe
  2⤵
  PID:10024
- C:\Windows\System\jKpRigG.exe
  C:\Windows\System\jKpRigG.exe
  2⤵
  PID:10012
- C:\Windows\System\AoNUzzg.exe
  C:\Windows\System\AoNUzzg.exe
  2⤵
  PID:9996
- C:\Windows\System\sMAHdcj.exe
  C:\Windows\System\sMAHdcj.exe
  2⤵
  PID:10064
- C:\Windows\System\nEArWbw.exe
  C:\Windows\System\nEArWbw.exe
  2⤵
  PID:10132
- C:\Windows\System\jdaReFc.exe
  C:\Windows\System\jdaReFc.exe
  2⤵
  PID:10100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DCsBAED.exe

Filesize
1.9MB

MD5
903edf7ea96025cdfe0c5c7140745bce

SHA1
26870c77da6149b50541afd467cc9d598ae71c7c

SHA256
8694af51de4142c1d0750b2e73c0c4a0df970d0e7a1c472d9934aacefbb68499

SHA512
b10079db80c63d0fe7c1cd5758173d537df28d2325ca27f4df892534665a4d9d435b69d64c8f6419f1daf9c3eb0aee3183a876df8a7d969d6e7f8ebfc4c573dd

Download Submit
C:\Windows\system\DJisoHf.exe

Filesize
1.9MB

MD5
ac92392646d8546993c68c62a5c9a2a0

SHA1
778a9eb439e27c13ab52e135c05d8da0741a50f9

SHA256
d862c9b920f87e903dd4a594fcfceb62382733a105f886c6b7b7e4e0a40ddc23

SHA512
4f46adaa6f9aac67056a170509b59388e90d6954225ed04bd0c9e6e211210a5f07e47daeeedfce05a025d4eaf6da505a9fd73c5d59ac67e450a5f6585099b80f

Download Submit
C:\Windows\system\EhMflKb.exe

Filesize
1.9MB

MD5
2467b697622fe5a3da6923e00cfebcb9

SHA1
c6c407f54129731c21e6c4e1e014cbc7c8f63b86

SHA256
10fb63dc4ea69c43d18d7d3dce160d96fd68badb4cdea89fbb966da6c406c5e3

SHA512
6a7e18fe7de729cae03c42aff8e4c50acaf9b8cb9eccbad7ac5c4cf0462ca212c01b6d20c3d4497dd89462b90a1ddf5a52613e96ad161035f56eeb37017c79cb

Download Submit
C:\Windows\system\GLcAgpM.exe

Filesize
1.9MB

MD5
9ee95438c4653159a6c923c423eb0fcc

SHA1
4c60ec5e63c49d0b6f4208af0507bc021489f1a2

SHA256
9d4ff8347fcc1edefcf5f3f4cdefe2a7bf79b8edbb9768ba9f7593f3161163b7

SHA512
f6c5b24fde514cd2485747c81f5d3b0e3794fe2bf11c3682c6687003933396133086b8347b4f8d128dc973b509d3e64c5767e5f253fb4b6cfa7187c8e35c6ec3

Download Submit
C:\Windows\system\OtcwLwr.exe

Filesize
1.9MB

MD5
33d75f8d775341947e7d674515947898

SHA1
fb0e9389c93d65d0d02ba466b9e73b399ea038e9

SHA256
53cc780475e918968e4130fda4f07db2eaeb0c09fbac87f8a79dc40afce05a4d

SHA512
ebc24cb3acec8ee4fc405a1f47c023042313eb558029762512c8c53530539dec22b388660dd97483c10e9a6b1bb262f7806c83988ed2f459b5aad0bd60798be3

Download Submit
C:\Windows\system\SzkDRHa.exe

Filesize
1.9MB

MD5
a79be0b1470955250d506416c4303528

SHA1
6e9b123d612661818535bd8a14ef13184cf562be

SHA256
3623f89c463338fe7ec82bfa1986689daf50fabd41afa2ae2f822a9f3c42376a

SHA512
9d80e2e5d35d96a29946e276d095e0d71eecd3e3d17b075ff9ad1a9c36485429cf9ea70499d00cd0b222dd04a6e0fc9092ae8e693fdf541b022588262c62cfcf

Download Submit
C:\Windows\system\ToFOqxb.exe

Filesize
1.9MB

MD5
fc1ef9a0371b028097a0d58e64f90356

SHA1
748a3fccb65dded5e2f29ed3d8c9c4a8726ccec4

SHA256
3e1f8e30a26d56814abe8766dda036aee0beeec7731e981577efbdbd20b37366

SHA512
345a0f086f28b80c5c0332b0a09f177b886ce3c2de107694f2242061fd7176dcea85c9288255fdcf3e26f1bfcc4aa828dd52536672c58646d53afb22ad7b0e33

Download Submit
C:\Windows\system\VCEUhyP.exe

Filesize
1.9MB

MD5
3c7b71d19bdeb06b6e7f8c5ddd4b885a

SHA1
f7b48260d2e3834893f3f66e0399eb5234f8c336

SHA256
e0265d61254982da5841460f56c43d9657d4263b9a8c5ba8b813ee4b4f7a8534

SHA512
e711f8a63e1b12a24b7ffdc6e4d4d106cd1cf1e6851d2a8bb052249d10a069eb2a167ccd9ac6761db49a31d3ab69554057a4adbf9a0462f3aaa4e3998f146260

Download Submit
C:\Windows\system\VQWlpRb.exe

Filesize
1.9MB

MD5
85ad15f5deeaba7a91a65cd9eff755de

SHA1
29453b219ed8c1c7e2f8fddfe68dc9a8380cb05b

SHA256
8ab91569ea350d4b349e751300b0a4492f76405d40f11f4acf16d3920cbe636d

SHA512
b5fa15fdff0f7a0d50229137558f07ed8749c94e5fe0d99b04ffe0e8e80cbc342e917f3107f046f12310e15c7cb87a357eb6b5cf08f0e5e78132050f783032aa

Download Submit
C:\Windows\system\WiYNziM.exe

Filesize
1.9MB

MD5
b55c826de44501258cb66d442a097ae6

SHA1
3f7bcf0cdc7c79f7985f1cc2b05b97023116fa21

SHA256
7d2dc576b66aa412ffe8d23b2c7e6ca6024c197e5be1320847c12ed5dfc63b20

SHA512
a4765e3306a6083a550f7a58f8d9e161b870b488a02c9ffa65d4776f14e804b3a2df3741d283a57ab27c3e8c100b97cfcb65f522ff1aee10919817ed35152446

Download Submit
C:\Windows\system\bAkXmtY.exe

Filesize
1.9MB

MD5
2f50b56a9cf267656a0b95ebe2fc5016

SHA1
6b77832fc01ff4d915ab052c67d1b3f0643b0c1d

SHA256
4dc95be5d7b1900e51828c00c69b9f89deeef051f9a9c6b80aee3c3904a650a6

SHA512
ea7d90b1bcaca1268726607c64abb199336f8a1e64e179d75232d324a1aa757630643697d43f863b9b5426622d25ec64d0569e7e719d95d771d23d14e3099d67

Download Submit
C:\Windows\system\eTdhsMx.exe

Filesize
1.9MB

MD5
69741ab7a49b500a3054e826301b2e22

SHA1
94de49965cbcec407d606d79f9d821424c8d58d6

SHA256
f42a978a75b46e484c03b6291aa50897cef735408303c1596ee446d212664a8c

SHA512
eb8e05e99567a676669394c31719a8f678a7578269641fedceed84d37dc51931fe3a7bc5d05c6826e7b59eb28d4742071e63e3fe9d5cc6fa4eecbd60ad8ccf15

Download Submit
C:\Windows\system\evuibje.exe

Filesize
1.9MB

MD5
47e1a5807a5bfe20c9f75d3437dcec0a

SHA1
2e541d09c2d05dd4b245fefddb87f10fb3a171c4

SHA256
7ae7782e2df03dfcf68f01bfd41777b40966a06726731c6cbe12daab38010f0e

SHA512
c4b7b157c1ede90de28f6c2260c4a5ef3d971f96e08b9cd894d003eaf81f9b975c4d9a126f307ab7f6b0f4eee3452c86c792f184c6fc14eb9cdde124c503e6a9

Download Submit
C:\Windows\system\fPiQzTe.exe

Filesize
1.9MB

MD5
6b4a9ae9de654f12fa6aa85adf25a638

SHA1
de1d36e1979391a584f5732a83ae52ccbe750338

SHA256
1b86a8ba558357b9ee678f62a8bc8735929cc06aa1bf38cffa1c2a9f5c519e52

SHA512
b5f06e79be178ea13c1ed709d32423db8c2a513bc47e62931908e5524c8c7acbde4b82a54f6354dedc9859659cc2beb01be0ed921afee13747043133a4974821

Download Submit
C:\Windows\system\mQTXtDm.exe

Filesize
1.9MB

MD5
84401d02b61815b4893fd5880cfbe097

SHA1
76586874c98515cbf5075f1874485fe90975b52b

SHA256
1d50ce734c1b6a17038753184d19196c5f3155044b52cdf1b7910bb37ac5f8d7

SHA512
86f1cd0f07fa8039c8a79bc4e3a4148cf54452f28fbcd456f0ec380e34eb0ead990b351b96053e4422cf4bc93873298a41759a959ca1e772b6c7ea264a5344ed

Download Submit
C:\Windows\system\nBShOOG.exe

Filesize
1.9MB

MD5
e91b4f8fa87187086280600105ee5da6

SHA1
949594030dc557094cfaff9e76d244f3077c8864

SHA256
cf412f2c6156d2aa87e25278ffb6557f2738d8a688424769dd5c2469bf09677b

SHA512
2c3f50166dc163b2afd5f8a35873835710a62073e3e1cda3a8c58bb3035c606888823a386054603783a380a82dea744998cb1704959e4dcdb1427c84a14a0548

Download Submit
C:\Windows\system\oDOyTEi.exe

Filesize
1.9MB

MD5
9651cf4601a99661410652a1fa4721c1

SHA1
d21aa7844687cd2ba9f3bd6896c6a93fa18a9cf2

SHA256
11d0e31cc7394d4cc15eac1cea7ec4eaa52ff6790fa60ec5e30b69f541e2857b

SHA512
5001d29fc858171acfc74e2ffd2392dc8f087bb7e882c9ff63d37a206ce8bec4c6ada762e4658c6215764241895f8b422e744475079dd7472ecd13eb265d485d

Download Submit
C:\Windows\system\qZoaiuL.exe

Filesize
1.9MB

MD5
a2ddbcbcad21838a03170a5113f56cc8

SHA1
a0356dba358f2c1c194f488902a8ec2891a66b74

SHA256
fd845e2b4562c655514c16b0c34d273a1c4aef70ee6c55e497a65836152cd45d

SHA512
4ba2be5fda5b74b7f68ec89ab9c2f0595a8a8186297199c71f719ba45703a2beefb9cf871d1da8c60ee7be72d962fa5aedc48d2c5f899017523a8a9609ee621b

Download Submit
C:\Windows\system\rOFtMbR.exe

Filesize
1.9MB

MD5
794e8b6239a1426280377c1b20d06d0f

SHA1
a7983b5d900c67f5ac39f51cde46d7bed09d5dd9

SHA256
f19573986a5f93f5c88b137b60afd4f09aef98d697f0088fdc2322333c743f72

SHA512
ce032476da268d6f8d77105d57561f0a7553bdd31667abf46e3b687c805f9798b5331436a285519dd4e8ba2d4ea57c7739a351aa78099d558f3fee9f3ba4a8f3

Download Submit
C:\Windows\system\rdstabE.exe

Filesize
1.9MB

MD5
50d34d68c03260f9abb61b780648254e

SHA1
247709b5157fbd99dd03d81605c4533c4d26a0ea

SHA256
728d2061cc52cd23db219a7f02dfc32ed1492e405ad702a98184c678e125f5dc

SHA512
59ac83122cd60a594b0936e874d8eac45aadbf0694cd9d3cce612cc4e700911f364ac66fd15366fe1200ef364d5637f1d64c1c457922b19712e413911c8f42e8

Download Submit
C:\Windows\system\sSZyWRb.exe

Filesize
1.9MB

MD5
6d29ffc4c50b199dbb8da7de6003af8b

SHA1
62444468db5e55d019354ec1e6a65c63d32a8431

SHA256
f40f0902d2ca0dfef854f2fb7dca8714798fc950f32ec2704e2323d66f215aa6

SHA512
0b8f65e138a7ebe4036f1461a4b28cd4446d9b430c33204f3b54c53818544a21206f891e674857648af057be56dfd05a1ff27f7f4dea299b1f971f63643d7527

Download Submit
C:\Windows\system\tJzNPpA.exe

Filesize
1.9MB

MD5
895caef2ce8bcd2dc1e3f5db40cb5e90

SHA1
58694dbee2295ea0471c30ab071f1aa9d34aa26c

SHA256
bfa1c2ef32c8cb0bf77a1605f4f652648af8394bfefa91166fa5eaa85da34bbf

SHA512
9fb11a9b926e84d5ff43e0d1794fad1b7f179aa7bd8751dc391b4c695c13b34eb3fee6412223d8fff43cdc11769b587d9cd3c321c29da452d4e16c2d7bd47a7f

Download Submit
C:\Windows\system\uOtuKPw.exe

Filesize
1.9MB

MD5
3c6c4c7b9744e7b08b86bd63233d9a10

SHA1
90a025500981321936e18d15a1e5f56608602e1c

SHA256
70fccd03b9addd31c05c1f5a5bc42b9bf6f979a354f0478b50c5781487111e54

SHA512
a41be7c5851318bc178b08a49c9ec92f93479429a7ac0b29b9e589951c214f93336ab36ed6d10fe34abea8301670ca6da5ae91253f3d7a183e10d5593980af8f

Download Submit
C:\Windows\system\ufLMypx.exe

Filesize
1.9MB

MD5
d47fc2863dc5fde9a1015c1b0f06820f

SHA1
1e91190fb8314fa2cce5e038a177f55bb42ef09a

SHA256
22313558b0027125759cd284aa90fb862aa41506b00214499c1c741e467b204e

SHA512
092f7c06c115cbddc2e8eb37e691c7cbdee1c34bbbd7095f46b400fb1835e8976f46ef86c0d188c0dae6cee73baa4103048a2d9ef7c119c3efda5ece79a6ecc9

Download Submit
C:\Windows\system\vIoXWTf.exe

Filesize
1.9MB

MD5
9b3d8f7086fa68da565d7069879a93f8

SHA1
347ae61ee9f2ff34f84c40780e2c532f96c240f3

SHA256
d295f74004662a23b29ccffa86e00b11ef4fad0c355f977411e082b2265743bf

SHA512
6ab83be1b27983692ba7354644119af6a87cbdc4155721f678f53f5d7562af0a1413451999c0e40cbc1e9b69be7daae5f72b88b0270ee3f0cdcf020357af2dbf

Download Submit
C:\Windows\system\vZwSZer.exe

Filesize
1.9MB

MD5
6e5533fecfc0caace3040a4ab4453fc8

SHA1
bf71538415df63398677b0380f480044e8a1d218

SHA256
9eb8546d9f409ac6c469eb13c0b59b299c0596171fe81ff73ace0f9b3f03341d

SHA512
d5a9ec1648f4df46c3b0a4f2fe61ddc43878571612e68129f233dbc0cf3657eab1521fddd27cde24737e1e4d39d4131d8cce2a5067eca14da5c3da17b91aebc5

Download Submit
\Windows\system\GgOCjax.exe

Filesize
1.9MB

MD5
68eaa4013e1174e8595a585f12df9e3d

SHA1
b8206280a8c72f9d1a5bca8a068c6b4f73afe05a

SHA256
4a78bc3424f7374003a9fe0d66666f4ce43780090e5384a1c1ce38d08560241c

SHA512
82be138c7c03b1d2ac3ce549dec6fac3aef97e5aa31768318211f96d3f268e3da816e6c454d58f459c14fa5cc61d034ad16fdf578d81254f6904bffc25a11d55

Download Submit
\Windows\system\QPQTRTy.exe

Filesize
1.9MB

MD5
ff21addaf25b4eebeb7bf603b2b09667

SHA1
2df805113b6e9c4b097b8bc723e1d44a18e506de

SHA256
5399a3c0a057f14e0a43a2adf9a2c3fe6ea97d045c778809bdbb499e7456142a

SHA512
87a01e6777082909b3ede90699b714a11af8b00a1307344bbc5d4938dfda6fdf648f6434f24873b1c646839433fbafa6136c3164fcb3de3ecf75c99dcc27adea

Download Submit
\Windows\system\SeUqdOs.exe

Filesize
1.9MB

MD5
6ea876a056509f822fc4dab94b39bd9a

SHA1
4c93771f96343c3fd31e3ac34e7f6b8045920cbb

SHA256
04038c361e1e03d889fc4ad1052e15bd1ec03ab32b49f6fb09476ae0a2e8396d

SHA512
2d4c837192bd931f534d1021187e3a11415c08bfba7dee9baf123ac37ed06c90f1e55a096c457fdeb7264989274cb0b986f4d7b808c3fbd498fab515041e0fb0

Download Submit
\Windows\system\nNhChGA.exe

Filesize
1.9MB

MD5
a6de1de1092b997ad2669b0481b588a8

SHA1
8373accf0d342b8c4acdb1ff203f007b3edf955c

SHA256
b17d5dae81d9caa2788f99e116da5e8200ae9a2c40e60544c0eb98406522d4c3

SHA512
5740d511480d7eca5cf00b63d65cded72b4c0c6546a4a9a15585151335bbb3aa3c076f04192470e446c7068c4926a5b0d714de71347dadee02df6ba089ffa5bc

Download Submit
\Windows\system\zCgKhYd.exe

Filesize
1.9MB

MD5
b3d41abf91080dd3420f75680de8564a

SHA1
0d3c48fccef3287072fc0f6ccf3e12abb854de0a

SHA256
fd1ecab58559894ae518ab31fbf8ac1a20ae30a9f51572790afc4314d259587a

SHA512
80220b72654b91d7f2efb48d27eb6d8546b33f2f8fa51aee7b2e0919c7a97dabc408d1d2656ac463b3063ef9378086c5dad6810a741f9de3b83d552a8cc6d67b

Download Submit
\Windows\system\zgTLEyF.exe

Filesize
1.9MB

MD5
c2ef50e37bcca34ee078b700059d6bbc

SHA1
fce5d903288d73d630e278cdcefd0c651b424f19

SHA256
fc525352cec9b81f21ab926a0e22c17ed367cf6e729721dbfef9a8f117c55a8a

SHA512
3be7c47f4c7a4c506ee39bdd6a05ef17d9b666c3072969b89f73624da9e791fa2a0e666edbea215313126b914182d9b3bfdfd4d8a96253f5f3ed1caf4aff996e

Download Submit
memory/240-234-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/576-1746-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/576-70-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/1412-242-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-14-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-25-0x0000000002C20000-0x0000000003012000-memory.dmp

Filesize
3.9MB

Download
memory/1524-53-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-224-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1524-0-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1524-262-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/1524-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1524-73-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1524-8-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-42-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1524-63-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-44-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/1576-235-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/1960-245-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-243-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-248-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2152-47-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-132-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

Filesize
2.9MB

Download
memory/2152-41-0x0000000002620000-0x00000000026A0000-memory.dmp

Filesize
512KB

Download
memory/2152-136-0x00000000022F0000-0x00000000022F8000-memory.dmp

Filesize
32KB

Download
memory/2152-32-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/2152-197-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/2320-247-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-64-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-2252-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-62-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-2168-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-240-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2524-1760-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2524-26-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2524-227-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2544-51-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2544-1681-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2640-15-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-226-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-2990-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-236-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2844-43-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2248-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2864-238-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2888-1601-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-9-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-1752-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download