xmrig | f55c6a83aee0c350076670df3291be7e62ea91c7a55587b2f877fde86605c1c0

Analysis

max time kernel
22s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
Size

1.8MB
MD5

03a51ffb55c1a5b04ce0b2d9ea9dbcc4
SHA1

d3bb3ea733a938130c19c4f003f43beb66b8df0a
SHA256

f55c6a83aee0c350076670df3291be7e62ea91c7a55587b2f877fde86605c1c0
SHA512

12e829350c1aa056f24332889a4b8f6bc0e9a968e631a97e08f7c97e986a86878a8c6e5b3343ea25a6ddaa50b60b4dcf8ab0fdc3cb6afd208e76a1381053f30d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrli+:NABU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2672-203-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2036-207-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2240-213-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2648-216-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2400-224-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2424-221-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2556-211-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2612-209-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/3004-208-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2504-205-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2968-198-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2968	kVXPlLz.exe
2672	fdfCgCM.exe
2504	gxMNVco.exe
2036	aRfnDuj.exe
3004	TgeTpjF.exe
2612	tJEsVix.exe
2556	rDeISgt.exe
2240	ZDgQdCl.exe
2648	JsdijDh.exe
2424	XXRjbCw.exe
2400	ZKVjpwe.exe
2832	sKdWGcO.exe
2120	BhZjyYl.exe
1508	jDLhpvh.exe
1656	nwIYIgQ.exe
1700	tAhmXQZ.exe
2680	CqsDeIY.exe
552	BAFREoj.exe
2388	usQwaht.exe
2500	tgLbZXF.exe
2512	FXFrRdv.exe
2476	AOemnKT.exe
308	tTPOSib.exe
2572	BsPUCoo.exe
804	LbkkyLb.exe
836	WYxBaHa.exe
1136	RllxrhT.exe
3060	kldfUEw.exe
1916	TnMTmOc.exe
1728	pnDwFeR.exe
344	MdXcddQ.exe
1884	JtBthSw.exe
2152	vMZWnKu.exe
1436	NPzTdqy.exe
2488	waPAxOq.exe
1308	YxECxrz.exe
1288	sKkTYaq.exe
1748	ZjtXKPl.exe
2760	qzIzqVC.exe
1660	ZpahkQZ.exe
2248	sCltGPB.exe
2896	BPFWhOD.exe
2800	lnLZmng.exe
1716	RmiklbH.exe
860	dyOnkSP.exe
888	OOqvTMU.exe
1256	EdpEzPS.exe
1524	wHCyieQ.exe
3052	OnASCCN.exe
2640	DVkmlbY.exe
2464	uoTTmWt.exe
304	aOiSXaH.exe
2000	UsURjva.exe
1444	OAZtSsJ.exe
1624	ogzusFO.exe
2068	DFNXKjh.exe
1544	LhiHtYB.exe
2492	nBoHaJL.exe
2772	BIIBQvt.exe
1852	gkshXac.exe
2960	EUqyqAX.exe
1944	ikGXHbq.exe
296	ICbYxfW.exe
1952	mfwnWng.exe

Loads dropped DLL 64 IoCs

pid	Process
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000143e5-2.dat	upx
behavioral1/files/0x0007000000014b18-20.dat	upx
behavioral1/memory/1712-21-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0009000000014b4c-26.dat	upx
behavioral1/files/0x000a000000014bbc-31.dat	upx
behavioral1/files/0x0006000000015cd9-38.dat	upx
behavioral1/files/0x0006000000015cff-46.dat	upx
behavioral1/files/0x0006000000015d42-53.dat	upx
behavioral1/files/0x0006000000015d56-63.dat	upx
behavioral1/files/0x0006000000015d6b-73.dat	upx
behavioral1/files/0x0006000000015d87-81.dat	upx
behavioral1/files/0x0006000000015e32-89.dat	upx
behavioral1/files/0x0006000000015f65-97.dat	upx
behavioral1/files/0x000600000001630a-118.dat	upx
behavioral1/files/0x0006000000016cdc-168.dat	upx
behavioral1/files/0x0006000000015ce3-107.dat	upx
behavioral1/files/0x0006000000015d4e-135.dat	upx
behavioral1/memory/2672-203-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2036-207-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x0006000000016851-140.dat	upx
behavioral1/memory/2240-213-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2648-216-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0006000000016cb0-164.dat	upx
behavioral1/files/0x000e0000000054ab-156.dat	upx
behavioral1/files/0x0006000000015d7f-147.dat	upx
behavioral1/files/0x0006000000015d5f-145.dat	upx
behavioral1/memory/2400-224-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2424-221-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2556-211-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0006000000016adc-139.dat	upx
behavioral1/memory/2612-209-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/3004-208-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2504-205-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2968-198-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x0006000000015d20-133.dat	upx
behavioral1/files/0x0006000000016616-128.dat	upx
behavioral1/files/0x00060000000164aa-120.dat	upx
behavioral1/files/0x000600000001621e-112.dat	upx
behavioral1/files/0x0006000000015fe5-99.dat	upx
behavioral1/files/0x0006000000015ecc-91.dat	upx
behavioral1/files/0x0006000000015d93-83.dat	upx
behavioral1/files/0x0007000000016c64-163.dat	upx
behavioral1/files/0x0006000000016c44-155.dat	upx
behavioral1/files/0x000600000001658a-126.dat	upx
behavioral1/files/0x000600000001610f-111.dat	upx
behavioral1/files/0x0008000000015ccd-34.dat	upx
behavioral1/files/0x0007000000014a9a-25.dat	upx
behavioral1/files/0x00090000000146f4-24.dat	upx
behavioral1/files/0x000700000001487f-15.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZwaGfNr.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\UVEOsVv.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\cqQSMmt.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\AjZAQdP.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\KVCrrVr.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\gdSyrwa.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\zSdmcKK.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\FUAJdgc.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\qIaaKvT.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\RmiklbH.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\kXonJoK.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\eRfmPQO.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\jIrvbpY.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\CeMXkvZ.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\xnAHhAc.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\mKMnpDz.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\qpHeVgh.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\VVZsaRb.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\MlgfVic.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\WzESXsR.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\bEfybHY.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\mQhKEGy.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\bUCUKtu.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\PxgOgii.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\ulTiSjq.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\fdfCgCM.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\MdXcddQ.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\vdffJuO.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\oomuBqB.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\zfIxLNl.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\UoXkzHc.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\nFosFiK.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\Vgjvsfa.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\RIUjYIr.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\CKlRaIe.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\LOdjlOz.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\ICbYxfW.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\DmdOdUy.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\xrQGUjs.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\pefHxcu.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\MLtfEpp.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\QlQbjSS.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\mTNBcYp.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\zRfEiWb.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\qQRSCKL.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\OHEVxhD.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\DlkjUSC.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\dNaiPHK.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\bRLhbtr.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\gmXOuQz.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\OOqvTMU.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\WHspqdG.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\nHuRvfL.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\JdnJjOJ.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\QZfVgmb.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\VguHWyP.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\PgDadLv.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\NTZzpGK.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\yjhitFu.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\IvoZyYe.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\wXnaNuM.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\TwkQZXz.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\GVyUGQR.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
File created	C:\Windows\System\LBSSKMV.exe	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
Token: SeDebugPrivilege	2040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2040	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	29
PID 1712 wrote to memory of 2040	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	29
PID 1712 wrote to memory of 2040	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	29
PID 1712 wrote to memory of 2968	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2968	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2968	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2036	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	31
PID 1712 wrote to memory of 2036	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	31
PID 1712 wrote to memory of 2036	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	31
PID 1712 wrote to memory of 2672	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2672	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2672	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	32
PID 1712 wrote to memory of 3004	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	33
PID 1712 wrote to memory of 3004	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	33
PID 1712 wrote to memory of 3004	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	33
PID 1712 wrote to memory of 2504	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2504	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2504	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2612	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	35
PID 1712 wrote to memory of 2612	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	35
PID 1712 wrote to memory of 2612	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	35
PID 1712 wrote to memory of 2556	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2556	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2556	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2240	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	37
PID 1712 wrote to memory of 2240	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	37
PID 1712 wrote to memory of 2240	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	37
PID 1712 wrote to memory of 2648	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	38
PID 1712 wrote to memory of 2648	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	38
PID 1712 wrote to memory of 2648	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	38
PID 1712 wrote to memory of 2680	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	39
PID 1712 wrote to memory of 2680	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	39
PID 1712 wrote to memory of 2680	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	39
PID 1712 wrote to memory of 2424	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2424	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2424	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2512	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2512	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2512	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2400	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	42
PID 1712 wrote to memory of 2400	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	42
PID 1712 wrote to memory of 2400	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	42
PID 1712 wrote to memory of 2476	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	43
PID 1712 wrote to memory of 2476	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	43
PID 1712 wrote to memory of 2476	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	43
PID 1712 wrote to memory of 2832	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	44
PID 1712 wrote to memory of 2832	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	44
PID 1712 wrote to memory of 2832	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	44
PID 1712 wrote to memory of 2572	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	45
PID 1712 wrote to memory of 2572	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	45
PID 1712 wrote to memory of 2572	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	45
PID 1712 wrote to memory of 2120	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	46
PID 1712 wrote to memory of 2120	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	46
PID 1712 wrote to memory of 2120	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	46
PID 1712 wrote to memory of 804	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	47
PID 1712 wrote to memory of 804	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	47
PID 1712 wrote to memory of 804	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	47
PID 1712 wrote to memory of 1508	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	48
PID 1712 wrote to memory of 1508	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	48
PID 1712 wrote to memory of 1508	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	48
PID 1712 wrote to memory of 1916	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	49
PID 1712 wrote to memory of 1916	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	49
PID 1712 wrote to memory of 1916	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	49
PID 1712 wrote to memory of 1656	1712	03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03a51ffb55c1a5b04ce0b2d9ea9dbcc4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\System\kVXPlLz.exe
  C:\Windows\System\kVXPlLz.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\aRfnDuj.exe
  C:\Windows\System\aRfnDuj.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\fdfCgCM.exe
  C:\Windows\System\fdfCgCM.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\TgeTpjF.exe
  C:\Windows\System\TgeTpjF.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\gxMNVco.exe
  C:\Windows\System\gxMNVco.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\tJEsVix.exe
  C:\Windows\System\tJEsVix.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\rDeISgt.exe
  C:\Windows\System\rDeISgt.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\ZDgQdCl.exe
  C:\Windows\System\ZDgQdCl.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\JsdijDh.exe
  C:\Windows\System\JsdijDh.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\CqsDeIY.exe
  C:\Windows\System\CqsDeIY.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\XXRjbCw.exe
  C:\Windows\System\XXRjbCw.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\FXFrRdv.exe
  C:\Windows\System\FXFrRdv.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ZKVjpwe.exe
  C:\Windows\System\ZKVjpwe.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\AOemnKT.exe
  C:\Windows\System\AOemnKT.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\sKdWGcO.exe
  C:\Windows\System\sKdWGcO.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\BsPUCoo.exe
  C:\Windows\System\BsPUCoo.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\BhZjyYl.exe
  C:\Windows\System\BhZjyYl.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\LbkkyLb.exe
  C:\Windows\System\LbkkyLb.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\jDLhpvh.exe
  C:\Windows\System\jDLhpvh.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\TnMTmOc.exe
  C:\Windows\System\TnMTmOc.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\nwIYIgQ.exe
  C:\Windows\System\nwIYIgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\MdXcddQ.exe
  C:\Windows\System\MdXcddQ.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\tAhmXQZ.exe
  C:\Windows\System\tAhmXQZ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\JtBthSw.exe
  C:\Windows\System\JtBthSw.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\BAFREoj.exe
  C:\Windows\System\BAFREoj.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\vMZWnKu.exe
  C:\Windows\System\vMZWnKu.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\usQwaht.exe
  C:\Windows\System\usQwaht.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\NPzTdqy.exe
  C:\Windows\System\NPzTdqy.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\tgLbZXF.exe
  C:\Windows\System\tgLbZXF.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\waPAxOq.exe
  C:\Windows\System\waPAxOq.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\tTPOSib.exe
  C:\Windows\System\tTPOSib.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\YxECxrz.exe
  C:\Windows\System\YxECxrz.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\WYxBaHa.exe
  C:\Windows\System\WYxBaHa.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\ZjtXKPl.exe
  C:\Windows\System\ZjtXKPl.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\RllxrhT.exe
  C:\Windows\System\RllxrhT.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\qzIzqVC.exe
  C:\Windows\System\qzIzqVC.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\kldfUEw.exe
  C:\Windows\System\kldfUEw.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\ZpahkQZ.exe
  C:\Windows\System\ZpahkQZ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\pnDwFeR.exe
  C:\Windows\System\pnDwFeR.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\sCltGPB.exe
  C:\Windows\System\sCltGPB.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\sKkTYaq.exe
  C:\Windows\System\sKkTYaq.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\lnLZmng.exe
  C:\Windows\System\lnLZmng.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\BPFWhOD.exe
  C:\Windows\System\BPFWhOD.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\RmiklbH.exe
  C:\Windows\System\RmiklbH.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\dyOnkSP.exe
  C:\Windows\System\dyOnkSP.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\UsURjva.exe
  C:\Windows\System\UsURjva.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\OOqvTMU.exe
  C:\Windows\System\OOqvTMU.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\BIIBQvt.exe
  C:\Windows\System\BIIBQvt.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\EdpEzPS.exe
  C:\Windows\System\EdpEzPS.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\gkshXac.exe
  C:\Windows\System\gkshXac.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\wHCyieQ.exe
  C:\Windows\System\wHCyieQ.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\EUqyqAX.exe
  C:\Windows\System\EUqyqAX.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\OnASCCN.exe
  C:\Windows\System\OnASCCN.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ytkodLh.exe
  C:\Windows\System\ytkodLh.exe
  2⤵
  PID:2028
- C:\Windows\System\DVkmlbY.exe
  C:\Windows\System\DVkmlbY.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\KLsGvDU.exe
  C:\Windows\System\KLsGvDU.exe
  2⤵
  PID:2104
- C:\Windows\System\uoTTmWt.exe
  C:\Windows\System\uoTTmWt.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\AzKnVbV.exe
  C:\Windows\System\AzKnVbV.exe
  2⤵
  PID:3036
- C:\Windows\System\aOiSXaH.exe
  C:\Windows\System\aOiSXaH.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\LUwBrOn.exe
  C:\Windows\System\LUwBrOn.exe
  2⤵
  PID:312
- C:\Windows\System\OAZtSsJ.exe
  C:\Windows\System\OAZtSsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\sZeXVAQ.exe
  C:\Windows\System\sZeXVAQ.exe
  2⤵
  PID:2696
- C:\Windows\System\ogzusFO.exe
  C:\Windows\System\ogzusFO.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\TIEQCgZ.exe
  C:\Windows\System\TIEQCgZ.exe
  2⤵
  PID:412
- C:\Windows\System\DFNXKjh.exe
  C:\Windows\System\DFNXKjh.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\vdLyyyu.exe
  C:\Windows\System\vdLyyyu.exe
  2⤵
  PID:1536
- C:\Windows\System\LhiHtYB.exe
  C:\Windows\System\LhiHtYB.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\UxtqfaO.exe
  C:\Windows\System\UxtqfaO.exe
  2⤵
  PID:2820
- C:\Windows\System\nBoHaJL.exe
  C:\Windows\System\nBoHaJL.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\FTDdyng.exe
  C:\Windows\System\FTDdyng.exe
  2⤵
  PID:2720
- C:\Windows\System\ikGXHbq.exe
  C:\Windows\System\ikGXHbq.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\xGQSpSf.exe
  C:\Windows\System\xGQSpSf.exe
  2⤵
  PID:2644
- C:\Windows\System\ICbYxfW.exe
  C:\Windows\System\ICbYxfW.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\wFneGvU.exe
  C:\Windows\System\wFneGvU.exe
  2⤵
  PID:1948
- C:\Windows\System\mfwnWng.exe
  C:\Windows\System\mfwnWng.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\cNOHZgk.exe
  C:\Windows\System\cNOHZgk.exe
  2⤵
  PID:352
- C:\Windows\System\FBdWMvw.exe
  C:\Windows\System\FBdWMvw.exe
  2⤵
  PID:776
- C:\Windows\System\YAdRcaI.exe
  C:\Windows\System\YAdRcaI.exe
  2⤵
  PID:2372
- C:\Windows\System\iywmaSA.exe
  C:\Windows\System\iywmaSA.exe
  2⤵
  PID:1516
- C:\Windows\System\KVCrrVr.exe
  C:\Windows\System\KVCrrVr.exe
  2⤵
  PID:2592
- C:\Windows\System\EEqsbJw.exe
  C:\Windows\System\EEqsbJw.exe
  2⤵
  PID:992
- C:\Windows\System\WMMzWCv.exe
  C:\Windows\System\WMMzWCv.exe
  2⤵
  PID:2912
- C:\Windows\System\ueffGil.exe
  C:\Windows\System\ueffGil.exe
  2⤵
  PID:2700
- C:\Windows\System\mZpIzwz.exe
  C:\Windows\System\mZpIzwz.exe
  2⤵
  PID:1940
- C:\Windows\System\VFEwNnH.exe
  C:\Windows\System\VFEwNnH.exe
  2⤵
  PID:2416
- C:\Windows\System\FeFKXfH.exe
  C:\Windows\System\FeFKXfH.exe
  2⤵
  PID:2808
- C:\Windows\System\ZUuMlCf.exe
  C:\Windows\System\ZUuMlCf.exe
  2⤵
  PID:2192
- C:\Windows\System\yheemKz.exe
  C:\Windows\System\yheemKz.exe
  2⤵
  PID:1456
- C:\Windows\System\ypoRHTV.exe
  C:\Windows\System\ypoRHTV.exe
  2⤵
  PID:3020
- C:\Windows\System\IyVyOKs.exe
  C:\Windows\System\IyVyOKs.exe
  2⤵
  PID:1176
- C:\Windows\System\jOcMxfC.exe
  C:\Windows\System\jOcMxfC.exe
  2⤵
  PID:2216
- C:\Windows\System\qMxNLgI.exe
  C:\Windows\System\qMxNLgI.exe
  2⤵
  PID:1460
- C:\Windows\System\CBAbuKP.exe
  C:\Windows\System\CBAbuKP.exe
  2⤵
  PID:2336
- C:\Windows\System\mEaZkRU.exe
  C:\Windows\System\mEaZkRU.exe
  2⤵
  PID:1512
- C:\Windows\System\fOSbzJt.exe
  C:\Windows\System\fOSbzJt.exe
  2⤵
  PID:1572
- C:\Windows\System\tSGzWfh.exe
  C:\Windows\System\tSGzWfh.exe
  2⤵
  PID:2664
- C:\Windows\System\TwkQZXz.exe
  C:\Windows\System\TwkQZXz.exe
  2⤵
  PID:2460
- C:\Windows\System\ivrMqfA.exe
  C:\Windows\System\ivrMqfA.exe
  2⤵
  PID:2300
- C:\Windows\System\FaubchI.exe
  C:\Windows\System\FaubchI.exe
  2⤵
  PID:2864
- C:\Windows\System\RsYtDsE.exe
  C:\Windows\System\RsYtDsE.exe
  2⤵
  PID:2444
- C:\Windows\System\FYKEYct.exe
  C:\Windows\System\FYKEYct.exe
  2⤵
  PID:3024
- C:\Windows\System\ZTTCwFm.exe
  C:\Windows\System\ZTTCwFm.exe
  2⤵
  PID:2160
- C:\Windows\System\NtDhvUa.exe
  C:\Windows\System\NtDhvUa.exe
  2⤵
  PID:1244
- C:\Windows\System\UpEkPpn.exe
  C:\Windows\System\UpEkPpn.exe
  2⤵
  PID:2516
- C:\Windows\System\ZNymnRH.exe
  C:\Windows\System\ZNymnRH.exe
  2⤵
  PID:2256
- C:\Windows\System\VRKLxeK.exe
  C:\Windows\System\VRKLxeK.exe
  2⤵
  PID:2780
- C:\Windows\System\qSsZvig.exe
  C:\Windows\System\qSsZvig.exe
  2⤵
  PID:1596
- C:\Windows\System\dhLKXVf.exe
  C:\Windows\System\dhLKXVf.exe
  2⤵
  PID:884
- C:\Windows\System\VpAQsnM.exe
  C:\Windows\System\VpAQsnM.exe
  2⤵
  PID:3080
- C:\Windows\System\FfSOKmH.exe
  C:\Windows\System\FfSOKmH.exe
  2⤵
  PID:3096
- C:\Windows\System\jtiOOWw.exe
  C:\Windows\System\jtiOOWw.exe
  2⤵
  PID:3112
- C:\Windows\System\wvjvYTV.exe
  C:\Windows\System\wvjvYTV.exe
  2⤵
  PID:3128
- C:\Windows\System\CsoZgJD.exe
  C:\Windows\System\CsoZgJD.exe
  2⤵
  PID:3144
- C:\Windows\System\uBStkrj.exe
  C:\Windows\System\uBStkrj.exe
  2⤵
  PID:3160
- C:\Windows\System\rXOZvrX.exe
  C:\Windows\System\rXOZvrX.exe
  2⤵
  PID:3176
- C:\Windows\System\yxAkuHg.exe
  C:\Windows\System\yxAkuHg.exe
  2⤵
  PID:3212
- C:\Windows\System\WHspqdG.exe
  C:\Windows\System\WHspqdG.exe
  2⤵
  PID:3256
- C:\Windows\System\VuofHVa.exe
  C:\Windows\System\VuofHVa.exe
  2⤵
  PID:3272
- C:\Windows\System\Ifwuyfv.exe
  C:\Windows\System\Ifwuyfv.exe
  2⤵
  PID:3288
- C:\Windows\System\qITRiku.exe
  C:\Windows\System\qITRiku.exe
  2⤵
  PID:3304
- C:\Windows\System\EPttjnL.exe
  C:\Windows\System\EPttjnL.exe
  2⤵
  PID:3320
- C:\Windows\System\PYauKvZ.exe
  C:\Windows\System\PYauKvZ.exe
  2⤵
  PID:3336
- C:\Windows\System\cneRQky.exe
  C:\Windows\System\cneRQky.exe
  2⤵
  PID:3352
- C:\Windows\System\lDFubyZ.exe
  C:\Windows\System\lDFubyZ.exe
  2⤵
  PID:3368
- C:\Windows\System\LBYlfsH.exe
  C:\Windows\System\LBYlfsH.exe
  2⤵
  PID:3384
- C:\Windows\System\iQUKiBK.exe
  C:\Windows\System\iQUKiBK.exe
  2⤵
  PID:3400
- C:\Windows\System\xKjzFkC.exe
  C:\Windows\System\xKjzFkC.exe
  2⤵
  PID:3416
- C:\Windows\System\SvmkanQ.exe
  C:\Windows\System\SvmkanQ.exe
  2⤵
  PID:3432
- C:\Windows\System\vwxmdcE.exe
  C:\Windows\System\vwxmdcE.exe
  2⤵
  PID:3448
- C:\Windows\System\oxfAuAc.exe
  C:\Windows\System\oxfAuAc.exe
  2⤵
  PID:3464
- C:\Windows\System\nGFJUhF.exe
  C:\Windows\System\nGFJUhF.exe
  2⤵
  PID:3480
- C:\Windows\System\KJGBYOm.exe
  C:\Windows\System\KJGBYOm.exe
  2⤵
  PID:3496
- C:\Windows\System\BDqrFVW.exe
  C:\Windows\System\BDqrFVW.exe
  2⤵
  PID:3512
- C:\Windows\System\zZdvPpc.exe
  C:\Windows\System\zZdvPpc.exe
  2⤵
  PID:3528
- C:\Windows\System\GLVPjUM.exe
  C:\Windows\System\GLVPjUM.exe
  2⤵
  PID:3544
- C:\Windows\System\ROdePpI.exe
  C:\Windows\System\ROdePpI.exe
  2⤵
  PID:3560
- C:\Windows\System\mKUCGIQ.exe
  C:\Windows\System\mKUCGIQ.exe
  2⤵
  PID:3576
- C:\Windows\System\ramPMho.exe
  C:\Windows\System\ramPMho.exe
  2⤵
  PID:3592
- C:\Windows\System\QwXNwfC.exe
  C:\Windows\System\QwXNwfC.exe
  2⤵
  PID:3608
- C:\Windows\System\VhxswYd.exe
  C:\Windows\System\VhxswYd.exe
  2⤵
  PID:3624
- C:\Windows\System\xiOoYZE.exe
  C:\Windows\System\xiOoYZE.exe
  2⤵
  PID:3640
- C:\Windows\System\ixegAUp.exe
  C:\Windows\System\ixegAUp.exe
  2⤵
  PID:3656
- C:\Windows\System\hZJlBdS.exe
  C:\Windows\System\hZJlBdS.exe
  2⤵
  PID:3672
- C:\Windows\System\fHhkhNc.exe
  C:\Windows\System\fHhkhNc.exe
  2⤵
  PID:3692
- C:\Windows\System\hvWUrkf.exe
  C:\Windows\System\hvWUrkf.exe
  2⤵
  PID:3708
- C:\Windows\System\AhZcMUW.exe
  C:\Windows\System\AhZcMUW.exe
  2⤵
  PID:3724
- C:\Windows\System\FfJPotj.exe
  C:\Windows\System\FfJPotj.exe
  2⤵
  PID:3740
- C:\Windows\System\nJsOrvC.exe
  C:\Windows\System\nJsOrvC.exe
  2⤵
  PID:3756
- C:\Windows\System\cqQSMmt.exe
  C:\Windows\System\cqQSMmt.exe
  2⤵
  PID:3772
- C:\Windows\System\XCDlYSf.exe
  C:\Windows\System\XCDlYSf.exe
  2⤵
  PID:3792
- C:\Windows\System\fQKxfgC.exe
  C:\Windows\System\fQKxfgC.exe
  2⤵
  PID:3812
- C:\Windows\System\rTHyZhE.exe
  C:\Windows\System\rTHyZhE.exe
  2⤵
  PID:3828
- C:\Windows\System\wqhdyyY.exe
  C:\Windows\System\wqhdyyY.exe
  2⤵
  PID:3844
- C:\Windows\System\gJNAqZw.exe
  C:\Windows\System\gJNAqZw.exe
  2⤵
  PID:3860
- C:\Windows\System\DBBytsy.exe
  C:\Windows\System\DBBytsy.exe
  2⤵
  PID:3876
- C:\Windows\System\gAhQcui.exe
  C:\Windows\System\gAhQcui.exe
  2⤵
  PID:3892
- C:\Windows\System\TfZAUIg.exe
  C:\Windows\System\TfZAUIg.exe
  2⤵
  PID:3908
- C:\Windows\System\lpASGYK.exe
  C:\Windows\System\lpASGYK.exe
  2⤵
  PID:3924
- C:\Windows\System\eQrzzIn.exe
  C:\Windows\System\eQrzzIn.exe
  2⤵
  PID:3940
- C:\Windows\System\acRLhWu.exe
  C:\Windows\System\acRLhWu.exe
  2⤵
  PID:3956
- C:\Windows\System\SzRclld.exe
  C:\Windows\System\SzRclld.exe
  2⤵
  PID:3976
- C:\Windows\System\nHqHPUt.exe
  C:\Windows\System\nHqHPUt.exe
  2⤵
  PID:3992
- C:\Windows\System\VPfCQLX.exe
  C:\Windows\System\VPfCQLX.exe
  2⤵
  PID:4008
- C:\Windows\System\Tnjkcdg.exe
  C:\Windows\System\Tnjkcdg.exe
  2⤵
  PID:4024
- C:\Windows\System\NkEHZsV.exe
  C:\Windows\System\NkEHZsV.exe
  2⤵
  PID:4040
- C:\Windows\System\CcWUhAQ.exe
  C:\Windows\System\CcWUhAQ.exe
  2⤵
  PID:4056
- C:\Windows\System\uqxrNLk.exe
  C:\Windows\System\uqxrNLk.exe
  2⤵
  PID:4072
- C:\Windows\System\gqARxpv.exe
  C:\Windows\System\gqARxpv.exe
  2⤵
  PID:4092
- C:\Windows\System\ffmqyld.exe
  C:\Windows\System\ffmqyld.exe
  2⤵
  PID:2468
- C:\Windows\System\BASrVsS.exe
  C:\Windows\System\BASrVsS.exe
  2⤵
  PID:448
- C:\Windows\System\edgaQGT.exe
  C:\Windows\System\edgaQGT.exe
  2⤵
  PID:3048
- C:\Windows\System\vHRRZbF.exe
  C:\Windows\System\vHRRZbF.exe
  2⤵
  PID:2376
- C:\Windows\System\BTfXNmL.exe
  C:\Windows\System\BTfXNmL.exe
  2⤵
  PID:1664
- C:\Windows\System\QaHHEyI.exe
  C:\Windows\System\QaHHEyI.exe
  2⤵
  PID:3088
- C:\Windows\System\lElmKxZ.exe
  C:\Windows\System\lElmKxZ.exe
  2⤵
  PID:3152
- C:\Windows\System\iMLMZLT.exe
  C:\Windows\System\iMLMZLT.exe
  2⤵
  PID:3196
- C:\Windows\System\ixBuNAU.exe
  C:\Windows\System\ixBuNAU.exe
  2⤵
  PID:3264
- C:\Windows\System\QsRAuXh.exe
  C:\Windows\System\QsRAuXh.exe
  2⤵
  PID:4108
- C:\Windows\System\NchKqPJ.exe
  C:\Windows\System\NchKqPJ.exe
  2⤵
  PID:4144
- C:\Windows\System\SuJWuDp.exe
  C:\Windows\System\SuJWuDp.exe
  2⤵
  PID:4160
- C:\Windows\System\CbhzQPF.exe
  C:\Windows\System\CbhzQPF.exe
  2⤵
  PID:4176
- C:\Windows\System\vpzawZI.exe
  C:\Windows\System\vpzawZI.exe
  2⤵
  PID:4192
- C:\Windows\System\mErBFIW.exe
  C:\Windows\System\mErBFIW.exe
  2⤵
  PID:4208
- C:\Windows\System\javlJMe.exe
  C:\Windows\System\javlJMe.exe
  2⤵
  PID:4224
- C:\Windows\System\rpCXURz.exe
  C:\Windows\System\rpCXURz.exe
  2⤵
  PID:4240
- C:\Windows\System\RNDnxdj.exe
  C:\Windows\System\RNDnxdj.exe
  2⤵
  PID:4256
- C:\Windows\System\bVTbXoP.exe
  C:\Windows\System\bVTbXoP.exe
  2⤵
  PID:4272
- C:\Windows\System\QJpLDPH.exe
  C:\Windows\System\QJpLDPH.exe
  2⤵
  PID:4292
- C:\Windows\System\wzzQisj.exe
  C:\Windows\System\wzzQisj.exe
  2⤵
  PID:4308
- C:\Windows\System\nnulqTF.exe
  C:\Windows\System\nnulqTF.exe
  2⤵
  PID:4324
- C:\Windows\System\HrWEhRr.exe
  C:\Windows\System\HrWEhRr.exe
  2⤵
  PID:4340
- C:\Windows\System\UMlTgOC.exe
  C:\Windows\System\UMlTgOC.exe
  2⤵
  PID:4356
- C:\Windows\System\NDEGFyI.exe
  C:\Windows\System\NDEGFyI.exe
  2⤵
  PID:4372
- C:\Windows\System\VSpkkiF.exe
  C:\Windows\System\VSpkkiF.exe
  2⤵
  PID:4388
- C:\Windows\System\ztROoVc.exe
  C:\Windows\System\ztROoVc.exe
  2⤵
  PID:4404
- C:\Windows\System\HIesIcw.exe
  C:\Windows\System\HIesIcw.exe
  2⤵
  PID:4420
- C:\Windows\System\zyEtFUH.exe
  C:\Windows\System\zyEtFUH.exe
  2⤵
  PID:4436
- C:\Windows\System\DlCFbsg.exe
  C:\Windows\System\DlCFbsg.exe
  2⤵
  PID:4452
- C:\Windows\System\weTKjFS.exe
  C:\Windows\System\weTKjFS.exe
  2⤵
  PID:4468
- C:\Windows\System\UoTcynr.exe
  C:\Windows\System\UoTcynr.exe
  2⤵
  PID:4484
- C:\Windows\System\AeYImXn.exe
  C:\Windows\System\AeYImXn.exe
  2⤵
  PID:4500
- C:\Windows\System\NoaPUWh.exe
  C:\Windows\System\NoaPUWh.exe
  2⤵
  PID:4516
- C:\Windows\System\byzUbiP.exe
  C:\Windows\System\byzUbiP.exe
  2⤵
  PID:4532
- C:\Windows\System\QZfVgmb.exe
  C:\Windows\System\QZfVgmb.exe
  2⤵
  PID:4548
- C:\Windows\System\NgoUHDq.exe
  C:\Windows\System\NgoUHDq.exe
  2⤵
  PID:4564
- C:\Windows\System\yqvrFSX.exe
  C:\Windows\System\yqvrFSX.exe
  2⤵
  PID:4580
- C:\Windows\System\mTNBcYp.exe
  C:\Windows\System\mTNBcYp.exe
  2⤵
  PID:4596
- C:\Windows\System\rKBnOcz.exe
  C:\Windows\System\rKBnOcz.exe
  2⤵
  PID:4612
- C:\Windows\System\IQFtQXD.exe
  C:\Windows\System\IQFtQXD.exe
  2⤵
  PID:4628
- C:\Windows\System\ZUrwHuX.exe
  C:\Windows\System\ZUrwHuX.exe
  2⤵
  PID:4644
- C:\Windows\System\bEfybHY.exe
  C:\Windows\System\bEfybHY.exe
  2⤵
  PID:4660
- C:\Windows\System\GVyUGQR.exe
  C:\Windows\System\GVyUGQR.exe
  2⤵
  PID:4676
- C:\Windows\System\hmWTtwG.exe
  C:\Windows\System\hmWTtwG.exe
  2⤵
  PID:4692
- C:\Windows\System\zRfEiWb.exe
  C:\Windows\System\zRfEiWb.exe
  2⤵
  PID:4708
- C:\Windows\System\afYbpIm.exe
  C:\Windows\System\afYbpIm.exe
  2⤵
  PID:4724
- C:\Windows\System\DZZXujk.exe
  C:\Windows\System\DZZXujk.exe
  2⤵
  PID:4740
- C:\Windows\System\VVhNIfs.exe
  C:\Windows\System\VVhNIfs.exe
  2⤵
  PID:4756
- C:\Windows\System\YBfnkXQ.exe
  C:\Windows\System\YBfnkXQ.exe
  2⤵
  PID:4772
- C:\Windows\System\LBSSKMV.exe
  C:\Windows\System\LBSSKMV.exe
  2⤵
  PID:4788
- C:\Windows\System\IwAnKOZ.exe
  C:\Windows\System\IwAnKOZ.exe
  2⤵
  PID:4804
- C:\Windows\System\PqSwjBT.exe
  C:\Windows\System\PqSwjBT.exe
  2⤵
  PID:4820
- C:\Windows\System\WpJTRxF.exe
  C:\Windows\System\WpJTRxF.exe
  2⤵
  PID:4836
- C:\Windows\System\glbUPyf.exe
  C:\Windows\System\glbUPyf.exe
  2⤵
  PID:4852
- C:\Windows\System\qUUleoG.exe
  C:\Windows\System\qUUleoG.exe
  2⤵
  PID:4868
- C:\Windows\System\DVpMYwT.exe
  C:\Windows\System\DVpMYwT.exe
  2⤵
  PID:4884
- C:\Windows\System\LBGfWnl.exe
  C:\Windows\System\LBGfWnl.exe
  2⤵
  PID:4900
- C:\Windows\System\YKdodxU.exe
  C:\Windows\System\YKdodxU.exe
  2⤵
  PID:4916
- C:\Windows\System\mKMnpDz.exe
  C:\Windows\System\mKMnpDz.exe
  2⤵
  PID:4936
- C:\Windows\System\pimIBSj.exe
  C:\Windows\System\pimIBSj.exe
  2⤵
  PID:4952
- C:\Windows\System\owQipwT.exe
  C:\Windows\System\owQipwT.exe
  2⤵
  PID:4968
- C:\Windows\System\wrCcfTX.exe
  C:\Windows\System\wrCcfTX.exe
  2⤵
  PID:4984
- C:\Windows\System\fAIUNRV.exe
  C:\Windows\System\fAIUNRV.exe
  2⤵
  PID:5000
- C:\Windows\System\HAhKseY.exe
  C:\Windows\System\HAhKseY.exe
  2⤵
  PID:5016
- C:\Windows\System\hVWivFt.exe
  C:\Windows\System\hVWivFt.exe
  2⤵
  PID:5032
- C:\Windows\System\CKlRaIe.exe
  C:\Windows\System\CKlRaIe.exe
  2⤵
  PID:5048
- C:\Windows\System\vEjkenH.exe
  C:\Windows\System\vEjkenH.exe
  2⤵
  PID:5068
- C:\Windows\System\QlzMRtR.exe
  C:\Windows\System\QlzMRtR.exe
  2⤵
  PID:5084
- C:\Windows\System\MMKcSDD.exe
  C:\Windows\System\MMKcSDD.exe
  2⤵
  PID:5100
- C:\Windows\System\waiyoun.exe
  C:\Windows\System\waiyoun.exe
  2⤵
  PID:5116
- C:\Windows\System\oCoWACM.exe
  C:\Windows\System\oCoWACM.exe
  2⤵
  PID:3332
- C:\Windows\System\DmdOdUy.exe
  C:\Windows\System\DmdOdUy.exe
  2⤵
  PID:3392
- C:\Windows\System\tbRsKFS.exe
  C:\Windows\System\tbRsKFS.exe
  2⤵
  PID:3456
- C:\Windows\System\DCKGGnZ.exe
  C:\Windows\System\DCKGGnZ.exe
  2⤵
  PID:3520
- C:\Windows\System\XxwAFkD.exe
  C:\Windows\System\XxwAFkD.exe
  2⤵
  PID:3584
- C:\Windows\System\Khrzglj.exe
  C:\Windows\System\Khrzglj.exe
  2⤵
  PID:3748
- C:\Windows\System\CwEchaz.exe
  C:\Windows\System\CwEchaz.exe
  2⤵
  PID:3824
- C:\Windows\System\ystpZiN.exe
  C:\Windows\System\ystpZiN.exe
  2⤵
  PID:4080
- C:\Windows\System\bFfknAN.exe
  C:\Windows\System\bFfknAN.exe
  2⤵
  PID:3192
- C:\Windows\System\FyyVAFz.exe
  C:\Windows\System\FyyVAFz.exe
  2⤵
  PID:4156
- C:\Windows\System\ikoyOHg.exe
  C:\Windows\System\ikoyOHg.exe
  2⤵
  PID:4220
- C:\Windows\System\xAtCDTD.exe
  C:\Windows\System\xAtCDTD.exe
  2⤵
  PID:2328
- C:\Windows\System\dCTXupz.exe
  C:\Windows\System\dCTXupz.exe
  2⤵
  PID:2588
- C:\Windows\System\IDXYrHt.exe
  C:\Windows\System\IDXYrHt.exe
  2⤵
  PID:1348
- C:\Windows\System\NFaQujY.exe
  C:\Windows\System\NFaQujY.exe
  2⤵
  PID:2616
- C:\Windows\System\DkfRkeF.exe
  C:\Windows\System\DkfRkeF.exe
  2⤵
  PID:2384
- C:\Windows\System\imZQjjv.exe
  C:\Windows\System\imZQjjv.exe
  2⤵
  PID:2228
- C:\Windows\System\RRpOUiA.exe
  C:\Windows\System\RRpOUiA.exe
  2⤵
  PID:4280
- C:\Windows\System\VJWiIuQ.exe
  C:\Windows\System\VJWiIuQ.exe
  2⤵
  PID:4320
- C:\Windows\System\GUBxukN.exe
  C:\Windows\System\GUBxukN.exe
  2⤵
  PID:4384
- C:\Windows\System\UyNfBqK.exe
  C:\Windows\System\UyNfBqK.exe
  2⤵
  PID:4476
- C:\Windows\System\ptvZjme.exe
  C:\Windows\System\ptvZjme.exe
  2⤵
  PID:4512
- C:\Windows\System\sglfzYN.exe
  C:\Windows\System\sglfzYN.exe
  2⤵
  PID:4576
- C:\Windows\System\XYbyivB.exe
  C:\Windows\System\XYbyivB.exe
  2⤵
  PID:4640
- C:\Windows\System\bmGwDEZ.exe
  C:\Windows\System\bmGwDEZ.exe
  2⤵
  PID:4704
- C:\Windows\System\dNaiPHK.exe
  C:\Windows\System\dNaiPHK.exe
  2⤵
  PID:4768
- C:\Windows\System\qTfEpnq.exe
  C:\Windows\System\qTfEpnq.exe
  2⤵
  PID:4832
- C:\Windows\System\ExIOgEP.exe
  C:\Windows\System\ExIOgEP.exe
  2⤵
  PID:4896
- C:\Windows\System\cgkGzAl.exe
  C:\Windows\System\cgkGzAl.exe
  2⤵
  PID:4960
- C:\Windows\System\oSqHbPA.exe
  C:\Windows\System\oSqHbPA.exe
  2⤵
  PID:5024
- C:\Windows\System\nlJOdqK.exe
  C:\Windows\System\nlJOdqK.exe
  2⤵
  PID:5064
- C:\Windows\System\AQQpWRF.exe
  C:\Windows\System\AQQpWRF.exe
  2⤵
  PID:3328
- C:\Windows\System\iiqQHrq.exe
  C:\Windows\System\iiqQHrq.exe
  2⤵
  PID:3556
- C:\Windows\System\IMumUoD.exe
  C:\Windows\System\IMumUoD.exe
  2⤵
  PID:3820
- C:\Windows\System\jwpNIqb.exe
  C:\Windows\System\jwpNIqb.exe
  2⤵
  PID:1428
- C:\Windows\System\hXKuUvA.exe
  C:\Windows\System\hXKuUvA.exe
  2⤵
  PID:1376
- C:\Windows\System\WUGaque.exe
  C:\Windows\System\WUGaque.exe
  2⤵
  PID:4188
- C:\Windows\System\LigCUBl.exe
  C:\Windows\System\LigCUBl.exe
  2⤵
  PID:348
- C:\Windows\System\FzKzaws.exe
  C:\Windows\System\FzKzaws.exe
  2⤵
  PID:812
- C:\Windows\System\DFBMqtS.exe
  C:\Windows\System\DFBMqtS.exe
  2⤵
  PID:1432
- C:\Windows\System\ndAjMwb.exe
  C:\Windows\System\ndAjMwb.exe
  2⤵
  PID:4572
- C:\Windows\System\nYANvpY.exe
  C:\Windows\System\nYANvpY.exe
  2⤵
  PID:4828
- C:\Windows\System\HCwxjoW.exe
  C:\Windows\System\HCwxjoW.exe
  2⤵
  PID:5060
- C:\Windows\System\bnghhri.exe
  C:\Windows\System\bnghhri.exe
  2⤵
  PID:984
- C:\Windows\System\eyVVraN.exe
  C:\Windows\System\eyVVraN.exe
  2⤵
  PID:5128
- C:\Windows\System\nSdtRlN.exe
  C:\Windows\System\nSdtRlN.exe
  2⤵
  PID:5144
- C:\Windows\System\llJFnfB.exe
  C:\Windows\System\llJFnfB.exe
  2⤵
  PID:5160
- C:\Windows\System\etGpGAj.exe
  C:\Windows\System\etGpGAj.exe
  2⤵
  PID:5176
- C:\Windows\System\BEsIkVU.exe
  C:\Windows\System\BEsIkVU.exe
  2⤵
  PID:5192
- C:\Windows\System\WOIUrwl.exe
  C:\Windows\System\WOIUrwl.exe
  2⤵
  PID:5208
- C:\Windows\System\XVWzqNw.exe
  C:\Windows\System\XVWzqNw.exe
  2⤵
  PID:5224
- C:\Windows\System\HCIcLdt.exe
  C:\Windows\System\HCIcLdt.exe
  2⤵
  PID:5240
- C:\Windows\System\igNyleE.exe
  C:\Windows\System\igNyleE.exe
  2⤵
  PID:5256
- C:\Windows\System\EwqbuEw.exe
  C:\Windows\System\EwqbuEw.exe
  2⤵
  PID:5272
- C:\Windows\System\AHlMkly.exe
  C:\Windows\System\AHlMkly.exe
  2⤵
  PID:5288
- C:\Windows\System\NfOOUIK.exe
  C:\Windows\System\NfOOUIK.exe
  2⤵
  PID:5304
- C:\Windows\System\unwRTcm.exe
  C:\Windows\System\unwRTcm.exe
  2⤵
  PID:5320
- C:\Windows\System\UsXiudc.exe
  C:\Windows\System\UsXiudc.exe
  2⤵
  PID:5336
- C:\Windows\System\UKfmzcj.exe
  C:\Windows\System\UKfmzcj.exe
  2⤵
  PID:5352
- C:\Windows\System\asaehmr.exe
  C:\Windows\System\asaehmr.exe
  2⤵
  PID:5368
- C:\Windows\System\ABPaDQy.exe
  C:\Windows\System\ABPaDQy.exe
  2⤵
  PID:5384
- C:\Windows\System\jcgHCna.exe
  C:\Windows\System\jcgHCna.exe
  2⤵
  PID:5400
- C:\Windows\System\XxohcFR.exe
  C:\Windows\System\XxohcFR.exe
  2⤵
  PID:5416
- C:\Windows\System\aGrmnPB.exe
  C:\Windows\System\aGrmnPB.exe
  2⤵
  PID:5432
- C:\Windows\System\eddioog.exe
  C:\Windows\System\eddioog.exe
  2⤵
  PID:5448
- C:\Windows\System\iCrfhal.exe
  C:\Windows\System\iCrfhal.exe
  2⤵
  PID:5464
- C:\Windows\System\izVnQkx.exe
  C:\Windows\System\izVnQkx.exe
  2⤵
  PID:5480
- C:\Windows\System\tFfTEJw.exe
  C:\Windows\System\tFfTEJw.exe
  2⤵
  PID:5496
- C:\Windows\System\mQhKEGy.exe
  C:\Windows\System\mQhKEGy.exe
  2⤵
  PID:5512
- C:\Windows\System\xIxUNKc.exe
  C:\Windows\System\xIxUNKc.exe
  2⤵
  PID:5528
- C:\Windows\System\GSBfpcy.exe
  C:\Windows\System\GSBfpcy.exe
  2⤵
  PID:5544
- C:\Windows\System\AwlBkVu.exe
  C:\Windows\System\AwlBkVu.exe
  2⤵
  PID:5560
- C:\Windows\System\HBkxuSb.exe
  C:\Windows\System\HBkxuSb.exe
  2⤵
  PID:5576
- C:\Windows\System\zCIPcZv.exe
  C:\Windows\System\zCIPcZv.exe
  2⤵
  PID:5592
- C:\Windows\System\fkjPcYP.exe
  C:\Windows\System\fkjPcYP.exe
  2⤵
  PID:5608
- C:\Windows\System\msvrZSO.exe
  C:\Windows\System\msvrZSO.exe
  2⤵
  PID:5624
- C:\Windows\System\vqMAVtz.exe
  C:\Windows\System\vqMAVtz.exe
  2⤵
  PID:5640
- C:\Windows\System\kXonJoK.exe
  C:\Windows\System\kXonJoK.exe
  2⤵
  PID:5664
- C:\Windows\System\kWFMOrc.exe
  C:\Windows\System\kWFMOrc.exe
  2⤵
  PID:5680
- C:\Windows\System\dTbeUxr.exe
  C:\Windows\System\dTbeUxr.exe
  2⤵
  PID:5696
- C:\Windows\System\zhZLIoT.exe
  C:\Windows\System\zhZLIoT.exe
  2⤵
  PID:5712
- C:\Windows\System\CdeymeN.exe
  C:\Windows\System\CdeymeN.exe
  2⤵
  PID:5728
- C:\Windows\System\pYVipqK.exe
  C:\Windows\System\pYVipqK.exe
  2⤵
  PID:5744
- C:\Windows\System\oomuBqB.exe
  C:\Windows\System\oomuBqB.exe
  2⤵
  PID:5768
- C:\Windows\System\MHPGNKt.exe
  C:\Windows\System\MHPGNKt.exe
  2⤵
  PID:5784
- C:\Windows\System\eWqDrIB.exe
  C:\Windows\System\eWqDrIB.exe
  2⤵
  PID:5824
- C:\Windows\System\fLPdiRu.exe
  C:\Windows\System\fLPdiRu.exe
  2⤵
  PID:5844
- C:\Windows\System\UWiuJrZ.exe
  C:\Windows\System\UWiuJrZ.exe
  2⤵
  PID:5860
- C:\Windows\System\ONlPNsB.exe
  C:\Windows\System\ONlPNsB.exe
  2⤵
  PID:5876
- C:\Windows\System\XHnACMm.exe
  C:\Windows\System\XHnACMm.exe
  2⤵
  PID:5892
- C:\Windows\System\DjMsfGt.exe
  C:\Windows\System\DjMsfGt.exe
  2⤵
  PID:5956
- C:\Windows\System\uKuuOmx.exe
  C:\Windows\System\uKuuOmx.exe
  2⤵
  PID:5976
- C:\Windows\System\SmgWCfw.exe
  C:\Windows\System\SmgWCfw.exe
  2⤵
  PID:6000
- C:\Windows\System\LOdjlOz.exe
  C:\Windows\System\LOdjlOz.exe
  2⤵
  PID:6020
- C:\Windows\System\GsTiIut.exe
  C:\Windows\System\GsTiIut.exe
  2⤵
  PID:6040
- C:\Windows\System\EAGVdbN.exe
  C:\Windows\System\EAGVdbN.exe
  2⤵
  PID:6056
- C:\Windows\System\qkAkbAr.exe
  C:\Windows\System\qkAkbAr.exe
  2⤵
  PID:6072
- C:\Windows\System\lQabDyA.exe
  C:\Windows\System\lQabDyA.exe
  2⤵
  PID:6088
- C:\Windows\System\nhXlDut.exe
  C:\Windows\System\nhXlDut.exe
  2⤵
  PID:6108
- C:\Windows\System\LWpVHEu.exe
  C:\Windows\System\LWpVHEu.exe
  2⤵
  PID:6128
- C:\Windows\System\AjZAQdP.exe
  C:\Windows\System\AjZAQdP.exe
  2⤵
  PID:2604
- C:\Windows\System\cvSGoNT.exe
  C:\Windows\System\cvSGoNT.exe
  2⤵
  PID:4932
- C:\Windows\System\BIsueLO.exe
  C:\Windows\System\BIsueLO.exe
  2⤵
  PID:5152
- C:\Windows\System\FOQaDnS.exe
  C:\Windows\System\FOQaDnS.exe
  2⤵
  PID:2884
- C:\Windows\System\HtLFYEI.exe
  C:\Windows\System\HtLFYEI.exe
  2⤵
  PID:488
- C:\Windows\System\mKlZkVV.exe
  C:\Windows\System\mKlZkVV.exe
  2⤵
  PID:5280
- C:\Windows\System\iATegpX.exe
  C:\Windows\System\iATegpX.exe
  2⤵
  PID:5376
- C:\Windows\System\qmfqSNK.exe
  C:\Windows\System\qmfqSNK.exe
  2⤵
  PID:5440
- C:\Windows\System\pgWUrgd.exe
  C:\Windows\System\pgWUrgd.exe
  2⤵
  PID:2288
- C:\Windows\System\jrkhYgp.exe
  C:\Windows\System\jrkhYgp.exe
  2⤵
  PID:1744
- C:\Windows\System\VXfmIWh.exe
  C:\Windows\System\VXfmIWh.exe
  2⤵
  PID:2448
- C:\Windows\System\PgDadLv.exe
  C:\Windows\System\PgDadLv.exe
  2⤵
  PID:1180
- C:\Windows\System\lCYeYRs.exe
  C:\Windows\System\lCYeYRs.exe
  2⤵
  PID:3104
- C:\Windows\System\CKOMedM.exe
  C:\Windows\System\CKOMedM.exe
  2⤵
  PID:3168
- C:\Windows\System\nFPYMyt.exe
  C:\Windows\System\nFPYMyt.exe
  2⤵
  PID:3228
- C:\Windows\System\SjwKYFc.exe
  C:\Windows\System\SjwKYFc.exe
  2⤵
  PID:3244
- C:\Windows\System\oJDRZSJ.exe
  C:\Windows\System\oJDRZSJ.exe
  2⤵
  PID:3284
- C:\Windows\System\jgtRUVw.exe
  C:\Windows\System\jgtRUVw.exe
  2⤵
  PID:3348
- C:\Windows\System\KVEeTSx.exe
  C:\Windows\System\KVEeTSx.exe
  2⤵
  PID:3412
- C:\Windows\System\nFosFiK.exe
  C:\Windows\System\nFosFiK.exe
  2⤵
  PID:3476
- C:\Windows\System\QjiZaGe.exe
  C:\Windows\System\QjiZaGe.exe
  2⤵
  PID:3540
- C:\Windows\System\vwjjwME.exe
  C:\Windows\System\vwjjwME.exe
  2⤵
  PID:3604
- C:\Windows\System\DxRBNkD.exe
  C:\Windows\System\DxRBNkD.exe
  2⤵
  PID:3632
- C:\Windows\System\RrARyPS.exe
  C:\Windows\System\RrARyPS.exe
  2⤵
  PID:3704
- C:\Windows\System\aoGxHml.exe
  C:\Windows\System\aoGxHml.exe
  2⤵
  PID:3768
- C:\Windows\System\ypJpcgl.exe
  C:\Windows\System\ypJpcgl.exe
  2⤵
  PID:3840
- C:\Windows\System\ieBrSBR.exe
  C:\Windows\System\ieBrSBR.exe
  2⤵
  PID:3932
- C:\Windows\System\wSNKZmb.exe
  C:\Windows\System\wSNKZmb.exe
  2⤵
  PID:3972
- C:\Windows\System\bUCUKtu.exe
  C:\Windows\System\bUCUKtu.exe
  2⤵
  PID:4064
- C:\Windows\System\KthsMgs.exe
  C:\Windows\System\KthsMgs.exe
  2⤵
  PID:772
- C:\Windows\System\bdiPTNf.exe
  C:\Windows\System\bdiPTNf.exe
  2⤵
  PID:3120
- C:\Windows\System\KGsnsHi.exe
  C:\Windows\System\KGsnsHi.exe
  2⤵
  PID:4116
- C:\Windows\System\TxmtTyJ.exe
  C:\Windows\System\TxmtTyJ.exe
  2⤵
  PID:4132
- C:\Windows\System\IQMAEBn.exe
  C:\Windows\System\IQMAEBn.exe
  2⤵
  PID:4172
- C:\Windows\System\YPLTxPa.exe
  C:\Windows\System\YPLTxPa.exe
  2⤵
  PID:4236
- C:\Windows\System\bKUxCaL.exe
  C:\Windows\System\bKUxCaL.exe
  2⤵
  PID:4304
- C:\Windows\System\KiVsmIg.exe
  C:\Windows\System\KiVsmIg.exe
  2⤵
  PID:4368
- C:\Windows\System\EWhWwPx.exe
  C:\Windows\System\EWhWwPx.exe
  2⤵
  PID:4432
- C:\Windows\System\EBJGEvl.exe
  C:\Windows\System\EBJGEvl.exe
  2⤵
  PID:5040
- C:\Windows\System\HJCjJwT.exe
  C:\Windows\System\HJCjJwT.exe
  2⤵
  PID:4480
- C:\Windows\System\bRLhbtr.exe
  C:\Windows\System\bRLhbtr.exe
  2⤵
  PID:5456
- C:\Windows\System\EBxkxxi.exe
  C:\Windows\System\EBxkxxi.exe
  2⤵
  PID:5584
- C:\Windows\System\pqqThFZ.exe
  C:\Windows\System\pqqThFZ.exe
  2⤵
  PID:5708
- C:\Windows\System\QypvehS.exe
  C:\Windows\System\QypvehS.exe
  2⤵
  PID:6028
- C:\Windows\System\RFyorgd.exe
  C:\Windows\System\RFyorgd.exe
  2⤵
  PID:760
- C:\Windows\System\NhIeVgj.exe
  C:\Windows\System\NhIeVgj.exe
  2⤵
  PID:6012
- C:\Windows\System\BxMoMtD.exe
  C:\Windows\System\BxMoMtD.exe
  2⤵
  PID:2824
- C:\Windows\System\DCUdmnf.exe
  C:\Windows\System\DCUdmnf.exe
  2⤵
  PID:2888
- C:\Windows\System\xoHVEDc.exe
  C:\Windows\System\xoHVEDc.exe
  2⤵
  PID:5312
- C:\Windows\System\XZmssEu.exe
  C:\Windows\System\XZmssEu.exe
  2⤵
  PID:1864
- C:\Windows\System\UprLdgE.exe
  C:\Windows\System\UprLdgE.exe
  2⤵
  PID:2900
- C:\Windows\System\jmHSPcF.exe
  C:\Windows\System\jmHSPcF.exe
  2⤵
  PID:3076
- C:\Windows\System\gKYjlwU.exe
  C:\Windows\System\gKYjlwU.exe
  2⤵
  PID:2600
- C:\Windows\System\HIeuWGe.exe
  C:\Windows\System\HIeuWGe.exe
  2⤵
  PID:3220
- C:\Windows\System\YgitYFW.exe
  C:\Windows\System\YgitYFW.exe
  2⤵
  PID:3224
- C:\Windows\System\zToUKiK.exe
  C:\Windows\System\zToUKiK.exe
  2⤵
  PID:3408
- C:\Windows\System\hDmwssc.exe
  C:\Windows\System\hDmwssc.exe
  2⤵
  PID:5472
- C:\Windows\System\lbkVUlW.exe
  C:\Windows\System\lbkVUlW.exe
  2⤵
  PID:2084
- C:\Windows\System\XOjJMoV.exe
  C:\Windows\System\XOjJMoV.exe
  2⤵
  PID:5972
- C:\Windows\System\eQKqGfu.exe
  C:\Windows\System\eQKqGfu.exe
  2⤵
  PID:2356
- C:\Windows\System\hCaJoZW.exe
  C:\Windows\System\hCaJoZW.exe
  2⤵
  PID:5412
- C:\Windows\System\YXoEWRG.exe
  C:\Windows\System\YXoEWRG.exe
  2⤵
  PID:6052
- C:\Windows\System\UfuSjBn.exe
  C:\Windows\System\UfuSjBn.exe
  2⤵
  PID:3900
- C:\Windows\System\cvxVQjv.exe
  C:\Windows\System\cvxVQjv.exe
  2⤵
  PID:6120
- C:\Windows\System\jIrvbpY.exe
  C:\Windows\System\jIrvbpY.exe
  2⤵
  PID:4544
- C:\Windows\System\VBJNCBc.exe
  C:\Windows\System\VBJNCBc.exe
  2⤵
  PID:1688
- C:\Windows\System\yZAVWGM.exe
  C:\Windows\System\yZAVWGM.exe
  2⤵
  PID:3236
- C:\Windows\System\iuSUnqg.exe
  C:\Windows\System\iuSUnqg.exe
  2⤵
  PID:3444
- C:\Windows\System\eLfthnT.exe
  C:\Windows\System\eLfthnT.exe
  2⤵
  PID:3664
- C:\Windows\System\sypZKpC.exe
  C:\Windows\System\sypZKpC.exe
  2⤵
  PID:5504
- C:\Windows\System\ZMOEHYK.exe
  C:\Windows\System\ZMOEHYK.exe
  2⤵
  PID:4032
- C:\Windows\System\JReAsSR.exe
  C:\Windows\System\JReAsSR.exe
  2⤵
  PID:4128
- C:\Windows\System\mdIbcDq.exe
  C:\Windows\System\mdIbcDq.exe
  2⤵
  PID:4232
- C:\Windows\System\faXbdTQ.exe
  C:\Windows\System\faXbdTQ.exe
  2⤵
  PID:2196
- C:\Windows\System\vdffJuO.exe
  C:\Windows\System\vdffJuO.exe
  2⤵
  PID:3204
- C:\Windows\System\RGuEcIQ.exe
  C:\Windows\System\RGuEcIQ.exe
  2⤵
  PID:4300
- C:\Windows\System\LBNaFRM.exe
  C:\Windows\System\LBNaFRM.exe
  2⤵
  PID:2428
- C:\Windows\System\fyygATI.exe
  C:\Windows\System\fyygATI.exe
  2⤵
  PID:4560
- C:\Windows\System\CeMXkvZ.exe
  C:\Windows\System\CeMXkvZ.exe
  2⤵
  PID:4624
- C:\Windows\System\YtoDBwx.exe
  C:\Windows\System\YtoDBwx.exe
  2⤵
  PID:4688
- C:\Windows\System\wtdpgfC.exe
  C:\Windows\System\wtdpgfC.exe
  2⤵
  PID:4752
- C:\Windows\System\WtaEYJq.exe
  C:\Windows\System\WtaEYJq.exe
  2⤵
  PID:4844
- C:\Windows\System\ROhsiRy.exe
  C:\Windows\System\ROhsiRy.exe
  2⤵
  PID:4880
- C:\Windows\System\yjhitFu.exe
  C:\Windows\System\yjhitFu.exe
  2⤵
  PID:4944
- C:\Windows\System\CIYOfLQ.exe
  C:\Windows\System\CIYOfLQ.exe
  2⤵
  PID:1404
- C:\Windows\System\wqlzJVc.exe
  C:\Windows\System\wqlzJVc.exe
  2⤵
  PID:5012
- C:\Windows\System\ixfKEKi.exe
  C:\Windows\System\ixfKEKi.exe
  2⤵
  PID:2836
- C:\Windows\System\cTeqhro.exe
  C:\Windows\System\cTeqhro.exe
  2⤵
  PID:2628
- C:\Windows\System\zfIxLNl.exe
  C:\Windows\System\zfIxLNl.exe
  2⤵
  PID:3360
- C:\Windows\System\QqCoYhL.exe
  C:\Windows\System\QqCoYhL.exe
  2⤵
  PID:3616
- C:\Windows\System\QtAIHhd.exe
  C:\Windows\System\QtAIHhd.exe
  2⤵
  PID:3648
- C:\Windows\System\xNXvSKf.exe
  C:\Windows\System\xNXvSKf.exe
  2⤵
  PID:3688
- C:\Windows\System\cyNpyNH.exe
  C:\Windows\System\cyNpyNH.exe
  2⤵
  PID:3856
- C:\Windows\System\kosaTvM.exe
  C:\Windows\System\kosaTvM.exe
  2⤵
  PID:3948
- C:\Windows\System\TnQWZdY.exe
  C:\Windows\System\TnQWZdY.exe
  2⤵
  PID:4016
- C:\Windows\System\brjsRLu.exe
  C:\Windows\System\brjsRLu.exe
  2⤵
  PID:1496
- C:\Windows\System\VKlHxiJ.exe
  C:\Windows\System\VKlHxiJ.exe
  2⤵
  PID:4152
- C:\Windows\System\qpHeVgh.exe
  C:\Windows\System\qpHeVgh.exe
  2⤵
  PID:4732
- C:\Windows\System\EXZeRoX.exe
  C:\Windows\System\EXZeRoX.exe
  2⤵
  PID:4992
- C:\Windows\System\EQxBlXF.exe
  C:\Windows\System\EQxBlXF.exe
  2⤵
  PID:2304
- C:\Windows\System\VhnRQpv.exe
  C:\Windows\System\VhnRQpv.exe
  2⤵
  PID:4380
- C:\Windows\System\GgcAvyq.exe
  C:\Windows\System\GgcAvyq.exe
  2⤵
  PID:5540
- C:\Windows\System\NTZzpGK.exe
  C:\Windows\System\NTZzpGK.exe
  2⤵
  PID:5600
- C:\Windows\System\onyNWdj.exe
  C:\Windows\System\onyNWdj.exe
  2⤵
  PID:1704
- C:\Windows\System\ZoZHdCA.exe
  C:\Windows\System\ZoZHdCA.exe
  2⤵
  PID:4316
- C:\Windows\System\rkbzzVZ.exe
  C:\Windows\System\rkbzzVZ.exe
  2⤵
  PID:5620
- C:\Windows\System\wpCvkPK.exe
  C:\Windows\System\wpCvkPK.exe
  2⤵
  PID:5740
- C:\Windows\System\tkWYNSK.exe
  C:\Windows\System\tkWYNSK.exe
  2⤵
  PID:5676
- C:\Windows\System\dLjjDbl.exe
  C:\Windows\System\dLjjDbl.exe
  2⤵
  PID:5688
- C:\Windows\System\hEqeHzh.exe
  C:\Windows\System\hEqeHzh.exe
  2⤵
  PID:5756
- C:\Windows\System\YPgccTC.exe
  C:\Windows\System\YPgccTC.exe
  2⤵
  PID:5852
- C:\Windows\System\FBbORYY.exe
  C:\Windows\System\FBbORYY.exe
  2⤵
  PID:5884
- C:\Windows\System\nvlBsQk.exe
  C:\Windows\System\nvlBsQk.exe
  2⤵
  PID:5936
- C:\Windows\System\XgrmjEt.exe
  C:\Windows\System\XgrmjEt.exe
  2⤵
  PID:5888
- C:\Windows\System\eNCJULr.exe
  C:\Windows\System\eNCJULr.exe
  2⤵
  PID:1020
- C:\Windows\System\jtPOWqi.exe
  C:\Windows\System\jtPOWqi.exe
  2⤵
  PID:6068
- C:\Windows\System\CYpanCy.exe
  C:\Windows\System\CYpanCy.exe
  2⤵
  PID:6104
- C:\Windows\System\ZEspRJf.exe
  C:\Windows\System\ZEspRJf.exe
  2⤵
  PID:1836
- C:\Windows\System\waFpaqz.exe
  C:\Windows\System\waFpaqz.exe
  2⤵
  PID:2420
- C:\Windows\System\fuHFkCa.exe
  C:\Windows\System\fuHFkCa.exe
  2⤵
  PID:5692
- C:\Windows\System\mPvJKCo.exe
  C:\Windows\System\mPvJKCo.exe
  2⤵
  PID:3536
- C:\Windows\System\PCkuxTP.exe
  C:\Windows\System\PCkuxTP.exe
  2⤵
  PID:2756
- C:\Windows\System\JDBZSji.exe
  C:\Windows\System\JDBZSji.exe
  2⤵
  PID:3764
- C:\Windows\System\xrQGUjs.exe
  C:\Windows\System\xrQGUjs.exe
  2⤵
  PID:4444
- C:\Windows\System\PeUhmlN.exe
  C:\Windows\System\PeUhmlN.exe
  2⤵
  PID:3600
- C:\Windows\System\xMJxNlc.exe
  C:\Windows\System\xMJxNlc.exe
  2⤵
  PID:4204
- C:\Windows\System\gOKyZKC.exe
  C:\Windows\System\gOKyZKC.exe
  2⤵
  PID:4428
- C:\Windows\System\VVZsaRb.exe
  C:\Windows\System\VVZsaRb.exe
  2⤵
  PID:2956
- C:\Windows\System\MwvFZSe.exe
  C:\Windows\System\MwvFZSe.exe
  2⤵
  PID:3280
- C:\Windows\System\JRRCZDT.exe
  C:\Windows\System\JRRCZDT.exe
  2⤵
  PID:2924
- C:\Windows\System\AcCpyrH.exe
  C:\Windows\System\AcCpyrH.exe
  2⤵
  PID:6084
- C:\Windows\System\vJXCHiG.exe
  C:\Windows\System\vJXCHiG.exe
  2⤵
  PID:4168
- C:\Windows\System\VCHHQRm.exe
  C:\Windows\System\VCHHQRm.exe
  2⤵
  PID:4124
- C:\Windows\System\OCcKjSM.exe
  C:\Windows\System\OCcKjSM.exe
  2⤵
  PID:3700
- C:\Windows\System\HVecvTs.exe
  C:\Windows\System\HVecvTs.exe
  2⤵
  PID:5188
- C:\Windows\System\guStYTC.exe
  C:\Windows\System\guStYTC.exe
  2⤵
  PID:1876
- C:\Windows\System\MhGPvrb.exe
  C:\Windows\System\MhGPvrb.exe
  2⤵
  PID:4268
- C:\Windows\System\apTHjQi.exe
  C:\Windows\System\apTHjQi.exe
  2⤵
  PID:3720
- C:\Windows\System\nmrtGwo.exe
  C:\Windows\System\nmrtGwo.exe
  2⤵
  PID:4104
- C:\Windows\System\BzxliRq.exe
  C:\Windows\System\BzxliRq.exe
  2⤵
  PID:4352
- C:\Windows\System\CcfhILd.exe
  C:\Windows\System\CcfhILd.exe
  2⤵
  PID:5096
- C:\Windows\System\LIlQZCt.exe
  C:\Windows\System\LIlQZCt.exe
  2⤵
  PID:5572
- C:\Windows\System\RRyYpvz.exe
  C:\Windows\System\RRyYpvz.exe
  2⤵
  PID:4656
- C:\Windows\System\VwxBhyi.exe
  C:\Windows\System\VwxBhyi.exe
  2⤵
  PID:2112
- C:\Windows\System\ikdkbWh.exe
  C:\Windows\System\ikdkbWh.exe
  2⤵
  PID:2128
- C:\Windows\System\gmXOuQz.exe
  C:\Windows\System\gmXOuQz.exe
  2⤵
  PID:2788
- C:\Windows\System\XueeFWz.exe
  C:\Windows\System\XueeFWz.exe
  2⤵
  PID:4492
- C:\Windows\System\rwUItCD.exe
  C:\Windows\System\rwUItCD.exe
  2⤵
  PID:5008
- C:\Windows\System\kSWmZvV.exe
  C:\Windows\System\kSWmZvV.exe
  2⤵
  PID:3888
- C:\Windows\System\uYvQGDm.exe
  C:\Windows\System\uYvQGDm.exe
  2⤵
  PID:808
- C:\Windows\System\YSeFpXw.exe
  C:\Windows\System\YSeFpXw.exe
  2⤵
  PID:4800
- C:\Windows\System\ScpleHV.exe
  C:\Windows\System\ScpleHV.exe
  2⤵
  PID:5204
- C:\Windows\System\IlMYHqe.exe
  C:\Windows\System\IlMYHqe.exe
  2⤵
  PID:5200
- C:\Windows\System\KVlWesn.exe
  C:\Windows\System\KVlWesn.exe
  2⤵
  PID:5264
- C:\Windows\System\rMmiXjC.exe
  C:\Windows\System\rMmiXjC.exe
  2⤵
  PID:5332
- C:\Windows\System\nUPnfyH.exe
  C:\Windows\System\nUPnfyH.exe
  2⤵
  PID:5392
- C:\Windows\System\kUUkEgj.exe
  C:\Windows\System\kUUkEgj.exe
  2⤵
  PID:5396
- C:\Windows\System\sNDLOMt.exe
  C:\Windows\System\sNDLOMt.exe
  2⤵
  PID:3428
- C:\Windows\System\vrGTfhj.exe
  C:\Windows\System\vrGTfhj.exe
  2⤵
  PID:5804
- C:\Windows\System\wOdUkvJ.exe
  C:\Windows\System\wOdUkvJ.exe
  2⤵
  PID:5552
- C:\Windows\System\puDdzkN.exe
  C:\Windows\System\puDdzkN.exe
  2⤵
  PID:5616
- C:\Windows\System\UTbOzqJ.exe
  C:\Windows\System\UTbOzqJ.exe
  2⤵
  PID:2692
- C:\Windows\System\yiplJNs.exe
  C:\Windows\System\yiplJNs.exe
  2⤵
  PID:5872
- C:\Windows\System\ThlVrqP.exe
  C:\Windows\System\ThlVrqP.exe
  2⤵
  PID:5916
- C:\Windows\System\EgWokhk.exe
  C:\Windows\System\EgWokhk.exe
  2⤵
  PID:5944
- C:\Windows\System\dVavKiZ.exe
  C:\Windows\System\dVavKiZ.exe
  2⤵
  PID:5984
- C:\Windows\System\JWVvsEN.exe
  C:\Windows\System\JWVvsEN.exe
  2⤵
  PID:1844
- C:\Windows\System\kCuxVVJ.exe
  C:\Windows\System\kCuxVVJ.exe
  2⤵
  PID:5964
- C:\Windows\System\sxywDRe.exe
  C:\Windows\System\sxywDRe.exe
  2⤵
  PID:4004
- C:\Windows\System\OAVkGAG.exe
  C:\Windows\System\OAVkGAG.exe
  2⤵
  PID:880
- C:\Windows\System\YTpKTPk.exe
  C:\Windows\System\YTpKTPk.exe
  2⤵
  PID:5248
- C:\Windows\System\gdSyrwa.exe
  C:\Windows\System\gdSyrwa.exe
  2⤵
  PID:1924
- C:\Windows\System\yxpYddg.exe
  C:\Windows\System\yxpYddg.exe
  2⤵
  PID:768
- C:\Windows\System\rOKSUSk.exe
  C:\Windows\System\rOKSUSk.exe
  2⤵
  PID:4684
- C:\Windows\System\vegHKdI.exe
  C:\Windows\System\vegHKdI.exe
  2⤵
  PID:4976
- C:\Windows\System\yYmytkD.exe
  C:\Windows\System\yYmytkD.exe
  2⤵
  PID:5836
- C:\Windows\System\MKfoCvl.exe
  C:\Windows\System\MKfoCvl.exe
  2⤵
  PID:4700
- C:\Windows\System\zwErsPD.exe
  C:\Windows\System\zwErsPD.exe
  2⤵
  PID:4908
- C:\Windows\System\ylkwqoS.exe
  C:\Windows\System\ylkwqoS.exe
  2⤵
  PID:4364
- C:\Windows\System\ZwaGfNr.exe
  C:\Windows\System\ZwaGfNr.exe
  2⤵
  PID:2544
- C:\Windows\System\YntrOgW.exe
  C:\Windows\System\YntrOgW.exe
  2⤵
  PID:4556
- C:\Windows\System\MLtfEpp.exe
  C:\Windows\System\MLtfEpp.exe
  2⤵
  PID:3784
- C:\Windows\System\wCQrRXp.exe
  C:\Windows\System\wCQrRXp.exe
  2⤵
  PID:3552
- C:\Windows\System\UBmvHBg.exe
  C:\Windows\System\UBmvHBg.exe
  2⤵
  PID:5492
- C:\Windows\System\BjOWvBp.exe
  C:\Windows\System\BjOWvBp.exe
  2⤵
  PID:3684
- C:\Windows\System\tpJYrYX.exe
  C:\Windows\System\tpJYrYX.exe
  2⤵
  PID:1860
- C:\Windows\System\dfjUtMv.exe
  C:\Windows\System\dfjUtMv.exe
  2⤵
  PID:2360
- C:\Windows\System\qYCKlcW.exe
  C:\Windows\System\qYCKlcW.exe
  2⤵
  PID:5524
- C:\Windows\System\OvTKmLO.exe
  C:\Windows\System\OvTKmLO.exe
  2⤵
  PID:2364
- C:\Windows\System\cBBrkGP.exe
  C:\Windows\System\cBBrkGP.exe
  2⤵
  PID:5988
- C:\Windows\System\gKzUsfl.exe
  C:\Windows\System\gKzUsfl.exe
  2⤵
  PID:2052
- C:\Windows\System\RArdFeJ.exe
  C:\Windows\System\RArdFeJ.exe
  2⤵
  PID:5996
- C:\Windows\System\zwWgjUV.exe
  C:\Windows\System\zwWgjUV.exe
  2⤵
  PID:1720
- C:\Windows\System\VuWquxd.exe
  C:\Windows\System\VuWquxd.exe
  2⤵
  PID:2764
- C:\Windows\System\FvgEdxW.exe
  C:\Windows\System\FvgEdxW.exe
  2⤵
  PID:6048
- C:\Windows\System\nbHJHLM.exe
  C:\Windows\System\nbHJHLM.exe
  2⤵
  PID:4400
- C:\Windows\System\nHELRHH.exe
  C:\Windows\System\nHELRHH.exe
  2⤵
  PID:3808
- C:\Windows\System\PJtqrhz.exe
  C:\Windows\System\PJtqrhz.exe
  2⤵
  PID:1620
- C:\Windows\System\peSvFEE.exe
  C:\Windows\System\peSvFEE.exe
  2⤵
  PID:5568
- C:\Windows\System\WUKYOCa.exe
  C:\Windows\System\WUKYOCa.exe
  2⤵
  PID:5328
- C:\Windows\System\AsCabMl.exe
  C:\Windows\System\AsCabMl.exe
  2⤵
  PID:5632
- C:\Windows\System\sigZnhT.exe
  C:\Windows\System\sigZnhT.exe
  2⤵
  PID:5928
- C:\Windows\System\IFpXOmG.exe
  C:\Windows\System\IFpXOmG.exe
  2⤵
  PID:2892
- C:\Windows\System\yAOvkww.exe
  C:\Windows\System\yAOvkww.exe
  2⤵
  PID:2520
- C:\Windows\System\oxmBJJS.exe
  C:\Windows\System\oxmBJJS.exe
  2⤵
  PID:5904
- C:\Windows\System\YGOIzjK.exe
  C:\Windows\System\YGOIzjK.exe
  2⤵
  PID:3140
- C:\Windows\System\MkVkUBI.exe
  C:\Windows\System\MkVkUBI.exe
  2⤵
  PID:4528
- C:\Windows\System\fdSJubB.exe
  C:\Windows\System\fdSJubB.exe
  2⤵
  PID:1964
- C:\Windows\System\dijsKVQ.exe
  C:\Windows\System\dijsKVQ.exe
  2⤵
  PID:5424
- C:\Windows\System\KFYFJTK.exe
  C:\Windows\System\KFYFJTK.exe
  2⤵
  PID:5316
- C:\Windows\System\ZOxVbjQ.exe
  C:\Windows\System\ZOxVbjQ.exe
  2⤵
  PID:5832
- C:\Windows\System\OMqbFft.exe
  C:\Windows\System\OMqbFft.exe
  2⤵
  PID:6156
- C:\Windows\System\JZSkJSB.exe
  C:\Windows\System\JZSkJSB.exe
  2⤵
  PID:6172
- C:\Windows\System\iJjcnhI.exe
  C:\Windows\System\iJjcnhI.exe
  2⤵
  PID:6188
- C:\Windows\System\acyuPvA.exe
  C:\Windows\System\acyuPvA.exe
  2⤵
  PID:6204
- C:\Windows\System\oatDYpJ.exe
  C:\Windows\System\oatDYpJ.exe
  2⤵
  PID:6220
- C:\Windows\System\ciqPvXT.exe
  C:\Windows\System\ciqPvXT.exe
  2⤵
  PID:6236
- C:\Windows\System\cpAudPi.exe
  C:\Windows\System\cpAudPi.exe
  2⤵
  PID:6252
- C:\Windows\System\PRzALVr.exe
  C:\Windows\System\PRzALVr.exe
  2⤵
  PID:6272
- C:\Windows\System\vBhwYkH.exe
  C:\Windows\System\vBhwYkH.exe
  2⤵
  PID:6288
- C:\Windows\System\svTxzvR.exe
  C:\Windows\System\svTxzvR.exe
  2⤵
  PID:6304
- C:\Windows\System\NdMQkeK.exe
  C:\Windows\System\NdMQkeK.exe
  2⤵
  PID:6320
- C:\Windows\System\WEtykjx.exe
  C:\Windows\System\WEtykjx.exe
  2⤵
  PID:6336
- C:\Windows\System\sFputev.exe
  C:\Windows\System\sFputev.exe
  2⤵
  PID:6352
- C:\Windows\System\StTQdjq.exe
  C:\Windows\System\StTQdjq.exe
  2⤵
  PID:6368
- C:\Windows\System\ieglfjZ.exe
  C:\Windows\System\ieglfjZ.exe
  2⤵
  PID:6384
- C:\Windows\System\FcDJkcN.exe
  C:\Windows\System\FcDJkcN.exe
  2⤵
  PID:6400
- C:\Windows\System\nJQRMmi.exe
  C:\Windows\System\nJQRMmi.exe
  2⤵
  PID:6416
- C:\Windows\System\iphxqwt.exe
  C:\Windows\System\iphxqwt.exe
  2⤵
  PID:6432
- C:\Windows\System\zCnJArQ.exe
  C:\Windows\System\zCnJArQ.exe
  2⤵
  PID:6448
- C:\Windows\System\NaxQBSn.exe
  C:\Windows\System\NaxQBSn.exe
  2⤵
  PID:6464
- C:\Windows\System\MPTLFsn.exe
  C:\Windows\System\MPTLFsn.exe
  2⤵
  PID:6480
- C:\Windows\System\ZOVpEpQ.exe
  C:\Windows\System\ZOVpEpQ.exe
  2⤵
  PID:6496
- C:\Windows\System\slwDybd.exe
  C:\Windows\System\slwDybd.exe
  2⤵
  PID:6512
- C:\Windows\System\itOaBcX.exe
  C:\Windows\System\itOaBcX.exe
  2⤵
  PID:6528
- C:\Windows\System\wVEvFca.exe
  C:\Windows\System\wVEvFca.exe
  2⤵
  PID:6544
- C:\Windows\System\KFILAmO.exe
  C:\Windows\System\KFILAmO.exe
  2⤵
  PID:6560
- C:\Windows\System\PoBnVzH.exe
  C:\Windows\System\PoBnVzH.exe
  2⤵
  PID:6576
- C:\Windows\System\FihbOtw.exe
  C:\Windows\System\FihbOtw.exe
  2⤵
  PID:6592
- C:\Windows\System\btNHbGm.exe
  C:\Windows\System\btNHbGm.exe
  2⤵
  PID:6608
- C:\Windows\System\ZsHoxoO.exe
  C:\Windows\System\ZsHoxoO.exe
  2⤵
  PID:6624
- C:\Windows\System\DKWueFM.exe
  C:\Windows\System\DKWueFM.exe
  2⤵
  PID:6640
- C:\Windows\System\YcIiUqi.exe
  C:\Windows\System\YcIiUqi.exe
  2⤵
  PID:6656
- C:\Windows\System\lywehNh.exe
  C:\Windows\System\lywehNh.exe
  2⤵
  PID:6672
- C:\Windows\System\pTvWTNF.exe
  C:\Windows\System\pTvWTNF.exe
  2⤵
  PID:6688
- C:\Windows\System\QREqCLf.exe
  C:\Windows\System\QREqCLf.exe
  2⤵
  PID:6704
- C:\Windows\System\MOUTSDD.exe
  C:\Windows\System\MOUTSDD.exe
  2⤵
  PID:6720
- C:\Windows\System\kyWEArk.exe
  C:\Windows\System\kyWEArk.exe
  2⤵
  PID:6736
- C:\Windows\System\dFYzdpX.exe
  C:\Windows\System\dFYzdpX.exe
  2⤵
  PID:6752
- C:\Windows\System\SVaFbgJ.exe
  C:\Windows\System\SVaFbgJ.exe
  2⤵
  PID:6768
- C:\Windows\System\CCfInNs.exe
  C:\Windows\System\CCfInNs.exe
  2⤵
  PID:6784
- C:\Windows\System\RRarBrB.exe
  C:\Windows\System\RRarBrB.exe
  2⤵
  PID:6800
- C:\Windows\System\QlHWMtB.exe
  C:\Windows\System\QlHWMtB.exe
  2⤵
  PID:6816
- C:\Windows\System\kxjgyUH.exe
  C:\Windows\System\kxjgyUH.exe
  2⤵
  PID:6832
- C:\Windows\System\PYIYNAq.exe
  C:\Windows\System\PYIYNAq.exe
  2⤵
  PID:6848
- C:\Windows\System\FcIMPzC.exe
  C:\Windows\System\FcIMPzC.exe
  2⤵
  PID:6864
- C:\Windows\System\DewuETA.exe
  C:\Windows\System\DewuETA.exe
  2⤵
  PID:6880
- C:\Windows\System\EsPjpyt.exe
  C:\Windows\System\EsPjpyt.exe
  2⤵
  PID:6896
- C:\Windows\System\ypooQUS.exe
  C:\Windows\System\ypooQUS.exe
  2⤵
  PID:6912
- C:\Windows\System\Mptrquz.exe
  C:\Windows\System\Mptrquz.exe
  2⤵
  PID:6928
- C:\Windows\System\VAKizTS.exe
  C:\Windows\System\VAKizTS.exe
  2⤵
  PID:6944
- C:\Windows\System\RgBrYVD.exe
  C:\Windows\System\RgBrYVD.exe
  2⤵
  PID:6960
- C:\Windows\System\rFTjVpY.exe
  C:\Windows\System\rFTjVpY.exe
  2⤵
  PID:6976
- C:\Windows\System\gDPtFdc.exe
  C:\Windows\System\gDPtFdc.exe
  2⤵
  PID:6992
- C:\Windows\System\qfIZyqk.exe
  C:\Windows\System\qfIZyqk.exe
  2⤵
  PID:7008
- C:\Windows\System\yLZuoVu.exe
  C:\Windows\System\yLZuoVu.exe
  2⤵
  PID:7024
- C:\Windows\System\LIxMaCd.exe
  C:\Windows\System\LIxMaCd.exe
  2⤵
  PID:7040
- C:\Windows\System\JjJYycf.exe
  C:\Windows\System\JjJYycf.exe
  2⤵
  PID:7056
- C:\Windows\System\CYhLfCF.exe
  C:\Windows\System\CYhLfCF.exe
  2⤵
  PID:7072
- C:\Windows\System\KHupooX.exe
  C:\Windows\System\KHupooX.exe
  2⤵
  PID:7088
- C:\Windows\System\mpEmEfw.exe
  C:\Windows\System\mpEmEfw.exe
  2⤵
  PID:7104
- C:\Windows\System\AyoERAO.exe
  C:\Windows\System\AyoERAO.exe
  2⤵
  PID:7120
- C:\Windows\System\pItYgav.exe
  C:\Windows\System\pItYgav.exe
  2⤵
  PID:7136
- C:\Windows\System\DeyLKww.exe
  C:\Windows\System\DeyLKww.exe
  2⤵
  PID:7152
- C:\Windows\System\RJmXYhb.exe
  C:\Windows\System\RJmXYhb.exe
  2⤵
  PID:6148
- C:\Windows\System\SsXxUGE.exe
  C:\Windows\System\SsXxUGE.exe
  2⤵
  PID:6184
- C:\Windows\System\uWKQrRL.exe
  C:\Windows\System\uWKQrRL.exe
  2⤵
  PID:6248
- C:\Windows\System\PVhFHJS.exe
  C:\Windows\System\PVhFHJS.exe
  2⤵
  PID:6316
- C:\Windows\System\nHuRvfL.exe
  C:\Windows\System\nHuRvfL.exe
  2⤵
  PID:6380
- C:\Windows\System\WyBOLqD.exe
  C:\Windows\System\WyBOLqD.exe
  2⤵
  PID:5604
- C:\Windows\System\ZKkHNFZ.exe
  C:\Windows\System\ZKkHNFZ.exe
  2⤵
  PID:6260
- C:\Windows\System\VGPPysQ.exe
  C:\Windows\System\VGPPysQ.exe
  2⤵
  PID:6504
- C:\Windows\System\SSOGrpp.exe
  C:\Windows\System\SSOGrpp.exe
  2⤵
  PID:6568
- C:\Windows\System\YRPUlfc.exe
  C:\Windows\System\YRPUlfc.exe
  2⤵
  PID:6396
- C:\Windows\System\ATLUPgK.exe
  C:\Windows\System\ATLUPgK.exe
  2⤵
  PID:6200
- C:\Windows\System\UFTCqZA.exe
  C:\Windows\System\UFTCqZA.exe
  2⤵
  PID:6424
- C:\Windows\System\SSILVhF.exe
  C:\Windows\System\SSILVhF.exe
  2⤵
  PID:4592
- C:\Windows\System\EGtaDAP.exe
  C:\Windows\System\EGtaDAP.exe
  2⤵
  PID:2652
- C:\Windows\System\irWnWXo.exe
  C:\Windows\System\irWnWXo.exe
  2⤵
  PID:6296
- C:\Windows\System\kCutowG.exe
  C:\Windows\System\kCutowG.exe
  2⤵
  PID:6364
- C:\Windows\System\JmtAajY.exe
  C:\Windows\System\JmtAajY.exe
  2⤵
  PID:6460
- C:\Windows\System\ZgdexjZ.exe
  C:\Windows\System\ZgdexjZ.exe
  2⤵
  PID:6524
- C:\Windows\System\EbVxBuY.exe
  C:\Windows\System\EbVxBuY.exe
  2⤵
  PID:6588
- C:\Windows\System\eOacGZI.exe
  C:\Windows\System\eOacGZI.exe
  2⤵
  PID:6664
- C:\Windows\System\UDrsAiL.exe
  C:\Windows\System\UDrsAiL.exe
  2⤵
  PID:6728
- C:\Windows\System\QlQbjSS.exe
  C:\Windows\System\QlQbjSS.exe
  2⤵
  PID:6792
- C:\Windows\System\EWTvFRv.exe
  C:\Windows\System\EWTvFRv.exe
  2⤵
  PID:6856
- C:\Windows\System\KMgJZQU.exe
  C:\Windows\System\KMgJZQU.exe
  2⤵
  PID:6652
- C:\Windows\System\eBSynyO.exe
  C:\Windows\System\eBSynyO.exe
  2⤵
  PID:6716
- C:\Windows\System\uAxZSwE.exe
  C:\Windows\System\uAxZSwE.exe
  2⤵
  PID:6808
- C:\Windows\System\dSLRJrL.exe
  C:\Windows\System\dSLRJrL.exe
  2⤵
  PID:6872
- C:\Windows\System\VguHWyP.exe
  C:\Windows\System\VguHWyP.exe
  2⤵
  PID:6908
- C:\Windows\System\bcnifoT.exe
  C:\Windows\System\bcnifoT.exe
  2⤵
  PID:1276
- C:\Windows\System\cveTDAe.exe
  C:\Windows\System\cveTDAe.exe
  2⤵
  PID:6956
- C:\Windows\System\NJZArZE.exe
  C:\Windows\System\NJZArZE.exe
  2⤵
  PID:7048
- C:\Windows\System\qQRSCKL.exe
  C:\Windows\System\qQRSCKL.exe
  2⤵
  PID:7020
- C:\Windows\System\jfnJhta.exe
  C:\Windows\System\jfnJhta.exe
  2⤵
  PID:7148
- C:\Windows\System\WzQfWKo.exe
  C:\Windows\System\WzQfWKo.exe
  2⤵
  PID:6312
- C:\Windows\System\eAlLlRH.exe
  C:\Windows\System\eAlLlRH.exe
  2⤵
  PID:7132
- C:\Windows\System\XfuJYRq.exe
  C:\Windows\System\XfuJYRq.exe
  2⤵
  PID:7004
- C:\Windows\System\jcoWRWn.exe
  C:\Windows\System\jcoWRWn.exe
  2⤵
  PID:7068
- C:\Windows\System\robOKoM.exe
  C:\Windows\System\robOKoM.exe
  2⤵
  PID:7164
- C:\Windows\System\jjdplKp.exe
  C:\Windows\System\jjdplKp.exe
  2⤵
  PID:6376
- C:\Windows\System\XvosxLO.exe
  C:\Windows\System\XvosxLO.exe
  2⤵
  PID:6600
- C:\Windows\System\VcRUBfj.exe
  C:\Windows\System\VcRUBfj.exe
  2⤵
  PID:6540
- C:\Windows\System\ZxwYOux.exe
  C:\Windows\System\ZxwYOux.exe
  2⤵
  PID:6328
- C:\Windows\System\hQIIYDP.exe
  C:\Windows\System\hQIIYDP.exe
  2⤵
  PID:6332
- C:\Windows\System\WYUKrMH.exe
  C:\Windows\System\WYUKrMH.exe
  2⤵
  PID:6196
- C:\Windows\System\aiCTori.exe
  C:\Windows\System\aiCTori.exe
  2⤵
  PID:6492
- C:\Windows\System\FuvJGzW.exe
  C:\Windows\System\FuvJGzW.exe
  2⤵
  PID:6760
- C:\Windows\System\NschxQM.exe
  C:\Windows\System\NschxQM.exe
  2⤵
  PID:6696
- C:\Windows\System\kqQqdZg.exe
  C:\Windows\System\kqQqdZg.exe
  2⤵
  PID:6748
- C:\Windows\System\OSiLydv.exe
  C:\Windows\System\OSiLydv.exe
  2⤵
  PID:6936
- C:\Windows\System\uNdSpJf.exe
  C:\Windows\System\uNdSpJf.exe
  2⤵
  PID:6988
- C:\Windows\System\feYWDvM.exe
  C:\Windows\System\feYWDvM.exe
  2⤵
  PID:6840
- C:\Windows\System\pFcYrCT.exe
  C:\Windows\System\pFcYrCT.exe
  2⤵
  PID:7016
- C:\Windows\System\EpNCiBh.exe
  C:\Windows\System\EpNCiBh.exe
  2⤵
  PID:6972
- C:\Windows\System\RbhwCHl.exe
  C:\Windows\System\RbhwCHl.exe
  2⤵
  PID:6476
- C:\Windows\System\aUCZFeL.exe
  C:\Windows\System\aUCZFeL.exe
  2⤵
  PID:2176
- C:\Windows\System\EWDIggT.exe
  C:\Windows\System\EWDIggT.exe
  2⤵
  PID:7036
- C:\Windows\System\ArkyOaF.exe
  C:\Windows\System\ArkyOaF.exe
  2⤵
  PID:568
- C:\Windows\System\qeQSDpv.exe
  C:\Windows\System\qeQSDpv.exe
  2⤵
  PID:6244
- C:\Windows\System\TTsQvhD.exe
  C:\Windows\System\TTsQvhD.exe
  2⤵
  PID:6428
- C:\Windows\System\iTpeMPO.exe
  C:\Windows\System\iTpeMPO.exe
  2⤵
  PID:6764
- C:\Windows\System\IvoZyYe.exe
  C:\Windows\System\IvoZyYe.exe
  2⤵
  PID:6180
- C:\Windows\System\IRGdFXa.exe
  C:\Windows\System\IRGdFXa.exe
  2⤵
  PID:6284
- C:\Windows\System\oIQAmQX.exe
  C:\Windows\System\oIQAmQX.exe
  2⤵
  PID:6892
- C:\Windows\System\ozRDxdl.exe
  C:\Windows\System\ozRDxdl.exe
  2⤵
  PID:6620
- C:\Windows\System\TqnWKJt.exe
  C:\Windows\System\TqnWKJt.exe
  2⤵
  PID:7128
- C:\Windows\System\cmmUXSL.exe
  C:\Windows\System\cmmUXSL.exe
  2⤵
  PID:6780
- C:\Windows\System\bEaOaig.exe
  C:\Windows\System\bEaOaig.exe
  2⤵
  PID:6712
- C:\Windows\System\WYKeLrJ.exe
  C:\Windows\System\WYKeLrJ.exe
  2⤵
  PID:6472
- C:\Windows\System\wXnaNuM.exe
  C:\Windows\System\wXnaNuM.exe
  2⤵
  PID:7172
- C:\Windows\System\ziSIVXc.exe
  C:\Windows\System\ziSIVXc.exe
  2⤵
  PID:7188
- C:\Windows\System\UVEOsVv.exe
  C:\Windows\System\UVEOsVv.exe
  2⤵
  PID:7204
- C:\Windows\System\igTbxFo.exe
  C:\Windows\System\igTbxFo.exe
  2⤵
  PID:7220
- C:\Windows\System\NmUQLuc.exe
  C:\Windows\System\NmUQLuc.exe
  2⤵
  PID:7236
- C:\Windows\System\bFvxVwC.exe
  C:\Windows\System\bFvxVwC.exe
  2⤵
  PID:7252
- C:\Windows\System\PlYdVNt.exe
  C:\Windows\System\PlYdVNt.exe
  2⤵
  PID:7268
- C:\Windows\System\pwOsrhj.exe
  C:\Windows\System\pwOsrhj.exe
  2⤵
  PID:7284
- C:\Windows\System\MlgfVic.exe
  C:\Windows\System\MlgfVic.exe
  2⤵
  PID:7300
- C:\Windows\System\ooutTqW.exe
  C:\Windows\System\ooutTqW.exe
  2⤵
  PID:7316
- C:\Windows\System\eRfmPQO.exe
  C:\Windows\System\eRfmPQO.exe
  2⤵
  PID:7332
- C:\Windows\System\JAgvTXH.exe
  C:\Windows\System\JAgvTXH.exe
  2⤵
  PID:7348
- C:\Windows\System\oWpssUr.exe
  C:\Windows\System\oWpssUr.exe
  2⤵
  PID:7364
- C:\Windows\System\weFGadR.exe
  C:\Windows\System\weFGadR.exe
  2⤵
  PID:7380
- C:\Windows\System\eimKKHF.exe
  C:\Windows\System\eimKKHF.exe
  2⤵
  PID:7396
- C:\Windows\System\itgfkZA.exe
  C:\Windows\System\itgfkZA.exe
  2⤵
  PID:7412
- C:\Windows\System\zSdmcKK.exe
  C:\Windows\System\zSdmcKK.exe
  2⤵
  PID:7428
- C:\Windows\System\nYqhbTd.exe
  C:\Windows\System\nYqhbTd.exe
  2⤵
  PID:7444
- C:\Windows\System\MxUkpXT.exe
  C:\Windows\System\MxUkpXT.exe
  2⤵
  PID:7460
- C:\Windows\System\kjkwdBR.exe
  C:\Windows\System\kjkwdBR.exe
  2⤵
  PID:7476
- C:\Windows\System\PxgOgii.exe
  C:\Windows\System\PxgOgii.exe
  2⤵
  PID:7492
- C:\Windows\System\VGZrDJW.exe
  C:\Windows\System\VGZrDJW.exe
  2⤵
  PID:7508
- C:\Windows\System\cPnsciK.exe
  C:\Windows\System\cPnsciK.exe
  2⤵
  PID:7524
- C:\Windows\System\MEOMWho.exe
  C:\Windows\System\MEOMWho.exe
  2⤵
  PID:7540
- C:\Windows\System\FyBXyjt.exe
  C:\Windows\System\FyBXyjt.exe
  2⤵
  PID:7556
- C:\Windows\System\lrfpQNq.exe
  C:\Windows\System\lrfpQNq.exe
  2⤵
  PID:7572
- C:\Windows\System\uhywdjm.exe
  C:\Windows\System\uhywdjm.exe
  2⤵
  PID:7588
- C:\Windows\System\JQYBjiN.exe
  C:\Windows\System\JQYBjiN.exe
  2⤵
  PID:7604
- C:\Windows\System\LQtwiVo.exe
  C:\Windows\System\LQtwiVo.exe
  2⤵
  PID:7620
- C:\Windows\System\FiaffND.exe
  C:\Windows\System\FiaffND.exe
  2⤵
  PID:7636
- C:\Windows\System\qyUqBsv.exe
  C:\Windows\System\qyUqBsv.exe
  2⤵
  PID:7652
- C:\Windows\System\zQSkSFp.exe
  C:\Windows\System\zQSkSFp.exe
  2⤵
  PID:7668
- C:\Windows\System\KrFyZdu.exe
  C:\Windows\System\KrFyZdu.exe
  2⤵
  PID:7684
- C:\Windows\System\mTIbCsS.exe
  C:\Windows\System\mTIbCsS.exe
  2⤵
  PID:7700
- C:\Windows\System\vYozewg.exe
  C:\Windows\System\vYozewg.exe
  2⤵
  PID:7716
- C:\Windows\System\kdOpRFq.exe
  C:\Windows\System\kdOpRFq.exe
  2⤵
  PID:7732
- C:\Windows\System\yuWMqXm.exe
  C:\Windows\System\yuWMqXm.exe
  2⤵
  PID:7748
- C:\Windows\System\XgapKPF.exe
  C:\Windows\System\XgapKPF.exe
  2⤵
  PID:7764
- C:\Windows\System\yEtwhXU.exe
  C:\Windows\System\yEtwhXU.exe
  2⤵
  PID:7780
- C:\Windows\System\xnAHhAc.exe
  C:\Windows\System\xnAHhAc.exe
  2⤵
  PID:7796
- C:\Windows\System\BaMjUFs.exe
  C:\Windows\System\BaMjUFs.exe
  2⤵
  PID:7812
- C:\Windows\System\owGJmlI.exe
  C:\Windows\System\owGJmlI.exe
  2⤵
  PID:7828
- C:\Windows\System\BBDQCSh.exe
  C:\Windows\System\BBDQCSh.exe
  2⤵
  PID:7844
- C:\Windows\System\qzHcLUS.exe
  C:\Windows\System\qzHcLUS.exe
  2⤵
  PID:7860
- C:\Windows\System\nuMrQyA.exe
  C:\Windows\System\nuMrQyA.exe
  2⤵
  PID:7876
- C:\Windows\System\jldckOg.exe
  C:\Windows\System\jldckOg.exe
  2⤵
  PID:7892
- C:\Windows\System\kOXNRyt.exe
  C:\Windows\System\kOXNRyt.exe
  2⤵
  PID:7908
- C:\Windows\System\KNVlrHH.exe
  C:\Windows\System\KNVlrHH.exe
  2⤵
  PID:7924
- C:\Windows\System\pefHxcu.exe
  C:\Windows\System\pefHxcu.exe
  2⤵
  PID:7940
- C:\Windows\System\GpUihcB.exe
  C:\Windows\System\GpUihcB.exe
  2⤵
  PID:7956
- C:\Windows\System\DYahnuT.exe
  C:\Windows\System\DYahnuT.exe
  2⤵
  PID:7972
- C:\Windows\System\eqOZcKL.exe
  C:\Windows\System\eqOZcKL.exe
  2⤵
  PID:7988
- C:\Windows\System\eYSRFwx.exe
  C:\Windows\System\eYSRFwx.exe
  2⤵
  PID:8004
- C:\Windows\System\ssYYQDP.exe
  C:\Windows\System\ssYYQDP.exe
  2⤵
  PID:8020
- C:\Windows\System\QXgKAcr.exe
  C:\Windows\System\QXgKAcr.exe
  2⤵
  PID:8036
- C:\Windows\System\gyGyhXd.exe
  C:\Windows\System\gyGyhXd.exe
  2⤵
  PID:8052
- C:\Windows\System\CeVvilD.exe
  C:\Windows\System\CeVvilD.exe
  2⤵
  PID:8068
- C:\Windows\System\FhmnnKh.exe
  C:\Windows\System\FhmnnKh.exe
  2⤵
  PID:8084
- C:\Windows\System\UoXkzHc.exe
  C:\Windows\System\UoXkzHc.exe
  2⤵
  PID:8100
- C:\Windows\System\BhBVRlQ.exe
  C:\Windows\System\BhBVRlQ.exe
  2⤵
  PID:8116
- C:\Windows\System\PfiFnmR.exe
  C:\Windows\System\PfiFnmR.exe
  2⤵
  PID:8132
- C:\Windows\System\gEwyFbC.exe
  C:\Windows\System\gEwyFbC.exe
  2⤵
  PID:8148
- C:\Windows\System\LPvGzzk.exe
  C:\Windows\System\LPvGzzk.exe
  2⤵
  PID:8164
- C:\Windows\System\DamDqNV.exe
  C:\Windows\System\DamDqNV.exe
  2⤵
  PID:8180
- C:\Windows\System\tkEpQcM.exe
  C:\Windows\System\tkEpQcM.exe
  2⤵
  PID:7080
- C:\Windows\System\EEwwIHX.exe
  C:\Windows\System\EEwwIHX.exe
  2⤵
  PID:7212
- C:\Windows\System\MDSWaGi.exe
  C:\Windows\System\MDSWaGi.exe
  2⤵
  PID:7276
- C:\Windows\System\OHEVxhD.exe
  C:\Windows\System\OHEVxhD.exe
  2⤵
  PID:7232
- C:\Windows\System\jVkOGwD.exe
  C:\Windows\System\jVkOGwD.exe
  2⤵
  PID:5112
- C:\Windows\System\ArxCAhx.exe
  C:\Windows\System\ArxCAhx.exe
  2⤵
  PID:7200
- C:\Windows\System\iYmAlRv.exe
  C:\Windows\System\iYmAlRv.exe
  2⤵
  PID:7340
- C:\Windows\System\TGzhsee.exe
  C:\Windows\System\TGzhsee.exe
  2⤵
  PID:7404
- C:\Windows\System\vpdAKGy.exe
  C:\Windows\System\vpdAKGy.exe
  2⤵
  PID:7472
- C:\Windows\System\TfvdsaD.exe
  C:\Windows\System\TfvdsaD.exe
  2⤵
  PID:7324
- C:\Windows\System\JdnJjOJ.exe
  C:\Windows\System\JdnJjOJ.exe
  2⤵
  PID:7360
- C:\Windows\System\xmmsUZm.exe
  C:\Windows\System\xmmsUZm.exe
  2⤵
  PID:7424
- C:\Windows\System\MSLEKSq.exe
  C:\Windows\System\MSLEKSq.exe
  2⤵
  PID:5140
- C:\Windows\System\BzYbnga.exe
  C:\Windows\System\BzYbnga.exe
  2⤵
  PID:7516
- C:\Windows\System\zGrioEZ.exe
  C:\Windows\System\zGrioEZ.exe
  2⤵
  PID:7584
- C:\Windows\System\EXMCphR.exe
  C:\Windows\System\EXMCphR.exe
  2⤵
  PID:7568
- C:\Windows\System\aOratYw.exe
  C:\Windows\System\aOratYw.exe
  2⤵
  PID:7632
- C:\Windows\System\aTxywAC.exe
  C:\Windows\System\aTxywAC.exe
  2⤵
  PID:7724
- C:\Windows\System\WvnuNmr.exe
  C:\Windows\System\WvnuNmr.exe
  2⤵
  PID:7756
- C:\Windows\System\ufROukM.exe
  C:\Windows\System\ufROukM.exe
  2⤵
  PID:7820
- C:\Windows\System\esyaFyy.exe
  C:\Windows\System\esyaFyy.exe
  2⤵
  PID:7680
- C:\Windows\System\mAzBUkE.exe
  C:\Windows\System\mAzBUkE.exe
  2⤵
  PID:7808
- C:\Windows\System\nSImYlc.exe
  C:\Windows\System\nSImYlc.exe
  2⤵
  PID:7740
- C:\Windows\System\EuMpXhx.exe
  C:\Windows\System\EuMpXhx.exe
  2⤵
  PID:7888
- C:\Windows\System\iWMWLJx.exe
  C:\Windows\System\iWMWLJx.exe
  2⤵
  PID:7868
- C:\Windows\System\RDotvlE.exe
  C:\Windows\System\RDotvlE.exe
  2⤵
  PID:7932
- C:\Windows\System\lAiMSjl.exe
  C:\Windows\System\lAiMSjl.exe
  2⤵
  PID:7936
- C:\Windows\System\oNMTGRq.exe
  C:\Windows\System\oNMTGRq.exe
  2⤵
  PID:8012
- C:\Windows\System\eQhWzWt.exe
  C:\Windows\System\eQhWzWt.exe
  2⤵
  PID:8076
- C:\Windows\System\SiYgnkf.exe
  C:\Windows\System\SiYgnkf.exe
  2⤵
  PID:8028
- C:\Windows\System\qJTrvCK.exe
  C:\Windows\System\qJTrvCK.exe
  2⤵
  PID:8140
- C:\Windows\System\UPKHrWF.exe
  C:\Windows\System\UPKHrWF.exe
  2⤵
  PID:7184
- C:\Windows\System\JLzgrqP.exe
  C:\Windows\System\JLzgrqP.exe
  2⤵
  PID:8124
- C:\Windows\System\dYuGIXv.exe
  C:\Windows\System\dYuGIXv.exe
  2⤵
  PID:7372
- C:\Windows\System\gDqRaTH.exe
  C:\Windows\System\gDqRaTH.exe
  2⤵
  PID:8188
- C:\Windows\System\MxtcSTA.exe
  C:\Windows\System\MxtcSTA.exe
  2⤵
  PID:7308
- C:\Windows\System\szGErTt.exe
  C:\Windows\System\szGErTt.exe
  2⤵
  PID:6348
- C:\Windows\System\CSNCVBq.exe
  C:\Windows\System\CSNCVBq.exe
  2⤵
  PID:7296
- C:\Windows\System\HtbzXyj.exe
  C:\Windows\System\HtbzXyj.exe
  2⤵
  PID:7532
- C:\Windows\System\CQqBmOJ.exe
  C:\Windows\System\CQqBmOJ.exe
  2⤵
  PID:7504
- C:\Windows\System\LbLiKnB.exe
  C:\Windows\System\LbLiKnB.exe
  2⤵
  PID:7664
- C:\Windows\System\LAuOEXM.exe
  C:\Windows\System\LAuOEXM.exe
  2⤵
  PID:7548
- C:\Windows\System\adFPKQq.exe
  C:\Windows\System\adFPKQq.exe
  2⤵
  PID:7600
- C:\Windows\System\louUCCG.exe
  C:\Windows\System\louUCCG.exe
  2⤵
  PID:7676
- C:\Windows\System\eJPvGpa.exe
  C:\Windows\System\eJPvGpa.exe
  2⤵
  PID:7900
- C:\Windows\System\gEnjGYx.exe
  C:\Windows\System\gEnjGYx.exe
  2⤵
  PID:7984
- C:\Windows\System\lavaYEt.exe
  C:\Windows\System\lavaYEt.exe
  2⤵
  PID:7952
- C:\Windows\System\ldFiajF.exe
  C:\Windows\System\ldFiajF.exe
  2⤵
  PID:8000
- C:\Windows\System\hMumNil.exe
  C:\Windows\System\hMumNil.exe
  2⤵
  PID:8108
- C:\Windows\System\zLLhhEj.exe
  C:\Windows\System\zLLhhEj.exe
  2⤵
  PID:7196
- C:\Windows\System\FUAJdgc.exe
  C:\Windows\System\FUAJdgc.exe
  2⤵
  PID:7376
- C:\Windows\System\PPxLbzS.exe
  C:\Windows\System\PPxLbzS.exe
  2⤵
  PID:7312
- C:\Windows\System\Vgjvsfa.exe
  C:\Windows\System\Vgjvsfa.exe
  2⤵
  PID:7484
- C:\Windows\System\IxgicuI.exe
  C:\Windows\System\IxgicuI.exe
  2⤵
  PID:7776
- C:\Windows\System\BlNzHXW.exe
  C:\Windows\System\BlNzHXW.exe
  2⤵
  PID:8048
- C:\Windows\System\EgKvEss.exe
  C:\Windows\System\EgKvEss.exe
  2⤵
  PID:7500
- C:\Windows\System\jCCzEwT.exe
  C:\Windows\System\jCCzEwT.exe
  2⤵
  PID:8172
- C:\Windows\System\dyKYzwm.exe
  C:\Windows\System\dyKYzwm.exe
  2⤵
  PID:8060
- C:\Windows\System\pbcMdfF.exe
  C:\Windows\System\pbcMdfF.exe
  2⤵
  PID:7392
- C:\Windows\System\NFlVrPS.exe
  C:\Windows\System\NFlVrPS.exe
  2⤵
  PID:8204
- C:\Windows\System\YDLwjvJ.exe
  C:\Windows\System\YDLwjvJ.exe
  2⤵
  PID:8220
- C:\Windows\System\tgRxgBy.exe
  C:\Windows\System\tgRxgBy.exe
  2⤵
  PID:8236
- C:\Windows\System\PSlMyra.exe
  C:\Windows\System\PSlMyra.exe
  2⤵
  PID:8252
- C:\Windows\System\WbNAhQa.exe
  C:\Windows\System\WbNAhQa.exe
  2⤵
  PID:8268
- C:\Windows\System\pzWDdUn.exe
  C:\Windows\System\pzWDdUn.exe
  2⤵
  PID:8284
- C:\Windows\System\FDKOQKx.exe
  C:\Windows\System\FDKOQKx.exe
  2⤵
  PID:8300
- C:\Windows\System\CxbmQcS.exe
  C:\Windows\System\CxbmQcS.exe
  2⤵
  PID:8316
- C:\Windows\System\WgyynsA.exe
  C:\Windows\System\WgyynsA.exe
  2⤵
  PID:8332
- C:\Windows\System\efTURwb.exe
  C:\Windows\System\efTURwb.exe
  2⤵
  PID:8348
- C:\Windows\System\qhyjQwo.exe
  C:\Windows\System\qhyjQwo.exe
  2⤵
  PID:8364
- C:\Windows\System\RUQxLHs.exe
  C:\Windows\System\RUQxLHs.exe
  2⤵
  PID:8380
- C:\Windows\System\nXePBkm.exe
  C:\Windows\System\nXePBkm.exe
  2⤵
  PID:8396
- C:\Windows\System\hXGcFxm.exe
  C:\Windows\System\hXGcFxm.exe
  2⤵
  PID:8412
- C:\Windows\System\ublAzJP.exe
  C:\Windows\System\ublAzJP.exe
  2⤵
  PID:8428
- C:\Windows\System\FFmwTBF.exe
  C:\Windows\System\FFmwTBF.exe
  2⤵
  PID:8444
- C:\Windows\System\ZKRTWjb.exe
  C:\Windows\System\ZKRTWjb.exe
  2⤵
  PID:8460
- C:\Windows\System\NBQMQlj.exe
  C:\Windows\System\NBQMQlj.exe
  2⤵
  PID:8476
- C:\Windows\System\kwFkvdM.exe
  C:\Windows\System\kwFkvdM.exe
  2⤵
  PID:8492
- C:\Windows\System\PDtQEzQ.exe
  C:\Windows\System\PDtQEzQ.exe
  2⤵
  PID:8508
- C:\Windows\System\wYrJSrK.exe
  C:\Windows\System\wYrJSrK.exe
  2⤵
  PID:8524
- C:\Windows\System\AyuAgWg.exe
  C:\Windows\System\AyuAgWg.exe
  2⤵
  PID:8540
- C:\Windows\System\MVQAjYB.exe
  C:\Windows\System\MVQAjYB.exe
  2⤵
  PID:8556
- C:\Windows\System\JcpwFrw.exe
  C:\Windows\System\JcpwFrw.exe
  2⤵
  PID:8572
- C:\Windows\System\ulTiSjq.exe
  C:\Windows\System\ulTiSjq.exe
  2⤵
  PID:8588
- C:\Windows\System\DthGGLL.exe
  C:\Windows\System\DthGGLL.exe
  2⤵
  PID:8604
- C:\Windows\System\RIUjYIr.exe
  C:\Windows\System\RIUjYIr.exe
  2⤵
  PID:8620
- C:\Windows\System\mrZmSio.exe
  C:\Windows\System\mrZmSio.exe
  2⤵
  PID:8636
- C:\Windows\System\qIaaKvT.exe
  C:\Windows\System\qIaaKvT.exe
  2⤵
  PID:8652
- C:\Windows\System\zmzHFuA.exe
  C:\Windows\System\zmzHFuA.exe
  2⤵
  PID:8668
- C:\Windows\System\oYWTTpV.exe
  C:\Windows\System\oYWTTpV.exe
  2⤵
  PID:8684
- C:\Windows\System\tPZcjvN.exe
  C:\Windows\System\tPZcjvN.exe
  2⤵
  PID:8700
- C:\Windows\System\WzESXsR.exe
  C:\Windows\System\WzESXsR.exe
  2⤵
  PID:8716
- C:\Windows\System\CUsiTBU.exe
  C:\Windows\System\CUsiTBU.exe
  2⤵
  PID:8732
- C:\Windows\System\YcjlLBM.exe
  C:\Windows\System\YcjlLBM.exe
  2⤵
  PID:8748
- C:\Windows\System\CybuiwH.exe
  C:\Windows\System\CybuiwH.exe
  2⤵
  PID:8764
- C:\Windows\System\jujCsoe.exe
  C:\Windows\System\jujCsoe.exe
  2⤵
  PID:8780
- C:\Windows\System\LIlhfzj.exe
  C:\Windows\System\LIlhfzj.exe
  2⤵
  PID:8796
- C:\Windows\System\DlkjUSC.exe
  C:\Windows\System\DlkjUSC.exe
  2⤵
  PID:8812
- C:\Windows\System\HyzbdET.exe
  C:\Windows\System\HyzbdET.exe
  2⤵
  PID:8828
- C:\Windows\System\ASZuAzJ.exe
  C:\Windows\System\ASZuAzJ.exe
  2⤵
  PID:8848
- C:\Windows\System\cSwdghS.exe
  C:\Windows\System\cSwdghS.exe
  2⤵
  PID:8864
- C:\Windows\System\zEoTkkr.exe
  C:\Windows\System\zEoTkkr.exe
  2⤵
  PID:8880
- C:\Windows\System\PDRzwZF.exe
  C:\Windows\System\PDRzwZF.exe
  2⤵
  PID:8896
- C:\Windows\System\lRHrCFD.exe
  C:\Windows\System\lRHrCFD.exe
  2⤵
  PID:8912
- C:\Windows\System\ttrSubR.exe
  C:\Windows\System\ttrSubR.exe
  2⤵
  PID:8928
- C:\Windows\System\epymkwU.exe
  C:\Windows\System\epymkwU.exe
  2⤵
  PID:8944
- C:\Windows\System\xgBfyEU.exe
  C:\Windows\System\xgBfyEU.exe
  2⤵
  PID:8960
- C:\Windows\System\nmhJjAV.exe
  C:\Windows\System\nmhJjAV.exe
  2⤵
  PID:8976
- C:\Windows\System\KQaPjQJ.exe
  C:\Windows\System\KQaPjQJ.exe
  2⤵
  PID:8992
- C:\Windows\System\cmrKcjO.exe
  C:\Windows\System\cmrKcjO.exe
  2⤵
  PID:9008
- C:\Windows\System\qUzdBJL.exe
  C:\Windows\System\qUzdBJL.exe
  2⤵
  PID:9024
- C:\Windows\System\KgLHRLS.exe
  C:\Windows\System\KgLHRLS.exe
  2⤵
  PID:9044
- C:\Windows\System\VoNvTvC.exe
  C:\Windows\System\VoNvTvC.exe
  2⤵
  PID:9060
- C:\Windows\System\HnyjXHE.exe
  C:\Windows\System\HnyjXHE.exe
  2⤵
  PID:9076
- C:\Windows\System\xvRxirl.exe
  C:\Windows\System\xvRxirl.exe
  2⤵
  PID:9092
- C:\Windows\System\UNpMXQw.exe
  C:\Windows\System\UNpMXQw.exe
  2⤵
  PID:9108
- C:\Windows\System\XIylCDj.exe
  C:\Windows\System\XIylCDj.exe
  2⤵
  PID:9124
- C:\Windows\System\dhGQwOS.exe
  C:\Windows\System\dhGQwOS.exe
  2⤵
  PID:9140
- C:\Windows\System\hwPGQco.exe
  C:\Windows\System\hwPGQco.exe
  2⤵
  PID:9156
- C:\Windows\System\dSQkgWd.exe
  C:\Windows\System\dSQkgWd.exe
  2⤵
  PID:9172
- C:\Windows\System\InAVLyF.exe
  C:\Windows\System\InAVLyF.exe
  2⤵
  PID:9188
- C:\Windows\System\cwioIkW.exe
  C:\Windows\System\cwioIkW.exe
  2⤵
  PID:9204
- C:\Windows\System\lgoshsL.exe
  C:\Windows\System\lgoshsL.exe
  2⤵
  PID:8200
- C:\Windows\System\pZyUHhT.exe
  C:\Windows\System\pZyUHhT.exe
  2⤵
  PID:8232
- C:\Windows\System\HqbXfiK.exe
  C:\Windows\System\HqbXfiK.exe
  2⤵
  PID:8292
- C:\Windows\System\gIkUZsX.exe
  C:\Windows\System\gIkUZsX.exe
  2⤵
  PID:8328
- C:\Windows\System\rHXROZG.exe
  C:\Windows\System\rHXROZG.exe
  2⤵
  PID:7968
- C:\Windows\System\WUCRIdr.exe
  C:\Windows\System\WUCRIdr.exe
  2⤵
  PID:7772
- C:\Windows\System\dWsXjBY.exe
  C:\Windows\System\dWsXjBY.exe
  2⤵
  PID:8244
- C:\Windows\System\RaNuekt.exe
  C:\Windows\System\RaNuekt.exe
  2⤵
  PID:8212
- C:\Windows\System\uZvOmHu.exe
  C:\Windows\System\uZvOmHu.exe
  2⤵
  PID:7440
- C:\Windows\System\CtwUmSc.exe
  C:\Windows\System\CtwUmSc.exe
  2⤵
  PID:8340
- C:\Windows\System\PspqXAg.exe
  C:\Windows\System\PspqXAg.exe
  2⤵
  PID:8420
- C:\Windows\System\miyonLz.exe
  C:\Windows\System\miyonLz.exe
  2⤵
  PID:8424
- C:\Windows\System\jAupKaH.exe
  C:\Windows\System\jAupKaH.exe
  2⤵
  PID:8436
- C:\Windows\System\QrEdtDW.exe
  C:\Windows\System\QrEdtDW.exe
  2⤵
  PID:8484
- C:\Windows\System\LtotZXp.exe
  C:\Windows\System\LtotZXp.exe
  2⤵
  PID:8548
- C:\Windows\System\gIUkAIe.exe
  C:\Windows\System\gIUkAIe.exe
  2⤵
  PID:8612
- C:\Windows\System\OHIPLWp.exe
  C:\Windows\System\OHIPLWp.exe
  2⤵
  PID:8676
- C:\Windows\System\NbVQOUr.exe
  C:\Windows\System\NbVQOUr.exe
  2⤵
  PID:8740
- C:\Windows\System\oCYYRWc.exe
  C:\Windows\System\oCYYRWc.exe
  2⤵
  PID:8804
- C:\Windows\System\sDNpSCS.exe
  C:\Windows\System\sDNpSCS.exe
  2⤵
  PID:8844
- C:\Windows\System\AxIwKqt.exe
  C:\Windows\System\AxIwKqt.exe
  2⤵
  PID:8532
- C:\Windows\System\qMZVTel.exe
  C:\Windows\System\qMZVTel.exe
  2⤵
  PID:8908
- C:\Windows\System\yAGUtbb.exe
  C:\Windows\System\yAGUtbb.exe
  2⤵
  PID:8792
- C:\Windows\System\HHcFwmv.exe
  C:\Windows\System\HHcFwmv.exe
  2⤵
  PID:8940
- C:\Windows\System\WwmSRsu.exe
  C:\Windows\System\WwmSRsu.exe
  2⤵
  PID:8972
- C:\Windows\System\vMtrTBr.exe
  C:\Windows\System\vMtrTBr.exe
  2⤵
  PID:9004
- C:\Windows\System\ZvUzOOx.exe
  C:\Windows\System\ZvUzOOx.exe
  2⤵
  PID:8692
- C:\Windows\System\ForFAlD.exe
  C:\Windows\System\ForFAlD.exe
  2⤵
  PID:8628
- C:\Windows\System\swTgtbr.exe
  C:\Windows\System\swTgtbr.exe
  2⤵
  PID:8860
- C:\Windows\System\SZlrZJt.exe
  C:\Windows\System\SZlrZJt.exe
  2⤵
  PID:8952
- C:\Windows\System\gsDClCG.exe
  C:\Windows\System\gsDClCG.exe
  2⤵
  PID:9020
- C:\Windows\System\cPlTRTQ.exe
  C:\Windows\System\cPlTRTQ.exe
  2⤵
  PID:9100
- C:\Windows\System\XoGMkVt.exe
  C:\Windows\System\XoGMkVt.exe
  2⤵
  PID:9168
- C:\Windows\System\cGBXJlv.exe
  C:\Windows\System\cGBXJlv.exe
  2⤵
  PID:9132
- C:\Windows\System\vvpBncf.exe
  C:\Windows\System\vvpBncf.exe
  2⤵
  PID:8044
- C:\Windows\System\ntaSXft.exe
  C:\Windows\System\ntaSXft.exe
  2⤵
  PID:8360
- C:\Windows\System\lvMArEH.exe
  C:\Windows\System\lvMArEH.exe
  2⤵
  PID:8312
- C:\Windows\System\UoQCkDj.exe
  C:\Windows\System\UoQCkDj.exe
  2⤵
  PID:9120
- C:\Windows\System\dqgEoKe.exe
  C:\Windows\System\dqgEoKe.exe
  2⤵
  PID:8196
- C:\Windows\System\FnPeRbQ.exe
  C:\Windows\System\FnPeRbQ.exe
  2⤵
  PID:7356
- C:\Windows\System\PFWJpNY.exe
  C:\Windows\System\PFWJpNY.exe
  2⤵
  PID:8404
- C:\Windows\System\gstFxnA.exe
  C:\Windows\System\gstFxnA.exe
  2⤵
  PID:8580
- C:\Windows\System\ClhFsQq.exe
  C:\Windows\System\ClhFsQq.exe
  2⤵
  PID:8808
- C:\Windows\System\ykFELgl.exe
  C:\Windows\System\ykFELgl.exe
  2⤵
  PID:7792
- C:\Windows\System\bTQmiGG.exe
  C:\Windows\System\bTQmiGG.exe
  2⤵
  PID:8632
- C:\Windows\System\RQuNCtG.exe
  C:\Windows\System\RQuNCtG.exe
  2⤵
  PID:8988
- C:\Windows\System\CAbxLPv.exe
  C:\Windows\System\CAbxLPv.exe
  2⤵
  PID:9072
- C:\Windows\System\wTzTKJO.exe
  C:\Windows\System\wTzTKJO.exe
  2⤵
  PID:8788
- C:\Windows\System\haTOFJP.exe
  C:\Windows\System\haTOFJP.exe
  2⤵
  PID:8372
- C:\Windows\System\pJapSAn.exe
  C:\Windows\System\pJapSAn.exe
  2⤵
  PID:8644
- C:\Windows\System\ohjLghU.exe
  C:\Windows\System\ohjLghU.exe
  2⤵
  PID:7228
- C:\Windows\System\JbmxNzp.exe
  C:\Windows\System\JbmxNzp.exe
  2⤵
  PID:8904
- C:\Windows\System\WTUyHhQ.exe
  C:\Windows\System\WTUyHhQ.exe
  2⤵
  PID:8984
- C:\Windows\System\IdsprMN.exe
  C:\Windows\System\IdsprMN.exe
  2⤵
  PID:8876
- C:\Windows\System\ZEJCHUz.exe
  C:\Windows\System\ZEJCHUz.exe
  2⤵
  PID:8568
- C:\Windows\System\fMLyapg.exe
  C:\Windows\System\fMLyapg.exe
  2⤵
  PID:8924
- C:\Windows\System\XFNtoDD.exe
  C:\Windows\System\XFNtoDD.exe
  2⤵
  PID:9180
- C:\Windows\System\QBevBrQ.exe
  C:\Windows\System\QBevBrQ.exe
  2⤵
  PID:8712
- C:\Windows\System\OirYVUB.exe
  C:\Windows\System\OirYVUB.exe
  2⤵
  PID:8080
- C:\Windows\System\gAXuQcw.exe
  C:\Windows\System\gAXuQcw.exe
  2⤵
  PID:8440
- C:\Windows\System\VfFbSUo.exe
  C:\Windows\System\VfFbSUo.exe
  2⤵
  PID:9016
- C:\Windows\System\batNHpF.exe
  C:\Windows\System\batNHpF.exe
  2⤵
  PID:8648
- C:\Windows\System\oOCiPMG.exe
  C:\Windows\System\oOCiPMG.exe
  2⤵
  PID:8500
- C:\Windows\System\bbftrIR.exe
  C:\Windows\System\bbftrIR.exe
  2⤵
  PID:8600
- C:\Windows\System\tKCMeCm.exe
  C:\Windows\System\tKCMeCm.exe
  2⤵
  PID:8772
- C:\Windows\System\tvLQgrW.exe
  C:\Windows\System\tvLQgrW.exe
  2⤵
  PID:9228
- C:\Windows\System\TBKmXSL.exe
  C:\Windows\System\TBKmXSL.exe
  2⤵
  PID:9244
- C:\Windows\System\RLKXzQV.exe
  C:\Windows\System\RLKXzQV.exe
  2⤵
  PID:9260
- C:\Windows\System\mquXEUe.exe
  C:\Windows\System\mquXEUe.exe
  2⤵
  PID:9276
- C:\Windows\System\vwtDiag.exe
  C:\Windows\System\vwtDiag.exe
  2⤵
  PID:9292
- C:\Windows\System\xngMrYE.exe
  C:\Windows\System\xngMrYE.exe
  2⤵
  PID:9308
- C:\Windows\System\BDMMSlp.exe
  C:\Windows\System\BDMMSlp.exe
  2⤵
  PID:9324
- C:\Windows\System\TRyCvvj.exe
  C:\Windows\System\TRyCvvj.exe
  2⤵
  PID:9340
- C:\Windows\System\RUqVPDH.exe
  C:\Windows\System\RUqVPDH.exe
  2⤵
  PID:9356
- C:\Windows\System\pJpVphZ.exe
  C:\Windows\System\pJpVphZ.exe
  2⤵
  PID:9372
- C:\Windows\System\DKYypgk.exe
  C:\Windows\System\DKYypgk.exe
  2⤵
  PID:9388
- C:\Windows\System\lbWePjx.exe
  C:\Windows\System\lbWePjx.exe
  2⤵
  PID:9404
- C:\Windows\System\XmZPZof.exe
  C:\Windows\System\XmZPZof.exe
  2⤵
  PID:9420
- C:\Windows\System\YBLtUIi.exe
  C:\Windows\System\YBLtUIi.exe
  2⤵
  PID:9436
- C:\Windows\System\GDTjuej.exe
  C:\Windows\System\GDTjuej.exe
  2⤵
  PID:9452
- C:\Windows\System\BhwHCra.exe
  C:\Windows\System\BhwHCra.exe
  2⤵
  PID:9468
- C:\Windows\System\ZRSDXgm.exe
  C:\Windows\System\ZRSDXgm.exe
  2⤵
  PID:9484
- C:\Windows\System\JvbwtLZ.exe
  C:\Windows\System\JvbwtLZ.exe
  2⤵
  PID:9500
- C:\Windows\System\GOvSStw.exe
  C:\Windows\System\GOvSStw.exe
  2⤵
  PID:9516
- C:\Windows\System\kRfaRkR.exe
  C:\Windows\System\kRfaRkR.exe
  2⤵
  PID:9532
- C:\Windows\System\dDNkjOc.exe
  C:\Windows\System\dDNkjOc.exe
  2⤵
  PID:9548
- C:\Windows\System\HfWWoHd.exe
  C:\Windows\System\HfWWoHd.exe
  2⤵
  PID:9564
- C:\Windows\System\sOVTOkE.exe
  C:\Windows\System\sOVTOkE.exe
  2⤵
  PID:9580
- C:\Windows\System\ZAZQsGw.exe
  C:\Windows\System\ZAZQsGw.exe
  2⤵
  PID:9596
- C:\Windows\System\jsgHlef.exe
  C:\Windows\System\jsgHlef.exe
  2⤵
  PID:9612
- C:\Windows\System\RrJHCKj.exe
  C:\Windows\System\RrJHCKj.exe
  2⤵
  PID:9628
- C:\Windows\System\bHFUzzM.exe
  C:\Windows\System\bHFUzzM.exe
  2⤵
  PID:9644
- C:\Windows\System\FiRsjrB.exe
  C:\Windows\System\FiRsjrB.exe
  2⤵
  PID:9660
- C:\Windows\System\IREQkFh.exe
  C:\Windows\System\IREQkFh.exe
  2⤵
  PID:9676
- C:\Windows\System\AbwgilS.exe
  C:\Windows\System\AbwgilS.exe
  2⤵
  PID:9692
- C:\Windows\System\jHEllZS.exe
  C:\Windows\System\jHEllZS.exe
  2⤵
  PID:9708
- C:\Windows\System\LRVIYQG.exe
  C:\Windows\System\LRVIYQG.exe
  2⤵
  PID:9724
- C:\Windows\System\VDPjRGY.exe
  C:\Windows\System\VDPjRGY.exe
  2⤵
  PID:9740
- C:\Windows\System\LspELNu.exe
  C:\Windows\System\LspELNu.exe
  2⤵
  PID:9756
- C:\Windows\System\dufbmiv.exe
  C:\Windows\System\dufbmiv.exe
  2⤵
  PID:9772
- C:\Windows\System\MKpXSUO.exe
  C:\Windows\System\MKpXSUO.exe
  2⤵
  PID:9788
- C:\Windows\System\PirZcPJ.exe
  C:\Windows\System\PirZcPJ.exe
  2⤵
  PID:9804
- C:\Windows\System\iFcxHBT.exe
  C:\Windows\System\iFcxHBT.exe
  2⤵
  PID:9820
- C:\Windows\System\HvvMjck.exe
  C:\Windows\System\HvvMjck.exe
  2⤵
  PID:9836
- C:\Windows\System\JWTjsIl.exe
  C:\Windows\System\JWTjsIl.exe
  2⤵
  PID:9852
- C:\Windows\System\fXmreKe.exe
  C:\Windows\System\fXmreKe.exe
  2⤵
  PID:9868
- C:\Windows\System\RTZyocE.exe
  C:\Windows\System\RTZyocE.exe
  2⤵
  PID:9884
- C:\Windows\System\awZFOSM.exe
  C:\Windows\System\awZFOSM.exe
  2⤵
  PID:9900
- C:\Windows\System\fjIednN.exe
  C:\Windows\System\fjIednN.exe
  2⤵
  PID:9916
- C:\Windows\System\zzgQGip.exe
  C:\Windows\System\zzgQGip.exe
  2⤵
  PID:9932
- C:\Windows\System\LsAOmew.exe
  C:\Windows\System\LsAOmew.exe
  2⤵
  PID:9948
- C:\Windows\System\yJsbVAW.exe
  C:\Windows\System\yJsbVAW.exe
  2⤵
  PID:9964
- C:\Windows\System\vEZZxHC.exe
  C:\Windows\System\vEZZxHC.exe
  2⤵
  PID:9980
- C:\Windows\System\OieXevT.exe
  C:\Windows\System\OieXevT.exe
  2⤵
  PID:9996
- C:\Windows\System\QCHQFjg.exe
  C:\Windows\System\QCHQFjg.exe
  2⤵
  PID:10012
- C:\Windows\System\QXkQHEA.exe
  C:\Windows\System\QXkQHEA.exe
  2⤵
  PID:10028
- C:\Windows\System\qLthfpn.exe
  C:\Windows\System\qLthfpn.exe
  2⤵
  PID:10044
- C:\Windows\System\weUOdLk.exe
  C:\Windows\System\weUOdLk.exe
  2⤵
  PID:10060
- C:\Windows\System\YyaAkTW.exe
  C:\Windows\System\YyaAkTW.exe
  2⤵
  PID:10076
- C:\Windows\System\yaXMvTS.exe
  C:\Windows\System\yaXMvTS.exe
  2⤵
  PID:10092
- C:\Windows\System\buYRpMB.exe
  C:\Windows\System\buYRpMB.exe
  2⤵
  PID:10108
- C:\Windows\System\AxXoEmf.exe
  C:\Windows\System\AxXoEmf.exe
  2⤵
  PID:10124
- C:\Windows\System\CwIuOes.exe
  C:\Windows\System\CwIuOes.exe
  2⤵
  PID:10140
- C:\Windows\System\lnyljOv.exe
  C:\Windows\System\lnyljOv.exe
  2⤵
  PID:10156
- C:\Windows\System\FUAimoX.exe
  C:\Windows\System\FUAimoX.exe
  2⤵
  PID:10172
- C:\Windows\System\QyxXOej.exe
  C:\Windows\System\QyxXOej.exe
  2⤵
  PID:10188
- C:\Windows\System\QFhYmQe.exe
  C:\Windows\System\QFhYmQe.exe
  2⤵
  PID:10204
- C:\Windows\System\SzBgnzm.exe
  C:\Windows\System\SzBgnzm.exe
  2⤵
  PID:10220
- C:\Windows\System\wyPBiCh.exe
  C:\Windows\System\wyPBiCh.exe
  2⤵
  PID:10236
- C:\Windows\System\caZTfTQ.exe
  C:\Windows\System\caZTfTQ.exe
  2⤵
  PID:9256
- C:\Windows\System\VuPGHsB.exe
  C:\Windows\System\VuPGHsB.exe
  2⤵
  PID:9320
- C:\Windows\System\rZeqAuz.exe
  C:\Windows\System\rZeqAuz.exe
  2⤵
  PID:8660
- C:\Windows\System\sdakHZc.exe
  C:\Windows\System\sdakHZc.exe
  2⤵
  PID:9152
- C:\Windows\System\WikwsdL.exe
  C:\Windows\System\WikwsdL.exe
  2⤵
  PID:9364
- C:\Windows\System\glwkdej.exe
  C:\Windows\System\glwkdej.exe
  2⤵
  PID:8760
- C:\Windows\System\IWExgFa.exe
  C:\Windows\System\IWExgFa.exe
  2⤵
  PID:8516
- C:\Windows\System\KgDGwQV.exe
  C:\Windows\System\KgDGwQV.exe
  2⤵
  PID:9272
- C:\Windows\System\cjiLeHh.exe
  C:\Windows\System\cjiLeHh.exe
  2⤵
  PID:9368
- C:\Windows\System\xAYbzwL.exe
  C:\Windows\System\xAYbzwL.exe
  2⤵
  PID:9480
- C:\Windows\System\WlRLYKl.exe
  C:\Windows\System\WlRLYKl.exe
  2⤵
  PID:9444
- C:\Windows\System\WOKOdXa.exe
  C:\Windows\System\WOKOdXa.exe
  2⤵
  PID:9572
- C:\Windows\System\ogMyJuB.exe
  C:\Windows\System\ogMyJuB.exe
  2⤵
  PID:9636
- C:\Windows\System\BeWzrJH.exe
  C:\Windows\System\BeWzrJH.exe
  2⤵
  PID:9700
- C:\Windows\System\kePUeLD.exe
  C:\Windows\System\kePUeLD.exe
  2⤵
  PID:9764
- C:\Windows\System\uaymRyv.exe
  C:\Windows\System\uaymRyv.exe
  2⤵
  PID:9828
- C:\Windows\System\cgDQTXY.exe
  C:\Windows\System\cgDQTXY.exe
  2⤵
  PID:9892
- C:\Windows\System\MkUlGhT.exe
  C:\Windows\System\MkUlGhT.exe
  2⤵
  PID:9956
- C:\Windows\System\ysIPERj.exe
  C:\Windows\System\ysIPERj.exe
  2⤵
  PID:10020
- C:\Windows\System\wpzSaVM.exe
  C:\Windows\System\wpzSaVM.exe
  2⤵
  PID:9396
- C:\Windows\System\lOsInPb.exe
  C:\Windows\System\lOsInPb.exe
  2⤵
  PID:9400
- C:\Windows\System\covDUiZ.exe
  C:\Windows\System\covDUiZ.exe
  2⤵
  PID:9464
- C:\Windows\System\muCgexY.exe
  C:\Windows\System\muCgexY.exe
  2⤵
  PID:9560
- C:\Windows\System\RamveiD.exe
  C:\Windows\System\RamveiD.exe
  2⤵
  PID:9652
- C:\Windows\System\XZPCJGh.exe
  C:\Windows\System\XZPCJGh.exe
  2⤵
  PID:9716
- C:\Windows\System\uWMEeni.exe
  C:\Windows\System\uWMEeni.exe
  2⤵
  PID:9780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOemnKT.exe

Filesize
1.8MB

MD5
d47f872b7038bacf8a4d506507ba7dd9

SHA1
c99cc2bf8bccbb54f63668e513ccf74ba497b21c

SHA256
c42cb766319f9c1fff46f0b12fc57896dd977967b63ff6f30fbabaf58ed6c5c5

SHA512
93ff5fc58e3b01d0804c114853b05d41d32c608e8f24a41888105714124cb6bdc682e199d32b797f94a4fafcca1a410cb847afe8b1cddc4c7a5569e0adbb3962

Download Submit
C:\Windows\system\BAFREoj.exe

Filesize
1.8MB

MD5
fa33372ec1e4490ec71c40d2961d039f

SHA1
350f41872f55314cea5d98e8e6325b0f8096f67b

SHA256
2195335bdcce0ef4788b581b9386726cdababa43e719df2c088168f1128ff21d

SHA512
92dd827587f99ba06349c606934c22f50b1db91711d6b5a8bbf3e4c57e46f23e7b73b72ec2119491e04d3e92762f9755be29a7ca9daaf6153d834f6e26c26921

Download Submit
C:\Windows\system\BhZjyYl.exe

Filesize
1.8MB

MD5
f2c55b4bfe20946058ae1f871edce3ab

SHA1
abe16b5f2504c57d6c1618b8fe211c90b1a339b5

SHA256
00d4fa5695fbff01c6abb75875544c38851fde1eefb3654bd584a0d523a54d37

SHA512
e004d2b13dcb320524d0380f3e92d8f43408afb2b613a284302d0b7af65ca32f1b1a4a171916272bafd9415415f42025e9b3d7738a309fd9e028939cdf3ffc53

Download Submit
C:\Windows\system\BsPUCoo.exe

Filesize
1.8MB

MD5
58f38ae09405e25126c126bbf3f2d3e1

SHA1
9dad8c32da3ed9507dd98242bba0b7397020c4df

SHA256
3bc7a71ef414d6a11da408dfa16e1e4cb9958948c72284e2dfd76372f0dfacaa

SHA512
61b67ad2de7f9da4fc1b37bf93247e205e00074eece9cd83da8aa1a107fd590609eba22cceed3a02a4caf1f43e14ec1b668c3961f1583615b4b9d3a87cb2b321

Download Submit
C:\Windows\system\CqsDeIY.exe

Filesize
1.8MB

MD5
040df735fbf17cf72cc96a9872224fb5

SHA1
07db46e26bafaae6bad7b4497c3e4f241723fcae

SHA256
90ddae702c472c25bea09a85b8f49f8796f1fd4e5fb77bcbc54303083cfd8f77

SHA512
6ac49dba2e9e1f90538d79fc070c10a5eccb4084170e7fc37de2450db7c62598561aee11386b22fafdc896c9b4cf1704b606d2e478fd6aff1852aacc47e81e55

Download Submit
C:\Windows\system\FXFrRdv.exe

Filesize
1.8MB

MD5
2138a8aaf9e6bf6d03646fa5f78f0a7d

SHA1
3e75e2535efc03096e74e30178c593c6779d952a

SHA256
b1f419521bc50de997172e8d96f5f656ebb85f9f630546ca378999d34504b60f

SHA512
54b745f678caba95cf4297e5199f1a5f02d2b3abd9ed7c3332317acdd97ebd29efc7b74642f64b381dc9f3655eb03ec392478d583ecedfc89b7cccc3d2a03adf

Download Submit
C:\Windows\system\JsdijDh.exe

Filesize
1.8MB

MD5
ce034851d4af34e5b332e45226d1218b

SHA1
85c4bc5ade4125e10d074f784f31422009c9d6b6

SHA256
a0f17ce616aee8d1f3527cd42cd370c760c8819b4e6879f95539b2e8e430f5fd

SHA512
bfa65d7b3e314fae889f144648a51100a8312c716447940bca941c0e817c4fd283744f217f4042fdb69ac9152756e2919533e56feea96530102cbba3eefd70b0

Download Submit
C:\Windows\system\LbkkyLb.exe

Filesize
1.8MB

MD5
8cb422de45524ec356055e4bc1f4299a

SHA1
8e444e734950e694eafb55dc410048ec74fd90b8

SHA256
a8008f965d740c7e1c9c49d55765ec91c25ff3011599a2e6a527d0fd13dd9b5a

SHA512
1c7d2f231f122f20cf5093e082856277978f245bf2e383fc5529a159e67c46a8c8b2c64ac331f3f3d050ffa3d477a1ac5e1b63a68a00f04be6787ee71f982478

Download Submit
C:\Windows\system\RllxrhT.exe

Filesize
1.9MB

MD5
c286b7ac92b29cbdb8d38821a8399d80

SHA1
b5eaf71eff4bcc31d36a3d7cff423acbf6c67bd6

SHA256
0bdd409a274c375fd2023160386533de87fb4b8ca1055540dabab00e8d6ace49

SHA512
773d202b07080c333435cc8ca49a8efcf908d16b3985baca04f51de177e4647bc946f4ba202143cffb6f47337b445f607e85ed1631f1bf97164e20a06701c36f

Download Submit
C:\Windows\system\TgeTpjF.exe

Filesize
1.8MB

MD5
ed4a2cf267cc7d742f807b157251738f

SHA1
1c600ab786e4615e7aa60af2fc0ca3b4fa80fc95

SHA256
42661fbd7194f1166f14802ab9b49178de57d598c64df05f20576f585eeb7329

SHA512
2d564515adbb0f61fcef5940660d98aeb3161dcfec2e561f4448e37b97611faceeb5a0cdebf47b0544a86d01006cf913b2ba2a53b3894fba7ecb5d5f1cdec273

Download Submit
C:\Windows\system\WYxBaHa.exe

Filesize
1.9MB

MD5
c51d9a4dea93b99809128a06b1ece555

SHA1
424f1b65dd314e83560131c43884286dab26538e

SHA256
e7d07dadb507e6f14831cfd92a8b5f139a31b5001556daaf18f937f8a84073e6

SHA512
1f9636a1456efa9ca43d34897355ddfb9229e658d6c73097a4f861958e74f8ee8100acdbe4afd3afe990b7683c44992dd1e082ea68abc7d3a9e4dca59546b158

Download Submit
C:\Windows\system\XXRjbCw.exe

Filesize
1.8MB

MD5
cbf811a0d7216634abf3ecf1f7df82aa

SHA1
b7370759210e4130d1baeccaab86901152d3a2d3

SHA256
f87cbdb8c8926cf441c6ee961fda20ee7d1f0883a7fe13e61d55fbc47af61ded

SHA512
acfae5ef35fc99440fc13c5dbc883a8d0e2077b960e28084a024e7eccf672ce1b8d55d29f2e5c933286d4c4114f6bdb4be0e6279ac877be21b8e6e1f427e8260

Download Submit
C:\Windows\system\ZDgQdCl.exe

Filesize
1.8MB

MD5
b88a29368363900de4d9e8836e0e4e9a

SHA1
ef6439959976e46c066626f5066c3bc7c0de156a

SHA256
7ec266e43f023256a9ad9bf7574f543d4da0745e6fb0808a47873aa5d9e8859a

SHA512
717d2dd70e6254696411cd5b91574abcf361ad50ccbdbce76aa4c8582f36a166ecf9db7ddceeed00160353d6b91f49b9893266fb75b79d2237a93c88157f0259

Download Submit
C:\Windows\system\ZKVjpwe.exe

Filesize
1.8MB

MD5
3f98fe9e5b543c24f25280ee8b314257

SHA1
53298215aa352b18385f3b6d809836415bb48023

SHA256
8251217a60e8e8be932e1996f406ea3338c09bec9b698f25d0de1d494c1ba749

SHA512
664b2238669379878d86e431bbbca658e8ee758f9f0560d518b5e8901a865f2a9786d383afd1287bdc07f7f582ed3c5571ac75e1bbdc7c6d8a3e4d86bff19e08

Download Submit
C:\Windows\system\aRfnDuj.exe

Filesize
1.8MB

MD5
b872e51797ef6a7fc1b83f2137775ff7

SHA1
98c6a9ab8e46258da2193349047037127166ac0e

SHA256
d1760ec4204c026038e985d44044524382b50b3f14e9455ecde4de8ca5361a17

SHA512
431c8f7aaaafab01124e6424b7dd8eb017b391a61f3245cfb4cffdac925fa2b366c05bd0255e050c3ae7027a2ba7b0da041efc2fcd46cbd02b225ee9c69ea85f

Download Submit
C:\Windows\system\fdfCgCM.exe

Filesize
1.8MB

MD5
8b80a01a5e3f1784c53f87a989324b7d

SHA1
b915b9b6f0c705a8c575586597cf6e04f001fc63

SHA256
064b55cb5148b1af45bce324cd4348e677c604d2a687fcb4535e540c4e636e71

SHA512
b4deaccfb8735804f570a3f295be9ba576769be5a7d9252811519f080891818a72e380efb6272ac4cd67f1b6f6122cc40f07ac1f6ab1f88464c16babc1018a76

Download Submit
C:\Windows\system\gxMNVco.exe

Filesize
1.8MB

MD5
7aa32c051d23919772f30354ca4f5f5f

SHA1
18242c08f9e1a987270de5c3e1354bb9194d234d

SHA256
6139fa40895b355b223806449853fa23cd33d19b40dfb0a3edd9bf57544ec57a

SHA512
2359ee1647915faf505197aa1005bc301ffa93f45831f7ec587f6814b7ba905bc1bdd361e0ad9a6841a1cbaea0bf2a97e8fe1f24e6f64a3e7583f4080e05b8dc

Download Submit
C:\Windows\system\jDLhpvh.exe

Filesize
1.8MB

MD5
50e0b825a1e11a6ebcc5dcb546335888

SHA1
aa58140ebcc4c852c9f128eed9748e3ce9c7fa30

SHA256
f3f74d08c52d39307ea32b5b19ab64ad28549d3f7a0f28b2a883fbe42a217322

SHA512
c00baec7872c3e718eb6fbf286f5aaec849192aeca0ec23453522ca11118d12d67dcc17b7abc402abeb4696a2ae98510170c0fc31a41d029395cdcfbf9e4e090

Download Submit
C:\Windows\system\nwIYIgQ.exe

Filesize
1.8MB

MD5
ad2d74f25c1ff9583256bb5e055ea66e

SHA1
798075f488d0982de805d3af55f0d776d5b5a83d

SHA256
54580279dbfe295784d358d474740e332f14b1f7e2f46a745189dc992f40f7e7

SHA512
b28e56dcdbb67733335b470708c73cd7ecaa4306d345956af496012d8a1d5a9337e26654466e07692c74badae7c9ed44c4059c26f4297db077753dfa6da16842

Download Submit
C:\Windows\system\rDeISgt.exe

Filesize
1.8MB

MD5
7f2277deacd97bc8fd1be48265e10f17

SHA1
c85652aaa7faad00d1e8f62a0dc8bfac2d77f65d

SHA256
7b70deffdd604aff67258f0d469835552f07220e98a017fe49a761a5c192b1b6

SHA512
25785a8c904a09adf12bd1d3475485209539b693c712d2a272dc654b8fa20e0cca40c7937cde338bb635ac62009b3d8785d79cd6be732fdc3e2cd53bf5608963

Download Submit
C:\Windows\system\sKdWGcO.exe

Filesize
1.8MB

MD5
a538501dc9b632aaf9b14abf472de480

SHA1
ea813e74ad50d6aa3a9cf94ef5d87ab23209ed9c

SHA256
841ecb268ac9ca4e3bcbed188d640736836293d9e50066250ad93a486622fe36

SHA512
af258a49fc48f9d2bce50c68048c5026b791adcfa2a212868dba5ed7cdef335b616970a8bf40e88c4988ab11cfcf7aba0cd09117e903dca81c2f1f8e3d6aba0c

Download Submit
C:\Windows\system\tAhmXQZ.exe

Filesize
1.8MB

MD5
b540cdec776d6773ea546a24a575a895

SHA1
03ebaf44022363f62535ce023c77f78e61092ca1

SHA256
ca80d3c2cd951c4a94da758198c60f3c467d12ec1d8afc1afc8e8ae9d185ce71

SHA512
7eb303db48c8887edb123e92ac8753bd35b45cd2e8a5a185c14d748bc0e2d8bc967c152b9c80a77391df6d0c8c57745e27116c7cf49f7379dbee3801e8e4c1cd

Download Submit
C:\Windows\system\tJEsVix.exe

Filesize
1.8MB

MD5
3e851bdbd42aa44518e65ea77762d2ac

SHA1
3a1ae7adafa7106aa87120f4bdc2138f2c515adb

SHA256
6b63478d3dc2f3a9c3ab78a20cae10dfcd86721c95b7c646f9307c14ff0577a9

SHA512
9291a2499c7091c9f4045d3837c438521e1e0812079a577777a5be9ca99132a076ffb3af7d21b8c8d30211e4c7a303f830c65a6cc734c6367bd12ede84bd56b3

Download Submit
C:\Windows\system\tTPOSib.exe

Filesize
1.8MB

MD5
85447f57b7972432b1abcf930a1aa4eb

SHA1
1b05958bcad242e1974fbdb15602e8854b5d1533

SHA256
fc00932abf63fdf7a9b8cb0ab22a94ce8e1a1a3c49812a01e65029d7d4636734

SHA512
b4db912847559b8c42a84bb4fadf42babfdca4f99750714ac6fdcec7c3e9c07a8b4165533cc81a04058cd439a94753847dc40b115c9653d11139a83011265371

Download Submit
C:\Windows\system\tgLbZXF.exe

Filesize
1.8MB

MD5
f4799eb24c1348c65c6d50de7ffd1c7a

SHA1
9b6f19b4165aa392fbfa891e7a840abb1e80482c

SHA256
247b642b2fb6d2903ea748bcb7aca2e378ca61f8c7c1d141e52f20c62901acad

SHA512
7121cecce07ff4e7f4d8c457d45ea173d719c68dff3c62077b61a99293b7a56dffc2af8dc01739d89b73898cfcdfaa8127f6c99addb7f698a733b7805054a424

Download Submit
C:\Windows\system\usQwaht.exe

Filesize
1.8MB

MD5
fcaaded7125f4676a570e596355d7615

SHA1
f6af89fce8e328e1733a765c412c5f72b8bcedc7

SHA256
56f3f4b45eab4223cd6281f3162030f168cf24c0ca9ac73f1c76b2dfad907b3f

SHA512
648d2651fee16de4ebd581af01f2fbc0adf98c3b4bff2fb9f208a6bc7c776bc2e18cfc105ef3e1a2880697a6fe833779b2dc45ae16d3f46a2a8cdf1fc09ea095

Download Submit
\Windows\system\JtBthSw.exe

Filesize
1.8MB

MD5
1dbc95859f8850bad219f77291503381

SHA1
8c02d29fba977722df75ba9c369a88fe104c11dd

SHA256
d001f5a074b93bb408d1cd75ea55e470afadc608d14e2693819d8bc3c75c3fa3

SHA512
fc1dc50972b3d9e3c65c3ba9fad878d93f9cbbfda9f73fe00686718d40aa37a8b83557eba44c1a795e6d31145eb6bb498d775eb7e5e7626c8331846bf6a330f9

Download Submit
\Windows\system\MdXcddQ.exe

Filesize
1.8MB

MD5
2b94ba601081193e6811dc9214ffdda1

SHA1
3f9e8930bff19e679900b00732718b8d2fe6e4fe

SHA256
cf169197b561ff59e23e5aeb65342298799d2304d8eeedf93e8433a2c53d1248

SHA512
5074c00109e766a03e59633e31154ee3bcfbefb863b483bcb0996989f980b50a2a34e60192431d41264c6af1f016fef7e176062cbb8528a2b0cc5b7401cef9e7

Download Submit
\Windows\system\NPzTdqy.exe

Filesize
1.8MB

MD5
dc93d712f65ca17ed4a4d1d9321fa174

SHA1
5adc2ea4440627b8c887f338f85734ce2d69f3e8

SHA256
196c92aa8708efbc8fa90fc30199af50f172498f51b4bcb980d97f1d3f1c5ece

SHA512
e409a50b7f183d80d0ce1f49f190dd8ceadda594e9dde641ed5aa098010fb772a59648f936fd37564a084c0fe60e6f0c7fbdcc024e815d2c0cb991b62ad41d30

Download Submit
\Windows\system\TnMTmOc.exe

Filesize
1.8MB

MD5
3051b7cbb3a0bdc1f01901b1bd0b4ea4

SHA1
f76ec67ebe655ee694b6f58a79c02c709bf5d7b5

SHA256
3970b852da6fab179ced5af1f695ff26bc3659f0909744806bf99e871d6ee49c

SHA512
40c88b8586ad33705315cb69f86457dd435ec40ba7635ed132d36192e067cef4628ee2bc40d06e16f6fda71828e24b1d2810d42df88ab570cebc33205fd08697

Download Submit
\Windows\system\YxECxrz.exe

Filesize
1.9MB

MD5
7cd90a8447db9822e7b0a87b0074e3a4

SHA1
f93af0a3e44cda843fca2984360e760af719d35f

SHA256
eed6e5a8f34adbd90171c7764c83237b11b91ff13ac63ae840cd2bf8f71b315a

SHA512
d62bc97b615609f2c4c06a2b85f90ce05fde46fccde1ce5719de971c51ec0a2c42f3e21e7c10a7bdf7f5708ad9e88280045378fdf5560f787412912cc3a3e9e8

Download Submit
\Windows\system\ZjtXKPl.exe

Filesize
1.9MB

MD5
a8bddac4c5cdb232537189487c2a56b9

SHA1
09e999178d2665a55df3e581bb36b7cde5365161

SHA256
a94b150610096830d60765845e224508eda36c3775db69ed5b13a25a2e4f4a4a

SHA512
e44175cdfe5c4e63b6b7fb5bcc64b5761f650ee027822cd09e0b85790eeb57b0bd037d964ea5c9e1668c141f64694b1354d664a9fe5501a58dcdcb48b822ea7a

Download Submit
\Windows\system\kVXPlLz.exe

Filesize
1.8MB

MD5
7c0348262f86ca97b75ba86794c358a5

SHA1
c31fe0ebd849c45f99849dbdd4b24f1cd2839fe0

SHA256
6e54125d701e41465b18dce16ed57a3a6e5825024b29eb97cc7d06f556385b98

SHA512
8b25add4260156529c8f02d7cbccd65805f29d3a15bd874265a23c5652775f7d6faaee9a7715deb575a96d2115f68e4f23b9285b4b8eca790e0390f2dcf8eae7

Download Submit
\Windows\system\kldfUEw.exe

Filesize
1.9MB

MD5
22d46cb62ff8bb5f9f03524170582096

SHA1
a5f8dae5d1d1e0d165ac5b9771c6a324e4cac3f7

SHA256
b066ab654339b352b8b894d8465c53bec357ecc8d8ef03ea1eeebef5356e8df0

SHA512
0c6ba330829890a6171ac3f2bba2762629ac80c0ba4d22d5042635e2018d67fe012be3c7110dc80e96f1eaa1572b8f035c687a5fd3b5373e608a819d51151fad

Download Submit
\Windows\system\qzIzqVC.exe

Filesize
1.9MB

MD5
6290381f1c409b38a7d01c82fcd5dc20

SHA1
264f70a4479a3ddda92ca8573e8530ffab044ea4

SHA256
ad7cf8b3144083d7104121beb220744c72e85e8d259a7674e9fb88fe5bddba1c

SHA512
e32564ae33984ea15b7a74453ee0c0fb2d818529d1069e003f9f6bdd73606bc2c804668ad52b0d264f86ce828c65be2a8aee74f1a50ff866639b5b0764817172

Download Submit
\Windows\system\vMZWnKu.exe

Filesize
1.8MB

MD5
43523a2252af664c859c900ee6e328f0

SHA1
a10f75efebceadffde230fb2bbe59f200f52447b

SHA256
f30a42c1d24fe1d888fb540ec07506c7cb4d15830c4a32a4bf337cb96f228af6

SHA512
c1feeeec0d5c555480fe329df3e5813d326415b39f390ded25e0dd1a376def3b8f9cfef43f5d333ae43a684756b858aae7432a5f57725642f65f1d1b0dc7c2f6

Download Submit
\Windows\system\waPAxOq.exe

Filesize
1.8MB

MD5
d1fdcfc06e25e4a078d1d6d7e9a41872

SHA1
4cc08b2c375bb7c07794be87af7cbc3283078912

SHA256
1594f50206e544c2bae70b92733f97fe1ff9328b9de728f2835e570e21b60d68

SHA512
46a16e82745fc4a3963444aeb64d5378fade2d65ff855f5a6f26e7042b3b07cb0e2ef0b8aba7f9b4d99d8a0762788b0f8e7ce05d3d9be9a9b1fce6ce12aaf158

Download Submit
memory/1712-222-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/1712-212-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1712-21-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/1712-210-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/1712-199-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1712-215-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1712-206-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/1712-223-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/1712-204-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/1712-202-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/1712-201-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/1712-0-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/1712-219-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-220-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/2036-207-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2040-225-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2040-230-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2240-213-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2400-224-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2424-221-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2504-205-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2556-211-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2612-209-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2648-216-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2672-203-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-198-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-208-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download