xmrig | 6ea0f8a3a97a495e8829a8ce6d4a43fe9b925788d1d2096ba577dd5101f400a6

Analysis

max time kernel
24s
max time network
30s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
Size

1.9MB
MD5

041c2b2e898fb4c5b78b56a2998a7a2c
SHA1

f2360416815c2670e95b2b50b9eaca0c55426faa
SHA256

6ea0f8a3a97a495e8829a8ce6d4a43fe9b925788d1d2096ba577dd5101f400a6
SHA512

d604e183d91e9b4e2aafb13a582ab4c6923ef92f66346c14f16c60a466830980558638ab69b0032e1a39a19daa769355553af75d22b3e869d42b34bbc4e2c4df
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlfR4:NABt

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2132-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2432-53-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2784-68-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/352-80-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2132-72-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/1592-89-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2408-85-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2784-84-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	xmrig
behavioral1/memory/2636-83-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2784-81-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2596-640-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2784-95-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2792-94-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/3048-78-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2540-77-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2540-25-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2636-26-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/352-12-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
352	LsRavSL.exe
2132	KImJzfg.exe
2540	RPneZDk.exe
2636	rMKAuhx.exe
2792	LGvUOut.exe
2596	cKHKHtI.exe
2432	rFITzxe.exe
2508	MeqnlGX.exe
3048	aRUREVZ.exe
2408	iNqGFMI.exe
1592	bqIhAtY.exe
2768	fmAHthR.exe
2848	qxFuxUF.exe
1044	yMNuZEH.exe
1820	SgEAPYt.exe
1252	JNAjlkN.exe
304	ssQVpbC.exe
2220	XalwjaX.exe
848	JscTagu.exe
2332	GnEOtvm.exe
1400	IGkaybT.exe
1232	CCEHOWR.exe
2812	HzMzsOg.exe
596	XcefFzg.exe
556	zaSjjcc.exe
580	ZWKhqGR.exe
2348	sZZtDiQ.exe
2696	yklDuKM.exe
2400	KTueZOo.exe
716	cgudfgY.exe
1120	jJuJsTt.exe
3040	qqCherE.exe
1772	aAFDTmj.exe
1352	orSYGZS.exe
1268	PAGXOSL.exe
1828	EqZwONh.exe
1716	CzBsRsD.exe
2516	TcxlGHZ.exe
1964	PuyYDKG.exe
1872	ANYyDLU.exe
1700	cikSKgc.exe
924	dfnJYwX.exe
1124	qPajQAn.exe
2988	qhVKfSj.exe
2160	vEvhdzP.exe
1304	OPUQgxa.exe
1512	XOgRqUx.exe
1724	wtBUGgh.exe
1616	rKHJiTi.exe
1520	VKqUEUK.exe
2620	uzHslzQ.exe
2956	lWAQXYR.exe
2980	ZhUeEUb.exe
2544	ycMuSOC.exe
1552	jvLvmzq.exe
1588	FGoPsut.exe
2716	TAWeCyU.exe
2444	duGpVGh.exe
2480	mhcoILh.exe
2700	mAPCmFp.exe
2256	BSLAmdO.exe
2252	TQMlBtl.exe
2168	aoiRRoj.exe
2288	kyMVkWz.exe

Loads dropped DLL 64 IoCs

pid	Process
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2784-0-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/files/0x000c000000014890-3.dat	upx
behavioral1/files/0x0007000000015662-13.dat	upx
behavioral1/memory/2132-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x00070000000158d9-24.dat	upx
behavioral1/files/0x0007000000015ae3-38.dat	upx
behavioral1/memory/2792-40-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x0016000000005586-41.dat	upx
behavioral1/memory/2432-53-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x0007000000015d61-57.dat	upx
behavioral1/files/0x0006000000015d85-60.dat	upx
behavioral1/memory/2508-59-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2784-68-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/352-80-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2132-72-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/1592-89-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x0006000000015fa6-92.dat	upx
behavioral1/files/0x0006000000015d9c-86.dat	upx
behavioral1/memory/2408-85-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/memory/2636-83-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x0006000000015f23-79.dat	upx
behavioral1/files/0x00060000000163eb-116.dat	upx
behavioral1/files/0x0006000000016a28-132.dat	upx
behavioral1/files/0x0006000000016c30-145.dat	upx
behavioral1/files/0x0006000000016c1f-137.dat	upx
behavioral1/files/0x0006000000016cb5-159.dat	upx
behavioral1/files/0x0006000000016ce0-169.dat	upx
behavioral1/files/0x0006000000016cf3-179.dat	upx
behavioral1/files/0x0006000000016d10-192.dat	upx
behavioral1/memory/2596-640-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x0006000000016cfd-184.dat	upx
behavioral1/files/0x0006000000016d06-189.dat	upx
behavioral1/files/0x0006000000016ced-174.dat	upx
behavioral1/files/0x0006000000016c38-153.dat	upx
behavioral1/files/0x0006000000016c84-158.dat	upx
behavioral1/files/0x00060000000167bf-128.dat	upx
behavioral1/files/0x0006000000016575-124.dat	upx
behavioral1/files/0x00060000000164ec-120.dat	upx
behavioral1/files/0x00060000000161ee-112.dat	upx
behavioral1/files/0x00340000000150d9-108.dat	upx
behavioral1/files/0x0006000000016122-105.dat	upx
behavioral1/files/0x0006000000016013-100.dat	upx
behavioral1/memory/2768-96-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2792-94-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/3048-78-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2540-77-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2784-44-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x000a000000015b85-49.dat	upx
behavioral1/memory/2540-25-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2636-26-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/352-12-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0034000000015083-10.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ANFZLqy.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\pNXqlay.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\QlLqixj.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\ITNtDtg.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\ALyMOfI.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\ZDbBUBw.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\PxiuJPi.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\kPusNhE.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\WlSInBe.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\qPajQAn.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\TSZMkkc.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\ssQVpbC.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\KTueZOo.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\KVZQnlc.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\pqGrrOn.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\KZHKsrd.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\NBBjAPM.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\BfYnPtj.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\lerzmOc.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\nalzfgv.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\lPeUWbm.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\jiHPzQG.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\LsRavSL.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\ESIGMwy.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\ZRZBXKY.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\sqXKDCw.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\gvMEkHY.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\CiQuJhg.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\GFuMxYH.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\xdyTHya.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\sZxqbHj.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\LKqSoCX.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\yYLsdoL.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\nUCPNyS.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\AmclvCW.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\yqVguHQ.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\LYHjOVL.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\WUbXTvV.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\EzJMCWY.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\POpYwVD.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\pxDxyXN.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\cVGzaXr.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\DJsRysJ.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\AnNpPyX.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\GSDNwQq.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\GNVrqIO.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\cKyWpIp.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\MfGOgaN.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\BqwaYjj.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\qJwvZsS.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\MkrmwzO.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\GEwskjg.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\SuuSfvH.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\jkCQMRw.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\SxbiJKI.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\iWEqTQv.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\yrQDzQY.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\SjPSTut.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\GlMjuED.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\sYwlllB.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\qeredRu.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\uDSOKWH.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\jxmuwph.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
File created	C:\Windows\System\sOTyahu.exe	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
Token: SeDebugPrivilege	2968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2968	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	29
PID 2784 wrote to memory of 2968	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	29
PID 2784 wrote to memory of 2968	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	29
PID 2784 wrote to memory of 352	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	30
PID 2784 wrote to memory of 352	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	30
PID 2784 wrote to memory of 352	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	30
PID 2784 wrote to memory of 2132	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2132	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2132	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2540	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2540	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2540	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2636	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2636	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2636	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2792	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2792	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2792	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2596	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2596	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2596	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2432	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2432	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2432	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2508	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2508	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2508	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	37
PID 2784 wrote to memory of 3048	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	38
PID 2784 wrote to memory of 3048	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	38
PID 2784 wrote to memory of 3048	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	38
PID 2784 wrote to memory of 1592	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	39
PID 2784 wrote to memory of 1592	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	39
PID 2784 wrote to memory of 1592	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	39
PID 2784 wrote to memory of 2408	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	40
PID 2784 wrote to memory of 2408	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	40
PID 2784 wrote to memory of 2408	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	40
PID 2784 wrote to memory of 2768	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	41
PID 2784 wrote to memory of 2768	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	41
PID 2784 wrote to memory of 2768	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	41
PID 2784 wrote to memory of 2848	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	42
PID 2784 wrote to memory of 2848	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	42
PID 2784 wrote to memory of 2848	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	42
PID 2784 wrote to memory of 1044	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	43
PID 2784 wrote to memory of 1044	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	43
PID 2784 wrote to memory of 1044	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	43
PID 2784 wrote to memory of 1820	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	44
PID 2784 wrote to memory of 1820	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	44
PID 2784 wrote to memory of 1820	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	44
PID 2784 wrote to memory of 1252	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	45
PID 2784 wrote to memory of 1252	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	45
PID 2784 wrote to memory of 1252	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	45
PID 2784 wrote to memory of 304	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	46
PID 2784 wrote to memory of 304	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	46
PID 2784 wrote to memory of 304	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	46
PID 2784 wrote to memory of 2220	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	47
PID 2784 wrote to memory of 2220	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	47
PID 2784 wrote to memory of 2220	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	47
PID 2784 wrote to memory of 848	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	48
PID 2784 wrote to memory of 848	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	48
PID 2784 wrote to memory of 848	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	48
PID 2784 wrote to memory of 2332	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	49
PID 2784 wrote to memory of 2332	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	49
PID 2784 wrote to memory of 2332	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	49
PID 2784 wrote to memory of 1400	2784	041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\041c2b2e898fb4c5b78b56a2998a7a2c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\System\LsRavSL.exe
  C:\Windows\System\LsRavSL.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\KImJzfg.exe
  C:\Windows\System\KImJzfg.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\RPneZDk.exe
  C:\Windows\System\RPneZDk.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\rMKAuhx.exe
  C:\Windows\System\rMKAuhx.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\LGvUOut.exe
  C:\Windows\System\LGvUOut.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\cKHKHtI.exe
  C:\Windows\System\cKHKHtI.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\rFITzxe.exe
  C:\Windows\System\rFITzxe.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\MeqnlGX.exe
  C:\Windows\System\MeqnlGX.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\aRUREVZ.exe
  C:\Windows\System\aRUREVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\bqIhAtY.exe
  C:\Windows\System\bqIhAtY.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\iNqGFMI.exe
  C:\Windows\System\iNqGFMI.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\fmAHthR.exe
  C:\Windows\System\fmAHthR.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\qxFuxUF.exe
  C:\Windows\System\qxFuxUF.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\yMNuZEH.exe
  C:\Windows\System\yMNuZEH.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\SgEAPYt.exe
  C:\Windows\System\SgEAPYt.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\JNAjlkN.exe
  C:\Windows\System\JNAjlkN.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\ssQVpbC.exe
  C:\Windows\System\ssQVpbC.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\XalwjaX.exe
  C:\Windows\System\XalwjaX.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\JscTagu.exe
  C:\Windows\System\JscTagu.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\GnEOtvm.exe
  C:\Windows\System\GnEOtvm.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\IGkaybT.exe
  C:\Windows\System\IGkaybT.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\CCEHOWR.exe
  C:\Windows\System\CCEHOWR.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\HzMzsOg.exe
  C:\Windows\System\HzMzsOg.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\XcefFzg.exe
  C:\Windows\System\XcefFzg.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\zaSjjcc.exe
  C:\Windows\System\zaSjjcc.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\ZWKhqGR.exe
  C:\Windows\System\ZWKhqGR.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\sZZtDiQ.exe
  C:\Windows\System\sZZtDiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\yklDuKM.exe
  C:\Windows\System\yklDuKM.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\KTueZOo.exe
  C:\Windows\System\KTueZOo.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\cgudfgY.exe
  C:\Windows\System\cgudfgY.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\jJuJsTt.exe
  C:\Windows\System\jJuJsTt.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\qqCherE.exe
  C:\Windows\System\qqCherE.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\aAFDTmj.exe
  C:\Windows\System\aAFDTmj.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\PuyYDKG.exe
  C:\Windows\System\PuyYDKG.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\orSYGZS.exe
  C:\Windows\System\orSYGZS.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ANYyDLU.exe
  C:\Windows\System\ANYyDLU.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\PAGXOSL.exe
  C:\Windows\System\PAGXOSL.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\cikSKgc.exe
  C:\Windows\System\cikSKgc.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\EqZwONh.exe
  C:\Windows\System\EqZwONh.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\dfnJYwX.exe
  C:\Windows\System\dfnJYwX.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\CzBsRsD.exe
  C:\Windows\System\CzBsRsD.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\qPajQAn.exe
  C:\Windows\System\qPajQAn.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\TcxlGHZ.exe
  C:\Windows\System\TcxlGHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\qhVKfSj.exe
  C:\Windows\System\qhVKfSj.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\vEvhdzP.exe
  C:\Windows\System\vEvhdzP.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\OPUQgxa.exe
  C:\Windows\System\OPUQgxa.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\XOgRqUx.exe
  C:\Windows\System\XOgRqUx.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\VKqUEUK.exe
  C:\Windows\System\VKqUEUK.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\wtBUGgh.exe
  C:\Windows\System\wtBUGgh.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ZhUeEUb.exe
  C:\Windows\System\ZhUeEUb.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\rKHJiTi.exe
  C:\Windows\System\rKHJiTi.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\FGoPsut.exe
  C:\Windows\System\FGoPsut.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\uzHslzQ.exe
  C:\Windows\System\uzHslzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\TAWeCyU.exe
  C:\Windows\System\TAWeCyU.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\lWAQXYR.exe
  C:\Windows\System\lWAQXYR.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\duGpVGh.exe
  C:\Windows\System\duGpVGh.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ycMuSOC.exe
  C:\Windows\System\ycMuSOC.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\mhcoILh.exe
  C:\Windows\System\mhcoILh.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\jvLvmzq.exe
  C:\Windows\System\jvLvmzq.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\mAPCmFp.exe
  C:\Windows\System\mAPCmFp.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\BSLAmdO.exe
  C:\Windows\System\BSLAmdO.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\TQMlBtl.exe
  C:\Windows\System\TQMlBtl.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\aoiRRoj.exe
  C:\Windows\System\aoiRRoj.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\kyMVkWz.exe
  C:\Windows\System\kyMVkWz.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\Mnkluxq.exe
  C:\Windows\System\Mnkluxq.exe
  2⤵
  PID:540
- C:\Windows\System\MChLOdo.exe
  C:\Windows\System\MChLOdo.exe
  2⤵
  PID:2820
- C:\Windows\System\nCNavIv.exe
  C:\Windows\System\nCNavIv.exe
  2⤵
  PID:2816
- C:\Windows\System\ANFZLqy.exe
  C:\Windows\System\ANFZLqy.exe
  2⤵
  PID:1800
- C:\Windows\System\xmWhJGk.exe
  C:\Windows\System\xmWhJGk.exe
  2⤵
  PID:1804
- C:\Windows\System\LKLcBqf.exe
  C:\Windows\System\LKLcBqf.exe
  2⤵
  PID:2404
- C:\Windows\System\MiDGEvy.exe
  C:\Windows\System\MiDGEvy.exe
  2⤵
  PID:2456
- C:\Windows\System\PExuFhd.exe
  C:\Windows\System\PExuFhd.exe
  2⤵
  PID:1672
- C:\Windows\System\PliJAWl.exe
  C:\Windows\System\PliJAWl.exe
  2⤵
  PID:312
- C:\Windows\System\GSDNwQq.exe
  C:\Windows\System\GSDNwQq.exe
  2⤵
  PID:1284
- C:\Windows\System\CdicSZM.exe
  C:\Windows\System\CdicSZM.exe
  2⤵
  PID:412
- C:\Windows\System\qMbxQLI.exe
  C:\Windows\System\qMbxQLI.exe
  2⤵
  PID:2640
- C:\Windows\System\JocAJTn.exe
  C:\Windows\System\JocAJTn.exe
  2⤵
  PID:772
- C:\Windows\System\WlSInBe.exe
  C:\Windows\System\WlSInBe.exe
  2⤵
  PID:1612
- C:\Windows\System\CdoWTNt.exe
  C:\Windows\System\CdoWTNt.exe
  2⤵
  PID:568
- C:\Windows\System\pNXqlay.exe
  C:\Windows\System\pNXqlay.exe
  2⤵
  PID:2708
- C:\Windows\System\NbOOdBh.exe
  C:\Windows\System\NbOOdBh.exe
  2⤵
  PID:1992
- C:\Windows\System\BfYnPtj.exe
  C:\Windows\System\BfYnPtj.exe
  2⤵
  PID:2340
- C:\Windows\System\igPiLIj.exe
  C:\Windows\System\igPiLIj.exe
  2⤵
  PID:2844
- C:\Windows\System\suckkpQ.exe
  C:\Windows\System\suckkpQ.exe
  2⤵
  PID:1728
- C:\Windows\System\xshrBvO.exe
  C:\Windows\System\xshrBvO.exe
  2⤵
  PID:320
- C:\Windows\System\lzsEQCk.exe
  C:\Windows\System\lzsEQCk.exe
  2⤵
  PID:1536
- C:\Windows\System\dKEqCUZ.exe
  C:\Windows\System\dKEqCUZ.exe
  2⤵
  PID:2572
- C:\Windows\System\GNVrqIO.exe
  C:\Windows\System\GNVrqIO.exe
  2⤵
  PID:636
- C:\Windows\System\mTsGskN.exe
  C:\Windows\System\mTsGskN.exe
  2⤵
  PID:1660
- C:\Windows\System\xdbPwTU.exe
  C:\Windows\System\xdbPwTU.exe
  2⤵
  PID:2804
- C:\Windows\System\SoxNGRw.exe
  C:\Windows\System\SoxNGRw.exe
  2⤵
  PID:2748
- C:\Windows\System\WkthSUH.exe
  C:\Windows\System\WkthSUH.exe
  2⤵
  PID:1308
- C:\Windows\System\ihBJWmy.exe
  C:\Windows\System\ihBJWmy.exe
  2⤵
  PID:2140
- C:\Windows\System\kyknGgI.exe
  C:\Windows\System\kyknGgI.exe
  2⤵
  PID:1668
- C:\Windows\System\zPsuYTg.exe
  C:\Windows\System\zPsuYTg.exe
  2⤵
  PID:800
- C:\Windows\System\FEEMKpo.exe
  C:\Windows\System\FEEMKpo.exe
  2⤵
  PID:1016
- C:\Windows\System\kJxgplk.exe
  C:\Windows\System\kJxgplk.exe
  2⤵
  PID:392
- C:\Windows\System\IAXyiUU.exe
  C:\Windows\System\IAXyiUU.exe
  2⤵
  PID:1104
- C:\Windows\System\JONkADL.exe
  C:\Windows\System\JONkADL.exe
  2⤵
  PID:2044
- C:\Windows\System\fAQXSUS.exe
  C:\Windows\System\fAQXSUS.exe
  2⤵
  PID:2896
- C:\Windows\System\FJXDbZv.exe
  C:\Windows\System\FJXDbZv.exe
  2⤵
  PID:1920
- C:\Windows\System\KVZQnlc.exe
  C:\Windows\System\KVZQnlc.exe
  2⤵
  PID:472
- C:\Windows\System\BYOBwFZ.exe
  C:\Windows\System\BYOBwFZ.exe
  2⤵
  PID:2308
- C:\Windows\System\TtcZgpE.exe
  C:\Windows\System\TtcZgpE.exe
  2⤵
  PID:2004
- C:\Windows\System\MQpkSSD.exe
  C:\Windows\System\MQpkSSD.exe
  2⤵
  PID:2592
- C:\Windows\System\OfFVSpO.exe
  C:\Windows\System\OfFVSpO.exe
  2⤵
  PID:1780
- C:\Windows\System\wygpFmg.exe
  C:\Windows\System\wygpFmg.exe
  2⤵
  PID:2260
- C:\Windows\System\RYuBDCJ.exe
  C:\Windows\System\RYuBDCJ.exe
  2⤵
  PID:964
- C:\Windows\System\pXkjVyH.exe
  C:\Windows\System\pXkjVyH.exe
  2⤵
  PID:2940
- C:\Windows\System\lcQjvTU.exe
  C:\Windows\System\lcQjvTU.exe
  2⤵
  PID:2624
- C:\Windows\System\BigyxZN.exe
  C:\Windows\System\BigyxZN.exe
  2⤵
  PID:784
- C:\Windows\System\FsMlHIn.exe
  C:\Windows\System\FsMlHIn.exe
  2⤵
  PID:1916
- C:\Windows\System\yOQMNyC.exe
  C:\Windows\System\yOQMNyC.exe
  2⤵
  PID:1564
- C:\Windows\System\ahENMAZ.exe
  C:\Windows\System\ahENMAZ.exe
  2⤵
  PID:2712
- C:\Windows\System\augQXEx.exe
  C:\Windows\System\augQXEx.exe
  2⤵
  PID:2036
- C:\Windows\System\hLBQCcJ.exe
  C:\Windows\System\hLBQCcJ.exe
  2⤵
  PID:2872
- C:\Windows\System\YHoniVH.exe
  C:\Windows\System\YHoniVH.exe
  2⤵
  PID:2024
- C:\Windows\System\pjmCMVE.exe
  C:\Windows\System\pjmCMVE.exe
  2⤵
  PID:1040
- C:\Windows\System\mZWfinl.exe
  C:\Windows\System\mZWfinl.exe
  2⤵
  PID:2196
- C:\Windows\System\XfulOTG.exe
  C:\Windows\System\XfulOTG.exe
  2⤵
  PID:2228
- C:\Windows\System\ESIGMwy.exe
  C:\Windows\System\ESIGMwy.exe
  2⤵
  PID:2876
- C:\Windows\System\HuTRYOx.exe
  C:\Windows\System\HuTRYOx.exe
  2⤵
  PID:1048
- C:\Windows\System\lgHkXVO.exe
  C:\Windows\System\lgHkXVO.exe
  2⤵
  PID:2996
- C:\Windows\System\eMRZbVQ.exe
  C:\Windows\System\eMRZbVQ.exe
  2⤵
  PID:2580
- C:\Windows\System\HQEDMKf.exe
  C:\Windows\System\HQEDMKf.exe
  2⤵
  PID:2272
- C:\Windows\System\bbYoGQg.exe
  C:\Windows\System\bbYoGQg.exe
  2⤵
  PID:2548
- C:\Windows\System\DkFJUYk.exe
  C:\Windows\System\DkFJUYk.exe
  2⤵
  PID:1740
- C:\Windows\System\wvlavnr.exe
  C:\Windows\System\wvlavnr.exe
  2⤵
  PID:1784
- C:\Windows\System\AmMRvUh.exe
  C:\Windows\System\AmMRvUh.exe
  2⤵
  PID:1200
- C:\Windows\System\TMbdNgM.exe
  C:\Windows\System\TMbdNgM.exe
  2⤵
  PID:3052
- C:\Windows\System\mkBGRWD.exe
  C:\Windows\System\mkBGRWD.exe
  2⤵
  PID:3076
- C:\Windows\System\ZfJBtDF.exe
  C:\Windows\System\ZfJBtDF.exe
  2⤵
  PID:3092
- C:\Windows\System\QFPfrPz.exe
  C:\Windows\System\QFPfrPz.exe
  2⤵
  PID:3112
- C:\Windows\System\PMIFRtl.exe
  C:\Windows\System\PMIFRtl.exe
  2⤵
  PID:3148
- C:\Windows\System\ZcvsmsJ.exe
  C:\Windows\System\ZcvsmsJ.exe
  2⤵
  PID:3164
- C:\Windows\System\QtvFIiY.exe
  C:\Windows\System\QtvFIiY.exe
  2⤵
  PID:3180
- C:\Windows\System\ImIDFFZ.exe
  C:\Windows\System\ImIDFFZ.exe
  2⤵
  PID:3196
- C:\Windows\System\SwyWInN.exe
  C:\Windows\System\SwyWInN.exe
  2⤵
  PID:3216
- C:\Windows\System\QjEGbnT.exe
  C:\Windows\System\QjEGbnT.exe
  2⤵
  PID:3232
- C:\Windows\System\RfLJxZd.exe
  C:\Windows\System\RfLJxZd.exe
  2⤵
  PID:3248
- C:\Windows\System\BreSKir.exe
  C:\Windows\System\BreSKir.exe
  2⤵
  PID:3264
- C:\Windows\System\FwJZfxv.exe
  C:\Windows\System\FwJZfxv.exe
  2⤵
  PID:3280
- C:\Windows\System\lHoagJz.exe
  C:\Windows\System\lHoagJz.exe
  2⤵
  PID:3296
- C:\Windows\System\WpxtpYv.exe
  C:\Windows\System\WpxtpYv.exe
  2⤵
  PID:3312
- C:\Windows\System\FvVlubc.exe
  C:\Windows\System\FvVlubc.exe
  2⤵
  PID:3332
- C:\Windows\System\ZnNivhA.exe
  C:\Windows\System\ZnNivhA.exe
  2⤵
  PID:3348
- C:\Windows\System\MXhZASB.exe
  C:\Windows\System\MXhZASB.exe
  2⤵
  PID:3364
- C:\Windows\System\LuhcBvB.exe
  C:\Windows\System\LuhcBvB.exe
  2⤵
  PID:3384
- C:\Windows\System\nsBYEkV.exe
  C:\Windows\System\nsBYEkV.exe
  2⤵
  PID:3468
- C:\Windows\System\FNkfkQF.exe
  C:\Windows\System\FNkfkQF.exe
  2⤵
  PID:3492
- C:\Windows\System\DdPLSVl.exe
  C:\Windows\System\DdPLSVl.exe
  2⤵
  PID:3528
- C:\Windows\System\gSmLWGd.exe
  C:\Windows\System\gSmLWGd.exe
  2⤵
  PID:3564
- C:\Windows\System\ACaHrUh.exe
  C:\Windows\System\ACaHrUh.exe
  2⤵
  PID:3588
- C:\Windows\System\zLSNeYx.exe
  C:\Windows\System\zLSNeYx.exe
  2⤵
  PID:3608
- C:\Windows\System\RngdlOF.exe
  C:\Windows\System\RngdlOF.exe
  2⤵
  PID:3624
- C:\Windows\System\VsVwJVt.exe
  C:\Windows\System\VsVwJVt.exe
  2⤵
  PID:3640
- C:\Windows\System\nXTYrXi.exe
  C:\Windows\System\nXTYrXi.exe
  2⤵
  PID:3660
- C:\Windows\System\oGGXAEe.exe
  C:\Windows\System\oGGXAEe.exe
  2⤵
  PID:3680
- C:\Windows\System\ChUteiG.exe
  C:\Windows\System\ChUteiG.exe
  2⤵
  PID:3700
- C:\Windows\System\euorOAE.exe
  C:\Windows\System\euorOAE.exe
  2⤵
  PID:3724
- C:\Windows\System\brtgIUI.exe
  C:\Windows\System\brtgIUI.exe
  2⤵
  PID:3744
- C:\Windows\System\eFCMxgD.exe
  C:\Windows\System\eFCMxgD.exe
  2⤵
  PID:3760
- C:\Windows\System\TXXUGup.exe
  C:\Windows\System\TXXUGup.exe
  2⤵
  PID:3784
- C:\Windows\System\JhgZHEH.exe
  C:\Windows\System\JhgZHEH.exe
  2⤵
  PID:3804
- C:\Windows\System\ZCIGbYT.exe
  C:\Windows\System\ZCIGbYT.exe
  2⤵
  PID:3824
- C:\Windows\System\rNOPSQz.exe
  C:\Windows\System\rNOPSQz.exe
  2⤵
  PID:3848
- C:\Windows\System\yrQDzQY.exe
  C:\Windows\System\yrQDzQY.exe
  2⤵
  PID:3864
- C:\Windows\System\WOSYjuF.exe
  C:\Windows\System\WOSYjuF.exe
  2⤵
  PID:3884
- C:\Windows\System\ACObJLu.exe
  C:\Windows\System\ACObJLu.exe
  2⤵
  PID:3900
- C:\Windows\System\nzKoIzZ.exe
  C:\Windows\System\nzKoIzZ.exe
  2⤵
  PID:3924
- C:\Windows\System\GqZxHjd.exe
  C:\Windows\System\GqZxHjd.exe
  2⤵
  PID:3944
- C:\Windows\System\zMUqJty.exe
  C:\Windows\System\zMUqJty.exe
  2⤵
  PID:3964
- C:\Windows\System\pxDxyXN.exe
  C:\Windows\System\pxDxyXN.exe
  2⤵
  PID:3984
- C:\Windows\System\cfpJgNR.exe
  C:\Windows\System\cfpJgNR.exe
  2⤵
  PID:4004
- C:\Windows\System\CiQuJhg.exe
  C:\Windows\System\CiQuJhg.exe
  2⤵
  PID:4020
- C:\Windows\System\DudSROI.exe
  C:\Windows\System\DudSROI.exe
  2⤵
  PID:4044
- C:\Windows\System\MkrmwzO.exe
  C:\Windows\System\MkrmwzO.exe
  2⤵
  PID:4064
- C:\Windows\System\dpfhkBs.exe
  C:\Windows\System\dpfhkBs.exe
  2⤵
  PID:4084
- C:\Windows\System\bsfboCd.exe
  C:\Windows\System\bsfboCd.exe
  2⤵
  PID:888
- C:\Windows\System\NKuMlVb.exe
  C:\Windows\System\NKuMlVb.exe
  2⤵
  PID:2428
- C:\Windows\System\bNreyda.exe
  C:\Windows\System\bNreyda.exe
  2⤵
  PID:2600
- C:\Windows\System\aMyYbLL.exe
  C:\Windows\System\aMyYbLL.exe
  2⤵
  PID:1956
- C:\Windows\System\UNchOSU.exe
  C:\Windows\System\UNchOSU.exe
  2⤵
  PID:1560
- C:\Windows\System\PucdqKc.exe
  C:\Windows\System\PucdqKc.exe
  2⤵
  PID:3128
- C:\Windows\System\tVBksdd.exe
  C:\Windows\System\tVBksdd.exe
  2⤵
  PID:3136
- C:\Windows\System\ZFupUCm.exe
  C:\Windows\System\ZFupUCm.exe
  2⤵
  PID:3176
- C:\Windows\System\tEZKQkU.exe
  C:\Windows\System\tEZKQkU.exe
  2⤵
  PID:3276
- C:\Windows\System\dlXuOwC.exe
  C:\Windows\System\dlXuOwC.exe
  2⤵
  PID:2172
- C:\Windows\System\DFbHJTx.exe
  C:\Windows\System\DFbHJTx.exe
  2⤵
  PID:3308
- C:\Windows\System\nfReoRR.exe
  C:\Windows\System\nfReoRR.exe
  2⤵
  PID:776
- C:\Windows\System\UhAHISa.exe
  C:\Windows\System\UhAHISa.exe
  2⤵
  PID:3476
- C:\Windows\System\GqkTtkD.exe
  C:\Windows\System\GqkTtkD.exe
  2⤵
  PID:3224
- C:\Windows\System\gPxMdBO.exe
  C:\Windows\System\gPxMdBO.exe
  2⤵
  PID:1028
- C:\Windows\System\MsLAsUx.exe
  C:\Windows\System\MsLAsUx.exe
  2⤵
  PID:2284
- C:\Windows\System\HVnaPqf.exe
  C:\Windows\System\HVnaPqf.exe
  2⤵
  PID:3396
- C:\Windows\System\RSRbpjH.exe
  C:\Windows\System\RSRbpjH.exe
  2⤵
  PID:2232
- C:\Windows\System\pkScCVw.exe
  C:\Windows\System\pkScCVw.exe
  2⤵
  PID:3100
- C:\Windows\System\GeyfrdV.exe
  C:\Windows\System\GeyfrdV.exe
  2⤵
  PID:3552
- C:\Windows\System\FLbTngn.exe
  C:\Windows\System\FLbTngn.exe
  2⤵
  PID:3192
- C:\Windows\System\euvdfoE.exe
  C:\Windows\System\euvdfoE.exe
  2⤵
  PID:3324
- C:\Windows\System\xZbmowO.exe
  C:\Windows\System\xZbmowO.exe
  2⤵
  PID:3424
- C:\Windows\System\YhXHYoV.exe
  C:\Windows\System\YhXHYoV.exe
  2⤵
  PID:3448
- C:\Windows\System\DJNorrg.exe
  C:\Windows\System\DJNorrg.exe
  2⤵
  PID:3464
- C:\Windows\System\APvMvJp.exe
  C:\Windows\System\APvMvJp.exe
  2⤵
  PID:3508
- C:\Windows\System\DVHoFnm.exe
  C:\Windows\System\DVHoFnm.exe
  2⤵
  PID:1980
- C:\Windows\System\ofsURgH.exe
  C:\Windows\System\ofsURgH.exe
  2⤵
  PID:3520
- C:\Windows\System\EXgRLUv.exe
  C:\Windows\System\EXgRLUv.exe
  2⤵
  PID:3576
- C:\Windows\System\VFFIZsx.exe
  C:\Windows\System\VFFIZsx.exe
  2⤵
  PID:3580
- C:\Windows\System\NrNaQHc.exe
  C:\Windows\System\NrNaQHc.exe
  2⤵
  PID:3620
- C:\Windows\System\uixpXLl.exe
  C:\Windows\System\uixpXLl.exe
  2⤵
  PID:3648
- C:\Windows\System\zpKkhxX.exe
  C:\Windows\System\zpKkhxX.exe
  2⤵
  PID:3672
- C:\Windows\System\xHfLHkR.exe
  C:\Windows\System\xHfLHkR.exe
  2⤵
  PID:3688
- C:\Windows\System\jwwCePU.exe
  C:\Windows\System\jwwCePU.exe
  2⤵
  PID:3752
- C:\Windows\System\QIFImWZ.exe
  C:\Windows\System\QIFImWZ.exe
  2⤵
  PID:3736
- C:\Windows\System\YismTpI.exe
  C:\Windows\System\YismTpI.exe
  2⤵
  PID:3776
- C:\Windows\System\KNlIiWB.exe
  C:\Windows\System\KNlIiWB.exe
  2⤵
  PID:1336
- C:\Windows\System\pShWkTj.exe
  C:\Windows\System\pShWkTj.exe
  2⤵
  PID:3796
- C:\Windows\System\eYvAcjl.exe
  C:\Windows\System\eYvAcjl.exe
  2⤵
  PID:3820
- C:\Windows\System\SFORDnj.exe
  C:\Windows\System\SFORDnj.exe
  2⤵
  PID:1852
- C:\Windows\System\NulyIxe.exe
  C:\Windows\System\NulyIxe.exe
  2⤵
  PID:3836
- C:\Windows\System\pnQzEqW.exe
  C:\Windows\System\pnQzEqW.exe
  2⤵
  PID:3860
- C:\Windows\System\PXNdPLC.exe
  C:\Windows\System\PXNdPLC.exe
  2⤵
  PID:3892
- C:\Windows\System\tpPmCwK.exe
  C:\Windows\System\tpPmCwK.exe
  2⤵
  PID:3916
- C:\Windows\System\AnqfKMF.exe
  C:\Windows\System\AnqfKMF.exe
  2⤵
  PID:3920
- C:\Windows\System\oOSOFBT.exe
  C:\Windows\System\oOSOFBT.exe
  2⤵
  PID:3940
- C:\Windows\System\etjzHtm.exe
  C:\Windows\System\etjzHtm.exe
  2⤵
  PID:3972
- C:\Windows\System\nwrUYGk.exe
  C:\Windows\System\nwrUYGk.exe
  2⤵
  PID:2680
- C:\Windows\System\XChmKjO.exe
  C:\Windows\System\XChmKjO.exe
  2⤵
  PID:4012
- C:\Windows\System\nmnJPpD.exe
  C:\Windows\System\nmnJPpD.exe
  2⤵
  PID:4036
- C:\Windows\System\sLoNSrt.exe
  C:\Windows\System\sLoNSrt.exe
  2⤵
  PID:2416
- C:\Windows\System\mvDEMBN.exe
  C:\Windows\System\mvDEMBN.exe
  2⤵
  PID:4076
- C:\Windows\System\PCMzyNH.exe
  C:\Windows\System\PCMzyNH.exe
  2⤵
  PID:1824
- C:\Windows\System\hJfcZYn.exe
  C:\Windows\System\hJfcZYn.exe
  2⤵
  PID:452
- C:\Windows\System\eqHWByx.exe
  C:\Windows\System\eqHWByx.exe
  2⤵
  PID:3000
- C:\Windows\System\DduVCdJ.exe
  C:\Windows\System\DduVCdJ.exe
  2⤵
  PID:2188
- C:\Windows\System\SRrWUXV.exe
  C:\Windows\System\SRrWUXV.exe
  2⤵
  PID:2016
- C:\Windows\System\qjFXZcn.exe
  C:\Windows\System\qjFXZcn.exe
  2⤵
  PID:1480
- C:\Windows\System\PPWpiKk.exe
  C:\Windows\System\PPWpiKk.exe
  2⤵
  PID:3172
- C:\Windows\System\DMpzXoS.exe
  C:\Windows\System\DMpzXoS.exe
  2⤵
  PID:3240
- C:\Windows\System\PmUTfUa.exe
  C:\Windows\System\PmUTfUa.exe
  2⤵
  PID:2028
- C:\Windows\System\SYnuyDU.exe
  C:\Windows\System\SYnuyDU.exe
  2⤵
  PID:3344
- C:\Windows\System\Fskcrvv.exe
  C:\Windows\System\Fskcrvv.exe
  2⤵
  PID:3372
- C:\Windows\System\ROxDEFe.exe
  C:\Windows\System\ROxDEFe.exe
  2⤵
  PID:3480
- C:\Windows\System\JmMRSuo.exe
  C:\Windows\System\JmMRSuo.exe
  2⤵
  PID:600
- C:\Windows\System\YbMmqGa.exe
  C:\Windows\System\YbMmqGa.exe
  2⤵
  PID:1960
- C:\Windows\System\KVHsfxA.exe
  C:\Windows\System\KVHsfxA.exe
  2⤵
  PID:2328
- C:\Windows\System\tjfdVrC.exe
  C:\Windows\System\tjfdVrC.exe
  2⤵
  PID:2952
- C:\Windows\System\RdBmuqy.exe
  C:\Windows\System\RdBmuqy.exe
  2⤵
  PID:3104
- C:\Windows\System\vFKpuhr.exe
  C:\Windows\System\vFKpuhr.exe
  2⤵
  PID:2764
- C:\Windows\System\dsziLAj.exe
  C:\Windows\System\dsziLAj.exe
  2⤵
  PID:3256
- C:\Windows\System\zoKxMsC.exe
  C:\Windows\System\zoKxMsC.exe
  2⤵
  PID:3360
- C:\Windows\System\knWtPtW.exe
  C:\Windows\System\knWtPtW.exe
  2⤵
  PID:3444
- C:\Windows\System\RhtudSX.exe
  C:\Windows\System\RhtudSX.exe
  2⤵
  PID:2240
- C:\Windows\System\KACpgaF.exe
  C:\Windows\System\KACpgaF.exe
  2⤵
  PID:1640
- C:\Windows\System\hzxrnAo.exe
  C:\Windows\System\hzxrnAo.exe
  2⤵
  PID:3524
- C:\Windows\System\RRCNijd.exe
  C:\Windows\System\RRCNijd.exe
  2⤵
  PID:3656
- C:\Windows\System\cJetZqq.exe
  C:\Windows\System\cJetZqq.exe
  2⤵
  PID:3756
- C:\Windows\System\TPeyChj.exe
  C:\Windows\System\TPeyChj.exe
  2⤵
  PID:876
- C:\Windows\System\ClJXcuA.exe
  C:\Windows\System\ClJXcuA.exe
  2⤵
  PID:4112
- C:\Windows\System\lerzmOc.exe
  C:\Windows\System\lerzmOc.exe
  2⤵
  PID:4128
- C:\Windows\System\XZByjUV.exe
  C:\Windows\System\XZByjUV.exe
  2⤵
  PID:4144
- C:\Windows\System\wGIsiPI.exe
  C:\Windows\System\wGIsiPI.exe
  2⤵
  PID:4160
- C:\Windows\System\toApkro.exe
  C:\Windows\System\toApkro.exe
  2⤵
  PID:4176
- C:\Windows\System\upVounA.exe
  C:\Windows\System\upVounA.exe
  2⤵
  PID:4192
- C:\Windows\System\VlOMZej.exe
  C:\Windows\System\VlOMZej.exe
  2⤵
  PID:4208
- C:\Windows\System\UqOLLlm.exe
  C:\Windows\System\UqOLLlm.exe
  2⤵
  PID:4228
- C:\Windows\System\lWoCXjh.exe
  C:\Windows\System\lWoCXjh.exe
  2⤵
  PID:4244
- C:\Windows\System\mxcczNc.exe
  C:\Windows\System\mxcczNc.exe
  2⤵
  PID:4268
- C:\Windows\System\vmKWxtT.exe
  C:\Windows\System\vmKWxtT.exe
  2⤵
  PID:4284
- C:\Windows\System\ekPIMyB.exe
  C:\Windows\System\ekPIMyB.exe
  2⤵
  PID:4304
- C:\Windows\System\rbqhADu.exe
  C:\Windows\System\rbqhADu.exe
  2⤵
  PID:4320
- C:\Windows\System\BHEcFxw.exe
  C:\Windows\System\BHEcFxw.exe
  2⤵
  PID:4336
- C:\Windows\System\ESxKRvs.exe
  C:\Windows\System\ESxKRvs.exe
  2⤵
  PID:4352
- C:\Windows\System\xpMFOFP.exe
  C:\Windows\System\xpMFOFP.exe
  2⤵
  PID:4368
- C:\Windows\System\EaVgBce.exe
  C:\Windows\System\EaVgBce.exe
  2⤵
  PID:4384
- C:\Windows\System\budbvXH.exe
  C:\Windows\System\budbvXH.exe
  2⤵
  PID:4400
- C:\Windows\System\FwpjneM.exe
  C:\Windows\System\FwpjneM.exe
  2⤵
  PID:4616
- C:\Windows\System\mgWguHk.exe
  C:\Windows\System\mgWguHk.exe
  2⤵
  PID:4680
- C:\Windows\System\xwVPawt.exe
  C:\Windows\System\xwVPawt.exe
  2⤵
  PID:4708
- C:\Windows\System\zbwISaV.exe
  C:\Windows\System\zbwISaV.exe
  2⤵
  PID:4728
- C:\Windows\System\iHdguEc.exe
  C:\Windows\System\iHdguEc.exe
  2⤵
  PID:4744
- C:\Windows\System\PhQPpPD.exe
  C:\Windows\System\PhQPpPD.exe
  2⤵
  PID:4760
- C:\Windows\System\dtaVRCZ.exe
  C:\Windows\System\dtaVRCZ.exe
  2⤵
  PID:4776
- C:\Windows\System\IBSiyFV.exe
  C:\Windows\System\IBSiyFV.exe
  2⤵
  PID:4792
- C:\Windows\System\pzfPIdO.exe
  C:\Windows\System\pzfPIdO.exe
  2⤵
  PID:4808
- C:\Windows\System\bExVfth.exe
  C:\Windows\System\bExVfth.exe
  2⤵
  PID:4824
- C:\Windows\System\oFMpzyg.exe
  C:\Windows\System\oFMpzyg.exe
  2⤵
  PID:4844
- C:\Windows\System\gjwaOhz.exe
  C:\Windows\System\gjwaOhz.exe
  2⤵
  PID:4860
- C:\Windows\System\eHIWoRY.exe
  C:\Windows\System\eHIWoRY.exe
  2⤵
  PID:4876
- C:\Windows\System\DcAJtKa.exe
  C:\Windows\System\DcAJtKa.exe
  2⤵
  PID:4892
- C:\Windows\System\RotBxrL.exe
  C:\Windows\System\RotBxrL.exe
  2⤵
  PID:4908
- C:\Windows\System\hRuVieg.exe
  C:\Windows\System\hRuVieg.exe
  2⤵
  PID:4924
- C:\Windows\System\yJIhrjJ.exe
  C:\Windows\System\yJIhrjJ.exe
  2⤵
  PID:4940
- C:\Windows\System\YteZYMZ.exe
  C:\Windows\System\YteZYMZ.exe
  2⤵
  PID:4956
- C:\Windows\System\akuSHCd.exe
  C:\Windows\System\akuSHCd.exe
  2⤵
  PID:4972
- C:\Windows\System\GhkvpQi.exe
  C:\Windows\System\GhkvpQi.exe
  2⤵
  PID:4988
- C:\Windows\System\tVdvqcG.exe
  C:\Windows\System\tVdvqcG.exe
  2⤵
  PID:5004
- C:\Windows\System\aZhtuqu.exe
  C:\Windows\System\aZhtuqu.exe
  2⤵
  PID:5020
- C:\Windows\System\VMEeHEX.exe
  C:\Windows\System\VMEeHEX.exe
  2⤵
  PID:5036
- C:\Windows\System\PPSvNkT.exe
  C:\Windows\System\PPSvNkT.exe
  2⤵
  PID:5052
- C:\Windows\System\cHmtADC.exe
  C:\Windows\System\cHmtADC.exe
  2⤵
  PID:5072
- C:\Windows\System\BpEfudq.exe
  C:\Windows\System\BpEfudq.exe
  2⤵
  PID:5088
- C:\Windows\System\gvvvaWj.exe
  C:\Windows\System\gvvvaWj.exe
  2⤵
  PID:5104
- C:\Windows\System\AqGtkAx.exe
  C:\Windows\System\AqGtkAx.exe
  2⤵
  PID:3856
- C:\Windows\System\PEMNhqp.exe
  C:\Windows\System\PEMNhqp.exe
  2⤵
  PID:3980
- C:\Windows\System\DWssSij.exe
  C:\Windows\System\DWssSij.exe
  2⤵
  PID:4040
- C:\Windows\System\hjBGMSv.exe
  C:\Windows\System\hjBGMSv.exe
  2⤵
  PID:2356
- C:\Windows\System\ZvLRRRv.exe
  C:\Windows\System\ZvLRRRv.exe
  2⤵
  PID:3208
- C:\Windows\System\aHQOKgv.exe
  C:\Windows\System\aHQOKgv.exe
  2⤵
  PID:3560
- C:\Windows\System\fQBvmdw.exe
  C:\Windows\System\fQBvmdw.exe
  2⤵
  PID:3288
- C:\Windows\System\GFuMxYH.exe
  C:\Windows\System\GFuMxYH.exe
  2⤵
  PID:4200
- C:\Windows\System\sfZfanA.exe
  C:\Windows\System\sfZfanA.exe
  2⤵
  PID:4240
- C:\Windows\System\cvUHVwL.exe
  C:\Windows\System\cvUHVwL.exe
  2⤵
  PID:3432
- C:\Windows\System\DCCHKmJ.exe
  C:\Windows\System\DCCHKmJ.exe
  2⤵
  PID:4348
- C:\Windows\System\zatLwpQ.exe
  C:\Windows\System\zatLwpQ.exe
  2⤵
  PID:3604
- C:\Windows\System\LHCGNao.exe
  C:\Windows\System\LHCGNao.exe
  2⤵
  PID:4080
- C:\Windows\System\QJhVyGy.exe
  C:\Windows\System\QJhVyGy.exe
  2⤵
  PID:2008
- C:\Windows\System\JPEidZr.exe
  C:\Windows\System\JPEidZr.exe
  2⤵
  PID:4448
- C:\Windows\System\qndpmxM.exe
  C:\Windows\System\qndpmxM.exe
  2⤵
  PID:4460
- C:\Windows\System\xOjuUzL.exe
  C:\Windows\System\xOjuUzL.exe
  2⤵
  PID:2720
- C:\Windows\System\nUwoSao.exe
  C:\Windows\System\nUwoSao.exe
  2⤵
  PID:4480
- C:\Windows\System\LaQdfwR.exe
  C:\Windows\System\LaQdfwR.exe
  2⤵
  PID:3544
- C:\Windows\System\yNhnJUB.exe
  C:\Windows\System\yNhnJUB.exe
  2⤵
  PID:2584
- C:\Windows\System\gfgBVAj.exe
  C:\Windows\System\gfgBVAj.exe
  2⤵
  PID:3692
- C:\Windows\System\DamrBEL.exe
  C:\Windows\System\DamrBEL.exe
  2⤵
  PID:2136
- C:\Windows\System\qnXjWIl.exe
  C:\Windows\System\qnXjWIl.exe
  2⤵
  PID:3768
- C:\Windows\System\kmBkoGf.exe
  C:\Windows\System\kmBkoGf.exe
  2⤵
  PID:4152
- C:\Windows\System\YcnEhvx.exe
  C:\Windows\System\YcnEhvx.exe
  2⤵
  PID:4256
- C:\Windows\System\JROIMUG.exe
  C:\Windows\System\JROIMUG.exe
  2⤵
  PID:4360
- C:\Windows\System\JWwQSEb.exe
  C:\Windows\System\JWwQSEb.exe
  2⤵
  PID:1868
- C:\Windows\System\zKSYzlX.exe
  C:\Windows\System\zKSYzlX.exe
  2⤵
  PID:4496
- C:\Windows\System\HrmDhIF.exe
  C:\Windows\System\HrmDhIF.exe
  2⤵
  PID:4560
- C:\Windows\System\lOIBQRg.exe
  C:\Windows\System\lOIBQRg.exe
  2⤵
  PID:4508
- C:\Windows\System\sOzzgUW.exe
  C:\Windows\System\sOzzgUW.exe
  2⤵
  PID:4408
- C:\Windows\System\RxsoqEg.exe
  C:\Windows\System\RxsoqEg.exe
  2⤵
  PID:4688
- C:\Windows\System\jkFrgrX.exe
  C:\Windows\System\jkFrgrX.exe
  2⤵
  PID:4692
- C:\Windows\System\TVGrDiC.exe
  C:\Windows\System\TVGrDiC.exe
  2⤵
  PID:4704
- C:\Windows\System\GWppAxl.exe
  C:\Windows\System\GWppAxl.exe
  2⤵
  PID:4772
- C:\Windows\System\XburZda.exe
  C:\Windows\System\XburZda.exe
  2⤵
  PID:4968
- C:\Windows\System\Yhkedas.exe
  C:\Windows\System\Yhkedas.exe
  2⤵
  PID:5032
- C:\Windows\System\keglRzZ.exe
  C:\Windows\System\keglRzZ.exe
  2⤵
  PID:4720
- C:\Windows\System\MBARfbZ.exe
  C:\Windows\System\MBARfbZ.exe
  2⤵
  PID:5116
- C:\Windows\System\SjPSTut.exe
  C:\Windows\System\SjPSTut.exe
  2⤵
  PID:4788
- C:\Windows\System\JZNJhYu.exe
  C:\Windows\System\JZNJhYu.exe
  2⤵
  PID:4856
- C:\Windows\System\TNJvOJI.exe
  C:\Windows\System\TNJvOJI.exe
  2⤵
  PID:4948
- C:\Windows\System\GUXCygN.exe
  C:\Windows\System\GUXCygN.exe
  2⤵
  PID:5016
- C:\Windows\System\ZVwNfCU.exe
  C:\Windows\System\ZVwNfCU.exe
  2⤵
  PID:5084
- C:\Windows\System\SpYIBnH.exe
  C:\Windows\System\SpYIBnH.exe
  2⤵
  PID:2324
- C:\Windows\System\rqkmwVv.exe
  C:\Windows\System\rqkmwVv.exe
  2⤵
  PID:1196
- C:\Windows\System\hcxAtCT.exe
  C:\Windows\System\hcxAtCT.exe
  2⤵
  PID:840
- C:\Windows\System\WDtOyai.exe
  C:\Windows\System\WDtOyai.exe
  2⤵
  PID:4104
- C:\Windows\System\FCcVpAl.exe
  C:\Windows\System\FCcVpAl.exe
  2⤵
  PID:4168
- C:\Windows\System\jkCQMRw.exe
  C:\Windows\System\jkCQMRw.exe
  2⤵
  PID:2336
- C:\Windows\System\KWnsuxz.exe
  C:\Windows\System\KWnsuxz.exe
  2⤵
  PID:4312
- C:\Windows\System\YvnKVRq.exe
  C:\Windows\System\YvnKVRq.exe
  2⤵
  PID:4428
- C:\Windows\System\KpUTEsg.exe
  C:\Windows\System\KpUTEsg.exe
  2⤵
  PID:2148
- C:\Windows\System\jbtVuVv.exe
  C:\Windows\System\jbtVuVv.exe
  2⤵
  PID:2532
- C:\Windows\System\gAWTodM.exe
  C:\Windows\System\gAWTodM.exe
  2⤵
  PID:4488
- C:\Windows\System\pqGrrOn.exe
  C:\Windows\System\pqGrrOn.exe
  2⤵
  PID:3668
- C:\Windows\System\Dzavvht.exe
  C:\Windows\System\Dzavvht.exe
  2⤵
  PID:3792
- C:\Windows\System\tevshqt.exe
  C:\Windows\System\tevshqt.exe
  2⤵
  PID:3844
- C:\Windows\System\ceDcfbr.exe
  C:\Windows\System\ceDcfbr.exe
  2⤵
  PID:2484
- C:\Windows\System\cKyWpIp.exe
  C:\Windows\System\cKyWpIp.exe
  2⤵
  PID:3160
- C:\Windows\System\BaybzMI.exe
  C:\Windows\System\BaybzMI.exe
  2⤵
  PID:624
- C:\Windows\System\kHxMfjt.exe
  C:\Windows\System\kHxMfjt.exe
  2⤵
  PID:3956
- C:\Windows\System\zTCTfou.exe
  C:\Windows\System\zTCTfou.exe
  2⤵
  PID:3376
- C:\Windows\System\ETVRInK.exe
  C:\Windows\System\ETVRInK.exe
  2⤵
  PID:4156
- C:\Windows\System\PdrWZoB.exe
  C:\Windows\System\PdrWZoB.exe
  2⤵
  PID:4264
- C:\Windows\System\gmthyJQ.exe
  C:\Windows\System\gmthyJQ.exe
  2⤵
  PID:4332
- C:\Windows\System\eKrAYig.exe
  C:\Windows\System\eKrAYig.exe
  2⤵
  PID:1864
- C:\Windows\System\eqUusvR.exe
  C:\Windows\System\eqUusvR.exe
  2⤵
  PID:4540
- C:\Windows\System\YFOjlrV.exe
  C:\Windows\System\YFOjlrV.exe
  2⤵
  PID:4432
- C:\Windows\System\zXfVtvs.exe
  C:\Windows\System\zXfVtvs.exe
  2⤵
  PID:4516
- C:\Windows\System\LYHjOVL.exe
  C:\Windows\System\LYHjOVL.exe
  2⤵
  PID:4628
- C:\Windows\System\eNKUawm.exe
  C:\Windows\System\eNKUawm.exe
  2⤵
  PID:4380
- C:\Windows\System\JwXDxxb.exe
  C:\Windows\System\JwXDxxb.exe
  2⤵
  PID:4700
- C:\Windows\System\wVfoJfy.exe
  C:\Windows\System\wVfoJfy.exe
  2⤵
  PID:5096
- C:\Windows\System\fPkQhaQ.exe
  C:\Windows\System\fPkQhaQ.exe
  2⤵
  PID:4756
- C:\Windows\System\ULzZjAb.exe
  C:\Windows\System\ULzZjAb.exe
  2⤵
  PID:4820
- C:\Windows\System\VrahFut.exe
  C:\Windows\System\VrahFut.exe
  2⤵
  PID:4980
- C:\Windows\System\kPgFFnd.exe
  C:\Windows\System\kPgFFnd.exe
  2⤵
  PID:4072
- C:\Windows\System\AybaEYh.exe
  C:\Windows\System\AybaEYh.exe
  2⤵
  PID:3292
- C:\Windows\System\mLPNoBL.exe
  C:\Windows\System\mLPNoBL.exe
  2⤵
  PID:3540
- C:\Windows\System\AHCUksZ.exe
  C:\Windows\System\AHCUksZ.exe
  2⤵
  PID:3516
- C:\Windows\System\ScKFFut.exe
  C:\Windows\System\ScKFFut.exe
  2⤵
  PID:4472
- C:\Windows\System\tQwPFPU.exe
  C:\Windows\System\tQwPFPU.exe
  2⤵
  PID:3816
- C:\Windows\System\kXbQarb.exe
  C:\Windows\System\kXbQarb.exe
  2⤵
  PID:1928
- C:\Windows\System\zSfJKBx.exe
  C:\Windows\System\zSfJKBx.exe
  2⤵
  PID:4300
- C:\Windows\System\ZVRZKGB.exe
  C:\Windows\System\ZVRZKGB.exe
  2⤵
  PID:3412
- C:\Windows\System\kVuQRUG.exe
  C:\Windows\System\kVuQRUG.exe
  2⤵
  PID:3996
- C:\Windows\System\UgcGNst.exe
  C:\Windows\System\UgcGNst.exe
  2⤵
  PID:4100
- C:\Windows\System\bSWkvJW.exe
  C:\Windows\System\bSWkvJW.exe
  2⤵
  PID:3676
- C:\Windows\System\wjbucIf.exe
  C:\Windows\System\wjbucIf.exe
  2⤵
  PID:3880
- C:\Windows\System\IddJpsw.exe
  C:\Windows\System\IddJpsw.exe
  2⤵
  PID:4216
- C:\Windows\System\ASHDOjd.exe
  C:\Windows\System\ASHDOjd.exe
  2⤵
  PID:3696
- C:\Windows\System\MPADsZp.exe
  C:\Windows\System\MPADsZp.exe
  2⤵
  PID:4580
- C:\Windows\System\sGpLHZN.exe
  C:\Windows\System\sGpLHZN.exe
  2⤵
  PID:4604
- C:\Windows\System\dRUwbsy.exe
  C:\Windows\System\dRUwbsy.exe
  2⤵
  PID:4588
- C:\Windows\System\zjeFKds.exe
  C:\Windows\System\zjeFKds.exe
  2⤵
  PID:1448
- C:\Windows\System\nhxDrLy.exe
  C:\Windows\System\nhxDrLy.exe
  2⤵
  PID:2776
- C:\Windows\System\GlMjuED.exe
  C:\Windows\System\GlMjuED.exe
  2⤵
  PID:4900
- C:\Windows\System\EzJMCWY.exe
  C:\Windows\System\EzJMCWY.exe
  2⤵
  PID:2092
- C:\Windows\System\neGPoUq.exe
  C:\Windows\System\neGPoUq.exe
  2⤵
  PID:4868
- C:\Windows\System\lKEDAAI.exe
  C:\Windows\System\lKEDAAI.exe
  2⤵
  PID:5028
- C:\Windows\System\hPqzqwv.exe
  C:\Windows\System\hPqzqwv.exe
  2⤵
  PID:4920
- C:\Windows\System\CvnpuyV.exe
  C:\Windows\System\CvnpuyV.exe
  2⤵
  PID:4028
- C:\Windows\System\CrJgmcX.exe
  C:\Windows\System\CrJgmcX.exe
  2⤵
  PID:1664
- C:\Windows\System\IJsmQWI.exe
  C:\Windows\System\IJsmQWI.exe
  2⤵
  PID:1816
- C:\Windows\System\oMuhLpW.exe
  C:\Windows\System\oMuhLpW.exe
  2⤵
  PID:4416
- C:\Windows\System\yjEpmXY.exe
  C:\Windows\System\yjEpmXY.exe
  2⤵
  PID:3772
- C:\Windows\System\rsCSsfv.exe
  C:\Windows\System\rsCSsfv.exe
  2⤵
  PID:4584
- C:\Windows\System\AOSxBJs.exe
  C:\Windows\System\AOSxBJs.exe
  2⤵
  PID:4996
- C:\Windows\System\bIBGIbF.exe
  C:\Windows\System\bIBGIbF.exe
  2⤵
  PID:4784
- C:\Windows\System\ocqUVvI.exe
  C:\Windows\System\ocqUVvI.exe
  2⤵
  PID:3912
- C:\Windows\System\sOTyahu.exe
  C:\Windows\System\sOTyahu.exe
  2⤵
  PID:4836
- C:\Windows\System\YcqJjjM.exe
  C:\Windows\System\YcqJjjM.exe
  2⤵
  PID:5100
- C:\Windows\System\vHlImUy.exe
  C:\Windows\System\vHlImUy.exe
  2⤵
  PID:4120
- C:\Windows\System\XTEvjyY.exe
  C:\Windows\System\XTEvjyY.exe
  2⤵
  PID:4624
- C:\Windows\System\QlLqixj.exe
  C:\Windows\System\QlLqixj.exe
  2⤵
  PID:708
- C:\Windows\System\rKXyksw.exe
  C:\Windows\System\rKXyksw.exe
  2⤵
  PID:4568
- C:\Windows\System\VMLdVVd.exe
  C:\Windows\System\VMLdVVd.exe
  2⤵
  PID:4524
- C:\Windows\System\MtNHZVe.exe
  C:\Windows\System\MtNHZVe.exe
  2⤵
  PID:5064
- C:\Windows\System\gRzGZFc.exe
  C:\Windows\System\gRzGZFc.exe
  2⤵
  PID:3932
- C:\Windows\System\lErrtbs.exe
  C:\Windows\System\lErrtbs.exe
  2⤵
  PID:4612
- C:\Windows\System\ANCLOYm.exe
  C:\Windows\System\ANCLOYm.exe
  2⤵
  PID:2420
- C:\Windows\System\IqrrDql.exe
  C:\Windows\System\IqrrDql.exe
  2⤵
  PID:3488
- C:\Windows\System\uDSOKWH.exe
  C:\Windows\System\uDSOKWH.exe
  2⤵
  PID:3356
- C:\Windows\System\KCztLMj.exe
  C:\Windows\System\KCztLMj.exe
  2⤵
  PID:4188
- C:\Windows\System\OSHvSHV.exe
  C:\Windows\System\OSHvSHV.exe
  2⤵
  PID:4280
- C:\Windows\System\UGlFiHy.exe
  C:\Windows\System\UGlFiHy.exe
  2⤵
  PID:4904
- C:\Windows\System\spARqvz.exe
  C:\Windows\System\spARqvz.exe
  2⤵
  PID:4420
- C:\Windows\System\jLGspmh.exe
  C:\Windows\System\jLGspmh.exe
  2⤵
  PID:4932
- C:\Windows\System\xpnIAeq.exe
  C:\Windows\System\xpnIAeq.exe
  2⤵
  PID:5132
- C:\Windows\System\ofEfmUl.exe
  C:\Windows\System\ofEfmUl.exe
  2⤵
  PID:5148
- C:\Windows\System\mBGKHqY.exe
  C:\Windows\System\mBGKHqY.exe
  2⤵
  PID:5164
- C:\Windows\System\jESOrZC.exe
  C:\Windows\System\jESOrZC.exe
  2⤵
  PID:5180
- C:\Windows\System\BKJFDfu.exe
  C:\Windows\System\BKJFDfu.exe
  2⤵
  PID:5196
- C:\Windows\System\WUOCPEk.exe
  C:\Windows\System\WUOCPEk.exe
  2⤵
  PID:5212
- C:\Windows\System\SxbiJKI.exe
  C:\Windows\System\SxbiJKI.exe
  2⤵
  PID:5228
- C:\Windows\System\DEAcIwv.exe
  C:\Windows\System\DEAcIwv.exe
  2⤵
  PID:5244
- C:\Windows\System\FVWGEpA.exe
  C:\Windows\System\FVWGEpA.exe
  2⤵
  PID:5260
- C:\Windows\System\czttXbX.exe
  C:\Windows\System\czttXbX.exe
  2⤵
  PID:5276
- C:\Windows\System\qkAcCHX.exe
  C:\Windows\System\qkAcCHX.exe
  2⤵
  PID:5292
- C:\Windows\System\fBSzGqN.exe
  C:\Windows\System\fBSzGqN.exe
  2⤵
  PID:5308
- C:\Windows\System\zxOtZxC.exe
  C:\Windows\System\zxOtZxC.exe
  2⤵
  PID:5324
- C:\Windows\System\SviIgKw.exe
  C:\Windows\System\SviIgKw.exe
  2⤵
  PID:5344
- C:\Windows\System\VQpcfsY.exe
  C:\Windows\System\VQpcfsY.exe
  2⤵
  PID:5360
- C:\Windows\System\fPsBZOM.exe
  C:\Windows\System\fPsBZOM.exe
  2⤵
  PID:5376
- C:\Windows\System\EhpEaUN.exe
  C:\Windows\System\EhpEaUN.exe
  2⤵
  PID:5392
- C:\Windows\System\odbCycP.exe
  C:\Windows\System\odbCycP.exe
  2⤵
  PID:5408
- C:\Windows\System\YlFNmjy.exe
  C:\Windows\System\YlFNmjy.exe
  2⤵
  PID:5424
- C:\Windows\System\WNiolZR.exe
  C:\Windows\System\WNiolZR.exe
  2⤵
  PID:5440
- C:\Windows\System\UUbfCAU.exe
  C:\Windows\System\UUbfCAU.exe
  2⤵
  PID:5456
- C:\Windows\System\igKTRsw.exe
  C:\Windows\System\igKTRsw.exe
  2⤵
  PID:5472
- C:\Windows\System\bovGfUh.exe
  C:\Windows\System\bovGfUh.exe
  2⤵
  PID:5488
- C:\Windows\System\MjxQETo.exe
  C:\Windows\System\MjxQETo.exe
  2⤵
  PID:5504
- C:\Windows\System\wahvBPc.exe
  C:\Windows\System\wahvBPc.exe
  2⤵
  PID:5524
- C:\Windows\System\krhSrNP.exe
  C:\Windows\System\krhSrNP.exe
  2⤵
  PID:5540
- C:\Windows\System\CEqdxvU.exe
  C:\Windows\System\CEqdxvU.exe
  2⤵
  PID:5556
- C:\Windows\System\VYvateT.exe
  C:\Windows\System\VYvateT.exe
  2⤵
  PID:5572
- C:\Windows\System\UwEehSA.exe
  C:\Windows\System\UwEehSA.exe
  2⤵
  PID:5660
- C:\Windows\System\utawnUB.exe
  C:\Windows\System\utawnUB.exe
  2⤵
  PID:5680
- C:\Windows\System\BDNMclP.exe
  C:\Windows\System\BDNMclP.exe
  2⤵
  PID:5696
- C:\Windows\System\wkoexzD.exe
  C:\Windows\System\wkoexzD.exe
  2⤵
  PID:5712
- C:\Windows\System\sqqJndG.exe
  C:\Windows\System\sqqJndG.exe
  2⤵
  PID:5728
- C:\Windows\System\IaYgUME.exe
  C:\Windows\System\IaYgUME.exe
  2⤵
  PID:5744
- C:\Windows\System\plxToXH.exe
  C:\Windows\System\plxToXH.exe
  2⤵
  PID:5856
- C:\Windows\System\Vggmppm.exe
  C:\Windows\System\Vggmppm.exe
  2⤵
  PID:5880
- C:\Windows\System\kszZijZ.exe
  C:\Windows\System\kszZijZ.exe
  2⤵
  PID:5896
- C:\Windows\System\jPqyCho.exe
  C:\Windows\System\jPqyCho.exe
  2⤵
  PID:5912
- C:\Windows\System\CgMHSAY.exe
  C:\Windows\System\CgMHSAY.exe
  2⤵
  PID:5928
- C:\Windows\System\yFmfHiy.exe
  C:\Windows\System\yFmfHiy.exe
  2⤵
  PID:5944
- C:\Windows\System\kYMBCFD.exe
  C:\Windows\System\kYMBCFD.exe
  2⤵
  PID:5960
- C:\Windows\System\kFIcOqs.exe
  C:\Windows\System\kFIcOqs.exe
  2⤵
  PID:5976
- C:\Windows\System\iGGuBVf.exe
  C:\Windows\System\iGGuBVf.exe
  2⤵
  PID:5992
- C:\Windows\System\icxrwxv.exe
  C:\Windows\System\icxrwxv.exe
  2⤵
  PID:6008
- C:\Windows\System\kVfpnGz.exe
  C:\Windows\System\kVfpnGz.exe
  2⤵
  PID:6024
- C:\Windows\System\qRADqST.exe
  C:\Windows\System\qRADqST.exe
  2⤵
  PID:6040
- C:\Windows\System\mSFHQEk.exe
  C:\Windows\System\mSFHQEk.exe
  2⤵
  PID:6056
- C:\Windows\System\JGIRuQH.exe
  C:\Windows\System\JGIRuQH.exe
  2⤵
  PID:6072
- C:\Windows\System\cekCGSr.exe
  C:\Windows\System\cekCGSr.exe
  2⤵
  PID:6088
- C:\Windows\System\RohGsXm.exe
  C:\Windows\System\RohGsXm.exe
  2⤵
  PID:6104
- C:\Windows\System\bvxfKlo.exe
  C:\Windows\System\bvxfKlo.exe
  2⤵
  PID:6132
- C:\Windows\System\nsrvZUt.exe
  C:\Windows\System\nsrvZUt.exe
  2⤵
  PID:3732
- C:\Windows\System\ZRZBXKY.exe
  C:\Windows\System\ZRZBXKY.exe
  2⤵
  PID:3260
- C:\Windows\System\Lzapckm.exe
  C:\Windows\System\Lzapckm.exe
  2⤵
  PID:5176
- C:\Windows\System\TaQTcMs.exe
  C:\Windows\System\TaQTcMs.exe
  2⤵
  PID:5156
- C:\Windows\System\IlDnuKp.exe
  C:\Windows\System\IlDnuKp.exe
  2⤵
  PID:5300
- C:\Windows\System\DgiFFBx.exe
  C:\Windows\System\DgiFFBx.exe
  2⤵
  PID:5340
- C:\Windows\System\JWGyrmo.exe
  C:\Windows\System\JWGyrmo.exe
  2⤵
  PID:5128
- C:\Windows\System\IzMnTkb.exe
  C:\Windows\System\IzMnTkb.exe
  2⤵
  PID:5224
- C:\Windows\System\nAYRpOd.exe
  C:\Windows\System\nAYRpOd.exe
  2⤵
  PID:5356
- C:\Windows\System\CoUdYlJ.exe
  C:\Windows\System\CoUdYlJ.exe
  2⤵
  PID:5388
- C:\Windows\System\tPNBLov.exe
  C:\Windows\System\tPNBLov.exe
  2⤵
  PID:5452
- C:\Windows\System\HXzbzbw.exe
  C:\Windows\System\HXzbzbw.exe
  2⤵
  PID:5548
- C:\Windows\System\RgcmiVN.exe
  C:\Windows\System\RgcmiVN.exe
  2⤵
  PID:5520
- C:\Windows\System\dxFhErD.exe
  C:\Windows\System\dxFhErD.exe
  2⤵
  PID:5436
- C:\Windows\System\OCovoyj.exe
  C:\Windows\System\OCovoyj.exe
  2⤵
  PID:5532
- C:\Windows\System\uzWyWGv.exe
  C:\Windows\System\uzWyWGv.exe
  2⤵
  PID:5592
- C:\Windows\System\JoqYDKC.exe
  C:\Windows\System\JoqYDKC.exe
  2⤵
  PID:5604
- C:\Windows\System\MURFulo.exe
  C:\Windows\System\MURFulo.exe
  2⤵
  PID:5612
- C:\Windows\System\ZWqHeSQ.exe
  C:\Windows\System\ZWqHeSQ.exe
  2⤵
  PID:4500
- C:\Windows\System\mrYvGRQ.exe
  C:\Windows\System\mrYvGRQ.exe
  2⤵
  PID:5636
- C:\Windows\System\ncXpSAg.exe
  C:\Windows\System\ncXpSAg.exe
  2⤵
  PID:5688
- C:\Windows\System\NCaDPxQ.exe
  C:\Windows\System\NCaDPxQ.exe
  2⤵
  PID:5752
- C:\Windows\System\KjJyZxT.exe
  C:\Windows\System\KjJyZxT.exe
  2⤵
  PID:5756
- C:\Windows\System\SwDmIgU.exe
  C:\Windows\System\SwDmIgU.exe
  2⤵
  PID:5676
- C:\Windows\System\trgyJIQ.exe
  C:\Windows\System\trgyJIQ.exe
  2⤵
  PID:5768
- C:\Windows\System\nWOoIYC.exe
  C:\Windows\System\nWOoIYC.exe
  2⤵
  PID:5788
- C:\Windows\System\cVGzaXr.exe
  C:\Windows\System\cVGzaXr.exe
  2⤵
  PID:5804
- C:\Windows\System\FzjoUCc.exe
  C:\Windows\System\FzjoUCc.exe
  2⤵
  PID:5836
- C:\Windows\System\NCRnRRc.exe
  C:\Windows\System\NCRnRRc.exe
  2⤵
  PID:5820
- C:\Windows\System\ybBmxhr.exe
  C:\Windows\System\ybBmxhr.exe
  2⤵
  PID:5868
- C:\Windows\System\mBpxmKj.exe
  C:\Windows\System\mBpxmKj.exe
  2⤵
  PID:5888
- C:\Windows\System\lGVSmwB.exe
  C:\Windows\System\lGVSmwB.exe
  2⤵
  PID:5952
- C:\Windows\System\oiVYFFQ.exe
  C:\Windows\System\oiVYFFQ.exe
  2⤵
  PID:6016
- C:\Windows\System\NSoJLUD.exe
  C:\Windows\System\NSoJLUD.exe
  2⤵
  PID:6080
- C:\Windows\System\HwHtWjC.exe
  C:\Windows\System\HwHtWjC.exe
  2⤵
  PID:6120
- C:\Windows\System\VpegToc.exe
  C:\Windows\System\VpegToc.exe
  2⤵
  PID:2108
- C:\Windows\System\mnmQuzH.exe
  C:\Windows\System\mnmQuzH.exe
  2⤵
  PID:5336
- C:\Windows\System\eGjdBqr.exe
  C:\Windows\System\eGjdBqr.exe
  2⤵
  PID:5904
- C:\Windows\System\aUPEtvW.exe
  C:\Windows\System\aUPEtvW.exe
  2⤵
  PID:5940
- C:\Windows\System\JiUYbwQ.exe
  C:\Windows\System\JiUYbwQ.exe
  2⤵
  PID:6004
- C:\Windows\System\GCevznM.exe
  C:\Windows\System\GCevznM.exe
  2⤵
  PID:6068
- C:\Windows\System\Limhrlu.exe
  C:\Windows\System\Limhrlu.exe
  2⤵
  PID:4600
- C:\Windows\System\bKwxIfC.exe
  C:\Windows\System\bKwxIfC.exe
  2⤵
  PID:5288
- C:\Windows\System\asthTkN.exe
  C:\Windows\System\asthTkN.exe
  2⤵
  PID:5420
- C:\Windows\System\THxGDtw.exe
  C:\Windows\System\THxGDtw.exe
  2⤵
  PID:5496
- C:\Windows\System\aFNdqpw.exe
  C:\Windows\System\aFNdqpw.exe
  2⤵
  PID:5628
- C:\Windows\System\eBJwWrc.exe
  C:\Windows\System\eBJwWrc.exe
  2⤵
  PID:5672
- C:\Windows\System\FyrDSXE.exe
  C:\Windows\System\FyrDSXE.exe
  2⤵
  PID:5512
- C:\Windows\System\ejtzfuS.exe
  C:\Windows\System\ejtzfuS.exe
  2⤵
  PID:5432
- C:\Windows\System\QIPDSbv.exe
  C:\Windows\System\QIPDSbv.exe
  2⤵
  PID:5616
- C:\Windows\System\MfGOgaN.exe
  C:\Windows\System\MfGOgaN.exe
  2⤵
  PID:5720
- C:\Windows\System\dekdjwU.exe
  C:\Windows\System\dekdjwU.exe
  2⤵
  PID:5780
- C:\Windows\System\AAbkprp.exe
  C:\Windows\System\AAbkprp.exe
  2⤵
  PID:5864
- C:\Windows\System\vSKmDDn.exe
  C:\Windows\System\vSKmDDn.exe
  2⤵
  PID:6052
- C:\Windows\System\LKzPOeM.exe
  C:\Windows\System\LKzPOeM.exe
  2⤵
  PID:5800
- C:\Windows\System\jIYXpUc.exe
  C:\Windows\System\jIYXpUc.exe
  2⤵
  PID:6112
- C:\Windows\System\TbJYHJQ.exe
  C:\Windows\System\TbJYHJQ.exe
  2⤵
  PID:5984
- C:\Windows\System\DaxdqhG.exe
  C:\Windows\System\DaxdqhG.exe
  2⤵
  PID:6100
- C:\Windows\System\kPusNhE.exe
  C:\Windows\System\kPusNhE.exe
  2⤵
  PID:5256
- C:\Windows\System\fjUTfaG.exe
  C:\Windows\System\fjUTfaG.exe
  2⤵
  PID:5332
- C:\Windows\System\regVDWP.exe
  C:\Windows\System\regVDWP.exe
  2⤵
  PID:5564
- C:\Windows\System\InQLvXT.exe
  C:\Windows\System\InQLvXT.exe
  2⤵
  PID:6064
- C:\Windows\System\ZDbBUBw.exe
  C:\Windows\System\ZDbBUBw.exe
  2⤵
  PID:5876
- C:\Windows\System\vvWERXN.exe
  C:\Windows\System\vvWERXN.exe
  2⤵
  PID:5552
- C:\Windows\System\gLerYLe.exe
  C:\Windows\System\gLerYLe.exe
  2⤵
  PID:5268
- C:\Windows\System\LExVBBA.exe
  C:\Windows\System\LExVBBA.exe
  2⤵
  PID:5656
- C:\Windows\System\KZHKsrd.exe
  C:\Windows\System\KZHKsrd.exe
  2⤵
  PID:5764
- C:\Windows\System\dHBidpS.exe
  C:\Windows\System\dHBidpS.exe
  2⤵
  PID:5796
- C:\Windows\System\xdyTHya.exe
  C:\Windows\System\xdyTHya.exe
  2⤵
  PID:6000
- C:\Windows\System\iFCsttv.exe
  C:\Windows\System\iFCsttv.exe
  2⤵
  PID:6156
- C:\Windows\System\wRvqjWf.exe
  C:\Windows\System\wRvqjWf.exe
  2⤵
  PID:6172
- C:\Windows\System\xKCoDMj.exe
  C:\Windows\System\xKCoDMj.exe
  2⤵
  PID:6188
- C:\Windows\System\zGqLocZ.exe
  C:\Windows\System\zGqLocZ.exe
  2⤵
  PID:6204
- C:\Windows\System\fxbYOBP.exe
  C:\Windows\System\fxbYOBP.exe
  2⤵
  PID:6220
- C:\Windows\System\RVmDqYg.exe
  C:\Windows\System\RVmDqYg.exe
  2⤵
  PID:6236
- C:\Windows\System\ueDnFhu.exe
  C:\Windows\System\ueDnFhu.exe
  2⤵
  PID:6252
- C:\Windows\System\VtZcxpf.exe
  C:\Windows\System\VtZcxpf.exe
  2⤵
  PID:6268
- C:\Windows\System\tepsJDi.exe
  C:\Windows\System\tepsJDi.exe
  2⤵
  PID:6284
- C:\Windows\System\nUCPNyS.exe
  C:\Windows\System\nUCPNyS.exe
  2⤵
  PID:6300
- C:\Windows\System\JhVqwXG.exe
  C:\Windows\System\JhVqwXG.exe
  2⤵
  PID:6320
- C:\Windows\System\XOcQwtE.exe
  C:\Windows\System\XOcQwtE.exe
  2⤵
  PID:6336
- C:\Windows\System\BqwaYjj.exe
  C:\Windows\System\BqwaYjj.exe
  2⤵
  PID:6352
- C:\Windows\System\gRCdTDu.exe
  C:\Windows\System\gRCdTDu.exe
  2⤵
  PID:6368
- C:\Windows\System\BieSFSD.exe
  C:\Windows\System\BieSFSD.exe
  2⤵
  PID:6384
- C:\Windows\System\hyheEmp.exe
  C:\Windows\System\hyheEmp.exe
  2⤵
  PID:6404
- C:\Windows\System\sgLmZhf.exe
  C:\Windows\System\sgLmZhf.exe
  2⤵
  PID:6420
- C:\Windows\System\jZDvaYz.exe
  C:\Windows\System\jZDvaYz.exe
  2⤵
  PID:6436
- C:\Windows\System\QrJhPuZ.exe
  C:\Windows\System\QrJhPuZ.exe
  2⤵
  PID:6452
- C:\Windows\System\yzmcSVJ.exe
  C:\Windows\System\yzmcSVJ.exe
  2⤵
  PID:6468
- C:\Windows\System\widorts.exe
  C:\Windows\System\widorts.exe
  2⤵
  PID:6484
- C:\Windows\System\xcnZKnI.exe
  C:\Windows\System\xcnZKnI.exe
  2⤵
  PID:6500
- C:\Windows\System\gnjvejS.exe
  C:\Windows\System\gnjvejS.exe
  2⤵
  PID:6516
- C:\Windows\System\sYwlllB.exe
  C:\Windows\System\sYwlllB.exe
  2⤵
  PID:6532
- C:\Windows\System\USBFFGM.exe
  C:\Windows\System\USBFFGM.exe
  2⤵
  PID:6548
- C:\Windows\System\ksZgXpU.exe
  C:\Windows\System\ksZgXpU.exe
  2⤵
  PID:6564
- C:\Windows\System\syjjdqt.exe
  C:\Windows\System\syjjdqt.exe
  2⤵
  PID:6580
- C:\Windows\System\OrGHekK.exe
  C:\Windows\System\OrGHekK.exe
  2⤵
  PID:6596
- C:\Windows\System\rPMvXZn.exe
  C:\Windows\System\rPMvXZn.exe
  2⤵
  PID:6612
- C:\Windows\System\wqFISIm.exe
  C:\Windows\System\wqFISIm.exe
  2⤵
  PID:6628
- C:\Windows\System\rPyRBPa.exe
  C:\Windows\System\rPyRBPa.exe
  2⤵
  PID:6644
- C:\Windows\System\auSwXkm.exe
  C:\Windows\System\auSwXkm.exe
  2⤵
  PID:6660
- C:\Windows\System\xklCCnI.exe
  C:\Windows\System\xklCCnI.exe
  2⤵
  PID:6676
- C:\Windows\System\qQcpezB.exe
  C:\Windows\System\qQcpezB.exe
  2⤵
  PID:6692
- C:\Windows\System\XmNPKSk.exe
  C:\Windows\System\XmNPKSk.exe
  2⤵
  PID:6708
- C:\Windows\System\aJaTTGw.exe
  C:\Windows\System\aJaTTGw.exe
  2⤵
  PID:6724
- C:\Windows\System\PGjYVVu.exe
  C:\Windows\System\PGjYVVu.exe
  2⤵
  PID:6740
- C:\Windows\System\QUKMfNN.exe
  C:\Windows\System\QUKMfNN.exe
  2⤵
  PID:6756
- C:\Windows\System\bqCkEaF.exe
  C:\Windows\System\bqCkEaF.exe
  2⤵
  PID:6772
- C:\Windows\System\cVdCZPl.exe
  C:\Windows\System\cVdCZPl.exe
  2⤵
  PID:6788
- C:\Windows\System\EFczesZ.exe
  C:\Windows\System\EFczesZ.exe
  2⤵
  PID:6804
- C:\Windows\System\RTNErbd.exe
  C:\Windows\System\RTNErbd.exe
  2⤵
  PID:6820
- C:\Windows\System\GPXLFhy.exe
  C:\Windows\System\GPXLFhy.exe
  2⤵
  PID:6836
- C:\Windows\System\FPaWLFa.exe
  C:\Windows\System\FPaWLFa.exe
  2⤵
  PID:6852
- C:\Windows\System\KiFVyUH.exe
  C:\Windows\System\KiFVyUH.exe
  2⤵
  PID:6868
- C:\Windows\System\pZSQoDA.exe
  C:\Windows\System\pZSQoDA.exe
  2⤵
  PID:6884
- C:\Windows\System\AmclvCW.exe
  C:\Windows\System\AmclvCW.exe
  2⤵
  PID:6900
- C:\Windows\System\FmyhjtQ.exe
  C:\Windows\System\FmyhjtQ.exe
  2⤵
  PID:6916
- C:\Windows\System\fENDRsh.exe
  C:\Windows\System\fENDRsh.exe
  2⤵
  PID:6932
- C:\Windows\System\xaQjdAg.exe
  C:\Windows\System\xaQjdAg.exe
  2⤵
  PID:6948
- C:\Windows\System\igqUhlO.exe
  C:\Windows\System\igqUhlO.exe
  2⤵
  PID:6964
- C:\Windows\System\gItulAx.exe
  C:\Windows\System\gItulAx.exe
  2⤵
  PID:6984
- C:\Windows\System\nhdJJue.exe
  C:\Windows\System\nhdJJue.exe
  2⤵
  PID:7000
- C:\Windows\System\tXpPuHV.exe
  C:\Windows\System\tXpPuHV.exe
  2⤵
  PID:7016
- C:\Windows\System\ryzVZba.exe
  C:\Windows\System\ryzVZba.exe
  2⤵
  PID:7032
- C:\Windows\System\bOKhFAw.exe
  C:\Windows\System\bOKhFAw.exe
  2⤵
  PID:7048
- C:\Windows\System\DpJxKvl.exe
  C:\Windows\System\DpJxKvl.exe
  2⤵
  PID:7064
- C:\Windows\System\POpYwVD.exe
  C:\Windows\System\POpYwVD.exe
  2⤵
  PID:7084
- C:\Windows\System\NvStZGk.exe
  C:\Windows\System\NvStZGk.exe
  2⤵
  PID:7100
- C:\Windows\System\LXzlcOR.exe
  C:\Windows\System\LXzlcOR.exe
  2⤵
  PID:7116
- C:\Windows\System\avghPcp.exe
  C:\Windows\System\avghPcp.exe
  2⤵
  PID:7132
- C:\Windows\System\oVUUKYO.exe
  C:\Windows\System\oVUUKYO.exe
  2⤵
  PID:7148
- C:\Windows\System\PGsvkOb.exe
  C:\Windows\System\PGsvkOb.exe
  2⤵
  PID:7164
- C:\Windows\System\oUHfwfD.exe
  C:\Windows\System\oUHfwfD.exe
  2⤵
  PID:6148
- C:\Windows\System\AvTWvcY.exe
  C:\Windows\System\AvTWvcY.exe
  2⤵
  PID:5588
- C:\Windows\System\pKDZqwP.exe
  C:\Windows\System\pKDZqwP.exe
  2⤵
  PID:5844
- C:\Windows\System\bodBPgX.exe
  C:\Windows\System\bodBPgX.exe
  2⤵
  PID:5484
- C:\Windows\System\fSMfFtJ.exe
  C:\Windows\System\fSMfFtJ.exe
  2⤵
  PID:6036
- C:\Windows\System\iBVzfFA.exe
  C:\Windows\System\iBVzfFA.exe
  2⤵
  PID:5648
- C:\Windows\System\egHMOQj.exe
  C:\Windows\System\egHMOQj.exe
  2⤵
  PID:6196
- C:\Windows\System\BPENQjw.exe
  C:\Windows\System\BPENQjw.exe
  2⤵
  PID:6232
- C:\Windows\System\qocehyd.exe
  C:\Windows\System\qocehyd.exe
  2⤵
  PID:6248
- C:\Windows\System\wEEJdmA.exe
  C:\Windows\System\wEEJdmA.exe
  2⤵
  PID:6296
- C:\Windows\System\tKwoiqV.exe
  C:\Windows\System\tKwoiqV.exe
  2⤵
  PID:6312
- C:\Windows\System\dNyGjZX.exe
  C:\Windows\System\dNyGjZX.exe
  2⤵
  PID:6344
- C:\Windows\System\RtJTXAA.exe
  C:\Windows\System\RtJTXAA.exe
  2⤵
  PID:6448
- C:\Windows\System\gytWpDX.exe
  C:\Windows\System\gytWpDX.exe
  2⤵
  PID:6508
- C:\Windows\System\mmLGyfD.exe
  C:\Windows\System\mmLGyfD.exe
  2⤵
  PID:6396
- C:\Windows\System\kahOFKJ.exe
  C:\Windows\System\kahOFKJ.exe
  2⤵
  PID:6604
- C:\Windows\System\scasCEj.exe
  C:\Windows\System\scasCEj.exe
  2⤵
  PID:6672
- C:\Windows\System\vXwroIZ.exe
  C:\Windows\System\vXwroIZ.exe
  2⤵
  PID:6732
- C:\Windows\System\FXzZLYE.exe
  C:\Windows\System\FXzZLYE.exe
  2⤵
  PID:6796
- C:\Windows\System\wZiMVxK.exe
  C:\Windows\System\wZiMVxK.exe
  2⤵
  PID:6860
- C:\Windows\System\vYIsMSB.exe
  C:\Windows\System\vYIsMSB.exe
  2⤵
  PID:6432
- C:\Windows\System\vZeYJeK.exe
  C:\Windows\System\vZeYJeK.exe
  2⤵
  PID:6688
- C:\Windows\System\OEYhcjH.exe
  C:\Windows\System\OEYhcjH.exe
  2⤵
  PID:6816
- C:\Windows\System\SYDkSQP.exe
  C:\Windows\System\SYDkSQP.exe
  2⤵
  PID:6492
- C:\Windows\System\xliLkLi.exe
  C:\Windows\System\xliLkLi.exe
  2⤵
  PID:6588
- C:\Windows\System\xjeDOps.exe
  C:\Windows\System\xjeDOps.exe
  2⤵
  PID:6928
- C:\Windows\System\ZCrAWpt.exe
  C:\Windows\System\ZCrAWpt.exe
  2⤵
  PID:6956
- C:\Windows\System\cFUgwNR.exe
  C:\Windows\System\cFUgwNR.exe
  2⤵
  PID:6716
- C:\Windows\System\bqfsFxS.exe
  C:\Windows\System\bqfsFxS.exe
  2⤵
  PID:7008
- C:\Windows\System\vPWaOPQ.exe
  C:\Windows\System\vPWaOPQ.exe
  2⤵
  PID:7012
- C:\Windows\System\gUjCCdd.exe
  C:\Windows\System\gUjCCdd.exe
  2⤵
  PID:7096
- C:\Windows\System\hjTvpla.exe
  C:\Windows\System\hjTvpla.exe
  2⤵
  PID:6912
- C:\Windows\System\otkUTxS.exe
  C:\Windows\System\otkUTxS.exe
  2⤵
  PID:7156
- C:\Windows\System\TSZMkkc.exe
  C:\Windows\System\TSZMkkc.exe
  2⤵
  PID:5352
- C:\Windows\System\zUDavzF.exe
  C:\Windows\System\zUDavzF.exe
  2⤵
  PID:6216
- C:\Windows\System\WCwePpp.exe
  C:\Windows\System\WCwePpp.exe
  2⤵
  PID:6280
- C:\Windows\System\yVXEVsX.exe
  C:\Windows\System\yVXEVsX.exe
  2⤵
  PID:6400
- C:\Windows\System\MiCXyJq.exe
  C:\Windows\System\MiCXyJq.exe
  2⤵
  PID:6048
- C:\Windows\System\obquYur.exe
  C:\Windows\System\obquYur.exe
  2⤵
  PID:6264
- C:\Windows\System\jhfaevA.exe
  C:\Windows\System\jhfaevA.exe
  2⤵
  PID:7108
- C:\Windows\System\amneCjQ.exe
  C:\Windows\System\amneCjQ.exe
  2⤵
  PID:5740
- C:\Windows\System\NBBjAPM.exe
  C:\Windows\System\NBBjAPM.exe
  2⤵
  PID:6316
- C:\Windows\System\iYvJjcq.exe
  C:\Windows\System\iYvJjcq.exe
  2⤵
  PID:6576
- C:\Windows\System\NbiXPfx.exe
  C:\Windows\System\NbiXPfx.exe
  2⤵
  PID:6244
- C:\Windows\System\hoAHhkc.exe
  C:\Windows\System\hoAHhkc.exe
  2⤵
  PID:5840
- C:\Windows\System\mYRDuGP.exe
  C:\Windows\System\mYRDuGP.exe
  2⤵
  PID:6876
- C:\Windows\System\VAQUBbr.exe
  C:\Windows\System\VAQUBbr.exe
  2⤵
  PID:6780
- C:\Windows\System\nalzfgv.exe
  C:\Windows\System\nalzfgv.exe
  2⤵
  PID:6896
- C:\Windows\System\HDhSMIY.exe
  C:\Windows\System\HDhSMIY.exe
  2⤵
  PID:6892
- C:\Windows\System\egshpJS.exe
  C:\Windows\System\egshpJS.exe
  2⤵
  PID:6960
- C:\Windows\System\fJQucHW.exe
  C:\Windows\System\fJQucHW.exe
  2⤵
  PID:7056
- C:\Windows\System\OEVRxCk.exe
  C:\Windows\System\OEVRxCk.exe
  2⤵
  PID:7040
- C:\Windows\System\FBmncTc.exe
  C:\Windows\System\FBmncTc.exe
  2⤵
  PID:6640
- C:\Windows\System\NIsNrka.exe
  C:\Windows\System\NIsNrka.exe
  2⤵
  PID:6180
- C:\Windows\System\GEwskjg.exe
  C:\Windows\System\GEwskjg.exe
  2⤵
  PID:6668
- C:\Windows\System\sRwkPfU.exe
  C:\Windows\System\sRwkPfU.exe
  2⤵
  PID:6832
- C:\Windows\System\FBfNWYi.exe
  C:\Windows\System\FBfNWYi.exe
  2⤵
  PID:5760
- C:\Windows\System\iEKiyyS.exe
  C:\Windows\System\iEKiyyS.exe
  2⤵
  PID:6164
- C:\Windows\System\mwNXANX.exe
  C:\Windows\System\mwNXANX.exe
  2⤵
  PID:5812
- C:\Windows\System\EFVOoOC.exe
  C:\Windows\System\EFVOoOC.exe
  2⤵
  PID:7144
- C:\Windows\System\zdIkKzy.exe
  C:\Windows\System\zdIkKzy.exe
  2⤵
  PID:6624
- C:\Windows\System\fENtUVy.exe
  C:\Windows\System\fENtUVy.exe
  2⤵
  PID:6540
- C:\Windows\System\OqrlKZe.exe
  C:\Windows\System\OqrlKZe.exe
  2⤵
  PID:6480
- C:\Windows\System\xCjPYVn.exe
  C:\Windows\System\xCjPYVn.exe
  2⤵
  PID:6464
- C:\Windows\System\xVysAyi.exe
  C:\Windows\System\xVysAyi.exe
  2⤵
  PID:7176
- C:\Windows\System\KGlBePg.exe
  C:\Windows\System\KGlBePg.exe
  2⤵
  PID:7192
- C:\Windows\System\vnepdPQ.exe
  C:\Windows\System\vnepdPQ.exe
  2⤵
  PID:7208
- C:\Windows\System\PtEujmA.exe
  C:\Windows\System\PtEujmA.exe
  2⤵
  PID:7232
- C:\Windows\System\qPDhfVm.exe
  C:\Windows\System\qPDhfVm.exe
  2⤵
  PID:7248
- C:\Windows\System\WxxDUGn.exe
  C:\Windows\System\WxxDUGn.exe
  2⤵
  PID:7264
- C:\Windows\System\uMUCrqo.exe
  C:\Windows\System\uMUCrqo.exe
  2⤵
  PID:7280
- C:\Windows\System\PFViiQQ.exe
  C:\Windows\System\PFViiQQ.exe
  2⤵
  PID:7304
- C:\Windows\System\ZzeAwZv.exe
  C:\Windows\System\ZzeAwZv.exe
  2⤵
  PID:7324
- C:\Windows\System\vURMykg.exe
  C:\Windows\System\vURMykg.exe
  2⤵
  PID:7340
- C:\Windows\System\wubYDAV.exe
  C:\Windows\System\wubYDAV.exe
  2⤵
  PID:7356
- C:\Windows\System\ikemcgs.exe
  C:\Windows\System\ikemcgs.exe
  2⤵
  PID:7372
- C:\Windows\System\mIUboTI.exe
  C:\Windows\System\mIUboTI.exe
  2⤵
  PID:7388
- C:\Windows\System\sZxqbHj.exe
  C:\Windows\System\sZxqbHj.exe
  2⤵
  PID:7404
- C:\Windows\System\pHQSWWb.exe
  C:\Windows\System\pHQSWWb.exe
  2⤵
  PID:7420
- C:\Windows\System\mDkteNR.exe
  C:\Windows\System\mDkteNR.exe
  2⤵
  PID:7436
- C:\Windows\System\NRitrYB.exe
  C:\Windows\System\NRitrYB.exe
  2⤵
  PID:7452
- C:\Windows\System\iTiLdul.exe
  C:\Windows\System\iTiLdul.exe
  2⤵
  PID:7468
- C:\Windows\System\UoPnExO.exe
  C:\Windows\System\UoPnExO.exe
  2⤵
  PID:7484
- C:\Windows\System\JeJrWBN.exe
  C:\Windows\System\JeJrWBN.exe
  2⤵
  PID:7500
- C:\Windows\System\TiHRcOv.exe
  C:\Windows\System\TiHRcOv.exe
  2⤵
  PID:7516
- C:\Windows\System\cjKRbBE.exe
  C:\Windows\System\cjKRbBE.exe
  2⤵
  PID:7532
- C:\Windows\System\LlirjJa.exe
  C:\Windows\System\LlirjJa.exe
  2⤵
  PID:7548
- C:\Windows\System\MOTHcvj.exe
  C:\Windows\System\MOTHcvj.exe
  2⤵
  PID:7564
- C:\Windows\System\DlmlzJk.exe
  C:\Windows\System\DlmlzJk.exe
  2⤵
  PID:7580
- C:\Windows\System\qJwvZsS.exe
  C:\Windows\System\qJwvZsS.exe
  2⤵
  PID:7596
- C:\Windows\System\nTpXWKr.exe
  C:\Windows\System\nTpXWKr.exe
  2⤵
  PID:7612
- C:\Windows\System\LPgBPWr.exe
  C:\Windows\System\LPgBPWr.exe
  2⤵
  PID:7628
- C:\Windows\System\lmknqWJ.exe
  C:\Windows\System\lmknqWJ.exe
  2⤵
  PID:7644
- C:\Windows\System\JuGANCS.exe
  C:\Windows\System\JuGANCS.exe
  2⤵
  PID:7660
- C:\Windows\System\Mwxpxpi.exe
  C:\Windows\System\Mwxpxpi.exe
  2⤵
  PID:7676
- C:\Windows\System\GXcziqJ.exe
  C:\Windows\System\GXcziqJ.exe
  2⤵
  PID:7708
- C:\Windows\System\nqFpXsG.exe
  C:\Windows\System\nqFpXsG.exe
  2⤵
  PID:7724
- C:\Windows\System\RGxJYkP.exe
  C:\Windows\System\RGxJYkP.exe
  2⤵
  PID:7740
- C:\Windows\System\ymlIkdC.exe
  C:\Windows\System\ymlIkdC.exe
  2⤵
  PID:7756
- C:\Windows\System\GZqBByK.exe
  C:\Windows\System\GZqBByK.exe
  2⤵
  PID:7776
- C:\Windows\System\VXYbcaw.exe
  C:\Windows\System\VXYbcaw.exe
  2⤵
  PID:7792
- C:\Windows\System\jxciXXD.exe
  C:\Windows\System\jxciXXD.exe
  2⤵
  PID:7808
- C:\Windows\System\PAquXCc.exe
  C:\Windows\System\PAquXCc.exe
  2⤵
  PID:7824
- C:\Windows\System\DJsRysJ.exe
  C:\Windows\System\DJsRysJ.exe
  2⤵
  PID:7840
- C:\Windows\System\iWEqTQv.exe
  C:\Windows\System\iWEqTQv.exe
  2⤵
  PID:7860
- C:\Windows\System\GrdJcky.exe
  C:\Windows\System\GrdJcky.exe
  2⤵
  PID:7876
- C:\Windows\System\MggVczc.exe
  C:\Windows\System\MggVczc.exe
  2⤵
  PID:7892
- C:\Windows\System\ZKPjYTI.exe
  C:\Windows\System\ZKPjYTI.exe
  2⤵
  PID:7908
- C:\Windows\System\smzWMhs.exe
  C:\Windows\System\smzWMhs.exe
  2⤵
  PID:7924
- C:\Windows\System\DNBWxaD.exe
  C:\Windows\System\DNBWxaD.exe
  2⤵
  PID:7940
- C:\Windows\System\tsJCwFI.exe
  C:\Windows\System\tsJCwFI.exe
  2⤵
  PID:7956
- C:\Windows\System\dcCjaZe.exe
  C:\Windows\System\dcCjaZe.exe
  2⤵
  PID:7976
- C:\Windows\System\bctIhgt.exe
  C:\Windows\System\bctIhgt.exe
  2⤵
  PID:7992
- C:\Windows\System\gJUxXdx.exe
  C:\Windows\System\gJUxXdx.exe
  2⤵
  PID:8008
- C:\Windows\System\QTPCvzQ.exe
  C:\Windows\System\QTPCvzQ.exe
  2⤵
  PID:8024
- C:\Windows\System\kGAmQZm.exe
  C:\Windows\System\kGAmQZm.exe
  2⤵
  PID:8040
- C:\Windows\System\BgEGNMK.exe
  C:\Windows\System\BgEGNMK.exe
  2⤵
  PID:8056
- C:\Windows\System\hNxWFAv.exe
  C:\Windows\System\hNxWFAv.exe
  2⤵
  PID:8072
- C:\Windows\System\mpAbkfN.exe
  C:\Windows\System\mpAbkfN.exe
  2⤵
  PID:8088
- C:\Windows\System\sGxysyl.exe
  C:\Windows\System\sGxysyl.exe
  2⤵
  PID:8104
- C:\Windows\System\ErnhbiY.exe
  C:\Windows\System\ErnhbiY.exe
  2⤵
  PID:8120
- C:\Windows\System\dYYZMkJ.exe
  C:\Windows\System\dYYZMkJ.exe
  2⤵
  PID:8136
- C:\Windows\System\LRwXDDv.exe
  C:\Windows\System\LRwXDDv.exe
  2⤵
  PID:8152
- C:\Windows\System\lPeUWbm.exe
  C:\Windows\System\lPeUWbm.exe
  2⤵
  PID:8168
- C:\Windows\System\aTGaWrX.exe
  C:\Windows\System\aTGaWrX.exe
  2⤵
  PID:8184
- C:\Windows\System\KtpuNyE.exe
  C:\Windows\System\KtpuNyE.exe
  2⤵
  PID:7216
- C:\Windows\System\AZSPXgx.exe
  C:\Windows\System\AZSPXgx.exe
  2⤵
  PID:7256
- C:\Windows\System\ejfAegR.exe
  C:\Windows\System\ejfAegR.exe
  2⤵
  PID:6428
- C:\Windows\System\vHdsQpM.exe
  C:\Windows\System\vHdsQpM.exe
  2⤵
  PID:6976
- C:\Windows\System\jiHPzQG.exe
  C:\Windows\System\jiHPzQG.exe
  2⤵
  PID:7240
- C:\Windows\System\TfHQPrV.exe
  C:\Windows\System\TfHQPrV.exe
  2⤵
  PID:6656
- C:\Windows\System\MuprmFa.exe
  C:\Windows\System\MuprmFa.exe
  2⤵
  PID:6228
- C:\Windows\System\Odfqrsr.exe
  C:\Windows\System\Odfqrsr.exe
  2⤵
  PID:7044
- C:\Windows\System\MbQudBu.exe
  C:\Windows\System\MbQudBu.exe
  2⤵
  PID:7296
- C:\Windows\System\tBCXCsE.exe
  C:\Windows\System\tBCXCsE.exe
  2⤵
  PID:7244
- C:\Windows\System\ZzvEwrv.exe
  C:\Windows\System\ZzvEwrv.exe
  2⤵
  PID:7332
- C:\Windows\System\GAiyrUK.exe
  C:\Windows\System\GAiyrUK.exe
  2⤵
  PID:7428
- C:\Windows\System\akWOEFc.exe
  C:\Windows\System\akWOEFc.exe
  2⤵
  PID:7492
- C:\Windows\System\aiWAnvd.exe
  C:\Windows\System\aiWAnvd.exe
  2⤵
  PID:7524
- C:\Windows\System\KDRiOYh.exe
  C:\Windows\System\KDRiOYh.exe
  2⤵
  PID:7320
- C:\Windows\System\PhvZqUW.exe
  C:\Windows\System\PhvZqUW.exe
  2⤵
  PID:7312
- C:\Windows\System\CgAjcJI.exe
  C:\Windows\System\CgAjcJI.exe
  2⤵
  PID:7412
- C:\Windows\System\aFXfvAV.exe
  C:\Windows\System\aFXfvAV.exe
  2⤵
  PID:7476
- C:\Windows\System\QJEaWcA.exe
  C:\Windows\System\QJEaWcA.exe
  2⤵
  PID:7592
- C:\Windows\System\wYoHEVI.exe
  C:\Windows\System\wYoHEVI.exe
  2⤵
  PID:7656
- C:\Windows\System\AdcEnkT.exe
  C:\Windows\System\AdcEnkT.exe
  2⤵
  PID:7540
- C:\Windows\System\OvFUgLI.exe
  C:\Windows\System\OvFUgLI.exe
  2⤵
  PID:7700
- C:\Windows\System\sqXKDCw.exe
  C:\Windows\System\sqXKDCw.exe
  2⤵
  PID:7572
- C:\Windows\System\zGLdSZo.exe
  C:\Windows\System\zGLdSZo.exe
  2⤵
  PID:7716
- C:\Windows\System\qwhFQJv.exe
  C:\Windows\System\qwhFQJv.exe
  2⤵
  PID:7636
- C:\Windows\System\AIgkPvi.exe
  C:\Windows\System\AIgkPvi.exe
  2⤵
  PID:7748
- C:\Windows\System\qxogXim.exe
  C:\Windows\System\qxogXim.exe
  2⤵
  PID:7832
- C:\Windows\System\TBpwWNu.exe
  C:\Windows\System\TBpwWNu.exe
  2⤵
  PID:7836
- C:\Windows\System\jTWgOOD.exe
  C:\Windows\System\jTWgOOD.exe
  2⤵
  PID:7856
- C:\Windows\System\HQxihcW.exe
  C:\Windows\System\HQxihcW.exe
  2⤵
  PID:7932
- C:\Windows\System\aRqCRks.exe
  C:\Windows\System\aRqCRks.exe
  2⤵
  PID:7948
- C:\Windows\System\tPugFaL.exe
  C:\Windows\System\tPugFaL.exe
  2⤵
  PID:7968
- C:\Windows\System\RdiHMmA.exe
  C:\Windows\System\RdiHMmA.exe
  2⤵
  PID:8032
- C:\Windows\System\TZUjVdO.exe
  C:\Windows\System\TZUjVdO.exe
  2⤵
  PID:8096
- C:\Windows\System\PxiuJPi.exe
  C:\Windows\System\PxiuJPi.exe
  2⤵
  PID:8016
- C:\Windows\System\ITNtDtg.exe
  C:\Windows\System\ITNtDtg.exe
  2⤵
  PID:8048
- C:\Windows\System\yqVguHQ.exe
  C:\Windows\System\yqVguHQ.exe
  2⤵
  PID:8116
- C:\Windows\System\HoBqUrT.exe
  C:\Windows\System\HoBqUrT.exe
  2⤵
  PID:8080
- C:\Windows\System\ALyMOfI.exe
  C:\Windows\System\ALyMOfI.exe
  2⤵
  PID:7080
- C:\Windows\System\ApWNFCX.exe
  C:\Windows\System\ApWNFCX.exe
  2⤵
  PID:7072
- C:\Windows\System\IPMBviU.exe
  C:\Windows\System\IPMBviU.exe
  2⤵
  PID:8180
- C:\Windows\System\XGavXlc.exe
  C:\Windows\System\XGavXlc.exe
  2⤵
  PID:7400
- C:\Windows\System\zfjvAbZ.exe
  C:\Windows\System\zfjvAbZ.exe
  2⤵
  PID:6768
- C:\Windows\System\TNgrbWy.exe
  C:\Windows\System\TNgrbWy.exe
  2⤵
  PID:7364
- C:\Windows\System\qeredRu.exe
  C:\Windows\System\qeredRu.exe
  2⤵
  PID:7384
- C:\Windows\System\sjYqAqP.exe
  C:\Windows\System\sjYqAqP.exe
  2⤵
  PID:7588
- C:\Windows\System\EEvHpIg.exe
  C:\Windows\System\EEvHpIg.exe
  2⤵
  PID:7444
- C:\Windows\System\HZKMNuQ.exe
  C:\Windows\System\HZKMNuQ.exe
  2⤵
  PID:7768
- C:\Windows\System\ayrlzSk.exe
  C:\Windows\System\ayrlzSk.exe
  2⤵
  PID:7736
- C:\Windows\System\wlYnsTX.exe
  C:\Windows\System\wlYnsTX.exe
  2⤵
  PID:7852
- C:\Windows\System\bvBxCZp.exe
  C:\Windows\System\bvBxCZp.exe
  2⤵
  PID:7720
- C:\Windows\System\MvIRGSS.exe
  C:\Windows\System\MvIRGSS.exe
  2⤵
  PID:7900
- C:\Windows\System\SbVbqrr.exe
  C:\Windows\System\SbVbqrr.exe
  2⤵
  PID:7964
- C:\Windows\System\KZEylEq.exe
  C:\Windows\System\KZEylEq.exe
  2⤵
  PID:8068
- C:\Windows\System\QwNTjIZ.exe
  C:\Windows\System\QwNTjIZ.exe
  2⤵
  PID:7292
- C:\Windows\System\lkarrEy.exe
  C:\Windows\System\lkarrEy.exe
  2⤵
  PID:6924
- C:\Windows\System\OyByCId.exe
  C:\Windows\System\OyByCId.exe
  2⤵
  PID:7984
- C:\Windows\System\LsxtlbJ.exe
  C:\Windows\System\LsxtlbJ.exe
  2⤵
  PID:6848
- C:\Windows\System\vveHCAR.exe
  C:\Windows\System\vveHCAR.exe
  2⤵
  PID:7432
- C:\Windows\System\xMxVXQm.exe
  C:\Windows\System\xMxVXQm.exe
  2⤵
  PID:7624
- C:\Windows\System\LKqSoCX.exe
  C:\Windows\System\LKqSoCX.exe
  2⤵
  PID:7496
- C:\Windows\System\VxZaayI.exe
  C:\Windows\System\VxZaayI.exe
  2⤵
  PID:7672
- C:\Windows\System\boNdQRW.exe
  C:\Windows\System\boNdQRW.exe
  2⤵
  PID:7952
- C:\Windows\System\wvhGXPZ.exe
  C:\Windows\System\wvhGXPZ.exe
  2⤵
  PID:8160
- C:\Windows\System\ONwjOdu.exe
  C:\Windows\System\ONwjOdu.exe
  2⤵
  PID:7816
- C:\Windows\System\OEZEWTS.exe
  C:\Windows\System\OEZEWTS.exe
  2⤵
  PID:8132
- C:\Windows\System\zNTAWWa.exe
  C:\Windows\System\zNTAWWa.exe
  2⤵
  PID:8176
- C:\Windows\System\fnSdUyw.exe
  C:\Windows\System\fnSdUyw.exe
  2⤵
  PID:7368
- C:\Windows\System\IPSHeVn.exe
  C:\Windows\System\IPSHeVn.exe
  2⤵
  PID:7668
- C:\Windows\System\AvHolde.exe
  C:\Windows\System\AvHolde.exe
  2⤵
  PID:7916
- C:\Windows\System\fBxQxZR.exe
  C:\Windows\System\fBxQxZR.exe
  2⤵
  PID:7800
- C:\Windows\System\YYfMVKK.exe
  C:\Windows\System\YYfMVKK.exe
  2⤵
  PID:8148
- C:\Windows\System\UdaNRoe.exe
  C:\Windows\System\UdaNRoe.exe
  2⤵
  PID:7652
- C:\Windows\System\kDleHdH.exe
  C:\Windows\System\kDleHdH.exe
  2⤵
  PID:7460
- C:\Windows\System\CfipRuA.exe
  C:\Windows\System\CfipRuA.exe
  2⤵
  PID:8208
- C:\Windows\System\MZtZRxi.exe
  C:\Windows\System\MZtZRxi.exe
  2⤵
  PID:8224
- C:\Windows\System\gygdYxB.exe
  C:\Windows\System\gygdYxB.exe
  2⤵
  PID:8240
- C:\Windows\System\cBXZrgO.exe
  C:\Windows\System\cBXZrgO.exe
  2⤵
  PID:8256
- C:\Windows\System\fxSTfKc.exe
  C:\Windows\System\fxSTfKc.exe
  2⤵
  PID:8272
- C:\Windows\System\HfyeREe.exe
  C:\Windows\System\HfyeREe.exe
  2⤵
  PID:8288
- C:\Windows\System\iiFPEIN.exe
  C:\Windows\System\iiFPEIN.exe
  2⤵
  PID:8304
- C:\Windows\System\kpFSvyO.exe
  C:\Windows\System\kpFSvyO.exe
  2⤵
  PID:8460
- C:\Windows\System\OIspfCd.exe
  C:\Windows\System\OIspfCd.exe
  2⤵
  PID:8476
- C:\Windows\System\gvMEkHY.exe
  C:\Windows\System\gvMEkHY.exe
  2⤵
  PID:8564
- C:\Windows\System\qTjPTwB.exe
  C:\Windows\System\qTjPTwB.exe
  2⤵
  PID:8588
- C:\Windows\System\YKVWsDv.exe
  C:\Windows\System\YKVWsDv.exe
  2⤵
  PID:8608
- C:\Windows\System\opPdEsf.exe
  C:\Windows\System\opPdEsf.exe
  2⤵
  PID:8624
- C:\Windows\System\DSMPlHI.exe
  C:\Windows\System\DSMPlHI.exe
  2⤵
  PID:8640
- C:\Windows\System\TcaxiWP.exe
  C:\Windows\System\TcaxiWP.exe
  2⤵
  PID:8656
- C:\Windows\System\AjvSOfK.exe
  C:\Windows\System\AjvSOfK.exe
  2⤵
  PID:8672
- C:\Windows\System\kFSnYIn.exe
  C:\Windows\System\kFSnYIn.exe
  2⤵
  PID:8688
- C:\Windows\System\JbrqAqN.exe
  C:\Windows\System\JbrqAqN.exe
  2⤵
  PID:8704
- C:\Windows\System\HjxUxvG.exe
  C:\Windows\System\HjxUxvG.exe
  2⤵
  PID:8720
- C:\Windows\System\kkwiggB.exe
  C:\Windows\System\kkwiggB.exe
  2⤵
  PID:8736
- C:\Windows\System\EtXATyz.exe
  C:\Windows\System\EtXATyz.exe
  2⤵
  PID:8756
- C:\Windows\System\GSxHBdv.exe
  C:\Windows\System\GSxHBdv.exe
  2⤵
  PID:8772
- C:\Windows\System\iycxqzy.exe
  C:\Windows\System\iycxqzy.exe
  2⤵
  PID:8792
- C:\Windows\System\DvgnzzM.exe
  C:\Windows\System\DvgnzzM.exe
  2⤵
  PID:8808
- C:\Windows\System\sPhzViP.exe
  C:\Windows\System\sPhzViP.exe
  2⤵
  PID:8824
- C:\Windows\System\PKLevuV.exe
  C:\Windows\System\PKLevuV.exe
  2⤵
  PID:8840
- C:\Windows\System\rIyNKhk.exe
  C:\Windows\System\rIyNKhk.exe
  2⤵
  PID:8856
- C:\Windows\System\xUlIkba.exe
  C:\Windows\System\xUlIkba.exe
  2⤵
  PID:8872
- C:\Windows\System\gwhrCKP.exe
  C:\Windows\System\gwhrCKP.exe
  2⤵
  PID:8888
- C:\Windows\System\HltMYCq.exe
  C:\Windows\System\HltMYCq.exe
  2⤵
  PID:8904
- C:\Windows\System\DoPRvSq.exe
  C:\Windows\System\DoPRvSq.exe
  2⤵
  PID:8920
- C:\Windows\System\OsrnAce.exe
  C:\Windows\System\OsrnAce.exe
  2⤵
  PID:8936
- C:\Windows\System\CJBOnis.exe
  C:\Windows\System\CJBOnis.exe
  2⤵
  PID:8952
- C:\Windows\System\yUibnBS.exe
  C:\Windows\System\yUibnBS.exe
  2⤵
  PID:8968
- C:\Windows\System\TLhUQFV.exe
  C:\Windows\System\TLhUQFV.exe
  2⤵
  PID:8984
- C:\Windows\System\SuuSfvH.exe
  C:\Windows\System\SuuSfvH.exe
  2⤵
  PID:9000
- C:\Windows\System\zZucSmJ.exe
  C:\Windows\System\zZucSmJ.exe
  2⤵
  PID:9016
- C:\Windows\System\xSKkbyR.exe
  C:\Windows\System\xSKkbyR.exe
  2⤵
  PID:9036
- C:\Windows\System\qVjHiAS.exe
  C:\Windows\System\qVjHiAS.exe
  2⤵
  PID:9052
- C:\Windows\System\EDjFLod.exe
  C:\Windows\System\EDjFLod.exe
  2⤵
  PID:9076
- C:\Windows\System\lOXRgxF.exe
  C:\Windows\System\lOXRgxF.exe
  2⤵
  PID:9092
- C:\Windows\System\fGSTegA.exe
  C:\Windows\System\fGSTegA.exe
  2⤵
  PID:9108
- C:\Windows\System\YGesjNc.exe
  C:\Windows\System\YGesjNc.exe
  2⤵
  PID:9124
- C:\Windows\System\pxAqbKR.exe
  C:\Windows\System\pxAqbKR.exe
  2⤵
  PID:9140
- C:\Windows\System\NtlhSFV.exe
  C:\Windows\System\NtlhSFV.exe
  2⤵
  PID:9156
- C:\Windows\System\RNNybwd.exe
  C:\Windows\System\RNNybwd.exe
  2⤵
  PID:9172
- C:\Windows\System\lCQTXFL.exe
  C:\Windows\System\lCQTXFL.exe
  2⤵
  PID:9188
- C:\Windows\System\iQmYQhQ.exe
  C:\Windows\System\iQmYQhQ.exe
  2⤵
  PID:9204
- C:\Windows\System\rGghiVj.exe
  C:\Windows\System\rGghiVj.exe
  2⤵
  PID:8144
- C:\Windows\System\HEuqfPO.exe
  C:\Windows\System\HEuqfPO.exe
  2⤵
  PID:8232
- C:\Windows\System\tgGFJms.exe
  C:\Windows\System\tgGFJms.exe
  2⤵
  PID:8300
- C:\Windows\System\WIRuRKt.exe
  C:\Windows\System\WIRuRKt.exe
  2⤵
  PID:8280
- C:\Windows\System\bEkbCwD.exe
  C:\Windows\System\bEkbCwD.exe
  2⤵
  PID:8064
- C:\Windows\System\ikQpmRj.exe
  C:\Windows\System\ikQpmRj.exe
  2⤵
  PID:8252
- C:\Windows\System\AABbqlt.exe
  C:\Windows\System\AABbqlt.exe
  2⤵
  PID:8332
- C:\Windows\System\DYlrHNy.exe
  C:\Windows\System\DYlrHNy.exe
  2⤵
  PID:8340
- C:\Windows\System\DQEeTrN.exe
  C:\Windows\System\DQEeTrN.exe
  2⤵
  PID:8360
- C:\Windows\System\cOtlLgI.exe
  C:\Windows\System\cOtlLgI.exe
  2⤵
  PID:8376
- C:\Windows\System\lhStupu.exe
  C:\Windows\System\lhStupu.exe
  2⤵
  PID:8388
- C:\Windows\System\vJycvjh.exe
  C:\Windows\System\vJycvjh.exe
  2⤵
  PID:8412
- C:\Windows\System\EQfFbmg.exe
  C:\Windows\System\EQfFbmg.exe
  2⤵
  PID:8428
- C:\Windows\System\zQINZbL.exe
  C:\Windows\System\zQINZbL.exe
  2⤵
  PID:8444
- C:\Windows\System\plWplBq.exe
  C:\Windows\System\plWplBq.exe
  2⤵
  PID:8456
- C:\Windows\System\bCxHKlF.exe
  C:\Windows\System\bCxHKlF.exe
  2⤵
  PID:8492
- C:\Windows\System\XVJkLFs.exe
  C:\Windows\System\XVJkLFs.exe
  2⤵
  PID:8508
- C:\Windows\System\YZDTDuK.exe
  C:\Windows\System\YZDTDuK.exe
  2⤵
  PID:8524
- C:\Windows\System\mpmLCwC.exe
  C:\Windows\System\mpmLCwC.exe
  2⤵
  PID:8536
- C:\Windows\System\JnGGyFo.exe
  C:\Windows\System\JnGGyFo.exe
  2⤵
  PID:8552
- C:\Windows\System\NCOfDAb.exe
  C:\Windows\System\NCOfDAb.exe
  2⤵
  PID:8580
- C:\Windows\System\MCzJTvJ.exe
  C:\Windows\System\MCzJTvJ.exe
  2⤵
  PID:8632
- C:\Windows\System\njBAsAL.exe
  C:\Windows\System\njBAsAL.exe
  2⤵
  PID:8668
- C:\Windows\System\gaVYkzG.exe
  C:\Windows\System\gaVYkzG.exe
  2⤵
  PID:8648
- C:\Windows\System\XhBfpaR.exe
  C:\Windows\System\XhBfpaR.exe
  2⤵
  PID:8996
- C:\Windows\System\uZjuMKk.exe
  C:\Windows\System\uZjuMKk.exe
  2⤵
  PID:8884
- C:\Windows\System\gjrpxAZ.exe
  C:\Windows\System\gjrpxAZ.exe
  2⤵
  PID:9008
- C:\Windows\System\dlEsIUy.exe
  C:\Windows\System\dlEsIUy.exe
  2⤵
  PID:9100
- C:\Windows\System\WsyZssI.exe
  C:\Windows\System\WsyZssI.exe
  2⤵
  PID:9164
- C:\Windows\System\GfJgKUu.exe
  C:\Windows\System\GfJgKUu.exe
  2⤵
  PID:9148
- C:\Windows\System\EwaCuYk.exe
  C:\Windows\System\EwaCuYk.exe
  2⤵
  PID:8264
- C:\Windows\System\HEbTxbk.exe
  C:\Windows\System\HEbTxbk.exe
  2⤵
  PID:7732
- C:\Windows\System\FWwsXZa.exe
  C:\Windows\System\FWwsXZa.exe
  2⤵
  PID:8316
- C:\Windows\System\UpLVisI.exe
  C:\Windows\System\UpLVisI.exe
  2⤵
  PID:8420
- C:\Windows\System\jQgXFfY.exe
  C:\Windows\System\jQgXFfY.exe
  2⤵
  PID:8500
- C:\Windows\System\DmZCyMZ.exe
  C:\Windows\System\DmZCyMZ.exe
  2⤵
  PID:8204
- C:\Windows\System\nRzGhWW.exe
  C:\Windows\System\nRzGhWW.exe
  2⤵
  PID:8248
- C:\Windows\System\WdFovbm.exe
  C:\Windows\System\WdFovbm.exe
  2⤵
  PID:8368
- C:\Windows\System\YXkchqC.exe
  C:\Windows\System\YXkchqC.exe
  2⤵
  PID:8520
- C:\Windows\System\FCxJmMa.exe
  C:\Windows\System\FCxJmMa.exe
  2⤵
  PID:8600
- C:\Windows\System\oXsJDVl.exe
  C:\Windows\System\oXsJDVl.exe
  2⤵
  PID:8616
- C:\Windows\System\XpYbyoA.exe
  C:\Windows\System\XpYbyoA.exe
  2⤵
  PID:8560
- C:\Windows\System\TrccbHr.exe
  C:\Windows\System\TrccbHr.exe
  2⤵
  PID:8716
- C:\Windows\System\hoymfUg.exe
  C:\Windows\System\hoymfUg.exe
  2⤵
  PID:8752
- C:\Windows\System\yknurmK.exe
  C:\Windows\System\yknurmK.exe
  2⤵
  PID:8732
- C:\Windows\System\lWceUBi.exe
  C:\Windows\System\lWceUBi.exe
  2⤵
  PID:8744
- C:\Windows\System\TctJXUt.exe
  C:\Windows\System\TctJXUt.exe
  2⤵
  PID:8816
- C:\Windows\System\AIhBMxv.exe
  C:\Windows\System\AIhBMxv.exe
  2⤵
  PID:8880
- C:\Windows\System\dRBwcbx.exe
  C:\Windows\System\dRBwcbx.exe
  2⤵
  PID:8900
- C:\Windows\System\fFvkvBf.exe
  C:\Windows\System\fFvkvBf.exe
  2⤵
  PID:8912
- C:\Windows\System\aIjFNQj.exe
  C:\Windows\System\aIjFNQj.exe
  2⤵
  PID:9068
- C:\Windows\System\tTTjrBH.exe
  C:\Windows\System\tTTjrBH.exe
  2⤵
  PID:9032
- C:\Windows\System\tqftzNi.exe
  C:\Windows\System\tqftzNi.exe
  2⤵
  PID:8372
- C:\Windows\System\PQbVEpW.exe
  C:\Windows\System\PQbVEpW.exe
  2⤵
  PID:8548
- C:\Windows\System\Mvvisyt.exe
  C:\Windows\System\Mvvisyt.exe
  2⤵
  PID:8620
- C:\Windows\System\mKaiKZG.exe
  C:\Windows\System\mKaiKZG.exe
  2⤵
  PID:8664
- C:\Windows\System\WUbXTvV.exe
  C:\Windows\System\WUbXTvV.exe
  2⤵
  PID:8800
- C:\Windows\System\wnjNukP.exe
  C:\Windows\System\wnjNukP.exe
  2⤵
  PID:8868
- C:\Windows\System\CuMPaCL.exe
  C:\Windows\System\CuMPaCL.exe
  2⤵
  PID:8932
- C:\Windows\System\jxmuwph.exe
  C:\Windows\System\jxmuwph.exe
  2⤵
  PID:8992
- C:\Windows\System\oBvKETO.exe
  C:\Windows\System\oBvKETO.exe
  2⤵
  PID:9168
- C:\Windows\System\wfcMxeO.exe
  C:\Windows\System\wfcMxeO.exe
  2⤵
  PID:8324
- C:\Windows\System\FhFfIwW.exe
  C:\Windows\System\FhFfIwW.exe
  2⤵
  PID:8468
- C:\Windows\System\GSkiBCi.exe
  C:\Windows\System\GSkiBCi.exe
  2⤵
  PID:9132
- C:\Windows\System\hOXJPiA.exe
  C:\Windows\System\hOXJPiA.exe
  2⤵
  PID:8960
- C:\Windows\System\vXqOzUB.exe
  C:\Windows\System\vXqOzUB.exe
  2⤵
  PID:8200
- C:\Windows\System\nAFaAWL.exe
  C:\Windows\System\nAFaAWL.exe
  2⤵
  PID:9084
- C:\Windows\System\nmPOnro.exe
  C:\Windows\System\nmPOnro.exe
  2⤵
  PID:8380
- C:\Windows\System\xzdMfUI.exe
  C:\Windows\System\xzdMfUI.exe
  2⤵
  PID:8488
- C:\Windows\System\YNshHHb.exe
  C:\Windows\System\YNshHHb.exe
  2⤵
  PID:8532
- C:\Windows\System\PGlQCWd.exe
  C:\Windows\System\PGlQCWd.exe
  2⤵
  PID:8848
- C:\Windows\System\LiWMBaI.exe
  C:\Windows\System\LiWMBaI.exe
  2⤵
  PID:8916
- C:\Windows\System\XstWZPb.exe
  C:\Windows\System\XstWZPb.exe
  2⤵
  PID:9116
- C:\Windows\System\zgcqqPF.exe
  C:\Windows\System\zgcqqPF.exe
  2⤵
  PID:8336
- C:\Windows\System\pROVsvM.exe
  C:\Windows\System\pROVsvM.exe
  2⤵
  PID:9220
- C:\Windows\System\gKPwtqM.exe
  C:\Windows\System\gKPwtqM.exe
  2⤵
  PID:9236
- C:\Windows\System\emkXhUf.exe
  C:\Windows\System\emkXhUf.exe
  2⤵
  PID:9252
- C:\Windows\System\NVqcekX.exe
  C:\Windows\System\NVqcekX.exe
  2⤵
  PID:9272
- C:\Windows\System\UhdMlPr.exe
  C:\Windows\System\UhdMlPr.exe
  2⤵
  PID:9288
- C:\Windows\System\ZjBCOMt.exe
  C:\Windows\System\ZjBCOMt.exe
  2⤵
  PID:9304
- C:\Windows\System\AnNpPyX.exe
  C:\Windows\System\AnNpPyX.exe
  2⤵
  PID:9320
- C:\Windows\System\GQfKohU.exe
  C:\Windows\System\GQfKohU.exe
  2⤵
  PID:9336
- C:\Windows\System\swZKZXZ.exe
  C:\Windows\System\swZKZXZ.exe
  2⤵
  PID:9352
- C:\Windows\System\LAseFLq.exe
  C:\Windows\System\LAseFLq.exe
  2⤵
  PID:9368
- C:\Windows\System\ZeVoIsG.exe
  C:\Windows\System\ZeVoIsG.exe
  2⤵
  PID:9384
- C:\Windows\System\XGEequL.exe
  C:\Windows\System\XGEequL.exe
  2⤵
  PID:9404
- C:\Windows\System\mrohAua.exe
  C:\Windows\System\mrohAua.exe
  2⤵
  PID:9420
- C:\Windows\System\xQcPOWA.exe
  C:\Windows\System\xQcPOWA.exe
  2⤵
  PID:9528
- C:\Windows\System\MijeBuU.exe
  C:\Windows\System\MijeBuU.exe
  2⤵
  PID:9544
- C:\Windows\System\VrxccCZ.exe
  C:\Windows\System\VrxccCZ.exe
  2⤵
  PID:9560
- C:\Windows\System\RITNUOL.exe
  C:\Windows\System\RITNUOL.exe
  2⤵
  PID:9584
- C:\Windows\System\rSGeTBS.exe
  C:\Windows\System\rSGeTBS.exe
  2⤵
  PID:9600
- C:\Windows\System\SRIYsEM.exe
  C:\Windows\System\SRIYsEM.exe
  2⤵
  PID:9616
- C:\Windows\System\NyziQwP.exe
  C:\Windows\System\NyziQwP.exe
  2⤵
  PID:9640
- C:\Windows\System\DTBjfTZ.exe
  C:\Windows\System\DTBjfTZ.exe
  2⤵
  PID:9656
- C:\Windows\System\aybZLKN.exe
  C:\Windows\System\aybZLKN.exe
  2⤵
  PID:9672
- C:\Windows\System\hZfIDtB.exe
  C:\Windows\System\hZfIDtB.exe
  2⤵
  PID:9692
- C:\Windows\System\NGuLzfV.exe
  C:\Windows\System\NGuLzfV.exe
  2⤵
  PID:9708
- C:\Windows\System\iaMLrmR.exe
  C:\Windows\System\iaMLrmR.exe
  2⤵
  PID:9724
- C:\Windows\System\PopeMGR.exe
  C:\Windows\System\PopeMGR.exe
  2⤵
  PID:9740
- C:\Windows\System\jAdXOvN.exe
  C:\Windows\System\jAdXOvN.exe
  2⤵
  PID:9756
- C:\Windows\System\KJlDGZX.exe
  C:\Windows\System\KJlDGZX.exe
  2⤵
  PID:9776
- C:\Windows\System\kLfruRq.exe
  C:\Windows\System\kLfruRq.exe
  2⤵
  PID:9792
- C:\Windows\System\cSypvNB.exe
  C:\Windows\System\cSypvNB.exe
  2⤵
  PID:9808
- C:\Windows\System\gQMyvyz.exe
  C:\Windows\System\gQMyvyz.exe
  2⤵
  PID:9824
- C:\Windows\System\djsQcYn.exe
  C:\Windows\System\djsQcYn.exe
  2⤵
  PID:9844
- C:\Windows\System\LTqBdbk.exe
  C:\Windows\System\LTqBdbk.exe
  2⤵
  PID:9860
- C:\Windows\System\LXLIjuj.exe
  C:\Windows\System\LXLIjuj.exe
  2⤵
  PID:9876
- C:\Windows\System\lkLyOGS.exe
  C:\Windows\System\lkLyOGS.exe
  2⤵
  PID:9892
- C:\Windows\System\TAwGKbm.exe
  C:\Windows\System\TAwGKbm.exe
  2⤵
  PID:9912
- C:\Windows\System\cktIiqg.exe
  C:\Windows\System\cktIiqg.exe
  2⤵
  PID:9928
- C:\Windows\System\eFAGlaO.exe
  C:\Windows\System\eFAGlaO.exe
  2⤵
  PID:9944
- C:\Windows\System\kyFczYN.exe
  C:\Windows\System\kyFczYN.exe
  2⤵
  PID:9960
- C:\Windows\System\JenpjHA.exe
  C:\Windows\System\JenpjHA.exe
  2⤵
  PID:9980
- C:\Windows\System\uSHEDuz.exe
  C:\Windows\System\uSHEDuz.exe
  2⤵
  PID:9996
- C:\Windows\System\yYLsdoL.exe
  C:\Windows\System\yYLsdoL.exe
  2⤵
  PID:10012
- C:\Windows\System\cFHOnFY.exe
  C:\Windows\System\cFHOnFY.exe
  2⤵
  PID:10028
- C:\Windows\System\dKgxhfh.exe
  C:\Windows\System\dKgxhfh.exe
  2⤵
  PID:10044
- C:\Windows\System\QBIZhWg.exe
  C:\Windows\System\QBIZhWg.exe
  2⤵
  PID:10064
- C:\Windows\System\VbTJoci.exe
  C:\Windows\System\VbTJoci.exe
  2⤵
  PID:10080
- C:\Windows\System\eafQcJH.exe
  C:\Windows\System\eafQcJH.exe
  2⤵
  PID:10096
- C:\Windows\System\WwCzuVa.exe
  C:\Windows\System\WwCzuVa.exe
  2⤵
  PID:10116
- C:\Windows\System\bzzjafR.exe
  C:\Windows\System\bzzjafR.exe
  2⤵
  PID:10132
- C:\Windows\System\uAIGZdO.exe
  C:\Windows\System\uAIGZdO.exe
  2⤵
  PID:10148
- C:\Windows\System\cUwEuWT.exe
  C:\Windows\System\cUwEuWT.exe
  2⤵
  PID:10168
- C:\Windows\System\HuELMMP.exe
  C:\Windows\System\HuELMMP.exe
  2⤵
  PID:10184
- C:\Windows\System\vElkswd.exe
  C:\Windows\System\vElkswd.exe
  2⤵
  PID:10200
- C:\Windows\System\VwbxLfq.exe
  C:\Windows\System\VwbxLfq.exe
  2⤵
  PID:10216
- C:\Windows\System\sLCIOCE.exe
  C:\Windows\System\sLCIOCE.exe
  2⤵
  PID:10232
- C:\Windows\System\ZKAXexe.exe
  C:\Windows\System\ZKAXexe.exe
  2⤵
  PID:1584
- C:\Windows\System\AUWFZlJ.exe
  C:\Windows\System\AUWFZlJ.exe
  2⤵
  PID:9196
- C:\Windows\System\DARapBC.exe
  C:\Windows\System\DARapBC.exe
  2⤵
  PID:8436
- C:\Windows\System\gigSYKq.exe
  C:\Windows\System\gigSYKq.exe
  2⤵
  PID:9316
- C:\Windows\System\iRoPRkS.exe
  C:\Windows\System\iRoPRkS.exe
  2⤵
  PID:9380
- C:\Windows\System\UMzBFYt.exe
  C:\Windows\System\UMzBFYt.exe
  2⤵
  PID:9332
- C:\Windows\System\gdwspON.exe
  C:\Windows\System\gdwspON.exe
  2⤵
  PID:9268
- C:\Windows\System\nSrQKOA.exe
  C:\Windows\System\nSrQKOA.exe
  2⤵
  PID:9392
- C:\Windows\System\UioXoHy.exe
  C:\Windows\System\UioXoHy.exe
  2⤵
  PID:8804
- C:\Windows\System\NpuYLlo.exe
  C:\Windows\System\NpuYLlo.exe
  2⤵
  PID:8700
- C:\Windows\System\mXvEtrj.exe
  C:\Windows\System\mXvEtrj.exe
  2⤵
  PID:9416
- C:\Windows\System\iLsQbcs.exe
  C:\Windows\System\iLsQbcs.exe
  2⤵
  PID:9448
- C:\Windows\System\PgMVovC.exe
  C:\Windows\System\PgMVovC.exe
  2⤵
  PID:9460
- C:\Windows\System\AcnMoSw.exe
  C:\Windows\System\AcnMoSw.exe
  2⤵
  PID:9480
- C:\Windows\System\XUCnQSX.exe
  C:\Windows\System\XUCnQSX.exe
  2⤵
  PID:8836
- C:\Windows\System\luGgECI.exe
  C:\Windows\System\luGgECI.exe
  2⤵
  PID:9536
- C:\Windows\System\NCWgmBl.exe
  C:\Windows\System\NCWgmBl.exe
  2⤵
  PID:9576
- C:\Windows\System\ltgIqQm.exe
  C:\Windows\System\ltgIqQm.exe
  2⤵
  PID:9524
- C:\Windows\System\nQtLoDZ.exe
  C:\Windows\System\nQtLoDZ.exe
  2⤵
  PID:9608
- C:\Windows\System\TJeFolu.exe
  C:\Windows\System\TJeFolu.exe
  2⤵
  PID:9680
- C:\Windows\System\jkVtmsr.exe
  C:\Windows\System\jkVtmsr.exe
  2⤵
  PID:9772
- C:\Windows\System\yulCrEp.exe
  C:\Windows\System\yulCrEp.exe
  2⤵
  PID:9816
- C:\Windows\System\pHJZjZx.exe
  C:\Windows\System\pHJZjZx.exe
  2⤵
  PID:9596
- C:\Windows\System\ZpJcbVt.exe
  C:\Windows\System\ZpJcbVt.exe
  2⤵
  PID:9592
- C:\Windows\System\SPeCgMC.exe
  C:\Windows\System\SPeCgMC.exe
  2⤵
  PID:9952
- C:\Windows\System\yuQHJcl.exe
  C:\Windows\System\yuQHJcl.exe
  2⤵
  PID:9668
- C:\Windows\System\jGvUWMD.exe
  C:\Windows\System\jGvUWMD.exe
  2⤵
  PID:9800
- C:\Windows\System\zKoIQmy.exe
  C:\Windows\System\zKoIQmy.exe
  2⤵
  PID:9704
- C:\Windows\System\gaNjsny.exe
  C:\Windows\System\gaNjsny.exe
  2⤵
  PID:9832
- C:\Windows\System\AEqbLbW.exe
  C:\Windows\System\AEqbLbW.exe
  2⤵
  PID:9872
- C:\Windows\System\JBwuGgI.exe
  C:\Windows\System\JBwuGgI.exe
  2⤵
  PID:9968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CCEHOWR.exe

Filesize
1.9MB

MD5
3b48d92e9887cf58018c6dc3f67260c5

SHA1
7d53d1688154cb1579297bf19416220123e310ee

SHA256
d6a0283eced520ffbda2a64aead6a22462578352c45fe85d8208965d481986ea

SHA512
ad7756689eef34fe5a7b1b15aed99c801c9cafcbb10452970cdf39f1a8152b009bbeb4489fb03ea461dd191f9ea4be13b287b3ce7943646a8dfefae498c59454

Download Submit
C:\Windows\system\GnEOtvm.exe

Filesize
1.9MB

MD5
93acc81f8b7459553f41a032f44b63b4

SHA1
492d6a659b1daaf1d7394a357c6efc5e6dd80cb9

SHA256
fe5527ff82ff0aafbc81bfd97bccc65bc83417f175a8b84d7c37f29b69e3f993

SHA512
6c34303ece74d1e45470e301dfc4d39a1afa4e751355dbc4b1b5e9ab39a848ed91356c3a39ae17b5b1ae7096de73272c115f654047302c22bc9c99a8b0d78ae9

Download Submit
C:\Windows\system\HzMzsOg.exe

Filesize
1.9MB

MD5
3790eaeabe660d64072420e555a4551e

SHA1
431c12590454f2500afa6b98c9c5cd66158d102f

SHA256
3da03ac36bf46969fa4023364bde9a2d59a59c751ca4105a13e424d3e4dbe83a

SHA512
f08a23f79a34ddcbbbc053fc28ee2fe0408aa6aa0fc83421f89602e6266240b16c587bc05817eb4fd8a20eefaf166c83fae3afa875c17a9f8cb0277d955b0c79

Download Submit
C:\Windows\system\IGkaybT.exe

Filesize
1.9MB

MD5
2ab1c7a15eaf122e2e9840a1a1aeaa7d

SHA1
656e6cde8acca6272c8b2c4f5a73417db96aad39

SHA256
f16be38aa069f1166e0ac21339436efa403df73ac0f7a597ffe038d79fc0e624

SHA512
05be28111442374aa1aecbda717cef4185d4c83b1da74948141b6e642e8e65d179dda4fd4c65fd4c2e2db2e084532352a16998959c12b26e79a199a14eb0806c

Download Submit
C:\Windows\system\JNAjlkN.exe

Filesize
1.9MB

MD5
7047d4bdb6caca0e8a3617ec029c9850

SHA1
b8d08ed8f846847579fb6201461630329a6747aa

SHA256
b7751d9fb5189f07c80f16b99304372868303c5e8cfd1ffc6e0a23199aff8dc0

SHA512
57068425a06f0834c2372bf32d1a24bd98514ba123a5adadddd808019d7d77535a6b3b1280afabac9335cb1fd89bdba56a101742e34cab163ec93cbdb0b8d0fb

Download Submit
C:\Windows\system\JscTagu.exe

Filesize
1.9MB

MD5
26a588669e36708f998c2013cd05b806

SHA1
a439c8ddc573bfaadc28ec8d3b09b2b8ed4e3100

SHA256
bf3cf58ec1f91012b55da4fd8652090f84036ed39ff4bc54a65131b362492c09

SHA512
9e7324265f8c1c40dd985858e92841656b29d814a3b0b8134795b961f2a1942fce88d7333e496bdb96cd81309298435b6ddc851a03e2fc119671e8c1242d0c2e

Download Submit
C:\Windows\system\KImJzfg.exe

Filesize
1.9MB

MD5
e9540635d87edaadf697d385b9fa87d1

SHA1
bd3200cbe759415f6f406a4c74833573a82752bb

SHA256
e8f1f5a356a454027e4fa8afd34e5bf34813ba08768de1699a36cb92ae179c08

SHA512
875488fae39f8121fc83228ccb28a7857d1a95fb4aab210d4b31267b3568fcf77a2a2be49130d8857b03ab82851c02f5612c3b1cd8cbc9e60d91352e589ecfa5

Download Submit
C:\Windows\system\KTueZOo.exe

Filesize
1.9MB

MD5
f6c2fd9cdbb05b0d053e67300532bc54

SHA1
4a853f41c58e2a916a65aa09fae895b785f44093

SHA256
48f6af64ca9ed0bdde2af347b39ac3f677456f84b5399a8cc14cc6c50b3eebcd

SHA512
120bdf24560c1b97b4b5188ef16a134ffaa4c69c4f1c0a8a518987392d10e36b61b04e4f8d77bbe952fd55336c8fe7cfbee46557323556b171c4f8917c05d15c

Download Submit
C:\Windows\system\LGvUOut.exe

Filesize
1.9MB

MD5
a59b22c81e62b101d7992419822c4460

SHA1
acb5b7bc51d849dc5303e181526f01f90267d5e8

SHA256
13f66ec6ebc95c8cf60de968dde12f1f2567589b8d13100d67174b6f1fd00cd0

SHA512
10b133032ef23cdd7ef3577258c4778f7d6626647e222a68b53a788bc723166f8d8635caf0e6bd4542143a13d46cd7c5cdcec444eb18161768d9cb56733f4a61

Download Submit
C:\Windows\system\MeqnlGX.exe

Filesize
1.9MB

MD5
c5d97ad9c7b881d9f4228b0c64e43958

SHA1
61f081cae2cdf0b47c7a9c8026babbcd7f3d1661

SHA256
7838ce4e1d56c362104cf42e09d2cdc8bbfaa39c18d90c745634f18b572ff341

SHA512
be365828f040ae1f6b43d8c038cc9a2e08078aa701a84033cead68b97a1bbc685573c8cc34aa23f8b1afd1210b572d1544b63e288f73a59f82ba8f778185577a

Download Submit
C:\Windows\system\SgEAPYt.exe

Filesize
1.9MB

MD5
379973207dea93000c03f6f0f5a83066

SHA1
9444a21d09bd95bca17c4d2757b987f948c29c93

SHA256
88de0cb1965bfd32d935ca38c5b037a602a59e632ea51892010119515bc26355

SHA512
02582b9d81510d6e93333ab410c3bf7928742b7b7047878126c574670cc67f3575c8e7ef9cbbb687414f876d3f2d1dd3cedf091bc441cbaeb34a04af4d40a5ef

Download Submit
C:\Windows\system\XalwjaX.exe

Filesize
1.9MB

MD5
a92a5b9f169a3c9159dc4170505027b2

SHA1
a175f4301fcc396788c27b0ba0a752d19de40e41

SHA256
31ca12bec6a0f2f499363a0c2e4025c002e6ab6ab174dd39ef1520c386f931e8

SHA512
0f4e30db2ea607d05d6c3659a536f09a34414f5c4aa730233b4756009f874635392a7f63ea5d92ed30ff75358a2e19402573b233d759bbf1def3a79c4eb32a3c

Download Submit
C:\Windows\system\XcefFzg.exe

Filesize
1.9MB

MD5
34b1274dafe7799a30b9e34e42d28b99

SHA1
b3075cc267844f83f3046d8c64fbe6d5c76c683b

SHA256
74c4312bbe8bb593cf4bfcd1d3a5aab1c6d82f64506bf83ced22184023ba80fd

SHA512
87d9c1f92575f8ca172e6926df4fb91c1c862c39e5990f5142e3f3b936de27c1a5f373bb83b6d5cf3befb9b5c3fd17fb565e414d1cbb2fa866e78c1a9be45768

Download Submit
C:\Windows\system\bqIhAtY.exe

Filesize
1.9MB

MD5
b79a9699d7d787e3b1046448120e6138

SHA1
6aae48c0ec813590e829495b0dd0b7c546620642

SHA256
eb86fca523dead86306f56bdc1f15efd5fbd97001bad09f5466184e1beaf7b6a

SHA512
e989ba2f6b6a96bbb53f0dab49433474d19e698e66c7cb0ecd4b2ede9c66fdb7cbdc132367d87233ef331933f7d25618c8ef73f1b076f8ab27d328357cb70075

Download Submit
C:\Windows\system\cgudfgY.exe

Filesize
1.9MB

MD5
6c5957de7119ed030d1a510abbeb0aec

SHA1
0a7f4e15818d3ad406e97fda96bbbb0d322a3648

SHA256
70a7ef669c271f27e9d902b8a579bca0720c0b44020bf4dcd6fa278d80ed805d

SHA512
4d46b7169d60d62e29ee830dec108f4355c3d37aa46e36812ff6c65760ec88fb50026b28a3003e563ddf806658993cbff10021669d39839de7de82151cef5d9e

Download Submit
C:\Windows\system\fmAHthR.exe

Filesize
1.9MB

MD5
6c765d401a985d2b0a276938175d3a5c

SHA1
9998552df0e24e3abf66ed8c4aafef29e1057ea4

SHA256
3acd1eb3f437eb1c8b91a74cb49907f4900b9b38cd074c3c8eeeadf6aeb5a2c0

SHA512
a643831ec6c90ba98d26c871f49c6a260f69f1368ff35e076321c36600933256c39e9c36486212526899cfe15806547af51ed219276870eda2dff89be1d3d600

Download Submit
C:\Windows\system\iNqGFMI.exe

Filesize
1.9MB

MD5
30a89e9f81dd59642241373abf68d7ac

SHA1
e6dc694786728213ae7850033f4cd608547ba71d

SHA256
78bd157fc76ff27de7a82adf170c000638a55bed71392e37092dd7ea9a6f5d7e

SHA512
c86c7785cf283671aaff08875bdab978b857fa72902f08c21a6bb638d4751c0f83c47f40b751e5b25154a664f99f9367626625fd64d3987fdd037e112c059bf2

Download Submit
C:\Windows\system\jJuJsTt.exe

Filesize
1.9MB

MD5
72bb3c1783390420b0933024a024409d

SHA1
d917c80fdd6074cc075cf227d5b8500ba0c89e61

SHA256
e76291d3e38b2f784f86b61a4e607cbe6a1447f2cac7e98a0d3649700bee2d73

SHA512
8eb63d1b5c0b3ced7475947856428828826ab6b50fbbb2b9e91c56efa46f5afd1e2bc15e294c1e040b1d8add673b4217fe13316788bfd3938c11b950b3e93ff7

Download Submit
C:\Windows\system\qxFuxUF.exe

Filesize
1.9MB

MD5
9b25946af2e9182418ebe97a13f4ebb6

SHA1
9b0f74363905edeb2a4a2646b0febf80845fa942

SHA256
aab19bf83b8a406f6227dec4af04a0ab254a36abeb9f1eddd0daa8118d0c4f5d

SHA512
844363c1412bc94edbd4e70136473fdacd916fbefae8c3d74723e078da0a747b8e031f4aeb8f4438b57ccab5b6b643fb148a049a871afa369f47e34e9afdafe4

Download Submit
C:\Windows\system\rFITzxe.exe

Filesize
1.9MB

MD5
d0e3a896cff40059408b993ffa88255f

SHA1
39ac4adaae697262c61c30b1b51d2375bb5ce3e3

SHA256
bb428fbc0263be9c2fff6cba30844d15eefc2f03a259761f5c64bbcbcee917aa

SHA512
7a17ed7e6f9377fb3ed2c800ccbb916ef9802d84ab029c2c3e04413423d052605ee164545293c1da82a8285cc263e3214ba7d689c8f2761d151abe7423fdd298

Download Submit
C:\Windows\system\rMKAuhx.exe

Filesize
1.9MB

MD5
7b5d0d49b921728d4333508d2b9106de

SHA1
064f7431f3d8590fd150a72ee804b305def3ef0f

SHA256
41595e73e5bc1322b637504a7d8baa6085a4f4215799736f987578f8255b651e

SHA512
fcdcfeb2c81f24b749a349c307154714f2f14250988df03376e49a54821457b15063c4cde1fc2f6245737ba73cdec60d38f31f39726d3eb40aa2261f1f4ea431

Download Submit
C:\Windows\system\sZZtDiQ.exe

Filesize
1.9MB

MD5
211c952ae4ab0004106e9fd7d825a216

SHA1
7c483f6082cce1ea5d49c6cc47169d1384f310ea

SHA256
70e9b3fca68a1daefc6e619eb4092f0df700478e599a4432c2324ca864f73fce

SHA512
3bafaf59799940deac71044928caf998bccad71e61c7e888fa36c50b5a480baaf492efa1731a93fe493f0383ac2203d712922a0f1568c723a9db3ed243a20b58

Download Submit
C:\Windows\system\ssQVpbC.exe

Filesize
1.9MB

MD5
20b495959f2a030c14e8da4032d3a549

SHA1
e90727adea9469a9a81bca57b4e14af859712b42

SHA256
4ba75cbc74b4320b903185c303324ba9f8da679fd18736b4acba47012bdffd81

SHA512
306e80a7e99722e1bb9d06426ce111b70189e689c24bf6db9afd5cae2dcd5fc962cf218e62572c3268f72386cb5d5734cd3fe77bee032a750adf1dd6f701b011

Download Submit
C:\Windows\system\yMNuZEH.exe

Filesize
1.9MB

MD5
fe702f1063d86dfc6982b96a2b14ddf9

SHA1
48012eff5574cb25c9878154139faec2451931b5

SHA256
cc2349f5d3529e121cdbc7af2d3b73c04ffadd3c69accf8c42f966ef62bea7f0

SHA512
1918f066010a59ac8b696a5130fd1822521c2ec8578f71d0385d903c9723f9338c0b4b602b7f2fb0e5b78ccc405cb39c2a9b8839c3132f90f396660143fcffeb

Download Submit
C:\Windows\system\yklDuKM.exe

Filesize
1.9MB

MD5
eb2b066ca4e27ff4c1288cc56cd789a8

SHA1
a8bd0a2d64ac84af52d5ac49dc9c6e5530df4400

SHA256
ea58a0711e1059a3e717fd9d5d1dad571aacfb59ec69e73386fa5b98dbf0b837

SHA512
87c826bfc010bb3a18387c79ec7f8e6d459119107830febfcd76bc63fa93c3f890a2960bbbf95cd2aaf72b1ff8492f4132e0eebc837dffa874350234e199d9a0

Download Submit
C:\Windows\system\zaSjjcc.exe

Filesize
1.9MB

MD5
61c4b27e3ffeb8434e2edd1d537ab10b

SHA1
7e5aecca838b25b914ef445275b05ebb19391305

SHA256
bb2c7f13706617f97abaa1563988edc5b4781f3a1309cf30f5d545f25f18a50b

SHA512
98d5c210e762435118756b7af2d9219d16186d3fce74b43a477272bbf994289cb4d7790b5d05c268f334c45226f491f8f7b4b2e1737a39f582a0bae12510f18e

Download Submit
\Windows\system\LsRavSL.exe

Filesize
1.9MB

MD5
dfa15c95bc9dcef7b57ea89b4e827f04

SHA1
1f2bc8bee373076acd69754045e40c15393ce074

SHA256
78caa227113d6d2267c012e55545fa5aa64fd7094168cb5ef10cbfd18720594a

SHA512
e26a347f9a3d980dc449e632637e7df778560ab81e65f98191627fec62228ff29b1f54988a084a2d06af2f97411df29852f4d22658be14e13691d9eff1a8493c

Download Submit
\Windows\system\RPneZDk.exe

Filesize
1.9MB

MD5
2ae0a5620c2bec980fd0587e073acdf0

SHA1
bff132076a916c9fad53569d6e9767c66bc331bd

SHA256
c77ccaf04f74de9b902c44697354f7076bdb173b3dcae679652967e430c6c5b8

SHA512
71af3a10f5b26d1261b31a3911cff64184e470ec0546d8ba46106bfba209787f02ce1a574b896961d072651f65c35c469380290dee90f79f201b833ddb027525

Download Submit
\Windows\system\ZWKhqGR.exe

Filesize
1.9MB

MD5
2d00b5288ac829ca37b4e71f0aab3b1b

SHA1
5c5f926af24b9c4e62c658b6cf359a36dfa40b00

SHA256
1b137a3da30b114324539aab852dec2f3b60c0f0e13eb8e5136e82cc0b571486

SHA512
0588b89025efb5606246d52da96ed0473cb1111b489bd661fad59f4342eb370d1ca2fc8f6c66d812d1d51c47a2b71b725b5d3bd58432ef9d7173ea486e588747

Download Submit
\Windows\system\aRUREVZ.exe

Filesize
1.9MB

MD5
28ee3fbbd19cb7a700eeaa16373503b6

SHA1
e357312037a6e9fb00e0e537d49e3163aefe871d

SHA256
7621a5ce2bb0ba7c7e28a4fefbdecbe7f1389b0f5c111993008f2c52cba6fab7

SHA512
d9b6148b99e22d5b244017fed6d28f6cd184ec60fe7f1bdd3493f97595f0c465c07d6fe3d548efaffd07dc10b4d0354d80700876b5792fc1c0564b697e03fbc5

Download Submit
\Windows\system\cKHKHtI.exe

Filesize
1.9MB

MD5
90243b7a4cbd3bc13173e1dd3256b5ac

SHA1
197f5981d3c04dbdbd5a5d5174444b5388566954

SHA256
e37689855e9a7821508c7f5b6669eec73d9743533331542fa5d33f7f0f4d6a88

SHA512
7d137f5b1452756004fd8c931e7292e6f75782e28c4aaccb46b10ba8b945595f9cf49671509b0c2022bc2adaed0881acc418fe6b73005e5d0832e1d46627a044

Download Submit
\Windows\system\qqCherE.exe

Filesize
1.9MB

MD5
628b19123121a890a7f52c237fadea78

SHA1
0e5bbc5135b8d55343772140712d9a7bbaf96de2

SHA256
124e58942eaad7578b45c69c3ab2ed676dd06903da18b96bac3296ae8bb92be9

SHA512
436b088835efb3495914be00e55c34bf5365fc900559e1e2ced3408ad053069a331a9f06134495a74568217f5a322cf9191cb3802f5d36092ad1326213ab51d4

Download Submit
memory/352-80-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/352-12-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1592-89-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2132-18-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-72-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-85-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-53-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2508-59-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2540-77-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-25-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-640-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-83-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2636-26-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2768-96-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2784-52-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2784-87-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2784-61-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2784-1121-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2784-58-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2784-95-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2784-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2784-11-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/2784-0-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-84-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-81-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2784-44-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-68-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-34-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2784-33-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2784-32-0x0000000003260000-0x0000000003652000-memory.dmp

Filesize
3.9MB

Download
memory/2792-40-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2792-94-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2968-62-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2968-63-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/3048-78-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download