xmrig | ec45f86d5a13c252bed5e2954d9ac86da3144eb1052ce4e0537cb122af82e58e

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
Size

1.9MB
MD5

044b48a5146b9abfeac7762dc35c2211
SHA1

b6f6ed292f490c49a537967c8ec3a9968d22fab7
SHA256

ec45f86d5a13c252bed5e2954d9ac86da3144eb1052ce4e0537cb122af82e58e
SHA512

da41894642e587e80f698c36a43be446cfb429a1baf71e37901d7351a913cf10352937d1d122a92126067aebc2db273efd212faccc7fe275e89d7d9e980b4397
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UgUl:NABU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/3024-9-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/1588-43-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2496-42-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2776-36-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2644-34-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2616-26-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2888-84-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2616-87-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2884-68-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/580-66-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2660-64-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/3024-1742-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2616-2179-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2776-2198-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/1588-2408-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2564-2409-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/572-2407-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2496-2479-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2660-2226-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2644-2225-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/580-2223-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/1916-2222-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2884-3356-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3024	IYqWnKZ.exe
2616	TDYEePi.exe
2644	pFnDSdV.exe
2776	UuwBwfN.exe
2496	eJUczIo.exe
1588	cOMiucG.exe
2660	JsXaKYw.exe
580	liLjhdx.exe
2884	RJmBdpp.exe
572	YHZnXCH.exe
1916	sZDLhET.exe
2564	jNorRaW.exe
2720	bYyJNzp.exe
2760	owqKSKF.exe
1968	FnNcUZz.exe
1932	DRPebHL.exe
864	nZHAUlh.exe
1504	VvuMxsg.exe
2164	nnDbNIA.exe
2432	hKtYimg.exe
1440	sXdCEyS.exe
956	wsPHwoR.exe
2852	QMseoPN.exe
1492	SUSbEuD.exe
1532	DecVCWD.exe
1716	iaqBCtW.exe
540	XncmMyh.exe
308	xmRgdGu.exe
268	EhtfaHt.exe
2064	PbtHvSf.exe
1096	aFqYTum.exe
1060	xabuXfv.exe
1816	fCOHthV.exe
1552	XHWVrDs.exe
2452	HLDrBbl.exe
2708	zVHnjzH.exe
2804	xocTWeR.exe
2448	HkeMxXj.exe
2080	JFGCiAu.exe
2020	MucikHy.exe
908	zupxDkY.exe
2140	cMOjXTL.exe
1432	BrrIxTW.exe
1736	mfVUUWE.exe
1728	ZzdULWj.exe
1772	yaYXpzV.exe
3060	PYfqpnC.exe
2444	hcCxdmU.exe
1764	fgXJYSb.exe
1752	QRuGprG.exe
892	sPSaAdS.exe
1792	URgAZkl.exe
2904	SdXvFIH.exe
1608	kAnhusx.exe
1596	uRiQiLG.exe
3020	LDWquGK.exe
2652	kgLeMYW.exe
2664	GkrHchS.exe
2684	MIgtarb.exe
1696	vqvpYLU.exe
2488	UiyEDUc.exe
1652	aWmtJHC.exe
2508	JMnNLSg.exe
1200	pYIgHCS.exe

Loads dropped DLL 64 IoCs

pid	Process
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2888-1-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x000d000000014698-5.dat	upx
behavioral1/memory/3024-9-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x00090000000155e2-40.dat	upx
behavioral1/memory/1588-43-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2496-42-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2776-36-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2644-34-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0008000000015364-18.dat	upx
behavioral1/files/0x002c000000014b6d-10.dat	upx
behavioral1/memory/2616-26-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x00070000000155d9-25.dat	upx
behavioral1/files/0x0008000000015d88-52.dat	upx
behavioral1/files/0x0007000000016d01-60.dat	upx
behavioral1/files/0x0006000000016d11-69.dat	upx
behavioral1/memory/1916-81-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2888-84-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2616-87-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2564-88-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x0006000000016d4a-99.dat	upx
behavioral1/files/0x0006000000016d84-114.dat	upx
behavioral1/files/0x0006000000016e56-124.dat	upx
behavioral1/files/0x000500000001868c-139.dat	upx
behavioral1/files/0x0006000000018b33-169.dat	upx
behavioral1/files/0x0006000000018b6a-189.dat	upx
behavioral1/files/0x0006000000018b42-179.dat	upx
behavioral1/files/0x0006000000018b4a-184.dat	upx
behavioral1/files/0x0006000000018b37-173.dat	upx
behavioral1/files/0x0006000000018ae8-159.dat	upx
behavioral1/files/0x0006000000018b15-163.dat	upx
behavioral1/files/0x00050000000186a0-149.dat	upx
behavioral1/files/0x0006000000018ae2-153.dat	upx
behavioral1/files/0x0005000000018698-144.dat	upx
behavioral1/files/0x0006000000017090-134.dat	upx
behavioral1/files/0x000600000001704f-129.dat	upx
behavioral1/files/0x0006000000016d89-119.dat	upx
behavioral1/files/0x0006000000016d55-109.dat	upx
behavioral1/files/0x0006000000016d4f-104.dat	upx
behavioral1/files/0x0006000000016d41-91.dat	upx
behavioral1/files/0x0006000000016d36-86.dat	upx
behavioral1/memory/572-74-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x0006000000016d24-77.dat	upx
behavioral1/memory/2884-68-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/580-66-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2660-64-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-62.dat	upx
behavioral1/files/0x002b000000014c67-17.dat	upx
behavioral1/memory/3024-1742-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2616-2179-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2776-2198-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/1588-2408-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2564-2409-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/572-2407-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2496-2479-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2660-2226-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2644-2225-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/580-2223-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/1916-2222-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2884-3356-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HfRkEYE.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\RvzapSG.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\MucikHy.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\gFNZMbg.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ZLfopev.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\GxwlHDR.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\OjRPZAH.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\umoKYGT.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\UivCSMo.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ITqVZkw.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\uoqDaki.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\xYRqyvX.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\chNzTEj.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\vJbTMug.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ZFjCbFB.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\spAgzJH.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\kHvwsnc.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\XcKKJIo.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\LKwUvLj.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\vqvpYLU.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\AvYZnSq.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\NUvjaLr.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\cswaMvL.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\EWlMkez.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\BAHLJpV.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\KtsodnW.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ftKJXhi.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\NueruJT.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\HhQRpni.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\pgpkhZp.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\tbBvNRi.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\IBdEsIR.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\WancWuf.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\qlTJeRv.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\DSWcLyt.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\vRmualw.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ielBzPv.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ggmDzhG.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\SBJiaOu.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\FgQpiAU.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\HWqdVzF.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\WMzybfo.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ZJvqeNA.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ASvqZsR.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\IjSRxXg.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ZdujvsC.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\yLSWKKe.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\EtTTncu.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\fKNerfD.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ZEvoVRq.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\xjtjxwq.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\IitVsLq.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\hhYtOOQ.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\ZXbxKxq.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\rPdkEYt.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\YJAJZlv.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\VOSwTEc.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\qTrUaas.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\KJNjycM.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\HWdFeGs.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\FsnBxUL.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\FGovGNq.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\gsOESFw.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
File created	C:\Windows\System\oEwLYGR.exe	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2900	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	29
PID 2888 wrote to memory of 2900	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	29
PID 2888 wrote to memory of 2900	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	29
PID 2888 wrote to memory of 3024	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	30
PID 2888 wrote to memory of 3024	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	30
PID 2888 wrote to memory of 3024	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	30
PID 2888 wrote to memory of 2616	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	31
PID 2888 wrote to memory of 2616	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	31
PID 2888 wrote to memory of 2616	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	31
PID 2888 wrote to memory of 2644	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	32
PID 2888 wrote to memory of 2644	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	32
PID 2888 wrote to memory of 2644	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	32
PID 2888 wrote to memory of 2496	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	33
PID 2888 wrote to memory of 2496	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	33
PID 2888 wrote to memory of 2496	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	33
PID 2888 wrote to memory of 2776	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	34
PID 2888 wrote to memory of 2776	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	34
PID 2888 wrote to memory of 2776	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	34
PID 2888 wrote to memory of 1588	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	35
PID 2888 wrote to memory of 1588	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	35
PID 2888 wrote to memory of 1588	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	35
PID 2888 wrote to memory of 2660	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	36
PID 2888 wrote to memory of 2660	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	36
PID 2888 wrote to memory of 2660	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	36
PID 2888 wrote to memory of 2884	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	37
PID 2888 wrote to memory of 2884	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	37
PID 2888 wrote to memory of 2884	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	37
PID 2888 wrote to memory of 580	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	38
PID 2888 wrote to memory of 580	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	38
PID 2888 wrote to memory of 580	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	38
PID 2888 wrote to memory of 572	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	39
PID 2888 wrote to memory of 572	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	39
PID 2888 wrote to memory of 572	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	39
PID 2888 wrote to memory of 1916	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	40
PID 2888 wrote to memory of 1916	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	40
PID 2888 wrote to memory of 1916	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	40
PID 2888 wrote to memory of 2564	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	41
PID 2888 wrote to memory of 2564	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	41
PID 2888 wrote to memory of 2564	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	41
PID 2888 wrote to memory of 2720	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	42
PID 2888 wrote to memory of 2720	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	42
PID 2888 wrote to memory of 2720	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	42
PID 2888 wrote to memory of 2760	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	43
PID 2888 wrote to memory of 2760	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	43
PID 2888 wrote to memory of 2760	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	43
PID 2888 wrote to memory of 1968	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	44
PID 2888 wrote to memory of 1968	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	44
PID 2888 wrote to memory of 1968	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	44
PID 2888 wrote to memory of 1932	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	45
PID 2888 wrote to memory of 1932	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	45
PID 2888 wrote to memory of 1932	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	45
PID 2888 wrote to memory of 864	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	46
PID 2888 wrote to memory of 864	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	46
PID 2888 wrote to memory of 864	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	46
PID 2888 wrote to memory of 1504	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	47
PID 2888 wrote to memory of 1504	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	47
PID 2888 wrote to memory of 1504	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	47
PID 2888 wrote to memory of 2164	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	48
PID 2888 wrote to memory of 2164	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	48
PID 2888 wrote to memory of 2164	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	48
PID 2888 wrote to memory of 2432	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	49
PID 2888 wrote to memory of 2432	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	49
PID 2888 wrote to memory of 2432	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	49
PID 2888 wrote to memory of 1440	2888	044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\044b48a5146b9abfeac7762dc35c2211_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System\IYqWnKZ.exe
  C:\Windows\System\IYqWnKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\TDYEePi.exe
  C:\Windows\System\TDYEePi.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\pFnDSdV.exe
  C:\Windows\System\pFnDSdV.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\eJUczIo.exe
  C:\Windows\System\eJUczIo.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\UuwBwfN.exe
  C:\Windows\System\UuwBwfN.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\cOMiucG.exe
  C:\Windows\System\cOMiucG.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\JsXaKYw.exe
  C:\Windows\System\JsXaKYw.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\RJmBdpp.exe
  C:\Windows\System\RJmBdpp.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\liLjhdx.exe
  C:\Windows\System\liLjhdx.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\YHZnXCH.exe
  C:\Windows\System\YHZnXCH.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\sZDLhET.exe
  C:\Windows\System\sZDLhET.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\jNorRaW.exe
  C:\Windows\System\jNorRaW.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\bYyJNzp.exe
  C:\Windows\System\bYyJNzp.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\owqKSKF.exe
  C:\Windows\System\owqKSKF.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\FnNcUZz.exe
  C:\Windows\System\FnNcUZz.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\DRPebHL.exe
  C:\Windows\System\DRPebHL.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\nZHAUlh.exe
  C:\Windows\System\nZHAUlh.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\VvuMxsg.exe
  C:\Windows\System\VvuMxsg.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\nnDbNIA.exe
  C:\Windows\System\nnDbNIA.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\hKtYimg.exe
  C:\Windows\System\hKtYimg.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\sXdCEyS.exe
  C:\Windows\System\sXdCEyS.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\wsPHwoR.exe
  C:\Windows\System\wsPHwoR.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\QMseoPN.exe
  C:\Windows\System\QMseoPN.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\SUSbEuD.exe
  C:\Windows\System\SUSbEuD.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\DecVCWD.exe
  C:\Windows\System\DecVCWD.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\iaqBCtW.exe
  C:\Windows\System\iaqBCtW.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\XncmMyh.exe
  C:\Windows\System\XncmMyh.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\xmRgdGu.exe
  C:\Windows\System\xmRgdGu.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\EhtfaHt.exe
  C:\Windows\System\EhtfaHt.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\PbtHvSf.exe
  C:\Windows\System\PbtHvSf.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\aFqYTum.exe
  C:\Windows\System\aFqYTum.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\xabuXfv.exe
  C:\Windows\System\xabuXfv.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\fCOHthV.exe
  C:\Windows\System\fCOHthV.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\XHWVrDs.exe
  C:\Windows\System\XHWVrDs.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\HLDrBbl.exe
  C:\Windows\System\HLDrBbl.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\zVHnjzH.exe
  C:\Windows\System\zVHnjzH.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\xocTWeR.exe
  C:\Windows\System\xocTWeR.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\HkeMxXj.exe
  C:\Windows\System\HkeMxXj.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\JFGCiAu.exe
  C:\Windows\System\JFGCiAu.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\MucikHy.exe
  C:\Windows\System\MucikHy.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\zupxDkY.exe
  C:\Windows\System\zupxDkY.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\cMOjXTL.exe
  C:\Windows\System\cMOjXTL.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\BrrIxTW.exe
  C:\Windows\System\BrrIxTW.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\mfVUUWE.exe
  C:\Windows\System\mfVUUWE.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\ZzdULWj.exe
  C:\Windows\System\ZzdULWj.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\yaYXpzV.exe
  C:\Windows\System\yaYXpzV.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\PYfqpnC.exe
  C:\Windows\System\PYfqpnC.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\hcCxdmU.exe
  C:\Windows\System\hcCxdmU.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\fgXJYSb.exe
  C:\Windows\System\fgXJYSb.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\QRuGprG.exe
  C:\Windows\System\QRuGprG.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\sPSaAdS.exe
  C:\Windows\System\sPSaAdS.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\URgAZkl.exe
  C:\Windows\System\URgAZkl.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\SdXvFIH.exe
  C:\Windows\System\SdXvFIH.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\kAnhusx.exe
  C:\Windows\System\kAnhusx.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\uRiQiLG.exe
  C:\Windows\System\uRiQiLG.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\LDWquGK.exe
  C:\Windows\System\LDWquGK.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\kgLeMYW.exe
  C:\Windows\System\kgLeMYW.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\GkrHchS.exe
  C:\Windows\System\GkrHchS.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\MIgtarb.exe
  C:\Windows\System\MIgtarb.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\vqvpYLU.exe
  C:\Windows\System\vqvpYLU.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\UiyEDUc.exe
  C:\Windows\System\UiyEDUc.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\aWmtJHC.exe
  C:\Windows\System\aWmtJHC.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\JMnNLSg.exe
  C:\Windows\System\JMnNLSg.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\pYIgHCS.exe
  C:\Windows\System\pYIgHCS.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\YHWcYEm.exe
  C:\Windows\System\YHWcYEm.exe
  2⤵
  PID:2568
- C:\Windows\System\cslSwxN.exe
  C:\Windows\System\cslSwxN.exe
  2⤵
  PID:2600
- C:\Windows\System\NipwsPU.exe
  C:\Windows\System\NipwsPU.exe
  2⤵
  PID:1936
- C:\Windows\System\zStqUvC.exe
  C:\Windows\System\zStqUvC.exe
  2⤵
  PID:1664
- C:\Windows\System\GjtTPxw.exe
  C:\Windows\System\GjtTPxw.exe
  2⤵
  PID:2340
- C:\Windows\System\RkuHlSv.exe
  C:\Windows\System\RkuHlSv.exe
  2⤵
  PID:1920
- C:\Windows\System\caHhqgt.exe
  C:\Windows\System\caHhqgt.exe
  2⤵
  PID:2240
- C:\Windows\System\GfCigJl.exe
  C:\Windows\System\GfCigJl.exe
  2⤵
  PID:1768
- C:\Windows\System\AyjXfJF.exe
  C:\Windows\System\AyjXfJF.exe
  2⤵
  PID:1120
- C:\Windows\System\eyWwXav.exe
  C:\Windows\System\eyWwXav.exe
  2⤵
  PID:1708
- C:\Windows\System\hpXhsys.exe
  C:\Windows\System\hpXhsys.exe
  2⤵
  PID:2992
- C:\Windows\System\OcEsWVO.exe
  C:\Windows\System\OcEsWVO.exe
  2⤵
  PID:2156
- C:\Windows\System\grFXJHJ.exe
  C:\Windows\System\grFXJHJ.exe
  2⤵
  PID:1724
- C:\Windows\System\UKCsJVE.exe
  C:\Windows\System\UKCsJVE.exe
  2⤵
  PID:2296
- C:\Windows\System\mcaSONZ.exe
  C:\Windows\System\mcaSONZ.exe
  2⤵
  PID:632
- C:\Windows\System\qNQVqoG.exe
  C:\Windows\System\qNQVqoG.exe
  2⤵
  PID:1544
- C:\Windows\System\vJbTMug.exe
  C:\Windows\System\vJbTMug.exe
  2⤵
  PID:1028
- C:\Windows\System\NyqnEQj.exe
  C:\Windows\System\NyqnEQj.exe
  2⤵
  PID:2748
- C:\Windows\System\nPZXhmi.exe
  C:\Windows\System\nPZXhmi.exe
  2⤵
  PID:2008
- C:\Windows\System\rCYhnFS.exe
  C:\Windows\System\rCYhnFS.exe
  2⤵
  PID:3052
- C:\Windows\System\rxsQbVp.exe
  C:\Windows\System\rxsQbVp.exe
  2⤵
  PID:1524
- C:\Windows\System\wjgpqgE.exe
  C:\Windows\System\wjgpqgE.exe
  2⤵
  PID:1564
- C:\Windows\System\UoVmbee.exe
  C:\Windows\System\UoVmbee.exe
  2⤵
  PID:2424
- C:\Windows\System\FMUhvUQ.exe
  C:\Windows\System\FMUhvUQ.exe
  2⤵
  PID:2640
- C:\Windows\System\LdJuDFi.exe
  C:\Windows\System\LdJuDFi.exe
  2⤵
  PID:2328
- C:\Windows\System\HfRkEYE.exe
  C:\Windows\System\HfRkEYE.exe
  2⤵
  PID:1748
- C:\Windows\System\jOzeoTX.exe
  C:\Windows\System\jOzeoTX.exe
  2⤵
  PID:2324
- C:\Windows\System\MQGqNfx.exe
  C:\Windows\System\MQGqNfx.exe
  2⤵
  PID:1604
- C:\Windows\System\TiKSudd.exe
  C:\Windows\System\TiKSudd.exe
  2⤵
  PID:2716
- C:\Windows\System\jkmmycB.exe
  C:\Windows\System\jkmmycB.exe
  2⤵
  PID:2360
- C:\Windows\System\aXnuYrH.exe
  C:\Windows\System\aXnuYrH.exe
  2⤵
  PID:2604
- C:\Windows\System\tOGNxZP.exe
  C:\Windows\System\tOGNxZP.exe
  2⤵
  PID:1264
- C:\Windows\System\wNIlItR.exe
  C:\Windows\System\wNIlItR.exe
  2⤵
  PID:2396
- C:\Windows\System\TKFPxgp.exe
  C:\Windows\System\TKFPxgp.exe
  2⤵
  PID:1384
- C:\Windows\System\FeDwqUL.exe
  C:\Windows\System\FeDwqUL.exe
  2⤵
  PID:1928
- C:\Windows\System\knVFCQf.exe
  C:\Windows\System\knVFCQf.exe
  2⤵
  PID:1912
- C:\Windows\System\HtuLOtm.exe
  C:\Windows\System\HtuLOtm.exe
  2⤵
  PID:1100
- C:\Windows\System\JPNpTfX.exe
  C:\Windows\System\JPNpTfX.exe
  2⤵
  PID:2840
- C:\Windows\System\rqdbSIt.exe
  C:\Windows\System\rqdbSIt.exe
  2⤵
  PID:324
- C:\Windows\System\jSPzWKO.exe
  C:\Windows\System\jSPzWKO.exe
  2⤵
  PID:2072
- C:\Windows\System\pVpSRMF.exe
  C:\Windows\System\pVpSRMF.exe
  2⤵
  PID:1180
- C:\Windows\System\iebigDJ.exe
  C:\Windows\System\iebigDJ.exe
  2⤵
  PID:2692
- C:\Windows\System\erEBpZo.exe
  C:\Windows\System\erEBpZo.exe
  2⤵
  PID:776
- C:\Windows\System\MJJuREV.exe
  C:\Windows\System\MJJuREV.exe
  2⤵
  PID:2556
- C:\Windows\System\EgzWidv.exe
  C:\Windows\System\EgzWidv.exe
  2⤵
  PID:1556
- C:\Windows\System\lfcJwZl.exe
  C:\Windows\System\lfcJwZl.exe
  2⤵
  PID:2880
- C:\Windows\System\NueruJT.exe
  C:\Windows\System\NueruJT.exe
  2⤵
  PID:1732
- C:\Windows\System\VYImYkN.exe
  C:\Windows\System\VYImYkN.exe
  2⤵
  PID:696
- C:\Windows\System\PdkDmER.exe
  C:\Windows\System\PdkDmER.exe
  2⤵
  PID:2016
- C:\Windows\System\daspMSx.exe
  C:\Windows\System\daspMSx.exe
  2⤵
  PID:2188
- C:\Windows\System\iWPeTGI.exe
  C:\Windows\System\iWPeTGI.exe
  2⤵
  PID:1396
- C:\Windows\System\vyZMsxC.exe
  C:\Windows\System\vyZMsxC.exe
  2⤵
  PID:2128
- C:\Windows\System\VjrbNAz.exe
  C:\Windows\System\VjrbNAz.exe
  2⤵
  PID:1704
- C:\Windows\System\KJWrmmi.exe
  C:\Windows\System\KJWrmmi.exe
  2⤵
  PID:1808
- C:\Windows\System\BQLetqw.exe
  C:\Windows\System\BQLetqw.exe
  2⤵
  PID:2388
- C:\Windows\System\oaQMxzG.exe
  C:\Windows\System\oaQMxzG.exe
  2⤵
  PID:2964
- C:\Windows\System\DxnQFLS.exe
  C:\Windows\System\DxnQFLS.exe
  2⤵
  PID:2736
- C:\Windows\System\Emsdzll.exe
  C:\Windows\System\Emsdzll.exe
  2⤵
  PID:3040
- C:\Windows\System\MDIrPVf.exe
  C:\Windows\System\MDIrPVf.exe
  2⤵
  PID:1976
- C:\Windows\System\xDAIMUt.exe
  C:\Windows\System\xDAIMUt.exe
  2⤵
  PID:912
- C:\Windows\System\BxJPGCY.exe
  C:\Windows\System\BxJPGCY.exe
  2⤵
  PID:1616
- C:\Windows\System\ZFjCbFB.exe
  C:\Windows\System\ZFjCbFB.exe
  2⤵
  PID:1480
- C:\Windows\System\ajqDelL.exe
  C:\Windows\System\ajqDelL.exe
  2⤵
  PID:1988
- C:\Windows\System\CoXeKJb.exe
  C:\Windows\System\CoXeKJb.exe
  2⤵
  PID:2972
- C:\Windows\System\GMZhJDM.exe
  C:\Windows\System\GMZhJDM.exe
  2⤵
  PID:2920
- C:\Windows\System\aYfkxgW.exe
  C:\Windows\System\aYfkxgW.exe
  2⤵
  PID:2384
- C:\Windows\System\CKYxYqy.exe
  C:\Windows\System\CKYxYqy.exe
  2⤵
  PID:2408
- C:\Windows\System\ZwhnddS.exe
  C:\Windows\System\ZwhnddS.exe
  2⤵
  PID:2000
- C:\Windows\System\gbYGQpL.exe
  C:\Windows\System\gbYGQpL.exe
  2⤵
  PID:1680
- C:\Windows\System\sXqHtcF.exe
  C:\Windows\System\sXqHtcF.exe
  2⤵
  PID:1368
- C:\Windows\System\VFyLiHs.exe
  C:\Windows\System\VFyLiHs.exe
  2⤵
  PID:584
- C:\Windows\System\vxwylHI.exe
  C:\Windows\System\vxwylHI.exe
  2⤵
  PID:2404
- C:\Windows\System\SsCpRlK.exe
  C:\Windows\System\SsCpRlK.exe
  2⤵
  PID:2648
- C:\Windows\System\ckrmyzH.exe
  C:\Windows\System\ckrmyzH.exe
  2⤵
  PID:2728
- C:\Windows\System\GEJTxho.exe
  C:\Windows\System\GEJTxho.exe
  2⤵
  PID:612
- C:\Windows\System\AyjPYHQ.exe
  C:\Windows\System\AyjPYHQ.exe
  2⤵
  PID:2868
- C:\Windows\System\heZVaZM.exe
  C:\Windows\System\heZVaZM.exe
  2⤵
  PID:2100
- C:\Windows\System\CKNgNME.exe
  C:\Windows\System\CKNgNME.exe
  2⤵
  PID:1380
- C:\Windows\System\ASvqZsR.exe
  C:\Windows\System\ASvqZsR.exe
  2⤵
  PID:3016
- C:\Windows\System\JYKEPHt.exe
  C:\Windows\System\JYKEPHt.exe
  2⤵
  PID:2576
- C:\Windows\System\IvORfuc.exe
  C:\Windows\System\IvORfuc.exe
  2⤵
  PID:596
- C:\Windows\System\NQOOhKt.exe
  C:\Windows\System\NQOOhKt.exe
  2⤵
  PID:564
- C:\Windows\System\AQUMzmr.exe
  C:\Windows\System\AQUMzmr.exe
  2⤵
  PID:1592
- C:\Windows\System\DEiYYPp.exe
  C:\Windows\System\DEiYYPp.exe
  2⤵
  PID:1656
- C:\Windows\System\OrMjviX.exe
  C:\Windows\System\OrMjviX.exe
  2⤵
  PID:1224
- C:\Windows\System\DwtSgUo.exe
  C:\Windows\System\DwtSgUo.exe
  2⤵
  PID:1084
- C:\Windows\System\pdcCRgk.exe
  C:\Windows\System\pdcCRgk.exe
  2⤵
  PID:1984
- C:\Windows\System\woAvtss.exe
  C:\Windows\System\woAvtss.exe
  2⤵
  PID:2540
- C:\Windows\System\lRYWQAO.exe
  C:\Windows\System\lRYWQAO.exe
  2⤵
  PID:2984
- C:\Windows\System\FEGAJBS.exe
  C:\Windows\System\FEGAJBS.exe
  2⤵
  PID:1124
- C:\Windows\System\DVMyTFM.exe
  C:\Windows\System\DVMyTFM.exe
  2⤵
  PID:1348
- C:\Windows\System\uoqDaki.exe
  C:\Windows\System\uoqDaki.exe
  2⤵
  PID:2040
- C:\Windows\System\evMpkKh.exe
  C:\Windows\System\evMpkKh.exe
  2⤵
  PID:2228
- C:\Windows\System\xySIZac.exe
  C:\Windows\System\xySIZac.exe
  2⤵
  PID:984
- C:\Windows\System\hDzIksl.exe
  C:\Windows\System\hDzIksl.exe
  2⤵
  PID:948
- C:\Windows\System\GmtRdOu.exe
  C:\Windows\System\GmtRdOu.exe
  2⤵
  PID:1116
- C:\Windows\System\DqpFwVl.exe
  C:\Windows\System\DqpFwVl.exe
  2⤵
  PID:2024
- C:\Windows\System\ucmOZGq.exe
  C:\Windows\System\ucmOZGq.exe
  2⤵
  PID:2004
- C:\Windows\System\AgVyJiF.exe
  C:\Windows\System\AgVyJiF.exe
  2⤵
  PID:2052
- C:\Windows\System\MmLpdAh.exe
  C:\Windows\System\MmLpdAh.exe
  2⤵
  PID:2544
- C:\Windows\System\pKuoEpy.exe
  C:\Windows\System\pKuoEpy.exe
  2⤵
  PID:2700
- C:\Windows\System\aEnsJGA.exe
  C:\Windows\System\aEnsJGA.exe
  2⤵
  PID:1512
- C:\Windows\System\wwIqSjQ.exe
  C:\Windows\System\wwIqSjQ.exe
  2⤵
  PID:2792
- C:\Windows\System\qmrcqms.exe
  C:\Windows\System\qmrcqms.exe
  2⤵
  PID:784
- C:\Windows\System\OhXhvri.exe
  C:\Windows\System\OhXhvri.exe
  2⤵
  PID:1956
- C:\Windows\System\ZcdmQJe.exe
  C:\Windows\System\ZcdmQJe.exe
  2⤵
  PID:968
- C:\Windows\System\fKqZEFO.exe
  C:\Windows\System\fKqZEFO.exe
  2⤵
  PID:476
- C:\Windows\System\Zywrutb.exe
  C:\Windows\System\Zywrutb.exe
  2⤵
  PID:2380
- C:\Windows\System\rcNkOOB.exe
  C:\Windows\System\rcNkOOB.exe
  2⤵
  PID:2732
- C:\Windows\System\qWTvAMp.exe
  C:\Windows\System\qWTvAMp.exe
  2⤵
  PID:1784
- C:\Windows\System\cJorilR.exe
  C:\Windows\System\cJorilR.exe
  2⤵
  PID:2276
- C:\Windows\System\AvKgSIy.exe
  C:\Windows\System\AvKgSIy.exe
  2⤵
  PID:2596
- C:\Windows\System\agBMTmQ.exe
  C:\Windows\System\agBMTmQ.exe
  2⤵
  PID:3008
- C:\Windows\System\jGsFkqT.exe
  C:\Windows\System\jGsFkqT.exe
  2⤵
  PID:1188
- C:\Windows\System\RIJTwpI.exe
  C:\Windows\System\RIJTwpI.exe
  2⤵
  PID:2172
- C:\Windows\System\gkEDPto.exe
  C:\Windows\System\gkEDPto.exe
  2⤵
  PID:436
- C:\Windows\System\UUbESOX.exe
  C:\Windows\System\UUbESOX.exe
  2⤵
  PID:2812
- C:\Windows\System\FWkmCAV.exe
  C:\Windows\System\FWkmCAV.exe
  2⤵
  PID:1372
- C:\Windows\System\lAWSgEC.exe
  C:\Windows\System\lAWSgEC.exe
  2⤵
  PID:1712
- C:\Windows\System\yLSWKKe.exe
  C:\Windows\System\yLSWKKe.exe
  2⤵
  PID:2532
- C:\Windows\System\QMDpvtD.exe
  C:\Windows\System\QMDpvtD.exe
  2⤵
  PID:1112
- C:\Windows\System\dihHVSw.exe
  C:\Windows\System\dihHVSw.exe
  2⤵
  PID:1452
- C:\Windows\System\MNCCvom.exe
  C:\Windows\System\MNCCvom.exe
  2⤵
  PID:2204
- C:\Windows\System\aGAjlBq.exe
  C:\Windows\System\aGAjlBq.exe
  2⤵
  PID:2272
- C:\Windows\System\azWirlH.exe
  C:\Windows\System\azWirlH.exe
  2⤵
  PID:2560
- C:\Windows\System\jbKtWSF.exe
  C:\Windows\System\jbKtWSF.exe
  2⤵
  PID:3084
- C:\Windows\System\FUMkMwI.exe
  C:\Windows\System\FUMkMwI.exe
  2⤵
  PID:3100
- C:\Windows\System\eEnAzKn.exe
  C:\Windows\System\eEnAzKn.exe
  2⤵
  PID:3116
- C:\Windows\System\GOvJHEA.exe
  C:\Windows\System\GOvJHEA.exe
  2⤵
  PID:3132
- C:\Windows\System\UAzHAJm.exe
  C:\Windows\System\UAzHAJm.exe
  2⤵
  PID:3148
- C:\Windows\System\jmUcdTf.exe
  C:\Windows\System\jmUcdTf.exe
  2⤵
  PID:3164
- C:\Windows\System\VEgTmQC.exe
  C:\Windows\System\VEgTmQC.exe
  2⤵
  PID:3180
- C:\Windows\System\SgMJbCY.exe
  C:\Windows\System\SgMJbCY.exe
  2⤵
  PID:3196
- C:\Windows\System\KluhdxY.exe
  C:\Windows\System\KluhdxY.exe
  2⤵
  PID:3212
- C:\Windows\System\smEbimg.exe
  C:\Windows\System\smEbimg.exe
  2⤵
  PID:3228
- C:\Windows\System\oKSshuK.exe
  C:\Windows\System\oKSshuK.exe
  2⤵
  PID:3244
- C:\Windows\System\pckiXcg.exe
  C:\Windows\System\pckiXcg.exe
  2⤵
  PID:3260
- C:\Windows\System\PKBcPmC.exe
  C:\Windows\System\PKBcPmC.exe
  2⤵
  PID:3276
- C:\Windows\System\bIPmBla.exe
  C:\Windows\System\bIPmBla.exe
  2⤵
  PID:3292
- C:\Windows\System\XFuptsj.exe
  C:\Windows\System\XFuptsj.exe
  2⤵
  PID:3308
- C:\Windows\System\WYGsOEW.exe
  C:\Windows\System\WYGsOEW.exe
  2⤵
  PID:3324
- C:\Windows\System\qIgyhKd.exe
  C:\Windows\System\qIgyhKd.exe
  2⤵
  PID:3340
- C:\Windows\System\xfzyTqR.exe
  C:\Windows\System\xfzyTqR.exe
  2⤵
  PID:3356
- C:\Windows\System\FvdgiEX.exe
  C:\Windows\System\FvdgiEX.exe
  2⤵
  PID:3372
- C:\Windows\System\AvYZnSq.exe
  C:\Windows\System\AvYZnSq.exe
  2⤵
  PID:3388
- C:\Windows\System\JSsWgSy.exe
  C:\Windows\System\JSsWgSy.exe
  2⤵
  PID:3404
- C:\Windows\System\lAlhjPf.exe
  C:\Windows\System\lAlhjPf.exe
  2⤵
  PID:3424
- C:\Windows\System\RvzapSG.exe
  C:\Windows\System\RvzapSG.exe
  2⤵
  PID:3440
- C:\Windows\System\tQRueEg.exe
  C:\Windows\System\tQRueEg.exe
  2⤵
  PID:3456
- C:\Windows\System\AbwleDi.exe
  C:\Windows\System\AbwleDi.exe
  2⤵
  PID:3476
- C:\Windows\System\BgrsIuX.exe
  C:\Windows\System\BgrsIuX.exe
  2⤵
  PID:3496
- C:\Windows\System\cnRVlZH.exe
  C:\Windows\System\cnRVlZH.exe
  2⤵
  PID:3512
- C:\Windows\System\tbjQqiE.exe
  C:\Windows\System\tbjQqiE.exe
  2⤵
  PID:3528
- C:\Windows\System\aBYNjkO.exe
  C:\Windows\System\aBYNjkO.exe
  2⤵
  PID:3544
- C:\Windows\System\jXafIdV.exe
  C:\Windows\System\jXafIdV.exe
  2⤵
  PID:3560
- C:\Windows\System\KJNjycM.exe
  C:\Windows\System\KJNjycM.exe
  2⤵
  PID:3576
- C:\Windows\System\lfIygEM.exe
  C:\Windows\System\lfIygEM.exe
  2⤵
  PID:3604
- C:\Windows\System\yWVojrd.exe
  C:\Windows\System\yWVojrd.exe
  2⤵
  PID:3620
- C:\Windows\System\JdHARYw.exe
  C:\Windows\System\JdHARYw.exe
  2⤵
  PID:3636
- C:\Windows\System\auBxAkH.exe
  C:\Windows\System\auBxAkH.exe
  2⤵
  PID:3656
- C:\Windows\System\spAgzJH.exe
  C:\Windows\System\spAgzJH.exe
  2⤵
  PID:3676
- C:\Windows\System\yOwZqqq.exe
  C:\Windows\System\yOwZqqq.exe
  2⤵
  PID:3692
- C:\Windows\System\zysZWGy.exe
  C:\Windows\System\zysZWGy.exe
  2⤵
  PID:3712
- C:\Windows\System\dbEMEAE.exe
  C:\Windows\System\dbEMEAE.exe
  2⤵
  PID:3728
- C:\Windows\System\HWqdVzF.exe
  C:\Windows\System\HWqdVzF.exe
  2⤵
  PID:3744
- C:\Windows\System\QyImLdN.exe
  C:\Windows\System\QyImLdN.exe
  2⤵
  PID:3760
- C:\Windows\System\GLunGZU.exe
  C:\Windows\System\GLunGZU.exe
  2⤵
  PID:3776
- C:\Windows\System\lKletoW.exe
  C:\Windows\System\lKletoW.exe
  2⤵
  PID:3796
- C:\Windows\System\YYQDqvh.exe
  C:\Windows\System\YYQDqvh.exe
  2⤵
  PID:3812
- C:\Windows\System\vRMLmtm.exe
  C:\Windows\System\vRMLmtm.exe
  2⤵
  PID:3828
- C:\Windows\System\AlpHUWu.exe
  C:\Windows\System\AlpHUWu.exe
  2⤵
  PID:3844
- C:\Windows\System\bzyiwLq.exe
  C:\Windows\System\bzyiwLq.exe
  2⤵
  PID:3864
- C:\Windows\System\elZkdkr.exe
  C:\Windows\System\elZkdkr.exe
  2⤵
  PID:3884
- C:\Windows\System\xjgfQqj.exe
  C:\Windows\System\xjgfQqj.exe
  2⤵
  PID:3900
- C:\Windows\System\uyaefiF.exe
  C:\Windows\System\uyaefiF.exe
  2⤵
  PID:3920
- C:\Windows\System\QBeaeWZ.exe
  C:\Windows\System\QBeaeWZ.exe
  2⤵
  PID:3936
- C:\Windows\System\CkMkFAA.exe
  C:\Windows\System\CkMkFAA.exe
  2⤵
  PID:3952
- C:\Windows\System\ZugxCYs.exe
  C:\Windows\System\ZugxCYs.exe
  2⤵
  PID:3968
- C:\Windows\System\oacpwVz.exe
  C:\Windows\System\oacpwVz.exe
  2⤵
  PID:3988
- C:\Windows\System\nBnwyFv.exe
  C:\Windows\System\nBnwyFv.exe
  2⤵
  PID:4004
- C:\Windows\System\DRZimZe.exe
  C:\Windows\System\DRZimZe.exe
  2⤵
  PID:4024
- C:\Windows\System\zqdxipl.exe
  C:\Windows\System\zqdxipl.exe
  2⤵
  PID:4040
- C:\Windows\System\QmIdHle.exe
  C:\Windows\System\QmIdHle.exe
  2⤵
  PID:4060
- C:\Windows\System\PJeBhmh.exe
  C:\Windows\System\PJeBhmh.exe
  2⤵
  PID:4076
- C:\Windows\System\cVJhsHp.exe
  C:\Windows\System\cVJhsHp.exe
  2⤵
  PID:4092
- C:\Windows\System\vPrpEJq.exe
  C:\Windows\System\vPrpEJq.exe
  2⤵
  PID:944
- C:\Windows\System\QXoatNw.exe
  C:\Windows\System\QXoatNw.exe
  2⤵
  PID:3092
- C:\Windows\System\CGfwRxV.exe
  C:\Windows\System\CGfwRxV.exe
  2⤵
  PID:2572
- C:\Windows\System\IaELbmu.exe
  C:\Windows\System\IaELbmu.exe
  2⤵
  PID:3128
- C:\Windows\System\ietOpnC.exe
  C:\Windows\System\ietOpnC.exe
  2⤵
  PID:3156
- C:\Windows\System\HCVrviR.exe
  C:\Windows\System\HCVrviR.exe
  2⤵
  PID:676
- C:\Windows\System\boEivdC.exe
  C:\Windows\System\boEivdC.exe
  2⤵
  PID:3268
- C:\Windows\System\UJprhmA.exe
  C:\Windows\System\UJprhmA.exe
  2⤵
  PID:3252
- C:\Windows\System\KkDrFgy.exe
  C:\Windows\System\KkDrFgy.exe
  2⤵
  PID:3256
- C:\Windows\System\kCpSZqo.exe
  C:\Windows\System\kCpSZqo.exe
  2⤵
  PID:3284
- C:\Windows\System\IGzNDij.exe
  C:\Windows\System\IGzNDij.exe
  2⤵
  PID:3352
- C:\Windows\System\EUwUhwR.exe
  C:\Windows\System\EUwUhwR.exe
  2⤵
  PID:3384
- C:\Windows\System\NHVedGM.exe
  C:\Windows\System\NHVedGM.exe
  2⤵
  PID:3432
- C:\Windows\System\RkRyqxN.exe
  C:\Windows\System\RkRyqxN.exe
  2⤵
  PID:3448
- C:\Windows\System\OcWCWic.exe
  C:\Windows\System\OcWCWic.exe
  2⤵
  PID:3504
- C:\Windows\System\DFJVqfo.exe
  C:\Windows\System\DFJVqfo.exe
  2⤵
  PID:3524
- C:\Windows\System\ebtPCDr.exe
  C:\Windows\System\ebtPCDr.exe
  2⤵
  PID:3556
- C:\Windows\System\EzfCWvI.exe
  C:\Windows\System\EzfCWvI.exe
  2⤵
  PID:3592
- C:\Windows\System\lhHeGpb.exe
  C:\Windows\System\lhHeGpb.exe
  2⤵
  PID:3612
- C:\Windows\System\UuZwcpr.exe
  C:\Windows\System\UuZwcpr.exe
  2⤵
  PID:3644
- C:\Windows\System\kXNPJXP.exe
  C:\Windows\System\kXNPJXP.exe
  2⤵
  PID:3720
- C:\Windows\System\MoVjuUr.exe
  C:\Windows\System\MoVjuUr.exe
  2⤵
  PID:3668
- C:\Windows\System\ZFFlruM.exe
  C:\Windows\System\ZFFlruM.exe
  2⤵
  PID:3824
- C:\Windows\System\aYlUatp.exe
  C:\Windows\System\aYlUatp.exe
  2⤵
  PID:3672
- C:\Windows\System\NUvjaLr.exe
  C:\Windows\System\NUvjaLr.exe
  2⤵
  PID:3768
- C:\Windows\System\uPKXGqO.exe
  C:\Windows\System\uPKXGqO.exe
  2⤵
  PID:3836
- C:\Windows\System\FsrPagA.exe
  C:\Windows\System\FsrPagA.exe
  2⤵
  PID:3860
- C:\Windows\System\sFLqTcg.exe
  C:\Windows\System\sFLqTcg.exe
  2⤵
  PID:3872
- C:\Windows\System\jLDvYqk.exe
  C:\Windows\System\jLDvYqk.exe
  2⤵
  PID:3912
- C:\Windows\System\rFponHr.exe
  C:\Windows\System\rFponHr.exe
  2⤵
  PID:3964
- C:\Windows\System\vrvYccC.exe
  C:\Windows\System\vrvYccC.exe
  2⤵
  PID:3996
- C:\Windows\System\MathHga.exe
  C:\Windows\System\MathHga.exe
  2⤵
  PID:3976
- C:\Windows\System\IVaWIkZ.exe
  C:\Windows\System\IVaWIkZ.exe
  2⤵
  PID:4052
- C:\Windows\System\IJtNvTt.exe
  C:\Windows\System\IJtNvTt.exe
  2⤵
  PID:4068
- C:\Windows\System\EgQVSAf.exe
  C:\Windows\System\EgQVSAf.exe
  2⤵
  PID:952
- C:\Windows\System\FXsSvLy.exe
  C:\Windows\System\FXsSvLy.exe
  2⤵
  PID:3080
- C:\Windows\System\wkXTCPK.exe
  C:\Windows\System\wkXTCPK.exe
  2⤵
  PID:3188
- C:\Windows\System\zUhOOVs.exe
  C:\Windows\System\zUhOOVs.exe
  2⤵
  PID:3224
- C:\Windows\System\vhvqxbY.exe
  C:\Windows\System\vhvqxbY.exe
  2⤵
  PID:3204
- C:\Windows\System\fGrWzIm.exe
  C:\Windows\System\fGrWzIm.exe
  2⤵
  PID:3304
- C:\Windows\System\qbkxOTW.exe
  C:\Windows\System\qbkxOTW.exe
  2⤵
  PID:3396
- C:\Windows\System\OjjcNIR.exe
  C:\Windows\System\OjjcNIR.exe
  2⤵
  PID:3380
- C:\Windows\System\hicFDII.exe
  C:\Windows\System\hicFDII.exe
  2⤵
  PID:3468
- C:\Windows\System\BpvDvGP.exe
  C:\Windows\System\BpvDvGP.exe
  2⤵
  PID:3536
- C:\Windows\System\pmAOJgY.exe
  C:\Windows\System\pmAOJgY.exe
  2⤵
  PID:3572
- C:\Windows\System\iRKzSwO.exe
  C:\Windows\System\iRKzSwO.exe
  2⤵
  PID:3652
- C:\Windows\System\hBLsOwz.exe
  C:\Windows\System\hBLsOwz.exe
  2⤵
  PID:3756
- C:\Windows\System\dUhYUtB.exe
  C:\Windows\System\dUhYUtB.exe
  2⤵
  PID:3804
- C:\Windows\System\SHEomft.exe
  C:\Windows\System\SHEomft.exe
  2⤵
  PID:3852
- C:\Windows\System\ZIRtDZR.exe
  C:\Windows\System\ZIRtDZR.exe
  2⤵
  PID:3896
- C:\Windows\System\wLfwVAT.exe
  C:\Windows\System\wLfwVAT.exe
  2⤵
  PID:3948
- C:\Windows\System\uRyEyok.exe
  C:\Windows\System\uRyEyok.exe
  2⤵
  PID:4048
- C:\Windows\System\uFxtkHC.exe
  C:\Windows\System\uFxtkHC.exe
  2⤵
  PID:1064
- C:\Windows\System\adiPMSN.exe
  C:\Windows\System\adiPMSN.exe
  2⤵
  PID:4016
- C:\Windows\System\AfzdNwI.exe
  C:\Windows\System\AfzdNwI.exe
  2⤵
  PID:3236
- C:\Windows\System\VqbuLpZ.exe
  C:\Windows\System\VqbuLpZ.exe
  2⤵
  PID:2232
- C:\Windows\System\fdmaTQD.exe
  C:\Windows\System\fdmaTQD.exe
  2⤵
  PID:3348
- C:\Windows\System\vMgXJfi.exe
  C:\Windows\System\vMgXJfi.exe
  2⤵
  PID:3452
- C:\Windows\System\QnpoWpA.exe
  C:\Windows\System\QnpoWpA.exe
  2⤵
  PID:3540
- C:\Windows\System\fGMAMqk.exe
  C:\Windows\System\fGMAMqk.exe
  2⤵
  PID:3752
- C:\Windows\System\YrpWyOf.exe
  C:\Windows\System\YrpWyOf.exe
  2⤵
  PID:3664
- C:\Windows\System\xSOTGPu.exe
  C:\Windows\System\xSOTGPu.exe
  2⤵
  PID:3736
- C:\Windows\System\odeQGcG.exe
  C:\Windows\System\odeQGcG.exe
  2⤵
  PID:4084
- C:\Windows\System\VnKLWFE.exe
  C:\Windows\System\VnKLWFE.exe
  2⤵
  PID:3288
- C:\Windows\System\BryhymD.exe
  C:\Windows\System\BryhymD.exe
  2⤵
  PID:2584
- C:\Windows\System\VFjatXm.exe
  C:\Windows\System\VFjatXm.exe
  2⤵
  PID:3596
- C:\Windows\System\DIgcidg.exe
  C:\Windows\System\DIgcidg.exe
  2⤵
  PID:4036
- C:\Windows\System\xzYAgIT.exe
  C:\Windows\System\xzYAgIT.exe
  2⤵
  PID:4108
- C:\Windows\System\AejWgko.exe
  C:\Windows\System\AejWgko.exe
  2⤵
  PID:4124
- C:\Windows\System\OmRhOYk.exe
  C:\Windows\System\OmRhOYk.exe
  2⤵
  PID:4140
- C:\Windows\System\YbCehZJ.exe
  C:\Windows\System\YbCehZJ.exe
  2⤵
  PID:4156
- C:\Windows\System\FfdAunq.exe
  C:\Windows\System\FfdAunq.exe
  2⤵
  PID:4180
- C:\Windows\System\cPxnMYN.exe
  C:\Windows\System\cPxnMYN.exe
  2⤵
  PID:4200
- C:\Windows\System\NifKTCb.exe
  C:\Windows\System\NifKTCb.exe
  2⤵
  PID:4216
- C:\Windows\System\BpQhYTq.exe
  C:\Windows\System\BpQhYTq.exe
  2⤵
  PID:4232
- C:\Windows\System\ynHhIBA.exe
  C:\Windows\System\ynHhIBA.exe
  2⤵
  PID:4248
- C:\Windows\System\vozOSni.exe
  C:\Windows\System\vozOSni.exe
  2⤵
  PID:4264
- C:\Windows\System\lgpjiXX.exe
  C:\Windows\System\lgpjiXX.exe
  2⤵
  PID:4280
- C:\Windows\System\PsrImJw.exe
  C:\Windows\System\PsrImJw.exe
  2⤵
  PID:4296
- C:\Windows\System\fUBvsSk.exe
  C:\Windows\System\fUBvsSk.exe
  2⤵
  PID:4312
- C:\Windows\System\NEGCzZU.exe
  C:\Windows\System\NEGCzZU.exe
  2⤵
  PID:4328
- C:\Windows\System\qBnOuzt.exe
  C:\Windows\System\qBnOuzt.exe
  2⤵
  PID:4344
- C:\Windows\System\NIgBUes.exe
  C:\Windows\System\NIgBUes.exe
  2⤵
  PID:4360
- C:\Windows\System\BEwQsQY.exe
  C:\Windows\System\BEwQsQY.exe
  2⤵
  PID:4380
- C:\Windows\System\UIindNj.exe
  C:\Windows\System\UIindNj.exe
  2⤵
  PID:4396
- C:\Windows\System\hAvIZie.exe
  C:\Windows\System\hAvIZie.exe
  2⤵
  PID:4412
- C:\Windows\System\pDqHCaw.exe
  C:\Windows\System\pDqHCaw.exe
  2⤵
  PID:4428
- C:\Windows\System\yPyuakl.exe
  C:\Windows\System\yPyuakl.exe
  2⤵
  PID:4448
- C:\Windows\System\JRnQBhW.exe
  C:\Windows\System\JRnQBhW.exe
  2⤵
  PID:4464
- C:\Windows\System\jPNOWPk.exe
  C:\Windows\System\jPNOWPk.exe
  2⤵
  PID:4484
- C:\Windows\System\vfXzglf.exe
  C:\Windows\System\vfXzglf.exe
  2⤵
  PID:4500
- C:\Windows\System\ntKrWCQ.exe
  C:\Windows\System\ntKrWCQ.exe
  2⤵
  PID:4520
- C:\Windows\System\kxULHgo.exe
  C:\Windows\System\kxULHgo.exe
  2⤵
  PID:4536
- C:\Windows\System\PAmLzco.exe
  C:\Windows\System\PAmLzco.exe
  2⤵
  PID:4552
- C:\Windows\System\XZXwoBr.exe
  C:\Windows\System\XZXwoBr.exe
  2⤵
  PID:4568
- C:\Windows\System\wUixZSW.exe
  C:\Windows\System\wUixZSW.exe
  2⤵
  PID:4584
- C:\Windows\System\OBibeJI.exe
  C:\Windows\System\OBibeJI.exe
  2⤵
  PID:4604
- C:\Windows\System\InhQUeY.exe
  C:\Windows\System\InhQUeY.exe
  2⤵
  PID:4620
- C:\Windows\System\lxZCvAs.exe
  C:\Windows\System\lxZCvAs.exe
  2⤵
  PID:4636
- C:\Windows\System\dfuwDYz.exe
  C:\Windows\System\dfuwDYz.exe
  2⤵
  PID:4652
- C:\Windows\System\RUoAFch.exe
  C:\Windows\System\RUoAFch.exe
  2⤵
  PID:4668
- C:\Windows\System\QlvXjQt.exe
  C:\Windows\System\QlvXjQt.exe
  2⤵
  PID:4684
- C:\Windows\System\soVcLIA.exe
  C:\Windows\System\soVcLIA.exe
  2⤵
  PID:4704
- C:\Windows\System\dwieXmC.exe
  C:\Windows\System\dwieXmC.exe
  2⤵
  PID:4720
- C:\Windows\System\WwMRJWY.exe
  C:\Windows\System\WwMRJWY.exe
  2⤵
  PID:4736
- C:\Windows\System\FFYMeng.exe
  C:\Windows\System\FFYMeng.exe
  2⤵
  PID:4752
- C:\Windows\System\zubtLQV.exe
  C:\Windows\System\zubtLQV.exe
  2⤵
  PID:4768
- C:\Windows\System\Uhuuzvs.exe
  C:\Windows\System\Uhuuzvs.exe
  2⤵
  PID:4784
- C:\Windows\System\vPQhjjY.exe
  C:\Windows\System\vPQhjjY.exe
  2⤵
  PID:4804
- C:\Windows\System\tTCKWWk.exe
  C:\Windows\System\tTCKWWk.exe
  2⤵
  PID:4820
- C:\Windows\System\hPfbsND.exe
  C:\Windows\System\hPfbsND.exe
  2⤵
  PID:4836
- C:\Windows\System\gRFbbwy.exe
  C:\Windows\System\gRFbbwy.exe
  2⤵
  PID:4852
- C:\Windows\System\RPlmIaE.exe
  C:\Windows\System\RPlmIaE.exe
  2⤵
  PID:4868
- C:\Windows\System\uzOnHic.exe
  C:\Windows\System\uzOnHic.exe
  2⤵
  PID:4884
- C:\Windows\System\fQzBftE.exe
  C:\Windows\System\fQzBftE.exe
  2⤵
  PID:4900
- C:\Windows\System\yMQMplL.exe
  C:\Windows\System\yMQMplL.exe
  2⤵
  PID:4916
- C:\Windows\System\xFyWUca.exe
  C:\Windows\System\xFyWUca.exe
  2⤵
  PID:4932
- C:\Windows\System\IFaPRee.exe
  C:\Windows\System\IFaPRee.exe
  2⤵
  PID:4948
- C:\Windows\System\nlQpdRa.exe
  C:\Windows\System\nlQpdRa.exe
  2⤵
  PID:4964
- C:\Windows\System\GaNnxNz.exe
  C:\Windows\System\GaNnxNz.exe
  2⤵
  PID:4980
- C:\Windows\System\hskMOeP.exe
  C:\Windows\System\hskMOeP.exe
  2⤵
  PID:4996
- C:\Windows\System\GRlytvA.exe
  C:\Windows\System\GRlytvA.exe
  2⤵
  PID:5012
- C:\Windows\System\LOhzxIJ.exe
  C:\Windows\System\LOhzxIJ.exe
  2⤵
  PID:5028
- C:\Windows\System\eqczAVl.exe
  C:\Windows\System\eqczAVl.exe
  2⤵
  PID:5044
- C:\Windows\System\qaYWmGR.exe
  C:\Windows\System\qaYWmGR.exe
  2⤵
  PID:5060
- C:\Windows\System\AjLUNHA.exe
  C:\Windows\System\AjLUNHA.exe
  2⤵
  PID:5076
- C:\Windows\System\aqokBbP.exe
  C:\Windows\System\aqokBbP.exe
  2⤵
  PID:5092
- C:\Windows\System\kHvwsnc.exe
  C:\Windows\System\kHvwsnc.exe
  2⤵
  PID:5112
- C:\Windows\System\PuzlNZQ.exe
  C:\Windows\System\PuzlNZQ.exe
  2⤵
  PID:3300
- C:\Windows\System\RWEvvDm.exe
  C:\Windows\System\RWEvvDm.exe
  2⤵
  PID:4020
- C:\Windows\System\KPimGRR.exe
  C:\Windows\System\KPimGRR.exe
  2⤵
  PID:4120
- C:\Windows\System\nFYiQEo.exe
  C:\Windows\System\nFYiQEo.exe
  2⤵
  PID:3420
- C:\Windows\System\EQwFfAr.exe
  C:\Windows\System\EQwFfAr.exe
  2⤵
  PID:4136
- C:\Windows\System\QAYtFCo.exe
  C:\Windows\System\QAYtFCo.exe
  2⤵
  PID:4164
- C:\Windows\System\IitVsLq.exe
  C:\Windows\System\IitVsLq.exe
  2⤵
  PID:4240
- C:\Windows\System\jSRjYHM.exe
  C:\Windows\System\jSRjYHM.exe
  2⤵
  PID:4272
- C:\Windows\System\CmQgRuz.exe
  C:\Windows\System\CmQgRuz.exe
  2⤵
  PID:4256
- C:\Windows\System\yJXWHoy.exe
  C:\Windows\System\yJXWHoy.exe
  2⤵
  PID:4376
- C:\Windows\System\MuhhGxi.exe
  C:\Windows\System\MuhhGxi.exe
  2⤵
  PID:4404
- C:\Windows\System\ZqyiRGr.exe
  C:\Windows\System\ZqyiRGr.exe
  2⤵
  PID:4292
- C:\Windows\System\qGkQGvA.exe
  C:\Windows\System\qGkQGvA.exe
  2⤵
  PID:4320
- C:\Windows\System\CixfGZm.exe
  C:\Windows\System\CixfGZm.exe
  2⤵
  PID:4440
- C:\Windows\System\pNhvIkM.exe
  C:\Windows\System\pNhvIkM.exe
  2⤵
  PID:4492
- C:\Windows\System\xUYYHIS.exe
  C:\Windows\System\xUYYHIS.exe
  2⤵
  PID:4480
- C:\Windows\System\sgTmSBc.exe
  C:\Windows\System\sgTmSBc.exe
  2⤵
  PID:4548
- C:\Windows\System\bARPjRR.exe
  C:\Windows\System\bARPjRR.exe
  2⤵
  PID:4564
- C:\Windows\System\GEQjxLS.exe
  C:\Windows\System\GEQjxLS.exe
  2⤵
  PID:4592
- C:\Windows\System\nBxpWMb.exe
  C:\Windows\System\nBxpWMb.exe
  2⤵
  PID:4616
- C:\Windows\System\yTtOVGL.exe
  C:\Windows\System\yTtOVGL.exe
  2⤵
  PID:4712
- C:\Windows\System\gpEzkca.exe
  C:\Windows\System\gpEzkca.exe
  2⤵
  PID:4628
- C:\Windows\System\gFNZMbg.exe
  C:\Windows\System\gFNZMbg.exe
  2⤵
  PID:4744
- C:\Windows\System\AXpqeup.exe
  C:\Windows\System\AXpqeup.exe
  2⤵
  PID:4728
- C:\Windows\System\xicqXqN.exe
  C:\Windows\System\xicqXqN.exe
  2⤵
  PID:4844
- C:\Windows\System\ceNtFiF.exe
  C:\Windows\System\ceNtFiF.exe
  2⤵
  PID:4732
- C:\Windows\System\EoJtVif.exe
  C:\Windows\System\EoJtVif.exe
  2⤵
  PID:4828
- C:\Windows\System\zFbcfJy.exe
  C:\Windows\System\zFbcfJy.exe
  2⤵
  PID:4800
- C:\Windows\System\oJxaFLh.exe
  C:\Windows\System\oJxaFLh.exe
  2⤵
  PID:4972
- C:\Windows\System\VIXZmtL.exe
  C:\Windows\System\VIXZmtL.exe
  2⤵
  PID:4956
- C:\Windows\System\aYHACDD.exe
  C:\Windows\System\aYHACDD.exe
  2⤵
  PID:5024
- C:\Windows\System\bmGvOrz.exe
  C:\Windows\System\bmGvOrz.exe
  2⤵
  PID:4992
- C:\Windows\System\MscdPgi.exe
  C:\Windows\System\MscdPgi.exe
  2⤵
  PID:5072
- C:\Windows\System\MgiTrjl.exe
  C:\Windows\System\MgiTrjl.exe
  2⤵
  PID:5088
- C:\Windows\System\rjSyYAl.exe
  C:\Windows\System\rjSyYAl.exe
  2⤵
  PID:3568
- C:\Windows\System\watqCPf.exe
  C:\Windows\System\watqCPf.exe
  2⤵
  PID:3588
- C:\Windows\System\sFBQVsh.exe
  C:\Windows\System\sFBQVsh.exe
  2⤵
  PID:4196
- C:\Windows\System\msIDoYT.exe
  C:\Windows\System\msIDoYT.exe
  2⤵
  PID:3932
- C:\Windows\System\BjlWEzz.exe
  C:\Windows\System\BjlWEzz.exe
  2⤵
  PID:4308
- C:\Windows\System\AYXJrBf.exe
  C:\Windows\System\AYXJrBf.exe
  2⤵
  PID:4388
- C:\Windows\System\jRaiVbJ.exe
  C:\Windows\System\jRaiVbJ.exe
  2⤵
  PID:4496
- C:\Windows\System\AFWoRXH.exe
  C:\Windows\System\AFWoRXH.exe
  2⤵
  PID:4600
- C:\Windows\System\LjVAqLn.exe
  C:\Windows\System\LjVAqLn.exe
  2⤵
  PID:4456
- C:\Windows\System\mEiNmKx.exe
  C:\Windows\System\mEiNmKx.exe
  2⤵
  PID:4532
- C:\Windows\System\gyDDSFW.exe
  C:\Windows\System\gyDDSFW.exe
  2⤵
  PID:4676
- C:\Windows\System\usZriXw.exe
  C:\Windows\System\usZriXw.exe
  2⤵
  PID:4368
- C:\Windows\System\gOPyBAb.exe
  C:\Windows\System\gOPyBAb.exe
  2⤵
  PID:4812
- C:\Windows\System\hhYtOOQ.exe
  C:\Windows\System\hhYtOOQ.exe
  2⤵
  PID:4864
- C:\Windows\System\skAopmh.exe
  C:\Windows\System\skAopmh.exe
  2⤵
  PID:4832
- C:\Windows\System\sxdfCQq.exe
  C:\Windows\System\sxdfCQq.exe
  2⤵
  PID:4764
- C:\Windows\System\wjPEoZf.exe
  C:\Windows\System\wjPEoZf.exe
  2⤵
  PID:5056
- C:\Windows\System\ZXbxKxq.exe
  C:\Windows\System\ZXbxKxq.exe
  2⤵
  PID:4940
- C:\Windows\System\rOBmsZj.exe
  C:\Windows\System\rOBmsZj.exe
  2⤵
  PID:5108
- C:\Windows\System\cvcFadZ.exe
  C:\Windows\System\cvcFadZ.exe
  2⤵
  PID:4116
- C:\Windows\System\HvAxPHr.exe
  C:\Windows\System\HvAxPHr.exe
  2⤵
  PID:4260
- C:\Windows\System\pLGiXGX.exe
  C:\Windows\System\pLGiXGX.exe
  2⤵
  PID:4372
- C:\Windows\System\AusOOhx.exe
  C:\Windows\System\AusOOhx.exe
  2⤵
  PID:4188
- C:\Windows\System\FlzynYZ.exe
  C:\Windows\System\FlzynYZ.exe
  2⤵
  PID:4104
- C:\Windows\System\RLSMQzA.exe
  C:\Windows\System\RLSMQzA.exe
  2⤵
  PID:4960
- C:\Windows\System\uyFOeBZ.exe
  C:\Windows\System\uyFOeBZ.exe
  2⤵
  PID:4056
- C:\Windows\System\GSjorKc.exe
  C:\Windows\System\GSjorKc.exe
  2⤵
  PID:4880
- C:\Windows\System\FeePgcn.exe
  C:\Windows\System\FeePgcn.exe
  2⤵
  PID:4988
- C:\Windows\System\AefpDFr.exe
  C:\Windows\System\AefpDFr.exe
  2⤵
  PID:4896
- C:\Windows\System\GhuwNMO.exe
  C:\Windows\System\GhuwNMO.exe
  2⤵
  PID:4780
- C:\Windows\System\xOQxTZj.exe
  C:\Windows\System\xOQxTZj.exe
  2⤵
  PID:4340
- C:\Windows\System\qfKkYBO.exe
  C:\Windows\System\qfKkYBO.exe
  2⤵
  PID:4692
- C:\Windows\System\ckCLzkL.exe
  C:\Windows\System\ckCLzkL.exe
  2⤵
  PID:4660
- C:\Windows\System\VOVAlRA.exe
  C:\Windows\System\VOVAlRA.exe
  2⤵
  PID:5128
- C:\Windows\System\KMcranD.exe
  C:\Windows\System\KMcranD.exe
  2⤵
  PID:5144
- C:\Windows\System\cnPlkfU.exe
  C:\Windows\System\cnPlkfU.exe
  2⤵
  PID:5160
- C:\Windows\System\xYRqyvX.exe
  C:\Windows\System\xYRqyvX.exe
  2⤵
  PID:5176
- C:\Windows\System\AKMRePc.exe
  C:\Windows\System\AKMRePc.exe
  2⤵
  PID:5192
- C:\Windows\System\MhkFIqU.exe
  C:\Windows\System\MhkFIqU.exe
  2⤵
  PID:5208
- C:\Windows\System\XHjrmgT.exe
  C:\Windows\System\XHjrmgT.exe
  2⤵
  PID:5224
- C:\Windows\System\hdFLnmH.exe
  C:\Windows\System\hdFLnmH.exe
  2⤵
  PID:5240
- C:\Windows\System\gNqXVet.exe
  C:\Windows\System\gNqXVet.exe
  2⤵
  PID:5256
- C:\Windows\System\gewVHzI.exe
  C:\Windows\System\gewVHzI.exe
  2⤵
  PID:5272
- C:\Windows\System\GNguaOm.exe
  C:\Windows\System\GNguaOm.exe
  2⤵
  PID:5288
- C:\Windows\System\bFEbQmv.exe
  C:\Windows\System\bFEbQmv.exe
  2⤵
  PID:5304
- C:\Windows\System\VmfbqWg.exe
  C:\Windows\System\VmfbqWg.exe
  2⤵
  PID:5320
- C:\Windows\System\bVCPzmD.exe
  C:\Windows\System\bVCPzmD.exe
  2⤵
  PID:5336
- C:\Windows\System\tJEFXEh.exe
  C:\Windows\System\tJEFXEh.exe
  2⤵
  PID:5352
- C:\Windows\System\SVLsbLl.exe
  C:\Windows\System\SVLsbLl.exe
  2⤵
  PID:5368
- C:\Windows\System\xueiSCm.exe
  C:\Windows\System\xueiSCm.exe
  2⤵
  PID:5384
- C:\Windows\System\vrQzBfh.exe
  C:\Windows\System\vrQzBfh.exe
  2⤵
  PID:5400
- C:\Windows\System\dwttXxP.exe
  C:\Windows\System\dwttXxP.exe
  2⤵
  PID:5416
- C:\Windows\System\hiUPXiG.exe
  C:\Windows\System\hiUPXiG.exe
  2⤵
  PID:5432
- C:\Windows\System\olswSws.exe
  C:\Windows\System\olswSws.exe
  2⤵
  PID:5456
- C:\Windows\System\BqbRXwm.exe
  C:\Windows\System\BqbRXwm.exe
  2⤵
  PID:5556
- C:\Windows\System\VwZdWmG.exe
  C:\Windows\System\VwZdWmG.exe
  2⤵
  PID:5572
- C:\Windows\System\qyzBnPU.exe
  C:\Windows\System\qyzBnPU.exe
  2⤵
  PID:5588
- C:\Windows\System\OVAOWms.exe
  C:\Windows\System\OVAOWms.exe
  2⤵
  PID:5608
- C:\Windows\System\FaBEAdv.exe
  C:\Windows\System\FaBEAdv.exe
  2⤵
  PID:5624
- C:\Windows\System\dyihpxS.exe
  C:\Windows\System\dyihpxS.exe
  2⤵
  PID:5640
- C:\Windows\System\ielBzPv.exe
  C:\Windows\System\ielBzPv.exe
  2⤵
  PID:5656
- C:\Windows\System\rPdkEYt.exe
  C:\Windows\System\rPdkEYt.exe
  2⤵
  PID:5672
- C:\Windows\System\eTGMKBv.exe
  C:\Windows\System\eTGMKBv.exe
  2⤵
  PID:5688
- C:\Windows\System\dhkbwVf.exe
  C:\Windows\System\dhkbwVf.exe
  2⤵
  PID:5704
- C:\Windows\System\IneIgjA.exe
  C:\Windows\System\IneIgjA.exe
  2⤵
  PID:5728
- C:\Windows\System\wxJsCfi.exe
  C:\Windows\System\wxJsCfi.exe
  2⤵
  PID:5744
- C:\Windows\System\lzEDMjG.exe
  C:\Windows\System\lzEDMjG.exe
  2⤵
  PID:5820
- C:\Windows\System\Xgcepbb.exe
  C:\Windows\System\Xgcepbb.exe
  2⤵
  PID:5836
- C:\Windows\System\qBOtvHO.exe
  C:\Windows\System\qBOtvHO.exe
  2⤵
  PID:5892
- C:\Windows\System\uhXuTry.exe
  C:\Windows\System\uhXuTry.exe
  2⤵
  PID:5940
- C:\Windows\System\zZYYvVu.exe
  C:\Windows\System\zZYYvVu.exe
  2⤵
  PID:5956
- C:\Windows\System\HWdFeGs.exe
  C:\Windows\System\HWdFeGs.exe
  2⤵
  PID:5972
- C:\Windows\System\lnHNGRX.exe
  C:\Windows\System\lnHNGRX.exe
  2⤵
  PID:5988
- C:\Windows\System\BKvVjuk.exe
  C:\Windows\System\BKvVjuk.exe
  2⤵
  PID:6004
- C:\Windows\System\TaIjUzY.exe
  C:\Windows\System\TaIjUzY.exe
  2⤵
  PID:6020
- C:\Windows\System\omwHLJJ.exe
  C:\Windows\System\omwHLJJ.exe
  2⤵
  PID:6036
- C:\Windows\System\UfFGYkV.exe
  C:\Windows\System\UfFGYkV.exe
  2⤵
  PID:6052
- C:\Windows\System\NxOxJkv.exe
  C:\Windows\System\NxOxJkv.exe
  2⤵
  PID:6068
- C:\Windows\System\LMnfLBG.exe
  C:\Windows\System\LMnfLBG.exe
  2⤵
  PID:6084
- C:\Windows\System\quYWfkr.exe
  C:\Windows\System\quYWfkr.exe
  2⤵
  PID:6100
- C:\Windows\System\bDBWmxj.exe
  C:\Windows\System\bDBWmxj.exe
  2⤵
  PID:6120
- C:\Windows\System\VeDvBVx.exe
  C:\Windows\System\VeDvBVx.exe
  2⤵
  PID:6136
- C:\Windows\System\mtbQwWp.exe
  C:\Windows\System\mtbQwWp.exe
  2⤵
  PID:5152
- C:\Windows\System\DzqWXwR.exe
  C:\Windows\System\DzqWXwR.exe
  2⤵
  PID:5184
- C:\Windows\System\cswaMvL.exe
  C:\Windows\System\cswaMvL.exe
  2⤵
  PID:5248
- C:\Windows\System\bWaQhWv.exe
  C:\Windows\System\bWaQhWv.exe
  2⤵
  PID:5280
- C:\Windows\System\CVRhNeS.exe
  C:\Windows\System\CVRhNeS.exe
  2⤵
  PID:5312
- C:\Windows\System\JiLeXrl.exe
  C:\Windows\System\JiLeXrl.exe
  2⤵
  PID:4648
- C:\Windows\System\EWlMkez.exe
  C:\Windows\System\EWlMkez.exe
  2⤵
  PID:5412
- C:\Windows\System\hdDaquo.exe
  C:\Windows\System\hdDaquo.exe
  2⤵
  PID:5008
- C:\Windows\System\hYMdoKZ.exe
  C:\Windows\System\hYMdoKZ.exe
  2⤵
  PID:5140
- C:\Windows\System\dehsMkv.exe
  C:\Windows\System\dehsMkv.exe
  2⤵
  PID:5360
- C:\Windows\System\iaXumDT.exe
  C:\Windows\System\iaXumDT.exe
  2⤵
  PID:5268
- C:\Windows\System\OshaXIA.exe
  C:\Windows\System\OshaXIA.exe
  2⤵
  PID:5296
- C:\Windows\System\PVriXKd.exe
  C:\Windows\System\PVriXKd.exe
  2⤵
  PID:5488
- C:\Windows\System\OsgWWUs.exe
  C:\Windows\System\OsgWWUs.exe
  2⤵
  PID:5500
- C:\Windows\System\TnZiknG.exe
  C:\Windows\System\TnZiknG.exe
  2⤵
  PID:5524
- C:\Windows\System\XeEfthL.exe
  C:\Windows\System\XeEfthL.exe
  2⤵
  PID:5548
- C:\Windows\System\KSfbabx.exe
  C:\Windows\System\KSfbabx.exe
  2⤵
  PID:5600
- C:\Windows\System\hwAuXcu.exe
  C:\Windows\System\hwAuXcu.exe
  2⤵
  PID:5604
- C:\Windows\System\PKTTDcP.exe
  C:\Windows\System\PKTTDcP.exe
  2⤵
  PID:5620
- C:\Windows\System\TEtupPV.exe
  C:\Windows\System\TEtupPV.exe
  2⤵
  PID:5652
- C:\Windows\System\rftnGLY.exe
  C:\Windows\System\rftnGLY.exe
  2⤵
  PID:5684
- C:\Windows\System\FudQyxA.exe
  C:\Windows\System\FudQyxA.exe
  2⤵
  PID:4152
- C:\Windows\System\ItkTpqQ.exe
  C:\Windows\System\ItkTpqQ.exe
  2⤵
  PID:5752
- C:\Windows\System\avrCfPy.exe
  C:\Windows\System\avrCfPy.exe
  2⤵
  PID:5844
- C:\Windows\System\grjRTLJ.exe
  C:\Windows\System\grjRTLJ.exe
  2⤵
  PID:5784
- C:\Windows\System\wOJPTDE.exe
  C:\Windows\System\wOJPTDE.exe
  2⤵
  PID:5852
- C:\Windows\System\dNxgaBJ.exe
  C:\Windows\System\dNxgaBJ.exe
  2⤵
  PID:5928
- C:\Windows\System\UCYBVYI.exe
  C:\Windows\System\UCYBVYI.exe
  2⤵
  PID:5964
- C:\Windows\System\ClaIvZV.exe
  C:\Windows\System\ClaIvZV.exe
  2⤵
  PID:5996
- C:\Windows\System\uzALxgv.exe
  C:\Windows\System\uzALxgv.exe
  2⤵
  PID:6044
- C:\Windows\System\lcBHlTp.exe
  C:\Windows\System\lcBHlTp.exe
  2⤵
  PID:5904
- C:\Windows\System\bXRocGb.exe
  C:\Windows\System\bXRocGb.exe
  2⤵
  PID:5932
- C:\Windows\System\dRiaGfb.exe
  C:\Windows\System\dRiaGfb.exe
  2⤵
  PID:5920
- C:\Windows\System\dYINaaa.exe
  C:\Windows\System\dYINaaa.exe
  2⤵
  PID:4612
- C:\Windows\System\xrBjJnw.exe
  C:\Windows\System\xrBjJnw.exe
  2⤵
  PID:5908
- C:\Windows\System\mhNuLSn.exe
  C:\Windows\System\mhNuLSn.exe
  2⤵
  PID:5424
- C:\Windows\System\uyGctHX.exe
  C:\Windows\System\uyGctHX.exe
  2⤵
  PID:5528
- C:\Windows\System\rqHhxHl.exe
  C:\Windows\System\rqHhxHl.exe
  2⤵
  PID:5540
- C:\Windows\System\PtnVgEa.exe
  C:\Windows\System\PtnVgEa.exe
  2⤵
  PID:5716
- C:\Windows\System\uAfMXNF.exe
  C:\Windows\System\uAfMXNF.exe
  2⤵
  PID:5856
- C:\Windows\System\JNsIGuy.exe
  C:\Windows\System\JNsIGuy.exe
  2⤵
  PID:5616
- C:\Windows\System\UNpkJFv.exe
  C:\Windows\System\UNpkJFv.exe
  2⤵
  PID:5808
- C:\Windows\System\qXvztpO.exe
  C:\Windows\System\qXvztpO.exe
  2⤵
  PID:5792
- C:\Windows\System\qNfvSIo.exe
  C:\Windows\System\qNfvSIo.exe
  2⤵
  PID:5872
- C:\Windows\System\gGFELAv.exe
  C:\Windows\System\gGFELAv.exe
  2⤵
  PID:5952
- C:\Windows\System\eNbDkqT.exe
  C:\Windows\System\eNbDkqT.exe
  2⤵
  PID:5504
- C:\Windows\System\WQEZFNH.exe
  C:\Windows\System\WQEZFNH.exe
  2⤵
  PID:6012
- C:\Windows\System\MPWzJZZ.exe
  C:\Windows\System\MPWzJZZ.exe
  2⤵
  PID:5124
- C:\Windows\System\cUTlfKg.exe
  C:\Windows\System\cUTlfKg.exe
  2⤵
  PID:6132
- C:\Windows\System\aJLDuVf.exe
  C:\Windows\System\aJLDuVf.exe
  2⤵
  PID:5364
- C:\Windows\System\fHEwoFn.exe
  C:\Windows\System\fHEwoFn.exe
  2⤵
  PID:5204
- C:\Windows\System\SwLeDtR.exe
  C:\Windows\System\SwLeDtR.exe
  2⤵
  PID:6092
- C:\Windows\System\QpsGcRB.exe
  C:\Windows\System\QpsGcRB.exe
  2⤵
  PID:5888
- C:\Windows\System\zyurSiA.exe
  C:\Windows\System\zyurSiA.exe
  2⤵
  PID:5568
- C:\Windows\System\FsnBxUL.exe
  C:\Windows\System\FsnBxUL.exe
  2⤵
  PID:5668
- C:\Windows\System\IwNReYj.exe
  C:\Windows\System\IwNReYj.exe
  2⤵
  PID:6080
- C:\Windows\System\QFVmvUj.exe
  C:\Windows\System\QFVmvUj.exe
  2⤵
  PID:5832
- C:\Windows\System\RKZePVX.exe
  C:\Windows\System\RKZePVX.exe
  2⤵
  PID:5596
- C:\Windows\System\URAHNaX.exe
  C:\Windows\System\URAHNaX.exe
  2⤵
  PID:5800
- C:\Windows\System\OMPQARY.exe
  C:\Windows\System\OMPQARY.exe
  2⤵
  PID:5508
- C:\Windows\System\LfQvrgW.exe
  C:\Windows\System\LfQvrgW.exe
  2⤵
  PID:5764
- C:\Windows\System\znBfqJj.exe
  C:\Windows\System\znBfqJj.exe
  2⤵
  PID:5768
- C:\Windows\System\YZLiYcw.exe
  C:\Windows\System\YZLiYcw.exe
  2⤵
  PID:5812
- C:\Windows\System\pEpZXYS.exe
  C:\Windows\System\pEpZXYS.exe
  2⤵
  PID:5136
- C:\Windows\System\ASZJtSU.exe
  C:\Windows\System\ASZJtSU.exe
  2⤵
  PID:6116
- C:\Windows\System\XAnaMOO.exe
  C:\Windows\System\XAnaMOO.exe
  2⤵
  PID:6160
- C:\Windows\System\ItJIPYy.exe
  C:\Windows\System\ItJIPYy.exe
  2⤵
  PID:6176
- C:\Windows\System\WiplTZJ.exe
  C:\Windows\System\WiplTZJ.exe
  2⤵
  PID:6192
- C:\Windows\System\pabZSgW.exe
  C:\Windows\System\pabZSgW.exe
  2⤵
  PID:6208
- C:\Windows\System\gmPPRzE.exe
  C:\Windows\System\gmPPRzE.exe
  2⤵
  PID:6228
- C:\Windows\System\KOvnAYU.exe
  C:\Windows\System\KOvnAYU.exe
  2⤵
  PID:6244
- C:\Windows\System\BhqrxGP.exe
  C:\Windows\System\BhqrxGP.exe
  2⤵
  PID:6260
- C:\Windows\System\ZcRRghT.exe
  C:\Windows\System\ZcRRghT.exe
  2⤵
  PID:6276
- C:\Windows\System\uNEZwcV.exe
  C:\Windows\System\uNEZwcV.exe
  2⤵
  PID:6292
- C:\Windows\System\ctIkIYd.exe
  C:\Windows\System\ctIkIYd.exe
  2⤵
  PID:6308
- C:\Windows\System\URvPVRM.exe
  C:\Windows\System\URvPVRM.exe
  2⤵
  PID:6324
- C:\Windows\System\ZLfopev.exe
  C:\Windows\System\ZLfopev.exe
  2⤵
  PID:6340
- C:\Windows\System\TAspupO.exe
  C:\Windows\System\TAspupO.exe
  2⤵
  PID:6356
- C:\Windows\System\ZbokBlW.exe
  C:\Windows\System\ZbokBlW.exe
  2⤵
  PID:6372
- C:\Windows\System\dfPCflJ.exe
  C:\Windows\System\dfPCflJ.exe
  2⤵
  PID:6396
- C:\Windows\System\gNpVNKn.exe
  C:\Windows\System\gNpVNKn.exe
  2⤵
  PID:6412
- C:\Windows\System\lfBHWom.exe
  C:\Windows\System\lfBHWom.exe
  2⤵
  PID:6468
- C:\Windows\System\QwNRRny.exe
  C:\Windows\System\QwNRRny.exe
  2⤵
  PID:6484
- C:\Windows\System\HsfGjPv.exe
  C:\Windows\System\HsfGjPv.exe
  2⤵
  PID:6500
- C:\Windows\System\ZwQyBtv.exe
  C:\Windows\System\ZwQyBtv.exe
  2⤵
  PID:6516
- C:\Windows\System\WfUiVME.exe
  C:\Windows\System\WfUiVME.exe
  2⤵
  PID:6532
- C:\Windows\System\hnOXHiQ.exe
  C:\Windows\System\hnOXHiQ.exe
  2⤵
  PID:6552
- C:\Windows\System\tNyRruK.exe
  C:\Windows\System\tNyRruK.exe
  2⤵
  PID:6568
- C:\Windows\System\byGHcSj.exe
  C:\Windows\System\byGHcSj.exe
  2⤵
  PID:6584
- C:\Windows\System\ctyLfga.exe
  C:\Windows\System\ctyLfga.exe
  2⤵
  PID:6600
- C:\Windows\System\LsWtCqa.exe
  C:\Windows\System\LsWtCqa.exe
  2⤵
  PID:6624
- C:\Windows\System\sjtJgpt.exe
  C:\Windows\System\sjtJgpt.exe
  2⤵
  PID:6656
- C:\Windows\System\JwEyVuP.exe
  C:\Windows\System\JwEyVuP.exe
  2⤵
  PID:6672
- C:\Windows\System\sciKlzJ.exe
  C:\Windows\System\sciKlzJ.exe
  2⤵
  PID:6688
- C:\Windows\System\BVmZPqz.exe
  C:\Windows\System\BVmZPqz.exe
  2⤵
  PID:6704
- C:\Windows\System\lfpDpjw.exe
  C:\Windows\System\lfpDpjw.exe
  2⤵
  PID:6720
- C:\Windows\System\agDlebb.exe
  C:\Windows\System\agDlebb.exe
  2⤵
  PID:6740
- C:\Windows\System\KSbkWyV.exe
  C:\Windows\System\KSbkWyV.exe
  2⤵
  PID:6784
- C:\Windows\System\BAHLJpV.exe
  C:\Windows\System\BAHLJpV.exe
  2⤵
  PID:6820
- C:\Windows\System\feaCPTP.exe
  C:\Windows\System\feaCPTP.exe
  2⤵
  PID:6836
- C:\Windows\System\mWjgtcX.exe
  C:\Windows\System\mWjgtcX.exe
  2⤵
  PID:6852
- C:\Windows\System\YsXOCes.exe
  C:\Windows\System\YsXOCes.exe
  2⤵
  PID:6868
- C:\Windows\System\WOXqmYR.exe
  C:\Windows\System\WOXqmYR.exe
  2⤵
  PID:6884
- C:\Windows\System\ezzbTFF.exe
  C:\Windows\System\ezzbTFF.exe
  2⤵
  PID:6920
- C:\Windows\System\qdavlvS.exe
  C:\Windows\System\qdavlvS.exe
  2⤵
  PID:7152
- C:\Windows\System\YWaeMJJ.exe
  C:\Windows\System\YWaeMJJ.exe
  2⤵
  PID:3648
- C:\Windows\System\KtPFugY.exe
  C:\Windows\System\KtPFugY.exe
  2⤵
  PID:5736
- C:\Windows\System\PxlRYFU.exe
  C:\Windows\System\PxlRYFU.exe
  2⤵
  PID:6240
- C:\Windows\System\zUygCwS.exe
  C:\Windows\System\zUygCwS.exe
  2⤵
  PID:6272
- C:\Windows\System\KtsodnW.exe
  C:\Windows\System\KtsodnW.exe
  2⤵
  PID:6408
- C:\Windows\System\nMOdbLg.exe
  C:\Windows\System\nMOdbLg.exe
  2⤵
  PID:6252
- C:\Windows\System\MFUbuhO.exe
  C:\Windows\System\MFUbuhO.exe
  2⤵
  PID:6636
- C:\Windows\System\ZNVlndr.exe
  C:\Windows\System\ZNVlndr.exe
  2⤵
  PID:5788
- C:\Windows\System\zNpqgMl.exe
  C:\Windows\System\zNpqgMl.exe
  2⤵
  PID:6152
- C:\Windows\System\RQfwwhI.exe
  C:\Windows\System\RQfwwhI.exe
  2⤵
  PID:6220
- C:\Windows\System\AdhlICG.exe
  C:\Windows\System\AdhlICG.exe
  2⤵
  PID:6320
- C:\Windows\System\sdNBGPc.exe
  C:\Windows\System\sdNBGPc.exe
  2⤵
  PID:6420
- C:\Windows\System\GWXdXoU.exe
  C:\Windows\System\GWXdXoU.exe
  2⤵
  PID:6440
- C:\Windows\System\HevAlOJ.exe
  C:\Windows\System\HevAlOJ.exe
  2⤵
  PID:6380
- C:\Windows\System\vqwDbYJ.exe
  C:\Windows\System\vqwDbYJ.exe
  2⤵
  PID:6796
- C:\Windows\System\btRoSNQ.exe
  C:\Windows\System\btRoSNQ.exe
  2⤵
  PID:6860
- C:\Windows\System\cDRDkSm.exe
  C:\Windows\System\cDRDkSm.exe
  2⤵
  PID:6880
- C:\Windows\System\cuotpCb.exe
  C:\Windows\System\cuotpCb.exe
  2⤵
  PID:6916
- C:\Windows\System\BwHKPmZ.exe
  C:\Windows\System\BwHKPmZ.exe
  2⤵
  PID:6956
- C:\Windows\System\KPGLKiR.exe
  C:\Windows\System\KPGLKiR.exe
  2⤵
  PID:6972
- C:\Windows\System\hEPcHUq.exe
  C:\Windows\System\hEPcHUq.exe
  2⤵
  PID:6992
- C:\Windows\System\DZcuWXi.exe
  C:\Windows\System\DZcuWXi.exe
  2⤵
  PID:7016
- C:\Windows\System\eargGkS.exe
  C:\Windows\System\eargGkS.exe
  2⤵
  PID:6168
- C:\Windows\System\QIJVeNR.exe
  C:\Windows\System\QIJVeNR.exe
  2⤵
  PID:7048
- C:\Windows\System\uzzASMg.exe
  C:\Windows\System\uzzASMg.exe
  2⤵
  PID:6368
- C:\Windows\System\MVLGfQs.exe
  C:\Windows\System\MVLGfQs.exe
  2⤵
  PID:7104
- C:\Windows\System\gsMQWJs.exe
  C:\Windows\System\gsMQWJs.exe
  2⤵
  PID:6316
- C:\Windows\System\bIChCcG.exe
  C:\Windows\System\bIChCcG.exe
  2⤵
  PID:6284
- C:\Windows\System\cRFEFBi.exe
  C:\Windows\System\cRFEFBi.exe
  2⤵
  PID:6980
- C:\Windows\System\ylYMgWm.exe
  C:\Windows\System\ylYMgWm.exe
  2⤵
  PID:7024
- C:\Windows\System\VviohzQ.exe
  C:\Windows\System\VviohzQ.exe
  2⤵
  PID:6608
- C:\Windows\System\MhNjNoB.exe
  C:\Windows\System\MhNjNoB.exe
  2⤵
  PID:7064
- C:\Windows\System\mwVYnHP.exe
  C:\Windows\System\mwVYnHP.exe
  2⤵
  PID:7076
- C:\Windows\System\WpzHkCe.exe
  C:\Windows\System\WpzHkCe.exe
  2⤵
  PID:6548
- C:\Windows\System\oYcaoUt.exe
  C:\Windows\System\oYcaoUt.exe
  2⤵
  PID:7096
- C:\Windows\System\YNMXtXA.exe
  C:\Windows\System\YNMXtXA.exe
  2⤵
  PID:6696
- C:\Windows\System\IsOQdYz.exe
  C:\Windows\System\IsOQdYz.exe
  2⤵
  PID:6448
- C:\Windows\System\BRVpyXc.exe
  C:\Windows\System\BRVpyXc.exe
  2⤵
  PID:6668
- C:\Windows\System\zzUSnEe.exe
  C:\Windows\System\zzUSnEe.exe
  2⤵
  PID:6632
- C:\Windows\System\whjztkf.exe
  C:\Windows\System\whjztkf.exe
  2⤵
  PID:6640
- C:\Windows\System\LLBuyky.exe
  C:\Windows\System\LLBuyky.exe
  2⤵
  PID:6932
- C:\Windows\System\RZxvtYc.exe
  C:\Windows\System\RZxvtYc.exe
  2⤵
  PID:6652
- C:\Windows\System\iebsqyO.exe
  C:\Windows\System\iebsqyO.exe
  2⤵
  PID:6480
- C:\Windows\System\AOLFDSx.exe
  C:\Windows\System\AOLFDSx.exe
  2⤵
  PID:7092
- C:\Windows\System\YJAJZlv.exe
  C:\Windows\System\YJAJZlv.exe
  2⤵
  PID:6616
- C:\Windows\System\kCTgtyc.exe
  C:\Windows\System\kCTgtyc.exe
  2⤵
  PID:7000
- C:\Windows\System\kvCYtKG.exe
  C:\Windows\System\kvCYtKG.exe
  2⤵
  PID:7044
- C:\Windows\System\DLjYtRa.exe
  C:\Windows\System\DLjYtRa.exe
  2⤵
  PID:5216
- C:\Windows\System\ClWWkIm.exe
  C:\Windows\System\ClWWkIm.exe
  2⤵
  PID:7128
- C:\Windows\System\xjtjxwq.exe
  C:\Windows\System\xjtjxwq.exe
  2⤵
  PID:7148
- C:\Windows\System\eulsjyv.exe
  C:\Windows\System\eulsjyv.exe
  2⤵
  PID:6188
- C:\Windows\System\RvuJUwn.exe
  C:\Windows\System\RvuJUwn.exe
  2⤵
  PID:6268
- C:\Windows\System\GxwlHDR.exe
  C:\Windows\System\GxwlHDR.exe
  2⤵
  PID:6592
- C:\Windows\System\DznxtFh.exe
  C:\Windows\System\DznxtFh.exe
  2⤵
  PID:6620
- C:\Windows\System\PnGyzeE.exe
  C:\Windows\System\PnGyzeE.exe
  2⤵
  PID:6352
- C:\Windows\System\BCzCfOk.exe
  C:\Windows\System\BCzCfOk.exe
  2⤵
  PID:6828
- C:\Windows\System\CKEKVqi.exe
  C:\Windows\System\CKEKVqi.exe
  2⤵
  PID:6732
- C:\Windows\System\lsifvVR.exe
  C:\Windows\System\lsifvVR.exe
  2⤵
  PID:5520
- C:\Windows\System\pJexARx.exe
  C:\Windows\System\pJexARx.exe
  2⤵
  PID:6256
- C:\Windows\System\PBUMbrC.exe
  C:\Windows\System\PBUMbrC.exe
  2⤵
  PID:6816
- C:\Windows\System\CurYVLe.exe
  C:\Windows\System\CurYVLe.exe
  2⤵
  PID:6424
- C:\Windows\System\CxizwrG.exe
  C:\Windows\System\CxizwrG.exe
  2⤵
  PID:7164
- C:\Windows\System\yZgPUfU.exe
  C:\Windows\System\yZgPUfU.exe
  2⤵
  PID:6984
- C:\Windows\System\enscAsE.exe
  C:\Windows\System\enscAsE.exe
  2⤵
  PID:7088
- C:\Windows\System\DkzGgAg.exe
  C:\Windows\System\DkzGgAg.exe
  2⤵
  PID:6560
- C:\Windows\System\nBQIRhF.exe
  C:\Windows\System\nBQIRhF.exe
  2⤵
  PID:6728
- C:\Windows\System\CatSXYF.exe
  C:\Windows\System\CatSXYF.exe
  2⤵
  PID:6964
- C:\Windows\System\VmPNbOI.exe
  C:\Windows\System\VmPNbOI.exe
  2⤵
  PID:6944
- C:\Windows\System\jplFRzB.exe
  C:\Windows\System\jplFRzB.exe
  2⤵
  PID:7080
- C:\Windows\System\mEMPEVu.exe
  C:\Windows\System\mEMPEVu.exe
  2⤵
  PID:6596
- C:\Windows\System\RLTQFuT.exe
  C:\Windows\System\RLTQFuT.exe
  2⤵
  PID:6680
- C:\Windows\System\gpaLfXv.exe
  C:\Windows\System\gpaLfXv.exe
  2⤵
  PID:6760
- C:\Windows\System\maLpJug.exe
  C:\Windows\System\maLpJug.exe
  2⤵
  PID:7172
- C:\Windows\System\KRLVViD.exe
  C:\Windows\System\KRLVViD.exe
  2⤵
  PID:7220
- C:\Windows\System\UnHmYjE.exe
  C:\Windows\System\UnHmYjE.exe
  2⤵
  PID:7236
- C:\Windows\System\JAPVriS.exe
  C:\Windows\System\JAPVriS.exe
  2⤵
  PID:7252
- C:\Windows\System\qNmwbLq.exe
  C:\Windows\System\qNmwbLq.exe
  2⤵
  PID:7268
- C:\Windows\System\IjSRxXg.exe
  C:\Windows\System\IjSRxXg.exe
  2⤵
  PID:7288
- C:\Windows\System\KkUYONW.exe
  C:\Windows\System\KkUYONW.exe
  2⤵
  PID:7304
- C:\Windows\System\hyYsdSt.exe
  C:\Windows\System\hyYsdSt.exe
  2⤵
  PID:7360
- C:\Windows\System\yCNfNqq.exe
  C:\Windows\System\yCNfNqq.exe
  2⤵
  PID:7380
- C:\Windows\System\tvNvqnD.exe
  C:\Windows\System\tvNvqnD.exe
  2⤵
  PID:7396
- C:\Windows\System\LmuXKbU.exe
  C:\Windows\System\LmuXKbU.exe
  2⤵
  PID:7416
- C:\Windows\System\OxsgPNL.exe
  C:\Windows\System\OxsgPNL.exe
  2⤵
  PID:7432
- C:\Windows\System\vRmualw.exe
  C:\Windows\System\vRmualw.exe
  2⤵
  PID:7456
- C:\Windows\System\VqLnZeJ.exe
  C:\Windows\System\VqLnZeJ.exe
  2⤵
  PID:7472
- C:\Windows\System\iEnYgJm.exe
  C:\Windows\System\iEnYgJm.exe
  2⤵
  PID:7488
- C:\Windows\System\JwNPmJu.exe
  C:\Windows\System\JwNPmJu.exe
  2⤵
  PID:7504
- C:\Windows\System\eXelfGH.exe
  C:\Windows\System\eXelfGH.exe
  2⤵
  PID:7520
- C:\Windows\System\tdHByIe.exe
  C:\Windows\System\tdHByIe.exe
  2⤵
  PID:7564
- C:\Windows\System\DQlmYjc.exe
  C:\Windows\System\DQlmYjc.exe
  2⤵
  PID:7580
- C:\Windows\System\uZuZLOV.exe
  C:\Windows\System\uZuZLOV.exe
  2⤵
  PID:7608
- C:\Windows\System\zhAynhn.exe
  C:\Windows\System\zhAynhn.exe
  2⤵
  PID:7640
- C:\Windows\System\wkFEQwx.exe
  C:\Windows\System\wkFEQwx.exe
  2⤵
  PID:7656
- C:\Windows\System\pSUWARV.exe
  C:\Windows\System\pSUWARV.exe
  2⤵
  PID:7672
- C:\Windows\System\pkEISGp.exe
  C:\Windows\System\pkEISGp.exe
  2⤵
  PID:7700
- C:\Windows\System\cuNtDyf.exe
  C:\Windows\System\cuNtDyf.exe
  2⤵
  PID:7804
- C:\Windows\System\UnuSGVz.exe
  C:\Windows\System\UnuSGVz.exe
  2⤵
  PID:7832
- C:\Windows\System\aAAUKgu.exe
  C:\Windows\System\aAAUKgu.exe
  2⤵
  PID:7848
- C:\Windows\System\zXWGwlL.exe
  C:\Windows\System\zXWGwlL.exe
  2⤵
  PID:7864
- C:\Windows\System\BTgMOUj.exe
  C:\Windows\System\BTgMOUj.exe
  2⤵
  PID:7880
- C:\Windows\System\ftKJXhi.exe
  C:\Windows\System\ftKJXhi.exe
  2⤵
  PID:7896
- C:\Windows\System\NuSLtEK.exe
  C:\Windows\System\NuSLtEK.exe
  2⤵
  PID:7944
- C:\Windows\System\WcjOgPs.exe
  C:\Windows\System\WcjOgPs.exe
  2⤵
  PID:7960
- C:\Windows\System\slYjtor.exe
  C:\Windows\System\slYjtor.exe
  2⤵
  PID:7976
- C:\Windows\System\LmWWgCB.exe
  C:\Windows\System\LmWWgCB.exe
  2⤵
  PID:7992
- C:\Windows\System\IBaoQVW.exe
  C:\Windows\System\IBaoQVW.exe
  2⤵
  PID:8008
- C:\Windows\System\zPsNbMv.exe
  C:\Windows\System\zPsNbMv.exe
  2⤵
  PID:8024
- C:\Windows\System\iqhgsTJ.exe
  C:\Windows\System\iqhgsTJ.exe
  2⤵
  PID:8040
- C:\Windows\System\mXrtfpp.exe
  C:\Windows\System\mXrtfpp.exe
  2⤵
  PID:8056
- C:\Windows\System\TwyYhwQ.exe
  C:\Windows\System\TwyYhwQ.exe
  2⤵
  PID:8116
- C:\Windows\System\dZQUqDC.exe
  C:\Windows\System\dZQUqDC.exe
  2⤵
  PID:8132
- C:\Windows\System\OjRPZAH.exe
  C:\Windows\System\OjRPZAH.exe
  2⤵
  PID:8148
- C:\Windows\System\TaJpRFW.exe
  C:\Windows\System\TaJpRFW.exe
  2⤵
  PID:8164
- C:\Windows\System\nPoCHOm.exe
  C:\Windows\System\nPoCHOm.exe
  2⤵
  PID:8184
- C:\Windows\System\IetwyoH.exe
  C:\Windows\System\IetwyoH.exe
  2⤵
  PID:5804
- C:\Windows\System\IBrlcsB.exe
  C:\Windows\System\IBrlcsB.exe
  2⤵
  PID:7284
- C:\Windows\System\wrWMUHt.exe
  C:\Windows\System\wrWMUHt.exe
  2⤵
  PID:7324
- C:\Windows\System\umoKYGT.exe
  C:\Windows\System\umoKYGT.exe
  2⤵
  PID:6804
- C:\Windows\System\qALtIZe.exe
  C:\Windows\System\qALtIZe.exe
  2⤵
  PID:5584
- C:\Windows\System\IXtOxSH.exe
  C:\Windows\System\IXtOxSH.exe
  2⤵
  PID:7344
- C:\Windows\System\CkqEjSf.exe
  C:\Windows\System\CkqEjSf.exe
  2⤵
  PID:6236
- C:\Windows\System\mdheIJX.exe
  C:\Windows\System\mdheIJX.exe
  2⤵
  PID:6780
- C:\Windows\System\EwLFovF.exe
  C:\Windows\System\EwLFovF.exe
  2⤵
  PID:7424
- C:\Windows\System\YbgLSmn.exe
  C:\Windows\System\YbgLSmn.exe
  2⤵
  PID:7120
- C:\Windows\System\FWsaOXn.exe
  C:\Windows\System\FWsaOXn.exe
  2⤵
  PID:7160
- C:\Windows\System\ycKDgmC.exe
  C:\Windows\System\ycKDgmC.exe
  2⤵
  PID:7296
- C:\Windows\System\wjcoHwm.exe
  C:\Windows\System\wjcoHwm.exe
  2⤵
  PID:7496
- C:\Windows\System\MRjpYXA.exe
  C:\Windows\System\MRjpYXA.exe
  2⤵
  PID:7412
- C:\Windows\System\LSSsmzB.exe
  C:\Windows\System\LSSsmzB.exe
  2⤵
  PID:7512
- C:\Windows\System\fJVhRUY.exe
  C:\Windows\System\fJVhRUY.exe
  2⤵
  PID:7572
- C:\Windows\System\QAaSrFa.exe
  C:\Windows\System\QAaSrFa.exe
  2⤵
  PID:7544
- C:\Windows\System\kMwMDoG.exe
  C:\Windows\System\kMwMDoG.exe
  2⤵
  PID:7540
- C:\Windows\System\fbkvFDx.exe
  C:\Windows\System\fbkvFDx.exe
  2⤵
  PID:6644
- C:\Windows\System\dMYdOdj.exe
  C:\Windows\System\dMYdOdj.exe
  2⤵
  PID:7648
- C:\Windows\System\mqykytZ.exe
  C:\Windows\System\mqykytZ.exe
  2⤵
  PID:7692
- C:\Windows\System\QZrqnXI.exe
  C:\Windows\System\QZrqnXI.exe
  2⤵
  PID:7636
- C:\Windows\System\IeVettu.exe
  C:\Windows\System\IeVettu.exe
  2⤵
  PID:7624
- C:\Windows\System\WjgupXP.exe
  C:\Windows\System\WjgupXP.exe
  2⤵
  PID:7752
- C:\Windows\System\OXKReHf.exe
  C:\Windows\System\OXKReHf.exe
  2⤵
  PID:7728
- C:\Windows\System\mkdMJcs.exe
  C:\Windows\System\mkdMJcs.exe
  2⤵
  PID:7860
- C:\Windows\System\KQUJdpY.exe
  C:\Windows\System\KQUJdpY.exe
  2⤵
  PID:7872
- C:\Windows\System\ZBlDPAO.exe
  C:\Windows\System\ZBlDPAO.exe
  2⤵
  PID:7988
- C:\Windows\System\oVGTQWM.exe
  C:\Windows\System\oVGTQWM.exe
  2⤵
  PID:8052
- C:\Windows\System\JzHGiKg.exe
  C:\Windows\System\JzHGiKg.exe
  2⤵
  PID:7796
- C:\Windows\System\xnvlmKa.exe
  C:\Windows\System\xnvlmKa.exe
  2⤵
  PID:7876
- C:\Windows\System\rltSNHb.exe
  C:\Windows\System\rltSNHb.exe
  2⤵
  PID:8104
- C:\Windows\System\loAaWaY.exe
  C:\Windows\System\loAaWaY.exe
  2⤵
  PID:7780
- C:\Windows\System\ptSoIQV.exe
  C:\Windows\System\ptSoIQV.exe
  2⤵
  PID:8080
- C:\Windows\System\QpyADth.exe
  C:\Windows\System\QpyADth.exe
  2⤵
  PID:7940
- C:\Windows\System\iFTMfRQ.exe
  C:\Windows\System\iFTMfRQ.exe
  2⤵
  PID:8004
- C:\Windows\System\pyoYDod.exe
  C:\Windows\System\pyoYDod.exe
  2⤵
  PID:8084
- C:\Windows\System\hxERNcD.exe
  C:\Windows\System\hxERNcD.exe
  2⤵
  PID:8112
- C:\Windows\System\hdwdbzC.exe
  C:\Windows\System\hdwdbzC.exe
  2⤵
  PID:8172
- C:\Windows\System\NdaTrad.exe
  C:\Windows\System\NdaTrad.exe
  2⤵
  PID:7212
- C:\Windows\System\FGovGNq.exe
  C:\Windows\System\FGovGNq.exe
  2⤵
  PID:7184
- C:\Windows\System\jsgpvmE.exe
  C:\Windows\System\jsgpvmE.exe
  2⤵
  PID:6348
- C:\Windows\System\EpJigRF.exe
  C:\Windows\System\EpJigRF.exe
  2⤵
  PID:7200
- C:\Windows\System\lQyxFqt.exe
  C:\Windows\System\lQyxFqt.exe
  2⤵
  PID:6892
- C:\Windows\System\ggmDzhG.exe
  C:\Windows\System\ggmDzhG.exe
  2⤵
  PID:7356
- C:\Windows\System\rJEtbxH.exe
  C:\Windows\System\rJEtbxH.exe
  2⤵
  PID:7332
- C:\Windows\System\LKbKSzv.exe
  C:\Windows\System\LKbKSzv.exe
  2⤵
  PID:7392
- C:\Windows\System\mpYFQfq.exe
  C:\Windows\System\mpYFQfq.exe
  2⤵
  PID:7464
- C:\Windows\System\tQeFYxq.exe
  C:\Windows\System\tQeFYxq.exe
  2⤵
  PID:7140
- C:\Windows\System\quTphiO.exe
  C:\Windows\System\quTphiO.exe
  2⤵
  PID:7260
- C:\Windows\System\vuuLBKu.exe
  C:\Windows\System\vuuLBKu.exe
  2⤵
  PID:7484
- C:\Windows\System\IpJFZyW.exe
  C:\Windows\System\IpJFZyW.exe
  2⤵
  PID:7528
- C:\Windows\System\DgXZMUS.exe
  C:\Windows\System\DgXZMUS.exe
  2⤵
  PID:7368
- C:\Windows\System\qNisxDK.exe
  C:\Windows\System\qNisxDK.exe
  2⤵
  PID:7536
- C:\Windows\System\hGQmIBK.exe
  C:\Windows\System\hGQmIBK.exe
  2⤵
  PID:7824
- C:\Windows\System\PJkLXfQ.exe
  C:\Windows\System\PJkLXfQ.exe
  2⤵
  PID:7772
- C:\Windows\System\afJZRvf.exe
  C:\Windows\System\afJZRvf.exe
  2⤵
  PID:7820
- C:\Windows\System\fDnQdOy.exe
  C:\Windows\System\fDnQdOy.exe
  2⤵
  PID:7888
- C:\Windows\System\RuDsNoU.exe
  C:\Windows\System\RuDsNoU.exe
  2⤵
  PID:8124
- C:\Windows\System\etINXEK.exe
  C:\Windows\System\etINXEK.exe
  2⤵
  PID:8076
- C:\Windows\System\utMuvto.exe
  C:\Windows\System\utMuvto.exe
  2⤵
  PID:7972
- C:\Windows\System\pGvHuLR.exe
  C:\Windows\System\pGvHuLR.exe
  2⤵
  PID:7816
- C:\Windows\System\SsZMwmw.exe
  C:\Windows\System\SsZMwmw.exe
  2⤵
  PID:8140
- C:\Windows\System\yVKKuuj.exe
  C:\Windows\System\yVKKuuj.exe
  2⤵
  PID:8180
- C:\Windows\System\soqciye.exe
  C:\Windows\System\soqciye.exe
  2⤵
  PID:7500
- C:\Windows\System\ylMmKzM.exe
  C:\Windows\System\ylMmKzM.exe
  2⤵
  PID:6332
- C:\Windows\System\SBJiaOu.exe
  C:\Windows\System\SBJiaOu.exe
  2⤵
  PID:7372
- C:\Windows\System\EdYzzEF.exe
  C:\Windows\System\EdYzzEF.exe
  2⤵
  PID:7744
- C:\Windows\System\dtFcBMm.exe
  C:\Windows\System\dtFcBMm.exe
  2⤵
  PID:7336
- C:\Windows\System\PmphJlG.exe
  C:\Windows\System\PmphJlG.exe
  2⤵
  PID:2252
- C:\Windows\System\rzLOpJW.exe
  C:\Windows\System\rzLOpJW.exe
  2⤵
  PID:7180
- C:\Windows\System\drTOBJr.exe
  C:\Windows\System\drTOBJr.exe
  2⤵
  PID:2208
- C:\Windows\System\daHnGSi.exe
  C:\Windows\System\daHnGSi.exe
  2⤵
  PID:8108
- C:\Windows\System\SXvSaGv.exe
  C:\Windows\System\SXvSaGv.exe
  2⤵
  PID:292
- C:\Windows\System\rMasoWa.exe
  C:\Windows\System\rMasoWa.exe
  2⤵
  PID:5664
- C:\Windows\System\mdtoGfo.exe
  C:\Windows\System\mdtoGfo.exe
  2⤵
  PID:7792
- C:\Windows\System\sIUTiUq.exe
  C:\Windows\System\sIUTiUq.exe
  2⤵
  PID:7856
- C:\Windows\System\HKKGItd.exe
  C:\Windows\System\HKKGItd.exe
  2⤵
  PID:7936
- C:\Windows\System\LylsVHs.exe
  C:\Windows\System\LylsVHs.exe
  2⤵
  PID:2524
- C:\Windows\System\PdQDAHL.exe
  C:\Windows\System\PdQDAHL.exe
  2⤵
  PID:2940
- C:\Windows\System\LVaskmK.exe
  C:\Windows\System\LVaskmK.exe
  2⤵
  PID:7244
- C:\Windows\System\GvQPPiv.exe
  C:\Windows\System\GvQPPiv.exe
  2⤵
  PID:8160
- C:\Windows\System\SLfzbEx.exe
  C:\Windows\System\SLfzbEx.exe
  2⤵
  PID:980
- C:\Windows\System\ShKfuWC.exe
  C:\Windows\System\ShKfuWC.exe
  2⤵
  PID:7840
- C:\Windows\System\FtdcWjf.exe
  C:\Windows\System\FtdcWjf.exe
  2⤵
  PID:8036
- C:\Windows\System\fVjhJUB.exe
  C:\Windows\System\fVjhJUB.exe
  2⤵
  PID:6392
- C:\Windows\System\xfDwuGE.exe
  C:\Windows\System\xfDwuGE.exe
  2⤵
  PID:6184
- C:\Windows\System\SIkliYj.exe
  C:\Windows\System\SIkliYj.exe
  2⤵
  PID:7696
- C:\Windows\System\PpKuHpj.exe
  C:\Windows\System\PpKuHpj.exe
  2⤵
  PID:7596
- C:\Windows\System\mLSwpKN.exe
  C:\Windows\System\mLSwpKN.exe
  2⤵
  PID:8200
- C:\Windows\System\rIhfyZt.exe
  C:\Windows\System\rIhfyZt.exe
  2⤵
  PID:8216
- C:\Windows\System\MNMiSsh.exe
  C:\Windows\System\MNMiSsh.exe
  2⤵
  PID:8232
- C:\Windows\System\SCowLGA.exe
  C:\Windows\System\SCowLGA.exe
  2⤵
  PID:8248
- C:\Windows\System\SNlXjRS.exe
  C:\Windows\System\SNlXjRS.exe
  2⤵
  PID:8264
- C:\Windows\System\hjzRzeM.exe
  C:\Windows\System\hjzRzeM.exe
  2⤵
  PID:8340
- C:\Windows\System\NaqbRHA.exe
  C:\Windows\System\NaqbRHA.exe
  2⤵
  PID:8356
- C:\Windows\System\VOSwTEc.exe
  C:\Windows\System\VOSwTEc.exe
  2⤵
  PID:8372
- C:\Windows\System\EtTTncu.exe
  C:\Windows\System\EtTTncu.exe
  2⤵
  PID:8388
- C:\Windows\System\mptnNHL.exe
  C:\Windows\System\mptnNHL.exe
  2⤵
  PID:8408
- C:\Windows\System\LmFBZye.exe
  C:\Windows\System\LmFBZye.exe
  2⤵
  PID:8424
- C:\Windows\System\QVGgIud.exe
  C:\Windows\System\QVGgIud.exe
  2⤵
  PID:8532
- C:\Windows\System\CtKHDJo.exe
  C:\Windows\System\CtKHDJo.exe
  2⤵
  PID:8548
- C:\Windows\System\iwhFWXq.exe
  C:\Windows\System\iwhFWXq.exe
  2⤵
  PID:8568
- C:\Windows\System\JsCmCYM.exe
  C:\Windows\System\JsCmCYM.exe
  2⤵
  PID:8584
- C:\Windows\System\UuWNYez.exe
  C:\Windows\System\UuWNYez.exe
  2⤵
  PID:8600
- C:\Windows\System\fqFMCtA.exe
  C:\Windows\System\fqFMCtA.exe
  2⤵
  PID:8616
- C:\Windows\System\SwMrkBO.exe
  C:\Windows\System\SwMrkBO.exe
  2⤵
  PID:8828
- C:\Windows\System\OZSsHgf.exe
  C:\Windows\System\OZSsHgf.exe
  2⤵
  PID:8848
- C:\Windows\System\dSDhYSF.exe
  C:\Windows\System\dSDhYSF.exe
  2⤵
  PID:8864
- C:\Windows\System\ltzUTbV.exe
  C:\Windows\System\ltzUTbV.exe
  2⤵
  PID:8940
- C:\Windows\System\ZbUmYeN.exe
  C:\Windows\System\ZbUmYeN.exe
  2⤵
  PID:8960
- C:\Windows\System\FFWgLKm.exe
  C:\Windows\System\FFWgLKm.exe
  2⤵
  PID:8984
- C:\Windows\System\kSOGDnE.exe
  C:\Windows\System\kSOGDnE.exe
  2⤵
  PID:9020
- C:\Windows\System\jpvCyFE.exe
  C:\Windows\System\jpvCyFE.exe
  2⤵
  PID:9044
- C:\Windows\System\dJNfOfW.exe
  C:\Windows\System\dJNfOfW.exe
  2⤵
  PID:9060
- C:\Windows\System\CoVfAlc.exe
  C:\Windows\System\CoVfAlc.exe
  2⤵
  PID:9108
- C:\Windows\System\ClCawix.exe
  C:\Windows\System\ClCawix.exe
  2⤵
  PID:9124
- C:\Windows\System\mOjfpCB.exe
  C:\Windows\System\mOjfpCB.exe
  2⤵
  PID:9140
- C:\Windows\System\mXHmPnt.exe
  C:\Windows\System\mXHmPnt.exe
  2⤵
  PID:9156
- C:\Windows\System\IYqxali.exe
  C:\Windows\System\IYqxali.exe
  2⤵
  PID:9172
- C:\Windows\System\FoMmtlz.exe
  C:\Windows\System\FoMmtlz.exe
  2⤵
  PID:9188
- C:\Windows\System\OjaMkIn.exe
  C:\Windows\System\OjaMkIn.exe
  2⤵
  PID:9204
- C:\Windows\System\fKNerfD.exe
  C:\Windows\System\fKNerfD.exe
  2⤵
  PID:8212
- C:\Windows\System\mdTeENS.exe
  C:\Windows\System\mdTeENS.exe
  2⤵
  PID:8284
- C:\Windows\System\wrXCUby.exe
  C:\Windows\System\wrXCUby.exe
  2⤵
  PID:8300
- C:\Windows\System\RnBKjzY.exe
  C:\Windows\System\RnBKjzY.exe
  2⤵
  PID:8320
- C:\Windows\System\IOnTlhS.exe
  C:\Windows\System\IOnTlhS.exe
  2⤵
  PID:8332
- C:\Windows\System\vYnxams.exe
  C:\Windows\System\vYnxams.exe
  2⤵
  PID:7684
- C:\Windows\System\kGctQpz.exe
  C:\Windows\System\kGctQpz.exe
  2⤵
  PID:960
- C:\Windows\System\ZdujvsC.exe
  C:\Windows\System\ZdujvsC.exe
  2⤵
  PID:8684
- C:\Windows\System\XcKKJIo.exe
  C:\Windows\System\XcKKJIo.exe
  2⤵
  PID:8768
- C:\Windows\System\jsoEjEL.exe
  C:\Windows\System\jsoEjEL.exe
  2⤵
  PID:8784
- C:\Windows\System\WfLMyqe.exe
  C:\Windows\System\WfLMyqe.exe
  2⤵
  PID:8808
- C:\Windows\System\JKgTQEW.exe
  C:\Windows\System\JKgTQEW.exe
  2⤵
  PID:9148
- C:\Windows\System\waOIVWr.exe
  C:\Windows\System\waOIVWr.exe
  2⤵
  PID:9076
- C:\Windows\System\RDhwypc.exe
  C:\Windows\System\RDhwypc.exe
  2⤵
  PID:2056
- C:\Windows\System\SxkVHlL.exe
  C:\Windows\System\SxkVHlL.exe
  2⤵
  PID:7320
- C:\Windows\System\osmVnYq.exe
  C:\Windows\System\osmVnYq.exe
  2⤵
  PID:7068
- C:\Windows\System\ybCMvYy.exe
  C:\Windows\System\ybCMvYy.exe
  2⤵
  PID:8228
- C:\Windows\System\njuBGOs.exe
  C:\Windows\System\njuBGOs.exe
  2⤵
  PID:7592
- C:\Windows\System\CDyJiAb.exe
  C:\Windows\System\CDyJiAb.exe
  2⤵
  PID:7352
- C:\Windows\System\oewngzz.exe
  C:\Windows\System\oewngzz.exe
  2⤵
  PID:1488
- C:\Windows\System\cuJomlG.exe
  C:\Windows\System\cuJomlG.exe
  2⤵
  PID:8700
- C:\Windows\System\gsOESFw.exe
  C:\Windows\System\gsOESFw.exe
  2⤵
  PID:8448
- C:\Windows\System\VinrExK.exe
  C:\Windows\System\VinrExK.exe
  2⤵
  PID:8468
- C:\Windows\System\TBFOtyH.exe
  C:\Windows\System\TBFOtyH.exe
  2⤵
  PID:8500
- C:\Windows\System\DUeZgJu.exe
  C:\Windows\System\DUeZgJu.exe
  2⤵
  PID:8524
- C:\Windows\System\OigdLUc.exe
  C:\Windows\System\OigdLUc.exe
  2⤵
  PID:8592
- C:\Windows\System\rhkTmEL.exe
  C:\Windows\System\rhkTmEL.exe
  2⤵
  PID:8628
- C:\Windows\System\pzezrRj.exe
  C:\Windows\System\pzezrRj.exe
  2⤵
  PID:8664
- C:\Windows\System\TSbzWct.exe
  C:\Windows\System\TSbzWct.exe
  2⤵
  PID:8400
- C:\Windows\System\ZQXmrHs.exe
  C:\Windows\System\ZQXmrHs.exe
  2⤵
  PID:8452
- C:\Windows\System\IvnrKRT.exe
  C:\Windows\System\IvnrKRT.exe
  2⤵
  PID:8436
- C:\Windows\System\ytctvPB.exe
  C:\Windows\System\ytctvPB.exe
  2⤵
  PID:8608
- C:\Windows\System\ytVcuKX.exe
  C:\Windows\System\ytVcuKX.exe
  2⤵
  PID:8840
- C:\Windows\System\nijSwvb.exe
  C:\Windows\System\nijSwvb.exe
  2⤵
  PID:8876
- C:\Windows\System\yUIwPdh.exe
  C:\Windows\System\yUIwPdh.exe
  2⤵
  PID:8612
- C:\Windows\System\KVSnQgu.exe
  C:\Windows\System\KVSnQgu.exe
  2⤵
  PID:8760
- C:\Windows\System\OrDYTEd.exe
  C:\Windows\System\OrDYTEd.exe
  2⤵
  PID:8776
- C:\Windows\System\ZwfEhWC.exe
  C:\Windows\System\ZwfEhWC.exe
  2⤵
  PID:8820
- C:\Windows\System\VQUzKgQ.exe
  C:\Windows\System\VQUzKgQ.exe
  2⤵
  PID:8800
- C:\Windows\System\aUdjJNB.exe
  C:\Windows\System\aUdjJNB.exe
  2⤵
  PID:9016
- C:\Windows\System\SDGocgl.exe
  C:\Windows\System\SDGocgl.exe
  2⤵
  PID:8860
- C:\Windows\System\gfgHREL.exe
  C:\Windows\System\gfgHREL.exe
  2⤵
  PID:8764
- C:\Windows\System\wWHiJwO.exe
  C:\Windows\System\wWHiJwO.exe
  2⤵
  PID:9012
- C:\Windows\System\hOSctZP.exe
  C:\Windows\System\hOSctZP.exe
  2⤵
  PID:9032
- C:\Windows\System\THsVsMJ.exe
  C:\Windows\System\THsVsMJ.exe
  2⤵
  PID:8892
- C:\Windows\System\HgFcVyj.exe
  C:\Windows\System\HgFcVyj.exe
  2⤵
  PID:936
- C:\Windows\System\XeKvDEL.exe
  C:\Windows\System\XeKvDEL.exe
  2⤵
  PID:8888
- C:\Windows\System\MQzIaaq.exe
  C:\Windows\System\MQzIaaq.exe
  2⤵
  PID:9036
- C:\Windows\System\uNZvoKF.exe
  C:\Windows\System\uNZvoKF.exe
  2⤵
  PID:8908
- C:\Windows\System\GCvUwjp.exe
  C:\Windows\System\GCvUwjp.exe
  2⤵
  PID:1272
- C:\Windows\System\UivCSMo.exe
  C:\Windows\System\UivCSMo.exe
  2⤵
  PID:8920
- C:\Windows\System\ZoRWTJI.exe
  C:\Windows\System\ZoRWTJI.exe
  2⤵
  PID:8928
- C:\Windows\System\kNHXouD.exe
  C:\Windows\System\kNHXouD.exe
  2⤵
  PID:8980
- C:\Windows\System\dqDmKob.exe
  C:\Windows\System\dqDmKob.exe
  2⤵
  PID:8292
- C:\Windows\System\vukXHjm.exe
  C:\Windows\System\vukXHjm.exe
  2⤵
  PID:9072
- C:\Windows\System\VjZDhaG.exe
  C:\Windows\System\VjZDhaG.exe
  2⤵
  PID:9132
- C:\Windows\System\pVDjgcE.exe
  C:\Windows\System\pVDjgcE.exe
  2⤵
  PID:9168
- C:\Windows\System\lvvFgiy.exe
  C:\Windows\System\lvvFgiy.exe
  2⤵
  PID:9096
- C:\Windows\System\KVjKJrV.exe
  C:\Windows\System\KVjKJrV.exe
  2⤵
  PID:9080
- C:\Windows\System\ZEvoVRq.exe
  C:\Windows\System\ZEvoVRq.exe
  2⤵
  PID:8692
- C:\Windows\System\oCjDYas.exe
  C:\Windows\System\oCjDYas.exe
  2⤵
  PID:8420
- C:\Windows\System\gobuNjG.exe
  C:\Windows\System\gobuNjG.exe
  2⤵
  PID:8364
- C:\Windows\System\oowobkq.exe
  C:\Windows\System\oowobkq.exe
  2⤵
  PID:7916
- C:\Windows\System\YTrdVvK.exe
  C:\Windows\System\YTrdVvK.exe
  2⤵
  PID:8672
- C:\Windows\System\jUjaepk.exe
  C:\Windows\System\jUjaepk.exe
  2⤵
  PID:8736
- C:\Windows\System\tKkIqcm.exe
  C:\Windows\System\tKkIqcm.exe
  2⤵
  PID:8660
- C:\Windows\System\RWhmCQe.exe
  C:\Windows\System\RWhmCQe.exe
  2⤵
  PID:8476
- C:\Windows\System\UyRPUlg.exe
  C:\Windows\System\UyRPUlg.exe
  2⤵
  PID:8380
- C:\Windows\System\rniADCG.exe
  C:\Windows\System\rniADCG.exe
  2⤵
  PID:8728
- C:\Windows\System\uWXrOlH.exe
  C:\Windows\System\uWXrOlH.exe
  2⤵
  PID:8440
- C:\Windows\System\gQmuUKI.exe
  C:\Windows\System\gQmuUKI.exe
  2⤵
  PID:8640
- C:\Windows\System\vQNZtLL.exe
  C:\Windows\System\vQNZtLL.exe
  2⤵
  PID:8836
- C:\Windows\System\SFfFDtH.exe
  C:\Windows\System\SFfFDtH.exe
  2⤵
  PID:8804
- C:\Windows\System\xSyKvqj.exe
  C:\Windows\System\xSyKvqj.exe
  2⤵
  PID:8752
- C:\Windows\System\lSTArsf.exe
  C:\Windows\System\lSTArsf.exe
  2⤵
  PID:8780
- C:\Windows\System\SJuPsWv.exe
  C:\Windows\System\SJuPsWv.exe
  2⤵
  PID:8632
- C:\Windows\System\chNzTEj.exe
  C:\Windows\System\chNzTEj.exe
  2⤵
  PID:1632
- C:\Windows\System\FExaDBe.exe
  C:\Windows\System\FExaDBe.exe
  2⤵
  PID:8884
- C:\Windows\System\LOGYWOm.exe
  C:\Windows\System\LOGYWOm.exe
  2⤵
  PID:9120
- C:\Windows\System\WMzybfo.exe
  C:\Windows\System\WMzybfo.exe
  2⤵
  PID:8904
- C:\Windows\System\nZaDhqD.exe
  C:\Windows\System\nZaDhqD.exe
  2⤵
  PID:9200
- C:\Windows\System\XMbLEOA.exe
  C:\Windows\System\XMbLEOA.exe
  2⤵
  PID:9068
- C:\Windows\System\HEUhVbV.exe
  C:\Windows\System\HEUhVbV.exe
  2⤵
  PID:8208
- C:\Windows\System\vvVdItH.exe
  C:\Windows\System\vvVdItH.exe
  2⤵
  PID:9164
- C:\Windows\System\ZJvqeNA.exe
  C:\Windows\System\ZJvqeNA.exe
  2⤵
  PID:8244
- C:\Windows\System\oTHfFjS.exe
  C:\Windows\System\oTHfFjS.exe
  2⤵
  PID:8492
- C:\Windows\System\EixKSlE.exe
  C:\Windows\System\EixKSlE.exe
  2⤵
  PID:8576
- C:\Windows\System\MPLSNEe.exe
  C:\Windows\System\MPLSNEe.exe
  2⤵
  PID:7588
- C:\Windows\System\PMDBKth.exe
  C:\Windows\System\PMDBKth.exe
  2⤵
  PID:9152
- C:\Windows\System\fqscfIl.exe
  C:\Windows\System\fqscfIl.exe
  2⤵
  PID:8724
- C:\Windows\System\HjlUDhP.exe
  C:\Windows\System\HjlUDhP.exe
  2⤵
  PID:8560
- C:\Windows\System\cyIItln.exe
  C:\Windows\System\cyIItln.exe
  2⤵
  PID:8756
- C:\Windows\System\lSkOgwN.exe
  C:\Windows\System\lSkOgwN.exe
  2⤵
  PID:972
- C:\Windows\System\tcJWUTW.exe
  C:\Windows\System\tcJWUTW.exe
  2⤵
  PID:8740
- C:\Windows\System\xdWxPLx.exe
  C:\Windows\System\xdWxPLx.exe
  2⤵
  PID:9056
- C:\Windows\System\KbHSTMs.exe
  C:\Windows\System\KbHSTMs.exe
  2⤵
  PID:9084
- C:\Windows\System\zskkWmC.exe
  C:\Windows\System\zskkWmC.exe
  2⤵
  PID:7444
- C:\Windows\System\LNouHCM.exe
  C:\Windows\System\LNouHCM.exe
  2⤵
  PID:8416
- C:\Windows\System\nQkbeMT.exe
  C:\Windows\System\nQkbeMT.exe
  2⤵
  PID:9028
- C:\Windows\System\XaiBNHK.exe
  C:\Windows\System\XaiBNHK.exe
  2⤵
  PID:7404
- C:\Windows\System\jSFpRAV.exe
  C:\Windows\System\jSFpRAV.exe
  2⤵
  PID:8336
- C:\Windows\System\PVzTASV.exe
  C:\Windows\System\PVzTASV.exe
  2⤵
  PID:8744
- C:\Windows\System\RpDOPqy.exe
  C:\Windows\System\RpDOPqy.exe
  2⤵
  PID:8464
- C:\Windows\System\YnwbAMM.exe
  C:\Windows\System\YnwbAMM.exe
  2⤵
  PID:9212
- C:\Windows\System\YfitrOt.exe
  C:\Windows\System\YfitrOt.exe
  2⤵
  PID:9100
- C:\Windows\System\QnkpbYj.exe
  C:\Windows\System\QnkpbYj.exe
  2⤵
  PID:9104
- C:\Windows\System\WkziiOM.exe
  C:\Windows\System\WkziiOM.exe
  2⤵
  PID:6524
- C:\Windows\System\CdCkvKm.exe
  C:\Windows\System\CdCkvKm.exe
  2⤵
  PID:2260
- C:\Windows\System\MRYTfjj.exe
  C:\Windows\System\MRYTfjj.exe
  2⤵
  PID:9004
- C:\Windows\System\jfXVsXv.exe
  C:\Windows\System\jfXVsXv.exe
  2⤵
  PID:8460
- C:\Windows\System\vWWzlcD.exe
  C:\Windows\System\vWWzlcD.exe
  2⤵
  PID:9228
- C:\Windows\System\QSuhtIM.exe
  C:\Windows\System\QSuhtIM.exe
  2⤵
  PID:9248
- C:\Windows\System\RXChtiI.exe
  C:\Windows\System\RXChtiI.exe
  2⤵
  PID:9264
- C:\Windows\System\TfVsMIL.exe
  C:\Windows\System\TfVsMIL.exe
  2⤵
  PID:9280
- C:\Windows\System\CseJrBs.exe
  C:\Windows\System\CseJrBs.exe
  2⤵
  PID:9296
- C:\Windows\System\AgqWEug.exe
  C:\Windows\System\AgqWEug.exe
  2⤵
  PID:9312
- C:\Windows\System\PyPBDcM.exe
  C:\Windows\System\PyPBDcM.exe
  2⤵
  PID:9328
- C:\Windows\System\oEwLYGR.exe
  C:\Windows\System\oEwLYGR.exe
  2⤵
  PID:9344
- C:\Windows\System\yyCoSky.exe
  C:\Windows\System\yyCoSky.exe
  2⤵
  PID:9360
- C:\Windows\System\WhUiKVe.exe
  C:\Windows\System\WhUiKVe.exe
  2⤵
  PID:9376
- C:\Windows\System\EkoBSwX.exe
  C:\Windows\System\EkoBSwX.exe
  2⤵
  PID:9392
- C:\Windows\System\wJtdXVj.exe
  C:\Windows\System\wJtdXVj.exe
  2⤵
  PID:9408
- C:\Windows\System\VtVIpES.exe
  C:\Windows\System\VtVIpES.exe
  2⤵
  PID:9424
- C:\Windows\System\OtvYlLY.exe
  C:\Windows\System\OtvYlLY.exe
  2⤵
  PID:9440
- C:\Windows\System\WKJVzCh.exe
  C:\Windows\System\WKJVzCh.exe
  2⤵
  PID:9460
- C:\Windows\System\xFSNcEH.exe
  C:\Windows\System\xFSNcEH.exe
  2⤵
  PID:9476
- C:\Windows\System\kHlTfAw.exe
  C:\Windows\System\kHlTfAw.exe
  2⤵
  PID:9492
- C:\Windows\System\uXoPdvt.exe
  C:\Windows\System\uXoPdvt.exe
  2⤵
  PID:9508
- C:\Windows\System\ZEcFAre.exe
  C:\Windows\System\ZEcFAre.exe
  2⤵
  PID:9524
- C:\Windows\System\VJdTrBh.exe
  C:\Windows\System\VJdTrBh.exe
  2⤵
  PID:9540
- C:\Windows\System\wjeUbNy.exe
  C:\Windows\System\wjeUbNy.exe
  2⤵
  PID:9556
- C:\Windows\System\RiRSeoB.exe
  C:\Windows\System\RiRSeoB.exe
  2⤵
  PID:9572
- C:\Windows\System\CEjMkRq.exe
  C:\Windows\System\CEjMkRq.exe
  2⤵
  PID:9588
- C:\Windows\System\PpXDdAa.exe
  C:\Windows\System\PpXDdAa.exe
  2⤵
  PID:9604
- C:\Windows\System\sZmXTYp.exe
  C:\Windows\System\sZmXTYp.exe
  2⤵
  PID:9620
- C:\Windows\System\iDJEqPg.exe
  C:\Windows\System\iDJEqPg.exe
  2⤵
  PID:9636
- C:\Windows\System\zoPHimn.exe
  C:\Windows\System\zoPHimn.exe
  2⤵
  PID:9652
- C:\Windows\System\wQQcgpX.exe
  C:\Windows\System\wQQcgpX.exe
  2⤵
  PID:9668
- C:\Windows\System\jzLuciu.exe
  C:\Windows\System\jzLuciu.exe
  2⤵
  PID:9684
- C:\Windows\System\EoXuxgJ.exe
  C:\Windows\System\EoXuxgJ.exe
  2⤵
  PID:9700
- C:\Windows\System\evGjcov.exe
  C:\Windows\System\evGjcov.exe
  2⤵
  PID:9720
- C:\Windows\System\eXJRkMp.exe
  C:\Windows\System\eXJRkMp.exe
  2⤵
  PID:9736
- C:\Windows\System\tUOzOJZ.exe
  C:\Windows\System\tUOzOJZ.exe
  2⤵
  PID:9752
- C:\Windows\System\QfZihYC.exe
  C:\Windows\System\QfZihYC.exe
  2⤵
  PID:9768
- C:\Windows\System\bYAJQwF.exe
  C:\Windows\System\bYAJQwF.exe
  2⤵
  PID:9784
- C:\Windows\System\cgWmEQS.exe
  C:\Windows\System\cgWmEQS.exe
  2⤵
  PID:9804
- C:\Windows\System\NWRHxuI.exe
  C:\Windows\System\NWRHxuI.exe
  2⤵
  PID:9824
- C:\Windows\System\IGivJuf.exe
  C:\Windows\System\IGivJuf.exe
  2⤵
  PID:9840
- C:\Windows\System\RYhYHFt.exe
  C:\Windows\System\RYhYHFt.exe
  2⤵
  PID:9856
- C:\Windows\System\hpflcBN.exe
  C:\Windows\System\hpflcBN.exe
  2⤵
  PID:9872
- C:\Windows\System\AyAeJjW.exe
  C:\Windows\System\AyAeJjW.exe
  2⤵
  PID:9888
- C:\Windows\System\qJbvwko.exe
  C:\Windows\System\qJbvwko.exe
  2⤵
  PID:9904
- C:\Windows\System\EtkEopk.exe
  C:\Windows\System\EtkEopk.exe
  2⤵
  PID:9920
- C:\Windows\System\gqpQsVu.exe
  C:\Windows\System\gqpQsVu.exe
  2⤵
  PID:9936
- C:\Windows\System\BLigDul.exe
  C:\Windows\System\BLigDul.exe
  2⤵
  PID:9952
- C:\Windows\System\qXJcPBH.exe
  C:\Windows\System\qXJcPBH.exe
  2⤵
  PID:9968
- C:\Windows\System\fBOywJI.exe
  C:\Windows\System\fBOywJI.exe
  2⤵
  PID:9984
- C:\Windows\System\sniUpCl.exe
  C:\Windows\System\sniUpCl.exe
  2⤵
  PID:10000
- C:\Windows\System\DOdsvzG.exe
  C:\Windows\System\DOdsvzG.exe
  2⤵
  PID:10016
- C:\Windows\System\bEbEisi.exe
  C:\Windows\System\bEbEisi.exe
  2⤵
  PID:10032
- C:\Windows\System\asbCDaq.exe
  C:\Windows\System\asbCDaq.exe
  2⤵
  PID:10048
- C:\Windows\System\nNWzJkh.exe
  C:\Windows\System\nNWzJkh.exe
  2⤵
  PID:10064
- C:\Windows\System\XCvEuXn.exe
  C:\Windows\System\XCvEuXn.exe
  2⤵
  PID:10080
- C:\Windows\System\fpxOeVo.exe
  C:\Windows\System\fpxOeVo.exe
  2⤵
  PID:10096
- C:\Windows\System\ctMGhpx.exe
  C:\Windows\System\ctMGhpx.exe
  2⤵
  PID:10116
- C:\Windows\System\bTiwMsu.exe
  C:\Windows\System\bTiwMsu.exe
  2⤵
  PID:10132
- C:\Windows\System\lusmjFQ.exe
  C:\Windows\System\lusmjFQ.exe
  2⤵
  PID:10148
- C:\Windows\System\rWtgmZW.exe
  C:\Windows\System\rWtgmZW.exe
  2⤵
  PID:10164
- C:\Windows\System\oMWbOLa.exe
  C:\Windows\System\oMWbOLa.exe
  2⤵
  PID:10180
- C:\Windows\System\ZmKUIuu.exe
  C:\Windows\System\ZmKUIuu.exe
  2⤵
  PID:10196
- C:\Windows\System\rUHWcQn.exe
  C:\Windows\System\rUHWcQn.exe
  2⤵
  PID:10212
- C:\Windows\System\uiJqNGn.exe
  C:\Windows\System\uiJqNGn.exe
  2⤵
  PID:10228
- C:\Windows\System\tXuRdUI.exe
  C:\Windows\System\tXuRdUI.exe
  2⤵
  PID:9224
- C:\Windows\System\pyUoTMF.exe
  C:\Windows\System\pyUoTMF.exe
  2⤵
  PID:9292
- C:\Windows\System\ulMatiV.exe
  C:\Windows\System\ulMatiV.exe
  2⤵
  PID:8680
- C:\Windows\System\oLPSyAx.exe
  C:\Windows\System\oLPSyAx.exe
  2⤵
  PID:9240
- C:\Windows\System\RfryCZF.exe
  C:\Windows\System\RfryCZF.exe
  2⤵
  PID:9304
- C:\Windows\System\nwEFhvb.exe
  C:\Windows\System\nwEFhvb.exe
  2⤵
  PID:9356
- C:\Windows\System\tbBvNRi.exe
  C:\Windows\System\tbBvNRi.exe
  2⤵
  PID:9388
- C:\Windows\System\IBdEsIR.exe
  C:\Windows\System\IBdEsIR.exe
  2⤵
  PID:9420
- C:\Windows\System\NLAjnQJ.exe
  C:\Windows\System\NLAjnQJ.exe
  2⤵
  PID:9000
- C:\Windows\System\EJcWvMt.exe
  C:\Windows\System\EJcWvMt.exe
  2⤵
  PID:9468
- C:\Windows\System\xyOiPSF.exe
  C:\Windows\System\xyOiPSF.exe
  2⤵
  PID:9504
- C:\Windows\System\gjQdKNi.exe
  C:\Windows\System\gjQdKNi.exe
  2⤵
  PID:9552
- C:\Windows\System\YfcVsUX.exe
  C:\Windows\System\YfcVsUX.exe
  2⤵
  PID:9616
- C:\Windows\System\POINUtf.exe
  C:\Windows\System\POINUtf.exe
  2⤵
  PID:9536
- C:\Windows\System\OcBNBkJ.exe
  C:\Windows\System\OcBNBkJ.exe
  2⤵
  PID:9596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DRPebHL.exe

Filesize
1.9MB

MD5
e3a42b9932b6f8edbdbf5c4865fca0b6

SHA1
8e74c87ce2754e8a4ef11be5f7ec4abbb9bb5ec8

SHA256
a7783897b1e6f542cfb3568752ea1848d87300ec68d1467b07f4ae31ce5dbdb3

SHA512
9e5c0a3bacce635b4f94ea5355fc6147b10d6b7620c24debc748b06b72dbc334545351232592548029ab771151895318f260f0778de9ded477c7f94a28cf23af

Download Submit
C:\Windows\system\DecVCWD.exe

Filesize
1.9MB

MD5
b8a0862898dbf4d0ad958875b9508d2c

SHA1
7af2ed782b010c001eb03cbc17a9d10624dc30e1

SHA256
3de67883c659ced59a3908f018cd7c05cdfa9cb831f2ee1c15d58b9f31486c04

SHA512
adad8565d324fde6250f7854d28379adbd41531973cf481fb614ecc0101972b20ca67181a711f1a23dbe19b717ccdac0cafb7e2ffd26faffe921749540c78af5

Download Submit
C:\Windows\system\EhtfaHt.exe

Filesize
1.9MB

MD5
bc8ed7acbf1cc9bc57a581389df39da1

SHA1
7cf0a94442d85c256da1cc76dfbff323809a66f2

SHA256
6ed841f37edae04197c4612986883189388118ad5c819e1202624adbe9a8596d

SHA512
b27f6946b40d3d9e182048d224b00488bb8f1f02688f812dadbf47becba7adf73f09347dae0d6bf8bc63df32ff6b691614f557bca5dd259c1ba31265b34286e1

Download Submit
C:\Windows\system\FnNcUZz.exe

Filesize
1.9MB

MD5
2db0f36e12e0ac13560ad1810832e4ce

SHA1
0a1d7c7b00926c880646b1633e9398359fccd477

SHA256
c28ded03ad8f7d10736ff7e5d84b10a6e517cb0271aedd121fc1dba4c67e1ceb

SHA512
8c2398dbb7d7fa307dc523ccb0473d01ac590936c48b348ee233fc948526790be68b769e2148f2945d353b8b42cc6ddb46f64be19d51dfddb3d5bf51521edc93

Download Submit
C:\Windows\system\IYqWnKZ.exe

Filesize
1.9MB

MD5
fab8c4727a07da98dbcc5fb64ede1935

SHA1
e5cbf1bafefd49dec04126635442ac1801ce4bab

SHA256
08e62298b642b9e837ad41211ba4b6356c0efd3dbe2e2eb1a36a8e3e6dd627ed

SHA512
782345dec25887913c0eb27a82c89bacf83087deac42ff22e687156167f609ba62b564db6895957f23672c790bd5b421f26b6aca0188701fd362eb3b27e8e090

Download Submit
C:\Windows\system\JsXaKYw.exe

Filesize
1.9MB

MD5
da88591b302352d80f5fc77a9e4274f0

SHA1
895f0acc382421e51801a2f0df3724fcf9a66f52

SHA256
d9b893521cce74cc615b50429f11532b0a1e591b0fcaac888468154aefd5910b

SHA512
85fbf762fa6e2f9684007294210f21461b0dded798e29d37917f1cbafde119b0ffe14e794544d7deb989e68993afd23c49b2cac2502abd6b49f6fe2990ffcbec

Download Submit
C:\Windows\system\PbtHvSf.exe

Filesize
1.9MB

MD5
c7fddb4ca7b3a7315f7f335b6821376b

SHA1
297fa102dec5c66581e7098ce68340ade4e6ba22

SHA256
4efffe524d24124c03d4d6ca29c86897dde6cb6f7f75f2c78e47278f2e988e19

SHA512
f2b1291a4b7bff64331489a3840a0720aebc995e84ac739a6f70b6dfaf4b00eef0a9c1ead28eae04d12cf0fc83cf8cc6ae8bb84c960a7ba7ffe212d98027796c

Download Submit
C:\Windows\system\QMseoPN.exe

Filesize
1.9MB

MD5
1a6c54c58ebef2017fc57d7a43ecdeb6

SHA1
db4007a65126913e1ee0d0f0ac35ef5bab15cb2d

SHA256
638a47b1988333a0c466e7a0cd6ba2baef0dd0fa4017dc2ad509b0eb3059bf7b

SHA512
ebce5bd89853538440a156b17a4d5d7ed339a4f931ac72bd9b6099dcf050303a9cda2151e4a675518e38755d4fe39d99be1a5f8050f8915b404cce1b31cab30f

Download Submit
C:\Windows\system\RJmBdpp.exe

Filesize
1.9MB

MD5
ab618d5636ea99b65d933070054e3939

SHA1
b02b2dda66172459b2dd740e6b36b317be09987f

SHA256
75d709574deda4492253a9d8bfcf27e7abc437986bd9ccc2cd0446c52c846a0f

SHA512
a4cfb68ca3493f77cc25d16d272de797016fdda68f091e2899cd74603d40612316e0990e02c1f2abd0ec59213405e2005bc0b4c9fb34a6fbad72a41c7447aba1

Download Submit
C:\Windows\system\SUSbEuD.exe

Filesize
1.9MB

MD5
3623251ca1ea311f260ff233b17047b2

SHA1
7960b53db9e0229455b5081df15880affc398906

SHA256
5a5cbd549ca2ed48e46d61cee2f97af291499ce68db11ae946ec5d4cdf58b167

SHA512
2a2d609d28509f34cef9c864640bd1e2ebf263a7603ff7010aa8eb399ea0bd426ec2d54086640a27e960c71c21d5e5a0984a1ed326b01e387eab69ff7bc5fa4e

Download Submit
C:\Windows\system\UuwBwfN.exe

Filesize
1.9MB

MD5
e50ed04bd205d5962fbc7b16ba699698

SHA1
8d6008ea0df62381199735ae386457c023079304

SHA256
97335f33e7e4fa1677b6894b22659cde3a1e2e256744e4b48673de0fd2e46f0e

SHA512
e8c9f19db4070778985764e56b31831a79b77f64fdb2a9d5f4bbbe8ec15c8aa9e263a0a8e6002895fb3f49489f889df3789469fb04371ea6cfa89dc74ff72301

Download Submit
C:\Windows\system\VvuMxsg.exe

Filesize
1.9MB

MD5
9e0abe94fac70882ba5d5eb6f93fec83

SHA1
50153d464eaef3e85ea1745903a3090334e82a63

SHA256
7c0395058e447d9c129ed121326fc77e11d13884670141cee4c753b9f08e6a41

SHA512
de6e3c7f8028edc4b19d245ff3aae58cf341d6cdb3a9eb07a90c0e148854c533317e48836b01534e10611528e0883629e8a701b4cb79bc75fc7bbb402ca3c2b8

Download Submit
C:\Windows\system\XncmMyh.exe

Filesize
1.9MB

MD5
883cac626358602a705522cf7142bcf4

SHA1
2e090eb6bee070aa5b34896b1cf7837e6cfea05f

SHA256
096f1e82a9556a082f3476f7c69e5d6e3b876e845a4434f322bb53524427592c

SHA512
6c35ca9cedf4d3f9f12d0440d97afbeacf7a92ea17cae876eb8bcbbd5db9910a0f653c3b8c5fd48f7148f9760e645b3a179d15f2be0f52105d904537ca37bdcf

Download Submit
C:\Windows\system\aFqYTum.exe

Filesize
1.9MB

MD5
dc73f186b115e478fec76a90f3928473

SHA1
aba54e2b33673120105537cbec8f7c146b7cc680

SHA256
ef764d3e80367078a637b6a8f799ac50b9b1ed5d4bbb3fcd512ca6a1c12c6666

SHA512
cf002c5519302c71621654f09d087f82498aba09be8d8724b5dc324753d1c7597a69765daeb69d48805b1cb42354b15aa5a31535f90d217126d5e9853c0a213e

Download Submit
C:\Windows\system\bYyJNzp.exe

Filesize
1.9MB

MD5
688d48aa2be12db8eb81d8ae0f42a0dd

SHA1
fc3c95e9644b4bd7b99414c24b0cc984e7b086a3

SHA256
3b6fce18b2ca382635294d167a9ab54c3fe6f7758587547a27396be937046923

SHA512
5f367853abc3605152c6561d68d73f0fbbd93b7d4d384b2169bbd9821d832230a2292d15c15ed3e688a81021ef40cc6b1142f78f74ae4715002deda35561860a

Download Submit
C:\Windows\system\cOMiucG.exe

Filesize
1.9MB

MD5
94ebafefd6ef236dcbdc4066aec3860c

SHA1
4d382dbd9fa39fda22f50be12426d2f0499cf19a

SHA256
6e914fb38a208016a45c49da11903b20d321c08c0fa751752b0f711614c9c06b

SHA512
e23e5caf165072d4c1d542575a45161dce998b83b0178f39e2c1ec926e646414e02df74d55780c1814291db804ea51c09ea93f2d62abd4e141174138c3d75157

Download Submit
C:\Windows\system\hKtYimg.exe

Filesize
1.9MB

MD5
8f6d5644d7704d59cc7d2ae0605a143c

SHA1
af58a57230efa6aa7083ca4cac6fbc907bd0470a

SHA256
dce18b8e86131e82f3777afab634322c35947a96af09ee64837b895e48a5ca7d

SHA512
7432ddf81111cd29cd388313bdc42558f47cccf317beb4a5da0c6e5acfde0db3a46191f6dfd4a776db5dd187aa836ed5c50767c6190ba6dc524c71d77363705c

Download Submit
C:\Windows\system\iaqBCtW.exe

Filesize
1.9MB

MD5
0cebf3cdd21960bb5f9f0dd018afb401

SHA1
03411bdbb6bd4c4a9cabb3f140bd9c672d40166e

SHA256
6eeea3b713d4ec774684f6d98d271d778155ab26afa93e811209fff7af8ec047

SHA512
b273a4010e1c25d2253cac1610586491612c7f284d79d8251ae26c2f707cfefa596c622d80a90cd17e079c7956f54f3a80b9202bdfdb7d80706806856004d611

Download Submit
C:\Windows\system\jNorRaW.exe

Filesize
1.9MB

MD5
511619c949cb9875f12c1c4d1f2caca3

SHA1
c80c8489fdc72224bf7cbe2f28b3c65080bf97b6

SHA256
27a91ed7de51cca51142841d469cc4220fd89489f6831a588c162ba3d3424699

SHA512
0bf3d491218aa69c325ecf4e303a529500376f42036a1f4574fc35edf818b812d4e6bc62966c8d4e4dee3808d7eb7cdd4093ab70c8b06ba6592ace6ce98cd294

Download Submit
C:\Windows\system\liLjhdx.exe

Filesize
1.9MB

MD5
287a9c54093715894a2403874d5de4b1

SHA1
2f9154007723d3e604ee264ed18180bf5243fcd4

SHA256
c370af7ea05a5ca0c6e595c19c0884ad437e2af8fd0501ece4e9ac471215014a

SHA512
22364f35b8e7fc29dd23d462024a9757ad2d46e6d1bd6b71fdd9a78e790ffb0370e23a892a4bb0ce61ca55ec06c8dd032e0937088d87776b65a5eb8a8603566f

Download Submit
C:\Windows\system\nZHAUlh.exe

Filesize
1.9MB

MD5
c1c78fbb2b97cb28859127d11fc3d6b6

SHA1
968b727512f19a58183c894a162fccab923bdc56

SHA256
bf6375a157d4f6891fa90cb9bc6041482126db0a759c9f10ce58fd7c5b55b65e

SHA512
2a1b1ea805b5d313c5aa7532f1b2c234d3a668e409c30df4916e59fe88c98b73a6f6e548cd8600ea009bae906dccfff27334ef906617571ff35a8736a7e6ab2e

Download Submit
C:\Windows\system\nnDbNIA.exe

Filesize
1.9MB

MD5
c26d1195e26e2094e0b49230defaeabf

SHA1
c5b984db8abd501f61b92c1f24a9debeac7df5a3

SHA256
19bd1f5d4359c37c8e1118979af96c76bcd361f2feb818ffa0dfc1cc65cd7524

SHA512
08d17805a9b3e8e97bdc1980a878691125532d202a7beb22fad0d6ff795103f1f9687c65bc3fc1fb317a95f63fd23058abc955797c13689085fce693882516b0

Download Submit
C:\Windows\system\owqKSKF.exe

Filesize
1.9MB

MD5
08bef549f1a78061aac09b67cce3f5b0

SHA1
e40bc9075e565d9fd76e200316e151f8916c4824

SHA256
7c58a79c5cf332cda57f2926fa5fa5b7b3550b67c0ec567f3ec61cc04be6ca5a

SHA512
9a38ad984488eb842d417803475f9000a78eb18e031aabf03de890faa6edbefd80c7a8d3227f4183f14476211b69a2cb80efea3d5d82317de64fa614a83080ed

Download Submit
C:\Windows\system\pFnDSdV.exe

Filesize
1.9MB

MD5
58ec2ae8e2ef182ce16b818a75111417

SHA1
4e35a88de96719c89450ea9ddc33757243d92834

SHA256
c826c878feb1c21df5f48ed3baca4318e7113b96d9c0e9034bebc687881cdfcf

SHA512
9cea8e8dabe03aa9aa2825e1cdf8ce68cd73d890e066ad8e93ce23dcb10871c38098442c1a684c20f37d5fc41fe1dccf46e3a93c956f35558a1da20827714e8e

Download Submit
C:\Windows\system\sXdCEyS.exe

Filesize
1.9MB

MD5
66ada76205716fc0c138c3d1bedabc4c

SHA1
1f7a1b3674ce248bee348ffc4db0f40f191df47d

SHA256
cbf2b3f25141584bc95763f19141fe5825b1dd7a702da2fbe7a8675a8c54198e

SHA512
4211a4dca1fbb5a9cb73d9bbe67fa1cef3613d9454b518741ffc3d773d38cb94e7ddddfffa4628e84e24724dd03971d51d93bd0b6be193be850db5262919f2d7

Download Submit
C:\Windows\system\sZDLhET.exe

Filesize
1.9MB

MD5
c32eefc1636842c916bd831c558f3ff2

SHA1
a33f7b9dcb1029b9dcb9907ca833105a10f11040

SHA256
bb0003953f5730ce05d3cb8643f5d01da700ae601cfcf72a711c3e75407fdf71

SHA512
d1ae72e09e3db3a7cd7b3e7a5e932f8e5687228c2ec3dfbb64a842a763739b4425ec710a4279364e2314e9d60c11f827a1be1f932c79dbda838d9ab06ca77eec

Download Submit
C:\Windows\system\wsPHwoR.exe

Filesize
1.9MB

MD5
1b2ae65f2525c56942b31bf6eeea1f91

SHA1
a00c8c6861469b9a8b500e8e855af8e95190fd44

SHA256
8b6f2f4622105c12432513f360225db7a3ef8cc374dc0bcb9f4353d456b9ae94

SHA512
9c00c1ef1a346e9d4c1fc0e67a97616bf302ecbc1ee2643f27618fe0ca2a5b8ef8632a94d66721388fc5256ef392ac1a50ec50d3ffc6dd715e35a3a3cb5462a7

Download Submit
C:\Windows\system\xabuXfv.exe

Filesize
1.9MB

MD5
fb0f3f3d897736307c2c979d7e3e0539

SHA1
5db9bf074de40b7d1243c2bad79b5ee088bfa5dc

SHA256
9f1a3035b033d828ea8be59678102e5dd65e6c1cf74234a3ca17b249228c41af

SHA512
8bf47c489d558cbee07d9e2ceaadae6602c3dee9afecdfd526bf97b7d0dd0428ae4a213af2358ce49c0093bf02a973c43b25642b6f0cc84847585e782b55e854

Download Submit
C:\Windows\system\xmRgdGu.exe

Filesize
1.9MB

MD5
feea209167dd30d092a3d3458f9e2d89

SHA1
0799b75c06ef4fa9511ae54863526f2a4963c593

SHA256
5a05aa177a6f5d5c303a503beef96abf1aa040be5cc6b8eff65143cf4951cecf

SHA512
b4675929a326b923e55756dda56bf9db770691492cee421f6c5d8a446af54ae735e4a90587290d8f71b86a9e1a05cd39ff10d2a77fcdc5e5f3ae28d46650bb2d

Download Submit
\Windows\system\TDYEePi.exe

Filesize
1.9MB

MD5
23b893c45397c2c7c41d2348c183f438

SHA1
6dc7ec3d5da1a3c0c2a89d1c6bc61f8fb2e51596

SHA256
828e92bc04e988d305550db086c91afbed94ae5b221ac7e4c37f7b03b0f74d2a

SHA512
15376f22a3dc32db080beeab11d98f4e3ec6c110e2c0f0149cdfc04f38a4148067fd9710921673ba6dbb8b117ed2a3720e67373d80bcb65ce4648e475011bdc6

Download Submit
\Windows\system\YHZnXCH.exe

Filesize
1.9MB

MD5
afe52699d84c8a44f7f7536c6d38fbf5

SHA1
35cebac6fef95ccfe7c4fa3952dda616331fac09

SHA256
c119d97ecb2cfed8dc28033b2bb50449210c8d8b7f2370a6c8f854971839ef67

SHA512
5ce03afa5124a90ebb495bcc9f4884bf5c6442f7a9c076aea1da702247dbb09eb623048db45abf9b3b6e990005f15078e94452dcef898d96263f7dbe31d5430a

Download Submit
\Windows\system\eJUczIo.exe

Filesize
1.9MB

MD5
145e41afe903523d3c39adbcab595fde

SHA1
a0bd3ef502471e315e157aea765a305432dbb5bd

SHA256
c2c4b2e11ceddfae244f6f30329b70cdffbb7cf271ca14f10c3c5e29c07688a4

SHA512
b15e05288bfb70e695695634e5fe5bad9d2ca1b6e016dc966bdbc7ac2a9368a66a458af84142dbbe97390bdbea0e0e176fa7c6c83541f8ce3c2a7b534439005c

Download Submit
memory/572-74-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/572-2407-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/580-66-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/580-2223-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1588-2408-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/1588-43-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/1916-81-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/1916-2222-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2496-42-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2496-2479-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2564-2409-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2564-88-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2616-26-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-87-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-2179-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-2225-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-34-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-64-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-2226-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-36-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2776-2198-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2884-3356-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2884-68-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2888-71-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2888-35-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/2888-22-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-65-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2888-33-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-8-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2888-67-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2888-1-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2888-79-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2888-37-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2888-84-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2888-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2900-48-0x000000001B250000-0x000000001B532000-memory.dmp

Filesize
2.9MB

Download
memory/2900-49-0x0000000002140000-0x0000000002148000-memory.dmp

Filesize
32KB

Download
memory/3024-1742-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3024-9-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download