xmrig | 265cb9e40a2a1b0f229d2c3df651923f69de6c22e000a63da859313320ba6794

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
Size

1.9MB
MD5

0cdde98b9cffe19ceae7b841cf20d374
SHA1

b4c18f2ef1ebd6b63387522cee252c53df995963
SHA256

265cb9e40a2a1b0f229d2c3df651923f69de6c22e000a63da859313320ba6794
SHA512

28467e68d2cf5d97e6851eda7965800aec39b053a13139949bd294e70f3d69148ba32b099006678b42b1bb237244fc8a91b62a4e274ae0075470b4dc0ab7cbaf
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U19:NABQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/1032-154-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/1400-153-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2428-151-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2552-146-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2456-144-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2560-142-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/1032-141-0x0000000003000000-0x00000000033F2000-memory.dmp	xmrig
behavioral1/memory/2436-140-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2588-137-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2648-132-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2580-130-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2560-6832-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/3040-6824-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2648-6864-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2436-6858-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2552-6856-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2456-6855-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2428-6853-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2588-6849-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2580-6845-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2392-7075-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/1400-8417-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/1032-10400-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2392	OcUxqSs.exe
3040	iBpBVny.exe
2580	mLKljBi.exe
2648	xxnDtOm.exe
2588	dgxMRps.exe
2436	IJxvRgo.exe
2560	ZNMwUjy.exe
2456	mRruMTl.exe
2552	tLUSVXw.exe
2428	qTpPpGz.exe
1400	lCBSzDg.exe
3020	PdGzoCB.exe
2460	olNAuDF.exe
1316	qFtynvC.exe
2312	CYDMexu.exe
2680	NMuPpxF.exe
2820	AgpFRab.exe
1288	gthHrbU.exe
1500	mZBnkro.exe
1860	KhEIjuE.exe
2788	NMSMgeq.exe
2772	PfbCIwB.exe
2696	babmlBs.exe
2796	QviVmrX.exe
2064	QxlKvEe.exe
1480	GsXHAxU.exe
2412	NKWeiKD.exe
2916	bCdCqOG.exe
2396	xNEuAYr.exe
2380	kRxDdCl.exe
2852	amGGzlc.exe
312	rgagzUF.exe
1772	fZGEIDA.exe
1532	bAghSwh.exe
1340	ldZbJJY.exe
2080	sbLXVON.exe
1040	wMVLPMo.exe
612	aQdzHpl.exe
1984	qiriplb.exe
908	oGEWIYX.exe
2892	LUvxaPX.exe
2896	aoraRek.exe
3068	GaiUFea.exe
584	OvTckXB.exe
2280	hVseITJ.exe
2304	oBsZQMj.exe
2836	MkZKXMD.exe
2204	hRgNjTM.exe
1992	DJrZMfx.exe
1552	MFdqRNh.exe
2224	Vuesiwt.exe
2348	INsMgHY.exe
2544	HcZbDtP.exe
2496	dgTCRqb.exe
2568	UCOLtDF.exe
2620	puWhZQQ.exe
2556	andpocR.exe
1844	XxXuVEs.exe
2948	emhloKm.exe
1560	YkCBptI.exe
2252	zlmTWyg.exe
1612	KckmxMP.exe
1768	frbdtKG.exe
2260	WxXhLgA.exe

Loads dropped DLL 64 IoCs

pid	Process
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1032-0-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x000b0000000144e4-6.dat	upx
behavioral1/files/0x0007000000004e76-19.dat	upx
behavioral1/files/0x0008000000014f71-39.dat	upx
behavioral1/files/0x0006000000015d07-46.dat	upx
behavioral1/files/0x0006000000015d4a-59.dat	upx
behavioral1/files/0x0007000000014baa-33.dat	upx
behavioral1/files/0x0006000000015d6f-79.dat	upx
behavioral1/files/0x0006000000015eaf-109.dat	upx
behavioral1/files/0x0006000000015e3a-123.dat	upx
behavioral1/files/0x0006000000016117-118.dat	upx
behavioral1/files/0x0006000000016a9a-193.dat	upx
behavioral1/files/0x0006000000016843-188.dat	upx
behavioral1/files/0x000600000001661c-183.dat	upx
behavioral1/files/0x0006000000016572-178.dat	upx
behavioral1/files/0x00060000000164b2-173.dat	upx
behavioral1/files/0x000600000001630b-168.dat	upx
behavioral1/files/0x0015000000014726-163.dat	upx
behavioral1/files/0x00060000000161e7-160.dat	upx
behavioral1/memory/1400-153-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2428-151-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2552-146-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2456-144-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2560-142-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2436-140-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2588-137-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2648-132-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2580-130-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/3040-127-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x0006000000015f6d-125.dat	upx
behavioral1/files/0x0006000000015d8f-105.dat	upx
behavioral1/files/0x0006000000015d79-95.dat	upx
behavioral1/files/0x0006000000015d67-85.dat	upx
behavioral1/files/0x0006000000015fe9-116.dat	upx
behavioral1/files/0x0006000000015d56-74.dat	upx
behavioral1/files/0x0006000000015d9b-99.dat	upx
behavioral1/files/0x0006000000015d28-64.dat	upx
behavioral1/files/0x0006000000015d87-89.dat	upx
behavioral1/files/0x0007000000015ceb-54.dat	upx
behavioral1/files/0x0007000000014bea-42.dat	upx
behavioral1/files/0x0006000000015d5e-69.dat	upx
behavioral1/files/0x0008000000014b63-27.dat	upx
behavioral1/files/0x001500000001471d-18.dat	upx
behavioral1/memory/2392-12-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2560-6832-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/3040-6824-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2648-6864-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2436-6858-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2552-6856-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2456-6855-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2428-6853-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2588-6849-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2580-6845-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2392-7075-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/1400-8417-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/1032-10400-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bAghSwh.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\IqBmonO.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\xGnXHwI.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\DsQNQXL.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\lSNKmwe.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\AkqtTCz.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\TYzHbQh.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\uKkMZiY.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\pdwVbPw.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\XeWKUue.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\CYTepvW.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\TJyHEzW.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\zCTXOhP.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\EBVeHDU.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\ldZbJJY.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\ugiNagc.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\yIUwOXF.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\iINkHXe.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\zRbRgjq.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\sPNdgdY.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\WGwadZQ.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\bNefjol.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\gFZRKqT.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\ZIdmMDY.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\DOqLVNg.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\jtDhUSp.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\vCaIrDM.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\ibZBPmG.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\YYBpTmO.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\OxrFzbL.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\mZKscnh.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\RNlkiWk.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\AXBTmpx.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\dBQPgsL.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\fHeQrCc.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\uSuRKpe.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\PCBcMqc.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\HDvYkaK.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\laIgoIn.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\HkTfPXW.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\RJAQacJ.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\GBDrTDQ.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\elSAgPV.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\ISEaEgJ.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\WqNnnjx.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\rAlgsOp.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\ACjAilO.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\KVJEHQB.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\ibRklEO.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\GVnYHdP.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\YGXDPLo.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\QgjQcIV.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\VQRYnRL.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\hLjNlav.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\MmGrpbZ.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\wEOgXxD.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\hjcvFCW.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\KCOimca.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\VgTsqcJ.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\kkeomRm.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\GZApnoC.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\qCOUmom.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\MaAmdAO.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
File created	C:\Windows\System\LdQMWyb.exe	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2352	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	29
PID 1032 wrote to memory of 2352	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	29
PID 1032 wrote to memory of 2352	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	29
PID 1032 wrote to memory of 2392	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	30
PID 1032 wrote to memory of 2392	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	30
PID 1032 wrote to memory of 2392	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	30
PID 1032 wrote to memory of 3040	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	31
PID 1032 wrote to memory of 3040	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	31
PID 1032 wrote to memory of 3040	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	31
PID 1032 wrote to memory of 2580	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	32
PID 1032 wrote to memory of 2580	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	32
PID 1032 wrote to memory of 2580	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	32
PID 1032 wrote to memory of 2648	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	33
PID 1032 wrote to memory of 2648	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	33
PID 1032 wrote to memory of 2648	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	33
PID 1032 wrote to memory of 2588	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	34
PID 1032 wrote to memory of 2588	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	34
PID 1032 wrote to memory of 2588	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	34
PID 1032 wrote to memory of 2560	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	35
PID 1032 wrote to memory of 2560	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	35
PID 1032 wrote to memory of 2560	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	35
PID 1032 wrote to memory of 2436	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	36
PID 1032 wrote to memory of 2436	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	36
PID 1032 wrote to memory of 2436	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	36
PID 1032 wrote to memory of 2552	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	37
PID 1032 wrote to memory of 2552	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	37
PID 1032 wrote to memory of 2552	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	37
PID 1032 wrote to memory of 2456	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	38
PID 1032 wrote to memory of 2456	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	38
PID 1032 wrote to memory of 2456	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	38
PID 1032 wrote to memory of 1400	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	39
PID 1032 wrote to memory of 1400	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	39
PID 1032 wrote to memory of 1400	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	39
PID 1032 wrote to memory of 2428	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	40
PID 1032 wrote to memory of 2428	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	40
PID 1032 wrote to memory of 2428	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	40
PID 1032 wrote to memory of 2460	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	41
PID 1032 wrote to memory of 2460	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	41
PID 1032 wrote to memory of 2460	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	41
PID 1032 wrote to memory of 3020	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	42
PID 1032 wrote to memory of 3020	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	42
PID 1032 wrote to memory of 3020	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	42
PID 1032 wrote to memory of 2312	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	43
PID 1032 wrote to memory of 2312	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	43
PID 1032 wrote to memory of 2312	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	43
PID 1032 wrote to memory of 1316	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	44
PID 1032 wrote to memory of 1316	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	44
PID 1032 wrote to memory of 1316	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	44
PID 1032 wrote to memory of 2820	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	45
PID 1032 wrote to memory of 2820	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	45
PID 1032 wrote to memory of 2820	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	45
PID 1032 wrote to memory of 2680	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	46
PID 1032 wrote to memory of 2680	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	46
PID 1032 wrote to memory of 2680	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	46
PID 1032 wrote to memory of 1500	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	47
PID 1032 wrote to memory of 1500	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	47
PID 1032 wrote to memory of 1500	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	47
PID 1032 wrote to memory of 1288	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	48
PID 1032 wrote to memory of 1288	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	48
PID 1032 wrote to memory of 1288	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	48
PID 1032 wrote to memory of 2772	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	49
PID 1032 wrote to memory of 2772	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	49
PID 1032 wrote to memory of 2772	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	49
PID 1032 wrote to memory of 1860	1032	0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0cdde98b9cffe19ceae7b841cf20d374_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System\OcUxqSs.exe
  C:\Windows\System\OcUxqSs.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\iBpBVny.exe
  C:\Windows\System\iBpBVny.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\mLKljBi.exe
  C:\Windows\System\mLKljBi.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\xxnDtOm.exe
  C:\Windows\System\xxnDtOm.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\dgxMRps.exe
  C:\Windows\System\dgxMRps.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ZNMwUjy.exe
  C:\Windows\System\ZNMwUjy.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\IJxvRgo.exe
  C:\Windows\System\IJxvRgo.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\tLUSVXw.exe
  C:\Windows\System\tLUSVXw.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\mRruMTl.exe
  C:\Windows\System\mRruMTl.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\lCBSzDg.exe
  C:\Windows\System\lCBSzDg.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\qTpPpGz.exe
  C:\Windows\System\qTpPpGz.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\olNAuDF.exe
  C:\Windows\System\olNAuDF.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\PdGzoCB.exe
  C:\Windows\System\PdGzoCB.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\CYDMexu.exe
  C:\Windows\System\CYDMexu.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\qFtynvC.exe
  C:\Windows\System\qFtynvC.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\AgpFRab.exe
  C:\Windows\System\AgpFRab.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\NMuPpxF.exe
  C:\Windows\System\NMuPpxF.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\mZBnkro.exe
  C:\Windows\System\mZBnkro.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\gthHrbU.exe
  C:\Windows\System\gthHrbU.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\PfbCIwB.exe
  C:\Windows\System\PfbCIwB.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\KhEIjuE.exe
  C:\Windows\System\KhEIjuE.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\babmlBs.exe
  C:\Windows\System\babmlBs.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\NMSMgeq.exe
  C:\Windows\System\NMSMgeq.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\QviVmrX.exe
  C:\Windows\System\QviVmrX.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\QxlKvEe.exe
  C:\Windows\System\QxlKvEe.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\GsXHAxU.exe
  C:\Windows\System\GsXHAxU.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\NKWeiKD.exe
  C:\Windows\System\NKWeiKD.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\bCdCqOG.exe
  C:\Windows\System\bCdCqOG.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\xNEuAYr.exe
  C:\Windows\System\xNEuAYr.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\kRxDdCl.exe
  C:\Windows\System\kRxDdCl.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\amGGzlc.exe
  C:\Windows\System\amGGzlc.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\rgagzUF.exe
  C:\Windows\System\rgagzUF.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\fZGEIDA.exe
  C:\Windows\System\fZGEIDA.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\bAghSwh.exe
  C:\Windows\System\bAghSwh.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ldZbJJY.exe
  C:\Windows\System\ldZbJJY.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\aQdzHpl.exe
  C:\Windows\System\aQdzHpl.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\sbLXVON.exe
  C:\Windows\System\sbLXVON.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\qiriplb.exe
  C:\Windows\System\qiriplb.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\wMVLPMo.exe
  C:\Windows\System\wMVLPMo.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\oGEWIYX.exe
  C:\Windows\System\oGEWIYX.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\LUvxaPX.exe
  C:\Windows\System\LUvxaPX.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\aoraRek.exe
  C:\Windows\System\aoraRek.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\GaiUFea.exe
  C:\Windows\System\GaiUFea.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\OvTckXB.exe
  C:\Windows\System\OvTckXB.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\hVseITJ.exe
  C:\Windows\System\hVseITJ.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\oBsZQMj.exe
  C:\Windows\System\oBsZQMj.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\MkZKXMD.exe
  C:\Windows\System\MkZKXMD.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\hRgNjTM.exe
  C:\Windows\System\hRgNjTM.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\DJrZMfx.exe
  C:\Windows\System\DJrZMfx.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\INsMgHY.exe
  C:\Windows\System\INsMgHY.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\MFdqRNh.exe
  C:\Windows\System\MFdqRNh.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\qOcaEiR.exe
  C:\Windows\System\qOcaEiR.exe
  2⤵
  PID:1576
- C:\Windows\System\Vuesiwt.exe
  C:\Windows\System\Vuesiwt.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\SqZZLYG.exe
  C:\Windows\System\SqZZLYG.exe
  2⤵
  PID:2612
- C:\Windows\System\HcZbDtP.exe
  C:\Windows\System\HcZbDtP.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\kvbRZUk.exe
  C:\Windows\System\kvbRZUk.exe
  2⤵
  PID:2604
- C:\Windows\System\dgTCRqb.exe
  C:\Windows\System\dgTCRqb.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\LszHaIQ.exe
  C:\Windows\System\LszHaIQ.exe
  2⤵
  PID:2940
- C:\Windows\System\UCOLtDF.exe
  C:\Windows\System\UCOLtDF.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ZscXcUx.exe
  C:\Windows\System\ZscXcUx.exe
  2⤵
  PID:2692
- C:\Windows\System\puWhZQQ.exe
  C:\Windows\System\puWhZQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\snlTUgO.exe
  C:\Windows\System\snlTUgO.exe
  2⤵
  PID:2548
- C:\Windows\System\andpocR.exe
  C:\Windows\System\andpocR.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\tIJuFHu.exe
  C:\Windows\System\tIJuFHu.exe
  2⤵
  PID:2752
- C:\Windows\System\XxXuVEs.exe
  C:\Windows\System\XxXuVEs.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\jTrGMQr.exe
  C:\Windows\System\jTrGMQr.exe
  2⤵
  PID:2912
- C:\Windows\System\emhloKm.exe
  C:\Windows\System\emhloKm.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\HCUSPFY.exe
  C:\Windows\System\HCUSPFY.exe
  2⤵
  PID:2404
- C:\Windows\System\YkCBptI.exe
  C:\Windows\System\YkCBptI.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\xbpeCjG.exe
  C:\Windows\System\xbpeCjG.exe
  2⤵
  PID:2100
- C:\Windows\System\zlmTWyg.exe
  C:\Windows\System\zlmTWyg.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\AScJaXr.exe
  C:\Windows\System\AScJaXr.exe
  2⤵
  PID:1816
- C:\Windows\System\KckmxMP.exe
  C:\Windows\System\KckmxMP.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\AnTAWqs.exe
  C:\Windows\System\AnTAWqs.exe
  2⤵
  PID:3052
- C:\Windows\System\frbdtKG.exe
  C:\Windows\System\frbdtKG.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\gUzcNet.exe
  C:\Windows\System\gUzcNet.exe
  2⤵
  PID:812
- C:\Windows\System\WxXhLgA.exe
  C:\Windows\System\WxXhLgA.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\rWgUZLp.exe
  C:\Windows\System\rWgUZLp.exe
  2⤵
  PID:2292
- C:\Windows\System\RMKrcPH.exe
  C:\Windows\System\RMKrcPH.exe
  2⤵
  PID:2400
- C:\Windows\System\KymLAac.exe
  C:\Windows\System\KymLAac.exe
  2⤵
  PID:960
- C:\Windows\System\kKlRsHv.exe
  C:\Windows\System\kKlRsHv.exe
  2⤵
  PID:1916
- C:\Windows\System\TnmvlhG.exe
  C:\Windows\System\TnmvlhG.exe
  2⤵
  PID:1268
- C:\Windows\System\aLJzjwO.exe
  C:\Windows\System\aLJzjwO.exe
  2⤵
  PID:348
- C:\Windows\System\MCtRImP.exe
  C:\Windows\System\MCtRImP.exe
  2⤵
  PID:780
- C:\Windows\System\gMJTwyX.exe
  C:\Windows\System\gMJTwyX.exe
  2⤵
  PID:3064
- C:\Windows\System\UwbGLpH.exe
  C:\Windows\System\UwbGLpH.exe
  2⤵
  PID:2044
- C:\Windows\System\pZQCGiO.exe
  C:\Windows\System\pZQCGiO.exe
  2⤵
  PID:2284
- C:\Windows\System\rzFWZJz.exe
  C:\Windows\System\rzFWZJz.exe
  2⤵
  PID:2236
- C:\Windows\System\uFeclnU.exe
  C:\Windows\System\uFeclnU.exe
  2⤵
  PID:2700
- C:\Windows\System\xajfnmW.exe
  C:\Windows\System\xajfnmW.exe
  2⤵
  PID:2780
- C:\Windows\System\PLrSWhI.exe
  C:\Windows\System\PLrSWhI.exe
  2⤵
  PID:2476
- C:\Windows\System\dHzdyvG.exe
  C:\Windows\System\dHzdyvG.exe
  2⤵
  PID:2956
- C:\Windows\System\thLSNbr.exe
  C:\Windows\System\thLSNbr.exe
  2⤵
  PID:1716
- C:\Windows\System\LYrulBL.exe
  C:\Windows\System\LYrulBL.exe
  2⤵
  PID:1728
- C:\Windows\System\SomEwyn.exe
  C:\Windows\System\SomEwyn.exe
  2⤵
  PID:876
- C:\Windows\System\tuwkchZ.exe
  C:\Windows\System\tuwkchZ.exe
  2⤵
  PID:1828
- C:\Windows\System\RJDJZYK.exe
  C:\Windows\System\RJDJZYK.exe
  2⤵
  PID:2720
- C:\Windows\System\WVsUTdR.exe
  C:\Windows\System\WVsUTdR.exe
  2⤵
  PID:2180
- C:\Windows\System\WjXVsbT.exe
  C:\Windows\System\WjXVsbT.exe
  2⤵
  PID:3084
- C:\Windows\System\ofaOeYN.exe
  C:\Windows\System\ofaOeYN.exe
  2⤵
  PID:3104
- C:\Windows\System\TwQodUS.exe
  C:\Windows\System\TwQodUS.exe
  2⤵
  PID:3124
- C:\Windows\System\XjqpREO.exe
  C:\Windows\System\XjqpREO.exe
  2⤵
  PID:3140
- C:\Windows\System\NslSocY.exe
  C:\Windows\System\NslSocY.exe
  2⤵
  PID:3160
- C:\Windows\System\ZhvYzIa.exe
  C:\Windows\System\ZhvYzIa.exe
  2⤵
  PID:3180
- C:\Windows\System\iXDYjxC.exe
  C:\Windows\System\iXDYjxC.exe
  2⤵
  PID:3196
- C:\Windows\System\ZyMvCjV.exe
  C:\Windows\System\ZyMvCjV.exe
  2⤵
  PID:3212
- C:\Windows\System\DbvxqNW.exe
  C:\Windows\System\DbvxqNW.exe
  2⤵
  PID:3232
- C:\Windows\System\AzgrXAi.exe
  C:\Windows\System\AzgrXAi.exe
  2⤵
  PID:3248
- C:\Windows\System\OsYBmxf.exe
  C:\Windows\System\OsYBmxf.exe
  2⤵
  PID:3264
- C:\Windows\System\QbhdWTJ.exe
  C:\Windows\System\QbhdWTJ.exe
  2⤵
  PID:3284
- C:\Windows\System\HBHASXS.exe
  C:\Windows\System\HBHASXS.exe
  2⤵
  PID:3324
- C:\Windows\System\jMxMqDa.exe
  C:\Windows\System\jMxMqDa.exe
  2⤵
  PID:3344
- C:\Windows\System\rlXYktQ.exe
  C:\Windows\System\rlXYktQ.exe
  2⤵
  PID:3360
- C:\Windows\System\nzzFACQ.exe
  C:\Windows\System\nzzFACQ.exe
  2⤵
  PID:3376
- C:\Windows\System\MeffAie.exe
  C:\Windows\System\MeffAie.exe
  2⤵
  PID:3400
- C:\Windows\System\cvHtlrl.exe
  C:\Windows\System\cvHtlrl.exe
  2⤵
  PID:3420
- C:\Windows\System\HXbbniq.exe
  C:\Windows\System\HXbbniq.exe
  2⤵
  PID:3444
- C:\Windows\System\QTLxjkD.exe
  C:\Windows\System\QTLxjkD.exe
  2⤵
  PID:3460
- C:\Windows\System\aGasdbG.exe
  C:\Windows\System\aGasdbG.exe
  2⤵
  PID:3480
- C:\Windows\System\AToISxz.exe
  C:\Windows\System\AToISxz.exe
  2⤵
  PID:3496
- C:\Windows\System\yALXWaZ.exe
  C:\Windows\System\yALXWaZ.exe
  2⤵
  PID:3512
- C:\Windows\System\eEnDhDT.exe
  C:\Windows\System\eEnDhDT.exe
  2⤵
  PID:3528
- C:\Windows\System\egTTJoX.exe
  C:\Windows\System\egTTJoX.exe
  2⤵
  PID:3544
- C:\Windows\System\elSAgPV.exe
  C:\Windows\System\elSAgPV.exe
  2⤵
  PID:3560
- C:\Windows\System\OGQqIAr.exe
  C:\Windows\System\OGQqIAr.exe
  2⤵
  PID:3576
- C:\Windows\System\enrgXxv.exe
  C:\Windows\System\enrgXxv.exe
  2⤵
  PID:3592
- C:\Windows\System\GVOkfHe.exe
  C:\Windows\System\GVOkfHe.exe
  2⤵
  PID:3616
- C:\Windows\System\OfLmOCw.exe
  C:\Windows\System\OfLmOCw.exe
  2⤵
  PID:3632
- C:\Windows\System\usRoXIg.exe
  C:\Windows\System\usRoXIg.exe
  2⤵
  PID:3656
- C:\Windows\System\XbOLMeO.exe
  C:\Windows\System\XbOLMeO.exe
  2⤵
  PID:3672
- C:\Windows\System\dUdxdlb.exe
  C:\Windows\System\dUdxdlb.exe
  2⤵
  PID:3692
- C:\Windows\System\mgjHcSP.exe
  C:\Windows\System\mgjHcSP.exe
  2⤵
  PID:3708
- C:\Windows\System\TvuLtWX.exe
  C:\Windows\System\TvuLtWX.exe
  2⤵
  PID:3724
- C:\Windows\System\VmBVLZH.exe
  C:\Windows\System\VmBVLZH.exe
  2⤵
  PID:3744
- C:\Windows\System\KVJEHQB.exe
  C:\Windows\System\KVJEHQB.exe
  2⤵
  PID:3768
- C:\Windows\System\XFdBkgZ.exe
  C:\Windows\System\XFdBkgZ.exe
  2⤵
  PID:3784
- C:\Windows\System\nnvrgbu.exe
  C:\Windows\System\nnvrgbu.exe
  2⤵
  PID:3804
- C:\Windows\System\WisszVP.exe
  C:\Windows\System\WisszVP.exe
  2⤵
  PID:3820
- C:\Windows\System\fFEFPjY.exe
  C:\Windows\System\fFEFPjY.exe
  2⤵
  PID:3840
- C:\Windows\System\ggDWHRq.exe
  C:\Windows\System\ggDWHRq.exe
  2⤵
  PID:3860
- C:\Windows\System\BHxuXzd.exe
  C:\Windows\System\BHxuXzd.exe
  2⤵
  PID:3884
- C:\Windows\System\RcoWrvs.exe
  C:\Windows\System\RcoWrvs.exe
  2⤵
  PID:3900
- C:\Windows\System\APQuwhx.exe
  C:\Windows\System\APQuwhx.exe
  2⤵
  PID:3920
- C:\Windows\System\kjbWQAc.exe
  C:\Windows\System\kjbWQAc.exe
  2⤵
  PID:3936
- C:\Windows\System\YZaJqUZ.exe
  C:\Windows\System\YZaJqUZ.exe
  2⤵
  PID:3952
- C:\Windows\System\wYDuHMB.exe
  C:\Windows\System\wYDuHMB.exe
  2⤵
  PID:3968
- C:\Windows\System\mzkndym.exe
  C:\Windows\System\mzkndym.exe
  2⤵
  PID:3984
- C:\Windows\System\uCeBTyW.exe
  C:\Windows\System\uCeBTyW.exe
  2⤵
  PID:4000
- C:\Windows\System\pDPNyrd.exe
  C:\Windows\System\pDPNyrd.exe
  2⤵
  PID:4016
- C:\Windows\System\uXGmAcS.exe
  C:\Windows\System\uXGmAcS.exe
  2⤵
  PID:4032
- C:\Windows\System\XPDqTJB.exe
  C:\Windows\System\XPDqTJB.exe
  2⤵
  PID:4048
- C:\Windows\System\dmwwtCW.exe
  C:\Windows\System\dmwwtCW.exe
  2⤵
  PID:4064
- C:\Windows\System\VBSMdAy.exe
  C:\Windows\System\VBSMdAy.exe
  2⤵
  PID:4080
- C:\Windows\System\cTInQHe.exe
  C:\Windows\System\cTInQHe.exe
  2⤵
  PID:1116
- C:\Windows\System\cfMunoL.exe
  C:\Windows\System\cfMunoL.exe
  2⤵
  PID:1124
- C:\Windows\System\MQghVbV.exe
  C:\Windows\System\MQghVbV.exe
  2⤵
  PID:1864
- C:\Windows\System\vQTmLPI.exe
  C:\Windows\System\vQTmLPI.exe
  2⤵
  PID:2876
- C:\Windows\System\MwQmLDU.exe
  C:\Windows\System\MwQmLDU.exe
  2⤵
  PID:2276
- C:\Windows\System\nQMZYBb.exe
  C:\Windows\System\nQMZYBb.exe
  2⤵
  PID:628
- C:\Windows\System\hTqMBfQ.exe
  C:\Windows\System\hTqMBfQ.exe
  2⤵
  PID:2240
- C:\Windows\System\gChwcos.exe
  C:\Windows\System\gChwcos.exe
  2⤵
  PID:2540
- C:\Windows\System\QtNvuXm.exe
  C:\Windows\System\QtNvuXm.exe
  2⤵
  PID:1652
- C:\Windows\System\LwouoWb.exe
  C:\Windows\System\LwouoWb.exe
  2⤵
  PID:1492
- C:\Windows\System\jHKkplS.exe
  C:\Windows\System\jHKkplS.exe
  2⤵
  PID:2760
- C:\Windows\System\NMkJyHO.exe
  C:\Windows\System\NMkJyHO.exe
  2⤵
  PID:2272
- C:\Windows\System\cQitkOZ.exe
  C:\Windows\System\cQitkOZ.exe
  2⤵
  PID:3096
- C:\Windows\System\jRHCQGJ.exe
  C:\Windows\System\jRHCQGJ.exe
  2⤵
  PID:2832
- C:\Windows\System\ZaqRXZO.exe
  C:\Windows\System\ZaqRXZO.exe
  2⤵
  PID:3132
- C:\Windows\System\mjBMSyI.exe
  C:\Windows\System\mjBMSyI.exe
  2⤵
  PID:3080
- C:\Windows\System\mbqoTcR.exe
  C:\Windows\System\mbqoTcR.exe
  2⤵
  PID:3176
- C:\Windows\System\WaZixsM.exe
  C:\Windows\System\WaZixsM.exe
  2⤵
  PID:3244
- C:\Windows\System\kbjsZsO.exe
  C:\Windows\System\kbjsZsO.exe
  2⤵
  PID:3332
- C:\Windows\System\fCUJEor.exe
  C:\Windows\System\fCUJEor.exe
  2⤵
  PID:3372
- C:\Windows\System\hmwpzss.exe
  C:\Windows\System\hmwpzss.exe
  2⤵
  PID:3456
- C:\Windows\System\AfmvzFi.exe
  C:\Windows\System\AfmvzFi.exe
  2⤵
  PID:3520
- C:\Windows\System\ASyGTWy.exe
  C:\Windows\System\ASyGTWy.exe
  2⤵
  PID:3584
- C:\Windows\System\zGBowdU.exe
  C:\Windows\System\zGBowdU.exe
  2⤵
  PID:3628
- C:\Windows\System\NTSmtJX.exe
  C:\Windows\System\NTSmtJX.exe
  2⤵
  PID:2516
- C:\Windows\System\uqRBtrF.exe
  C:\Windows\System\uqRBtrF.exe
  2⤵
  PID:3412
- C:\Windows\System\axtGmTS.exe
  C:\Windows\System\axtGmTS.exe
  2⤵
  PID:3700
- C:\Windows\System\ILpZalJ.exe
  C:\Windows\System\ILpZalJ.exe
  2⤵
  PID:3152
- C:\Windows\System\TwbWlCs.exe
  C:\Windows\System\TwbWlCs.exe
  2⤵
  PID:3192
- C:\Windows\System\KIpORDO.exe
  C:\Windows\System\KIpORDO.exe
  2⤵
  PID:3296
- C:\Windows\System\oZtvNfo.exe
  C:\Windows\System\oZtvNfo.exe
  2⤵
  PID:3308
- C:\Windows\System\MtyuWEL.exe
  C:\Windows\System\MtyuWEL.exe
  2⤵
  PID:2424
- C:\Windows\System\AGsKaeQ.exe
  C:\Windows\System\AGsKaeQ.exe
  2⤵
  PID:3812
- C:\Windows\System\eCAHzGb.exe
  C:\Windows\System\eCAHzGb.exe
  2⤵
  PID:3852
- C:\Windows\System\POBbmgA.exe
  C:\Windows\System\POBbmgA.exe
  2⤵
  PID:1476
- C:\Windows\System\mwloNML.exe
  C:\Windows\System\mwloNML.exe
  2⤵
  PID:2756
- C:\Windows\System\VrWkNUN.exe
  C:\Windows\System\VrWkNUN.exe
  2⤵
  PID:3932
- C:\Windows\System\kKhxYWk.exe
  C:\Windows\System\kKhxYWk.exe
  2⤵
  PID:3396
- C:\Windows\System\yxJFwWQ.exe
  C:\Windows\System\yxJFwWQ.exe
  2⤵
  PID:3440
- C:\Windows\System\OjIksPA.exe
  C:\Windows\System\OjIksPA.exe
  2⤵
  PID:3608
- C:\Windows\System\HeNAVwH.exe
  C:\Windows\System\HeNAVwH.exe
  2⤵
  PID:3172
- C:\Windows\System\LQlILkH.exe
  C:\Windows\System\LQlILkH.exe
  2⤵
  PID:3688
- C:\Windows\System\NyUhpzO.exe
  C:\Windows\System\NyUhpzO.exe
  2⤵
  PID:3832
- C:\Windows\System\AUiMbLf.exe
  C:\Windows\System\AUiMbLf.exe
  2⤵
  PID:2884
- C:\Windows\System\oBSuPeg.exe
  C:\Windows\System\oBSuPeg.exe
  2⤵
  PID:2176
- C:\Windows\System\GjOjSoa.exe
  C:\Windows\System\GjOjSoa.exe
  2⤵
  PID:840
- C:\Windows\System\YJWkmhV.exe
  C:\Windows\System\YJWkmhV.exe
  2⤵
  PID:1140
- C:\Windows\System\VvsPrVd.exe
  C:\Windows\System\VvsPrVd.exe
  2⤵
  PID:2764
- C:\Windows\System\nAWBVQM.exe
  C:\Windows\System\nAWBVQM.exe
  2⤵
  PID:3208
- C:\Windows\System\TieiGRv.exe
  C:\Windows\System\TieiGRv.exe
  2⤵
  PID:3488
- C:\Windows\System\mohtBaD.exe
  C:\Windows\System\mohtBaD.exe
  2⤵
  PID:3960
- C:\Windows\System\vQjsMuY.exe
  C:\Windows\System\vQjsMuY.exe
  2⤵
  PID:4024
- C:\Windows\System\lHqCkam.exe
  C:\Windows\System\lHqCkam.exe
  2⤵
  PID:4088
- C:\Windows\System\tXJTvqC.exe
  C:\Windows\System\tXJTvqC.exe
  2⤵
  PID:4012
- C:\Windows\System\oGIYhqh.exe
  C:\Windows\System\oGIYhqh.exe
  2⤵
  PID:3872
- C:\Windows\System\BAVqnzn.exe
  C:\Windows\System\BAVqnzn.exe
  2⤵
  PID:3684
- C:\Windows\System\HwwZGni.exe
  C:\Windows\System\HwwZGni.exe
  2⤵
  PID:872
- C:\Windows\System\eKYeEIt.exe
  C:\Windows\System\eKYeEIt.exe
  2⤵
  PID:2564
- C:\Windows\System\ZecqRZN.exe
  C:\Windows\System\ZecqRZN.exe
  2⤵
  PID:3556
- C:\Windows\System\uEQbpxq.exe
  C:\Windows\System\uEQbpxq.exe
  2⤵
  PID:3188
- C:\Windows\System\NeDBMap.exe
  C:\Windows\System\NeDBMap.exe
  2⤵
  PID:3508
- C:\Windows\System\SdlUUiN.exe
  C:\Windows\System\SdlUUiN.exe
  2⤵
  PID:3304
- C:\Windows\System\CnXAGNW.exe
  C:\Windows\System\CnXAGNW.exe
  2⤵
  PID:764
- C:\Windows\System\WiLiVjv.exe
  C:\Windows\System\WiLiVjv.exe
  2⤵
  PID:4040
- C:\Windows\System\WTYCVlV.exe
  C:\Windows\System\WTYCVlV.exe
  2⤵
  PID:2936
- C:\Windows\System\sJFptoL.exe
  C:\Windows\System\sJFptoL.exe
  2⤵
  PID:3892
- C:\Windows\System\QxOfrCF.exe
  C:\Windows\System\QxOfrCF.exe
  2⤵
  PID:3792
- C:\Windows\System\dWvlqDY.exe
  C:\Windows\System\dWvlqDY.exe
  2⤵
  PID:3640
- C:\Windows\System\eMGstsC.exe
  C:\Windows\System\eMGstsC.exe
  2⤵
  PID:3896
- C:\Windows\System\dQsnzKy.exe
  C:\Windows\System\dQsnzKy.exe
  2⤵
  PID:3732
- C:\Windows\System\MCYvfNB.exe
  C:\Windows\System\MCYvfNB.exe
  2⤵
  PID:1972
- C:\Windows\System\QrewbSG.exe
  C:\Windows\System\QrewbSG.exe
  2⤵
  PID:2332
- C:\Windows\System\BbCapNW.exe
  C:\Windows\System\BbCapNW.exe
  2⤵
  PID:3436
- C:\Windows\System\eMyDNta.exe
  C:\Windows\System\eMyDNta.exe
  2⤵
  PID:3796
- C:\Windows\System\EUJHHsS.exe
  C:\Windows\System\EUJHHsS.exe
  2⤵
  PID:3352
- C:\Windows\System\izJuYTL.exe
  C:\Windows\System\izJuYTL.exe
  2⤵
  PID:3228
- C:\Windows\System\zVtXZSV.exe
  C:\Windows\System\zVtXZSV.exe
  2⤵
  PID:3016
- C:\Windows\System\mKrgbbq.exe
  C:\Windows\System\mKrgbbq.exe
  2⤵
  PID:2640
- C:\Windows\System\kGZBtSW.exe
  C:\Windows\System\kGZBtSW.exe
  2⤵
  PID:2536
- C:\Windows\System\STZakFX.exe
  C:\Windows\System\STZakFX.exe
  2⤵
  PID:3392
- C:\Windows\System\zqgUaer.exe
  C:\Windows\System\zqgUaer.exe
  2⤵
  PID:3916
- C:\Windows\System\xxXmEdw.exe
  C:\Windows\System\xxXmEdw.exe
  2⤵
  PID:1504
- C:\Windows\System\IsYeyaz.exe
  C:\Windows\System\IsYeyaz.exe
  2⤵
  PID:1520
- C:\Windows\System\CCTDcnd.exe
  C:\Windows\System\CCTDcnd.exe
  2⤵
  PID:2608
- C:\Windows\System\PxpwUtD.exe
  C:\Windows\System\PxpwUtD.exe
  2⤵
  PID:4108
- C:\Windows\System\FFoxYRm.exe
  C:\Windows\System\FFoxYRm.exe
  2⤵
  PID:4124
- C:\Windows\System\AnHUtWZ.exe
  C:\Windows\System\AnHUtWZ.exe
  2⤵
  PID:4140
- C:\Windows\System\JftWCwl.exe
  C:\Windows\System\JftWCwl.exe
  2⤵
  PID:4172
- C:\Windows\System\qyVCjcH.exe
  C:\Windows\System\qyVCjcH.exe
  2⤵
  PID:4188
- C:\Windows\System\rACaOiO.exe
  C:\Windows\System\rACaOiO.exe
  2⤵
  PID:4204
- C:\Windows\System\GsQZOpS.exe
  C:\Windows\System\GsQZOpS.exe
  2⤵
  PID:4220
- C:\Windows\System\ARuKJpS.exe
  C:\Windows\System\ARuKJpS.exe
  2⤵
  PID:4236
- C:\Windows\System\LetOXvd.exe
  C:\Windows\System\LetOXvd.exe
  2⤵
  PID:4252
- C:\Windows\System\nKdytGe.exe
  C:\Windows\System\nKdytGe.exe
  2⤵
  PID:4268
- C:\Windows\System\jaeKYqk.exe
  C:\Windows\System\jaeKYqk.exe
  2⤵
  PID:4288
- C:\Windows\System\HayStlU.exe
  C:\Windows\System\HayStlU.exe
  2⤵
  PID:4304
- C:\Windows\System\SnJOsCE.exe
  C:\Windows\System\SnJOsCE.exe
  2⤵
  PID:4320
- C:\Windows\System\SxxGCAN.exe
  C:\Windows\System\SxxGCAN.exe
  2⤵
  PID:4336
- C:\Windows\System\isLwYQE.exe
  C:\Windows\System\isLwYQE.exe
  2⤵
  PID:4352
- C:\Windows\System\dVTALkS.exe
  C:\Windows\System\dVTALkS.exe
  2⤵
  PID:4368
- C:\Windows\System\mswQmuH.exe
  C:\Windows\System\mswQmuH.exe
  2⤵
  PID:4384
- C:\Windows\System\nFWwlnW.exe
  C:\Windows\System\nFWwlnW.exe
  2⤵
  PID:4400
- C:\Windows\System\tdfEbvK.exe
  C:\Windows\System\tdfEbvK.exe
  2⤵
  PID:4416
- C:\Windows\System\XKapBUI.exe
  C:\Windows\System\XKapBUI.exe
  2⤵
  PID:4432
- C:\Windows\System\WnwdPfe.exe
  C:\Windows\System\WnwdPfe.exe
  2⤵
  PID:4452
- C:\Windows\System\MjoDzXl.exe
  C:\Windows\System\MjoDzXl.exe
  2⤵
  PID:4472
- C:\Windows\System\WJHhgRM.exe
  C:\Windows\System\WJHhgRM.exe
  2⤵
  PID:4488
- C:\Windows\System\pcDsele.exe
  C:\Windows\System\pcDsele.exe
  2⤵
  PID:4504
- C:\Windows\System\PxGBiRW.exe
  C:\Windows\System\PxGBiRW.exe
  2⤵
  PID:4520
- C:\Windows\System\EgFQlWr.exe
  C:\Windows\System\EgFQlWr.exe
  2⤵
  PID:4536
- C:\Windows\System\hhPSSqH.exe
  C:\Windows\System\hhPSSqH.exe
  2⤵
  PID:4552
- C:\Windows\System\VbLnViI.exe
  C:\Windows\System\VbLnViI.exe
  2⤵
  PID:4568
- C:\Windows\System\PYgRUsf.exe
  C:\Windows\System\PYgRUsf.exe
  2⤵
  PID:4584
- C:\Windows\System\RqEaSLk.exe
  C:\Windows\System\RqEaSLk.exe
  2⤵
  PID:4600
- C:\Windows\System\lNFitxw.exe
  C:\Windows\System\lNFitxw.exe
  2⤵
  PID:4616
- C:\Windows\System\sPVAeFi.exe
  C:\Windows\System\sPVAeFi.exe
  2⤵
  PID:4632
- C:\Windows\System\NjGnfst.exe
  C:\Windows\System\NjGnfst.exe
  2⤵
  PID:4648
- C:\Windows\System\DMEZimA.exe
  C:\Windows\System\DMEZimA.exe
  2⤵
  PID:4664
- C:\Windows\System\kMtePYl.exe
  C:\Windows\System\kMtePYl.exe
  2⤵
  PID:4680
- C:\Windows\System\TfyFnWB.exe
  C:\Windows\System\TfyFnWB.exe
  2⤵
  PID:4696
- C:\Windows\System\lGBLDnq.exe
  C:\Windows\System\lGBLDnq.exe
  2⤵
  PID:4712
- C:\Windows\System\pHstUCl.exe
  C:\Windows\System\pHstUCl.exe
  2⤵
  PID:4728
- C:\Windows\System\FPdiPvT.exe
  C:\Windows\System\FPdiPvT.exe
  2⤵
  PID:4744
- C:\Windows\System\ZXmktnc.exe
  C:\Windows\System\ZXmktnc.exe
  2⤵
  PID:4760
- C:\Windows\System\SzilbiQ.exe
  C:\Windows\System\SzilbiQ.exe
  2⤵
  PID:4776
- C:\Windows\System\WgFPDPB.exe
  C:\Windows\System\WgFPDPB.exe
  2⤵
  PID:4792
- C:\Windows\System\zoGRwDd.exe
  C:\Windows\System\zoGRwDd.exe
  2⤵
  PID:4808
- C:\Windows\System\QUXlwFJ.exe
  C:\Windows\System\QUXlwFJ.exe
  2⤵
  PID:4824
- C:\Windows\System\jtVlbjl.exe
  C:\Windows\System\jtVlbjl.exe
  2⤵
  PID:4840
- C:\Windows\System\niKElZa.exe
  C:\Windows\System\niKElZa.exe
  2⤵
  PID:4856
- C:\Windows\System\dwvihrB.exe
  C:\Windows\System\dwvihrB.exe
  2⤵
  PID:4900
- C:\Windows\System\SiLHLka.exe
  C:\Windows\System\SiLHLka.exe
  2⤵
  PID:5016
- C:\Windows\System\tBfImHU.exe
  C:\Windows\System\tBfImHU.exe
  2⤵
  PID:5040
- C:\Windows\System\YpKCtLS.exe
  C:\Windows\System\YpKCtLS.exe
  2⤵
  PID:5064
- C:\Windows\System\HIyRTjF.exe
  C:\Windows\System\HIyRTjF.exe
  2⤵
  PID:5080
- C:\Windows\System\yZZvVuw.exe
  C:\Windows\System\yZZvVuw.exe
  2⤵
  PID:3504
- C:\Windows\System\xsfcOwA.exe
  C:\Windows\System\xsfcOwA.exe
  2⤵
  PID:1328
- C:\Windows\System\RygwXBP.exe
  C:\Windows\System\RygwXBP.exe
  2⤵
  PID:3644
- C:\Windows\System\RlJEcKn.exe
  C:\Windows\System\RlJEcKn.exe
  2⤵
  PID:4132
- C:\Windows\System\acJmErr.exe
  C:\Windows\System\acJmErr.exe
  2⤵
  PID:3148
- C:\Windows\System\bwxPaBo.exe
  C:\Windows\System\bwxPaBo.exe
  2⤵
  PID:2520
- C:\Windows\System\GUFbhLH.exe
  C:\Windows\System\GUFbhLH.exe
  2⤵
  PID:3612
- C:\Windows\System\yxEuHVb.exe
  C:\Windows\System\yxEuHVb.exe
  2⤵
  PID:4156
- C:\Windows\System\AHwCWzO.exe
  C:\Windows\System\AHwCWzO.exe
  2⤵
  PID:4264
- C:\Windows\System\zkSYxYv.exe
  C:\Windows\System\zkSYxYv.exe
  2⤵
  PID:1108
- C:\Windows\System\zxCKNBr.exe
  C:\Windows\System\zxCKNBr.exe
  2⤵
  PID:3780
- C:\Windows\System\NtMWuzo.exe
  C:\Windows\System\NtMWuzo.exe
  2⤵
  PID:3416
- C:\Windows\System\dJDWhwR.exe
  C:\Windows\System\dJDWhwR.exe
  2⤵
  PID:3848
- C:\Windows\System\qdEIzHK.exe
  C:\Windows\System\qdEIzHK.exe
  2⤵
  PID:4500
- C:\Windows\System\oQMbYcB.exe
  C:\Windows\System\oQMbYcB.exe
  2⤵
  PID:4532
- C:\Windows\System\QuFCEnu.exe
  C:\Windows\System\QuFCEnu.exe
  2⤵
  PID:4260
- C:\Windows\System\MtfqExB.exe
  C:\Windows\System\MtfqExB.exe
  2⤵
  PID:4672
- C:\Windows\System\OjoDetK.exe
  C:\Windows\System\OjoDetK.exe
  2⤵
  PID:4380
- C:\Windows\System\sFsvIRi.exe
  C:\Windows\System\sFsvIRi.exe
  2⤵
  PID:4408
- C:\Windows\System\WTSdYij.exe
  C:\Windows\System\WTSdYij.exe
  2⤵
  PID:4480
- C:\Windows\System\rSkouam.exe
  C:\Windows\System\rSkouam.exe
  2⤵
  PID:4544
- C:\Windows\System\sQVXHuy.exe
  C:\Windows\System\sQVXHuy.exe
  2⤵
  PID:4736
- C:\Windows\System\KegYgkq.exe
  C:\Windows\System\KegYgkq.exe
  2⤵
  PID:4804
- C:\Windows\System\tBLodVK.exe
  C:\Windows\System\tBLodVK.exe
  2⤵
  PID:4868
- C:\Windows\System\rMFUAsa.exe
  C:\Windows\System\rMFUAsa.exe
  2⤵
  PID:4656
- C:\Windows\System\fSqsLDl.exe
  C:\Windows\System\fSqsLDl.exe
  2⤵
  PID:4628
- C:\Windows\System\sMGNqLR.exe
  C:\Windows\System\sMGNqLR.exe
  2⤵
  PID:4788
- C:\Windows\System\JbzKZKs.exe
  C:\Windows\System\JbzKZKs.exe
  2⤵
  PID:4852
- C:\Windows\System\fkRteVn.exe
  C:\Windows\System\fkRteVn.exe
  2⤵
  PID:4752
- C:\Windows\System\DBMfHCF.exe
  C:\Windows\System\DBMfHCF.exe
  2⤵
  PID:4892
- C:\Windows\System\fEFkEiD.exe
  C:\Windows\System\fEFkEiD.exe
  2⤵
  PID:4908
- C:\Windows\System\rUKKXQS.exe
  C:\Windows\System\rUKKXQS.exe
  2⤵
  PID:2980
- C:\Windows\System\pHCwsEg.exe
  C:\Windows\System\pHCwsEg.exe
  2⤵
  PID:1740
- C:\Windows\System\LPDVzyD.exe
  C:\Windows\System\LPDVzyD.exe
  2⤵
  PID:4932
- C:\Windows\System\pZYqQjF.exe
  C:\Windows\System\pZYqQjF.exe
  2⤵
  PID:4924
- C:\Windows\System\wgVjnHz.exe
  C:\Windows\System\wgVjnHz.exe
  2⤵
  PID:4980
- C:\Windows\System\BHgAqgH.exe
  C:\Windows\System\BHgAqgH.exe
  2⤵
  PID:4960
- C:\Windows\System\fhLphvL.exe
  C:\Windows\System\fhLphvL.exe
  2⤵
  PID:4972
- C:\Windows\System\HjPGnPY.exe
  C:\Windows\System\HjPGnPY.exe
  2⤵
  PID:5004
- C:\Windows\System\xjsIPhc.exe
  C:\Windows\System\xjsIPhc.exe
  2⤵
  PID:5024
- C:\Windows\System\VIEGKRf.exe
  C:\Windows\System\VIEGKRf.exe
  2⤵
  PID:5048
- C:\Windows\System\foGBIRQ.exe
  C:\Windows\System\foGBIRQ.exe
  2⤵
  PID:5088
- C:\Windows\System\TczSzGM.exe
  C:\Windows\System\TczSzGM.exe
  2⤵
  PID:5100
- C:\Windows\System\ZTPZljN.exe
  C:\Windows\System\ZTPZljN.exe
  2⤵
  PID:276
- C:\Windows\System\cJnpFSV.exe
  C:\Windows\System\cJnpFSV.exe
  2⤵
  PID:1776
- C:\Windows\System\nIhqPEB.exe
  C:\Windows\System\nIhqPEB.exe
  2⤵
  PID:1188
- C:\Windows\System\KZdQDou.exe
  C:\Windows\System\KZdQDou.exe
  2⤵
  PID:2020
- C:\Windows\System\HJSXLon.exe
  C:\Windows\System\HJSXLon.exe
  2⤵
  PID:3368
- C:\Windows\System\rshxCuT.exe
  C:\Windows\System\rshxCuT.exe
  2⤵
  PID:2964
- C:\Windows\System\LTCdkwb.exe
  C:\Windows\System\LTCdkwb.exe
  2⤵
  PID:4104
- C:\Windows\System\DssvBKQ.exe
  C:\Windows\System\DssvBKQ.exe
  2⤵
  PID:4284
- C:\Windows\System\yFkrzzK.exe
  C:\Windows\System\yFkrzzK.exe
  2⤵
  PID:4216
- C:\Windows\System\AygNmqA.exe
  C:\Windows\System\AygNmqA.exe
  2⤵
  PID:3600
- C:\Windows\System\XHoDpEQ.exe
  C:\Windows\System\XHoDpEQ.exe
  2⤵
  PID:3568
- C:\Windows\System\XLnbKFF.exe
  C:\Windows\System\XLnbKFF.exe
  2⤵
  PID:2600
- C:\Windows\System\eyVFbvS.exe
  C:\Windows\System\eyVFbvS.exe
  2⤵
  PID:1780
- C:\Windows\System\mSxuCuD.exe
  C:\Windows\System\mSxuCuD.exe
  2⤵
  PID:3024
- C:\Windows\System\YSKwvOs.exe
  C:\Windows\System\YSKwvOs.exe
  2⤵
  PID:1044
- C:\Windows\System\tmYTFmb.exe
  C:\Windows\System\tmYTFmb.exe
  2⤵
  PID:3680
- C:\Windows\System\fKCnSXy.exe
  C:\Windows\System\fKCnSXy.exe
  2⤵
  PID:4168
- C:\Windows\System\dhLSZNm.exe
  C:\Windows\System\dhLSZNm.exe
  2⤵
  PID:4460
- C:\Windows\System\BrmVKhy.exe
  C:\Windows\System\BrmVKhy.exe
  2⤵
  PID:2984
- C:\Windows\System\heHLGKu.exe
  C:\Windows\System\heHLGKu.exe
  2⤵
  PID:4676
- C:\Windows\System\dARzAjy.exe
  C:\Windows\System\dARzAjy.exe
  2⤵
  PID:4836
- C:\Windows\System\NbuaKWq.exe
  C:\Windows\System\NbuaKWq.exe
  2⤵
  PID:4512
- C:\Windows\System\dbECAkx.exe
  C:\Windows\System\dbECAkx.exe
  2⤵
  PID:4596
- C:\Windows\System\LniMumK.exe
  C:\Windows\System\LniMumK.exe
  2⤵
  PID:4364
- C:\Windows\System\IafKMro.exe
  C:\Windows\System\IafKMro.exe
  2⤵
  PID:4724
- C:\Windows\System\qwaKAQl.exe
  C:\Windows\System\qwaKAQl.exe
  2⤵
  PID:4912
- C:\Windows\System\gSAgiCf.exe
  C:\Windows\System\gSAgiCf.exe
  2⤵
  PID:4940
- C:\Windows\System\zXCoSeI.exe
  C:\Windows\System\zXCoSeI.exe
  2⤵
  PID:4984
- C:\Windows\System\wHPSnPC.exe
  C:\Windows\System\wHPSnPC.exe
  2⤵
  PID:1028
- C:\Windows\System\rZczuHx.exe
  C:\Windows\System\rZczuHx.exe
  2⤵
  PID:4956
- C:\Windows\System\CMkQazB.exe
  C:\Windows\System\CMkQazB.exe
  2⤵
  PID:4992
- C:\Windows\System\IlwqqPr.exe
  C:\Windows\System\IlwqqPr.exe
  2⤵
  PID:4996
- C:\Windows\System\UrlHOeu.exe
  C:\Windows\System\UrlHOeu.exe
  2⤵
  PID:5076
- C:\Windows\System\eGbEboA.exe
  C:\Windows\System\eGbEboA.exe
  2⤵
  PID:1128
- C:\Windows\System\umZBOtN.exe
  C:\Windows\System\umZBOtN.exe
  2⤵
  PID:4184
- C:\Windows\System\nfSkzeV.exe
  C:\Windows\System\nfSkzeV.exe
  2⤵
  PID:1800
- C:\Windows\System\WgOPcFJ.exe
  C:\Windows\System\WgOPcFJ.exe
  2⤵
  PID:4640
- C:\Windows\System\AwMbBxl.exe
  C:\Windows\System\AwMbBxl.exe
  2⤵
  PID:4332
- C:\Windows\System\NfTaGhH.exe
  C:\Windows\System\NfTaGhH.exe
  2⤵
  PID:4344
- C:\Windows\System\IAazkdL.exe
  C:\Windows\System\IAazkdL.exe
  2⤵
  PID:4028
- C:\Windows\System\MfuTKyY.exe
  C:\Windows\System\MfuTKyY.exe
  2⤵
  PID:3572
- C:\Windows\System\lumdQXT.exe
  C:\Windows\System\lumdQXT.exe
  2⤵
  PID:3384
- C:\Windows\System\mDTprMw.exe
  C:\Windows\System\mDTprMw.exe
  2⤵
  PID:3292
- C:\Windows\System\hpNgGMO.exe
  C:\Windows\System\hpNgGMO.exe
  2⤵
  PID:2468
- C:\Windows\System\CvEujZm.exe
  C:\Windows\System\CvEujZm.exe
  2⤵
  PID:1784
- C:\Windows\System\FWWMdPV.exe
  C:\Windows\System\FWWMdPV.exe
  2⤵
  PID:2492
- C:\Windows\System\idHbHYp.exe
  C:\Windows\System\idHbHYp.exe
  2⤵
  PID:4200
- C:\Windows\System\aNnjziX.exe
  C:\Windows\System\aNnjziX.exe
  2⤵
  PID:1648
- C:\Windows\System\eSYCBIh.exe
  C:\Windows\System\eSYCBIh.exe
  2⤵
  PID:4348
- C:\Windows\System\hajpqjq.exe
  C:\Windows\System\hajpqjq.exe
  2⤵
  PID:4624
- C:\Windows\System\WLFPypv.exe
  C:\Windows\System\WLFPypv.exe
  2⤵
  PID:5036
- C:\Windows\System\bnLKTUR.exe
  C:\Windows\System\bnLKTUR.exe
  2⤵
  PID:4800
- C:\Windows\System\QeIgItg.exe
  C:\Windows\System\QeIgItg.exe
  2⤵
  PID:2628
- C:\Windows\System\AjQtXnd.exe
  C:\Windows\System\AjQtXnd.exe
  2⤵
  PID:5096
- C:\Windows\System\AyCAnqa.exe
  C:\Windows\System\AyCAnqa.exe
  2⤵
  PID:4952
- C:\Windows\System\QtNwaUn.exe
  C:\Windows\System\QtNwaUn.exe
  2⤵
  PID:2932
- C:\Windows\System\HAoeZjS.exe
  C:\Windows\System\HAoeZjS.exe
  2⤵
  PID:3828
- C:\Windows\System\MQBMnHu.exe
  C:\Windows\System\MQBMnHu.exe
  2⤵
  PID:1656
- C:\Windows\System\gTfDCUY.exe
  C:\Windows\System\gTfDCUY.exe
  2⤵
  PID:4100
- C:\Windows\System\jaqWQzp.exe
  C:\Windows\System\jaqWQzp.exe
  2⤵
  PID:4756
- C:\Windows\System\fMpKqoi.exe
  C:\Windows\System\fMpKqoi.exe
  2⤵
  PID:1344
- C:\Windows\System\byIqWqW.exe
  C:\Windows\System\byIqWqW.exe
  2⤵
  PID:4396
- C:\Windows\System\VqogavD.exe
  C:\Windows\System\VqogavD.exe
  2⤵
  PID:4116
- C:\Windows\System\rAVRGih.exe
  C:\Windows\System\rAVRGih.exe
  2⤵
  PID:3276
- C:\Windows\System\KNABEYK.exe
  C:\Windows\System\KNABEYK.exe
  2⤵
  PID:3476
- C:\Windows\System\PWhhijS.exe
  C:\Windows\System\PWhhijS.exe
  2⤵
  PID:3716
- C:\Windows\System\eBZWJfY.exe
  C:\Windows\System\eBZWJfY.exe
  2⤵
  PID:4496
- C:\Windows\System\TXsqUtI.exe
  C:\Windows\System\TXsqUtI.exe
  2⤵
  PID:2488
- C:\Windows\System\BYswTbX.exe
  C:\Windows\System\BYswTbX.exe
  2⤵
  PID:1336
- C:\Windows\System\vRbjMiq.exe
  C:\Windows\System\vRbjMiq.exe
  2⤵
  PID:1636
- C:\Windows\System\MSXfDpT.exe
  C:\Windows\System\MSXfDpT.exe
  2⤵
  PID:3536
- C:\Windows\System\FGwZDqg.exe
  C:\Windows\System\FGwZDqg.exe
  2⤵
  PID:4312
- C:\Windows\System\tTFubyR.exe
  C:\Windows\System\tTFubyR.exe
  2⤵
  PID:5132
- C:\Windows\System\STyikBH.exe
  C:\Windows\System\STyikBH.exe
  2⤵
  PID:5148
- C:\Windows\System\CNHqeKT.exe
  C:\Windows\System\CNHqeKT.exe
  2⤵
  PID:5168
- C:\Windows\System\FwXhzPB.exe
  C:\Windows\System\FwXhzPB.exe
  2⤵
  PID:5188
- C:\Windows\System\dIglQjB.exe
  C:\Windows\System\dIglQjB.exe
  2⤵
  PID:5208
- C:\Windows\System\yVFljGK.exe
  C:\Windows\System\yVFljGK.exe
  2⤵
  PID:5224
- C:\Windows\System\fCjentN.exe
  C:\Windows\System\fCjentN.exe
  2⤵
  PID:5240
- C:\Windows\System\jwlBfMT.exe
  C:\Windows\System\jwlBfMT.exe
  2⤵
  PID:5256
- C:\Windows\System\CWfSRRe.exe
  C:\Windows\System\CWfSRRe.exe
  2⤵
  PID:5272
- C:\Windows\System\YGXDPLo.exe
  C:\Windows\System\YGXDPLo.exe
  2⤵
  PID:5288
- C:\Windows\System\GhXMFpp.exe
  C:\Windows\System\GhXMFpp.exe
  2⤵
  PID:5304
- C:\Windows\System\icSenjm.exe
  C:\Windows\System\icSenjm.exe
  2⤵
  PID:5324
- C:\Windows\System\afrNFvh.exe
  C:\Windows\System\afrNFvh.exe
  2⤵
  PID:5340
- C:\Windows\System\UzVEuUl.exe
  C:\Windows\System\UzVEuUl.exe
  2⤵
  PID:5356
- C:\Windows\System\HdiEDhX.exe
  C:\Windows\System\HdiEDhX.exe
  2⤵
  PID:5372
- C:\Windows\System\YqoBvjr.exe
  C:\Windows\System\YqoBvjr.exe
  2⤵
  PID:5388
- C:\Windows\System\vpgGAzV.exe
  C:\Windows\System\vpgGAzV.exe
  2⤵
  PID:5404
- C:\Windows\System\JWXueRZ.exe
  C:\Windows\System\JWXueRZ.exe
  2⤵
  PID:5420
- C:\Windows\System\iaZDZin.exe
  C:\Windows\System\iaZDZin.exe
  2⤵
  PID:5440
- C:\Windows\System\xiVTbvx.exe
  C:\Windows\System\xiVTbvx.exe
  2⤵
  PID:5456
- C:\Windows\System\wLqZQPQ.exe
  C:\Windows\System\wLqZQPQ.exe
  2⤵
  PID:5472
- C:\Windows\System\QDTuiqU.exe
  C:\Windows\System\QDTuiqU.exe
  2⤵
  PID:5488
- C:\Windows\System\czyHobq.exe
  C:\Windows\System\czyHobq.exe
  2⤵
  PID:5504
- C:\Windows\System\YLWNlku.exe
  C:\Windows\System\YLWNlku.exe
  2⤵
  PID:5520
- C:\Windows\System\LGAegEr.exe
  C:\Windows\System\LGAegEr.exe
  2⤵
  PID:5536
- C:\Windows\System\nGEayyo.exe
  C:\Windows\System\nGEayyo.exe
  2⤵
  PID:5552
- C:\Windows\System\PcFgMhU.exe
  C:\Windows\System\PcFgMhU.exe
  2⤵
  PID:5596
- C:\Windows\System\gnCGRap.exe
  C:\Windows\System\gnCGRap.exe
  2⤵
  PID:5652
- C:\Windows\System\URkDdvu.exe
  C:\Windows\System\URkDdvu.exe
  2⤵
  PID:5744
- C:\Windows\System\hbKedEO.exe
  C:\Windows\System\hbKedEO.exe
  2⤵
  PID:5856
- C:\Windows\System\bauWEPZ.exe
  C:\Windows\System\bauWEPZ.exe
  2⤵
  PID:5872
- C:\Windows\System\GqlzVNH.exe
  C:\Windows\System\GqlzVNH.exe
  2⤵
  PID:5888
- C:\Windows\System\fwIOgIZ.exe
  C:\Windows\System\fwIOgIZ.exe
  2⤵
  PID:5904
- C:\Windows\System\bMUVTsL.exe
  C:\Windows\System\bMUVTsL.exe
  2⤵
  PID:5944
- C:\Windows\System\hbkZyNx.exe
  C:\Windows\System\hbkZyNx.exe
  2⤵
  PID:5960
- C:\Windows\System\eCshgHa.exe
  C:\Windows\System\eCshgHa.exe
  2⤵
  PID:5976
- C:\Windows\System\KUJMKig.exe
  C:\Windows\System\KUJMKig.exe
  2⤵
  PID:5992
- C:\Windows\System\nKFBiLD.exe
  C:\Windows\System\nKFBiLD.exe
  2⤵
  PID:6008
- C:\Windows\System\BxstMer.exe
  C:\Windows\System\BxstMer.exe
  2⤵
  PID:6024
- C:\Windows\System\bldZxqn.exe
  C:\Windows\System\bldZxqn.exe
  2⤵
  PID:6060
- C:\Windows\System\MKwTRXZ.exe
  C:\Windows\System\MKwTRXZ.exe
  2⤵
  PID:6080
- C:\Windows\System\RnatIGD.exe
  C:\Windows\System\RnatIGD.exe
  2⤵
  PID:6096
- C:\Windows\System\VtxsNHe.exe
  C:\Windows\System\VtxsNHe.exe
  2⤵
  PID:6112
- C:\Windows\System\SArSNJr.exe
  C:\Windows\System\SArSNJr.exe
  2⤵
  PID:6128
- C:\Windows\System\BqnSXUh.exe
  C:\Windows\System\BqnSXUh.exe
  2⤵
  PID:4160
- C:\Windows\System\JRkDUEB.exe
  C:\Windows\System\JRkDUEB.exe
  2⤵
  PID:2828
- C:\Windows\System\YkWERDH.exe
  C:\Windows\System\YkWERDH.exe
  2⤵
  PID:4948
- C:\Windows\System\DcVexNv.exe
  C:\Windows\System\DcVexNv.exe
  2⤵
  PID:3112
- C:\Windows\System\QZGjSOp.exe
  C:\Windows\System\QZGjSOp.exe
  2⤵
  PID:3928
- C:\Windows\System\XgaUJvH.exe
  C:\Windows\System\XgaUJvH.exe
  2⤵
  PID:2928
- C:\Windows\System\npFjzfi.exe
  C:\Windows\System\npFjzfi.exe
  2⤵
  PID:5140
- C:\Windows\System\TRELUJC.exe
  C:\Windows\System\TRELUJC.exe
  2⤵
  PID:1440
- C:\Windows\System\ZPyjZkn.exe
  C:\Windows\System\ZPyjZkn.exe
  2⤵
  PID:4576
- C:\Windows\System\GcBQqHV.exe
  C:\Windows\System\GcBQqHV.exe
  2⤵
  PID:4964
- C:\Windows\System\DGKvMtt.exe
  C:\Windows\System\DGKvMtt.exe
  2⤵
  PID:5012
- C:\Windows\System\jMUkBeF.exe
  C:\Windows\System\jMUkBeF.exe
  2⤵
  PID:1428
- C:\Windows\System\gsKDGLI.exe
  C:\Windows\System\gsKDGLI.exe
  2⤵
  PID:1804
- C:\Windows\System\imLAbky.exe
  C:\Windows\System\imLAbky.exe
  2⤵
  PID:2244
- C:\Windows\System\qqcAukP.exe
  C:\Windows\System\qqcAukP.exe
  2⤵
  PID:5156
- C:\Windows\System\opFtHFa.exe
  C:\Windows\System\opFtHFa.exe
  2⤵
  PID:5200
- C:\Windows\System\CumhlQR.exe
  C:\Windows\System\CumhlQR.exe
  2⤵
  PID:5396
- C:\Windows\System\hSmHOMw.exe
  C:\Windows\System\hSmHOMw.exe
  2⤵
  PID:5464
- C:\Windows\System\vElgzvB.exe
  C:\Windows\System\vElgzvB.exe
  2⤵
  PID:5528
- C:\Windows\System\RscnaGz.exe
  C:\Windows\System\RscnaGz.exe
  2⤵
  PID:5236
- C:\Windows\System\cikKpTs.exe
  C:\Windows\System\cikKpTs.exe
  2⤵
  PID:5576
- C:\Windows\System\fSUiAtH.exe
  C:\Windows\System\fSUiAtH.exe
  2⤵
  PID:5204
- C:\Windows\System\CbVvnCb.exe
  C:\Windows\System\CbVvnCb.exe
  2⤵
  PID:5480
- C:\Windows\System\EYZtYni.exe
  C:\Windows\System\EYZtYni.exe
  2⤵
  PID:3996
- C:\Windows\System\bAXABcy.exe
  C:\Windows\System\bAXABcy.exe
  2⤵
  PID:5268
- C:\Windows\System\vIDNnIU.exe
  C:\Windows\System\vIDNnIU.exe
  2⤵
  PID:5412
- C:\Windows\System\RMkkVGI.exe
  C:\Windows\System\RMkkVGI.exe
  2⤵
  PID:5220
- C:\Windows\System\bhajFac.exe
  C:\Windows\System\bhajFac.exe
  2⤵
  PID:5348
- C:\Windows\System\DKiicyS.exe
  C:\Windows\System\DKiicyS.exe
  2⤵
  PID:5544
- C:\Windows\System\LSbdPew.exe
  C:\Windows\System\LSbdPew.exe
  2⤵
  PID:5320
- C:\Windows\System\sAKcnIr.exe
  C:\Windows\System\sAKcnIr.exe
  2⤵
  PID:5608
- C:\Windows\System\hvOaiTW.exe
  C:\Windows\System\hvOaiTW.exe
  2⤵
  PID:5644
- C:\Windows\System\eRyTUoX.exe
  C:\Windows\System\eRyTUoX.exe
  2⤵
  PID:5624
- C:\Windows\System\hyGDJkz.exe
  C:\Windows\System\hyGDJkz.exe
  2⤵
  PID:5688
- C:\Windows\System\pqLZfan.exe
  C:\Windows\System\pqLZfan.exe
  2⤵
  PID:5704
- C:\Windows\System\YoacEcO.exe
  C:\Windows\System\YoacEcO.exe
  2⤵
  PID:5720
- C:\Windows\System\kkeomRm.exe
  C:\Windows\System\kkeomRm.exe
  2⤵
  PID:5736
- C:\Windows\System\GIgtVPf.exe
  C:\Windows\System\GIgtVPf.exe
  2⤵
  PID:5756
- C:\Windows\System\BWwbsZi.exe
  C:\Windows\System\BWwbsZi.exe
  2⤵
  PID:5800
- C:\Windows\System\heBPOHX.exe
  C:\Windows\System\heBPOHX.exe
  2⤵
  PID:5836
- C:\Windows\System\gxKshHX.exe
  C:\Windows\System\gxKshHX.exe
  2⤵
  PID:5764
- C:\Windows\System\VVnbFQw.exe
  C:\Windows\System\VVnbFQw.exe
  2⤵
  PID:5796
- C:\Windows\System\dlwGHrQ.exe
  C:\Windows\System\dlwGHrQ.exe
  2⤵
  PID:5828
- C:\Windows\System\PHtQFzb.exe
  C:\Windows\System\PHtQFzb.exe
  2⤵
  PID:5848
- C:\Windows\System\AtWPiVc.exe
  C:\Windows\System\AtWPiVc.exe
  2⤵
  PID:5880
- C:\Windows\System\LpQHOEv.exe
  C:\Windows\System\LpQHOEv.exe
  2⤵
  PID:5956
- C:\Windows\System\ShCBxAc.exe
  C:\Windows\System\ShCBxAc.exe
  2⤵
  PID:5916
- C:\Windows\System\WsIaGRh.exe
  C:\Windows\System\WsIaGRh.exe
  2⤵
  PID:5972
- C:\Windows\System\UYpwTid.exe
  C:\Windows\System\UYpwTid.exe
  2⤵
  PID:6016
- C:\Windows\System\jHLacdu.exe
  C:\Windows\System\jHLacdu.exe
  2⤵
  PID:6052
- C:\Windows\System\hHuFmJW.exe
  C:\Windows\System\hHuFmJW.exe
  2⤵
  PID:6056
- C:\Windows\System\EzXKTaB.exe
  C:\Windows\System\EzXKTaB.exe
  2⤵
  PID:6088
- C:\Windows\System\HZoEMAO.exe
  C:\Windows\System\HZoEMAO.exe
  2⤵
  PID:6092
- C:\Windows\System\HxCJfPI.exe
  C:\Windows\System\HxCJfPI.exe
  2⤵
  PID:6124
- C:\Windows\System\ZPKnoAT.exe
  C:\Windows\System\ZPKnoAT.exe
  2⤵
  PID:2728
- C:\Windows\System\MDSDEsn.exe
  C:\Windows\System\MDSDEsn.exe
  2⤵
  PID:4704
- C:\Windows\System\eLjhqvA.exe
  C:\Windows\System\eLjhqvA.exe
  2⤵
  PID:4592
- C:\Windows\System\zZWgKTt.exe
  C:\Windows\System\zZWgKTt.exe
  2⤵
  PID:568
- C:\Windows\System\bRdPaEH.exe
  C:\Windows\System\bRdPaEH.exe
  2⤵
  PID:5428
- C:\Windows\System\njiTsHt.exe
  C:\Windows\System\njiTsHt.exe
  2⤵
  PID:5588
- C:\Windows\System\bCDSXmF.exe
  C:\Windows\System\bCDSXmF.exe
  2⤵
  PID:5332
- C:\Windows\System\JnsQmFm.exe
  C:\Windows\System\JnsQmFm.exe
  2⤵
  PID:5280
- C:\Windows\System\iAHEesg.exe
  C:\Windows\System\iAHEesg.exe
  2⤵
  PID:5712
- C:\Windows\System\FFUvexJ.exe
  C:\Windows\System\FFUvexJ.exe
  2⤵
  PID:5752
- C:\Windows\System\wtJHebw.exe
  C:\Windows\System\wtJHebw.exe
  2⤵
  PID:5840
- C:\Windows\System\iDGTZwu.exe
  C:\Windows\System\iDGTZwu.exe
  2⤵
  PID:4784
- C:\Windows\System\cElvfoT.exe
  C:\Windows\System\cElvfoT.exe
  2⤵
  PID:2000
- C:\Windows\System\oBBrVkZ.exe
  C:\Windows\System\oBBrVkZ.exe
  2⤵
  PID:5056
- C:\Windows\System\pKtWSjk.exe
  C:\Windows\System\pKtWSjk.exe
  2⤵
  PID:5128
- C:\Windows\System\cGXfJXa.exe
  C:\Windows\System\cGXfJXa.exe
  2⤵
  PID:5584
- C:\Windows\System\bHdQTZI.exe
  C:\Windows\System\bHdQTZI.exe
  2⤵
  PID:5144
- C:\Windows\System\OesCXiT.exe
  C:\Windows\System\OesCXiT.exe
  2⤵
  PID:5364
- C:\Windows\System\bVgAdAJ.exe
  C:\Windows\System\bVgAdAJ.exe
  2⤵
  PID:5604
- C:\Windows\System\xbxHUGp.exe
  C:\Windows\System\xbxHUGp.exe
  2⤵
  PID:5728
- C:\Windows\System\MZAWonk.exe
  C:\Windows\System\MZAWonk.exe
  2⤵
  PID:5788
- C:\Windows\System\emiXmLL.exe
  C:\Windows\System\emiXmLL.exe
  2⤵
  PID:5912
- C:\Windows\System\nETevBN.exe
  C:\Windows\System\nETevBN.exe
  2⤵
  PID:5940
- C:\Windows\System\vQGkGXM.exe
  C:\Windows\System\vQGkGXM.exe
  2⤵
  PID:6040
- C:\Windows\System\flcQLQf.exe
  C:\Windows\System\flcQLQf.exe
  2⤵
  PID:6072
- C:\Windows\System\WQQxKnI.exe
  C:\Windows\System\WQQxKnI.exe
  2⤵
  PID:4768
- C:\Windows\System\iDnJEJx.exe
  C:\Windows\System\iDnJEJx.exe
  2⤵
  PID:6032
- C:\Windows\System\jJUUvEn.exe
  C:\Windows\System\jJUUvEn.exe
  2⤵
  PID:4196
- C:\Windows\System\aFudEKp.exe
  C:\Windows\System\aFudEKp.exe
  2⤵
  PID:6136
- C:\Windows\System\EcFRLDg.exe
  C:\Windows\System\EcFRLDg.exe
  2⤵
  PID:5336
- C:\Windows\System\hFRoXDE.exe
  C:\Windows\System\hFRoXDE.exe
  2⤵
  PID:5664
- C:\Windows\System\DQKihBi.exe
  C:\Windows\System\DQKihBi.exe
  2⤵
  PID:5812
- C:\Windows\System\rxMiPAH.exe
  C:\Windows\System\rxMiPAH.exe
  2⤵
  PID:4688
- C:\Windows\System\cOOfQKW.exe
  C:\Windows\System\cOOfQKW.exe
  2⤵
  PID:5896
- C:\Windows\System\ADDzERF.exe
  C:\Windows\System\ADDzERF.exe
  2⤵
  PID:304
- C:\Windows\System\pdLyCke.exe
  C:\Windows\System\pdLyCke.exe
  2⤵
  PID:5572
- C:\Windows\System\zcuBUKx.exe
  C:\Windows\System\zcuBUKx.exe
  2⤵
  PID:2268
- C:\Windows\System\TFINppn.exe
  C:\Windows\System\TFINppn.exe
  2⤵
  PID:5924
- C:\Windows\System\EvrEKyb.exe
  C:\Windows\System\EvrEKyb.exe
  2⤵
  PID:5164
- C:\Windows\System\slcCQmK.exe
  C:\Windows\System\slcCQmK.exe
  2⤵
  PID:5640
- C:\Windows\System\LnjaguS.exe
  C:\Windows\System\LnjaguS.exe
  2⤵
  PID:5452
- C:\Windows\System\paNshqC.exe
  C:\Windows\System\paNshqC.exe
  2⤵
  PID:5824
- C:\Windows\System\xhdYItL.exe
  C:\Windows\System\xhdYItL.exe
  2⤵
  PID:5932
- C:\Windows\System\THZsYYy.exe
  C:\Windows\System\THZsYYy.exe
  2⤵
  PID:1660
- C:\Windows\System\lptBZvm.exe
  C:\Windows\System\lptBZvm.exe
  2⤵
  PID:5300
- C:\Windows\System\jFRjjnM.exe
  C:\Windows\System\jFRjjnM.exe
  2⤵
  PID:5124
- C:\Windows\System\mrbbECg.exe
  C:\Windows\System\mrbbECg.exe
  2⤵
  PID:4428
- C:\Windows\System\PbuMZiT.exe
  C:\Windows\System\PbuMZiT.exe
  2⤵
  PID:5792
- C:\Windows\System\dflZJmi.exe
  C:\Windows\System\dflZJmi.exe
  2⤵
  PID:5516
- C:\Windows\System\eLYVdNY.exe
  C:\Windows\System\eLYVdNY.exe
  2⤵
  PID:6152
- C:\Windows\System\Kbhzcjh.exe
  C:\Windows\System\Kbhzcjh.exe
  2⤵
  PID:6172
- C:\Windows\System\PlORPoH.exe
  C:\Windows\System\PlORPoH.exe
  2⤵
  PID:6188
- C:\Windows\System\WqSAjAF.exe
  C:\Windows\System\WqSAjAF.exe
  2⤵
  PID:6204
- C:\Windows\System\eTAKSSm.exe
  C:\Windows\System\eTAKSSm.exe
  2⤵
  PID:6224
- C:\Windows\System\yNuJDMW.exe
  C:\Windows\System\yNuJDMW.exe
  2⤵
  PID:6240
- C:\Windows\System\OqNNvag.exe
  C:\Windows\System\OqNNvag.exe
  2⤵
  PID:6256
- C:\Windows\System\NACQZdP.exe
  C:\Windows\System\NACQZdP.exe
  2⤵
  PID:6272
- C:\Windows\System\ZBNrnay.exe
  C:\Windows\System\ZBNrnay.exe
  2⤵
  PID:6288
- C:\Windows\System\QKXIWlm.exe
  C:\Windows\System\QKXIWlm.exe
  2⤵
  PID:6308
- C:\Windows\System\qIewaZf.exe
  C:\Windows\System\qIewaZf.exe
  2⤵
  PID:6324
- C:\Windows\System\pHqDicy.exe
  C:\Windows\System\pHqDicy.exe
  2⤵
  PID:6340
- C:\Windows\System\lOlKujF.exe
  C:\Windows\System\lOlKujF.exe
  2⤵
  PID:6360
- C:\Windows\System\RGqufgo.exe
  C:\Windows\System\RGqufgo.exe
  2⤵
  PID:6376
- C:\Windows\System\zEgholA.exe
  C:\Windows\System\zEgholA.exe
  2⤵
  PID:6392
- C:\Windows\System\rEXXSSZ.exe
  C:\Windows\System\rEXXSSZ.exe
  2⤵
  PID:6408
- C:\Windows\System\zBBIsQP.exe
  C:\Windows\System\zBBIsQP.exe
  2⤵
  PID:6424
- C:\Windows\System\IdMmXYC.exe
  C:\Windows\System\IdMmXYC.exe
  2⤵
  PID:6440
- C:\Windows\System\vKeEgls.exe
  C:\Windows\System\vKeEgls.exe
  2⤵
  PID:6460
- C:\Windows\System\MHegSHR.exe
  C:\Windows\System\MHegSHR.exe
  2⤵
  PID:6480
- C:\Windows\System\ucUEkEu.exe
  C:\Windows\System\ucUEkEu.exe
  2⤵
  PID:6504
- C:\Windows\System\bLnrZDe.exe
  C:\Windows\System\bLnrZDe.exe
  2⤵
  PID:6520
- C:\Windows\System\cJTjalw.exe
  C:\Windows\System\cJTjalw.exe
  2⤵
  PID:6536
- C:\Windows\System\cwINfer.exe
  C:\Windows\System\cwINfer.exe
  2⤵
  PID:6556
- C:\Windows\System\RmoSSDE.exe
  C:\Windows\System\RmoSSDE.exe
  2⤵
  PID:6572
- C:\Windows\System\fLMELyo.exe
  C:\Windows\System\fLMELyo.exe
  2⤵
  PID:6588
- C:\Windows\System\VGPBRvD.exe
  C:\Windows\System\VGPBRvD.exe
  2⤵
  PID:6608
- C:\Windows\System\qmdVLWZ.exe
  C:\Windows\System\qmdVLWZ.exe
  2⤵
  PID:6624
- C:\Windows\System\ZBicCaS.exe
  C:\Windows\System\ZBicCaS.exe
  2⤵
  PID:6640
- C:\Windows\System\UUvulYU.exe
  C:\Windows\System\UUvulYU.exe
  2⤵
  PID:6656
- C:\Windows\System\kjwZJQz.exe
  C:\Windows\System\kjwZJQz.exe
  2⤵
  PID:6676
- C:\Windows\System\LqYbWuC.exe
  C:\Windows\System\LqYbWuC.exe
  2⤵
  PID:6692
- C:\Windows\System\pGyvNap.exe
  C:\Windows\System\pGyvNap.exe
  2⤵
  PID:6708
- C:\Windows\System\TiGZDVm.exe
  C:\Windows\System\TiGZDVm.exe
  2⤵
  PID:6724
- C:\Windows\System\OGbEWcA.exe
  C:\Windows\System\OGbEWcA.exe
  2⤵
  PID:6744
- C:\Windows\System\AzmgtWa.exe
  C:\Windows\System\AzmgtWa.exe
  2⤵
  PID:6760
- C:\Windows\System\MSJhXBL.exe
  C:\Windows\System\MSJhXBL.exe
  2⤵
  PID:6776
- C:\Windows\System\EguzQeX.exe
  C:\Windows\System\EguzQeX.exe
  2⤵
  PID:6792
- C:\Windows\System\IwgueyQ.exe
  C:\Windows\System\IwgueyQ.exe
  2⤵
  PID:6812
- C:\Windows\System\NMzNaXa.exe
  C:\Windows\System\NMzNaXa.exe
  2⤵
  PID:6828
- C:\Windows\System\KcWzsDm.exe
  C:\Windows\System\KcWzsDm.exe
  2⤵
  PID:6844
- C:\Windows\System\eSJpnzr.exe
  C:\Windows\System\eSJpnzr.exe
  2⤵
  PID:6860
- C:\Windows\System\XAADOUW.exe
  C:\Windows\System\XAADOUW.exe
  2⤵
  PID:6876
- C:\Windows\System\EwMVqJP.exe
  C:\Windows\System\EwMVqJP.exe
  2⤵
  PID:6892
- C:\Windows\System\nnhtElP.exe
  C:\Windows\System\nnhtElP.exe
  2⤵
  PID:6908
- C:\Windows\System\nBovoin.exe
  C:\Windows\System\nBovoin.exe
  2⤵
  PID:6924
- C:\Windows\System\ytMaifP.exe
  C:\Windows\System\ytMaifP.exe
  2⤵
  PID:6940
- C:\Windows\System\FpCqpWy.exe
  C:\Windows\System\FpCqpWy.exe
  2⤵
  PID:6956
- C:\Windows\System\yosCPDT.exe
  C:\Windows\System\yosCPDT.exe
  2⤵
  PID:6972
- C:\Windows\System\gEXVosb.exe
  C:\Windows\System\gEXVosb.exe
  2⤵
  PID:6992
- C:\Windows\System\VFWeAwB.exe
  C:\Windows\System\VFWeAwB.exe
  2⤵
  PID:7008
- C:\Windows\System\cgrHwoI.exe
  C:\Windows\System\cgrHwoI.exe
  2⤵
  PID:7024
- C:\Windows\System\RLWKCZJ.exe
  C:\Windows\System\RLWKCZJ.exe
  2⤵
  PID:7040
- C:\Windows\System\HEKfDsT.exe
  C:\Windows\System\HEKfDsT.exe
  2⤵
  PID:7056
- C:\Windows\System\EawjjGn.exe
  C:\Windows\System\EawjjGn.exe
  2⤵
  PID:7072
- C:\Windows\System\crWmoCo.exe
  C:\Windows\System\crWmoCo.exe
  2⤵
  PID:7088
- C:\Windows\System\yWaICTC.exe
  C:\Windows\System\yWaICTC.exe
  2⤵
  PID:7104
- C:\Windows\System\LkgVybh.exe
  C:\Windows\System\LkgVybh.exe
  2⤵
  PID:7120
- C:\Windows\System\KUOKVSJ.exe
  C:\Windows\System\KUOKVSJ.exe
  2⤵
  PID:7136
- C:\Windows\System\hDqODij.exe
  C:\Windows\System\hDqODij.exe
  2⤵
  PID:7152
- C:\Windows\System\qVTWXyL.exe
  C:\Windows\System\qVTWXyL.exe
  2⤵
  PID:6148
- C:\Windows\System\xYSoQVh.exe
  C:\Windows\System\xYSoQVh.exe
  2⤵
  PID:5512
- C:\Windows\System\vmbHOVy.exe
  C:\Windows\System\vmbHOVy.exe
  2⤵
  PID:2308
- C:\Windows\System\mMJVyWe.exe
  C:\Windows\System\mMJVyWe.exe
  2⤵
  PID:5900
- C:\Windows\System\PoZEHKm.exe
  C:\Windows\System\PoZEHKm.exe
  2⤵
  PID:6252
- C:\Windows\System\kflScQd.exe
  C:\Windows\System\kflScQd.exe
  2⤵
  PID:6316
- C:\Windows\System\bwztYHv.exe
  C:\Windows\System\bwztYHv.exe
  2⤵
  PID:6004
- C:\Windows\System\plxyIaA.exe
  C:\Windows\System\plxyIaA.exe
  2⤵
  PID:6160
- C:\Windows\System\HdKkUKj.exe
  C:\Windows\System\HdKkUKj.exe
  2⤵
  PID:6296
- C:\Windows\System\JBUVCWM.exe
  C:\Windows\System\JBUVCWM.exe
  2⤵
  PID:6268
- C:\Windows\System\omRRmJr.exe
  C:\Windows\System\omRRmJr.exe
  2⤵
  PID:6384
- C:\Windows\System\WHIEUdj.exe
  C:\Windows\System\WHIEUdj.exe
  2⤵
  PID:6448
- C:\Windows\System\FTTSOmy.exe
  C:\Windows\System\FTTSOmy.exe
  2⤵
  PID:6400
- C:\Windows\System\TnZobBh.exe
  C:\Windows\System\TnZobBh.exe
  2⤵
  PID:6468
- C:\Windows\System\XFbQrkY.exe
  C:\Windows\System\XFbQrkY.exe
  2⤵
  PID:6500
- C:\Windows\System\RypiuXP.exe
  C:\Windows\System\RypiuXP.exe
  2⤵
  PID:6568
- C:\Windows\System\VAYoaNn.exe
  C:\Windows\System\VAYoaNn.exe
  2⤵
  PID:6580
- C:\Windows\System\npnPWaB.exe
  C:\Windows\System\npnPWaB.exe
  2⤵
  PID:6584
- C:\Windows\System\GqbczJa.exe
  C:\Windows\System\GqbczJa.exe
  2⤵
  PID:6632
- C:\Windows\System\iCawiTr.exe
  C:\Windows\System\iCawiTr.exe
  2⤵
  PID:6668
- C:\Windows\System\LbPySrs.exe
  C:\Windows\System\LbPySrs.exe
  2⤵
  PID:6684
- C:\Windows\System\mamyGPX.exe
  C:\Windows\System\mamyGPX.exe
  2⤵
  PID:6704
- C:\Windows\System\FDbvmVC.exe
  C:\Windows\System\FDbvmVC.exe
  2⤵
  PID:6740
- C:\Windows\System\hbAVbHR.exe
  C:\Windows\System\hbAVbHR.exe
  2⤵
  PID:6804
- C:\Windows\System\BLiJCiI.exe
  C:\Windows\System\BLiJCiI.exe
  2⤵
  PID:6840
- C:\Windows\System\YhdlJyf.exe
  C:\Windows\System\YhdlJyf.exe
  2⤵
  PID:6900
- C:\Windows\System\CVhGPFj.exe
  C:\Windows\System\CVhGPFj.exe
  2⤵
  PID:6968
- C:\Windows\System\PsyrTAi.exe
  C:\Windows\System\PsyrTAi.exe
  2⤵
  PID:6752
- C:\Windows\System\LwCGJkW.exe
  C:\Windows\System\LwCGJkW.exe
  2⤵
  PID:6984
- C:\Windows\System\BbzdRSn.exe
  C:\Windows\System\BbzdRSn.exe
  2⤵
  PID:6820
- C:\Windows\System\QNZQEYU.exe
  C:\Windows\System\QNZQEYU.exe
  2⤵
  PID:6756
- C:\Windows\System\HHVnshg.exe
  C:\Windows\System\HHVnshg.exe
  2⤵
  PID:6852
- C:\Windows\System\BEqhVhQ.exe
  C:\Windows\System\BEqhVhQ.exe
  2⤵
  PID:7068
- C:\Windows\System\PyTPPqv.exe
  C:\Windows\System\PyTPPqv.exe
  2⤵
  PID:7084
- C:\Windows\System\cXCAHGn.exe
  C:\Windows\System\cXCAHGn.exe
  2⤵
  PID:7164
- C:\Windows\System\JeMbQxQ.exe
  C:\Windows\System\JeMbQxQ.exe
  2⤵
  PID:6200
- C:\Windows\System\tUGJSQL.exe
  C:\Windows\System\tUGJSQL.exe
  2⤵
  PID:7144
- C:\Windows\System\iBjFtqZ.exe
  C:\Windows\System\iBjFtqZ.exe
  2⤵
  PID:6356
- C:\Windows\System\tLzfrYQ.exe
  C:\Windows\System\tLzfrYQ.exe
  2⤵
  PID:6488
- C:\Windows\System\bThmjmS.exe
  C:\Windows\System\bThmjmS.exe
  2⤵
  PID:6600
- C:\Windows\System\VZgrqrZ.exe
  C:\Windows\System\VZgrqrZ.exe
  2⤵
  PID:6936
- C:\Windows\System\NJLabBk.exe
  C:\Windows\System\NJLabBk.exe
  2⤵
  PID:2724
- C:\Windows\System\TYfRHRS.exe
  C:\Windows\System\TYfRHRS.exe
  2⤵
  PID:6964
- C:\Windows\System\MDkohkm.exe
  C:\Windows\System\MDkohkm.exe
  2⤵
  PID:6888
- C:\Windows\System\rMBHlDF.exe
  C:\Windows\System\rMBHlDF.exe
  2⤵
  PID:7004
- C:\Windows\System\oAfsZdw.exe
  C:\Windows\System\oAfsZdw.exe
  2⤵
  PID:6332
- C:\Windows\System\gjarBRh.exe
  C:\Windows\System\gjarBRh.exe
  2⤵
  PID:6436
- C:\Windows\System\ayexlYQ.exe
  C:\Windows\System\ayexlYQ.exe
  2⤵
  PID:6564
- C:\Windows\System\NsSufsA.exe
  C:\Windows\System\NsSufsA.exe
  2⤵
  PID:6648
- C:\Windows\System\SSmUcfD.exe
  C:\Windows\System\SSmUcfD.exe
  2⤵
  PID:6872
- C:\Windows\System\JsrBxAy.exe
  C:\Windows\System\JsrBxAy.exe
  2⤵
  PID:6020
- C:\Windows\System\scGcDhC.exe
  C:\Windows\System\scGcDhC.exe
  2⤵
  PID:7048
- C:\Windows\System\VCVPBDH.exe
  C:\Windows\System\VCVPBDH.exe
  2⤵
  PID:6164
- C:\Windows\System\XEqMRay.exe
  C:\Windows\System\XEqMRay.exe
  2⤵
  PID:6352
- C:\Windows\System\ZLmPWeI.exe
  C:\Windows\System\ZLmPWeI.exe
  2⤵
  PID:6496
- C:\Windows\System\MWpfZWF.exe
  C:\Windows\System\MWpfZWF.exe
  2⤵
  PID:6304
- C:\Windows\System\XUEXEpU.exe
  C:\Windows\System\XUEXEpU.exe
  2⤵
  PID:6420
- C:\Windows\System\TmoMDBI.exe
  C:\Windows\System\TmoMDBI.exe
  2⤵
  PID:6372
- C:\Windows\System\kWZPemd.exe
  C:\Windows\System\kWZPemd.exe
  2⤵
  PID:6788
- C:\Windows\System\dEvLYxz.exe
  C:\Windows\System\dEvLYxz.exe
  2⤵
  PID:7132
- C:\Windows\System\ICNxvzH.exe
  C:\Windows\System\ICNxvzH.exe
  2⤵
  PID:7080
- C:\Windows\System\gtzFoxl.exe
  C:\Windows\System\gtzFoxl.exe
  2⤵
  PID:6184
- C:\Windows\System\LFaOOKY.exe
  C:\Windows\System\LFaOOKY.exe
  2⤵
  PID:6320
- C:\Windows\System\UAEqbAC.exe
  C:\Windows\System\UAEqbAC.exe
  2⤵
  PID:7036
- C:\Windows\System\DymZsNd.exe
  C:\Windows\System\DymZsNd.exe
  2⤵
  PID:6720
- C:\Windows\System\OgDHELb.exe
  C:\Windows\System\OgDHELb.exe
  2⤵
  PID:6952
- C:\Windows\System\HzUVoxS.exe
  C:\Windows\System\HzUVoxS.exe
  2⤵
  PID:6672
- C:\Windows\System\BKOmFoC.exe
  C:\Windows\System\BKOmFoC.exe
  2⤵
  PID:7064
- C:\Windows\System\qGMCkpk.exe
  C:\Windows\System\qGMCkpk.exe
  2⤵
  PID:6772
- C:\Windows\System\RxZMyqT.exe
  C:\Windows\System\RxZMyqT.exe
  2⤵
  PID:7172
- C:\Windows\System\DROClZr.exe
  C:\Windows\System\DROClZr.exe
  2⤵
  PID:7192
- C:\Windows\System\oaDgzEI.exe
  C:\Windows\System\oaDgzEI.exe
  2⤵
  PID:7208
- C:\Windows\System\kxtekWq.exe
  C:\Windows\System\kxtekWq.exe
  2⤵
  PID:7224
- C:\Windows\System\lPkStzt.exe
  C:\Windows\System\lPkStzt.exe
  2⤵
  PID:7244
- C:\Windows\System\JteyRlg.exe
  C:\Windows\System\JteyRlg.exe
  2⤵
  PID:7260
- C:\Windows\System\sjjGaYn.exe
  C:\Windows\System\sjjGaYn.exe
  2⤵
  PID:7276
- C:\Windows\System\nuMXtZG.exe
  C:\Windows\System\nuMXtZG.exe
  2⤵
  PID:7292
- C:\Windows\System\xunbgub.exe
  C:\Windows\System\xunbgub.exe
  2⤵
  PID:7308
- C:\Windows\System\ErKBoJR.exe
  C:\Windows\System\ErKBoJR.exe
  2⤵
  PID:7328
- C:\Windows\System\TvFMgrS.exe
  C:\Windows\System\TvFMgrS.exe
  2⤵
  PID:7344
- C:\Windows\System\hhPDfIr.exe
  C:\Windows\System\hhPDfIr.exe
  2⤵
  PID:7360
- C:\Windows\System\nUZBvbb.exe
  C:\Windows\System\nUZBvbb.exe
  2⤵
  PID:7376
- C:\Windows\System\YrRHily.exe
  C:\Windows\System\YrRHily.exe
  2⤵
  PID:7392
- C:\Windows\System\FcTOleB.exe
  C:\Windows\System\FcTOleB.exe
  2⤵
  PID:7412
- C:\Windows\System\UWSdsQp.exe
  C:\Windows\System\UWSdsQp.exe
  2⤵
  PID:7428
- C:\Windows\System\HFsmNKt.exe
  C:\Windows\System\HFsmNKt.exe
  2⤵
  PID:7444
- C:\Windows\System\cszCjNR.exe
  C:\Windows\System\cszCjNR.exe
  2⤵
  PID:7468
- C:\Windows\System\szJKAoc.exe
  C:\Windows\System\szJKAoc.exe
  2⤵
  PID:7484
- C:\Windows\System\WicOBJN.exe
  C:\Windows\System\WicOBJN.exe
  2⤵
  PID:7500
- C:\Windows\System\PTGhRQY.exe
  C:\Windows\System\PTGhRQY.exe
  2⤵
  PID:7520
- C:\Windows\System\XgYEIGp.exe
  C:\Windows\System\XgYEIGp.exe
  2⤵
  PID:7536
- C:\Windows\System\DOqjegg.exe
  C:\Windows\System\DOqjegg.exe
  2⤵
  PID:7556
- C:\Windows\System\lDqkIDt.exe
  C:\Windows\System\lDqkIDt.exe
  2⤵
  PID:7572
- C:\Windows\System\yCuVUjU.exe
  C:\Windows\System\yCuVUjU.exe
  2⤵
  PID:7588
- C:\Windows\System\ZJOULAR.exe
  C:\Windows\System\ZJOULAR.exe
  2⤵
  PID:7608
- C:\Windows\System\wnZBmke.exe
  C:\Windows\System\wnZBmke.exe
  2⤵
  PID:7624
- C:\Windows\System\IFbpUht.exe
  C:\Windows\System\IFbpUht.exe
  2⤵
  PID:7640
- C:\Windows\System\IihjIDX.exe
  C:\Windows\System\IihjIDX.exe
  2⤵
  PID:7660
- C:\Windows\System\nJbiKkw.exe
  C:\Windows\System\nJbiKkw.exe
  2⤵
  PID:7680
- C:\Windows\System\YqOltby.exe
  C:\Windows\System\YqOltby.exe
  2⤵
  PID:7700
- C:\Windows\System\nqMVzBN.exe
  C:\Windows\System\nqMVzBN.exe
  2⤵
  PID:7716
- C:\Windows\System\hLdhBcu.exe
  C:\Windows\System\hLdhBcu.exe
  2⤵
  PID:7732
- C:\Windows\System\IPJTbrc.exe
  C:\Windows\System\IPJTbrc.exe
  2⤵
  PID:7752
- C:\Windows\System\pWsvevY.exe
  C:\Windows\System\pWsvevY.exe
  2⤵
  PID:7768
- C:\Windows\System\NrTxiFl.exe
  C:\Windows\System\NrTxiFl.exe
  2⤵
  PID:7784
- C:\Windows\System\gKmOajq.exe
  C:\Windows\System\gKmOajq.exe
  2⤵
  PID:7800
- C:\Windows\System\aGKHhNu.exe
  C:\Windows\System\aGKHhNu.exe
  2⤵
  PID:7816
- C:\Windows\System\pXfRnEC.exe
  C:\Windows\System\pXfRnEC.exe
  2⤵
  PID:7832
- C:\Windows\System\xhztthX.exe
  C:\Windows\System\xhztthX.exe
  2⤵
  PID:7848
- C:\Windows\System\qYxLTkW.exe
  C:\Windows\System\qYxLTkW.exe
  2⤵
  PID:7864
- C:\Windows\System\GTeyPmk.exe
  C:\Windows\System\GTeyPmk.exe
  2⤵
  PID:7880
- C:\Windows\System\mmwlCRS.exe
  C:\Windows\System\mmwlCRS.exe
  2⤵
  PID:7896
- C:\Windows\System\uMLufvf.exe
  C:\Windows\System\uMLufvf.exe
  2⤵
  PID:7912
- C:\Windows\System\eHZHDHW.exe
  C:\Windows\System\eHZHDHW.exe
  2⤵
  PID:7928
- C:\Windows\System\eyZkNzr.exe
  C:\Windows\System\eyZkNzr.exe
  2⤵
  PID:7944
- C:\Windows\System\dBQPgsL.exe
  C:\Windows\System\dBQPgsL.exe
  2⤵
  PID:7960
- C:\Windows\System\MWnFvhk.exe
  C:\Windows\System\MWnFvhk.exe
  2⤵
  PID:7976
- C:\Windows\System\heKZnKU.exe
  C:\Windows\System\heKZnKU.exe
  2⤵
  PID:7992
- C:\Windows\System\jJJdXOT.exe
  C:\Windows\System\jJJdXOT.exe
  2⤵
  PID:8008
- C:\Windows\System\jOOknhF.exe
  C:\Windows\System\jOOknhF.exe
  2⤵
  PID:8024
- C:\Windows\System\QEqrDiC.exe
  C:\Windows\System\QEqrDiC.exe
  2⤵
  PID:8040
- C:\Windows\System\gJnDrpt.exe
  C:\Windows\System\gJnDrpt.exe
  2⤵
  PID:8056
- C:\Windows\System\KtqrSIS.exe
  C:\Windows\System\KtqrSIS.exe
  2⤵
  PID:8072
- C:\Windows\System\cFzOTCi.exe
  C:\Windows\System\cFzOTCi.exe
  2⤵
  PID:8088
- C:\Windows\System\zPSIDSc.exe
  C:\Windows\System\zPSIDSc.exe
  2⤵
  PID:8108
- C:\Windows\System\xxKRjwr.exe
  C:\Windows\System\xxKRjwr.exe
  2⤵
  PID:8124
- C:\Windows\System\QIEnWZD.exe
  C:\Windows\System\QIEnWZD.exe
  2⤵
  PID:8140
- C:\Windows\System\urqtrgm.exe
  C:\Windows\System\urqtrgm.exe
  2⤵
  PID:8156
- C:\Windows\System\MPxbWut.exe
  C:\Windows\System\MPxbWut.exe
  2⤵
  PID:8176
- C:\Windows\System\XaGHjkk.exe
  C:\Windows\System\XaGHjkk.exe
  2⤵
  PID:6616
- C:\Windows\System\JCaqzuV.exe
  C:\Windows\System\JCaqzuV.exe
  2⤵
  PID:7180
- C:\Windows\System\gdNRIRq.exe
  C:\Windows\System\gdNRIRq.exe
  2⤵
  PID:7284
- C:\Windows\System\eIVgwcx.exe
  C:\Windows\System\eIVgwcx.exe
  2⤵
  PID:7128
- C:\Windows\System\pCteIJX.exe
  C:\Windows\System\pCteIJX.exe
  2⤵
  PID:7220
- C:\Windows\System\ZqDZYRf.exe
  C:\Windows\System\ZqDZYRf.exe
  2⤵
  PID:7352
- C:\Windows\System\qiCZaLL.exe
  C:\Windows\System\qiCZaLL.exe
  2⤵
  PID:7424
- C:\Windows\System\AEIXoQb.exe
  C:\Windows\System\AEIXoQb.exe
  2⤵
  PID:7496
- C:\Windows\System\SUiVoiz.exe
  C:\Windows\System\SUiVoiz.exe
  2⤵
  PID:7564
- C:\Windows\System\mardyqn.exe
  C:\Windows\System\mardyqn.exe
  2⤵
  PID:7636
- C:\Windows\System\bAqBQJH.exe
  C:\Windows\System\bAqBQJH.exe
  2⤵
  PID:7676
- C:\Windows\System\ZRyZjGn.exe
  C:\Windows\System\ZRyZjGn.exe
  2⤵
  PID:7744
- C:\Windows\System\zoxabrO.exe
  C:\Windows\System\zoxabrO.exe
  2⤵
  PID:6980
- C:\Windows\System\jxrIjVy.exe
  C:\Windows\System\jxrIjVy.exe
  2⤵
  PID:7844
- C:\Windows\System\JXFhjYk.exe
  C:\Windows\System\JXFhjYk.exe
  2⤵
  PID:7908
- C:\Windows\System\LQBlRAJ.exe
  C:\Windows\System\LQBlRAJ.exe
  2⤵
  PID:7268
- C:\Windows\System\XHuMYGh.exe
  C:\Windows\System\XHuMYGh.exe
  2⤵
  PID:7972
- C:\Windows\System\hKAyDyA.exe
  C:\Windows\System\hKAyDyA.exe
  2⤵
  PID:7204
- C:\Windows\System\ynmDsoT.exe
  C:\Windows\System\ynmDsoT.exe
  2⤵
  PID:7304
- C:\Windows\System\qJcmlYe.exe
  C:\Windows\System\qJcmlYe.exe
  2⤵
  PID:7372
- C:\Windows\System\rbGOedS.exe
  C:\Windows\System\rbGOedS.exe
  2⤵
  PID:7480
- C:\Windows\System\grEYEWQ.exe
  C:\Windows\System\grEYEWQ.exe
  2⤵
  PID:7548
- C:\Windows\System\HZrCjVY.exe
  C:\Windows\System\HZrCjVY.exe
  2⤵
  PID:7580
- C:\Windows\System\rmeWEYI.exe
  C:\Windows\System\rmeWEYI.exe
  2⤵
  PID:7656
- C:\Windows\System\eyoHcFt.exe
  C:\Windows\System\eyoHcFt.exe
  2⤵
  PID:7724
- C:\Windows\System\DyzKbrA.exe
  C:\Windows\System\DyzKbrA.exe
  2⤵
  PID:7824
- C:\Windows\System\ILJxxnj.exe
  C:\Windows\System\ILJxxnj.exe
  2⤵
  PID:7888
- C:\Windows\System\hzxUZRD.exe
  C:\Windows\System\hzxUZRD.exe
  2⤵
  PID:7956
- C:\Windows\System\eDupwhb.exe
  C:\Windows\System\eDupwhb.exe
  2⤵
  PID:8004
- C:\Windows\System\TuoTkuO.exe
  C:\Windows\System\TuoTkuO.exe
  2⤵
  PID:8172
- C:\Windows\System\QWtuiEe.exe
  C:\Windows\System\QWtuiEe.exe
  2⤵
  PID:7316
- C:\Windows\System\DhcRZOo.exe
  C:\Windows\System\DhcRZOo.exe
  2⤵
  PID:7596
- C:\Windows\System\eNlcdbv.exe
  C:\Windows\System\eNlcdbv.exe
  2⤵
  PID:7740
- C:\Windows\System\xSJrNfM.exe
  C:\Windows\System\xSJrNfM.exe
  2⤵
  PID:7200
- C:\Windows\System\BzjJCnw.exe
  C:\Windows\System\BzjJCnw.exe
  2⤵
  PID:8052
- C:\Windows\System\phQzXxm.exe
  C:\Windows\System\phQzXxm.exe
  2⤵
  PID:7368
- C:\Windows\System\vYbRGft.exe
  C:\Windows\System\vYbRGft.exe
  2⤵
  PID:6516
- C:\Windows\System\oJRhWgv.exe
  C:\Windows\System\oJRhWgv.exe
  2⤵
  PID:7516
- C:\Windows\System\ugiNagc.exe
  C:\Windows\System\ugiNagc.exe
  2⤵
  PID:7696
- C:\Windows\System\YQuSbdM.exe
  C:\Windows\System\YQuSbdM.exe
  2⤵
  PID:7876
- C:\Windows\System\cJXsnQY.exe
  C:\Windows\System\cJXsnQY.exe
  2⤵
  PID:8188
- C:\Windows\System\MqVZIOo.exe
  C:\Windows\System\MqVZIOo.exe
  2⤵
  PID:7672
- C:\Windows\System\GEQTIuC.exe
  C:\Windows\System\GEQTIuC.exe
  2⤵
  PID:7236
- C:\Windows\System\EvjIlhe.exe
  C:\Windows\System\EvjIlhe.exe
  2⤵
  PID:7552
- C:\Windows\System\TYcSyAX.exe
  C:\Windows\System\TYcSyAX.exe
  2⤵
  PID:7792
- C:\Windows\System\SkURUdj.exe
  C:\Windows\System\SkURUdj.exe
  2⤵
  PID:8068
- C:\Windows\System\VJuQDSH.exe
  C:\Windows\System\VJuQDSH.exe
  2⤵
  PID:8136
- C:\Windows\System\KyrKAqN.exe
  C:\Windows\System\KyrKAqN.exe
  2⤵
  PID:7840
- C:\Windows\System\fxXkKam.exe
  C:\Windows\System\fxXkKam.exe
  2⤵
  PID:7712
- C:\Windows\System\DjEWyCK.exe
  C:\Windows\System\DjEWyCK.exe
  2⤵
  PID:7436
- C:\Windows\System\yuQwsFD.exe
  C:\Windows\System\yuQwsFD.exe
  2⤵
  PID:3472
- C:\Windows\System\thAVXvt.exe
  C:\Windows\System\thAVXvt.exe
  2⤵
  PID:8120
- C:\Windows\System\fbqDGxD.exe
  C:\Windows\System\fbqDGxD.exe
  2⤵
  PID:7796
- C:\Windows\System\lPCeSVp.exe
  C:\Windows\System\lPCeSVp.exe
  2⤵
  PID:7776
- C:\Windows\System\lCQAHsS.exe
  C:\Windows\System\lCQAHsS.exe
  2⤵
  PID:8184
- C:\Windows\System\lSAHkHi.exe
  C:\Windows\System\lSAHkHi.exe
  2⤵
  PID:7940
- C:\Windows\System\eItTpHO.exe
  C:\Windows\System\eItTpHO.exe
  2⤵
  PID:7668
- C:\Windows\System\UGvDEGw.exe
  C:\Windows\System\UGvDEGw.exe
  2⤵
  PID:7356
- C:\Windows\System\kfBnYbF.exe
  C:\Windows\System\kfBnYbF.exe
  2⤵
  PID:8208
- C:\Windows\System\DViYGvk.exe
  C:\Windows\System\DViYGvk.exe
  2⤵
  PID:8224
- C:\Windows\System\MEphkgb.exe
  C:\Windows\System\MEphkgb.exe
  2⤵
  PID:8240
- C:\Windows\System\rTjfpri.exe
  C:\Windows\System\rTjfpri.exe
  2⤵
  PID:8256
- C:\Windows\System\IpgxNgK.exe
  C:\Windows\System\IpgxNgK.exe
  2⤵
  PID:8272
- C:\Windows\System\ACMxNev.exe
  C:\Windows\System\ACMxNev.exe
  2⤵
  PID:8288
- C:\Windows\System\NoLZFbW.exe
  C:\Windows\System\NoLZFbW.exe
  2⤵
  PID:8312
- C:\Windows\System\CxMIQLG.exe
  C:\Windows\System\CxMIQLG.exe
  2⤵
  PID:8328
- C:\Windows\System\pInqiJO.exe
  C:\Windows\System\pInqiJO.exe
  2⤵
  PID:8344
- C:\Windows\System\LXhNzxn.exe
  C:\Windows\System\LXhNzxn.exe
  2⤵
  PID:8360
- C:\Windows\System\texnXwh.exe
  C:\Windows\System\texnXwh.exe
  2⤵
  PID:8380
- C:\Windows\System\QwPmrUS.exe
  C:\Windows\System\QwPmrUS.exe
  2⤵
  PID:8400
- C:\Windows\System\mpZCLCU.exe
  C:\Windows\System\mpZCLCU.exe
  2⤵
  PID:8416
- C:\Windows\System\bCUoudn.exe
  C:\Windows\System\bCUoudn.exe
  2⤵
  PID:8436
- C:\Windows\System\sLeehUZ.exe
  C:\Windows\System\sLeehUZ.exe
  2⤵
  PID:8456
- C:\Windows\System\lCEhwTk.exe
  C:\Windows\System\lCEhwTk.exe
  2⤵
  PID:8472
- C:\Windows\System\DVWGUlH.exe
  C:\Windows\System\DVWGUlH.exe
  2⤵
  PID:8488
- C:\Windows\System\tVDdPqo.exe
  C:\Windows\System\tVDdPqo.exe
  2⤵
  PID:8504
- C:\Windows\System\jwYEnxs.exe
  C:\Windows\System\jwYEnxs.exe
  2⤵
  PID:8520
- C:\Windows\System\foytizv.exe
  C:\Windows\System\foytizv.exe
  2⤵
  PID:8536
- C:\Windows\System\CWJGPNH.exe
  C:\Windows\System\CWJGPNH.exe
  2⤵
  PID:8552
- C:\Windows\System\dCEitMm.exe
  C:\Windows\System\dCEitMm.exe
  2⤵
  PID:8568
- C:\Windows\System\BolpIgC.exe
  C:\Windows\System\BolpIgC.exe
  2⤵
  PID:8584
- C:\Windows\System\lcOAAnp.exe
  C:\Windows\System\lcOAAnp.exe
  2⤵
  PID:8600
- C:\Windows\System\AebByQd.exe
  C:\Windows\System\AebByQd.exe
  2⤵
  PID:8616
- C:\Windows\System\VKcNhCv.exe
  C:\Windows\System\VKcNhCv.exe
  2⤵
  PID:8632
- C:\Windows\System\SHgdMaM.exe
  C:\Windows\System\SHgdMaM.exe
  2⤵
  PID:8648
- C:\Windows\System\taEvvTj.exe
  C:\Windows\System\taEvvTj.exe
  2⤵
  PID:8664
- C:\Windows\System\EBxiHWX.exe
  C:\Windows\System\EBxiHWX.exe
  2⤵
  PID:8684
- C:\Windows\System\OGoyRUh.exe
  C:\Windows\System\OGoyRUh.exe
  2⤵
  PID:8700
- C:\Windows\System\POlWOFy.exe
  C:\Windows\System\POlWOFy.exe
  2⤵
  PID:8716
- C:\Windows\System\qbajrmy.exe
  C:\Windows\System\qbajrmy.exe
  2⤵
  PID:8732
- C:\Windows\System\DdSomZO.exe
  C:\Windows\System\DdSomZO.exe
  2⤵
  PID:8748
- C:\Windows\System\ufpBuNO.exe
  C:\Windows\System\ufpBuNO.exe
  2⤵
  PID:8764
- C:\Windows\System\ZPVANzV.exe
  C:\Windows\System\ZPVANzV.exe
  2⤵
  PID:8780
- C:\Windows\System\WjNrsHj.exe
  C:\Windows\System\WjNrsHj.exe
  2⤵
  PID:8796
- C:\Windows\System\mfdAOoA.exe
  C:\Windows\System\mfdAOoA.exe
  2⤵
  PID:8812
- C:\Windows\System\UfhFTfN.exe
  C:\Windows\System\UfhFTfN.exe
  2⤵
  PID:8828
- C:\Windows\System\ROkGlqy.exe
  C:\Windows\System\ROkGlqy.exe
  2⤵
  PID:8844
- C:\Windows\System\SqnsufS.exe
  C:\Windows\System\SqnsufS.exe
  2⤵
  PID:8860
- C:\Windows\System\aReGVma.exe
  C:\Windows\System\aReGVma.exe
  2⤵
  PID:8876
- C:\Windows\System\JsvGBjx.exe
  C:\Windows\System\JsvGBjx.exe
  2⤵
  PID:8892
- C:\Windows\System\bnZksDn.exe
  C:\Windows\System\bnZksDn.exe
  2⤵
  PID:8908
- C:\Windows\System\SPPcAsI.exe
  C:\Windows\System\SPPcAsI.exe
  2⤵
  PID:8924
- C:\Windows\System\PUdlnGC.exe
  C:\Windows\System\PUdlnGC.exe
  2⤵
  PID:8940
- C:\Windows\System\rPhbBBY.exe
  C:\Windows\System\rPhbBBY.exe
  2⤵
  PID:8956
- C:\Windows\System\BzWQoHy.exe
  C:\Windows\System\BzWQoHy.exe
  2⤵
  PID:8972
- C:\Windows\System\RdoGNPk.exe
  C:\Windows\System\RdoGNPk.exe
  2⤵
  PID:8988
- C:\Windows\System\xmjbwjG.exe
  C:\Windows\System\xmjbwjG.exe
  2⤵
  PID:9004
- C:\Windows\System\gFlZvdh.exe
  C:\Windows\System\gFlZvdh.exe
  2⤵
  PID:9020
- C:\Windows\System\jJGtyse.exe
  C:\Windows\System\jJGtyse.exe
  2⤵
  PID:9036
- C:\Windows\System\SVZbJje.exe
  C:\Windows\System\SVZbJje.exe
  2⤵
  PID:9052
- C:\Windows\System\sTUPazh.exe
  C:\Windows\System\sTUPazh.exe
  2⤵
  PID:9068
- C:\Windows\System\FzIuenA.exe
  C:\Windows\System\FzIuenA.exe
  2⤵
  PID:9084
- C:\Windows\System\VwnmLrW.exe
  C:\Windows\System\VwnmLrW.exe
  2⤵
  PID:9100
- C:\Windows\System\DOPQliU.exe
  C:\Windows\System\DOPQliU.exe
  2⤵
  PID:9116
- C:\Windows\System\JQWnwNv.exe
  C:\Windows\System\JQWnwNv.exe
  2⤵
  PID:9132
- C:\Windows\System\XmXzbGa.exe
  C:\Windows\System\XmXzbGa.exe
  2⤵
  PID:9148
- C:\Windows\System\rvCwGOh.exe
  C:\Windows\System\rvCwGOh.exe
  2⤵
  PID:9164
- C:\Windows\System\pSIURjd.exe
  C:\Windows\System\pSIURjd.exe
  2⤵
  PID:9180
- C:\Windows\System\uruPDMq.exe
  C:\Windows\System\uruPDMq.exe
  2⤵
  PID:9196
- C:\Windows\System\QryDBmw.exe
  C:\Windows\System\QryDBmw.exe
  2⤵
  PID:8036
- C:\Windows\System\xolJXHD.exe
  C:\Windows\System\xolJXHD.exe
  2⤵
  PID:7460
- C:\Windows\System\RSMamgl.exe
  C:\Windows\System\RSMamgl.exe
  2⤵
  PID:7240
- C:\Windows\System\tuoRVxY.exe
  C:\Windows\System\tuoRVxY.exe
  2⤵
  PID:8116
- C:\Windows\System\grvSADZ.exe
  C:\Windows\System\grvSADZ.exe
  2⤵
  PID:7508
- C:\Windows\System\rhRcesB.exe
  C:\Windows\System\rhRcesB.exe
  2⤵
  PID:7256
- C:\Windows\System\aahLXPR.exe
  C:\Windows\System\aahLXPR.exe
  2⤵
  PID:8284
- C:\Windows\System\Ipfvctv.exe
  C:\Windows\System\Ipfvctv.exe
  2⤵
  PID:8356
- C:\Windows\System\DkvOZgL.exe
  C:\Windows\System\DkvOZgL.exe
  2⤵
  PID:8296
- C:\Windows\System\tTjYbNQ.exe
  C:\Windows\System\tTjYbNQ.exe
  2⤵
  PID:7512
- C:\Windows\System\TRWpJRt.exe
  C:\Windows\System\TRWpJRt.exe
  2⤵
  PID:6532
- C:\Windows\System\TYvkDjr.exe
  C:\Windows\System\TYvkDjr.exe
  2⤵
  PID:8200
- C:\Windows\System\GfSrSIK.exe
  C:\Windows\System\GfSrSIK.exe
  2⤵
  PID:8264
- C:\Windows\System\LhRQgzK.exe
  C:\Windows\System\LhRQgzK.exe
  2⤵
  PID:8336
- C:\Windows\System\wikIEGT.exe
  C:\Windows\System\wikIEGT.exe
  2⤵
  PID:8376
- C:\Windows\System\yDIrFCg.exe
  C:\Windows\System\yDIrFCg.exe
  2⤵
  PID:8432
- C:\Windows\System\hCHtBAY.exe
  C:\Windows\System\hCHtBAY.exe
  2⤵
  PID:8448
- C:\Windows\System\suIkVcU.exe
  C:\Windows\System\suIkVcU.exe
  2⤵
  PID:8484
- C:\Windows\System\wEtEXAE.exe
  C:\Windows\System\wEtEXAE.exe
  2⤵
  PID:8532
- C:\Windows\System\czItszz.exe
  C:\Windows\System\czItszz.exe
  2⤵
  PID:8548
- C:\Windows\System\tmGebhN.exe
  C:\Windows\System\tmGebhN.exe
  2⤵
  PID:8608
- C:\Windows\System\jHqPEkI.exe
  C:\Windows\System\jHqPEkI.exe
  2⤵
  PID:8592
- C:\Windows\System\gkkrYQp.exe
  C:\Windows\System\gkkrYQp.exe
  2⤵
  PID:8628
- C:\Windows\System\WrZToTB.exe
  C:\Windows\System\WrZToTB.exe
  2⤵
  PID:8692
- C:\Windows\System\VrvQGIE.exe
  C:\Windows\System\VrvQGIE.exe
  2⤵
  PID:8756
- C:\Windows\System\YligvUA.exe
  C:\Windows\System\YligvUA.exe
  2⤵
  PID:8820
- C:\Windows\System\sdhmfRP.exe
  C:\Windows\System\sdhmfRP.exe
  2⤵
  PID:8856
- C:\Windows\System\nuKMWbM.exe
  C:\Windows\System\nuKMWbM.exe
  2⤵
  PID:8712
- C:\Windows\System\ememonQ.exe
  C:\Windows\System\ememonQ.exe
  2⤵
  PID:8776
- C:\Windows\System\QDCwfHx.exe
  C:\Windows\System\QDCwfHx.exe
  2⤵
  PID:8808
- C:\Windows\System\cBqcJmu.exe
  C:\Windows\System\cBqcJmu.exe
  2⤵
  PID:8900
- C:\Windows\System\tQHZswg.exe
  C:\Windows\System\tQHZswg.exe
  2⤵
  PID:8980
- C:\Windows\System\VUWGjoQ.exe
  C:\Windows\System\VUWGjoQ.exe
  2⤵
  PID:8932
- C:\Windows\System\BmIOrDr.exe
  C:\Windows\System\BmIOrDr.exe
  2⤵
  PID:9108
- C:\Windows\System\NCRMhZG.exe
  C:\Windows\System\NCRMhZG.exe
  2⤵
  PID:8968
- C:\Windows\System\GUddmxG.exe
  C:\Windows\System\GUddmxG.exe
  2⤵
  PID:8964
- C:\Windows\System\AnAwSlF.exe
  C:\Windows\System\AnAwSlF.exe
  2⤵
  PID:9124
- C:\Windows\System\DOgYvtE.exe
  C:\Windows\System\DOgYvtE.exe
  2⤵
  PID:9212
- C:\Windows\System\XJUEUvh.exe
  C:\Windows\System\XJUEUvh.exe
  2⤵
  PID:1244
- C:\Windows\System\QHlIrxt.exe
  C:\Windows\System\QHlIrxt.exe
  2⤵
  PID:8324
- C:\Windows\System\MwuEplk.exe
  C:\Windows\System\MwuEplk.exe
  2⤵
  PID:6180
- C:\Windows\System\lPUXbzW.exe
  C:\Windows\System\lPUXbzW.exe
  2⤵
  PID:7604
- C:\Windows\System\WgkBtby.exe
  C:\Windows\System\WgkBtby.exe
  2⤵
  PID:8424
- C:\Windows\System\wjzJcol.exe
  C:\Windows\System\wjzJcol.exe
  2⤵
  PID:8512
- C:\Windows\System\KkTnTEX.exe
  C:\Windows\System\KkTnTEX.exe
  2⤵
  PID:8444
- C:\Windows\System\jMTPjbG.exe
  C:\Windows\System\jMTPjbG.exe
  2⤵
  PID:8236
- C:\Windows\System\AucFtzs.exe
  C:\Windows\System\AucFtzs.exe
  2⤵
  PID:8624
- C:\Windows\System\yDwGtYW.exe
  C:\Windows\System\yDwGtYW.exe
  2⤵
  PID:8516
- C:\Windows\System\otVjQRT.exe
  C:\Windows\System\otVjQRT.exe
  2⤵
  PID:8644
- C:\Windows\System\XTUxolB.exe
  C:\Windows\System\XTUxolB.exe
  2⤵
  PID:8920
- C:\Windows\System\KfzPaRD.exe
  C:\Windows\System\KfzPaRD.exe
  2⤵
  PID:8660
- C:\Windows\System\dwwozfi.exe
  C:\Windows\System\dwwozfi.exe
  2⤵
  PID:8708
- C:\Windows\System\dcFTxCs.exe
  C:\Windows\System\dcFTxCs.exe
  2⤵
  PID:8952
- C:\Windows\System\OGsbghv.exe
  C:\Windows\System\OGsbghv.exe
  2⤵
  PID:9048
- C:\Windows\System\wfzSYLa.exe
  C:\Windows\System\wfzSYLa.exe
  2⤵
  PID:9096
- C:\Windows\System\CUaqeKa.exe
  C:\Windows\System\CUaqeKa.exe
  2⤵
  PID:9028
- C:\Windows\System\DLmFBAi.exe
  C:\Windows\System\DLmFBAi.exe
  2⤵
  PID:9160
- C:\Windows\System\BDplIHu.exe
  C:\Windows\System\BDplIHu.exe
  2⤵
  PID:9156
- C:\Windows\System\OIaukqb.exe
  C:\Windows\System\OIaukqb.exe
  2⤵
  PID:8152
- C:\Windows\System\AyrQODY.exe
  C:\Windows\System\AyrQODY.exe
  2⤵
  PID:7728
- C:\Windows\System\ePwOVFc.exe
  C:\Windows\System\ePwOVFc.exe
  2⤵
  PID:8464
- C:\Windows\System\PezlkHd.exe
  C:\Windows\System\PezlkHd.exe
  2⤵
  PID:8916
- C:\Windows\System\KeCnTMY.exe
  C:\Windows\System\KeCnTMY.exe
  2⤵
  PID:9224
- C:\Windows\System\qUEndoI.exe
  C:\Windows\System\qUEndoI.exe
  2⤵
  PID:9240
- C:\Windows\System\KqRCcYk.exe
  C:\Windows\System\KqRCcYk.exe
  2⤵
  PID:9256
- C:\Windows\System\NVHlLnA.exe
  C:\Windows\System\NVHlLnA.exe
  2⤵
  PID:9276
- C:\Windows\System\RoplyLM.exe
  C:\Windows\System\RoplyLM.exe
  2⤵
  PID:9292
- C:\Windows\System\jRWJxfP.exe
  C:\Windows\System\jRWJxfP.exe
  2⤵
  PID:9308
- C:\Windows\System\binKyyG.exe
  C:\Windows\System\binKyyG.exe
  2⤵
  PID:9324
- C:\Windows\System\ZtATJNe.exe
  C:\Windows\System\ZtATJNe.exe
  2⤵
  PID:9340
- C:\Windows\System\jShKIWZ.exe
  C:\Windows\System\jShKIWZ.exe
  2⤵
  PID:9356
- C:\Windows\System\rwpyciC.exe
  C:\Windows\System\rwpyciC.exe
  2⤵
  PID:9372
- C:\Windows\System\lgWXzeZ.exe
  C:\Windows\System\lgWXzeZ.exe
  2⤵
  PID:9388
- C:\Windows\System\mCAVfhy.exe
  C:\Windows\System\mCAVfhy.exe
  2⤵
  PID:9404
- C:\Windows\System\GBXFUQa.exe
  C:\Windows\System\GBXFUQa.exe
  2⤵
  PID:9580
- C:\Windows\System\aBxrbgf.exe
  C:\Windows\System\aBxrbgf.exe
  2⤵
  PID:9596
- C:\Windows\System\hPGfDmc.exe
  C:\Windows\System\hPGfDmc.exe
  2⤵
  PID:9612
- C:\Windows\System\YapNicY.exe
  C:\Windows\System\YapNicY.exe
  2⤵
  PID:9628
- C:\Windows\System\VJLwtyv.exe
  C:\Windows\System\VJLwtyv.exe
  2⤵
  PID:9652
- C:\Windows\System\qvPrcLt.exe
  C:\Windows\System\qvPrcLt.exe
  2⤵
  PID:9672
- C:\Windows\System\eBaJZKs.exe
  C:\Windows\System\eBaJZKs.exe
  2⤵
  PID:9688
- C:\Windows\System\pCVkBrO.exe
  C:\Windows\System\pCVkBrO.exe
  2⤵
  PID:9708
- C:\Windows\System\qpmHjfR.exe
  C:\Windows\System\qpmHjfR.exe
  2⤵
  PID:9728
- C:\Windows\System\LlsVvkf.exe
  C:\Windows\System\LlsVvkf.exe
  2⤵
  PID:9744
- C:\Windows\System\TbriveK.exe
  C:\Windows\System\TbriveK.exe
  2⤵
  PID:9768
- C:\Windows\System\BlNEunq.exe
  C:\Windows\System\BlNEunq.exe
  2⤵
  PID:9784
- C:\Windows\System\iEbPBoy.exe
  C:\Windows\System\iEbPBoy.exe
  2⤵
  PID:9804
- C:\Windows\System\WiaHrmF.exe
  C:\Windows\System\WiaHrmF.exe
  2⤵
  PID:9824
- C:\Windows\System\pajNrxp.exe
  C:\Windows\System\pajNrxp.exe
  2⤵
  PID:9840
- C:\Windows\System\YGRJhjS.exe
  C:\Windows\System\YGRJhjS.exe
  2⤵
  PID:9860
- C:\Windows\System\rQUwbYk.exe
  C:\Windows\System\rQUwbYk.exe
  2⤵
  PID:9876
- C:\Windows\System\wXQRipG.exe
  C:\Windows\System\wXQRipG.exe
  2⤵
  PID:9892
- C:\Windows\System\cwGgevV.exe
  C:\Windows\System\cwGgevV.exe
  2⤵
  PID:9912
- C:\Windows\System\ZUIyzsk.exe
  C:\Windows\System\ZUIyzsk.exe
  2⤵
  PID:9928
- C:\Windows\System\zlKWDAR.exe
  C:\Windows\System\zlKWDAR.exe
  2⤵
  PID:9944
- C:\Windows\System\tKJwKzC.exe
  C:\Windows\System\tKJwKzC.exe
  2⤵
  PID:9964
- C:\Windows\System\DtRdGBd.exe
  C:\Windows\System\DtRdGBd.exe
  2⤵
  PID:10084
- C:\Windows\System\wrNVbUo.exe
  C:\Windows\System\wrNVbUo.exe
  2⤵
  PID:10104
- C:\Windows\System\OMQdLgE.exe
  C:\Windows\System\OMQdLgE.exe
  2⤵
  PID:10120
- C:\Windows\System\XMlQuLV.exe
  C:\Windows\System\XMlQuLV.exe
  2⤵
  PID:10140
- C:\Windows\System\rNkhRek.exe
  C:\Windows\System\rNkhRek.exe
  2⤵
  PID:10160
- C:\Windows\System\EPsCmJG.exe
  C:\Windows\System\EPsCmJG.exe
  2⤵
  PID:10180
- C:\Windows\System\cPVUPxO.exe
  C:\Windows\System\cPVUPxO.exe
  2⤵
  PID:10200
- C:\Windows\System\pdiVWfH.exe
  C:\Windows\System\pdiVWfH.exe
  2⤵
  PID:10216
- C:\Windows\System\EUzjWvx.exe
  C:\Windows\System\EUzjWvx.exe
  2⤵
  PID:10236
- C:\Windows\System\CcfZpnq.exe
  C:\Windows\System\CcfZpnq.exe
  2⤵
  PID:9176
- C:\Windows\System\FVTNcMg.exe
  C:\Windows\System\FVTNcMg.exe
  2⤵
  PID:9128
- C:\Windows\System\gWiOygX.exe
  C:\Windows\System\gWiOygX.exe
  2⤵
  PID:8740
- C:\Windows\System\YteycDV.exe
  C:\Windows\System\YteycDV.exe
  2⤵
  PID:9420
- C:\Windows\System\GlSVArs.exe
  C:\Windows\System\GlSVArs.exe
  2⤵
  PID:9444
- C:\Windows\System\wRDUZhk.exe
  C:\Windows\System\wRDUZhk.exe
  2⤵
  PID:9460
- C:\Windows\System\JwIyxfY.exe
  C:\Windows\System\JwIyxfY.exe
  2⤵
  PID:8840
- C:\Windows\System\BhkPpnY.exe
  C:\Windows\System\BhkPpnY.exe
  2⤵
  PID:7856
- C:\Windows\System\KrDoLBn.exe
  C:\Windows\System\KrDoLBn.exe
  2⤵
  PID:8728
- C:\Windows\System\NHechwD.exe
  C:\Windows\System\NHechwD.exe
  2⤵
  PID:9060
- C:\Windows\System\WGsPKCy.exe
  C:\Windows\System\WGsPKCy.exe
  2⤵
  PID:9188
- C:\Windows\System\bjDzxXz.exe
  C:\Windows\System\bjDzxXz.exe
  2⤵
  PID:9236
- C:\Windows\System\MVvsniu.exe
  C:\Windows\System\MVvsniu.exe
  2⤵
  PID:9332
- C:\Windows\System\qOAPGOF.exe
  C:\Windows\System\qOAPGOF.exe
  2⤵
  PID:9396
- C:\Windows\System\nrxwvwJ.exe
  C:\Windows\System\nrxwvwJ.exe
  2⤵
  PID:9524
- C:\Windows\System\wevXltC.exe
  C:\Windows\System\wevXltC.exe
  2⤵
  PID:9552
- C:\Windows\System\FHNrjBW.exe
  C:\Windows\System\FHNrjBW.exe
  2⤵
  PID:9576
- C:\Windows\System\sMNHUnZ.exe
  C:\Windows\System\sMNHUnZ.exe
  2⤵
  PID:9520
- C:\Windows\System\RltejUg.exe
  C:\Windows\System\RltejUg.exe
  2⤵
  PID:9416
- C:\Windows\System\uBjnDyV.exe
  C:\Windows\System\uBjnDyV.exe
  2⤵
  PID:9620
- C:\Windows\System\iPrtKpr.exe
  C:\Windows\System\iPrtKpr.exe
  2⤵
  PID:9700
- C:\Windows\System\MjlkIDH.exe
  C:\Windows\System\MjlkIDH.exe
  2⤵
  PID:9776
- C:\Windows\System\iTaOAqc.exe
  C:\Windows\System\iTaOAqc.exe
  2⤵
  PID:9812
- C:\Windows\System\AojhLcX.exe
  C:\Windows\System\AojhLcX.exe
  2⤵
  PID:9648
- C:\Windows\System\nuPeHZa.exe
  C:\Windows\System\nuPeHZa.exe
  2⤵
  PID:9720
- C:\Windows\System\YBWAnzm.exe
  C:\Windows\System\YBWAnzm.exe
  2⤵
  PID:9800
- C:\Windows\System\OxSaQDL.exe
  C:\Windows\System\OxSaQDL.exe
  2⤵
  PID:9848
- C:\Windows\System\XCsfajb.exe
  C:\Windows\System\XCsfajb.exe
  2⤵
  PID:9764
- C:\Windows\System\SgEVoPU.exe
  C:\Windows\System\SgEVoPU.exe
  2⤵
  PID:9832
- C:\Windows\System\Zzrmkok.exe
  C:\Windows\System\Zzrmkok.exe
  2⤵
  PID:8872
- C:\Windows\System\SiDkpkw.exe
  C:\Windows\System\SiDkpkw.exe
  2⤵
  PID:9936
- C:\Windows\System\OAVIxxd.exe
  C:\Windows\System\OAVIxxd.exe
  2⤵
  PID:9920
- C:\Windows\System\QuUkSAk.exe
  C:\Windows\System\QuUkSAk.exe
  2⤵
  PID:9980
- C:\Windows\System\hHeWwPN.exe
  C:\Windows\System\hHeWwPN.exe
  2⤵
  PID:9996
- C:\Windows\System\qWpNHMo.exe
  C:\Windows\System\qWpNHMo.exe
  2⤵
  PID:10032
- C:\Windows\System\icAQcja.exe
  C:\Windows\System\icAQcja.exe
  2⤵
  PID:10048
- C:\Windows\System\BJyJhFl.exe
  C:\Windows\System\BJyJhFl.exe
  2⤵
  PID:10064
- C:\Windows\System\INtJZAv.exe
  C:\Windows\System\INtJZAv.exe
  2⤵
  PID:10036
- C:\Windows\System\MaePAVQ.exe
  C:\Windows\System\MaePAVQ.exe
  2⤵
  PID:10100
- C:\Windows\System\anCVBiK.exe
  C:\Windows\System\anCVBiK.exe
  2⤵
  PID:10116
- C:\Windows\System\yerKnNQ.exe
  C:\Windows\System\yerKnNQ.exe
  2⤵
  PID:10192
- C:\Windows\System\jtDhUSp.exe
  C:\Windows\System\jtDhUSp.exe
  2⤵
  PID:9412
- C:\Windows\System\mcDvVYs.exe
  C:\Windows\System\mcDvVYs.exe
  2⤵
  PID:10080
- C:\Windows\System\GVHSNez.exe
  C:\Windows\System\GVHSNez.exe
  2⤵
  PID:9456
- C:\Windows\System\vJjOJTW.exe
  C:\Windows\System\vJjOJTW.exe
  2⤵
  PID:10128
- C:\Windows\System\RpxcxaY.exe
  C:\Windows\System\RpxcxaY.exe
  2⤵
  PID:8640
- C:\Windows\System\ohGzGRH.exe
  C:\Windows\System\ohGzGRH.exe
  2⤵
  PID:10136
- C:\Windows\System\EvWtCDU.exe
  C:\Windows\System\EvWtCDU.exe
  2⤵
  PID:10208
- C:\Windows\System\twOzyJd.exe
  C:\Windows\System\twOzyJd.exe
  2⤵
  PID:9316
- C:\Windows\System\gerhUPq.exe
  C:\Windows\System\gerhUPq.exe
  2⤵
  PID:8528
- C:\Windows\System\ZELUhxh.exe
  C:\Windows\System\ZELUhxh.exe
  2⤵
  PID:8304
- C:\Windows\System\fCIUAtD.exe
  C:\Windows\System\fCIUAtD.exe
  2⤵
  PID:9032
- C:\Windows\System\ZtDYAel.exe
  C:\Windows\System\ZtDYAel.exe
  2⤵
  PID:7532
- C:\Windows\System\ISEaEgJ.exe
  C:\Windows\System\ISEaEgJ.exe
  2⤵
  PID:9536
- C:\Windows\System\kLQfejj.exe
  C:\Windows\System\kLQfejj.exe
  2⤵
  PID:9300
- C:\Windows\System\QALUTro.exe
  C:\Windows\System\QALUTro.exe
  2⤵
  PID:9508
- C:\Windows\System\gggJTvm.exe
  C:\Windows\System\gggJTvm.exe
  2⤵
  PID:9660
- C:\Windows\System\XoYxaQs.exe
  C:\Windows\System\XoYxaQs.exe
  2⤵
  PID:9696
- C:\Windows\System\tktUdBY.exe
  C:\Windows\System\tktUdBY.exe
  2⤵
  PID:9736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AgpFRab.exe

Filesize
1.9MB

MD5
a2af79bec2683e04fa2e2800362db200

SHA1
7b03a3c6dc964f0b85a30eec500ffa6c7c055c6f

SHA256
a03ab9f609afa5e93ee3e528127df4dc696a0ac6b3d76e980342ee654d82f13b

SHA512
ee9012680a0d1da2bd222a262503a177d5d0974199726404d30b9947e9a6bd48bcf34baaa1a4b13205f5104758c2cbfef4233662c00278f321fcd2a618c5ea80

Download Submit
C:\Windows\system\CYDMexu.exe

Filesize
1.9MB

MD5
a1c7ca51cc948348354822e8ac1b8866

SHA1
f48a86162c6808ca1cc87ac100557c48cb4a720a

SHA256
36e01e6cb7cc37c56130b6c1cf1d7ad3f6885f02f4c7fd3f13f58e78c66de9b0

SHA512
957eb260a0c40a1e90dd58bbd9867822302a6903cdc29a625b6ac64d9ae57448a00bbec86779a6e7148b02c12ffd867d596b91e171d161166ec8b2b0e48740fb

Download Submit
C:\Windows\system\GsXHAxU.exe

Filesize
1.9MB

MD5
d18c1cac6ec1440c89136ada6c1ef569

SHA1
ec04482bbc3755d30d860e3e46532db9c69c7baf

SHA256
75e027ff3e58407b554fa30ae0edc8f2ce318067e6e460e4abac93f195b44315

SHA512
93e71f0b727e72f6282c4ce7cff6290f4676d5161e96fa6886cee0c80138c863bc96f16784d161fd6c6b0fa8438d2ddcccaf5426715677dc2ccafe09a7ae1127

Download Submit
C:\Windows\system\IJxvRgo.exe

Filesize
1.9MB

MD5
510d586384811436688e96cdd76b7774

SHA1
32bfe9e0ba036b5d30896d95b4a1c114034e1a41

SHA256
c08a5ea6e5588aba6d6effe3fdb3b4c00837a08261d808638e75b266079403f4

SHA512
6ab62859869c271c1c9a594021778b047d5053257528416da1bfa796a46e02ebb21862f1153cbc055c8720b9dfafe7229b3184b91c9f7b2a687f3d4844fb41b5

Download Submit
C:\Windows\system\KhEIjuE.exe

Filesize
1.9MB

MD5
649eee3e7f445d752e7b011353502c47

SHA1
03be0b91fcde8e2849bfcfa36d5fc985fa0b1edd

SHA256
187bd550395cb2c4620cb5b80308655d1f8dc3232cf57a6947959d682cf120e4

SHA512
1a3474373442b8b3727901d83c8c8e31839806cf92d8b93b317768ef0994087be5bf027d2a2cdac3fed0c91d89d252e12e4b48ef7d01bbf9041addca0a5007d2

Download Submit
C:\Windows\system\NKWeiKD.exe

Filesize
1.9MB

MD5
adf0fc36e9f860948cc8b2a68b061ba5

SHA1
241543e3c5a762cb3b8d81d67100181e8bf31705

SHA256
2d2cea45ad899c4d36ff4a718d690374d36473f1160b2601df35ac831f0ef2c5

SHA512
c9463fc777d09b60bd1e69d0a501beba64b54c8d8033b2f5dffcedc1218a10dd42e2dcd9b3b73d392a760dda93b1d421ec11cd17fbb260c8448f1c01590ffcad

Download Submit
C:\Windows\system\NMSMgeq.exe

Filesize
1.9MB

MD5
f4f520892370ad0c46d6c7f6f40c1cfb

SHA1
a766cd86e2e262ed414377d93c40270e5efe37e2

SHA256
b29b86ef74518b5fd6f898efd3de16537842c9c0e65ff6bc4b37c02dfd971554

SHA512
594345056eeec4b76d820e0d47aa1db9685ee82ce42b3d3e7bc0995548a2d541e68be6db762f6ffe4e4c651ba07b14d616724046f3b9ef0589d19c054b9c5d52

Download Submit
C:\Windows\system\NMuPpxF.exe

Filesize
1.9MB

MD5
d5b8ecd8605b8b607e131c7a157c4bf0

SHA1
058a1d784e2e32bb16c064328b672436efe1ce3e

SHA256
7fc92d98331beb53ba6e30a4294b461d419660c69d7e96521a51976136f40f75

SHA512
4ce09adaf0bfe8d2d127cc28cfc2aad6842394cb7ff35a971661e63fc55d3df34cebb713bdd22cf6e8381d5f60924999be5bdee64e3fc6e790fb1cf474d6f783

Download Submit
C:\Windows\system\OcUxqSs.exe

Filesize
1.9MB

MD5
00682771d8c1f3606d5dac5d698d027a

SHA1
11f75ab25c1b838d54d74b71a83b99b023569b8f

SHA256
4c1477809a15a304c8394ca17f8d82be848c4baa371e98934132090f1119fe0f

SHA512
a4bc46ddc3b909d98164c1a1f44ef80eaebcd0eb800f69219cd562c400649db075506220b3ddcf109cb95423b1867996f714e75b6f5b6c47bf4a093c31ff7b4b

Download Submit
C:\Windows\system\PdGzoCB.exe

Filesize
1.9MB

MD5
4298d58e363a108c84ddd8265cb5d8eb

SHA1
794f38ec26f498cdac77ab7fcf390d096ef0f251

SHA256
90da5d7ee4f83621a743cf59e24661a64512f916bd8431578f54d2d2bc72f147

SHA512
c9089d0362911840ca5cc1e3c21aae653aa2db38d35b1d50ac37e614ac78f760622c5589f92257d10bc0ccb3cad7a7f13342e90ca2fcf6c6db7821bfc69566dd

Download Submit
C:\Windows\system\PfbCIwB.exe

Filesize
1.9MB

MD5
fe469eec8a8884a58191e9eb3686b88c

SHA1
d0fd8af7dd9e6d1c705fc719f841d5d0dac0a993

SHA256
e71a4e62955189ebf934bf5f641a07a993cfaa4bb226a54051acb5631c8ff55d

SHA512
1c0338e55e14e26e38ae426d8be79a40d154b9d931074a64ad93f2b460a97dced1752238ebedbe7262728bd5b4a445f7eb48c00af8c9cb9526be9145d06ee979

Download Submit
C:\Windows\system\QxlKvEe.exe

Filesize
1.9MB

MD5
9e865affafe96c45eb7ec794310cf685

SHA1
5ccfcb2a5931b0ffaeb938c4aaa0ec10c21a4d57

SHA256
fef1f638a2794ed4bdf143563d13057f54099f4c577bbab20d351c96c8f4cde8

SHA512
27076df0dac7600d9c9fdc3c68cdfc6d4e753e090a236f947276db487d538ea3a07558e7a1979c46ce5312e081681a3abe56339e3ec42f9825f1cd179d52f73e

Download Submit
C:\Windows\system\RHlFqFd.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\system\ZNMwUjy.exe

Filesize
1.9MB

MD5
ea51310f9e51eabd61285efb62b13ef9

SHA1
a93b970cd3ac8e209f877391751d98c216089d29

SHA256
82bc9cf26ede3ad24c46b098a05505b6ed0ae0be1faa1e2a8651e284549d525a

SHA512
856f00afd1a2a96ff1331465c75bb19f818cb80e2825afa03528d12fc8ccc87ff7e80b50fb75934c884276b50a831d1837ed093ba20c19b89a86bf84397b2824

Download Submit
C:\Windows\system\amGGzlc.exe

Filesize
1.9MB

MD5
7d88b2527be6dee9c6099b16a78ee592

SHA1
be1040e46ecd1e92fc58a8f6c98ddaf31bd0a5b3

SHA256
fdab9ba1bd7d5c027ad36a13db804a1c6dc5e2be41a8fb13b441097e1ae365bf

SHA512
9e560984ba4c848821035a49439f5de4fdf793e2d518e33e3f6c39489a1340d6eca887225f5c3be966bd279d548102844334afe4864666b0039bfca8fb5697c2

Download Submit
C:\Windows\system\bCdCqOG.exe

Filesize
1.9MB

MD5
49fd6f402000c10e72866b12ae57aac7

SHA1
65018821d372866904c74851308b943e1f4a3a12

SHA256
e113fc6321464fb902583890dc9e63e744e945dedb41744674395901375690e1

SHA512
090f1d69aba09ef6b33b0c1a522ebc9063858efe3238bddff00ece5b6abf94441b1b9adc4bc5511c470ab228fd53aa49c6bd852b792cff74b9fdf051fb0100ea

Download Submit
C:\Windows\system\babmlBs.exe

Filesize
1.9MB

MD5
5ec3bc08303d39271a693e1bfb3b6fcd

SHA1
27dfbed371dc546e7f71c39b50a2e22ebcfb952c

SHA256
5f066dcae0803d4a1474172e0cea8f879ebae53b9ba6405a5d327b64062f58f6

SHA512
47bb273d8033eeeaddc4a839b423bcc49f84a847f96dabeacbc92beb73b8c400a1faf5ada3184144ea4a1d3d1335c80d1c890216c35ae5c88ad6b40710dcf5d8

Download Submit
C:\Windows\system\dgxMRps.exe

Filesize
1.9MB

MD5
e2700c637f28dd33a3e9852599d54181

SHA1
91e2f8860258aea7c19a7f9d0b05706849b9fe4a

SHA256
70438ecde84c13247935243aac70e2439904a7099e277e2dffe6962532c97826

SHA512
b842ac9cdf8b889972ae6977360b138a65289d10d6d98d58c6965ab240cc1df002ca1d99025e5b2738d3734b7939aa0241f912d6a865b5772d495634ea907dca

Download Submit
C:\Windows\system\gthHrbU.exe

Filesize
1.9MB

MD5
10a738dc84427da943a4af6dc853447a

SHA1
bdec5d02a6219e3df1825deb8b52b20f3938952a

SHA256
5a9c13ed3561957c17452fb7cb8d2e06a0a1bd9f035562b8936049bccb12f8da

SHA512
391b82dfbd6b245d00f67eedfd6d0ae2d62bd9417a85f35707377cd6eb7dedf591e9df0aea7130ad1dafc21625bb142ab6e18ac826ea9a2e0543e6f4d61b32b0

Download Submit
C:\Windows\system\iBpBVny.exe

Filesize
1.9MB

MD5
11b3ace2a1a5827aced7daaf7dda000e

SHA1
9ca43d8580e5dd44489f979df2eef87adffccd11

SHA256
3c1a3423fea2c7ef899730bfb138f41280c260aaf19a2f567f4aab8893b5348b

SHA512
221392d1504e6f3aa17037db414e56d24b16539af7177a4e28ac0b1c85f493ed7a34f93132d8a9936bb92eacf2f6b1bd8e80659158c662ed2233f64c1b5442d2

Download Submit
C:\Windows\system\kRxDdCl.exe

Filesize
1.9MB

MD5
88cce20fcb751b6dfb135ea1b0943670

SHA1
4948ed61d33410e2bcb6040753d9975528993aa3

SHA256
5e56bef318ffc836da737b8e5415d2aa08efc8d3bc8578648ac0489848d73702

SHA512
33aaf5596f02f138d91b58f4f95328296ad6d1e41b9a6b3994439ab78b3da319c72790fc78f162918ec4f1fc54e550a3671d9a8f74e07df12671cbb6746910d3

Download Submit
C:\Windows\system\lCBSzDg.exe

Filesize
1.9MB

MD5
513b6bdb1e6ef3c1edc397a395dffd6a

SHA1
cefe55a0f5bbb947e5a357b40c34465979d70b09

SHA256
f2ac314f2f16942eca3328de9637e892b5434a0a894ee5f98adbfa58a0f2a753

SHA512
aaac7bd8c87f9c3569c2ac48088aaa0f77d919c57d1967f2b9520cd00b53c0fef24e630533138612862e43b3225973d5e389502db951b4a4b8786ce36e1ca8c2

Download Submit
C:\Windows\system\mZBnkro.exe

Filesize
1.9MB

MD5
274e50ed79b85294c3efcd9eb1863e9c

SHA1
082b6c67b3fa79cabbd0ebab32c7d805cf6649d4

SHA256
d348c1955fb880759b4967df54db0b6de8a74c94030c5ec83320267cc5d91f70

SHA512
6bbc04ee8a2b16dc6ee98b3f20f4e23d8a160b810316ff3bb90782408bbcb30136e8f9f116837d70ea5eba77073285c118053a75d76c5e720bf69ff2c6beb321

Download Submit
C:\Windows\system\olNAuDF.exe

Filesize
1.9MB

MD5
b1041b1a5777d691af523561e2c4a534

SHA1
01cfba2364cc082bb58ed86ec54b2e54e979d7bc

SHA256
8794dc64e401973bb1705613b2a0a4d72bbd8b2ddab4c10300387470c0f5a051

SHA512
53a9adb842ac4be92d9b309b531e9f01132f92fe30962aba4060aa869d85f4245e8637e3af55486fa8c674a916a7ac5d5a0953ea9d1d82016a248dc097ea8dbd

Download Submit
C:\Windows\system\qFtynvC.exe

Filesize
1.9MB

MD5
d69b83f6588513307ce6606da646ff37

SHA1
b81334240d81dff593202d22179523da34f919e4

SHA256
12a1891a9c5ec7ed5b16b121b52c1da5b0422dbf34bc74e6975414c6ae22f2bc

SHA512
469ab6e3697a5933641718f9ba362e174e18639e49a97150562bb9d4a7b5f38ce95863cc0967a29f5c0944fc29408e5ec8b5ee86769676c4a65d384c0902fe08

Download Submit
C:\Windows\system\qTpPpGz.exe

Filesize
1.9MB

MD5
6b6dcd6a6ed56f04975aab62a99d1dab

SHA1
ee5f7878cf1a0806ac4290b4c4d94d52819379bb

SHA256
60a6d1946f9a78f7e2cc657f20e390279caab5534e4d79f577623d434447c4d6

SHA512
2ae9209f94bcddc37369c7109929540440b1b5cb13858d9bd5589e7485bfda7ab1543eba5f84aa776ad11ff2d767115c6f4b120c3028b456595499476255695c

Download Submit
C:\Windows\system\rgagzUF.exe

Filesize
1.9MB

MD5
fa2d9c1609d7d1e0ae3a3311967a8d19

SHA1
366b639f5448878087fb0158d010938a987e38ba

SHA256
70e8a2a9fde9acfd635bd4ed174c98b7e51d87a3e9e077ec3148d689d8244a97

SHA512
449463c4ecd3ee37dc38d12e6b81f1fde167495e0a5d6d56ae4239ecc1097e40c15acbf094f0e7a0dda5e99748500b273493f901d0df3f1bd4f23da3c9ff1ae8

Download Submit
C:\Windows\system\tLUSVXw.exe

Filesize
1.9MB

MD5
3cb5262b76addbff144e95a004b38508

SHA1
7487b6102748ca8e6c040ae3b0dcb6aa31f0ca09

SHA256
9dc77739e3b913b0971aa7389fd277f99b70103090f852c49e4808f081953c7e

SHA512
906bef4e6d25309a29cd9cfbdda7e49da10a0e4f5706bad233bc6bd581505cd00e1ffc843375a0e476c4cacad791295b3629accf1f4aa12f8241b958b1088b25

Download Submit
C:\Windows\system\xNEuAYr.exe

Filesize
1.9MB

MD5
4afc88e3f45c615545584139be172617

SHA1
8ea57e012561fb89dc830f1b7f3c25a1032b8d73

SHA256
c9f6f6214abbcf221f7abaab29695e4142cded7381f77934793c9711aa60457b

SHA512
bb569fe8c9597275cbff1e03635f3b944d9d3d30d78e78ec93c01e4db6e19ee17426030b34714276dbf4c427588a67a1414dc7073ae073cf0cf00c313033026f

Download Submit
C:\Windows\system\xxnDtOm.exe

Filesize
1.9MB

MD5
71a214b432ba6112ed0fca839d473cbc

SHA1
fce0dec27a3ef219348ca09a980cc8261d0f287a

SHA256
f5b8d7a78c4cfa89357171243279a8877b142e1a335a4252307d99b5843ac3f5

SHA512
878ad0d8f50f05f7e855c3fd25e6bf2476b10b5c380c1192ce24d096753dc745f285ae105243587f2ef3df62b77aa0a906dd67471128bac0d2ebaeab6abd7ecb

Download Submit
\Windows\system\QviVmrX.exe

Filesize
1.9MB

MD5
3bea98021a74f0c07cbcaf04160c9b89

SHA1
9280a90a5447a12c15c45bfaf4f7c2959f0f20b3

SHA256
86eced870c579a382ed5815d74db2e9db0f57e6c1f9f3a8695f046504264a5ab

SHA512
7da2cb4c6d98b36b2c61c8fd78252c6ffbbdad425a199b03836a9eb0c1bfa0baaf4fafaa205da1b72f980e82c97af553bd94c8e93ce85e9b43c084ead266df09

Download Submit
\Windows\system\mLKljBi.exe

Filesize
1.9MB

MD5
9770b5c39c39d1f04e7b606922f0d611

SHA1
0afa0172e66791da2da59f70c7bd0a6e4f863a1a

SHA256
06513b3149ec0ce55ff1a09250ba14130f4cfbbba49af31535825c319bf5b5a2

SHA512
8d8de1b45399824386c472014ae2e27a7ed91ce88437b2a0085d9f2765c4aaf77572a434734a8bc52ff57edac9591cd5d7496f2bcd41f0385f9281b0f87cc7bc

Download Submit
\Windows\system\mRruMTl.exe

Filesize
1.9MB

MD5
37eeea1b0d565c465332475274f8f938

SHA1
869ecd23d512ec1573a1d410e2654ac2272c0186

SHA256
7010a00d76e9ddf12c3d38708424bd1c825d5b8d417ccd608a6fb2cce40dfd0d

SHA512
3033596843f826f935be1c51276ea6be4eda00cc16613615dd4855f667ed69b650a368e2e1a4357913d1b1853d963663939c736f6197addb099f0bc2de6ffcd4

Download Submit
memory/1032-131-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/1032-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1032-141-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-145-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-139-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1032-147-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/1032-135-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-134-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-7-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/1032-143-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-0-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-10694-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/1032-128-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-152-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-156-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-154-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1032-10400-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-153-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-8417-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-126-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-150-0x0000000002670000-0x0000000002678000-memory.dmp

Filesize
32KB

Download
memory/2352-129-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/2352-1095-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-155-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/2352-13-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/2352-14-0x000007FEF607E000-0x000007FEF607F000-memory.dmp

Filesize
4KB

Download
memory/2392-7075-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2392-12-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2428-151-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2428-6853-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2436-6858-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2436-140-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2456-144-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-6855-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-146-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-6856-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-6832-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-142-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-6845-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2580-130-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2588-6849-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-137-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-6864-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2648-132-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/3040-6824-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/3040-127-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download