xmrig | a1c797e3d6805c140e774142866937b2a5f922afdc6caedc23574c0a479e150d

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
Size

1.8MB
MD5

0c460dcb75e5b2fca5a415b2981adf76
SHA1

f26e80a90e521d14012c424896a8afa6672d7dca
SHA256

a1c797e3d6805c140e774142866937b2a5f922afdc6caedc23574c0a479e150d
SHA512

b67e94ce4d40a81ebda76ecea24964facb8fad91aafee8ff735d903a648946a8b4f7e5842fa835ec6dc8f1bb9cf432e6b99f07dad5604fcbaa942e0886168fc1
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl6:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2652-13-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2976-59-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2424-64-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2020-65-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2676-55-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2700-46-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2468-43-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2580-41-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/1808-835-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2676-4367-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2424-4374-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2020-4422-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2976-4539-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2700-4597-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2344-5250-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/1632-5249-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2820-6353-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2652	yjbOUBs.exe
2580	mdKRHDK.exe
2468	lTgUsUa.exe
2700	dLsAKmz.exe
2676	qBucBBG.exe
2976	UiXTaZm.exe
2424	ImEKDvZ.exe
2020	WmtIZRm.exe
2820	TdFWELg.exe
2344	TAOyGKk.exe
1632	OwPzbvn.exe
956	wbxEwob.exe
2684	oigvKQN.exe
1648	hwqKdLK.exe
2656	coiZUDo.exe
2116	EKMWBJY.exe
944	pbQHrBJ.exe
1756	vvVxSHA.exe
1912	ZPpiCnN.exe
540	gWpyBHX.exe
2940	DYwBxFG.exe
1668	aZsqTig.exe
2272	RyosMjb.exe
1492	kdLzHBR.exe
2248	mdyWTdu.exe
2232	fGUmgut.exe
2076	NNPOTeQ.exe
268	bvnYukl.exe
2200	SnYEWxa.exe
592	QvTvkKr.exe
2936	iasogQA.exe
2552	PJTBfyk.exe
1964	bwJwyIe.exe
484	PHMWfnb.exe
1060	qgWkDAM.exe
1700	dZPIeFL.exe
2120	fECiTjZ.exe
1528	GKFkUXm.exe
1092	EiNjdRx.exe
1456	BvlDFTB.exe
980	GqbApDy.exe
700	mEhEyuX.exe
2252	wAleoeV.exe
2256	JYRsMou.exe
2024	xSWqIhj.exe
2040	SndeFOf.exe
2596	etkDhXU.exe
1720	wrDNOIu.exe
1644	QctkNhi.exe
1696	OeVzHLB.exe
1140	nyGSLyq.exe
1824	FxoxbNH.exe
2832	VrEUkck.exe
1724	KZkppeJ.exe
2992	utsKwDw.exe
2512	SZFEuWH.exe
3044	vlxqrBB.exe
2856	GoTsIvr.exe
2592	ZtojbhU.exe
2536	GFxMUwf.exe
2160	lWoHtRw.exe
1672	oFmgTcV.exe
2980	kQUPERj.exe
1816	VfbJWfb.exe

Loads dropped DLL 64 IoCs

pid	Process
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1808-0-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x000b000000015a2d-3.dat	upx
behavioral1/memory/2652-13-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x002b000000015c2f-16.dat	upx
behavioral1/files/0x000f0000000006fd-18.dat	upx
behavioral1/files/0x0009000000015c87-25.dat	upx
behavioral1/files/0x0012000000015c52-30.dat	upx
behavioral1/files/0x0007000000015cb9-38.dat	upx
behavioral1/files/0x0009000000015e02-47.dat	upx
behavioral1/memory/2976-59-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-61.dat	upx
behavioral1/memory/2424-64-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2020-65-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x000700000001663d-66.dat	upx
behavioral1/files/0x0006000000018ae8-73.dat	upx
behavioral1/memory/2820-74-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/1632-89-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2676-55-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0006000000018b96-123.dat	upx
behavioral1/files/0x0006000000018b73-120.dat	upx
behavioral1/files/0x0005000000019377-162.dat	upx
behavioral1/files/0x00050000000193b0-172.dat	upx
behavioral1/files/0x000500000001931b-150.dat	upx
behavioral1/files/0x0005000000019368-167.dat	upx
behavioral1/files/0x000500000001939b-186.dat	upx
behavioral1/files/0x000500000001946f-182.dat	upx
behavioral1/files/0x0005000000019410-173.dat	upx
behavioral1/files/0x0005000000019473-189.dat	upx
behavioral1/files/0x000500000001946b-180.dat	upx
behavioral1/files/0x00050000000192c9-136.dat	upx
behavioral1/files/0x0005000000019333-153.dat	upx
behavioral1/files/0x00050000000192f4-142.dat	upx
behavioral1/files/0x0006000000018ba2-130.dat	upx
behavioral1/files/0x0006000000018d06-134.dat	upx
behavioral1/files/0x0006000000018b4a-110.dat	upx
behavioral1/files/0x0006000000018b37-108.dat	upx
behavioral1/files/0x0006000000018b15-105.dat	upx
behavioral1/files/0x0006000000018ae2-95.dat	upx
behavioral1/files/0x0006000000018b6a-114.dat	upx
behavioral1/memory/2344-84-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-100.dat	upx
behavioral1/files/0x0006000000018b33-87.dat	upx
behavioral1/memory/2700-46-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2468-43-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2580-41-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/1808-835-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2676-4367-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2424-4374-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2020-4422-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2976-4539-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2700-4597-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2344-5250-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/1632-5249-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2820-6353-0x000000013FE90000-0x0000000140282000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gVxFUIM.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\TtMMgvt.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\xYjwYhj.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\zqoGEFD.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\fdIvfcV.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\ltSazxc.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\jrORCgS.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\YNYsPDR.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\qFekYdw.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\jNAmZYX.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\OvYHusx.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\rbpahmq.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\CeMiRXc.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\JacaltP.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\uYCabxf.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\RQljSFE.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\HeyLZVm.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\rvNxKqF.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\zMqTGXJ.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\gkaOatl.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\nvChhKW.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\DLeeRLQ.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\wlKuxRj.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\RcyCHjG.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\VCLiMJY.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\zwmTTHB.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\BGvRPeU.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\dtziqru.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\LxVwTZR.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\TkQEBuV.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\nvoJYNx.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\VhnJPXl.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\rtAoQcP.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\AhNeQyj.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\zhIdrgf.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\kigRKZO.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\iCAzdGF.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\GYklBbs.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\rthZLUF.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\FhICBfi.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\HCKwDBN.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\lNLAcTd.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\pMFaHCh.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\qNyySwX.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\IimCnJP.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\DMlrvVk.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\QXWOMRo.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\GCnEyzo.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\zsStHxX.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\SqNurFx.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\BFYgdrO.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\EWnPUdN.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\ZpwlRwm.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\pmLaUAs.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\YHxHyLj.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\xJiVBYi.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\kECQQMa.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\CTAMOnL.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\KbBwAUk.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\vrGJMOl.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\JrzVEoD.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\tvvuCBW.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\yniYITw.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
File created	C:\Windows\System\SAZdxQI.exe	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
Token: SeDebugPrivilege	2996	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2996	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2996	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2996	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2652	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2652	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2652	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2580	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2580	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2580	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2468	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2468	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2468	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2700	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2700	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2700	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2676	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	34
PID 1808 wrote to memory of 2676	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	34
PID 1808 wrote to memory of 2676	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	34
PID 1808 wrote to memory of 2976	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2976	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2976	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2424	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2424	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2424	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2820	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2820	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2820	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2020	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	38
PID 1808 wrote to memory of 2020	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	38
PID 1808 wrote to memory of 2020	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	38
PID 1808 wrote to memory of 956	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	39
PID 1808 wrote to memory of 956	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	39
PID 1808 wrote to memory of 956	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	39
PID 1808 wrote to memory of 2344	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	40
PID 1808 wrote to memory of 2344	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	40
PID 1808 wrote to memory of 2344	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	40
PID 1808 wrote to memory of 1648	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	41
PID 1808 wrote to memory of 1648	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	41
PID 1808 wrote to memory of 1648	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	41
PID 1808 wrote to memory of 1632	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	42
PID 1808 wrote to memory of 1632	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	42
PID 1808 wrote to memory of 1632	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	42
PID 1808 wrote to memory of 2656	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2656	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2656	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2684	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	44
PID 1808 wrote to memory of 2684	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	44
PID 1808 wrote to memory of 2684	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	44
PID 1808 wrote to memory of 2116	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	45
PID 1808 wrote to memory of 2116	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	45
PID 1808 wrote to memory of 2116	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	45
PID 1808 wrote to memory of 944	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	46
PID 1808 wrote to memory of 944	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	46
PID 1808 wrote to memory of 944	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	46
PID 1808 wrote to memory of 1756	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	47
PID 1808 wrote to memory of 1756	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	47
PID 1808 wrote to memory of 1756	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	47
PID 1808 wrote to memory of 1912	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	48
PID 1808 wrote to memory of 1912	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	48
PID 1808 wrote to memory of 1912	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	48
PID 1808 wrote to memory of 540	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	49
PID 1808 wrote to memory of 540	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	49
PID 1808 wrote to memory of 540	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	49
PID 1808 wrote to memory of 2940	1808	0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c460dcb75e5b2fca5a415b2981adf76_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System\yjbOUBs.exe
  C:\Windows\System\yjbOUBs.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\mdKRHDK.exe
  C:\Windows\System\mdKRHDK.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\lTgUsUa.exe
  C:\Windows\System\lTgUsUa.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\dLsAKmz.exe
  C:\Windows\System\dLsAKmz.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\qBucBBG.exe
  C:\Windows\System\qBucBBG.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\UiXTaZm.exe
  C:\Windows\System\UiXTaZm.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\ImEKDvZ.exe
  C:\Windows\System\ImEKDvZ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\TdFWELg.exe
  C:\Windows\System\TdFWELg.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\WmtIZRm.exe
  C:\Windows\System\WmtIZRm.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\wbxEwob.exe
  C:\Windows\System\wbxEwob.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\TAOyGKk.exe
  C:\Windows\System\TAOyGKk.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\hwqKdLK.exe
  C:\Windows\System\hwqKdLK.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\OwPzbvn.exe
  C:\Windows\System\OwPzbvn.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\coiZUDo.exe
  C:\Windows\System\coiZUDo.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\oigvKQN.exe
  C:\Windows\System\oigvKQN.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\EKMWBJY.exe
  C:\Windows\System\EKMWBJY.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\pbQHrBJ.exe
  C:\Windows\System\pbQHrBJ.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\vvVxSHA.exe
  C:\Windows\System\vvVxSHA.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\ZPpiCnN.exe
  C:\Windows\System\ZPpiCnN.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\gWpyBHX.exe
  C:\Windows\System\gWpyBHX.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\DYwBxFG.exe
  C:\Windows\System\DYwBxFG.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\RyosMjb.exe
  C:\Windows\System\RyosMjb.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\aZsqTig.exe
  C:\Windows\System\aZsqTig.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\kdLzHBR.exe
  C:\Windows\System\kdLzHBR.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\mdyWTdu.exe
  C:\Windows\System\mdyWTdu.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\NNPOTeQ.exe
  C:\Windows\System\NNPOTeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\fGUmgut.exe
  C:\Windows\System\fGUmgut.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\QvTvkKr.exe
  C:\Windows\System\QvTvkKr.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\bvnYukl.exe
  C:\Windows\System\bvnYukl.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\PJTBfyk.exe
  C:\Windows\System\PJTBfyk.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\SnYEWxa.exe
  C:\Windows\System\SnYEWxa.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\qgWkDAM.exe
  C:\Windows\System\qgWkDAM.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\iasogQA.exe
  C:\Windows\System\iasogQA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\fECiTjZ.exe
  C:\Windows\System\fECiTjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\bwJwyIe.exe
  C:\Windows\System\bwJwyIe.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\BvlDFTB.exe
  C:\Windows\System\BvlDFTB.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\PHMWfnb.exe
  C:\Windows\System\PHMWfnb.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\GqbApDy.exe
  C:\Windows\System\GqbApDy.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\dZPIeFL.exe
  C:\Windows\System\dZPIeFL.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\mEhEyuX.exe
  C:\Windows\System\mEhEyuX.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\GKFkUXm.exe
  C:\Windows\System\GKFkUXm.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\wAleoeV.exe
  C:\Windows\System\wAleoeV.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\EiNjdRx.exe
  C:\Windows\System\EiNjdRx.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\JYRsMou.exe
  C:\Windows\System\JYRsMou.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\xSWqIhj.exe
  C:\Windows\System\xSWqIhj.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\SndeFOf.exe
  C:\Windows\System\SndeFOf.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\etkDhXU.exe
  C:\Windows\System\etkDhXU.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\wrDNOIu.exe
  C:\Windows\System\wrDNOIu.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\QctkNhi.exe
  C:\Windows\System\QctkNhi.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\nyGSLyq.exe
  C:\Windows\System\nyGSLyq.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\OeVzHLB.exe
  C:\Windows\System\OeVzHLB.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\FxoxbNH.exe
  C:\Windows\System\FxoxbNH.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\VrEUkck.exe
  C:\Windows\System\VrEUkck.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\KZkppeJ.exe
  C:\Windows\System\KZkppeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\utsKwDw.exe
  C:\Windows\System\utsKwDw.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\SZFEuWH.exe
  C:\Windows\System\SZFEuWH.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\vlxqrBB.exe
  C:\Windows\System\vlxqrBB.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\GoTsIvr.exe
  C:\Windows\System\GoTsIvr.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\ZtojbhU.exe
  C:\Windows\System\ZtojbhU.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\GFxMUwf.exe
  C:\Windows\System\GFxMUwf.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\lWoHtRw.exe
  C:\Windows\System\lWoHtRw.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\oFmgTcV.exe
  C:\Windows\System\oFmgTcV.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\kQUPERj.exe
  C:\Windows\System\kQUPERj.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\rvjlpvj.exe
  C:\Windows\System\rvjlpvj.exe
  2⤵
  PID:2704
- C:\Windows\System\VfbJWfb.exe
  C:\Windows\System\VfbJWfb.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\nJmbHbn.exe
  C:\Windows\System\nJmbHbn.exe
  2⤵
  PID:2464
- C:\Windows\System\uIqMMwp.exe
  C:\Windows\System\uIqMMwp.exe
  2⤵
  PID:1776
- C:\Windows\System\gGAWCRm.exe
  C:\Windows\System\gGAWCRm.exe
  2⤵
  PID:940
- C:\Windows\System\wWmjITB.exe
  C:\Windows\System\wWmjITB.exe
  2⤵
  PID:1412
- C:\Windows\System\XsFJRpq.exe
  C:\Windows\System\XsFJRpq.exe
  2⤵
  PID:1476
- C:\Windows\System\UNmxdpE.exe
  C:\Windows\System\UNmxdpE.exe
  2⤵
  PID:472
- C:\Windows\System\ZETbWNb.exe
  C:\Windows\System\ZETbWNb.exe
  2⤵
  PID:2876
- C:\Windows\System\mSIhRNi.exe
  C:\Windows\System\mSIhRNi.exe
  2⤵
  PID:1424
- C:\Windows\System\kxmJGEa.exe
  C:\Windows\System\kxmJGEa.exe
  2⤵
  PID:332
- C:\Windows\System\ypYDovg.exe
  C:\Windows\System\ypYDovg.exe
  2⤵
  PID:1148
- C:\Windows\System\AdMYbWZ.exe
  C:\Windows\System\AdMYbWZ.exe
  2⤵
  PID:1784
- C:\Windows\System\hPCOvGG.exe
  C:\Windows\System\hPCOvGG.exe
  2⤵
  PID:1604
- C:\Windows\System\LSqMZMD.exe
  C:\Windows\System\LSqMZMD.exe
  2⤵
  PID:524
- C:\Windows\System\hcLgIyO.exe
  C:\Windows\System\hcLgIyO.exe
  2⤵
  PID:2732
- C:\Windows\System\OXUOwPy.exe
  C:\Windows\System\OXUOwPy.exe
  2⤵
  PID:2584
- C:\Windows\System\VmHmPip.exe
  C:\Windows\System\VmHmPip.exe
  2⤵
  PID:1172
- C:\Windows\System\XyyEinx.exe
  C:\Windows\System\XyyEinx.exe
  2⤵
  PID:1552
- C:\Windows\System\SdPBtoW.exe
  C:\Windows\System\SdPBtoW.exe
  2⤵
  PID:1608
- C:\Windows\System\aRyKdkJ.exe
  C:\Windows\System\aRyKdkJ.exe
  2⤵
  PID:1664
- C:\Windows\System\PPEYUmv.exe
  C:\Windows\System\PPEYUmv.exe
  2⤵
  PID:1212
- C:\Windows\System\xsgueak.exe
  C:\Windows\System\xsgueak.exe
  2⤵
  PID:1744
- C:\Windows\System\PUqPFgx.exe
  C:\Windows\System\PUqPFgx.exe
  2⤵
  PID:2204
- C:\Windows\System\NLaBXGn.exe
  C:\Windows\System\NLaBXGn.exe
  2⤵
  PID:1916
- C:\Windows\System\CJVMDuA.exe
  C:\Windows\System\CJVMDuA.exe
  2⤵
  PID:2788
- C:\Windows\System\RUiZTjz.exe
  C:\Windows\System\RUiZTjz.exe
  2⤵
  PID:1940
- C:\Windows\System\OgEtYVG.exe
  C:\Windows\System\OgEtYVG.exe
  2⤵
  PID:2016
- C:\Windows\System\YLiOqOQ.exe
  C:\Windows\System\YLiOqOQ.exe
  2⤵
  PID:632
- C:\Windows\System\OmDXTXT.exe
  C:\Windows\System\OmDXTXT.exe
  2⤵
  PID:2816
- C:\Windows\System\HquaUUl.exe
  C:\Windows\System\HquaUUl.exe
  2⤵
  PID:2336
- C:\Windows\System\QQOVAnY.exe
  C:\Windows\System\QQOVAnY.exe
  2⤵
  PID:2896
- C:\Windows\System\WkzoyFk.exe
  C:\Windows\System\WkzoyFk.exe
  2⤵
  PID:1992
- C:\Windows\System\IzUdlPz.exe
  C:\Windows\System\IzUdlPz.exe
  2⤵
  PID:2144
- C:\Windows\System\shGHHVb.exe
  C:\Windows\System\shGHHVb.exe
  2⤵
  PID:584
- C:\Windows\System\runAeyu.exe
  C:\Windows\System\runAeyu.exe
  2⤵
  PID:2056
- C:\Windows\System\jGoDong.exe
  C:\Windows\System\jGoDong.exe
  2⤵
  PID:1828
- C:\Windows\System\TmavBtl.exe
  C:\Windows\System\TmavBtl.exe
  2⤵
  PID:1160
- C:\Windows\System\IskhrMe.exe
  C:\Windows\System\IskhrMe.exe
  2⤵
  PID:2052
- C:\Windows\System\NjiRpew.exe
  C:\Windows\System\NjiRpew.exe
  2⤵
  PID:1692
- C:\Windows\System\MwERdRL.exe
  C:\Windows\System\MwERdRL.exe
  2⤵
  PID:2308
- C:\Windows\System\uNtmuvX.exe
  C:\Windows\System\uNtmuvX.exe
  2⤵
  PID:2736
- C:\Windows\System\OazYZjv.exe
  C:\Windows\System\OazYZjv.exe
  2⤵
  PID:2628
- C:\Windows\System\lCRCWbI.exe
  C:\Windows\System\lCRCWbI.exe
  2⤵
  PID:2644
- C:\Windows\System\FuYPkCj.exe
  C:\Windows\System\FuYPkCj.exe
  2⤵
  PID:2436
- C:\Windows\System\grpRNTv.exe
  C:\Windows\System\grpRNTv.exe
  2⤵
  PID:708
- C:\Windows\System\tfpCcTt.exe
  C:\Windows\System\tfpCcTt.exe
  2⤵
  PID:3024
- C:\Windows\System\unOCXjZ.exe
  C:\Windows\System\unOCXjZ.exe
  2⤵
  PID:2080
- C:\Windows\System\wzCkHGj.exe
  C:\Windows\System\wzCkHGj.exe
  2⤵
  PID:2928
- C:\Windows\System\DsXtdgy.exe
  C:\Windows\System\DsXtdgy.exe
  2⤵
  PID:2812
- C:\Windows\System\avfAQEQ.exe
  C:\Windows\System\avfAQEQ.exe
  2⤵
  PID:880
- C:\Windows\System\bdGGyvn.exe
  C:\Windows\System\bdGGyvn.exe
  2⤵
  PID:1484
- C:\Windows\System\hpfsHPZ.exe
  C:\Windows\System\hpfsHPZ.exe
  2⤵
  PID:2112
- C:\Windows\System\HxSphNB.exe
  C:\Windows\System\HxSphNB.exe
  2⤵
  PID:1288
- C:\Windows\System\ROnBzjS.exe
  C:\Windows\System\ROnBzjS.exe
  2⤵
  PID:1728
- C:\Windows\System\kHTsvJz.exe
  C:\Windows\System\kHTsvJz.exe
  2⤵
  PID:1276
- C:\Windows\System\KBAKLiX.exe
  C:\Windows\System\KBAKLiX.exe
  2⤵
  PID:1908
- C:\Windows\System\wblFNlB.exe
  C:\Windows\System\wblFNlB.exe
  2⤵
  PID:1972
- C:\Windows\System\DyblyVt.exe
  C:\Windows\System\DyblyVt.exe
  2⤵
  PID:676
- C:\Windows\System\SOWUesr.exe
  C:\Windows\System\SOWUesr.exe
  2⤵
  PID:1080
- C:\Windows\System\KgUgDvZ.exe
  C:\Windows\System\KgUgDvZ.exe
  2⤵
  PID:2304
- C:\Windows\System\TTXuDrL.exe
  C:\Windows\System\TTXuDrL.exe
  2⤵
  PID:2904
- C:\Windows\System\whyaCRw.exe
  C:\Windows\System\whyaCRw.exe
  2⤵
  PID:1688
- C:\Windows\System\wapbpkx.exe
  C:\Windows\System\wapbpkx.exe
  2⤵
  PID:1164
- C:\Windows\System\eGKbrlf.exe
  C:\Windows\System\eGKbrlf.exe
  2⤵
  PID:2276
- C:\Windows\System\WEtpzrj.exe
  C:\Windows\System\WEtpzrj.exe
  2⤵
  PID:2384
- C:\Windows\System\CsewjTK.exe
  C:\Windows\System\CsewjTK.exe
  2⤵
  PID:3040
- C:\Windows\System\eoQwlvu.exe
  C:\Windows\System\eoQwlvu.exe
  2⤵
  PID:1980
- C:\Windows\System\FtmZpHB.exe
  C:\Windows\System\FtmZpHB.exe
  2⤵
  PID:1388
- C:\Windows\System\KFlykeK.exe
  C:\Windows\System\KFlykeK.exe
  2⤵
  PID:3084
- C:\Windows\System\gLEMPzW.exe
  C:\Windows\System\gLEMPzW.exe
  2⤵
  PID:3100
- C:\Windows\System\ppKHWNv.exe
  C:\Windows\System\ppKHWNv.exe
  2⤵
  PID:3116
- C:\Windows\System\uhyUGLE.exe
  C:\Windows\System\uhyUGLE.exe
  2⤵
  PID:3132
- C:\Windows\System\CjFUtEa.exe
  C:\Windows\System\CjFUtEa.exe
  2⤵
  PID:3152
- C:\Windows\System\OiWJFZn.exe
  C:\Windows\System\OiWJFZn.exe
  2⤵
  PID:3172
- C:\Windows\System\pxWYDxm.exe
  C:\Windows\System\pxWYDxm.exe
  2⤵
  PID:3188
- C:\Windows\System\IJtHZEQ.exe
  C:\Windows\System\IJtHZEQ.exe
  2⤵
  PID:3204
- C:\Windows\System\MJogTii.exe
  C:\Windows\System\MJogTii.exe
  2⤵
  PID:3220
- C:\Windows\System\DwbJKcD.exe
  C:\Windows\System\DwbJKcD.exe
  2⤵
  PID:3236
- C:\Windows\System\YCpqevH.exe
  C:\Windows\System\YCpqevH.exe
  2⤵
  PID:3252
- C:\Windows\System\gbgavpn.exe
  C:\Windows\System\gbgavpn.exe
  2⤵
  PID:3268
- C:\Windows\System\iGXCrCp.exe
  C:\Windows\System\iGXCrCp.exe
  2⤵
  PID:3284
- C:\Windows\System\dtLqQzA.exe
  C:\Windows\System\dtLqQzA.exe
  2⤵
  PID:3304
- C:\Windows\System\PSggKSI.exe
  C:\Windows\System\PSggKSI.exe
  2⤵
  PID:3320
- C:\Windows\System\quQzBjb.exe
  C:\Windows\System\quQzBjb.exe
  2⤵
  PID:3336
- C:\Windows\System\KckLoYe.exe
  C:\Windows\System\KckLoYe.exe
  2⤵
  PID:3356
- C:\Windows\System\yZSuTMO.exe
  C:\Windows\System\yZSuTMO.exe
  2⤵
  PID:3372
- C:\Windows\System\dBiFZuK.exe
  C:\Windows\System\dBiFZuK.exe
  2⤵
  PID:3388
- C:\Windows\System\RlyDYIQ.exe
  C:\Windows\System\RlyDYIQ.exe
  2⤵
  PID:3404
- C:\Windows\System\cLehvql.exe
  C:\Windows\System\cLehvql.exe
  2⤵
  PID:3420
- C:\Windows\System\nmIXQdd.exe
  C:\Windows\System\nmIXQdd.exe
  2⤵
  PID:3436
- C:\Windows\System\ossPRcE.exe
  C:\Windows\System\ossPRcE.exe
  2⤵
  PID:3452
- C:\Windows\System\lwmTPwQ.exe
  C:\Windows\System\lwmTPwQ.exe
  2⤵
  PID:3468
- C:\Windows\System\TQSbZPP.exe
  C:\Windows\System\TQSbZPP.exe
  2⤵
  PID:3484
- C:\Windows\System\YgbktoP.exe
  C:\Windows\System\YgbktoP.exe
  2⤵
  PID:3500
- C:\Windows\System\bRygwYi.exe
  C:\Windows\System\bRygwYi.exe
  2⤵
  PID:3516
- C:\Windows\System\CqPUqrb.exe
  C:\Windows\System\CqPUqrb.exe
  2⤵
  PID:3532
- C:\Windows\System\XURkKxb.exe
  C:\Windows\System\XURkKxb.exe
  2⤵
  PID:3548
- C:\Windows\System\vtuEsfc.exe
  C:\Windows\System\vtuEsfc.exe
  2⤵
  PID:3564
- C:\Windows\System\KbBwAUk.exe
  C:\Windows\System\KbBwAUk.exe
  2⤵
  PID:3584
- C:\Windows\System\eRSZHWn.exe
  C:\Windows\System\eRSZHWn.exe
  2⤵
  PID:3612
- C:\Windows\System\tgQYPQw.exe
  C:\Windows\System\tgQYPQw.exe
  2⤵
  PID:3744
- C:\Windows\System\YDqvhET.exe
  C:\Windows\System\YDqvhET.exe
  2⤵
  PID:3764
- C:\Windows\System\aVzDXKd.exe
  C:\Windows\System\aVzDXKd.exe
  2⤵
  PID:3780
- C:\Windows\System\VHCupWR.exe
  C:\Windows\System\VHCupWR.exe
  2⤵
  PID:3796
- C:\Windows\System\TIvybFd.exe
  C:\Windows\System\TIvybFd.exe
  2⤵
  PID:3812
- C:\Windows\System\CKqKeAv.exe
  C:\Windows\System\CKqKeAv.exe
  2⤵
  PID:3828
- C:\Windows\System\NJNsfSV.exe
  C:\Windows\System\NJNsfSV.exe
  2⤵
  PID:3844
- C:\Windows\System\yyizjvf.exe
  C:\Windows\System\yyizjvf.exe
  2⤵
  PID:3860
- C:\Windows\System\CWcbCtl.exe
  C:\Windows\System\CWcbCtl.exe
  2⤵
  PID:3876
- C:\Windows\System\xLwsKiy.exe
  C:\Windows\System\xLwsKiy.exe
  2⤵
  PID:3892
- C:\Windows\System\fqHjxNG.exe
  C:\Windows\System\fqHjxNG.exe
  2⤵
  PID:3908
- C:\Windows\System\kOQRlVm.exe
  C:\Windows\System\kOQRlVm.exe
  2⤵
  PID:3924
- C:\Windows\System\uATAYBf.exe
  C:\Windows\System\uATAYBf.exe
  2⤵
  PID:3940
- C:\Windows\System\gfQxffQ.exe
  C:\Windows\System\gfQxffQ.exe
  2⤵
  PID:3956
- C:\Windows\System\LkXoDXa.exe
  C:\Windows\System\LkXoDXa.exe
  2⤵
  PID:3976
- C:\Windows\System\vyBEicb.exe
  C:\Windows\System\vyBEicb.exe
  2⤵
  PID:3992
- C:\Windows\System\XiApUvz.exe
  C:\Windows\System\XiApUvz.exe
  2⤵
  PID:4008
- C:\Windows\System\oUEDAuH.exe
  C:\Windows\System\oUEDAuH.exe
  2⤵
  PID:4024
- C:\Windows\System\TZcXRmq.exe
  C:\Windows\System\TZcXRmq.exe
  2⤵
  PID:4040
- C:\Windows\System\KrgElKo.exe
  C:\Windows\System\KrgElKo.exe
  2⤵
  PID:4056
- C:\Windows\System\qfrLKEt.exe
  C:\Windows\System\qfrLKEt.exe
  2⤵
  PID:4072
- C:\Windows\System\YnYsCLe.exe
  C:\Windows\System\YnYsCLe.exe
  2⤵
  PID:4088
- C:\Windows\System\alwsZcV.exe
  C:\Windows\System\alwsZcV.exe
  2⤵
  PID:1508
- C:\Windows\System\dzaueRA.exe
  C:\Windows\System\dzaueRA.exe
  2⤵
  PID:2888
- C:\Windows\System\Qabtptw.exe
  C:\Windows\System\Qabtptw.exe
  2⤵
  PID:2088
- C:\Windows\System\yFwBIhQ.exe
  C:\Windows\System\yFwBIhQ.exe
  2⤵
  PID:872
- C:\Windows\System\iTYoVKL.exe
  C:\Windows\System\iTYoVKL.exe
  2⤵
  PID:796
- C:\Windows\System\bUodpvJ.exe
  C:\Windows\System\bUodpvJ.exe
  2⤵
  PID:2744
- C:\Windows\System\YCOqyGy.exe
  C:\Windows\System\YCOqyGy.exe
  2⤵
  PID:776
- C:\Windows\System\ZRuEdPg.exe
  C:\Windows\System\ZRuEdPg.exe
  2⤵
  PID:2616
- C:\Windows\System\EGubrEN.exe
  C:\Windows\System\EGubrEN.exe
  2⤵
  PID:2532
- C:\Windows\System\LoWZSHw.exe
  C:\Windows\System\LoWZSHw.exe
  2⤵
  PID:2952
- C:\Windows\System\yWxAdRt.exe
  C:\Windows\System\yWxAdRt.exe
  2⤵
  PID:2444
- C:\Windows\System\iOWtRIz.exe
  C:\Windows\System\iOWtRIz.exe
  2⤵
  PID:3196
- C:\Windows\System\LaNqtQi.exe
  C:\Windows\System\LaNqtQi.exe
  2⤵
  PID:3160
- C:\Windows\System\fZNBbaP.exe
  C:\Windows\System\fZNBbaP.exe
  2⤵
  PID:3264
- C:\Windows\System\IdQVwNx.exe
  C:\Windows\System\IdQVwNx.exe
  2⤵
  PID:3328
- C:\Windows\System\gSnhlTW.exe
  C:\Windows\System\gSnhlTW.exe
  2⤵
  PID:3396
- C:\Windows\System\izUwvcC.exe
  C:\Windows\System\izUwvcC.exe
  2⤵
  PID:3460
- C:\Windows\System\BTMBZgO.exe
  C:\Windows\System\BTMBZgO.exe
  2⤵
  PID:3524
- C:\Windows\System\GCfeBbV.exe
  C:\Windows\System\GCfeBbV.exe
  2⤵
  PID:3596
- C:\Windows\System\IizYBrj.exe
  C:\Windows\System\IizYBrj.exe
  2⤵
  PID:3144
- C:\Windows\System\cBgibnw.exe
  C:\Windows\System\cBgibnw.exe
  2⤵
  PID:3244
- C:\Windows\System\lhhqYId.exe
  C:\Windows\System\lhhqYId.exe
  2⤵
  PID:3348
- C:\Windows\System\MruMFRa.exe
  C:\Windows\System\MruMFRa.exe
  2⤵
  PID:2012
- C:\Windows\System\bBQrrMh.exe
  C:\Windows\System\bBQrrMh.exe
  2⤵
  PID:4112
- C:\Windows\System\CSFqvxV.exe
  C:\Windows\System\CSFqvxV.exe
  2⤵
  PID:4128
- C:\Windows\System\SqNurFx.exe
  C:\Windows\System\SqNurFx.exe
  2⤵
  PID:4144
- C:\Windows\System\gYIlden.exe
  C:\Windows\System\gYIlden.exe
  2⤵
  PID:4160
- C:\Windows\System\YwuzAZL.exe
  C:\Windows\System\YwuzAZL.exe
  2⤵
  PID:4176
- C:\Windows\System\MNYaMVX.exe
  C:\Windows\System\MNYaMVX.exe
  2⤵
  PID:4192
- C:\Windows\System\hZaZqrv.exe
  C:\Windows\System\hZaZqrv.exe
  2⤵
  PID:4208
- C:\Windows\System\nNtPigL.exe
  C:\Windows\System\nNtPigL.exe
  2⤵
  PID:4224
- C:\Windows\System\RGHtzYA.exe
  C:\Windows\System\RGHtzYA.exe
  2⤵
  PID:4244
- C:\Windows\System\ezUabcV.exe
  C:\Windows\System\ezUabcV.exe
  2⤵
  PID:4260
- C:\Windows\System\EiExsVR.exe
  C:\Windows\System\EiExsVR.exe
  2⤵
  PID:4276
- C:\Windows\System\gkquckO.exe
  C:\Windows\System\gkquckO.exe
  2⤵
  PID:4292
- C:\Windows\System\mLqMQIc.exe
  C:\Windows\System\mLqMQIc.exe
  2⤵
  PID:4308
- C:\Windows\System\nkUkIvw.exe
  C:\Windows\System\nkUkIvw.exe
  2⤵
  PID:4324
- C:\Windows\System\dHgMnVA.exe
  C:\Windows\System\dHgMnVA.exe
  2⤵
  PID:4340
- C:\Windows\System\zqgMdtu.exe
  C:\Windows\System\zqgMdtu.exe
  2⤵
  PID:4356
- C:\Windows\System\RPeZmOW.exe
  C:\Windows\System\RPeZmOW.exe
  2⤵
  PID:4372
- C:\Windows\System\wbYvKfY.exe
  C:\Windows\System\wbYvKfY.exe
  2⤵
  PID:4388
- C:\Windows\System\jttJkPi.exe
  C:\Windows\System\jttJkPi.exe
  2⤵
  PID:4404
- C:\Windows\System\nliwTwW.exe
  C:\Windows\System\nliwTwW.exe
  2⤵
  PID:4420
- C:\Windows\System\EjXCaOz.exe
  C:\Windows\System\EjXCaOz.exe
  2⤵
  PID:4436
- C:\Windows\System\FIPHooq.exe
  C:\Windows\System\FIPHooq.exe
  2⤵
  PID:4704
- C:\Windows\System\tQhLnTm.exe
  C:\Windows\System\tQhLnTm.exe
  2⤵
  PID:4728
- C:\Windows\System\NtYrQCP.exe
  C:\Windows\System\NtYrQCP.exe
  2⤵
  PID:4748
- C:\Windows\System\yhQkBWh.exe
  C:\Windows\System\yhQkBWh.exe
  2⤵
  PID:4784
- C:\Windows\System\gONyWNx.exe
  C:\Windows\System\gONyWNx.exe
  2⤵
  PID:4800
- C:\Windows\System\oGmRVGE.exe
  C:\Windows\System\oGmRVGE.exe
  2⤵
  PID:4816
- C:\Windows\System\oEnVRAV.exe
  C:\Windows\System\oEnVRAV.exe
  2⤵
  PID:4832
- C:\Windows\System\nUcInMU.exe
  C:\Windows\System\nUcInMU.exe
  2⤵
  PID:4848
- C:\Windows\System\KFNudOQ.exe
  C:\Windows\System\KFNudOQ.exe
  2⤵
  PID:4864
- C:\Windows\System\mzDXwcj.exe
  C:\Windows\System\mzDXwcj.exe
  2⤵
  PID:4880
- C:\Windows\System\bZpputP.exe
  C:\Windows\System\bZpputP.exe
  2⤵
  PID:4896
- C:\Windows\System\llGLimG.exe
  C:\Windows\System\llGLimG.exe
  2⤵
  PID:4916
- C:\Windows\System\itpOVsU.exe
  C:\Windows\System\itpOVsU.exe
  2⤵
  PID:5060
- C:\Windows\System\mbpKgvh.exe
  C:\Windows\System\mbpKgvh.exe
  2⤵
  PID:5092
- C:\Windows\System\veKNceL.exe
  C:\Windows\System\veKNceL.exe
  2⤵
  PID:5108
- C:\Windows\System\FrvzIYR.exe
  C:\Windows\System\FrvzIYR.exe
  2⤵
  PID:760
- C:\Windows\System\mZLMSdZ.exe
  C:\Windows\System\mZLMSdZ.exe
  2⤵
  PID:3756
- C:\Windows\System\pJUWjgc.exe
  C:\Windows\System\pJUWjgc.exe
  2⤵
  PID:3820
- C:\Windows\System\CDzdyup.exe
  C:\Windows\System\CDzdyup.exe
  2⤵
  PID:3620
- C:\Windows\System\zHQcHSQ.exe
  C:\Windows\System\zHQcHSQ.exe
  2⤵
  PID:3632
- C:\Windows\System\koOwGsh.exe
  C:\Windows\System\koOwGsh.exe
  2⤵
  PID:2152
- C:\Windows\System\EnlVQtj.exe
  C:\Windows\System\EnlVQtj.exe
  2⤵
  PID:2912
- C:\Windows\System\ojfApQg.exe
  C:\Windows\System\ojfApQg.exe
  2⤵
  PID:2564
- C:\Windows\System\VeMadIM.exe
  C:\Windows\System\VeMadIM.exe
  2⤵
  PID:3712
- C:\Windows\System\oSNfUfx.exe
  C:\Windows\System\oSNfUfx.exe
  2⤵
  PID:3076
- C:\Windows\System\bsveRhd.exe
  C:\Windows\System\bsveRhd.exe
  2⤵
  PID:3888
- C:\Windows\System\icIRBgu.exe
  C:\Windows\System\icIRBgu.exe
  2⤵
  PID:3952
- C:\Windows\System\PwHpolE.exe
  C:\Windows\System\PwHpolE.exe
  2⤵
  PID:4020
- C:\Windows\System\GGFmKVS.exe
  C:\Windows\System\GGFmKVS.exe
  2⤵
  PID:4084
- C:\Windows\System\SRxHLCP.exe
  C:\Windows\System\SRxHLCP.exe
  2⤵
  PID:936
- C:\Windows\System\dqiWQdd.exe
  C:\Windows\System\dqiWQdd.exe
  2⤵
  PID:2692
- C:\Windows\System\aORLqQf.exe
  C:\Windows\System\aORLqQf.exe
  2⤵
  PID:3232
- C:\Windows\System\GfaegCV.exe
  C:\Windows\System\GfaegCV.exe
  2⤵
  PID:3492
- C:\Windows\System\qsQKFtt.exe
  C:\Windows\System\qsQKFtt.exe
  2⤵
  PID:1712
- C:\Windows\System\qHaDSGZ.exe
  C:\Windows\System\qHaDSGZ.exe
  2⤵
  PID:4232
- C:\Windows\System\mUbsepr.exe
  C:\Windows\System\mUbsepr.exe
  2⤵
  PID:4300
- C:\Windows\System\HYmUgoh.exe
  C:\Windows\System\HYmUgoh.exe
  2⤵
  PID:4364
- C:\Windows\System\UxxTpHJ.exe
  C:\Windows\System\UxxTpHJ.exe
  2⤵
  PID:4428
- C:\Windows\System\fVyAIEe.exe
  C:\Windows\System\fVyAIEe.exe
  2⤵
  PID:3184
- C:\Windows\System\KRMUccD.exe
  C:\Windows\System\KRMUccD.exe
  2⤵
  PID:1368
- C:\Windows\System\BFmfjWp.exe
  C:\Windows\System\BFmfjWp.exe
  2⤵
  PID:2456
- C:\Windows\System\iqiJGEB.exe
  C:\Windows\System\iqiJGEB.exe
  2⤵
  PID:3344
- C:\Windows\System\rErbzmH.exe
  C:\Windows\System\rErbzmH.exe
  2⤵
  PID:2620
- C:\Windows\System\nFmQzdo.exe
  C:\Windows\System\nFmQzdo.exe
  2⤵
  PID:4768
- C:\Windows\System\ZcDMpsb.exe
  C:\Windows\System\ZcDMpsb.exe
  2⤵
  PID:3652
- C:\Windows\System\bMEHhxP.exe
  C:\Windows\System\bMEHhxP.exe
  2⤵
  PID:3672
- C:\Windows\System\JLUvQpL.exe
  C:\Windows\System\JLUvQpL.exe
  2⤵
  PID:1440
- C:\Windows\System\YbIRjEp.exe
  C:\Windows\System\YbIRjEp.exe
  2⤵
  PID:3692
- C:\Windows\System\lPUsrok.exe
  C:\Windows\System\lPUsrok.exe
  2⤵
  PID:1764
- C:\Windows\System\DLeeRLQ.exe
  C:\Windows\System\DLeeRLQ.exe
  2⤵
  PID:3728
- C:\Windows\System\TbWeYdx.exe
  C:\Windows\System\TbWeYdx.exe
  2⤵
  PID:4592
- C:\Windows\System\ClBSify.exe
  C:\Windows\System\ClBSify.exe
  2⤵
  PID:4640
- C:\Windows\System\estzmRc.exe
  C:\Windows\System\estzmRc.exe
  2⤵
  PID:2768
- C:\Windows\System\MIxBzNe.exe
  C:\Windows\System\MIxBzNe.exe
  2⤵
  PID:4872
- C:\Windows\System\AjepxJu.exe
  C:\Windows\System\AjepxJu.exe
  2⤵
  PID:4812
- C:\Windows\System\lOzmnWC.exe
  C:\Windows\System\lOzmnWC.exe
  2⤵
  PID:4912
- C:\Windows\System\xewGbBS.exe
  C:\Windows\System\xewGbBS.exe
  2⤵
  PID:3572
- C:\Windows\System\DLRnCQX.exe
  C:\Windows\System\DLRnCQX.exe
  2⤵
  PID:4528
- C:\Windows\System\hgqGbAC.exe
  C:\Windows\System\hgqGbAC.exe
  2⤵
  PID:4552
- C:\Windows\System\vYvldqX.exe
  C:\Windows\System\vYvldqX.exe
  2⤵
  PID:4576
- C:\Windows\System\OBiGmGz.exe
  C:\Windows\System\OBiGmGz.exe
  2⤵
  PID:4608
- C:\Windows\System\AamyIfp.exe
  C:\Windows\System\AamyIfp.exe
  2⤵
  PID:3972
- C:\Windows\System\kxkAkUG.exe
  C:\Windows\System\kxkAkUG.exe
  2⤵
  PID:3904
- C:\Windows\System\OPiPnHM.exe
  C:\Windows\System\OPiPnHM.exe
  2⤵
  PID:4000
- C:\Windows\System\dvRIFRX.exe
  C:\Windows\System\dvRIFRX.exe
  2⤵
  PID:2600
- C:\Windows\System\AlMnFQI.exe
  C:\Windows\System\AlMnFQI.exe
  2⤵
  PID:3300
- C:\Windows\System\ElainpR.exe
  C:\Windows\System\ElainpR.exe
  2⤵
  PID:3216
- C:\Windows\System\wnLpcch.exe
  C:\Windows\System\wnLpcch.exe
  2⤵
  PID:4184
- C:\Windows\System\qKKkJFm.exe
  C:\Windows\System\qKKkJFm.exe
  2⤵
  PID:4256
- C:\Windows\System\vWociwl.exe
  C:\Windows\System\vWociwl.exe
  2⤵
  PID:4320
- C:\Windows\System\VNmjozn.exe
  C:\Windows\System\VNmjozn.exe
  2⤵
  PID:4736
- C:\Windows\System\RarxEMy.exe
  C:\Windows\System\RarxEMy.exe
  2⤵
  PID:4416
- C:\Windows\System\NFamFyp.exe
  C:\Windows\System\NFamFyp.exe
  2⤵
  PID:4464
- C:\Windows\System\sImMpcH.exe
  C:\Windows\System\sImMpcH.exe
  2⤵
  PID:4484
- C:\Windows\System\YThHPAE.exe
  C:\Windows\System\YThHPAE.exe
  2⤵
  PID:1656
- C:\Windows\System\NhTkDOq.exe
  C:\Windows\System\NhTkDOq.exe
  2⤵
  PID:2668
- C:\Windows\System\ssycElw.exe
  C:\Windows\System\ssycElw.exe
  2⤵
  PID:4932
- C:\Windows\System\aBnFlZc.exe
  C:\Windows\System\aBnFlZc.exe
  2⤵
  PID:4660
- C:\Windows\System\CkwBFta.exe
  C:\Windows\System\CkwBFta.exe
  2⤵
  PID:4676
- C:\Windows\System\PnMJLNf.exe
  C:\Windows\System\PnMJLNf.exe
  2⤵
  PID:4692
- C:\Windows\System\XUAfPHs.exe
  C:\Windows\System\XUAfPHs.exe
  2⤵
  PID:4744
- C:\Windows\System\LYEbDZu.exe
  C:\Windows\System\LYEbDZu.exe
  2⤵
  PID:4952
- C:\Windows\System\KcFCCiF.exe
  C:\Windows\System\KcFCCiF.exe
  2⤵
  PID:4972
- C:\Windows\System\xpBXFGZ.exe
  C:\Windows\System\xpBXFGZ.exe
  2⤵
  PID:5004
- C:\Windows\System\ykgjspi.exe
  C:\Windows\System\ykgjspi.exe
  2⤵
  PID:5008
- C:\Windows\System\UUvOxMO.exe
  C:\Windows\System\UUvOxMO.exe
  2⤵
  PID:5084
- C:\Windows\System\wPbXykp.exe
  C:\Windows\System\wPbXykp.exe
  2⤵
  PID:3792
- C:\Windows\System\NMXkBtw.exe
  C:\Windows\System\NMXkBtw.exe
  2⤵
  PID:1432
- C:\Windows\System\clForyH.exe
  C:\Windows\System\clForyH.exe
  2⤵
  PID:5032
- C:\Windows\System\jnmXGIn.exe
  C:\Windows\System\jnmXGIn.exe
  2⤵
  PID:2416
- C:\Windows\System\KGRyfIy.exe
  C:\Windows\System\KGRyfIy.exe
  2⤵
  PID:3852
- C:\Windows\System\wHLcHXx.exe
  C:\Windows\System\wHLcHXx.exe
  2⤵
  PID:2568
- C:\Windows\System\nWfBGPe.exe
  C:\Windows\System\nWfBGPe.exe
  2⤵
  PID:3476
- C:\Windows\System\GmJrzXv.exe
  C:\Windows\System\GmJrzXv.exe
  2⤵
  PID:2284
- C:\Windows\System\UNmgbVx.exe
  C:\Windows\System\UNmgbVx.exe
  2⤵
  PID:3920
- C:\Windows\System\aCXPVus.exe
  C:\Windows\System\aCXPVus.exe
  2⤵
  PID:4080
- C:\Windows\System\yNoUiPY.exe
  C:\Windows\System\yNoUiPY.exe
  2⤵
  PID:1888
- C:\Windows\System\VCLiMJY.exe
  C:\Windows\System\VCLiMJY.exe
  2⤵
  PID:3368
- C:\Windows\System\aCpyzdh.exe
  C:\Windows\System\aCpyzdh.exe
  2⤵
  PID:1572
- C:\Windows\System\OtwLAHn.exe
  C:\Windows\System\OtwLAHn.exe
  2⤵
  PID:804
- C:\Windows\System\OvYHusx.exe
  C:\Windows\System\OvYHusx.exe
  2⤵
  PID:4204
- C:\Windows\System\bEcDzsJ.exe
  C:\Windows\System\bEcDzsJ.exe
  2⤵
  PID:4572
- C:\Windows\System\gbZJlOl.exe
  C:\Windows\System\gbZJlOl.exe
  2⤵
  PID:548
- C:\Windows\System\RxEqCMv.exe
  C:\Windows\System\RxEqCMv.exe
  2⤵
  PID:3140
- C:\Windows\System\zxajKLn.exe
  C:\Windows\System\zxajKLn.exe
  2⤵
  PID:4716
- C:\Windows\System\llncJwo.exe
  C:\Windows\System\llncJwo.exe
  2⤵
  PID:3148
- C:\Windows\System\PqmtAar.exe
  C:\Windows\System\PqmtAar.exe
  2⤵
  PID:3648
- C:\Windows\System\zbbhcnJ.exe
  C:\Windows\System\zbbhcnJ.exe
  2⤵
  PID:3680
- C:\Windows\System\PhcylwM.exe
  C:\Windows\System\PhcylwM.exe
  2⤵
  PID:3112
- C:\Windows\System\uytRKkm.exe
  C:\Windows\System\uytRKkm.exe
  2⤵
  PID:4644
- C:\Windows\System\FYRtQZN.exe
  C:\Windows\System\FYRtQZN.exe
  2⤵
  PID:2244
- C:\Windows\System\YHkGOKP.exe
  C:\Windows\System\YHkGOKP.exe
  2⤵
  PID:3580
- C:\Windows\System\idzLlpF.exe
  C:\Windows\System\idzLlpF.exe
  2⤵
  PID:3640
- C:\Windows\System\AIijanH.exe
  C:\Windows\System\AIijanH.exe
  2⤵
  PID:3676
- C:\Windows\System\ouhzhIf.exe
  C:\Windows\System\ouhzhIf.exe
  2⤵
  PID:4600
- C:\Windows\System\OvYXDLK.exe
  C:\Windows\System\OvYXDLK.exe
  2⤵
  PID:828
- C:\Windows\System\mYlFnGd.exe
  C:\Windows\System\mYlFnGd.exe
  2⤵
  PID:2228
- C:\Windows\System\ljXXxPT.exe
  C:\Windows\System\ljXXxPT.exe
  2⤵
  PID:3540
- C:\Windows\System\zMqTGXJ.exe
  C:\Windows\System\zMqTGXJ.exe
  2⤵
  PID:4772
- C:\Windows\System\SWrZMOk.exe
  C:\Windows\System\SWrZMOk.exe
  2⤵
  PID:572
- C:\Windows\System\XWSdBql.exe
  C:\Windows\System\XWSdBql.exe
  2⤵
  PID:3776
- C:\Windows\System\QNSehjk.exe
  C:\Windows\System\QNSehjk.exe
  2⤵
  PID:1272
- C:\Windows\System\rbpahmq.exe
  C:\Windows\System\rbpahmq.exe
  2⤵
  PID:2960
- C:\Windows\System\nYsQiee.exe
  C:\Windows\System\nYsQiee.exe
  2⤵
  PID:3872
- C:\Windows\System\zNVgLan.exe
  C:\Windows\System\zNVgLan.exe
  2⤵
  PID:4624
- C:\Windows\System\rnmQECV.exe
  C:\Windows\System\rnmQECV.exe
  2⤵
  PID:4616
- C:\Windows\System\YPGHCxE.exe
  C:\Windows\System\YPGHCxE.exe
  2⤵
  PID:4504
- C:\Windows\System\VAeWenl.exe
  C:\Windows\System\VAeWenl.exe
  2⤵
  PID:4940
- C:\Windows\System\tAsvMVQ.exe
  C:\Windows\System\tAsvMVQ.exe
  2⤵
  PID:4684
- C:\Windows\System\OjYnhPV.exe
  C:\Windows\System\OjYnhPV.exe
  2⤵
  PID:3932
- C:\Windows\System\NWrjeHn.exe
  C:\Windows\System\NWrjeHn.exe
  2⤵
  PID:3592
- C:\Windows\System\GLyGRDo.exe
  C:\Windows\System\GLyGRDo.exe
  2⤵
  PID:5012
- C:\Windows\System\bBKtytx.exe
  C:\Windows\System\bBKtytx.exe
  2⤵
  PID:2636
- C:\Windows\System\DPopSlD.exe
  C:\Windows\System\DPopSlD.exe
  2⤵
  PID:4700
- C:\Windows\System\QwFMlQv.exe
  C:\Windows\System\QwFMlQv.exe
  2⤵
  PID:4352
- C:\Windows\System\xUIDffw.exe
  C:\Windows\System\xUIDffw.exe
  2⤵
  PID:3840
- C:\Windows\System\eepYoMC.exe
  C:\Windows\System\eepYoMC.exe
  2⤵
  PID:4888
- C:\Windows\System\tPRUvdd.exe
  C:\Windows\System\tPRUvdd.exe
  2⤵
  PID:4448
- C:\Windows\System\XJnjYBF.exe
  C:\Windows\System\XJnjYBF.exe
  2⤵
  PID:4984
- C:\Windows\System\ZpVgsGp.exe
  C:\Windows\System\ZpVgsGp.exe
  2⤵
  PID:4968
- C:\Windows\System\mPsOswq.exe
  C:\Windows\System\mPsOswq.exe
  2⤵
  PID:5076
- C:\Windows\System\fHLqaNG.exe
  C:\Windows\System\fHLqaNG.exe
  2⤵
  PID:3628
- C:\Windows\System\EdCtrhP.exe
  C:\Windows\System\EdCtrhP.exe
  2⤵
  PID:3544
- C:\Windows\System\LzoMxQJ.exe
  C:\Windows\System\LzoMxQJ.exe
  2⤵
  PID:1224
- C:\Windows\System\dRUYKHP.exe
  C:\Windows\System\dRUYKHP.exe
  2⤵
  PID:2660
- C:\Windows\System\QXAQAAK.exe
  C:\Windows\System\QXAQAAK.exe
  2⤵
  PID:2556
- C:\Windows\System\ghdIUod.exe
  C:\Windows\System\ghdIUod.exe
  2⤵
  PID:5040
- C:\Windows\System\reSyQSE.exe
  C:\Windows\System\reSyQSE.exe
  2⤵
  PID:2348
- C:\Windows\System\jEDjHTa.exe
  C:\Windows\System\jEDjHTa.exe
  2⤵
  PID:3364
- C:\Windows\System\xBqYVVa.exe
  C:\Windows\System\xBqYVVa.exe
  2⤵
  PID:4172
- C:\Windows\System\yyPBIwd.exe
  C:\Windows\System\yyPBIwd.exe
  2⤵
  PID:4400
- C:\Windows\System\yqvxYJs.exe
  C:\Windows\System\yqvxYJs.exe
  2⤵
  PID:4336
- C:\Windows\System\hlGKwgu.exe
  C:\Windows\System\hlGKwgu.exe
  2⤵
  PID:4384
- C:\Windows\System\alFrYEn.exe
  C:\Windows\System\alFrYEn.exe
  2⤵
  PID:4068
- C:\Windows\System\DGDVRTS.exe
  C:\Windows\System\DGDVRTS.exe
  2⤵
  PID:4780
- C:\Windows\System\MEMkIdV.exe
  C:\Windows\System\MEMkIdV.exe
  2⤵
  PID:2784
- C:\Windows\System\QwmwAVz.exe
  C:\Windows\System\QwmwAVz.exe
  2⤵
  PID:4540
- C:\Windows\System\nTQtGHG.exe
  C:\Windows\System\nTQtGHG.exe
  2⤵
  PID:3444
- C:\Windows\System\OeyhfuC.exe
  C:\Windows\System\OeyhfuC.exe
  2⤵
  PID:288
- C:\Windows\System\bEvEQfN.exe
  C:\Windows\System\bEvEQfN.exe
  2⤵
  PID:4524
- C:\Windows\System\rUJUXar.exe
  C:\Windows\System\rUJUXar.exe
  2⤵
  PID:2376
- C:\Windows\System\zeuqwOy.exe
  C:\Windows\System\zeuqwOy.exe
  2⤵
  PID:4544
- C:\Windows\System\TungMyd.exe
  C:\Windows\System\TungMyd.exe
  2⤵
  PID:4548
- C:\Windows\System\RJlezDE.exe
  C:\Windows\System\RJlezDE.exe
  2⤵
  PID:4480
- C:\Windows\System\FFDGhcr.exe
  C:\Windows\System\FFDGhcr.exe
  2⤵
  PID:4492
- C:\Windows\System\MTRJJgA.exe
  C:\Windows\System\MTRJJgA.exe
  2⤵
  PID:4828
- C:\Windows\System\rHYDiUL.exe
  C:\Windows\System\rHYDiUL.exe
  2⤵
  PID:4216
- C:\Windows\System\CqadHSr.exe
  C:\Windows\System\CqadHSr.exe
  2⤵
  PID:4628
- C:\Windows\System\amjTFuc.exe
  C:\Windows\System\amjTFuc.exe
  2⤵
  PID:4472
- C:\Windows\System\rPAadJN.exe
  C:\Windows\System\rPAadJN.exe
  2⤵
  PID:4672
- C:\Windows\System\AkrUcRU.exe
  C:\Windows\System\AkrUcRU.exe
  2⤵
  PID:5044
- C:\Windows\System\mPFqvmt.exe
  C:\Windows\System\mPFqvmt.exe
  2⤵
  PID:5100
- C:\Windows\System\MJqfCQT.exe
  C:\Windows\System\MJqfCQT.exe
  2⤵
  PID:3684
- C:\Windows\System\ptpJaOo.exe
  C:\Windows\System\ptpJaOo.exe
  2⤵
  PID:1028
- C:\Windows\System\tQtWYpY.exe
  C:\Windows\System\tQtWYpY.exe
  2⤵
  PID:4948
- C:\Windows\System\ObTQLTA.exe
  C:\Windows\System\ObTQLTA.exe
  2⤵
  PID:5028
- C:\Windows\System\VwPcGdm.exe
  C:\Windows\System\VwPcGdm.exe
  2⤵
  PID:4140
- C:\Windows\System\NoLsjQA.exe
  C:\Windows\System\NoLsjQA.exe
  2⤵
  PID:3316
- C:\Windows\System\aSKitOp.exe
  C:\Windows\System\aSKitOp.exe
  2⤵
  PID:4272
- C:\Windows\System\pTrQEvo.exe
  C:\Windows\System\pTrQEvo.exe
  2⤵
  PID:2460
- C:\Windows\System\ALJCIkI.exe
  C:\Windows\System\ALJCIkI.exe
  2⤵
  PID:1620
- C:\Windows\System\uvkqzzZ.exe
  C:\Windows\System\uvkqzzZ.exe
  2⤵
  PID:3480
- C:\Windows\System\NpapBie.exe
  C:\Windows\System\NpapBie.exe
  2⤵
  PID:3808
- C:\Windows\System\gvsqlRj.exe
  C:\Windows\System\gvsqlRj.exe
  2⤵
  PID:4004
- C:\Windows\System\GGTDOtr.exe
  C:\Windows\System\GGTDOtr.exe
  2⤵
  PID:4688
- C:\Windows\System\EOnoRvn.exe
  C:\Windows\System\EOnoRvn.exe
  2⤵
  PID:4796
- C:\Windows\System\HqzvWCq.exe
  C:\Windows\System\HqzvWCq.exe
  2⤵
  PID:4460
- C:\Windows\System\nqcUjzj.exe
  C:\Windows\System\nqcUjzj.exe
  2⤵
  PID:4892
- C:\Windows\System\KELXpXK.exe
  C:\Windows\System\KELXpXK.exe
  2⤵
  PID:4052
- C:\Windows\System\ftokjXQ.exe
  C:\Windows\System\ftokjXQ.exe
  2⤵
  PID:2148
- C:\Windows\System\YHxyNuV.exe
  C:\Windows\System\YHxyNuV.exe
  2⤵
  PID:2724
- C:\Windows\System\ZxyiEFN.exe
  C:\Windows\System\ZxyiEFN.exe
  2⤵
  PID:4508
- C:\Windows\System\vpWkzIF.exe
  C:\Windows\System\vpWkzIF.exe
  2⤵
  PID:2180
- C:\Windows\System\oVTeCKf.exe
  C:\Windows\System\oVTeCKf.exe
  2⤵
  PID:3432
- C:\Windows\System\GIGxQgN.exe
  C:\Windows\System\GIGxQgN.exe
  2⤵
  PID:3736
- C:\Windows\System\LihCXrQ.exe
  C:\Windows\System\LihCXrQ.exe
  2⤵
  PID:4956
- C:\Windows\System\kqnycWD.exe
  C:\Windows\System\kqnycWD.exe
  2⤵
  PID:2084
- C:\Windows\System\gVLwNhE.exe
  C:\Windows\System\gVLwNhE.exe
  2⤵
  PID:4964
- C:\Windows\System\rCQtbwJ.exe
  C:\Windows\System\rCQtbwJ.exe
  2⤵
  PID:3412
- C:\Windows\System\GXzUGBm.exe
  C:\Windows\System\GXzUGBm.exe
  2⤵
  PID:2140
- C:\Windows\System\sTmcxJw.exe
  C:\Windows\System\sTmcxJw.exe
  2⤵
  PID:3984
- C:\Windows\System\pscVxiM.exe
  C:\Windows\System\pscVxiM.exe
  2⤵
  PID:4240
- C:\Windows\System\rXvNTtC.exe
  C:\Windows\System\rXvNTtC.exe
  2⤵
  PID:1652
- C:\Windows\System\XCbxTLl.exe
  C:\Windows\System\XCbxTLl.exe
  2⤵
  PID:5136
- C:\Windows\System\uYuDlOa.exe
  C:\Windows\System\uYuDlOa.exe
  2⤵
  PID:5152
- C:\Windows\System\VKBttMV.exe
  C:\Windows\System\VKBttMV.exe
  2⤵
  PID:5168
- C:\Windows\System\doVMPyl.exe
  C:\Windows\System\doVMPyl.exe
  2⤵
  PID:5184
- C:\Windows\System\nblVuSq.exe
  C:\Windows\System\nblVuSq.exe
  2⤵
  PID:5200
- C:\Windows\System\IWBmJuu.exe
  C:\Windows\System\IWBmJuu.exe
  2⤵
  PID:5216
- C:\Windows\System\IQZcOjt.exe
  C:\Windows\System\IQZcOjt.exe
  2⤵
  PID:5232
- C:\Windows\System\XYrbCeR.exe
  C:\Windows\System\XYrbCeR.exe
  2⤵
  PID:5248
- C:\Windows\System\AtzQcDl.exe
  C:\Windows\System\AtzQcDl.exe
  2⤵
  PID:5268
- C:\Windows\System\oWZhXNE.exe
  C:\Windows\System\oWZhXNE.exe
  2⤵
  PID:5284
- C:\Windows\System\UnksEBx.exe
  C:\Windows\System\UnksEBx.exe
  2⤵
  PID:5300
- C:\Windows\System\okvLkZX.exe
  C:\Windows\System\okvLkZX.exe
  2⤵
  PID:5316
- C:\Windows\System\QZGKPDA.exe
  C:\Windows\System\QZGKPDA.exe
  2⤵
  PID:5332
- C:\Windows\System\nRZyNhx.exe
  C:\Windows\System\nRZyNhx.exe
  2⤵
  PID:5348
- C:\Windows\System\fdIvfcV.exe
  C:\Windows\System\fdIvfcV.exe
  2⤵
  PID:5368
- C:\Windows\System\GhYlhQG.exe
  C:\Windows\System\GhYlhQG.exe
  2⤵
  PID:5384
- C:\Windows\System\gLlXXQn.exe
  C:\Windows\System\gLlXXQn.exe
  2⤵
  PID:5404
- C:\Windows\System\voxCeIf.exe
  C:\Windows\System\voxCeIf.exe
  2⤵
  PID:5420
- C:\Windows\System\mqhMpKm.exe
  C:\Windows\System\mqhMpKm.exe
  2⤵
  PID:5564
- C:\Windows\System\PmzqBwp.exe
  C:\Windows\System\PmzqBwp.exe
  2⤵
  PID:5580
- C:\Windows\System\etxgGKy.exe
  C:\Windows\System\etxgGKy.exe
  2⤵
  PID:5596
- C:\Windows\System\GjISojf.exe
  C:\Windows\System\GjISojf.exe
  2⤵
  PID:5616
- C:\Windows\System\McGJOfW.exe
  C:\Windows\System\McGJOfW.exe
  2⤵
  PID:5632
- C:\Windows\System\lSTTfmS.exe
  C:\Windows\System\lSTTfmS.exe
  2⤵
  PID:5652
- C:\Windows\System\vvqAQfU.exe
  C:\Windows\System\vvqAQfU.exe
  2⤵
  PID:5672
- C:\Windows\System\XeNJRik.exe
  C:\Windows\System\XeNJRik.exe
  2⤵
  PID:5688
- C:\Windows\System\qgUBiXb.exe
  C:\Windows\System\qgUBiXb.exe
  2⤵
  PID:5708
- C:\Windows\System\trcThHG.exe
  C:\Windows\System\trcThHG.exe
  2⤵
  PID:5724
- C:\Windows\System\DnKKfAP.exe
  C:\Windows\System\DnKKfAP.exe
  2⤵
  PID:5740
- C:\Windows\System\GIXmWZG.exe
  C:\Windows\System\GIXmWZG.exe
  2⤵
  PID:5760
- C:\Windows\System\tIJgfbg.exe
  C:\Windows\System\tIJgfbg.exe
  2⤵
  PID:5776
- C:\Windows\System\LfXgrKx.exe
  C:\Windows\System\LfXgrKx.exe
  2⤵
  PID:5792
- C:\Windows\System\YmzuOVS.exe
  C:\Windows\System\YmzuOVS.exe
  2⤵
  PID:5808
- C:\Windows\System\QjMobuU.exe
  C:\Windows\System\QjMobuU.exe
  2⤵
  PID:5824
- C:\Windows\System\aMmCJuf.exe
  C:\Windows\System\aMmCJuf.exe
  2⤵
  PID:5840
- C:\Windows\System\bLZPyCu.exe
  C:\Windows\System\bLZPyCu.exe
  2⤵
  PID:5856
- C:\Windows\System\RsYXAmC.exe
  C:\Windows\System\RsYXAmC.exe
  2⤵
  PID:5872
- C:\Windows\System\MzqnOvE.exe
  C:\Windows\System\MzqnOvE.exe
  2⤵
  PID:5888
- C:\Windows\System\BubQCFM.exe
  C:\Windows\System\BubQCFM.exe
  2⤵
  PID:5904
- C:\Windows\System\auRzgDg.exe
  C:\Windows\System\auRzgDg.exe
  2⤵
  PID:5920
- C:\Windows\System\vaqILpM.exe
  C:\Windows\System\vaqILpM.exe
  2⤵
  PID:5936
- C:\Windows\System\ywKqriJ.exe
  C:\Windows\System\ywKqriJ.exe
  2⤵
  PID:5952
- C:\Windows\System\CzbfQzK.exe
  C:\Windows\System\CzbfQzK.exe
  2⤵
  PID:5968
- C:\Windows\System\OvDjpFN.exe
  C:\Windows\System\OvDjpFN.exe
  2⤵
  PID:5984
- C:\Windows\System\CAgBtzh.exe
  C:\Windows\System\CAgBtzh.exe
  2⤵
  PID:6000
- C:\Windows\System\HKpNunG.exe
  C:\Windows\System\HKpNunG.exe
  2⤵
  PID:6016
- C:\Windows\System\rNgmroJ.exe
  C:\Windows\System\rNgmroJ.exe
  2⤵
  PID:6032
- C:\Windows\System\kzbOype.exe
  C:\Windows\System\kzbOype.exe
  2⤵
  PID:6048
- C:\Windows\System\iPNfONa.exe
  C:\Windows\System\iPNfONa.exe
  2⤵
  PID:6064
- C:\Windows\System\huqQQAO.exe
  C:\Windows\System\huqQQAO.exe
  2⤵
  PID:6080
- C:\Windows\System\MAIiJXg.exe
  C:\Windows\System\MAIiJXg.exe
  2⤵
  PID:6096
- C:\Windows\System\GPjlVwb.exe
  C:\Windows\System\GPjlVwb.exe
  2⤵
  PID:6112
- C:\Windows\System\yDzgyOy.exe
  C:\Windows\System\yDzgyOy.exe
  2⤵
  PID:6128
- C:\Windows\System\eefyVhn.exe
  C:\Windows\System\eefyVhn.exe
  2⤵
  PID:5056
- C:\Windows\System\odmOgpU.exe
  C:\Windows\System\odmOgpU.exe
  2⤵
  PID:5132
- C:\Windows\System\pTHhRwP.exe
  C:\Windows\System\pTHhRwP.exe
  2⤵
  PID:5160
- C:\Windows\System\PQQTqzL.exe
  C:\Windows\System\PQQTqzL.exe
  2⤵
  PID:5228
- C:\Windows\System\fqvDDQH.exe
  C:\Windows\System\fqvDDQH.exe
  2⤵
  PID:5292
- C:\Windows\System\yvDIsjJ.exe
  C:\Windows\System\yvDIsjJ.exe
  2⤵
  PID:5356
- C:\Windows\System\tSTpaGd.exe
  C:\Windows\System\tSTpaGd.exe
  2⤵
  PID:5392
- C:\Windows\System\AagejOV.exe
  C:\Windows\System\AagejOV.exe
  2⤵
  PID:5448
- C:\Windows\System\fVltqVi.exe
  C:\Windows\System\fVltqVi.exe
  2⤵
  PID:5468
- C:\Windows\System\QAbUNYa.exe
  C:\Windows\System\QAbUNYa.exe
  2⤵
  PID:5144
- C:\Windows\System\ATaEigL.exe
  C:\Windows\System\ATaEigL.exe
  2⤵
  PID:5576
- C:\Windows\System\hrpsXJg.exe
  C:\Windows\System\hrpsXJg.exe
  2⤵
  PID:5480
- C:\Windows\System\KHIgEiY.exe
  C:\Windows\System\KHIgEiY.exe
  2⤵
  PID:5668
- C:\Windows\System\AaSRUtr.exe
  C:\Windows\System\AaSRUtr.exe
  2⤵
  PID:5208
- C:\Windows\System\NaTivfG.exe
  C:\Windows\System\NaTivfG.exe
  2⤵
  PID:5180
- C:\Windows\System\cpVPuHl.exe
  C:\Windows\System\cpVPuHl.exe
  2⤵
  PID:5376
- C:\Windows\System\FvBJegq.exe
  C:\Windows\System\FvBJegq.exe
  2⤵
  PID:5720
- C:\Windows\System\frpoWPV.exe
  C:\Windows\System\frpoWPV.exe
  2⤵
  PID:5484
- C:\Windows\System\HqQArKJ.exe
  C:\Windows\System\HqQArKJ.exe
  2⤵
  PID:5500
- C:\Windows\System\TLYehwA.exe
  C:\Windows\System\TLYehwA.exe
  2⤵
  PID:5520
- C:\Windows\System\LWYIsIJ.exe
  C:\Windows\System\LWYIsIJ.exe
  2⤵
  PID:5540
- C:\Windows\System\caAKuss.exe
  C:\Windows\System\caAKuss.exe
  2⤵
  PID:5244
- C:\Windows\System\VAowEmL.exe
  C:\Windows\System\VAowEmL.exe
  2⤵
  PID:5380
- C:\Windows\System\LdKqAQh.exe
  C:\Windows\System\LdKqAQh.exe
  2⤵
  PID:5660
- C:\Windows\System\aazUpIP.exe
  C:\Windows\System\aazUpIP.exe
  2⤵
  PID:5556
- C:\Windows\System\sAfXzqW.exe
  C:\Windows\System\sAfXzqW.exe
  2⤵
  PID:5820
- C:\Windows\System\RavqcMW.exe
  C:\Windows\System\RavqcMW.exe
  2⤵
  PID:5696
- C:\Windows\System\qNyySwX.exe
  C:\Windows\System\qNyySwX.exe
  2⤵
  PID:5800
- C:\Windows\System\ZXIXSoc.exe
  C:\Windows\System\ZXIXSoc.exe
  2⤵
  PID:5832
- C:\Windows\System\pYAQGPq.exe
  C:\Windows\System\pYAQGPq.exe
  2⤵
  PID:5880
- C:\Windows\System\OhTPAzj.exe
  C:\Windows\System\OhTPAzj.exe
  2⤵
  PID:5896
- C:\Windows\System\WEKUfoz.exe
  C:\Windows\System\WEKUfoz.exe
  2⤵
  PID:5944
- C:\Windows\System\hulNjIS.exe
  C:\Windows\System\hulNjIS.exe
  2⤵
  PID:5980
- C:\Windows\System\oeZoMpT.exe
  C:\Windows\System\oeZoMpT.exe
  2⤵
  PID:6044
- C:\Windows\System\tjlzatG.exe
  C:\Windows\System\tjlzatG.exe
  2⤵
  PID:6108
- C:\Windows\System\JQfaWTh.exe
  C:\Windows\System\JQfaWTh.exe
  2⤵
  PID:5992
- C:\Windows\System\EFsDrgz.exe
  C:\Windows\System\EFsDrgz.exe
  2⤵
  PID:6060
- C:\Windows\System\VQmWKoD.exe
  C:\Windows\System\VQmWKoD.exe
  2⤵
  PID:6124
- C:\Windows\System\fEjrgPT.exe
  C:\Windows\System\fEjrgPT.exe
  2⤵
  PID:3636
- C:\Windows\System\iFhVqXr.exe
  C:\Windows\System\iFhVqXr.exe
  2⤵
  PID:5364
- C:\Windows\System\kCCWzls.exe
  C:\Windows\System\kCCWzls.exe
  2⤵
  PID:5224
- C:\Windows\System\mkCetZA.exe
  C:\Windows\System\mkCetZA.exe
  2⤵
  PID:5572
- C:\Windows\System\PzYaVWH.exe
  C:\Windows\System\PzYaVWH.exe
  2⤵
  PID:5644
- C:\Windows\System\JkJdHxy.exe
  C:\Windows\System\JkJdHxy.exe
  2⤵
  PID:5176
- C:\Windows\System\LMGxKPU.exe
  C:\Windows\System\LMGxKPU.exe
  2⤵
  PID:5684
- C:\Windows\System\wAVVDNO.exe
  C:\Windows\System\wAVVDNO.exe
  2⤵
  PID:5492
- C:\Windows\System\NsyDlQy.exe
  C:\Windows\System\NsyDlQy.exe
  2⤵
  PID:5276
- C:\Windows\System\BNWUcUB.exe
  C:\Windows\System\BNWUcUB.exe
  2⤵
  PID:5400
- C:\Windows\System\FrKYtQF.exe
  C:\Windows\System\FrKYtQF.exe
  2⤵
  PID:5704
- C:\Windows\System\YDggyfF.exe
  C:\Windows\System\YDggyfF.exe
  2⤵
  PID:5700
- C:\Windows\System\ynXVPya.exe
  C:\Windows\System\ynXVPya.exe
  2⤵
  PID:5848
- C:\Windows\System\IzNQHOm.exe
  C:\Windows\System\IzNQHOm.exe
  2⤵
  PID:5592
- C:\Windows\System\bsnSbpY.exe
  C:\Windows\System\bsnSbpY.exe
  2⤵
  PID:5852
- C:\Windows\System\iMsSrRI.exe
  C:\Windows\System\iMsSrRI.exe
  2⤵
  PID:6076
- C:\Windows\System\HpXUJlK.exe
  C:\Windows\System\HpXUJlK.exe
  2⤵
  PID:6012
- C:\Windows\System\Gqmxcbb.exe
  C:\Windows\System\Gqmxcbb.exe
  2⤵
  PID:6024
- C:\Windows\System\FAOmNwJ.exe
  C:\Windows\System\FAOmNwJ.exe
  2⤵
  PID:6092
- C:\Windows\System\aHVQCFw.exe
  C:\Windows\System\aHVQCFw.exe
  2⤵
  PID:5260
- C:\Windows\System\Cvxuheu.exe
  C:\Windows\System\Cvxuheu.exe
  2⤵
  PID:5148
- C:\Windows\System\oGmVCPj.exe
  C:\Windows\System\oGmVCPj.exe
  2⤵
  PID:5612
- C:\Windows\System\vvRyUeh.exe
  C:\Windows\System\vvRyUeh.exe
  2⤵
  PID:5752
- C:\Windows\System\KXyOiaA.exe
  C:\Windows\System\KXyOiaA.exe
  2⤵
  PID:5664
- C:\Windows\System\stmomHE.exe
  C:\Windows\System\stmomHE.exe
  2⤵
  PID:5772
- C:\Windows\System\YKywbFQ.exe
  C:\Windows\System\YKywbFQ.exe
  2⤵
  PID:5784
- C:\Windows\System\iYhuecV.exe
  C:\Windows\System\iYhuecV.exe
  2⤵
  PID:5864
- C:\Windows\System\wbCoDFv.exe
  C:\Windows\System\wbCoDFv.exe
  2⤵
  PID:5444
- C:\Windows\System\ZqGGBSO.exe
  C:\Windows\System\ZqGGBSO.exe
  2⤵
  PID:5528
- C:\Windows\System\iwTyWwD.exe
  C:\Windows\System\iwTyWwD.exe
  2⤵
  PID:5516
- C:\Windows\System\ypoPDKM.exe
  C:\Windows\System\ypoPDKM.exe
  2⤵
  PID:5548
- C:\Windows\System\KOZydnT.exe
  C:\Windows\System\KOZydnT.exe
  2⤵
  PID:5868
- C:\Windows\System\etndmgE.exe
  C:\Windows\System\etndmgE.exe
  2⤵
  PID:5328
- C:\Windows\System\vagBktX.exe
  C:\Windows\System\vagBktX.exe
  2⤵
  PID:5560
- C:\Windows\System\zLOwSjk.exe
  C:\Windows\System\zLOwSjk.exe
  2⤵
  PID:6152
- C:\Windows\System\WzyQSya.exe
  C:\Windows\System\WzyQSya.exe
  2⤵
  PID:6168
- C:\Windows\System\ujGxQxk.exe
  C:\Windows\System\ujGxQxk.exe
  2⤵
  PID:6184
- C:\Windows\System\emPkQPw.exe
  C:\Windows\System\emPkQPw.exe
  2⤵
  PID:6200
- C:\Windows\System\lReMjmo.exe
  C:\Windows\System\lReMjmo.exe
  2⤵
  PID:6216
- C:\Windows\System\QOUbyqq.exe
  C:\Windows\System\QOUbyqq.exe
  2⤵
  PID:6232
- C:\Windows\System\UOiNxdZ.exe
  C:\Windows\System\UOiNxdZ.exe
  2⤵
  PID:6248
- C:\Windows\System\zmjbyCn.exe
  C:\Windows\System\zmjbyCn.exe
  2⤵
  PID:6264
- C:\Windows\System\SSqenYe.exe
  C:\Windows\System\SSqenYe.exe
  2⤵
  PID:6280
- C:\Windows\System\GCysKPw.exe
  C:\Windows\System\GCysKPw.exe
  2⤵
  PID:6296
- C:\Windows\System\ceGPXli.exe
  C:\Windows\System\ceGPXli.exe
  2⤵
  PID:6312
- C:\Windows\System\ykGAQiB.exe
  C:\Windows\System\ykGAQiB.exe
  2⤵
  PID:6328
- C:\Windows\System\lZraPnP.exe
  C:\Windows\System\lZraPnP.exe
  2⤵
  PID:6344
- C:\Windows\System\sFqFwNc.exe
  C:\Windows\System\sFqFwNc.exe
  2⤵
  PID:6360
- C:\Windows\System\Visdpox.exe
  C:\Windows\System\Visdpox.exe
  2⤵
  PID:6376
- C:\Windows\System\Uldnpgh.exe
  C:\Windows\System\Uldnpgh.exe
  2⤵
  PID:6392
- C:\Windows\System\bTDDAyS.exe
  C:\Windows\System\bTDDAyS.exe
  2⤵
  PID:6408
- C:\Windows\System\chzTcDY.exe
  C:\Windows\System\chzTcDY.exe
  2⤵
  PID:6424
- C:\Windows\System\xfYWTzK.exe
  C:\Windows\System\xfYWTzK.exe
  2⤵
  PID:6440
- C:\Windows\System\kKrIGYm.exe
  C:\Windows\System\kKrIGYm.exe
  2⤵
  PID:6456
- C:\Windows\System\rNnIrQg.exe
  C:\Windows\System\rNnIrQg.exe
  2⤵
  PID:6472
- C:\Windows\System\WklfHPp.exe
  C:\Windows\System\WklfHPp.exe
  2⤵
  PID:6488
- C:\Windows\System\uiojMmO.exe
  C:\Windows\System\uiojMmO.exe
  2⤵
  PID:6504
- C:\Windows\System\rnEHApc.exe
  C:\Windows\System\rnEHApc.exe
  2⤵
  PID:6520
- C:\Windows\System\WnFNuHy.exe
  C:\Windows\System\WnFNuHy.exe
  2⤵
  PID:6536
- C:\Windows\System\rSZLoDw.exe
  C:\Windows\System\rSZLoDw.exe
  2⤵
  PID:6552
- C:\Windows\System\ZIpyAyj.exe
  C:\Windows\System\ZIpyAyj.exe
  2⤵
  PID:6568
- C:\Windows\System\uzpkIBt.exe
  C:\Windows\System\uzpkIBt.exe
  2⤵
  PID:6584
- C:\Windows\System\gXjRSCs.exe
  C:\Windows\System\gXjRSCs.exe
  2⤵
  PID:6604
- C:\Windows\System\JuVpxcO.exe
  C:\Windows\System\JuVpxcO.exe
  2⤵
  PID:6620
- C:\Windows\System\YVuHxPv.exe
  C:\Windows\System\YVuHxPv.exe
  2⤵
  PID:6636
- C:\Windows\System\RvFeRic.exe
  C:\Windows\System\RvFeRic.exe
  2⤵
  PID:6652
- C:\Windows\System\qYKrWBW.exe
  C:\Windows\System\qYKrWBW.exe
  2⤵
  PID:6668
- C:\Windows\System\iOULdco.exe
  C:\Windows\System\iOULdco.exe
  2⤵
  PID:6684
- C:\Windows\System\HfwSvEg.exe
  C:\Windows\System\HfwSvEg.exe
  2⤵
  PID:6700
- C:\Windows\System\WBPhQGg.exe
  C:\Windows\System\WBPhQGg.exe
  2⤵
  PID:6716
- C:\Windows\System\uTodeOF.exe
  C:\Windows\System\uTodeOF.exe
  2⤵
  PID:6732
- C:\Windows\System\PNfWIbh.exe
  C:\Windows\System\PNfWIbh.exe
  2⤵
  PID:6748
- C:\Windows\System\qgnbVSU.exe
  C:\Windows\System\qgnbVSU.exe
  2⤵
  PID:6764
- C:\Windows\System\egbjDQT.exe
  C:\Windows\System\egbjDQT.exe
  2⤵
  PID:6780
- C:\Windows\System\DLdWTgD.exe
  C:\Windows\System\DLdWTgD.exe
  2⤵
  PID:6796
- C:\Windows\System\qnYoPqp.exe
  C:\Windows\System\qnYoPqp.exe
  2⤵
  PID:6816
- C:\Windows\System\AlWMcMV.exe
  C:\Windows\System\AlWMcMV.exe
  2⤵
  PID:6832
- C:\Windows\System\ZfZbwJW.exe
  C:\Windows\System\ZfZbwJW.exe
  2⤵
  PID:6848
- C:\Windows\System\rSkiINF.exe
  C:\Windows\System\rSkiINF.exe
  2⤵
  PID:6864
- C:\Windows\System\bVDOKVB.exe
  C:\Windows\System\bVDOKVB.exe
  2⤵
  PID:6880
- C:\Windows\System\OxMtDdN.exe
  C:\Windows\System\OxMtDdN.exe
  2⤵
  PID:6896
- C:\Windows\System\XJBXuKq.exe
  C:\Windows\System\XJBXuKq.exe
  2⤵
  PID:6916
- C:\Windows\System\gmxIgXI.exe
  C:\Windows\System\gmxIgXI.exe
  2⤵
  PID:6932
- C:\Windows\System\nUnZKnW.exe
  C:\Windows\System\nUnZKnW.exe
  2⤵
  PID:6952
- C:\Windows\System\tBNITai.exe
  C:\Windows\System\tBNITai.exe
  2⤵
  PID:6968
- C:\Windows\System\FxbTbJf.exe
  C:\Windows\System\FxbTbJf.exe
  2⤵
  PID:6984
- C:\Windows\System\YSFrhFm.exe
  C:\Windows\System\YSFrhFm.exe
  2⤵
  PID:7000
- C:\Windows\System\prmjKjD.exe
  C:\Windows\System\prmjKjD.exe
  2⤵
  PID:7016
- C:\Windows\System\oVpyAyi.exe
  C:\Windows\System\oVpyAyi.exe
  2⤵
  PID:7032
- C:\Windows\System\MOvBuLV.exe
  C:\Windows\System\MOvBuLV.exe
  2⤵
  PID:7048
- C:\Windows\System\kXlXize.exe
  C:\Windows\System\kXlXize.exe
  2⤵
  PID:7064
- C:\Windows\System\SpmvLCY.exe
  C:\Windows\System\SpmvLCY.exe
  2⤵
  PID:7080
- C:\Windows\System\xmjZZaY.exe
  C:\Windows\System\xmjZZaY.exe
  2⤵
  PID:7156
- C:\Windows\System\IGHSsJe.exe
  C:\Windows\System\IGHSsJe.exe
  2⤵
  PID:5416
- C:\Windows\System\AaBDQhU.exe
  C:\Windows\System\AaBDQhU.exe
  2⤵
  PID:6340
- C:\Windows\System\KWCKmrV.exe
  C:\Windows\System\KWCKmrV.exe
  2⤵
  PID:6292
- C:\Windows\System\vrGJMOl.exe
  C:\Windows\System\vrGJMOl.exe
  2⤵
  PID:6420
- C:\Windows\System\oHtyAOS.exe
  C:\Windows\System\oHtyAOS.exe
  2⤵
  PID:6560
- C:\Windows\System\YGdQSQC.exe
  C:\Windows\System\YGdQSQC.exe
  2⤵
  PID:6516
- C:\Windows\System\MsOjUVM.exe
  C:\Windows\System\MsOjUVM.exe
  2⤵
  PID:6576
- C:\Windows\System\mzBkRka.exe
  C:\Windows\System\mzBkRka.exe
  2⤵
  PID:6692
- C:\Windows\System\aktjWSn.exe
  C:\Windows\System\aktjWSn.exe
  2⤵
  PID:6696
- C:\Windows\System\LSsIsLj.exe
  C:\Windows\System\LSsIsLj.exe
  2⤵
  PID:6708
- C:\Windows\System\WXJzTdF.exe
  C:\Windows\System\WXJzTdF.exe
  2⤵
  PID:6744
- C:\Windows\System\nuZPrvr.exe
  C:\Windows\System\nuZPrvr.exe
  2⤵
  PID:6872
- C:\Windows\System\uRndsbJ.exe
  C:\Windows\System\uRndsbJ.exe
  2⤵
  PID:6928
- C:\Windows\System\VYGdrbF.exe
  C:\Windows\System\VYGdrbF.exe
  2⤵
  PID:6964
- C:\Windows\System\TzrvAMg.exe
  C:\Windows\System\TzrvAMg.exe
  2⤵
  PID:7024
- C:\Windows\System\aCTAmuS.exe
  C:\Windows\System\aCTAmuS.exe
  2⤵
  PID:7060
- C:\Windows\System\gcTJXhR.exe
  C:\Windows\System\gcTJXhR.exe
  2⤵
  PID:7012
- C:\Windows\System\DjmECHH.exe
  C:\Windows\System\DjmECHH.exe
  2⤵
  PID:6600
- C:\Windows\System\SVWywpE.exe
  C:\Windows\System\SVWywpE.exe
  2⤵
  PID:6288
- C:\Windows\System\ckNSwLV.exe
  C:\Windows\System\ckNSwLV.exe
  2⤵
  PID:5324
- C:\Windows\System\ZWitFCu.exe
  C:\Windows\System\ZWitFCu.exe
  2⤵
  PID:6308
- C:\Windows\System\sOtgant.exe
  C:\Windows\System\sOtgant.exe
  2⤵
  PID:6400
- C:\Windows\System\npGuGBx.exe
  C:\Windows\System\npGuGBx.exe
  2⤵
  PID:5192
- C:\Windows\System\rpTDxcy.exe
  C:\Windows\System\rpTDxcy.exe
  2⤵
  PID:6180
- C:\Windows\System\omUCwdq.exe
  C:\Windows\System\omUCwdq.exe
  2⤵
  PID:6196
- C:\Windows\System\oROVptW.exe
  C:\Windows\System\oROVptW.exe
  2⤵
  PID:6240
- C:\Windows\System\EMQLyZp.exe
  C:\Windows\System\EMQLyZp.exe
  2⤵
  PID:6500
- C:\Windows\System\wKRvFdM.exe
  C:\Windows\System\wKRvFdM.exe
  2⤵
  PID:6468
- C:\Windows\System\ACADzIG.exe
  C:\Windows\System\ACADzIG.exe
  2⤵
  PID:6724
- C:\Windows\System\EcCkTEq.exe
  C:\Windows\System\EcCkTEq.exe
  2⤵
  PID:6792
- C:\Windows\System\tElxNiG.exe
  C:\Windows\System\tElxNiG.exe
  2⤵
  PID:6856
- C:\Windows\System\mGLiQir.exe
  C:\Windows\System\mGLiQir.exe
  2⤵
  PID:6844
- C:\Windows\System\idiNoGr.exe
  C:\Windows\System\idiNoGr.exe
  2⤵
  PID:6788
- C:\Windows\System\obOfJVT.exe
  C:\Windows\System\obOfJVT.exe
  2⤵
  PID:6648
- C:\Windows\System\GnHdUrS.exe
  C:\Windows\System\GnHdUrS.exe
  2⤵
  PID:6944
- C:\Windows\System\cwSfzsh.exe
  C:\Windows\System\cwSfzsh.exe
  2⤵
  PID:5532
- C:\Windows\System\GaQEWPA.exe
  C:\Windows\System\GaQEWPA.exe
  2⤵
  PID:6512
- C:\Windows\System\qgcSZrI.exe
  C:\Windows\System\qgcSZrI.exe
  2⤵
  PID:6544
- C:\Windows\System\cKpQxrd.exe
  C:\Windows\System\cKpQxrd.exe
  2⤵
  PID:6224
- C:\Windows\System\tMOzbxt.exe
  C:\Windows\System\tMOzbxt.exe
  2⤵
  PID:7040
- C:\Windows\System\hcxfDLw.exe
  C:\Windows\System\hcxfDLw.exe
  2⤵
  PID:6244
- C:\Windows\System\fByZXJN.exe
  C:\Windows\System\fByZXJN.exe
  2⤵
  PID:6164
- C:\Windows\System\LKrYZrg.exe
  C:\Windows\System\LKrYZrg.exe
  2⤵
  PID:6664
- C:\Windows\System\KzsfrJQ.exe
  C:\Windows\System\KzsfrJQ.exe
  2⤵
  PID:6888
- C:\Windows\System\AKqsdXJ.exe
  C:\Windows\System\AKqsdXJ.exe
  2⤵
  PID:7088
- C:\Windows\System\yxSFxOd.exe
  C:\Windows\System\yxSFxOd.exe
  2⤵
  PID:6436
- C:\Windows\System\vFFDxxO.exe
  C:\Windows\System\vFFDxxO.exe
  2⤵
  PID:6480
- C:\Windows\System\LXkCNFX.exe
  C:\Windows\System\LXkCNFX.exe
  2⤵
  PID:6980
- C:\Windows\System\JmMaSwN.exe
  C:\Windows\System\JmMaSwN.exe
  2⤵
  PID:6760
- C:\Windows\System\eshKOpd.exe
  C:\Windows\System\eshKOpd.exe
  2⤵
  PID:6860
- C:\Windows\System\mfwsZFX.exe
  C:\Windows\System\mfwsZFX.exe
  2⤵
  PID:6160
- C:\Windows\System\ZHgNLiG.exe
  C:\Windows\System\ZHgNLiG.exe
  2⤵
  PID:6948
- C:\Windows\System\FQMicII.exe
  C:\Windows\System\FQMicII.exe
  2⤵
  PID:6140
- C:\Windows\System\UcSfNxX.exe
  C:\Windows\System\UcSfNxX.exe
  2⤵
  PID:6256
- C:\Windows\System\MsMCnSu.exe
  C:\Windows\System\MsMCnSu.exe
  2⤵
  PID:7172
- C:\Windows\System\VrTYwZb.exe
  C:\Windows\System\VrTYwZb.exe
  2⤵
  PID:7188
- C:\Windows\System\VZohxdo.exe
  C:\Windows\System\VZohxdo.exe
  2⤵
  PID:7204
- C:\Windows\System\tIAgYgx.exe
  C:\Windows\System\tIAgYgx.exe
  2⤵
  PID:7220
- C:\Windows\System\iTceVrc.exe
  C:\Windows\System\iTceVrc.exe
  2⤵
  PID:7236
- C:\Windows\System\ksoXYef.exe
  C:\Windows\System\ksoXYef.exe
  2⤵
  PID:7256
- C:\Windows\System\gavcJQS.exe
  C:\Windows\System\gavcJQS.exe
  2⤵
  PID:7272
- C:\Windows\System\CeMiRXc.exe
  C:\Windows\System\CeMiRXc.exe
  2⤵
  PID:7288
- C:\Windows\System\cBOVZcw.exe
  C:\Windows\System\cBOVZcw.exe
  2⤵
  PID:7308
- C:\Windows\System\IimCnJP.exe
  C:\Windows\System\IimCnJP.exe
  2⤵
  PID:7324
- C:\Windows\System\mUWVyQX.exe
  C:\Windows\System\mUWVyQX.exe
  2⤵
  PID:7340
- C:\Windows\System\tmquGkW.exe
  C:\Windows\System\tmquGkW.exe
  2⤵
  PID:7356
- C:\Windows\System\EmtLiMO.exe
  C:\Windows\System\EmtLiMO.exe
  2⤵
  PID:7372
- C:\Windows\System\aziNuqz.exe
  C:\Windows\System\aziNuqz.exe
  2⤵
  PID:7388
- C:\Windows\System\ZkdFDnU.exe
  C:\Windows\System\ZkdFDnU.exe
  2⤵
  PID:7404
- C:\Windows\System\GqvKsDw.exe
  C:\Windows\System\GqvKsDw.exe
  2⤵
  PID:7420
- C:\Windows\System\koxuYdV.exe
  C:\Windows\System\koxuYdV.exe
  2⤵
  PID:7440
- C:\Windows\System\Wlikdbj.exe
  C:\Windows\System\Wlikdbj.exe
  2⤵
  PID:7528
- C:\Windows\System\dQLiiJs.exe
  C:\Windows\System\dQLiiJs.exe
  2⤵
  PID:7544
- C:\Windows\System\sKqbpQz.exe
  C:\Windows\System\sKqbpQz.exe
  2⤵
  PID:7560
- C:\Windows\System\FBwwrag.exe
  C:\Windows\System\FBwwrag.exe
  2⤵
  PID:7576
- C:\Windows\System\MoMETmy.exe
  C:\Windows\System\MoMETmy.exe
  2⤵
  PID:7592
- C:\Windows\System\HUxkKAz.exe
  C:\Windows\System\HUxkKAz.exe
  2⤵
  PID:7608
- C:\Windows\System\AIIWWgt.exe
  C:\Windows\System\AIIWWgt.exe
  2⤵
  PID:7624
- C:\Windows\System\smTWGJP.exe
  C:\Windows\System\smTWGJP.exe
  2⤵
  PID:7640
- C:\Windows\System\tqCOwej.exe
  C:\Windows\System\tqCOwej.exe
  2⤵
  PID:7656
- C:\Windows\System\WqJCwNu.exe
  C:\Windows\System\WqJCwNu.exe
  2⤵
  PID:7672
- C:\Windows\System\cMxBjsC.exe
  C:\Windows\System\cMxBjsC.exe
  2⤵
  PID:7688
- C:\Windows\System\lthJUYQ.exe
  C:\Windows\System\lthJUYQ.exe
  2⤵
  PID:7704
- C:\Windows\System\CvieYfT.exe
  C:\Windows\System\CvieYfT.exe
  2⤵
  PID:7720
- C:\Windows\System\svhlrjm.exe
  C:\Windows\System\svhlrjm.exe
  2⤵
  PID:7736
- C:\Windows\System\DBZKbOs.exe
  C:\Windows\System\DBZKbOs.exe
  2⤵
  PID:7772
- C:\Windows\System\ykOsqcE.exe
  C:\Windows\System\ykOsqcE.exe
  2⤵
  PID:7788
- C:\Windows\System\KfVRGMj.exe
  C:\Windows\System\KfVRGMj.exe
  2⤵
  PID:7804
- C:\Windows\System\skdMezt.exe
  C:\Windows\System\skdMezt.exe
  2⤵
  PID:7824
- C:\Windows\System\jdlCsKi.exe
  C:\Windows\System\jdlCsKi.exe
  2⤵
  PID:7848
- C:\Windows\System\nphkJja.exe
  C:\Windows\System\nphkJja.exe
  2⤵
  PID:7864
- C:\Windows\System\ltSazxc.exe
  C:\Windows\System\ltSazxc.exe
  2⤵
  PID:7880
- C:\Windows\System\kLvsVCr.exe
  C:\Windows\System\kLvsVCr.exe
  2⤵
  PID:7896
- C:\Windows\System\biWDQwi.exe
  C:\Windows\System\biWDQwi.exe
  2⤵
  PID:7912
- C:\Windows\System\zWQbXuu.exe
  C:\Windows\System\zWQbXuu.exe
  2⤵
  PID:7952
- C:\Windows\System\JZsPUBE.exe
  C:\Windows\System\JZsPUBE.exe
  2⤵
  PID:7968
- C:\Windows\System\JacaltP.exe
  C:\Windows\System\JacaltP.exe
  2⤵
  PID:7988
- C:\Windows\System\mqxMato.exe
  C:\Windows\System\mqxMato.exe
  2⤵
  PID:8004
- C:\Windows\System\wGjnZYi.exe
  C:\Windows\System\wGjnZYi.exe
  2⤵
  PID:8024
- C:\Windows\System\HteiKKB.exe
  C:\Windows\System\HteiKKB.exe
  2⤵
  PID:8044
- C:\Windows\System\QyAHPOh.exe
  C:\Windows\System\QyAHPOh.exe
  2⤵
  PID:8060
- C:\Windows\System\DEJTfkC.exe
  C:\Windows\System\DEJTfkC.exe
  2⤵
  PID:8092
- C:\Windows\System\biXZnnU.exe
  C:\Windows\System\biXZnnU.exe
  2⤵
  PID:8116
- C:\Windows\System\UdZSDBH.exe
  C:\Windows\System\UdZSDBH.exe
  2⤵
  PID:8132
- C:\Windows\System\QqTGzNe.exe
  C:\Windows\System\QqTGzNe.exe
  2⤵
  PID:8156
- C:\Windows\System\EGhYGcy.exe
  C:\Windows\System\EGhYGcy.exe
  2⤵
  PID:8176
- C:\Windows\System\QIMQkGv.exe
  C:\Windows\System\QIMQkGv.exe
  2⤵
  PID:6840
- C:\Windows\System\BwdqZIP.exe
  C:\Windows\System\BwdqZIP.exe
  2⤵
  PID:6912
- C:\Windows\System\YOPyuZU.exe
  C:\Windows\System\YOPyuZU.exe
  2⤵
  PID:7280
- C:\Windows\System\rOdzhTn.exe
  C:\Windows\System\rOdzhTn.exe
  2⤵
  PID:7248
- C:\Windows\System\raKWgxm.exe
  C:\Windows\System\raKWgxm.exe
  2⤵
  PID:6644
- C:\Windows\System\TqcVgMW.exe
  C:\Windows\System\TqcVgMW.exe
  2⤵
  PID:7348
- C:\Windows\System\nHgRNbp.exe
  C:\Windows\System\nHgRNbp.exe
  2⤵
  PID:7448
- C:\Windows\System\cDKpNOj.exe
  C:\Windows\System\cDKpNOj.exe
  2⤵
  PID:7096
- C:\Windows\System\BisfGih.exe
  C:\Windows\System\BisfGih.exe
  2⤵
  PID:6272
- C:\Windows\System\nstlrUZ.exe
  C:\Windows\System\nstlrUZ.exe
  2⤵
  PID:6940
- C:\Windows\System\ZgorkQj.exe
  C:\Windows\System\ZgorkQj.exe
  2⤵
  PID:7196
- C:\Windows\System\pbdZSBy.exe
  C:\Windows\System\pbdZSBy.exe
  2⤵
  PID:7364
- C:\Windows\System\wlKuxRj.exe
  C:\Windows\System\wlKuxRj.exe
  2⤵
  PID:7432
- C:\Windows\System\KaIxVaL.exe
  C:\Windows\System\KaIxVaL.exe
  2⤵
  PID:7540
- C:\Windows\System\RViXYBM.exe
  C:\Windows\System\RViXYBM.exe
  2⤵
  PID:7632
- C:\Windows\System\QUXYvwi.exe
  C:\Windows\System\QUXYvwi.exe
  2⤵
  PID:7728
- C:\Windows\System\fQESLZk.exe
  C:\Windows\System\fQESLZk.exe
  2⤵
  PID:7476
- C:\Windows\System\niDtVDC.exe
  C:\Windows\System\niDtVDC.exe
  2⤵
  PID:7800
- C:\Windows\System\aiVgPbw.exe
  C:\Windows\System\aiVgPbw.exe
  2⤵
  PID:7508
- C:\Windows\System\CWgbUXW.exe
  C:\Windows\System\CWgbUXW.exe
  2⤵
  PID:7492
- C:\Windows\System\JfpzjeF.exe
  C:\Windows\System\JfpzjeF.exe
  2⤵
  PID:7680
- C:\Windows\System\jnoghnm.exe
  C:\Windows\System\jnoghnm.exe
  2⤵
  PID:7876
- C:\Windows\System\OYSzySq.exe
  C:\Windows\System\OYSzySq.exe
  2⤵
  PID:7888
- C:\Windows\System\dwPtCoi.exe
  C:\Windows\System\dwPtCoi.exe
  2⤵
  PID:7856
- C:\Windows\System\nfKiRlQ.exe
  C:\Windows\System\nfKiRlQ.exe
  2⤵
  PID:7924
- C:\Windows\System\JSuMOpY.exe
  C:\Windows\System\JSuMOpY.exe
  2⤵
  PID:7948
- C:\Windows\System\gCKCRVr.exe
  C:\Windows\System\gCKCRVr.exe
  2⤵
  PID:7996
- C:\Windows\System\BOCmNpy.exe
  C:\Windows\System\BOCmNpy.exe
  2⤵
  PID:8056
- C:\Windows\System\gHNwcdz.exe
  C:\Windows\System\gHNwcdz.exe
  2⤵
  PID:8100
- C:\Windows\System\gSpmsAx.exe
  C:\Windows\System\gSpmsAx.exe
  2⤵
  PID:8088
- C:\Windows\System\vTxkaFL.exe
  C:\Windows\System\vTxkaFL.exe
  2⤵
  PID:8072
- C:\Windows\System\kcxfgWm.exe
  C:\Windows\System\kcxfgWm.exe
  2⤵
  PID:8164
- C:\Windows\System\ozRriac.exe
  C:\Windows\System\ozRriac.exe
  2⤵
  PID:7452
- C:\Windows\System\BQjxsmX.exe
  C:\Windows\System\BQjxsmX.exe
  2⤵
  PID:6228
- C:\Windows\System\RcNVTXe.exe
  C:\Windows\System\RcNVTXe.exe
  2⤵
  PID:7244
- C:\Windows\System\NccYodV.exe
  C:\Windows\System\NccYodV.exe
  2⤵
  PID:6432
- C:\Windows\System\wIIZyQA.exe
  C:\Windows\System\wIIZyQA.exe
  2⤵
  PID:7384
- C:\Windows\System\SznidYw.exe
  C:\Windows\System\SznidYw.exe
  2⤵
  PID:7436
- C:\Windows\System\SWuLesu.exe
  C:\Windows\System\SWuLesu.exe
  2⤵
  PID:7416
- C:\Windows\System\rDcGExP.exe
  C:\Windows\System\rDcGExP.exe
  2⤵
  PID:7412
- C:\Windows\System\xGVJClY.exe
  C:\Windows\System\xGVJClY.exe
  2⤵
  PID:7572
- C:\Windows\System\bGzWYzQ.exe
  C:\Windows\System\bGzWYzQ.exe
  2⤵
  PID:6176
- C:\Windows\System\wZLzxzP.exe
  C:\Windows\System\wZLzxzP.exe
  2⤵
  PID:7664
- C:\Windows\System\qEbyfnI.exe
  C:\Windows\System\qEbyfnI.exe
  2⤵
  PID:7812
- C:\Windows\System\vdpXzcF.exe
  C:\Windows\System\vdpXzcF.exe
  2⤵
  PID:7480
- C:\Windows\System\VagVlHk.exe
  C:\Windows\System\VagVlHk.exe
  2⤵
  PID:7872
- C:\Windows\System\vQvdSZl.exe
  C:\Windows\System\vQvdSZl.exe
  2⤵
  PID:7940
- C:\Windows\System\SmlisUl.exe
  C:\Windows\System\SmlisUl.exe
  2⤵
  PID:8020
- C:\Windows\System\nexbXmG.exe
  C:\Windows\System\nexbXmG.exe
  2⤵
  PID:7908
- C:\Windows\System\aqrKyma.exe
  C:\Windows\System\aqrKyma.exe
  2⤵
  PID:7964
- C:\Windows\System\AEwYvTF.exe
  C:\Windows\System\AEwYvTF.exe
  2⤵
  PID:7684
- C:\Windows\System\zMndQjS.exe
  C:\Windows\System\zMndQjS.exe
  2⤵
  PID:7976
- C:\Windows\System\zJYAeWI.exe
  C:\Windows\System\zJYAeWI.exe
  2⤵
  PID:7932
- C:\Windows\System\hJGKAex.exe
  C:\Windows\System\hJGKAex.exe
  2⤵
  PID:8036
- C:\Windows\System\rNZyzUx.exe
  C:\Windows\System\rNZyzUx.exe
  2⤵
  PID:8172
- C:\Windows\System\soQNUeX.exe
  C:\Windows\System\soQNUeX.exe
  2⤵
  PID:6276
- C:\Windows\System\gldfWQK.exe
  C:\Windows\System\gldfWQK.exe
  2⤵
  PID:7316
- C:\Windows\System\RRWNqor.exe
  C:\Windows\System\RRWNqor.exe
  2⤵
  PID:7400
- C:\Windows\System\jyjkrIy.exe
  C:\Windows\System\jyjkrIy.exe
  2⤵
  PID:7504
- C:\Windows\System\xkYqEng.exe
  C:\Windows\System\xkYqEng.exe
  2⤵
  PID:7936
- C:\Windows\System\AbhxWwi.exe
  C:\Windows\System\AbhxWwi.exe
  2⤵
  PID:8148
- C:\Windows\System\QYvvFrk.exe
  C:\Windows\System\QYvvFrk.exe
  2⤵
  PID:7752
- C:\Windows\System\qSOUETO.exe
  C:\Windows\System\qSOUETO.exe
  2⤵
  PID:8140
- C:\Windows\System\LefnxRG.exe
  C:\Windows\System\LefnxRG.exe
  2⤵
  PID:7524
- C:\Windows\System\arcybXG.exe
  C:\Windows\System\arcybXG.exe
  2⤵
  PID:7332
- C:\Windows\System\zkuBkEH.exe
  C:\Windows\System\zkuBkEH.exe
  2⤵
  PID:7700
- C:\Windows\System\kqjNjBO.exe
  C:\Windows\System\kqjNjBO.exe
  2⤵
  PID:7768
- C:\Windows\System\oBWClKt.exe
  C:\Windows\System\oBWClKt.exe
  2⤵
  PID:7212
- C:\Windows\System\GdPoEhc.exe
  C:\Windows\System\GdPoEhc.exe
  2⤵
  PID:8168
- C:\Windows\System\EySxvqB.exe
  C:\Windows\System\EySxvqB.exe
  2⤵
  PID:7252
- C:\Windows\System\RvQEmYE.exe
  C:\Windows\System\RvQEmYE.exe
  2⤵
  PID:7428
- C:\Windows\System\RGnotAi.exe
  C:\Windows\System\RGnotAi.exe
  2⤵
  PID:7892
- C:\Windows\System\KNpwefL.exe
  C:\Windows\System\KNpwefL.exe
  2⤵
  PID:8000
- C:\Windows\System\AYSdcan.exe
  C:\Windows\System\AYSdcan.exe
  2⤵
  PID:7516
- C:\Windows\System\VsGqgby.exe
  C:\Windows\System\VsGqgby.exe
  2⤵
  PID:7536
- C:\Windows\System\rjesiAt.exe
  C:\Windows\System\rjesiAt.exe
  2⤵
  PID:8196
- C:\Windows\System\zqoGEFD.exe
  C:\Windows\System\zqoGEFD.exe
  2⤵
  PID:8212
- C:\Windows\System\IZagMOo.exe
  C:\Windows\System\IZagMOo.exe
  2⤵
  PID:8228
- C:\Windows\System\rzfwMRV.exe
  C:\Windows\System\rzfwMRV.exe
  2⤵
  PID:8256
- C:\Windows\System\yrrgoot.exe
  C:\Windows\System\yrrgoot.exe
  2⤵
  PID:8280
- C:\Windows\System\yibIFyo.exe
  C:\Windows\System\yibIFyo.exe
  2⤵
  PID:8296
- C:\Windows\System\lLWFusP.exe
  C:\Windows\System\lLWFusP.exe
  2⤵
  PID:8320
- C:\Windows\System\BHcOxdG.exe
  C:\Windows\System\BHcOxdG.exe
  2⤵
  PID:8340
- C:\Windows\System\ynTlVZM.exe
  C:\Windows\System\ynTlVZM.exe
  2⤵
  PID:8356
- C:\Windows\System\lISsnkt.exe
  C:\Windows\System\lISsnkt.exe
  2⤵
  PID:8372
- C:\Windows\System\zJTAtEd.exe
  C:\Windows\System\zJTAtEd.exe
  2⤵
  PID:8392
- C:\Windows\System\SKqCamQ.exe
  C:\Windows\System\SKqCamQ.exe
  2⤵
  PID:8408
- C:\Windows\System\QdccypJ.exe
  C:\Windows\System\QdccypJ.exe
  2⤵
  PID:8424
- C:\Windows\System\bJBSfcT.exe
  C:\Windows\System\bJBSfcT.exe
  2⤵
  PID:8444
- C:\Windows\System\GXaaGer.exe
  C:\Windows\System\GXaaGer.exe
  2⤵
  PID:8504
- C:\Windows\System\HZuInTm.exe
  C:\Windows\System\HZuInTm.exe
  2⤵
  PID:8520
- C:\Windows\System\unEDWGY.exe
  C:\Windows\System\unEDWGY.exe
  2⤵
  PID:8536
- C:\Windows\System\rAdWNqM.exe
  C:\Windows\System\rAdWNqM.exe
  2⤵
  PID:8552
- C:\Windows\System\CFexmDu.exe
  C:\Windows\System\CFexmDu.exe
  2⤵
  PID:8568
- C:\Windows\System\YBcaQOd.exe
  C:\Windows\System\YBcaQOd.exe
  2⤵
  PID:8584
- C:\Windows\System\bUrBggT.exe
  C:\Windows\System\bUrBggT.exe
  2⤵
  PID:8600
- C:\Windows\System\NaQTYJv.exe
  C:\Windows\System\NaQTYJv.exe
  2⤵
  PID:8616
- C:\Windows\System\JnKWCmH.exe
  C:\Windows\System\JnKWCmH.exe
  2⤵
  PID:8632
- C:\Windows\System\EgMbLEt.exe
  C:\Windows\System\EgMbLEt.exe
  2⤵
  PID:8648
- C:\Windows\System\jRPAVrF.exe
  C:\Windows\System\jRPAVrF.exe
  2⤵
  PID:8664
- C:\Windows\System\WpmPLmT.exe
  C:\Windows\System\WpmPLmT.exe
  2⤵
  PID:8680
- C:\Windows\System\PxSLmuR.exe
  C:\Windows\System\PxSLmuR.exe
  2⤵
  PID:8696
- C:\Windows\System\dJEPRVw.exe
  C:\Windows\System\dJEPRVw.exe
  2⤵
  PID:8712
- C:\Windows\System\CNfafby.exe
  C:\Windows\System\CNfafby.exe
  2⤵
  PID:8728
- C:\Windows\System\XMMjMJw.exe
  C:\Windows\System\XMMjMJw.exe
  2⤵
  PID:8748
- C:\Windows\System\MnYqyHa.exe
  C:\Windows\System\MnYqyHa.exe
  2⤵
  PID:8764
- C:\Windows\System\xEyLOZc.exe
  C:\Windows\System\xEyLOZc.exe
  2⤵
  PID:8780
- C:\Windows\System\fkrwWAT.exe
  C:\Windows\System\fkrwWAT.exe
  2⤵
  PID:8800
- C:\Windows\System\gVxFUIM.exe
  C:\Windows\System\gVxFUIM.exe
  2⤵
  PID:8816
- C:\Windows\System\WyKjJIQ.exe
  C:\Windows\System\WyKjJIQ.exe
  2⤵
  PID:8832
- C:\Windows\System\hQMKbcA.exe
  C:\Windows\System\hQMKbcA.exe
  2⤵
  PID:8852
- C:\Windows\System\ontydnl.exe
  C:\Windows\System\ontydnl.exe
  2⤵
  PID:8868
- C:\Windows\System\EoKIQFK.exe
  C:\Windows\System\EoKIQFK.exe
  2⤵
  PID:8884
- C:\Windows\System\dxoMOYG.exe
  C:\Windows\System\dxoMOYG.exe
  2⤵
  PID:8904
- C:\Windows\System\FNvFwqS.exe
  C:\Windows\System\FNvFwqS.exe
  2⤵
  PID:8928
- C:\Windows\System\ATrUfVe.exe
  C:\Windows\System\ATrUfVe.exe
  2⤵
  PID:8980
- C:\Windows\System\HwRlOTd.exe
  C:\Windows\System\HwRlOTd.exe
  2⤵
  PID:7496
- C:\Windows\System\SlXDuKC.exe
  C:\Windows\System\SlXDuKC.exe
  2⤵
  PID:6416
- C:\Windows\System\wHfirAJ.exe
  C:\Windows\System\wHfirAJ.exe
  2⤵
  PID:7232
- C:\Windows\System\FtYBobk.exe
  C:\Windows\System\FtYBobk.exe
  2⤵
  PID:8268
- C:\Windows\System\cFFstaC.exe
  C:\Windows\System\cFFstaC.exe
  2⤵
  PID:8312
- C:\Windows\System\yIWnbXT.exe
  C:\Windows\System\yIWnbXT.exe
  2⤵
  PID:8380
- C:\Windows\System\PfsrFdH.exe
  C:\Windows\System\PfsrFdH.exe
  2⤵
  PID:8240
- C:\Windows\System\AqUuIxb.exe
  C:\Windows\System\AqUuIxb.exe
  2⤵
  PID:8328
- C:\Windows\System\EgaNKhJ.exe
  C:\Windows\System\EgaNKhJ.exe
  2⤵
  PID:8404
- C:\Windows\System\FuvZXAq.exe
  C:\Windows\System\FuvZXAq.exe
  2⤵
  PID:7780
- C:\Windows\System\uVQmemI.exe
  C:\Windows\System\uVQmemI.exe
  2⤵
  PID:7472
- C:\Windows\System\izeqKBo.exe
  C:\Windows\System\izeqKBo.exe
  2⤵
  PID:8456
- C:\Windows\System\GOfxRLa.exe
  C:\Windows\System\GOfxRLa.exe
  2⤵
  PID:8468
- C:\Windows\System\NKzctFO.exe
  C:\Windows\System\NKzctFO.exe
  2⤵
  PID:8640
- C:\Windows\System\iDsziYV.exe
  C:\Windows\System\iDsziYV.exe
  2⤵
  PID:8644
- C:\Windows\System\eAemssr.exe
  C:\Windows\System\eAemssr.exe
  2⤵
  PID:8628
- C:\Windows\System\doEqufk.exe
  C:\Windows\System\doEqufk.exe
  2⤵
  PID:8660
- C:\Windows\System\yaOvZPs.exe
  C:\Windows\System\yaOvZPs.exe
  2⤵
  PID:8596
- C:\Windows\System\aZriblZ.exe
  C:\Windows\System\aZriblZ.exe
  2⤵
  PID:8708
- C:\Windows\System\anlazqA.exe
  C:\Windows\System\anlazqA.exe
  2⤵
  PID:8720
- C:\Windows\System\kdRPSiF.exe
  C:\Windows\System\kdRPSiF.exe
  2⤵
  PID:8796
- C:\Windows\System\oDzsXRX.exe
  C:\Windows\System\oDzsXRX.exe
  2⤵
  PID:8860
- C:\Windows\System\CdiyGUl.exe
  C:\Windows\System\CdiyGUl.exe
  2⤵
  PID:8724
- C:\Windows\System\GfWoxSt.exe
  C:\Windows\System\GfWoxSt.exe
  2⤵
  PID:8744
- C:\Windows\System\phOWwlp.exe
  C:\Windows\System\phOWwlp.exe
  2⤵
  PID:8692
- C:\Windows\System\kVrVDNN.exe
  C:\Windows\System\kVrVDNN.exe
  2⤵
  PID:8704
- C:\Windows\System\tjBAKqx.exe
  C:\Windows\System\tjBAKqx.exe
  2⤵
  PID:8840
- C:\Windows\System\kFOvWhf.exe
  C:\Windows\System\kFOvWhf.exe
  2⤵
  PID:8880
- C:\Windows\System\WkcIZuE.exe
  C:\Windows\System\WkcIZuE.exe
  2⤵
  PID:8960
- C:\Windows\System\GeGeFOC.exe
  C:\Windows\System\GeGeFOC.exe
  2⤵
  PID:9012
- C:\Windows\System\pxeqFWX.exe
  C:\Windows\System\pxeqFWX.exe
  2⤵
  PID:9108
- C:\Windows\System\wEchyuu.exe
  C:\Windows\System\wEchyuu.exe
  2⤵
  PID:9148
- C:\Windows\System\dsCZUUu.exe
  C:\Windows\System\dsCZUUu.exe
  2⤵
  PID:9000
- C:\Windows\System\cjlyNzo.exe
  C:\Windows\System\cjlyNzo.exe
  2⤵
  PID:9028
- C:\Windows\System\ZLREcSj.exe
  C:\Windows\System\ZLREcSj.exe
  2⤵
  PID:9044
- C:\Windows\System\exaaUqB.exe
  C:\Windows\System\exaaUqB.exe
  2⤵
  PID:9060
- C:\Windows\System\InGsYKl.exe
  C:\Windows\System\InGsYKl.exe
  2⤵
  PID:9088
- C:\Windows\System\HMCQsjI.exe
  C:\Windows\System\HMCQsjI.exe
  2⤵
  PID:9112
- C:\Windows\System\MwELjnF.exe
  C:\Windows\System\MwELjnF.exe
  2⤵
  PID:9184
- C:\Windows\System\kNsSSVb.exe
  C:\Windows\System\kNsSSVb.exe
  2⤵
  PID:9152
- C:\Windows\System\YcxsoEy.exe
  C:\Windows\System\YcxsoEy.exe
  2⤵
  PID:9208
- C:\Windows\System\SMpuodM.exe
  C:\Windows\System\SMpuodM.exe
  2⤵
  PID:9200
- C:\Windows\System\sdbsaTQ.exe
  C:\Windows\System\sdbsaTQ.exe
  2⤵
  PID:8220
- C:\Windows\System\hPmoRAy.exe
  C:\Windows\System\hPmoRAy.exe
  2⤵
  PID:7336
- C:\Windows\System\jpFplGm.exe
  C:\Windows\System\jpFplGm.exe
  2⤵
  PID:8272
- C:\Windows\System\kVWfZbV.exe
  C:\Windows\System\kVWfZbV.exe
  2⤵
  PID:8248
- C:\Windows\System\ohIEWhQ.exe
  C:\Windows\System\ohIEWhQ.exe
  2⤵
  PID:8788
- C:\Windows\System\WSfttFG.exe
  C:\Windows\System\WSfttFG.exe
  2⤵
  PID:9156
- C:\Windows\System\plnlNOs.exe
  C:\Windows\System\plnlNOs.exe
  2⤵
  PID:9040
- C:\Windows\System\GkXGhlm.exe
  C:\Windows\System\GkXGhlm.exe
  2⤵
  PID:9092
- C:\Windows\System\AjmPZyE.exe
  C:\Windows\System\AjmPZyE.exe
  2⤵
  PID:9180
- C:\Windows\System\gVHrvZP.exe
  C:\Windows\System\gVHrvZP.exe
  2⤵
  PID:9196
- C:\Windows\System\tmwLFDY.exe
  C:\Windows\System\tmwLFDY.exe
  2⤵
  PID:7648
- C:\Windows\System\zLJZNxf.exe
  C:\Windows\System\zLJZNxf.exe
  2⤵
  PID:8352
- C:\Windows\System\HjLgrCB.exe
  C:\Windows\System\HjLgrCB.exe
  2⤵
  PID:7604
- C:\Windows\System\tJyDZnz.exe
  C:\Windows\System\tJyDZnz.exe
  2⤵
  PID:8368
- C:\Windows\System\rDZePNN.exe
  C:\Windows\System\rDZePNN.exe
  2⤵
  PID:9136
- C:\Windows\System\RuKuHIF.exe
  C:\Windows\System\RuKuHIF.exe
  2⤵
  PID:8740
- C:\Windows\System\GmeqNQp.exe
  C:\Windows\System\GmeqNQp.exe
  2⤵
  PID:8580
- C:\Windows\System\aNUVnCH.exe
  C:\Windows\System\aNUVnCH.exe
  2⤵
  PID:8084
- C:\Windows\System\erKrIeT.exe
  C:\Windows\System\erKrIeT.exe
  2⤵
  PID:8472
- C:\Windows\System\IcCzkmU.exe
  C:\Windows\System\IcCzkmU.exe
  2⤵
  PID:8576
- C:\Windows\System\DfgbsAE.exe
  C:\Windows\System\DfgbsAE.exe
  2⤵
  PID:8676
- C:\Windows\System\mCpVdZG.exe
  C:\Windows\System\mCpVdZG.exe
  2⤵
  PID:8244
- C:\Windows\System\qxdiPRk.exe
  C:\Windows\System\qxdiPRk.exe
  2⤵
  PID:9096
- C:\Windows\System\jNFNjIX.exe
  C:\Windows\System\jNFNjIX.exe
  2⤵
  PID:8516
- C:\Windows\System\oAlyrcQ.exe
  C:\Windows\System\oAlyrcQ.exe
  2⤵
  PID:9224
- C:\Windows\System\cEXNYcs.exe
  C:\Windows\System\cEXNYcs.exe
  2⤵
  PID:9240
- C:\Windows\System\OZrbszu.exe
  C:\Windows\System\OZrbszu.exe
  2⤵
  PID:9256
- C:\Windows\System\GCyldOp.exe
  C:\Windows\System\GCyldOp.exe
  2⤵
  PID:9272
- C:\Windows\System\VMfIrlY.exe
  C:\Windows\System\VMfIrlY.exe
  2⤵
  PID:9288
- C:\Windows\System\sEzUvWl.exe
  C:\Windows\System\sEzUvWl.exe
  2⤵
  PID:9304
- C:\Windows\System\ovMULXL.exe
  C:\Windows\System\ovMULXL.exe
  2⤵
  PID:9320
- C:\Windows\System\ciyJMAY.exe
  C:\Windows\System\ciyJMAY.exe
  2⤵
  PID:9336
- C:\Windows\System\CTzDVut.exe
  C:\Windows\System\CTzDVut.exe
  2⤵
  PID:9352
- C:\Windows\System\EskszPk.exe
  C:\Windows\System\EskszPk.exe
  2⤵
  PID:9368
- C:\Windows\System\WNfKamh.exe
  C:\Windows\System\WNfKamh.exe
  2⤵
  PID:9384
- C:\Windows\System\RHVGzmD.exe
  C:\Windows\System\RHVGzmD.exe
  2⤵
  PID:9400
- C:\Windows\System\kkYuFOk.exe
  C:\Windows\System\kkYuFOk.exe
  2⤵
  PID:9416
- C:\Windows\System\asrgCRp.exe
  C:\Windows\System\asrgCRp.exe
  2⤵
  PID:9432
- C:\Windows\System\SYpMQce.exe
  C:\Windows\System\SYpMQce.exe
  2⤵
  PID:9448
- C:\Windows\System\BaMTOOX.exe
  C:\Windows\System\BaMTOOX.exe
  2⤵
  PID:9468
- C:\Windows\System\yjbHiOQ.exe
  C:\Windows\System\yjbHiOQ.exe
  2⤵
  PID:9484
- C:\Windows\System\GnCIFls.exe
  C:\Windows\System\GnCIFls.exe
  2⤵
  PID:9500
- C:\Windows\System\HaGjUcY.exe
  C:\Windows\System\HaGjUcY.exe
  2⤵
  PID:9516
- C:\Windows\System\bwcjqdg.exe
  C:\Windows\System\bwcjqdg.exe
  2⤵
  PID:9532
- C:\Windows\System\BvRUMpQ.exe
  C:\Windows\System\BvRUMpQ.exe
  2⤵
  PID:9548
- C:\Windows\System\PAruDCc.exe
  C:\Windows\System\PAruDCc.exe
  2⤵
  PID:9564
- C:\Windows\System\iDcFSqG.exe
  C:\Windows\System\iDcFSqG.exe
  2⤵
  PID:9580
- C:\Windows\System\camDJSC.exe
  C:\Windows\System\camDJSC.exe
  2⤵
  PID:9596
- C:\Windows\System\JrzVEoD.exe
  C:\Windows\System\JrzVEoD.exe
  2⤵
  PID:9612
- C:\Windows\System\tpynNHm.exe
  C:\Windows\System\tpynNHm.exe
  2⤵
  PID:9628
- C:\Windows\System\ynONtQl.exe
  C:\Windows\System\ynONtQl.exe
  2⤵
  PID:9644
- C:\Windows\System\eTdGhkX.exe
  C:\Windows\System\eTdGhkX.exe
  2⤵
  PID:9660
- C:\Windows\System\uQOwwBd.exe
  C:\Windows\System\uQOwwBd.exe
  2⤵
  PID:9676
- C:\Windows\System\reTrVlt.exe
  C:\Windows\System\reTrVlt.exe
  2⤵
  PID:9692
- C:\Windows\System\jmeJJLW.exe
  C:\Windows\System\jmeJJLW.exe
  2⤵
  PID:9708
- C:\Windows\System\raMJMxH.exe
  C:\Windows\System\raMJMxH.exe
  2⤵
  PID:9724
- C:\Windows\System\GThtbzQ.exe
  C:\Windows\System\GThtbzQ.exe
  2⤵
  PID:9740
- C:\Windows\System\TErIzgw.exe
  C:\Windows\System\TErIzgw.exe
  2⤵
  PID:9760
- C:\Windows\System\yFJwZeX.exe
  C:\Windows\System\yFJwZeX.exe
  2⤵
  PID:9776
- C:\Windows\System\HimqvtA.exe
  C:\Windows\System\HimqvtA.exe
  2⤵
  PID:9792
- C:\Windows\System\icQBzCo.exe
  C:\Windows\System\icQBzCo.exe
  2⤵
  PID:9812
- C:\Windows\System\ujmzpXK.exe
  C:\Windows\System\ujmzpXK.exe
  2⤵
  PID:9828
- C:\Windows\System\VeJdMqX.exe
  C:\Windows\System\VeJdMqX.exe
  2⤵
  PID:9844
- C:\Windows\System\rcGRICW.exe
  C:\Windows\System\rcGRICW.exe
  2⤵
  PID:9860
- C:\Windows\System\MQxxCVO.exe
  C:\Windows\System\MQxxCVO.exe
  2⤵
  PID:9876
- C:\Windows\System\fhlSsfX.exe
  C:\Windows\System\fhlSsfX.exe
  2⤵
  PID:9896
- C:\Windows\System\aiYluOi.exe
  C:\Windows\System\aiYluOi.exe
  2⤵
  PID:9912
- C:\Windows\System\KxNPqNQ.exe
  C:\Windows\System\KxNPqNQ.exe
  2⤵
  PID:9928
- C:\Windows\System\yPbJoHP.exe
  C:\Windows\System\yPbJoHP.exe
  2⤵
  PID:9944
- C:\Windows\System\iIGMZle.exe
  C:\Windows\System\iIGMZle.exe
  2⤵
  PID:9960
- C:\Windows\System\inQWgaL.exe
  C:\Windows\System\inQWgaL.exe
  2⤵
  PID:10000
- C:\Windows\System\SLWDMgL.exe
  C:\Windows\System\SLWDMgL.exe
  2⤵
  PID:10020
- C:\Windows\System\xUYymge.exe
  C:\Windows\System\xUYymge.exe
  2⤵
  PID:10036
- C:\Windows\System\WIGuMYq.exe
  C:\Windows\System\WIGuMYq.exe
  2⤵
  PID:10052
- C:\Windows\System\ZZzEGwg.exe
  C:\Windows\System\ZZzEGwg.exe
  2⤵
  PID:10068
- C:\Windows\System\ClmPKWe.exe
  C:\Windows\System\ClmPKWe.exe
  2⤵
  PID:10084
- C:\Windows\System\KDbeeti.exe
  C:\Windows\System\KDbeeti.exe
  2⤵
  PID:10100
- C:\Windows\System\cWiMSgS.exe
  C:\Windows\System\cWiMSgS.exe
  2⤵
  PID:10116
- C:\Windows\System\WYhHPmE.exe
  C:\Windows\System\WYhHPmE.exe
  2⤵
  PID:10132
- C:\Windows\System\Irfcszu.exe
  C:\Windows\System\Irfcszu.exe
  2⤵
  PID:10148
- C:\Windows\System\LisfYMQ.exe
  C:\Windows\System\LisfYMQ.exe
  2⤵
  PID:10164
- C:\Windows\System\ObkcPWw.exe
  C:\Windows\System\ObkcPWw.exe
  2⤵
  PID:10180
- C:\Windows\System\yaonMZz.exe
  C:\Windows\System\yaonMZz.exe
  2⤵
  PID:10196
- C:\Windows\System\GNPRGcA.exe
  C:\Windows\System\GNPRGcA.exe
  2⤵
  PID:10212
- C:\Windows\System\rmbrDZa.exe
  C:\Windows\System\rmbrDZa.exe
  2⤵
  PID:10228
- C:\Windows\System\aKJzujz.exe
  C:\Windows\System\aKJzujz.exe
  2⤵
  PID:9248
- C:\Windows\System\wlJeGzt.exe
  C:\Windows\System\wlJeGzt.exe
  2⤵
  PID:9252
- C:\Windows\System\DyKxkFI.exe
  C:\Windows\System\DyKxkFI.exe
  2⤵
  PID:9344
- C:\Windows\System\YHbtQto.exe
  C:\Windows\System\YHbtQto.exe
  2⤵
  PID:9408
- C:\Windows\System\HlHBBbZ.exe
  C:\Windows\System\HlHBBbZ.exe
  2⤵
  PID:9476
- C:\Windows\System\JuoQmzb.exe
  C:\Windows\System\JuoQmzb.exe
  2⤵
  PID:9840
- C:\Windows\System\SmWXhKN.exe
  C:\Windows\System\SmWXhKN.exe
  2⤵
  PID:9392
- C:\Windows\System\zacetvt.exe
  C:\Windows\System\zacetvt.exe
  2⤵
  PID:8828
- C:\Windows\System\iiIDKpE.exe
  C:\Windows\System\iiIDKpE.exe
  2⤵
  PID:8876
- C:\Windows\System\qhbjWGH.exe
  C:\Windows\System\qhbjWGH.exe
  2⤵
  PID:9560
- C:\Windows\System\viGeEuO.exe
  C:\Windows\System\viGeEuO.exe
  2⤵
  PID:9132
- C:\Windows\System\hHuUWiz.exe
  C:\Windows\System\hHuUWiz.exe
  2⤵
  PID:9008
- C:\Windows\System\tvvuCBW.exe
  C:\Windows\System\tvvuCBW.exe
  2⤵
  PID:9748
- C:\Windows\System\gSdtOrZ.exe
  C:\Windows\System\gSdtOrZ.exe
  2⤵
  PID:9788
- C:\Windows\System\NLqUOEu.exe
  C:\Windows\System\NLqUOEu.exe
  2⤵
  PID:9056
- C:\Windows\System\kiBmjaX.exe
  C:\Windows\System\kiBmjaX.exe
  2⤵
  PID:9888
- C:\Windows\System\vEvAfUQ.exe
  C:\Windows\System\vEvAfUQ.exe
  2⤵
  PID:9976
- C:\Windows\System\PgjRgrf.exe
  C:\Windows\System\PgjRgrf.exe
  2⤵
  PID:9996
- C:\Windows\System\lUFoLPz.exe
  C:\Windows\System\lUFoLPz.exe
  2⤵
  PID:10060
- C:\Windows\System\xuHsikJ.exe
  C:\Windows\System\xuHsikJ.exe
  2⤵
  PID:9988
- C:\Windows\System\odEqtUW.exe
  C:\Windows\System\odEqtUW.exe
  2⤵
  PID:612
- C:\Windows\System\jrORCgS.exe
  C:\Windows\System\jrORCgS.exe
  2⤵
  PID:10188
- C:\Windows\System\xwyCfxc.exe
  C:\Windows\System\xwyCfxc.exe
  2⤵
  PID:10220
- C:\Windows\System\FVOPljc.exe
  C:\Windows\System\FVOPljc.exe
  2⤵
  PID:10048
- C:\Windows\System\daXGcVk.exe
  C:\Windows\System\daXGcVk.exe
  2⤵
  PID:9236
- C:\Windows\System\jTWIUoY.exe
  C:\Windows\System\jTWIUoY.exe
  2⤵
  PID:10076
- C:\Windows\System\iXnPBiv.exe
  C:\Windows\System\iXnPBiv.exe
  2⤵
  PID:9428
- C:\Windows\System\xMQBgTH.exe
  C:\Windows\System\xMQBgTH.exe
  2⤵
  PID:9524
- C:\Windows\System\hMqZtVM.exe
  C:\Windows\System\hMqZtVM.exe
  2⤵
  PID:9852
- C:\Windows\System\QvrMMZa.exe
  C:\Windows\System\QvrMMZa.exe
  2⤵
  PID:9924
- C:\Windows\System\aIdeafD.exe
  C:\Windows\System\aIdeafD.exe
  2⤵
  PID:7588
- C:\Windows\System\cDpPLbn.exe
  C:\Windows\System\cDpPLbn.exe
  2⤵
  PID:10108
- C:\Windows\System\bokiwzP.exe
  C:\Windows\System\bokiwzP.exe
  2⤵
  PID:10144
- C:\Windows\System\QvqtkQI.exe
  C:\Windows\System\QvqtkQI.exe
  2⤵
  PID:10172
- C:\Windows\System\ruimOlv.exe
  C:\Windows\System\ruimOlv.exe
  2⤵
  PID:10224
- C:\Windows\System\Pauizkw.exe
  C:\Windows\System\Pauizkw.exe
  2⤵
  PID:9540
- C:\Windows\System\EwNprrU.exe
  C:\Windows\System\EwNprrU.exe
  2⤵
  PID:8920
- C:\Windows\System\WZzlQFB.exe
  C:\Windows\System\WZzlQFB.exe
  2⤵
  PID:9904
- C:\Windows\System\WYyITnF.exe
  C:\Windows\System\WYyITnF.exe
  2⤵
  PID:1900
- C:\Windows\System\RcyAhDT.exe
  C:\Windows\System\RcyAhDT.exe
  2⤵
  PID:9608
- C:\Windows\System\ydaFTIY.exe
  C:\Windows\System\ydaFTIY.exe
  2⤵
  PID:9572
- C:\Windows\System\qLRyZVu.exe
  C:\Windows\System\qLRyZVu.exe
  2⤵
  PID:9080
- C:\Windows\System\pMRVYyk.exe
  C:\Windows\System\pMRVYyk.exe
  2⤵
  PID:9772
- C:\Windows\System\jOseHgR.exe
  C:\Windows\System\jOseHgR.exe
  2⤵
  PID:9672
- C:\Windows\System\sGEUfEa.exe
  C:\Windows\System\sGEUfEa.exe
  2⤵
  PID:8308
- C:\Windows\System\vuqyxJS.exe
  C:\Windows\System\vuqyxJS.exe
  2⤵
  PID:8608
- C:\Windows\System\LYBqbXW.exe
  C:\Windows\System\LYBqbXW.exe
  2⤵
  PID:9892
- C:\Windows\System\YlLVlBC.exe
  C:\Windows\System\YlLVlBC.exe
  2⤵
  PID:10292
- C:\Windows\System\IPypAzf.exe
  C:\Windows\System\IPypAzf.exe
  2⤵
  PID:10360
- C:\Windows\System\yniLMXZ.exe
  C:\Windows\System\yniLMXZ.exe
  2⤵
  PID:10428
- C:\Windows\System\vGgFWNZ.exe
  C:\Windows\System\vGgFWNZ.exe
  2⤵
  PID:10504
- C:\Windows\System\enuJRjO.exe
  C:\Windows\System\enuJRjO.exe
  2⤵
  PID:10540
- C:\Windows\System\KxCCnUj.exe
  C:\Windows\System\KxCCnUj.exe
  2⤵
  PID:10560
- C:\Windows\System\ppYONgt.exe
  C:\Windows\System\ppYONgt.exe
  2⤵
  PID:10576
- C:\Windows\System\EmvyDdX.exe
  C:\Windows\System\EmvyDdX.exe
  2⤵
  PID:10604
- C:\Windows\System\OwxLZjw.exe
  C:\Windows\System\OwxLZjw.exe
  2⤵
  PID:10624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DYwBxFG.exe

Filesize
1.8MB

MD5
af5325b928d9d62c62e0ed9a8af7105d

SHA1
58df9b61e770b9aceea2f5a4a780c1666edea225

SHA256
59586cb531098d30e56f1a3c6f743e415eda69d7a3b15fad53e6113c898b8790

SHA512
511f55a03cdc23dd6d05ce16f44cb16d0f11262dd56a80d37adb342be6fa192a22174590f695786adc4119c79ee0b27b15688358630f917e380bbe2cd7e0712a

Download Submit
C:\Windows\system\EKMWBJY.exe

Filesize
1.8MB

MD5
bb5d04be3c7f9f5554de4085950b2113

SHA1
fcb17c88030dc23e898853c8386370ea871ce7e5

SHA256
e40f4de0e915d8c5230f88739007632a0ec070ab3ed2c14bde1b05e3f223bf7f

SHA512
185f4c59bf333d1f0c9c5d369bce1633ff7e8b2277e42ee84f1229f76cc1812eb0a74d632e3357cd3e570309405664257b18885a0b32f21bb8d9d335a22b774f

Download Submit
C:\Windows\system\NNPOTeQ.exe

Filesize
1.8MB

MD5
880bf9ce4485ea1900efc72ba972ba74

SHA1
1a243d664eaf5cb4a884aa943387fd1f78fef0ec

SHA256
398e867e0d93c3424c0033b7e696168098968ad613c0059fbf0d242d719041cc

SHA512
307dafb53c1e67b0d4117d48fd8dd5cc2fb9d1d707283a3484ccf3c47f35737e5af8a57f3c316770e0499fd2b9ecb62ab698545ee1ae906259600bf3fe1d6f10

Download Submit
C:\Windows\system\OwPzbvn.exe

Filesize
1.8MB

MD5
3116fbb590a00940f8ee6d6273510c30

SHA1
ecccff247476b759a8841e445c122338bef935b2

SHA256
430a402a5ba2f8ddd530ad6e259d0ae31b2b43f048b09d0516dbd7339296f23f

SHA512
c52298073ccfedb1efeadf35c1cb9085e3932cc8d8d6b98ba9e7b7ba0814f6e18ba2be1f08fd6a9f7f0275dda3c14b19c60c93e285740181b77e4253f1a09ceb

Download Submit
C:\Windows\system\QvTvkKr.exe

Filesize
1.8MB

MD5
06e4cdcb6d3ba2a6b834bd734eab7c2b

SHA1
0961a13b0e81bb9637c714480aa34e3335deabc1

SHA256
34820efe122729c54f952746bfc6dc9388b20b222cc57b26063d374e38294500

SHA512
ed173a8584a04201c3e322f63544b6040fdfb04140f4ae0d8c2c9e8e13041587daa692968c7a4cafa2173dba5e743547506812d7d0698aa28650e7eb617d3066

Download Submit
C:\Windows\system\SnYEWxa.exe

Filesize
1.8MB

MD5
cd3052c97f5b8777dcd3eedb48e3caf4

SHA1
1a5201582d4d9af1eeb3c33fe330affa9857b4c5

SHA256
5af85153408c8413bb56d81e2455c7e88845d9bea3b328df5247c2b4c476c651

SHA512
f12fcb9927cb07458f6e58162a1969bce05e2d51812d880fba4b028d66afe01424b420939052213121c61fcac551fd67094bf6b2588e4a9f4adf6595bb943960

Download Submit
C:\Windows\system\TdFWELg.exe

Filesize
1.8MB

MD5
1b4dcecb477e7242cdad3fad7b26ad4c

SHA1
b40d9204ed9e65e0a4f97ba920b7595ca3bd5ed1

SHA256
7ad8adf132092ae8550e727200adb468e9ffbf89a8db94afc6a0acb9f139c26f

SHA512
0e775abbc31e1f6ba18737ecabdc23472c971f2d0b16d35e218225a5fca1e3acffedb5944b1da99a5338d3867ee77767f7141cb7cbdc55b912e0a0ecb164943d

Download Submit
C:\Windows\system\UiXTaZm.exe

Filesize
1.8MB

MD5
0e989dd43027678dfbaae5adb1b457bd

SHA1
0fabc80e0cf9664767cb453add32535e62c15a8f

SHA256
c46ed44d793011438a7045516c7389c1a83ee16d445f03e155cb6ec0d7248e28

SHA512
e81fd17eedf0039992df8067daaaff1025c62e1f4a5cd311f62df48088b894ce86f060526752a489c0aa499e274612c7c23184d4a45d26e09f0b3a2e5a36842f

Download Submit
C:\Windows\system\WmtIZRm.exe

Filesize
1.8MB

MD5
92eb73b9b03a27e68e5fcbf70ed1f340

SHA1
b58631f4a511744de102c786e78dce8feac0faba

SHA256
ff8b42f080ced2d99d09a1a956fb1c3c4e368b9a795d187e19196da36a186734

SHA512
0abe11f6f9333331571c5444e10b9d5f826a918c1c63b64009f3a57239080d5623ef6eb075061da3fb128864d170b23e6e4f7647442e08169ae14334a6d34e9c

Download Submit
C:\Windows\system\ZPpiCnN.exe

Filesize
1.8MB

MD5
72a801d7104b9092ee0553d2a59762f0

SHA1
c9ce9334f13d832822c25c7b37cebbb1e85c17c0

SHA256
0d4d6d1c23671b4b9e584c50028cfbe58731e94987fe658f1f1b66a93199e2ea

SHA512
945bff368d793598951378c77f61410999e007c3c1099739e6766d426265bb09235ee87eee310499c92fce40cf2788dd8c1b27eb06bf6e1bd6ebcb78ba0fdd98

Download Submit
C:\Windows\system\aZsqTig.exe

Filesize
1.8MB

MD5
14deeae1aa76b0c4fe5ebff9ebe0ee88

SHA1
91547104bb749272d1ed3c42006e9e4cea637ab9

SHA256
4607dac9a24b1445fbc164976c98313cc5cb86c0f178d094caadb726052e9dc5

SHA512
52bb23a84d5714dab23312c09bcf2101644e2a569537c7dc8967a6c3b6a654afbb25a1aa105ffe689fc8efeefd1d2b69054d48e3d25da7d5cc90589653b3bdd5

Download Submit
C:\Windows\system\bvnYukl.exe

Filesize
1.8MB

MD5
86147b143764b19879d3fedf64197afa

SHA1
10d9919eb4f9381ff133432f39a06dc9e442fef1

SHA256
e8a8942fdbbf9b72c53eb6921c785deddb96e62461ce2c518a7f9ba19a775120

SHA512
ff52e9ff71b076fdb1668c6a6d005bae667af735b27532dc486d1bd17b3077721a608ad443f75b15892dd6e5b76e59553fa52c694fbfe05203353cee0cb8eb28

Download Submit
C:\Windows\system\coiZUDo.exe

Filesize
1.8MB

MD5
5dbef273cd73efeb8cf10cf866c9ab99

SHA1
40c725ec3a19a8cfcfa34ae401852a8e71e1f799

SHA256
ccf826ab3c1835dc078177f2dca780af85ccd230b9a3a375baac51c4d7bb938f

SHA512
5a311c5f28a10c37b91fdf0ea554409804d21b5c8ae473b4e84c0a2eee1bcf2d803454568b69bf07ebb3935717cfd6c3a40c036ae104af6db7ec89b84abc035b

Download Submit
C:\Windows\system\fGUmgut.exe

Filesize
1.8MB

MD5
e8bf0258a6c7f64687621d7b84a77f81

SHA1
84e5b66009d5e8fe4ed915153aba5b9a46edf7dc

SHA256
df4fc0fc50354b880a519e6b473e030aeec26e6571d19e403ed9cfed48bd1ced

SHA512
7c561d3007e5cb282650d20576f29ebdc2a87c36da83a0e0e7acb9a57a4e2fe9322ae7d6616daf248d3e30c331e51421a8f94f08279b228ba9470434ef2e8e92

Download Submit
C:\Windows\system\gWpyBHX.exe

Filesize
1.8MB

MD5
d258b7fb624256de6e8920b95ed60411

SHA1
29461e53a2cd21749f6b430b7c86bccb73fd67a6

SHA256
9b23b24e1ee2672f152b06b476713ad812a7d86a23dd408f058cc5eb894f0ab3

SHA512
662cb27f6246b8cbe0de986e9bd48fb227c2b6a1b0f5e5b24a836ae8100fecd1bb1fd94021d4e15789fc0e19c1d3baeceacad7d01f0e895be04bf7a8a3bb448b

Download Submit
C:\Windows\system\hwqKdLK.exe

Filesize
1.8MB

MD5
ba569759d45cbcbece1f79f21a0c0059

SHA1
443d3811de7c6b7c1436a856749b08dc3a7dd6b2

SHA256
8edac47cc498b41febc2a5c07b2a57dddb53fe9a76626fce994442b0c89fcee1

SHA512
99fb5a076a8cc562cb65370dde5347404537ead2e6cfe580514238a6abac9b34a5c5dde0e249ee76d37c80225050070a17ba2dc80d1c604f9d34b59a2a03dfa6

Download Submit
C:\Windows\system\iasogQA.exe

Filesize
1.8MB

MD5
67056928bda2b909b1f306890a461ac4

SHA1
c53d9e869a7ebe6eae93063f02d72f0ac0877681

SHA256
7084482c80516163d15c132c3a156c7722e3f30fa85df537c0f4ce14e7aa53e2

SHA512
7761b1711d877dd35bd75ed62767b46cd9813a4ba30816c7c54bd715e7bc9e6ef90ad778472c4e1344da905c3d03f609e75ac04ff39eba1bec1f4903b9495687

Download Submit
C:\Windows\system\kdLzHBR.exe

Filesize
1.8MB

MD5
9a174fc31ddb83db654ddd20a1ef4707

SHA1
ead213f74e917788fd45d375301bf6cf1eabe827

SHA256
96d5371e43d34e668eb4398ad7be6e903c210ad55718d84178582758c1ce21cb

SHA512
a0c8fb10917f530b96fb91c143adaae3844fe576975125adb7f861baf23815dd9b864bf85effe00fe3edd0e65fcb95fe85dd3cc9601ae4a80fdde972dd16a45d

Download Submit
C:\Windows\system\lTgUsUa.exe

Filesize
1.8MB

MD5
47980bf88bfff0d5485965138f1d712e

SHA1
72531214aea47ea55c5112177552149b1db0d835

SHA256
b6c2dc07bbe360cc589550d74c112a885c6adfa015ae81c595bf5ed439523a89

SHA512
c041686dd7aaf0d489da921e58bddd16f8e552aaf13f3a2975c178381d3d716080953d22ce34f2f74a90de5900460e96f4ea7f67a0fb7b4b1518a75190035f07

Download Submit
C:\Windows\system\mdyWTdu.exe

Filesize
1.8MB

MD5
12da377b2e15493e107862f9c75c68de

SHA1
22e7fc169eb259f34a3f70d85cd7a41a3e06ca9a

SHA256
ad3ab06e2fade4142b45de6548463bb1bc70605be4a665fd64f3c93515b7944d

SHA512
f0d784e1d2d54240e3c603fbf9b37677d18e621d6d4dfff8afa498e68cb82c566a9ed2a9cb699365dd5bae870b062a8bb999afa1d35e4b9d5a19b44ab7ca4c05

Download Submit
C:\Windows\system\oigvKQN.exe

Filesize
1.8MB

MD5
7c6684d7af26de4b705ff54c41c2612d

SHA1
e7f2da69c9f42d3f8d063c4d1b9c25cd55d460e5

SHA256
c90ced434181c9914cc4d2a1e7a8a77b79365ceb6e4ce6bc820549cac64f7344

SHA512
b7e391466fa1580d8d4d9e0cbdbdb2b6eed7a9b3373d08a8799025d2240c51c346dd55a89cb1e90acbc91339f0d21904f23f0984e2887a7cbb27c534b7c24893

Download Submit
C:\Windows\system\pbQHrBJ.exe

Filesize
1.8MB

MD5
08f6179a06258427aaf13e981da4c309

SHA1
8f0385137c340f66b7385c36ee200e40b10e87cd

SHA256
41cb3bc8f86df898bc5675184bd9481ac81f12319f0da8c2e414a31e7102a1cd

SHA512
261792bafba3302c74a82742db9a6950d0fb25a2ffdaa3b6a006d6526fa3130ab5fa4db06a2708593547d949d1ea3a212f2e843aa72877089abc4de96bd46fb1

Download Submit
C:\Windows\system\vvVxSHA.exe

Filesize
1.8MB

MD5
1895932318eec6bd7b7e0630c224b38a

SHA1
30431b12829e5ec64db2644421e5770c4904f5a2

SHA256
e02febb8240c166858a2c5a0e1ac627240b210897c246d128aaaa24e3b36a24a

SHA512
1f049a1c36ec1a61c9c3e3b2a4131c6917bbd30c465d9c0adac0152dc40932710b6a96955b33c25dfa01492411ff4946c8a9e74177f49905b537dff93eebc7ff

Download Submit
C:\Windows\system\wbxEwob.exe

Filesize
1.8MB

MD5
f9a6939f594f3a2c3c86c9126cd16fbc

SHA1
5462814fece54d06e9dc4e3a9389a298e31e00f1

SHA256
4e95eb977bc24d0b5ed7c007ac6374fcf7623bdfddc0036626c8d0f2cb7aa341

SHA512
ff94a765a336f69e59aa63f7f1be15f21e26873f71679e13724ef9e63d9254b70bfd1edba8bdd0d10cd49473954690e1bb1317f25132129320078a1ab7270ffd

Download Submit
\Windows\system\ImEKDvZ.exe

Filesize
1.8MB

MD5
5c23d8042df6a76bf672d3693e4bf276

SHA1
9d17c2d2c9fa50538dfca787445c44ae37e7fc15

SHA256
5ed09f88a9cd31a96186562ca2ff0641a31332d7e779bb4b47b4dd10be85af1a

SHA512
62306e7ff220c5dea73397a18c98259181c61fb4f2e621edb5e5d6b6446d711dd98dbf172fa60c425e663c60d1475ef7acbe27e1d37ac8d0bf630d55bb1ed5d7

Download Submit
\Windows\system\PJTBfyk.exe

Filesize
1.8MB

MD5
30649e64960a29bc39700b3fe04359fc

SHA1
5e5e55b702b6cd7f4ea0ab652b9ce813b18185b2

SHA256
33012940c9461862ccffa17d2aea3fcc8bf8b2bfb83772bffb1a6c9a1a9ac5f9

SHA512
fc9b50725c7617b405d4450325b0da79677ceb523e68ddd2916fc238d4e758a0eb14d12422c2073448911fcb48e3efc5ff439aec4ab26226bd372dbd7dd1c705

Download Submit
\Windows\system\RyosMjb.exe

Filesize
1.8MB

MD5
8b66b9be65077978ce58a9ccac263d6b

SHA1
1de4aa189992646e85712cc7f380488a9586b235

SHA256
ebe20730089e0158f33e8a1b0494be58c05e66e9368d240a964e8afc00037829

SHA512
3ada6b24aeb408726416d9eec6d3f3a9b41420be9417ab5efca31467950abdb5c7d56ff70fbb31cc1586bef4abc026f3f87f15b57edfb85917588f083f7f7109

Download Submit
\Windows\system\TAOyGKk.exe

Filesize
1.8MB

MD5
db56d91b5d5a940c13bee141e7ad7ad0

SHA1
75ae86d7724b3196f98d6fc7590b1947e72df9be

SHA256
8ae601b4469fcc321b7f02da3690c969a7fae57c3375595613a4744fa1318b1c

SHA512
6e8536a3e4dbd7855f9c9d318c17abe12e51673160858f31e16613e0c985a4a54214e7edd29ff14f63d3e7748777a6fe1a7a5aa5164b2d95fe117bf6e4f9ba93

Download Submit
\Windows\system\dLsAKmz.exe

Filesize
1.8MB

MD5
d230335a9acedde359d18484afff0506

SHA1
c5233dfec71b328196b594d0ec64a8a2ec11c051

SHA256
997162954d417f2aeec870b52ac5f0be318b64faf212ccd9cefbbe010ba9d3e3

SHA512
95402bc353232a384ef00206dd113aa9700673d8cc4abe315ca9e99a67f6c92adf142d50710ca32a5f5f7ecc071596557c24f041ff4bf61e66c778d6123d2554

Download Submit
\Windows\system\mdKRHDK.exe

Filesize
1.8MB

MD5
9a24828d4be36cc0223d8f813f39d5fe

SHA1
2ad23ab9f3faab5a9d0f8399b2819dfcf61fb0c9

SHA256
6184bb7d2b7fbecb015299e4020e003182061ab07f64ee81438857a722f907af

SHA512
59b5eb8721f69715f1151920d0bb3021a4957c8281cde6062c9f24cd47cab86125808d1c2d47df198697495c1f41644b6572890db72fcdb3b61201ff1865904f

Download Submit
\Windows\system\qBucBBG.exe

Filesize
1.8MB

MD5
c7958db82ff5a47cbcd2db7e155a3e97

SHA1
0e1bc727c277b939168e2adf11dd615d8012594b

SHA256
bac842215172c61146e87c2027d664364992a073260f131d8c6ff2f91069bef3

SHA512
27c737c2ef5af86d2bbe9ef43768fdf18c06de1095af0b76b02498384681746d09f6df9c362a3dce26e03e30e4e61b0dccd75c1a072a0d7fac51a4d58f4be1cc

Download Submit
\Windows\system\qgWkDAM.exe

Filesize
1.8MB

MD5
6bef0b803470d53f3b6cdadbc943ef1f

SHA1
a5e460705d65f2e920c5b04d26a35a87093ff9f0

SHA256
21c7d3a6eb8f77c381a720e2b02b62cceee19aa51436905b829199ebdc943528

SHA512
3264bd4e896f2fe1a9408960b82b146baa6c4c91a2fec9fbadf82347d88db69a95db31d6eb36d3b92c2d14646d82d734bbcb05e4189c14d786f02a59e4cac696

Download Submit
\Windows\system\yjbOUBs.exe

Filesize
1.8MB

MD5
577ad01e85cf63829c221ff4ccd91a3f

SHA1
0dadc08d4b36ffec6f695c4cc0c78811f8ee086c

SHA256
6008326e83195dc96bcc0f9566784010f2857d21d248aa2baddfca8eed28ae9b

SHA512
9c684054b29b58e57176181184c717bf7adf27025e56e8c1a2c0ed4a0177448feceb5d0061b13c7ca37c30ea4d6ab4da014dc2fc74248caecfc19fb529b815bd

Download Submit
memory/1632-89-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1632-5249-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1808-67-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/1808-11-0x0000000002DD0000-0x00000000031C2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-835-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/1808-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1808-42-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-44-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1808-68-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-0-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/1808-88-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1808-54-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-71-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/1808-51-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1808-79-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-82-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1808-83-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2020-4422-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2020-65-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2344-5250-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2344-84-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2424-64-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-4374-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-43-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-41-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2652-13-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2676-4367-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2676-55-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2700-4597-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2700-46-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2820-74-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2820-6353-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2976-59-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-4539-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-40-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2996-15-0x000007FEF5D7E000-0x000007FEF5D7F000-memory.dmp

Filesize
4KB

Download
memory/2996-14-0x0000000002A10000-0x0000000002A90000-memory.dmp

Filesize
512KB

Download
memory/2996-249-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/2996-250-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2996-359-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download