xmrig | 7f2d9472f33ea2da66a9fc650d03e7cbcfe94f59cc5c4c3af5eb548299f46fcb

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
Size

1.9MB
MD5

0daac1f9eccd235c4abf4aaa8c175628
SHA1

4d4e9cbfda5eac3bbc363f618c26f68f8e31b658
SHA256

7f2d9472f33ea2da66a9fc650d03e7cbcfe94f59cc5c4c3af5eb548299f46fcb
SHA512

c4dcfa06ebb734f700643a2ab199a299d38bbb87ee47023d0184fad70c611aee66ef095fbc9cf3c1ec6a6e0aea34950abe56c23a59022c9f8316641f93bbbbde
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UR:NAB+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2616-180-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2180-179-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/1964-178-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2964-176-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2912-174-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2568-171-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2432-169-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2404-157-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2456-149-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2712-13-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2616-4248-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2656-4501-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2712-4602-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2768-4605-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2432-4606-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2456-4607-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/1964-4604-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2568-4603-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/1724-4611-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2404-4692-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2964-4691-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2712	gGqudNl.exe
2656	cvbmMgG.exe
2768	UvUZbfq.exe
1724	KBmuUWx.exe
2456	MThOZzo.exe
2404	IpMZowY.exe
2432	TmtcJQK.exe
2568	jddHFvQ.exe
2912	qEwIXca.exe
2964	MReuytT.exe
1964	IhLiXwM.exe
2616	LykGLnn.exe
2612	dRBQAWD.exe
2760	nPeOerZ.exe
2748	sfCtLgh.exe
108	HENRnaB.exe
1780	sdtfSWa.exe
804	SlYOQwK.exe
1896	RLfQgTY.exe
1900	qqMcCwN.exe
1148	zalGbKk.exe
1104	FTmjfdx.exe
576	wjGvXmP.exe
1564	iCKMoMl.exe
1572	XAdCGyD.exe
1464	PsrclAl.exe
2928	ImlNHDp.exe
2940	evmBvEM.exe
2888	sohBYqF.exe
2228	hzVOufo.exe
3004	EZORkxm.exe
1712	KiZMBIS.exe
992	DqcauKa.exe
1012	uQiPhIc.exe
856	ZQoHjum.exe
1472	NbtelzR.exe
948	BUgPRYT.exe
1592	jQjKwpl.exe
1252	UQBwYRT.exe
1020	UXmWROU.exe
2320	UtmIEUr.exe
2220	hwGdQVH.exe
1684	JlmmErD.exe
1240	ediMthp.exe
2984	yCFkxMu.exe
2008	LeqPtpq.exe
880	kwxyAOi.exe
1868	EpaqxrA.exe
2956	FJbQTXb.exe
1516	zssUQiH.exe
1544	KlgPriR.exe
2808	yXVYYFZ.exe
2548	nYDcbIc.exe
2564	vOLmYMN.exe
2156	fmMIAGp.exe
2960	zXbHKIU.exe
2608	UzVSQOL.exe
2772	RHeXalt.exe
1588	HeYdnPk.exe
1960	lqHscJn.exe
2292	wlBCjhP.exe
1448	WDmyhkr.exe
1204	OjYBuwy.exe
3028	vwjAHyZ.exe

Loads dropped DLL 64 IoCs

pid	Process
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-0-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x000c000000013a7c-6.dat	upx
behavioral1/files/0x0031000000015eaf-16.dat	upx
behavioral1/files/0x0007000000004e76-23.dat	upx
behavioral1/files/0x00080000000164b2-27.dat	upx
behavioral1/files/0x0007000000016572-31.dat	upx
behavioral1/files/0x00060000000173e0-66.dat	upx
behavioral1/files/0x00050000000191a7-128.dat	upx
behavioral1/files/0x0031000000015f6d-191.dat	upx
behavioral1/files/0x00050000000191cd-183.dat	upx
behavioral1/files/0x00060000000190b6-182.dat	upx
behavioral1/memory/2616-180-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/1964-178-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2964-176-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2912-174-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2568-171-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2432-169-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/files/0x0006000000019021-166.dat	upx
behavioral1/memory/2404-157-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2456-149-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/1724-120-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2768-118-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2656-116-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0005000000019215-194.dat	upx
behavioral1/files/0x00050000000191ed-188.dat	upx
behavioral1/files/0x0006000000018f3a-112.dat	upx
behavioral1/files/0x0006000000018c0a-106.dat	upx
behavioral1/files/0x0006000000018c1a-110.dat	upx
behavioral1/files/0x0005000000018778-102.dat	upx
behavioral1/files/0x000500000001866d-99.dat	upx
behavioral1/files/0x000900000001864e-90.dat	upx
behavioral1/files/0x000500000001866b-94.dat	upx
behavioral1/files/0x0006000000017556-86.dat	upx
behavioral1/files/0x000600000001749c-82.dat	upx
behavioral1/files/0x000600000001747d-78.dat	upx
behavioral1/files/0x000600000001745e-74.dat	upx
behavioral1/files/0x0006000000017456-70.dat	upx
behavioral1/files/0x00060000000173d8-62.dat	upx
behavioral1/files/0x00060000000173d5-58.dat	upx
behavioral1/files/0x0006000000017052-54.dat	upx
behavioral1/files/0x0006000000016eb2-50.dat	upx
behavioral1/files/0x0006000000016e94-46.dat	upx
behavioral1/files/0x0008000000016dbf-42.dat	upx
behavioral1/files/0x0007000000016843-39.dat	upx
behavioral1/files/0x000700000001661c-34.dat	upx
behavioral1/memory/2712-13-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2616-4248-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2656-4501-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2712-4602-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2768-4605-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2432-4606-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2456-4607-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/1964-4604-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2568-4603-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/1724-4611-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2404-4692-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2964-4691-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vCXlUGB.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\MVYJrNI.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\dLfUMZe.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\WeZAkhf.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\caSRhSj.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\uSfEAMW.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\BMwOYMC.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\PsrclAl.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\JPqeowb.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\zbMKZGp.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\DqtOlAn.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\cauAnut.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\ZQBOwxb.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\lPANLfN.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\UEhfeZX.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\lEcMHJf.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\oWcevGA.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\DuhyykS.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\uucChwY.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\JpjWNjf.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\PLWZNsT.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\MzHiQNF.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\OiWpyGZ.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\EiwhHZy.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\vrSNkfN.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\HUNgtvh.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\NEGABLL.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\XwLutym.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\ejGGUnc.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\XSpVSiw.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\bufwbHV.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\wRbAukM.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\VxCdfyp.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\qDlUuWH.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\KtrwEoy.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\QZqrzqR.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\JrtVUKH.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\eGQSkyl.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\OSPMNjw.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\tIBJFuO.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\oihniCP.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\pVjCBWw.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\SVcrHkp.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\owggzjE.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\Ehmtdhr.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\TUbXUTu.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\gefeOoa.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\gcVmlHe.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\SCqhpgQ.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\tTOZWeo.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\JMRaFDP.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\TryutaT.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\wFQoLFC.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\rEJmnit.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\gBtIRXX.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\llyruKW.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\LKLqlpo.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\WKiQgSP.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\MHYrnGf.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\nhczxjc.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\haHBquP.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\hFAMaJd.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\EIvCXsY.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
File created	C:\Windows\System\Vsimouz.exe	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
Token: SeDebugPrivilege	3024	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3024	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	29
PID 2180 wrote to memory of 3024	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	29
PID 2180 wrote to memory of 3024	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	29
PID 2180 wrote to memory of 2712	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2712	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2712	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	30
PID 2180 wrote to memory of 2656	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2656	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2656	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	31
PID 2180 wrote to memory of 2768	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2768	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	32
PID 2180 wrote to memory of 2768	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	32
PID 2180 wrote to memory of 1724	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	33
PID 2180 wrote to memory of 1724	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	33
PID 2180 wrote to memory of 1724	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	33
PID 2180 wrote to memory of 2456	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2456	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2456	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	34
PID 2180 wrote to memory of 2404	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	35
PID 2180 wrote to memory of 2404	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	35
PID 2180 wrote to memory of 2404	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	35
PID 2180 wrote to memory of 2432	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	36
PID 2180 wrote to memory of 2432	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	36
PID 2180 wrote to memory of 2432	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	36
PID 2180 wrote to memory of 2568	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	37
PID 2180 wrote to memory of 2568	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	37
PID 2180 wrote to memory of 2568	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	37
PID 2180 wrote to memory of 2912	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	38
PID 2180 wrote to memory of 2912	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	38
PID 2180 wrote to memory of 2912	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	38
PID 2180 wrote to memory of 2964	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	39
PID 2180 wrote to memory of 2964	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	39
PID 2180 wrote to memory of 2964	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	39
PID 2180 wrote to memory of 1964	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	40
PID 2180 wrote to memory of 1964	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	40
PID 2180 wrote to memory of 1964	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	40
PID 2180 wrote to memory of 2616	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	41
PID 2180 wrote to memory of 2616	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	41
PID 2180 wrote to memory of 2616	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	41
PID 2180 wrote to memory of 2612	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	42
PID 2180 wrote to memory of 2612	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	42
PID 2180 wrote to memory of 2612	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	42
PID 2180 wrote to memory of 2760	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	43
PID 2180 wrote to memory of 2760	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	43
PID 2180 wrote to memory of 2760	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	43
PID 2180 wrote to memory of 2748	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	44
PID 2180 wrote to memory of 2748	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	44
PID 2180 wrote to memory of 2748	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	44
PID 2180 wrote to memory of 108	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	45
PID 2180 wrote to memory of 108	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	45
PID 2180 wrote to memory of 108	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	45
PID 2180 wrote to memory of 1780	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	46
PID 2180 wrote to memory of 1780	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	46
PID 2180 wrote to memory of 1780	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	46
PID 2180 wrote to memory of 804	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	47
PID 2180 wrote to memory of 804	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	47
PID 2180 wrote to memory of 804	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	47
PID 2180 wrote to memory of 1896	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	48
PID 2180 wrote to memory of 1896	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	48
PID 2180 wrote to memory of 1896	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	48
PID 2180 wrote to memory of 1900	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	49
PID 2180 wrote to memory of 1900	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	49
PID 2180 wrote to memory of 1900	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	49
PID 2180 wrote to memory of 1148	2180	0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0daac1f9eccd235c4abf4aaa8c175628_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\System\gGqudNl.exe
  C:\Windows\System\gGqudNl.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\cvbmMgG.exe
  C:\Windows\System\cvbmMgG.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\UvUZbfq.exe
  C:\Windows\System\UvUZbfq.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\KBmuUWx.exe
  C:\Windows\System\KBmuUWx.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\MThOZzo.exe
  C:\Windows\System\MThOZzo.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\IpMZowY.exe
  C:\Windows\System\IpMZowY.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\TmtcJQK.exe
  C:\Windows\System\TmtcJQK.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\jddHFvQ.exe
  C:\Windows\System\jddHFvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\qEwIXca.exe
  C:\Windows\System\qEwIXca.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\MReuytT.exe
  C:\Windows\System\MReuytT.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\IhLiXwM.exe
  C:\Windows\System\IhLiXwM.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\LykGLnn.exe
  C:\Windows\System\LykGLnn.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\dRBQAWD.exe
  C:\Windows\System\dRBQAWD.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\nPeOerZ.exe
  C:\Windows\System\nPeOerZ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\sfCtLgh.exe
  C:\Windows\System\sfCtLgh.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\HENRnaB.exe
  C:\Windows\System\HENRnaB.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\sdtfSWa.exe
  C:\Windows\System\sdtfSWa.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\SlYOQwK.exe
  C:\Windows\System\SlYOQwK.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\RLfQgTY.exe
  C:\Windows\System\RLfQgTY.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\qqMcCwN.exe
  C:\Windows\System\qqMcCwN.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\zalGbKk.exe
  C:\Windows\System\zalGbKk.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\FTmjfdx.exe
  C:\Windows\System\FTmjfdx.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\wjGvXmP.exe
  C:\Windows\System\wjGvXmP.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\iCKMoMl.exe
  C:\Windows\System\iCKMoMl.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\XAdCGyD.exe
  C:\Windows\System\XAdCGyD.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\PsrclAl.exe
  C:\Windows\System\PsrclAl.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\ImlNHDp.exe
  C:\Windows\System\ImlNHDp.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\sohBYqF.exe
  C:\Windows\System\sohBYqF.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\evmBvEM.exe
  C:\Windows\System\evmBvEM.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\hzVOufo.exe
  C:\Windows\System\hzVOufo.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\EZORkxm.exe
  C:\Windows\System\EZORkxm.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\NbtelzR.exe
  C:\Windows\System\NbtelzR.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\KiZMBIS.exe
  C:\Windows\System\KiZMBIS.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\BUgPRYT.exe
  C:\Windows\System\BUgPRYT.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\DqcauKa.exe
  C:\Windows\System\DqcauKa.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\jQjKwpl.exe
  C:\Windows\System\jQjKwpl.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\uQiPhIc.exe
  C:\Windows\System\uQiPhIc.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\UXmWROU.exe
  C:\Windows\System\UXmWROU.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\ZQoHjum.exe
  C:\Windows\System\ZQoHjum.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\UtmIEUr.exe
  C:\Windows\System\UtmIEUr.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\UQBwYRT.exe
  C:\Windows\System\UQBwYRT.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\hwGdQVH.exe
  C:\Windows\System\hwGdQVH.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\JlmmErD.exe
  C:\Windows\System\JlmmErD.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\ediMthp.exe
  C:\Windows\System\ediMthp.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\yCFkxMu.exe
  C:\Windows\System\yCFkxMu.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\LeqPtpq.exe
  C:\Windows\System\LeqPtpq.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\kwxyAOi.exe
  C:\Windows\System\kwxyAOi.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\EpaqxrA.exe
  C:\Windows\System\EpaqxrA.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\FJbQTXb.exe
  C:\Windows\System\FJbQTXb.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\zssUQiH.exe
  C:\Windows\System\zssUQiH.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\KlgPriR.exe
  C:\Windows\System\KlgPriR.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\yXVYYFZ.exe
  C:\Windows\System\yXVYYFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\nYDcbIc.exe
  C:\Windows\System\nYDcbIc.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\vOLmYMN.exe
  C:\Windows\System\vOLmYMN.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\fmMIAGp.exe
  C:\Windows\System\fmMIAGp.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\zXbHKIU.exe
  C:\Windows\System\zXbHKIU.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\UzVSQOL.exe
  C:\Windows\System\UzVSQOL.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\RHeXalt.exe
  C:\Windows\System\RHeXalt.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\HeYdnPk.exe
  C:\Windows\System\HeYdnPk.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\lqHscJn.exe
  C:\Windows\System\lqHscJn.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\wlBCjhP.exe
  C:\Windows\System\wlBCjhP.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\WDmyhkr.exe
  C:\Windows\System\WDmyhkr.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\OjYBuwy.exe
  C:\Windows\System\OjYBuwy.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\vwjAHyZ.exe
  C:\Windows\System\vwjAHyZ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\fuEZTnP.exe
  C:\Windows\System\fuEZTnP.exe
  2⤵
  PID:2776
- C:\Windows\System\IeEDmOV.exe
  C:\Windows\System\IeEDmOV.exe
  2⤵
  PID:320
- C:\Windows\System\cqJXoNL.exe
  C:\Windows\System\cqJXoNL.exe
  2⤵
  PID:1952
- C:\Windows\System\aNYwDXd.exe
  C:\Windows\System\aNYwDXd.exe
  2⤵
  PID:2360
- C:\Windows\System\FRSYWyT.exe
  C:\Windows\System\FRSYWyT.exe
  2⤵
  PID:1880
- C:\Windows\System\BDPkAXs.exe
  C:\Windows\System\BDPkAXs.exe
  2⤵
  PID:1620
- C:\Windows\System\gbvGmMV.exe
  C:\Windows\System\gbvGmMV.exe
  2⤵
  PID:2264
- C:\Windows\System\CmFnwJN.exe
  C:\Windows\System\CmFnwJN.exe
  2⤵
  PID:2168
- C:\Windows\System\JzNGAmw.exe
  C:\Windows\System\JzNGAmw.exe
  2⤵
  PID:1992
- C:\Windows\System\qMmyVRF.exe
  C:\Windows\System\qMmyVRF.exe
  2⤵
  PID:2816
- C:\Windows\System\sUEGbru.exe
  C:\Windows\System\sUEGbru.exe
  2⤵
  PID:2384
- C:\Windows\System\ZsGjdzr.exe
  C:\Windows\System\ZsGjdzr.exe
  2⤵
  PID:2596
- C:\Windows\System\JiSDCda.exe
  C:\Windows\System\JiSDCda.exe
  2⤵
  PID:2812
- C:\Windows\System\ugSfkJf.exe
  C:\Windows\System\ugSfkJf.exe
  2⤵
  PID:1144
- C:\Windows\System\ghOABaB.exe
  C:\Windows\System\ghOABaB.exe
  2⤵
  PID:1672
- C:\Windows\System\gisYmgw.exe
  C:\Windows\System\gisYmgw.exe
  2⤵
  PID:1324
- C:\Windows\System\yQbUYtV.exe
  C:\Windows\System\yQbUYtV.exe
  2⤵
  PID:2284
- C:\Windows\System\ONyRRlO.exe
  C:\Windows\System\ONyRRlO.exe
  2⤵
  PID:2176
- C:\Windows\System\jlDNLeI.exe
  C:\Windows\System\jlDNLeI.exe
  2⤵
  PID:2020
- C:\Windows\System\XPwTifL.exe
  C:\Windows\System\XPwTifL.exe
  2⤵
  PID:1416
- C:\Windows\System\TopUzbH.exe
  C:\Windows\System\TopUzbH.exe
  2⤵
  PID:628
- C:\Windows\System\ZQZVWhS.exe
  C:\Windows\System\ZQZVWhS.exe
  2⤵
  PID:328
- C:\Windows\System\RsatBQw.exe
  C:\Windows\System\RsatBQw.exe
  2⤵
  PID:2016
- C:\Windows\System\gTDhvKP.exe
  C:\Windows\System\gTDhvKP.exe
  2⤵
  PID:2552
- C:\Windows\System\qDnnDJn.exe
  C:\Windows\System\qDnnDJn.exe
  2⤵
  PID:2524
- C:\Windows\System\CpUmkMN.exe
  C:\Windows\System\CpUmkMN.exe
  2⤵
  PID:1660
- C:\Windows\System\ybkrgip.exe
  C:\Windows\System\ybkrgip.exe
  2⤵
  PID:2988
- C:\Windows\System\iiFiXQO.exe
  C:\Windows\System\iiFiXQO.exe
  2⤵
  PID:2476
- C:\Windows\System\eAfdpio.exe
  C:\Windows\System\eAfdpio.exe
  2⤵
  PID:1740
- C:\Windows\System\FrPzNoU.exe
  C:\Windows\System\FrPzNoU.exe
  2⤵
  PID:2308
- C:\Windows\System\bOOPykX.exe
  C:\Windows\System\bOOPykX.exe
  2⤵
  PID:2792
- C:\Windows\System\ERIezzt.exe
  C:\Windows\System\ERIezzt.exe
  2⤵
  PID:996
- C:\Windows\System\ZZejAtc.exe
  C:\Windows\System\ZZejAtc.exe
  2⤵
  PID:2880
- C:\Windows\System\iXgsxjj.exe
  C:\Windows\System\iXgsxjj.exe
  2⤵
  PID:828
- C:\Windows\System\ZxpkxNE.exe
  C:\Windows\System\ZxpkxNE.exe
  2⤵
  PID:2400
- C:\Windows\System\nPkMkBI.exe
  C:\Windows\System\nPkMkBI.exe
  2⤵
  PID:2644
- C:\Windows\System\aYhcNKB.exe
  C:\Windows\System\aYhcNKB.exe
  2⤵
  PID:3052
- C:\Windows\System\gMTIyRU.exe
  C:\Windows\System\gMTIyRU.exe
  2⤵
  PID:1068
- C:\Windows\System\gLAakQL.exe
  C:\Windows\System\gLAakQL.exe
  2⤵
  PID:2836
- C:\Windows\System\UlewhcM.exe
  C:\Windows\System\UlewhcM.exe
  2⤵
  PID:2828
- C:\Windows\System\asCrckG.exe
  C:\Windows\System\asCrckG.exe
  2⤵
  PID:2500
- C:\Windows\System\TpnIvYx.exe
  C:\Windows\System\TpnIvYx.exe
  2⤵
  PID:2064
- C:\Windows\System\dSVRvBr.exe
  C:\Windows\System\dSVRvBr.exe
  2⤵
  PID:2352
- C:\Windows\System\KEJmPQX.exe
  C:\Windows\System\KEJmPQX.exe
  2⤵
  PID:2052
- C:\Windows\System\PSyLlIC.exe
  C:\Windows\System\PSyLlIC.exe
  2⤵
  PID:2372
- C:\Windows\System\tMbSiuW.exe
  C:\Windows\System\tMbSiuW.exe
  2⤵
  PID:1608
- C:\Windows\System\YWTdfYW.exe
  C:\Windows\System\YWTdfYW.exe
  2⤵
  PID:1540
- C:\Windows\System\XtOsEsW.exe
  C:\Windows\System\XtOsEsW.exe
  2⤵
  PID:1980
- C:\Windows\System\HaQdeBa.exe
  C:\Windows\System\HaQdeBa.exe
  2⤵
  PID:2728
- C:\Windows\System\AUmPMdc.exe
  C:\Windows\System\AUmPMdc.exe
  2⤵
  PID:2416
- C:\Windows\System\FzAxoXy.exe
  C:\Windows\System\FzAxoXy.exe
  2⤵
  PID:2952
- C:\Windows\System\juofpQf.exe
  C:\Windows\System\juofpQf.exe
  2⤵
  PID:380
- C:\Windows\System\qoFpftq.exe
  C:\Windows\System\qoFpftq.exe
  2⤵
  PID:2904
- C:\Windows\System\feJYJMp.exe
  C:\Windows\System\feJYJMp.exe
  2⤵
  PID:1412
- C:\Windows\System\LIQLGKA.exe
  C:\Windows\System\LIQLGKA.exe
  2⤵
  PID:2520
- C:\Windows\System\mMbUHTP.exe
  C:\Windows\System\mMbUHTP.exe
  2⤵
  PID:2528
- C:\Windows\System\ejUhAst.exe
  C:\Windows\System\ejUhAst.exe
  2⤵
  PID:900
- C:\Windows\System\gOmgudd.exe
  C:\Windows\System\gOmgudd.exe
  2⤵
  PID:2900
- C:\Windows\System\MOJygqP.exe
  C:\Windows\System\MOJygqP.exe
  2⤵
  PID:2496
- C:\Windows\System\SpLzeFD.exe
  C:\Windows\System\SpLzeFD.exe
  2⤵
  PID:2028
- C:\Windows\System\tOLnIUT.exe
  C:\Windows\System\tOLnIUT.exe
  2⤵
  PID:1476
- C:\Windows\System\ccJRmeR.exe
  C:\Windows\System\ccJRmeR.exe
  2⤵
  PID:2560
- C:\Windows\System\hbnmtHD.exe
  C:\Windows\System\hbnmtHD.exe
  2⤵
  PID:2480
- C:\Windows\System\mxDTKio.exe
  C:\Windows\System\mxDTKio.exe
  2⤵
  PID:1860
- C:\Windows\System\mxwCgkp.exe
  C:\Windows\System\mxwCgkp.exe
  2⤵
  PID:1640
- C:\Windows\System\bphasrF.exe
  C:\Windows\System\bphasrF.exe
  2⤵
  PID:2572
- C:\Windows\System\ztpWiZp.exe
  C:\Windows\System\ztpWiZp.exe
  2⤵
  PID:2916
- C:\Windows\System\KvnGowQ.exe
  C:\Windows\System\KvnGowQ.exe
  2⤵
  PID:2436
- C:\Windows\System\wTvvjzT.exe
  C:\Windows\System\wTvvjzT.exe
  2⤵
  PID:1376
- C:\Windows\System\CLzGXeo.exe
  C:\Windows\System\CLzGXeo.exe
  2⤵
  PID:1584
- C:\Windows\System\RXzrnHo.exe
  C:\Windows\System\RXzrnHo.exe
  2⤵
  PID:2892
- C:\Windows\System\TyYzYrn.exe
  C:\Windows\System\TyYzYrn.exe
  2⤵
  PID:1720
- C:\Windows\System\JEcLnkB.exe
  C:\Windows\System\JEcLnkB.exe
  2⤵
  PID:2316
- C:\Windows\System\ADejkfl.exe
  C:\Windows\System\ADejkfl.exe
  2⤵
  PID:2412
- C:\Windows\System\frpDKkR.exe
  C:\Windows\System\frpDKkR.exe
  2⤵
  PID:1424
- C:\Windows\System\LVOzusi.exe
  C:\Windows\System\LVOzusi.exe
  2⤵
  PID:292
- C:\Windows\System\MTeXsCe.exe
  C:\Windows\System\MTeXsCe.exe
  2⤵
  PID:2980
- C:\Windows\System\jelrYoh.exe
  C:\Windows\System\jelrYoh.exe
  2⤵
  PID:2968
- C:\Windows\System\UajSqgN.exe
  C:\Windows\System\UajSqgN.exe
  2⤵
  PID:3080
- C:\Windows\System\HJKNiUC.exe
  C:\Windows\System\HJKNiUC.exe
  2⤵
  PID:3096
- C:\Windows\System\BFzVNfc.exe
  C:\Windows\System\BFzVNfc.exe
  2⤵
  PID:3136
- C:\Windows\System\IZLwAVQ.exe
  C:\Windows\System\IZLwAVQ.exe
  2⤵
  PID:3152
- C:\Windows\System\kPKHTUa.exe
  C:\Windows\System\kPKHTUa.exe
  2⤵
  PID:3172
- C:\Windows\System\gteixvx.exe
  C:\Windows\System\gteixvx.exe
  2⤵
  PID:3188
- C:\Windows\System\BCSrjqv.exe
  C:\Windows\System\BCSrjqv.exe
  2⤵
  PID:3252
- C:\Windows\System\ZrSSRaj.exe
  C:\Windows\System\ZrSSRaj.exe
  2⤵
  PID:3312
- C:\Windows\System\HzjpiKl.exe
  C:\Windows\System\HzjpiKl.exe
  2⤵
  PID:3328
- C:\Windows\System\cNAvjfT.exe
  C:\Windows\System\cNAvjfT.exe
  2⤵
  PID:3344
- C:\Windows\System\eEbQrtm.exe
  C:\Windows\System\eEbQrtm.exe
  2⤵
  PID:3360
- C:\Windows\System\cmyZhfI.exe
  C:\Windows\System\cmyZhfI.exe
  2⤵
  PID:3376
- C:\Windows\System\pZnSwoa.exe
  C:\Windows\System\pZnSwoa.exe
  2⤵
  PID:3412
- C:\Windows\System\wGGiRXI.exe
  C:\Windows\System\wGGiRXI.exe
  2⤵
  PID:3428
- C:\Windows\System\smUeQLV.exe
  C:\Windows\System\smUeQLV.exe
  2⤵
  PID:3444
- C:\Windows\System\pxyHKMw.exe
  C:\Windows\System\pxyHKMw.exe
  2⤵
  PID:3460
- C:\Windows\System\ihvsafk.exe
  C:\Windows\System\ihvsafk.exe
  2⤵
  PID:3476
- C:\Windows\System\mzejWOn.exe
  C:\Windows\System\mzejWOn.exe
  2⤵
  PID:3492
- C:\Windows\System\hKQgDza.exe
  C:\Windows\System\hKQgDza.exe
  2⤵
  PID:3508
- C:\Windows\System\WqhfKVo.exe
  C:\Windows\System\WqhfKVo.exe
  2⤵
  PID:3524
- C:\Windows\System\VFpYhnD.exe
  C:\Windows\System\VFpYhnD.exe
  2⤵
  PID:3540
- C:\Windows\System\YoGRqCb.exe
  C:\Windows\System\YoGRqCb.exe
  2⤵
  PID:3556
- C:\Windows\System\hknxLhk.exe
  C:\Windows\System\hknxLhk.exe
  2⤵
  PID:3572
- C:\Windows\System\CQvinwf.exe
  C:\Windows\System\CQvinwf.exe
  2⤵
  PID:3588
- C:\Windows\System\ovMIzGT.exe
  C:\Windows\System\ovMIzGT.exe
  2⤵
  PID:3604
- C:\Windows\System\GOFtvGE.exe
  C:\Windows\System\GOFtvGE.exe
  2⤵
  PID:3620
- C:\Windows\System\ADuSzIJ.exe
  C:\Windows\System\ADuSzIJ.exe
  2⤵
  PID:3636
- C:\Windows\System\wDpTydD.exe
  C:\Windows\System\wDpTydD.exe
  2⤵
  PID:3652
- C:\Windows\System\fnIMMBR.exe
  C:\Windows\System\fnIMMBR.exe
  2⤵
  PID:3668
- C:\Windows\System\yGZkLLF.exe
  C:\Windows\System\yGZkLLF.exe
  2⤵
  PID:3684
- C:\Windows\System\LTaDmeS.exe
  C:\Windows\System\LTaDmeS.exe
  2⤵
  PID:3700
- C:\Windows\System\ofjcCim.exe
  C:\Windows\System\ofjcCim.exe
  2⤵
  PID:3716
- C:\Windows\System\EePqWGC.exe
  C:\Windows\System\EePqWGC.exe
  2⤵
  PID:3732
- C:\Windows\System\CCGTUXe.exe
  C:\Windows\System\CCGTUXe.exe
  2⤵
  PID:3748
- C:\Windows\System\WWndEcA.exe
  C:\Windows\System\WWndEcA.exe
  2⤵
  PID:3764
- C:\Windows\System\sIzntOv.exe
  C:\Windows\System\sIzntOv.exe
  2⤵
  PID:3780
- C:\Windows\System\jWDoadQ.exe
  C:\Windows\System\jWDoadQ.exe
  2⤵
  PID:3796
- C:\Windows\System\BIFZxsM.exe
  C:\Windows\System\BIFZxsM.exe
  2⤵
  PID:3812
- C:\Windows\System\shvjnDd.exe
  C:\Windows\System\shvjnDd.exe
  2⤵
  PID:3828
- C:\Windows\System\goNVJBK.exe
  C:\Windows\System\goNVJBK.exe
  2⤵
  PID:3844
- C:\Windows\System\nkOWmyO.exe
  C:\Windows\System\nkOWmyO.exe
  2⤵
  PID:3860
- C:\Windows\System\MacDdBE.exe
  C:\Windows\System\MacDdBE.exe
  2⤵
  PID:3876
- C:\Windows\System\MhxkkaW.exe
  C:\Windows\System\MhxkkaW.exe
  2⤵
  PID:3892
- C:\Windows\System\qdJhSOO.exe
  C:\Windows\System\qdJhSOO.exe
  2⤵
  PID:3908
- C:\Windows\System\vBqINiv.exe
  C:\Windows\System\vBqINiv.exe
  2⤵
  PID:3924
- C:\Windows\System\OKVEvuW.exe
  C:\Windows\System\OKVEvuW.exe
  2⤵
  PID:3940
- C:\Windows\System\cwzhNuC.exe
  C:\Windows\System\cwzhNuC.exe
  2⤵
  PID:3956
- C:\Windows\System\TzuLjlu.exe
  C:\Windows\System\TzuLjlu.exe
  2⤵
  PID:3972
- C:\Windows\System\FtHPziY.exe
  C:\Windows\System\FtHPziY.exe
  2⤵
  PID:3988
- C:\Windows\System\rZPCpzJ.exe
  C:\Windows\System\rZPCpzJ.exe
  2⤵
  PID:4004
- C:\Windows\System\CJlnMST.exe
  C:\Windows\System\CJlnMST.exe
  2⤵
  PID:4020
- C:\Windows\System\oENRzdP.exe
  C:\Windows\System\oENRzdP.exe
  2⤵
  PID:4036
- C:\Windows\System\dhZqoLp.exe
  C:\Windows\System\dhZqoLp.exe
  2⤵
  PID:4052
- C:\Windows\System\vjMHblK.exe
  C:\Windows\System\vjMHblK.exe
  2⤵
  PID:4068
- C:\Windows\System\zxrvZqQ.exe
  C:\Windows\System\zxrvZqQ.exe
  2⤵
  PID:4084
- C:\Windows\System\oiZUtir.exe
  C:\Windows\System\oiZUtir.exe
  2⤵
  PID:1428
- C:\Windows\System\IQQTZTy.exe
  C:\Windows\System\IQQTZTy.exe
  2⤵
  PID:2924
- C:\Windows\System\aXglcWH.exe
  C:\Windows\System\aXglcWH.exe
  2⤵
  PID:1796
- C:\Windows\System\KMYzOae.exe
  C:\Windows\System\KMYzOae.exe
  2⤵
  PID:2428
- C:\Windows\System\cnJEoTD.exe
  C:\Windows\System\cnJEoTD.exe
  2⤵
  PID:2132
- C:\Windows\System\daOtTHd.exe
  C:\Windows\System\daOtTHd.exe
  2⤵
  PID:3092
- C:\Windows\System\evbmWxG.exe
  C:\Windows\System\evbmWxG.exe
  2⤵
  PID:1552
- C:\Windows\System\dwycAVn.exe
  C:\Windows\System\dwycAVn.exe
  2⤵
  PID:2116
- C:\Windows\System\QfJfPmb.exe
  C:\Windows\System\QfJfPmb.exe
  2⤵
  PID:864
- C:\Windows\System\QNJfKaJ.exe
  C:\Windows\System\QNJfKaJ.exe
  2⤵
  PID:2720
- C:\Windows\System\gPgmfCh.exe
  C:\Windows\System\gPgmfCh.exe
  2⤵
  PID:2240
- C:\Windows\System\AEEJcSL.exe
  C:\Windows\System\AEEJcSL.exe
  2⤵
  PID:3116
- C:\Windows\System\lFYZfzQ.exe
  C:\Windows\System\lFYZfzQ.exe
  2⤵
  PID:3168
- C:\Windows\System\zmtjrXR.exe
  C:\Windows\System\zmtjrXR.exe
  2⤵
  PID:3204
- C:\Windows\System\nOZPSLm.exe
  C:\Windows\System\nOZPSLm.exe
  2⤵
  PID:2684
- C:\Windows\System\GgaYYMN.exe
  C:\Windows\System\GgaYYMN.exe
  2⤵
  PID:3128
- C:\Windows\System\ykZyeSv.exe
  C:\Windows\System\ykZyeSv.exe
  2⤵
  PID:3260
- C:\Windows\System\egaJFwt.exe
  C:\Windows\System\egaJFwt.exe
  2⤵
  PID:3284
- C:\Windows\System\LLIGbyF.exe
  C:\Windows\System\LLIGbyF.exe
  2⤵
  PID:3300
- C:\Windows\System\LHNkmNI.exe
  C:\Windows\System\LHNkmNI.exe
  2⤵
  PID:3220
- C:\Windows\System\BEfxODo.exe
  C:\Windows\System\BEfxODo.exe
  2⤵
  PID:3236
- C:\Windows\System\YeOnaYq.exe
  C:\Windows\System\YeOnaYq.exe
  2⤵
  PID:3264
- C:\Windows\System\nFNBpyh.exe
  C:\Windows\System\nFNBpyh.exe
  2⤵
  PID:3352
- C:\Windows\System\RotVPlc.exe
  C:\Windows\System\RotVPlc.exe
  2⤵
  PID:3372
- C:\Windows\System\SlgzNdg.exe
  C:\Windows\System\SlgzNdg.exe
  2⤵
  PID:2148
- C:\Windows\System\OKykGGU.exe
  C:\Windows\System\OKykGGU.exe
  2⤵
  PID:3400
- C:\Windows\System\OSYRCma.exe
  C:\Windows\System\OSYRCma.exe
  2⤵
  PID:1708
- C:\Windows\System\dOoJIRf.exe
  C:\Windows\System\dOoJIRf.exe
  2⤵
  PID:3440
- C:\Windows\System\NdQHgEr.exe
  C:\Windows\System\NdQHgEr.exe
  2⤵
  PID:3472
- C:\Windows\System\IQVNFuT.exe
  C:\Windows\System\IQVNFuT.exe
  2⤵
  PID:3504
- C:\Windows\System\lkmGjrF.exe
  C:\Windows\System\lkmGjrF.exe
  2⤵
  PID:3548
- C:\Windows\System\KdVgBPM.exe
  C:\Windows\System\KdVgBPM.exe
  2⤵
  PID:3580
- C:\Windows\System\UdLfVQz.exe
  C:\Windows\System\UdLfVQz.exe
  2⤵
  PID:3612
- C:\Windows\System\ZmLONAj.exe
  C:\Windows\System\ZmLONAj.exe
  2⤵
  PID:3308
- C:\Windows\System\bLMcOiI.exe
  C:\Windows\System\bLMcOiI.exe
  2⤵
  PID:3660
- C:\Windows\System\aTTboIc.exe
  C:\Windows\System\aTTboIc.exe
  2⤵
  PID:4104
- C:\Windows\System\bgaHSIc.exe
  C:\Windows\System\bgaHSIc.exe
  2⤵
  PID:4128
- C:\Windows\System\QwHdgrd.exe
  C:\Windows\System\QwHdgrd.exe
  2⤵
  PID:4144
- C:\Windows\System\PVopuSm.exe
  C:\Windows\System\PVopuSm.exe
  2⤵
  PID:4160
- C:\Windows\System\ZExVESV.exe
  C:\Windows\System\ZExVESV.exe
  2⤵
  PID:4176
- C:\Windows\System\fdnxgXl.exe
  C:\Windows\System\fdnxgXl.exe
  2⤵
  PID:4192
- C:\Windows\System\xzUriMm.exe
  C:\Windows\System\xzUriMm.exe
  2⤵
  PID:4212
- C:\Windows\System\nuenlBw.exe
  C:\Windows\System\nuenlBw.exe
  2⤵
  PID:4228
- C:\Windows\System\OoTgNeP.exe
  C:\Windows\System\OoTgNeP.exe
  2⤵
  PID:4248
- C:\Windows\System\HpAZHxM.exe
  C:\Windows\System\HpAZHxM.exe
  2⤵
  PID:4264
- C:\Windows\System\QkyMNeo.exe
  C:\Windows\System\QkyMNeo.exe
  2⤵
  PID:4280
- C:\Windows\System\cIjGzEC.exe
  C:\Windows\System\cIjGzEC.exe
  2⤵
  PID:4296
- C:\Windows\System\sdlaZwK.exe
  C:\Windows\System\sdlaZwK.exe
  2⤵
  PID:4320
- C:\Windows\System\tYCUnVO.exe
  C:\Windows\System\tYCUnVO.exe
  2⤵
  PID:4336
- C:\Windows\System\EbiTJaF.exe
  C:\Windows\System\EbiTJaF.exe
  2⤵
  PID:4352
- C:\Windows\System\JQQCYla.exe
  C:\Windows\System\JQQCYla.exe
  2⤵
  PID:4368
- C:\Windows\System\vVThiQm.exe
  C:\Windows\System\vVThiQm.exe
  2⤵
  PID:4388
- C:\Windows\System\OlUUgid.exe
  C:\Windows\System\OlUUgid.exe
  2⤵
  PID:4404
- C:\Windows\System\QQzvXlV.exe
  C:\Windows\System\QQzvXlV.exe
  2⤵
  PID:4420
- C:\Windows\System\cOlBTbp.exe
  C:\Windows\System\cOlBTbp.exe
  2⤵
  PID:4436
- C:\Windows\System\KKgTiJJ.exe
  C:\Windows\System\KKgTiJJ.exe
  2⤵
  PID:4456
- C:\Windows\System\zwQPZIA.exe
  C:\Windows\System\zwQPZIA.exe
  2⤵
  PID:4472
- C:\Windows\System\ploWHWU.exe
  C:\Windows\System\ploWHWU.exe
  2⤵
  PID:4488
- C:\Windows\System\qSLHNvb.exe
  C:\Windows\System\qSLHNvb.exe
  2⤵
  PID:4504
- C:\Windows\System\XYoEOkI.exe
  C:\Windows\System\XYoEOkI.exe
  2⤵
  PID:4524
- C:\Windows\System\oPMGvOz.exe
  C:\Windows\System\oPMGvOz.exe
  2⤵
  PID:4540
- C:\Windows\System\REdHOri.exe
  C:\Windows\System\REdHOri.exe
  2⤵
  PID:4556
- C:\Windows\System\tBbCxyk.exe
  C:\Windows\System\tBbCxyk.exe
  2⤵
  PID:4572
- C:\Windows\System\TrmkzDU.exe
  C:\Windows\System\TrmkzDU.exe
  2⤵
  PID:4588
- C:\Windows\System\aGJUZpi.exe
  C:\Windows\System\aGJUZpi.exe
  2⤵
  PID:4608
- C:\Windows\System\DoHubYM.exe
  C:\Windows\System\DoHubYM.exe
  2⤵
  PID:4624
- C:\Windows\System\RcWINPo.exe
  C:\Windows\System\RcWINPo.exe
  2⤵
  PID:4640
- C:\Windows\System\epqqaQe.exe
  C:\Windows\System\epqqaQe.exe
  2⤵
  PID:4656
- C:\Windows\System\aaMbNRe.exe
  C:\Windows\System\aaMbNRe.exe
  2⤵
  PID:4676
- C:\Windows\System\lVTYsNw.exe
  C:\Windows\System\lVTYsNw.exe
  2⤵
  PID:4692
- C:\Windows\System\uQqZcFN.exe
  C:\Windows\System\uQqZcFN.exe
  2⤵
  PID:4796
- C:\Windows\System\VRtmjOz.exe
  C:\Windows\System\VRtmjOz.exe
  2⤵
  PID:4860
- C:\Windows\System\NNeNJhY.exe
  C:\Windows\System\NNeNJhY.exe
  2⤵
  PID:4948
- C:\Windows\System\hZVvIEs.exe
  C:\Windows\System\hZVvIEs.exe
  2⤵
  PID:4964
- C:\Windows\System\RuthkjB.exe
  C:\Windows\System\RuthkjB.exe
  2⤵
  PID:4984
- C:\Windows\System\EJgnGBF.exe
  C:\Windows\System\EJgnGBF.exe
  2⤵
  PID:5004
- C:\Windows\System\VydHLfh.exe
  C:\Windows\System\VydHLfh.exe
  2⤵
  PID:5028
- C:\Windows\System\doADkJW.exe
  C:\Windows\System\doADkJW.exe
  2⤵
  PID:5044
- C:\Windows\System\ZVKkSUf.exe
  C:\Windows\System\ZVKkSUf.exe
  2⤵
  PID:5060
- C:\Windows\System\pWVKuvl.exe
  C:\Windows\System\pWVKuvl.exe
  2⤵
  PID:5076
- C:\Windows\System\bvVaVyn.exe
  C:\Windows\System\bvVaVyn.exe
  2⤵
  PID:5092
- C:\Windows\System\VkigvWx.exe
  C:\Windows\System\VkigvWx.exe
  2⤵
  PID:5108
- C:\Windows\System\FRQXAaX.exe
  C:\Windows\System\FRQXAaX.exe
  2⤵
  PID:4060
- C:\Windows\System\YosnMZH.exe
  C:\Windows\System\YosnMZH.exe
  2⤵
  PID:3696
- C:\Windows\System\AxgGUKO.exe
  C:\Windows\System\AxgGUKO.exe
  2⤵
  PID:4028
- C:\Windows\System\FfwIAyi.exe
  C:\Windows\System\FfwIAyi.exe
  2⤵
  PID:3712
- C:\Windows\System\TFxvAlS.exe
  C:\Windows\System\TFxvAlS.exe
  2⤵
  PID:3776
- C:\Windows\System\JyxwzKZ.exe
  C:\Windows\System\JyxwzKZ.exe
  2⤵
  PID:3872
- C:\Windows\System\cfTZXiL.exe
  C:\Windows\System\cfTZXiL.exe
  2⤵
  PID:3964
- C:\Windows\System\eaCOHyY.exe
  C:\Windows\System\eaCOHyY.exe
  2⤵
  PID:2276
- C:\Windows\System\VNlcmBP.exe
  C:\Windows\System\VNlcmBP.exe
  2⤵
  PID:2664
- C:\Windows\System\CnOcvKI.exe
  C:\Windows\System\CnOcvKI.exe
  2⤵
  PID:3144
- C:\Windows\System\KpIFpqc.exe
  C:\Windows\System\KpIFpqc.exe
  2⤵
  PID:988
- C:\Windows\System\CUVCavB.exe
  C:\Windows\System\CUVCavB.exe
  2⤵
  PID:2804
- C:\Windows\System\vBLdiJf.exe
  C:\Windows\System\vBLdiJf.exe
  2⤵
  PID:3228
- C:\Windows\System\KtrwEoy.exe
  C:\Windows\System\KtrwEoy.exe
  2⤵
  PID:3340
- C:\Windows\System\aZyHrDa.exe
  C:\Windows\System\aZyHrDa.exe
  2⤵
  PID:3420
- C:\Windows\System\mLjGuKX.exe
  C:\Windows\System\mLjGuKX.exe
  2⤵
  PID:3520
- C:\Windows\System\XMLbpEr.exe
  C:\Windows\System\XMLbpEr.exe
  2⤵
  PID:3648
- C:\Windows\System\qKRwEEK.exe
  C:\Windows\System\qKRwEEK.exe
  2⤵
  PID:4120
- C:\Windows\System\pSXhnZG.exe
  C:\Windows\System\pSXhnZG.exe
  2⤵
  PID:4188
- C:\Windows\System\cJdmewm.exe
  C:\Windows\System\cJdmewm.exe
  2⤵
  PID:4224
- C:\Windows\System\VjTdIoq.exe
  C:\Windows\System\VjTdIoq.exe
  2⤵
  PID:4332
- C:\Windows\System\rxlYqYZ.exe
  C:\Windows\System\rxlYqYZ.exe
  2⤵
  PID:4400
- C:\Windows\System\PwaFpIc.exe
  C:\Windows\System\PwaFpIc.exe
  2⤵
  PID:4468
- C:\Windows\System\yjDzibJ.exe
  C:\Windows\System\yjDzibJ.exe
  2⤵
  PID:4536
- C:\Windows\System\uTaYron.exe
  C:\Windows\System\uTaYron.exe
  2⤵
  PID:4600
- C:\Windows\System\ytZmYFp.exe
  C:\Windows\System\ytZmYFp.exe
  2⤵
  PID:4664
- C:\Windows\System\MpwrRCq.exe
  C:\Windows\System\MpwrRCq.exe
  2⤵
  PID:4708
- C:\Windows\System\LHMtYZC.exe
  C:\Windows\System\LHMtYZC.exe
  2⤵
  PID:4724
- C:\Windows\System\TZfiFpm.exe
  C:\Windows\System\TZfiFpm.exe
  2⤵
  PID:4748
- C:\Windows\System\aFvqnmN.exe
  C:\Windows\System\aFvqnmN.exe
  2⤵
  PID:4764
- C:\Windows\System\qSJXoqC.exe
  C:\Windows\System\qSJXoqC.exe
  2⤵
  PID:4780
- C:\Windows\System\NzPramW.exe
  C:\Windows\System\NzPramW.exe
  2⤵
  PID:3728
- C:\Windows\System\QmXvvPG.exe
  C:\Windows\System\QmXvvPG.exe
  2⤵
  PID:3792
- C:\Windows\System\Ozvujqe.exe
  C:\Windows\System\Ozvujqe.exe
  2⤵
  PID:3884
- C:\Windows\System\UAvUafK.exe
  C:\Windows\System\UAvUafK.exe
  2⤵
  PID:3920
- C:\Windows\System\FDnvaml.exe
  C:\Windows\System\FDnvaml.exe
  2⤵
  PID:4012
- C:\Windows\System\uPixFUg.exe
  C:\Windows\System\uPixFUg.exe
  2⤵
  PID:4016
- C:\Windows\System\vwsIJDn.exe
  C:\Windows\System\vwsIJDn.exe
  2⤵
  PID:1628
- C:\Windows\System\fDIfnrJ.exe
  C:\Windows\System\fDIfnrJ.exe
  2⤵
  PID:3088
- C:\Windows\System\aYodStg.exe
  C:\Windows\System\aYodStg.exe
  2⤵
  PID:1940
- C:\Windows\System\VOqgdBG.exe
  C:\Windows\System\VOqgdBG.exe
  2⤵
  PID:3124
- C:\Windows\System\AUEznhV.exe
  C:\Windows\System\AUEznhV.exe
  2⤵
  PID:3272
- C:\Windows\System\bvbwzsx.exe
  C:\Windows\System\bvbwzsx.exe
  2⤵
  PID:3216
- C:\Windows\System\kcECSmx.exe
  C:\Windows\System\kcECSmx.exe
  2⤵
  PID:2184
- C:\Windows\System\Xarhyve.exe
  C:\Windows\System\Xarhyve.exe
  2⤵
  PID:3488
- C:\Windows\System\HayXTac.exe
  C:\Windows\System\HayXTac.exe
  2⤵
  PID:3616
- C:\Windows\System\hpmEfxV.exe
  C:\Windows\System\hpmEfxV.exe
  2⤵
  PID:4136
- C:\Windows\System\KOsAPQq.exe
  C:\Windows\System\KOsAPQq.exe
  2⤵
  PID:4204
- C:\Windows\System\NxJAaWo.exe
  C:\Windows\System\NxJAaWo.exe
  2⤵
  PID:4244
- C:\Windows\System\kRtpGmW.exe
  C:\Windows\System\kRtpGmW.exe
  2⤵
  PID:4312
- C:\Windows\System\cKaAmxT.exe
  C:\Windows\System\cKaAmxT.exe
  2⤵
  PID:4376
- C:\Windows\System\wRbAukM.exe
  C:\Windows\System\wRbAukM.exe
  2⤵
  PID:4416
- C:\Windows\System\efPWFar.exe
  C:\Windows\System\efPWFar.exe
  2⤵
  PID:4480
- C:\Windows\System\beQiwBf.exe
  C:\Windows\System\beQiwBf.exe
  2⤵
  PID:4548
- C:\Windows\System\ECKjJkN.exe
  C:\Windows\System\ECKjJkN.exe
  2⤵
  PID:4616
- C:\Windows\System\bwjuIbr.exe
  C:\Windows\System\bwjuIbr.exe
  2⤵
  PID:4684
- C:\Windows\System\whvthZH.exe
  C:\Windows\System\whvthZH.exe
  2⤵
  PID:4856
- C:\Windows\System\AMkVXQO.exe
  C:\Windows\System\AMkVXQO.exe
  2⤵
  PID:4908
- C:\Windows\System\fixCrJQ.exe
  C:\Windows\System\fixCrJQ.exe
  2⤵
  PID:4872
- C:\Windows\System\mHmhNBB.exe
  C:\Windows\System\mHmhNBB.exe
  2⤵
  PID:4884
- C:\Windows\System\JypnIgY.exe
  C:\Windows\System\JypnIgY.exe
  2⤵
  PID:4904
- C:\Windows\System\zpJsUtG.exe
  C:\Windows\System\zpJsUtG.exe
  2⤵
  PID:4936
- C:\Windows\System\mAjAcTD.exe
  C:\Windows\System\mAjAcTD.exe
  2⤵
  PID:4992
- C:\Windows\System\kBtSAsB.exe
  C:\Windows\System\kBtSAsB.exe
  2⤵
  PID:4960
- C:\Windows\System\ujTEtRw.exe
  C:\Windows\System\ujTEtRw.exe
  2⤵
  PID:5056
- C:\Windows\System\WnJBMxl.exe
  C:\Windows\System\WnJBMxl.exe
  2⤵
  PID:3932
- C:\Windows\System\ejgxemd.exe
  C:\Windows\System\ejgxemd.exe
  2⤵
  PID:3996
- C:\Windows\System\QZqrzqR.exe
  C:\Windows\System\QZqrzqR.exe
  2⤵
  PID:3968
- C:\Windows\System\nvTBOYO.exe
  C:\Windows\System\nvTBOYO.exe
  2⤵
  PID:3148
- C:\Windows\System\vsBdIhb.exe
  C:\Windows\System\vsBdIhb.exe
  2⤵
  PID:2864
- C:\Windows\System\TwEHQzq.exe
  C:\Windows\System\TwEHQzq.exe
  2⤵
  PID:3336
- C:\Windows\System\vnhpwJk.exe
  C:\Windows\System\vnhpwJk.exe
  2⤵
  PID:5100
- C:\Windows\System\yDOgzeV.exe
  C:\Windows\System\yDOgzeV.exe
  2⤵
  PID:3708
- C:\Windows\System\QrJjNAh.exe
  C:\Windows\System\QrJjNAh.exe
  2⤵
  PID:3840
- C:\Windows\System\CkjHAZC.exe
  C:\Windows\System\CkjHAZC.exe
  2⤵
  PID:636
- C:\Windows\System\SAQNsrh.exe
  C:\Windows\System\SAQNsrh.exe
  2⤵
  PID:2884
- C:\Windows\System\msyTMep.exe
  C:\Windows\System\msyTMep.exe
  2⤵
  PID:4328
- C:\Windows\System\RdAZrSK.exe
  C:\Windows\System\RdAZrSK.exe
  2⤵
  PID:4360
- C:\Windows\System\RDeWfLg.exe
  C:\Windows\System\RDeWfLg.exe
  2⤵
  PID:3064
- C:\Windows\System\gWAaVZj.exe
  C:\Windows\System\gWAaVZj.exe
  2⤵
  PID:3852
- C:\Windows\System\lldgopj.exe
  C:\Windows\System\lldgopj.exe
  2⤵
  PID:1348
- C:\Windows\System\GHdgLNE.exe
  C:\Windows\System\GHdgLNE.exe
  2⤵
  PID:2440
- C:\Windows\System\ivXEsga.exe
  C:\Windows\System\ivXEsga.exe
  2⤵
  PID:4956
- C:\Windows\System\GzfZsmt.exe
  C:\Windows\System\GzfZsmt.exe
  2⤵
  PID:1136
- C:\Windows\System\QvNUsUH.exe
  C:\Windows\System\QvNUsUH.exe
  2⤵
  PID:5068
- C:\Windows\System\maDwhwu.exe
  C:\Windows\System\maDwhwu.exe
  2⤵
  PID:4184
- C:\Windows\System\kKGsRln.exe
  C:\Windows\System\kKGsRln.exe
  2⤵
  PID:3772
- C:\Windows\System\cZAhQlP.exe
  C:\Windows\System\cZAhQlP.exe
  2⤵
  PID:4672
- C:\Windows\System\hwJvJaY.exe
  C:\Windows\System\hwJvJaY.exe
  2⤵
  PID:4568
- C:\Windows\System\eDVMuMK.exe
  C:\Windows\System\eDVMuMK.exe
  2⤵
  PID:2236
- C:\Windows\System\XlAPvZZ.exe
  C:\Windows\System\XlAPvZZ.exe
  2⤵
  PID:2932
- C:\Windows\System\ZaCDoeR.exe
  C:\Windows\System\ZaCDoeR.exe
  2⤵
  PID:4116
- C:\Windows\System\bGYFMJL.exe
  C:\Windows\System\bGYFMJL.exe
  2⤵
  PID:3788
- C:\Windows\System\gaYoFLB.exe
  C:\Windows\System\gaYoFLB.exe
  2⤵
  PID:3104
- C:\Windows\System\FaNBcGJ.exe
  C:\Windows\System\FaNBcGJ.exe
  2⤵
  PID:3112
- C:\Windows\System\zumTmLg.exe
  C:\Windows\System\zumTmLg.exe
  2⤵
  PID:4636
- C:\Windows\System\ykDxjvX.exe
  C:\Windows\System\ykDxjvX.exe
  2⤵
  PID:4716
- C:\Windows\System\qYRNqQW.exe
  C:\Windows\System\qYRNqQW.exe
  2⤵
  PID:4868
- C:\Windows\System\FwJdMzc.exe
  C:\Windows\System\FwJdMzc.exe
  2⤵
  PID:4648
- C:\Windows\System\UbnUBJS.exe
  C:\Windows\System\UbnUBJS.exe
  2⤵
  PID:4520
- C:\Windows\System\MKlUuhO.exe
  C:\Windows\System\MKlUuhO.exe
  2⤵
  PID:4512
- C:\Windows\System\jbcJUfW.exe
  C:\Windows\System\jbcJUfW.exe
  2⤵
  PID:1716
- C:\Windows\System\jsVnTed.exe
  C:\Windows\System\jsVnTed.exe
  2⤵
  PID:3132
- C:\Windows\System\DAhiMlw.exe
  C:\Windows\System\DAhiMlw.exe
  2⤵
  PID:1212
- C:\Windows\System\ifFnahY.exe
  C:\Windows\System\ifFnahY.exe
  2⤵
  PID:5116
- C:\Windows\System\OjCZaDt.exe
  C:\Windows\System\OjCZaDt.exe
  2⤵
  PID:3808
- C:\Windows\System\kaGKstA.exe
  C:\Windows\System\kaGKstA.exe
  2⤵
  PID:4736
- C:\Windows\System\mgDRyua.exe
  C:\Windows\System\mgDRyua.exe
  2⤵
  PID:3632
- C:\Windows\System\iMdzplM.exe
  C:\Windows\System\iMdzplM.exe
  2⤵
  PID:4756
- C:\Windows\System\hEluiPv.exe
  C:\Windows\System\hEluiPv.exe
  2⤵
  PID:4792
- C:\Windows\System\IKlXIBL.exe
  C:\Windows\System\IKlXIBL.exe
  2⤵
  PID:3020
- C:\Windows\System\WSThuMf.exe
  C:\Windows\System\WSThuMf.exe
  2⤵
  PID:2516
- C:\Windows\System\hCjBsIM.exe
  C:\Windows\System\hCjBsIM.exe
  2⤵
  PID:3724
- C:\Windows\System\qDSGcom.exe
  C:\Windows\System\qDSGcom.exe
  2⤵
  PID:4804
- C:\Windows\System\UGkVrbu.exe
  C:\Windows\System\UGkVrbu.exe
  2⤵
  PID:4452
- C:\Windows\System\msOmsCi.exe
  C:\Windows\System\msOmsCi.exe
  2⤵
  PID:4580
- C:\Windows\System\vUZzUsl.exe
  C:\Windows\System\vUZzUsl.exe
  2⤵
  PID:4928
- C:\Windows\System\orPqtyS.exe
  C:\Windows\System\orPqtyS.exe
  2⤵
  PID:5052
- C:\Windows\System\XRTcILi.exe
  C:\Windows\System\XRTcILi.exe
  2⤵
  PID:5040
- C:\Windows\System\mxmJfSK.exe
  C:\Windows\System\mxmJfSK.exe
  2⤵
  PID:3936
- C:\Windows\System\FwDycGD.exe
  C:\Windows\System\FwDycGD.exe
  2⤵
  PID:1244
- C:\Windows\System\tRTmmTc.exe
  C:\Windows\System\tRTmmTc.exe
  2⤵
  PID:4032
- C:\Windows\System\YzZGNaN.exe
  C:\Windows\System\YzZGNaN.exe
  2⤵
  PID:3196
- C:\Windows\System\hKcUHXl.exe
  C:\Windows\System\hKcUHXl.exe
  2⤵
  PID:3456
- C:\Windows\System\xVdOBYw.exe
  C:\Windows\System\xVdOBYw.exe
  2⤵
  PID:4772
- C:\Windows\System\QrbEzxN.exe
  C:\Windows\System\QrbEzxN.exe
  2⤵
  PID:4240
- C:\Windows\System\soiStwa.exe
  C:\Windows\System\soiStwa.exe
  2⤵
  PID:4752
- C:\Windows\System\hRgvgDA.exe
  C:\Windows\System\hRgvgDA.exe
  2⤵
  PID:2092
- C:\Windows\System\ZtumniW.exe
  C:\Windows\System\ZtumniW.exe
  2⤵
  PID:2160
- C:\Windows\System\gZvCHSe.exe
  C:\Windows\System\gZvCHSe.exe
  2⤵
  PID:3184
- C:\Windows\System\ztgIJBi.exe
  C:\Windows\System\ztgIJBi.exe
  2⤵
  PID:4276
- C:\Windows\System\zCYyrAN.exe
  C:\Windows\System\zCYyrAN.exe
  2⤵
  PID:4256
- C:\Windows\System\EMvBSnq.exe
  C:\Windows\System\EMvBSnq.exe
  2⤵
  PID:5088
- C:\Windows\System\PjxTFmP.exe
  C:\Windows\System\PjxTFmP.exe
  2⤵
  PID:5016
- C:\Windows\System\umeLkMA.exe
  C:\Windows\System\umeLkMA.exe
  2⤵
  PID:4700
- C:\Windows\System\hfAeaNs.exe
  C:\Windows\System\hfAeaNs.exe
  2⤵
  PID:4516
- C:\Windows\System\XSzpoBy.exe
  C:\Windows\System\XSzpoBy.exe
  2⤵
  PID:3916
- C:\Windows\System\KdmpWux.exe
  C:\Windows\System\KdmpWux.exe
  2⤵
  PID:3552
- C:\Windows\System\VYCSzzW.exe
  C:\Windows\System\VYCSzzW.exe
  2⤵
  PID:4900
- C:\Windows\System\FAfROhn.exe
  C:\Windows\System\FAfROhn.exe
  2⤵
  PID:4632
- C:\Windows\System\JmvlljO.exe
  C:\Windows\System\JmvlljO.exe
  2⤵
  PID:4448
- C:\Windows\System\aSxbziH.exe
  C:\Windows\System\aSxbziH.exe
  2⤵
  PID:4596
- C:\Windows\System\NLcVVrS.exe
  C:\Windows\System\NLcVVrS.exe
  2⤵
  PID:4304
- C:\Windows\System\ybHZXra.exe
  C:\Windows\System\ybHZXra.exe
  2⤵
  PID:5196
- C:\Windows\System\yCHVpkg.exe
  C:\Windows\System\yCHVpkg.exe
  2⤵
  PID:5212
- C:\Windows\System\qFjjVtZ.exe
  C:\Windows\System\qFjjVtZ.exe
  2⤵
  PID:5228
- C:\Windows\System\VpnTmmf.exe
  C:\Windows\System\VpnTmmf.exe
  2⤵
  PID:5244
- C:\Windows\System\vlBROjm.exe
  C:\Windows\System\vlBROjm.exe
  2⤵
  PID:5260
- C:\Windows\System\HasKfDv.exe
  C:\Windows\System\HasKfDv.exe
  2⤵
  PID:5284
- C:\Windows\System\BEKBEXe.exe
  C:\Windows\System\BEKBEXe.exe
  2⤵
  PID:5300
- C:\Windows\System\VysTHOR.exe
  C:\Windows\System\VysTHOR.exe
  2⤵
  PID:5332
- C:\Windows\System\HBOzYQS.exe
  C:\Windows\System\HBOzYQS.exe
  2⤵
  PID:5352
- C:\Windows\System\tBLnXNX.exe
  C:\Windows\System\tBLnXNX.exe
  2⤵
  PID:5372
- C:\Windows\System\UbShqvv.exe
  C:\Windows\System\UbShqvv.exe
  2⤵
  PID:5388
- C:\Windows\System\uWTcDTX.exe
  C:\Windows\System\uWTcDTX.exe
  2⤵
  PID:5408
- C:\Windows\System\SUwOYpa.exe
  C:\Windows\System\SUwOYpa.exe
  2⤵
  PID:5428
- C:\Windows\System\vAnHDVb.exe
  C:\Windows\System\vAnHDVb.exe
  2⤵
  PID:5444
- C:\Windows\System\YykOJKG.exe
  C:\Windows\System\YykOJKG.exe
  2⤵
  PID:5460
- C:\Windows\System\klQSOTE.exe
  C:\Windows\System\klQSOTE.exe
  2⤵
  PID:5480
- C:\Windows\System\maThxfZ.exe
  C:\Windows\System\maThxfZ.exe
  2⤵
  PID:5496
- C:\Windows\System\OGxcnti.exe
  C:\Windows\System\OGxcnti.exe
  2⤵
  PID:5512
- C:\Windows\System\PqwIgax.exe
  C:\Windows\System\PqwIgax.exe
  2⤵
  PID:5528
- C:\Windows\System\hcWDTRw.exe
  C:\Windows\System\hcWDTRw.exe
  2⤵
  PID:5544
- C:\Windows\System\ZLuyJOx.exe
  C:\Windows\System\ZLuyJOx.exe
  2⤵
  PID:5564
- C:\Windows\System\sIJKZKA.exe
  C:\Windows\System\sIJKZKA.exe
  2⤵
  PID:5580
- C:\Windows\System\tJbfzVK.exe
  C:\Windows\System\tJbfzVK.exe
  2⤵
  PID:5596
- C:\Windows\System\pgpZexm.exe
  C:\Windows\System\pgpZexm.exe
  2⤵
  PID:5616
- C:\Windows\System\FrvfQJf.exe
  C:\Windows\System\FrvfQJf.exe
  2⤵
  PID:5636
- C:\Windows\System\REQDADn.exe
  C:\Windows\System\REQDADn.exe
  2⤵
  PID:5652
- C:\Windows\System\wgeXJWd.exe
  C:\Windows\System\wgeXJWd.exe
  2⤵
  PID:5672
- C:\Windows\System\ISZaWIh.exe
  C:\Windows\System\ISZaWIh.exe
  2⤵
  PID:5732
- C:\Windows\System\SMeeyhc.exe
  C:\Windows\System\SMeeyhc.exe
  2⤵
  PID:5748
- C:\Windows\System\qhAtXOl.exe
  C:\Windows\System\qhAtXOl.exe
  2⤵
  PID:5764
- C:\Windows\System\JvTvTvb.exe
  C:\Windows\System\JvTvTvb.exe
  2⤵
  PID:5780
- C:\Windows\System\IFaJYkF.exe
  C:\Windows\System\IFaJYkF.exe
  2⤵
  PID:5796
- C:\Windows\System\vEfBXFk.exe
  C:\Windows\System\vEfBXFk.exe
  2⤵
  PID:5812
- C:\Windows\System\HLNYyIT.exe
  C:\Windows\System\HLNYyIT.exe
  2⤵
  PID:5832
- C:\Windows\System\dLBvBvZ.exe
  C:\Windows\System\dLBvBvZ.exe
  2⤵
  PID:5848
- C:\Windows\System\aWObuQC.exe
  C:\Windows\System\aWObuQC.exe
  2⤵
  PID:5864
- C:\Windows\System\qMyAPuV.exe
  C:\Windows\System\qMyAPuV.exe
  2⤵
  PID:5880
- C:\Windows\System\MjRTDxX.exe
  C:\Windows\System\MjRTDxX.exe
  2⤵
  PID:5944
- C:\Windows\System\cxdUWCC.exe
  C:\Windows\System\cxdUWCC.exe
  2⤵
  PID:5960
- C:\Windows\System\mCRglue.exe
  C:\Windows\System\mCRglue.exe
  2⤵
  PID:5976
- C:\Windows\System\NtXyxpA.exe
  C:\Windows\System\NtXyxpA.exe
  2⤵
  PID:5992
- C:\Windows\System\pHUkjog.exe
  C:\Windows\System\pHUkjog.exe
  2⤵
  PID:6008
- C:\Windows\System\DtTrjud.exe
  C:\Windows\System\DtTrjud.exe
  2⤵
  PID:6036
- C:\Windows\System\UHgPGwX.exe
  C:\Windows\System\UHgPGwX.exe
  2⤵
  PID:6052
- C:\Windows\System\PVyTaUe.exe
  C:\Windows\System\PVyTaUe.exe
  2⤵
  PID:6068
- C:\Windows\System\mGLApts.exe
  C:\Windows\System\mGLApts.exe
  2⤵
  PID:6084
- C:\Windows\System\vmCNKHN.exe
  C:\Windows\System\vmCNKHN.exe
  2⤵
  PID:6100
- C:\Windows\System\IZnaUdh.exe
  C:\Windows\System\IZnaUdh.exe
  2⤵
  PID:6116
- C:\Windows\System\OSSzuFy.exe
  C:\Windows\System\OSSzuFy.exe
  2⤵
  PID:6132
- C:\Windows\System\LrNCCOK.exe
  C:\Windows\System\LrNCCOK.exe
  2⤵
  PID:3324
- C:\Windows\System\vUzTomX.exe
  C:\Windows\System\vUzTomX.exe
  2⤵
  PID:4896
- C:\Windows\System\GfUZYOR.exe
  C:\Windows\System\GfUZYOR.exe
  2⤵
  PID:4260
- C:\Windows\System\ckZfnkL.exe
  C:\Windows\System\ckZfnkL.exe
  2⤵
  PID:2056
- C:\Windows\System\iLYhgCW.exe
  C:\Windows\System\iLYhgCW.exe
  2⤵
  PID:3436
- C:\Windows\System\bhAevBs.exe
  C:\Windows\System\bhAevBs.exe
  2⤵
  PID:4876
- C:\Windows\System\pyWrihe.exe
  C:\Windows\System\pyWrihe.exe
  2⤵
  PID:5144
- C:\Windows\System\XsaeMBL.exe
  C:\Windows\System\XsaeMBL.exe
  2⤵
  PID:5164
- C:\Windows\System\VhTkKTz.exe
  C:\Windows\System\VhTkKTz.exe
  2⤵
  PID:5184
- C:\Windows\System\dpNSGxJ.exe
  C:\Windows\System\dpNSGxJ.exe
  2⤵
  PID:5240
- C:\Windows\System\uUovTPA.exe
  C:\Windows\System\uUovTPA.exe
  2⤵
  PID:5280
- C:\Windows\System\GcRfhoy.exe
  C:\Windows\System\GcRfhoy.exe
  2⤵
  PID:5256
- C:\Windows\System\lOBGItn.exe
  C:\Windows\System\lOBGItn.exe
  2⤵
  PID:5316
- C:\Windows\System\mHVawtu.exe
  C:\Windows\System\mHVawtu.exe
  2⤵
  PID:1512
- C:\Windows\System\mlHWeis.exe
  C:\Windows\System\mlHWeis.exe
  2⤵
  PID:5404
- C:\Windows\System\dSsXkap.exe
  C:\Windows\System\dSsXkap.exe
  2⤵
  PID:5436
- C:\Windows\System\ZPVcCcE.exe
  C:\Windows\System\ZPVcCcE.exe
  2⤵
  PID:5420
- C:\Windows\System\LWDBtFW.exe
  C:\Windows\System\LWDBtFW.exe
  2⤵
  PID:5508
- C:\Windows\System\jfKsxpi.exe
  C:\Windows\System\jfKsxpi.exe
  2⤵
  PID:5608
- C:\Windows\System\HWimZqs.exe
  C:\Windows\System\HWimZqs.exe
  2⤵
  PID:5684
- C:\Windows\System\jmdUAKa.exe
  C:\Windows\System\jmdUAKa.exe
  2⤵
  PID:5700
- C:\Windows\System\aJAHwTf.exe
  C:\Windows\System\aJAHwTf.exe
  2⤵
  PID:5424
- C:\Windows\System\bgvUkLr.exe
  C:\Windows\System\bgvUkLr.exe
  2⤵
  PID:5592
- C:\Windows\System\zfOYDrU.exe
  C:\Windows\System\zfOYDrU.exe
  2⤵
  PID:5660
- C:\Windows\System\NydLmbL.exe
  C:\Windows\System\NydLmbL.exe
  2⤵
  PID:5712
- C:\Windows\System\uaxpByU.exe
  C:\Windows\System\uaxpByU.exe
  2⤵
  PID:5456
- C:\Windows\System\zbjFDKC.exe
  C:\Windows\System\zbjFDKC.exe
  2⤵
  PID:5416
- C:\Windows\System\dMdbBDB.exe
  C:\Windows\System\dMdbBDB.exe
  2⤵
  PID:5760
- C:\Windows\System\QwUhYuP.exe
  C:\Windows\System\QwUhYuP.exe
  2⤵
  PID:5888
- C:\Windows\System\mnVawbS.exe
  C:\Windows\System\mnVawbS.exe
  2⤵
  PID:5904
- C:\Windows\System\LhvSPMX.exe
  C:\Windows\System\LhvSPMX.exe
  2⤵
  PID:5912
- C:\Windows\System\BNdjict.exe
  C:\Windows\System\BNdjict.exe
  2⤵
  PID:5744
- C:\Windows\System\tgsAUdL.exe
  C:\Windows\System\tgsAUdL.exe
  2⤵
  PID:5928
- C:\Windows\System\grFGNlc.exe
  C:\Windows\System\grFGNlc.exe
  2⤵
  PID:5844
- C:\Windows\System\oosOHFd.exe
  C:\Windows\System\oosOHFd.exe
  2⤵
  PID:5952
- C:\Windows\System\GHZZNeu.exe
  C:\Windows\System\GHZZNeu.exe
  2⤵
  PID:6000
- C:\Windows\System\UoYnfMF.exe
  C:\Windows\System\UoYnfMF.exe
  2⤵
  PID:6024
- C:\Windows\System\tHOTDpV.exe
  C:\Windows\System\tHOTDpV.exe
  2⤵
  PID:6076
- C:\Windows\System\vmpuzkB.exe
  C:\Windows\System\vmpuzkB.exe
  2⤵
  PID:6112
- C:\Windows\System\rIbzTtW.exe
  C:\Windows\System\rIbzTtW.exe
  2⤵
  PID:984
- C:\Windows\System\HlCQvfD.exe
  C:\Windows\System\HlCQvfD.exe
  2⤵
  PID:5236
- C:\Windows\System\YfbjZUB.exe
  C:\Windows\System\YfbjZUB.exe
  2⤵
  PID:5368
- C:\Windows\System\PifMAlT.exe
  C:\Windows\System\PifMAlT.exe
  2⤵
  PID:3408
- C:\Windows\System\hEIULew.exe
  C:\Windows\System\hEIULew.exe
  2⤵
  PID:5692
- C:\Windows\System\SktBggh.exe
  C:\Windows\System\SktBggh.exe
  2⤵
  PID:5276
- C:\Windows\System\xFiNYYh.exe
  C:\Windows\System\xFiNYYh.exe
  2⤵
  PID:5572
- C:\Windows\System\pyAuPUL.exe
  C:\Windows\System\pyAuPUL.exe
  2⤵
  PID:5520
- C:\Windows\System\kxItDik.exe
  C:\Windows\System\kxItDik.exe
  2⤵
  PID:5856
- C:\Windows\System\cVSDaWX.exe
  C:\Windows\System\cVSDaWX.exe
  2⤵
  PID:6156
- C:\Windows\System\Rdhewhc.exe
  C:\Windows\System\Rdhewhc.exe
  2⤵
  PID:6172
- C:\Windows\System\LKfLtas.exe
  C:\Windows\System\LKfLtas.exe
  2⤵
  PID:6188
- C:\Windows\System\lAxsyjy.exe
  C:\Windows\System\lAxsyjy.exe
  2⤵
  PID:6204
- C:\Windows\System\WpXRrKo.exe
  C:\Windows\System\WpXRrKo.exe
  2⤵
  PID:6220
- C:\Windows\System\uOvfxjI.exe
  C:\Windows\System\uOvfxjI.exe
  2⤵
  PID:6240
- C:\Windows\System\qhBbexR.exe
  C:\Windows\System\qhBbexR.exe
  2⤵
  PID:6256
- C:\Windows\System\dqOzWzJ.exe
  C:\Windows\System\dqOzWzJ.exe
  2⤵
  PID:6272
- C:\Windows\System\IqAICpb.exe
  C:\Windows\System\IqAICpb.exe
  2⤵
  PID:6296
- C:\Windows\System\dOZWAtl.exe
  C:\Windows\System\dOZWAtl.exe
  2⤵
  PID:6312
- C:\Windows\System\ucXOxZL.exe
  C:\Windows\System\ucXOxZL.exe
  2⤵
  PID:6328
- C:\Windows\System\UMnMxCy.exe
  C:\Windows\System\UMnMxCy.exe
  2⤵
  PID:6344
- C:\Windows\System\DVylfJo.exe
  C:\Windows\System\DVylfJo.exe
  2⤵
  PID:6360
- C:\Windows\System\tpkzqrk.exe
  C:\Windows\System\tpkzqrk.exe
  2⤵
  PID:6376
- C:\Windows\System\wtJyOWj.exe
  C:\Windows\System\wtJyOWj.exe
  2⤵
  PID:6392
- C:\Windows\System\fWFKSIV.exe
  C:\Windows\System\fWFKSIV.exe
  2⤵
  PID:6412
- C:\Windows\System\LKvzxvE.exe
  C:\Windows\System\LKvzxvE.exe
  2⤵
  PID:6452
- C:\Windows\System\XmVSAjw.exe
  C:\Windows\System\XmVSAjw.exe
  2⤵
  PID:6472
- C:\Windows\System\odPPgBV.exe
  C:\Windows\System\odPPgBV.exe
  2⤵
  PID:6488
- C:\Windows\System\jmWdbru.exe
  C:\Windows\System\jmWdbru.exe
  2⤵
  PID:6504
- C:\Windows\System\kUDTiWd.exe
  C:\Windows\System\kUDTiWd.exe
  2⤵
  PID:6520
- C:\Windows\System\VIbihCE.exe
  C:\Windows\System\VIbihCE.exe
  2⤵
  PID:6540
- C:\Windows\System\dpPiDiA.exe
  C:\Windows\System\dpPiDiA.exe
  2⤵
  PID:6556
- C:\Windows\System\WoNpklN.exe
  C:\Windows\System\WoNpklN.exe
  2⤵
  PID:6576
- C:\Windows\System\HALDBuv.exe
  C:\Windows\System\HALDBuv.exe
  2⤵
  PID:6596
- C:\Windows\System\APlGIHJ.exe
  C:\Windows\System\APlGIHJ.exe
  2⤵
  PID:6612
- C:\Windows\System\GwewolL.exe
  C:\Windows\System\GwewolL.exe
  2⤵
  PID:6628
- C:\Windows\System\OMHNZKT.exe
  C:\Windows\System\OMHNZKT.exe
  2⤵
  PID:6644
- C:\Windows\System\NQlOafP.exe
  C:\Windows\System\NQlOafP.exe
  2⤵
  PID:6660
- C:\Windows\System\BzRTVFP.exe
  C:\Windows\System\BzRTVFP.exe
  2⤵
  PID:6680
- C:\Windows\System\HdMninh.exe
  C:\Windows\System\HdMninh.exe
  2⤵
  PID:6704
- C:\Windows\System\FrvUXUD.exe
  C:\Windows\System\FrvUXUD.exe
  2⤵
  PID:6724
- C:\Windows\System\HtGIjPl.exe
  C:\Windows\System\HtGIjPl.exe
  2⤵
  PID:6744
- C:\Windows\System\ZuwGHuz.exe
  C:\Windows\System\ZuwGHuz.exe
  2⤵
  PID:6760
- C:\Windows\System\fdlKcPH.exe
  C:\Windows\System\fdlKcPH.exe
  2⤵
  PID:6776
- C:\Windows\System\RIHlRHH.exe
  C:\Windows\System\RIHlRHH.exe
  2⤵
  PID:6796
- C:\Windows\System\rUXkQdF.exe
  C:\Windows\System\rUXkQdF.exe
  2⤵
  PID:6812
- C:\Windows\System\lbWKZep.exe
  C:\Windows\System\lbWKZep.exe
  2⤵
  PID:6828
- C:\Windows\System\pMUlnYp.exe
  C:\Windows\System\pMUlnYp.exe
  2⤵
  PID:6844
- C:\Windows\System\DEDlhSJ.exe
  C:\Windows\System\DEDlhSJ.exe
  2⤵
  PID:6864
- C:\Windows\System\fDvJSLN.exe
  C:\Windows\System\fDvJSLN.exe
  2⤵
  PID:6880
- C:\Windows\System\EiabXCh.exe
  C:\Windows\System\EiabXCh.exe
  2⤵
  PID:6896
- C:\Windows\System\CYCgvAO.exe
  C:\Windows\System\CYCgvAO.exe
  2⤵
  PID:6912
- C:\Windows\System\nrusfud.exe
  C:\Windows\System\nrusfud.exe
  2⤵
  PID:6928
- C:\Windows\System\emexzXa.exe
  C:\Windows\System\emexzXa.exe
  2⤵
  PID:6944
- C:\Windows\System\UoZSFeD.exe
  C:\Windows\System\UoZSFeD.exe
  2⤵
  PID:6960
- C:\Windows\System\MsFuSRZ.exe
  C:\Windows\System\MsFuSRZ.exe
  2⤵
  PID:6976
- C:\Windows\System\JKdoiBZ.exe
  C:\Windows\System\JKdoiBZ.exe
  2⤵
  PID:6992
- C:\Windows\System\brCNaAB.exe
  C:\Windows\System\brCNaAB.exe
  2⤵
  PID:7008
- C:\Windows\System\SJnDkrT.exe
  C:\Windows\System\SJnDkrT.exe
  2⤵
  PID:7024
- C:\Windows\System\VYRWgvo.exe
  C:\Windows\System\VYRWgvo.exe
  2⤵
  PID:7040
- C:\Windows\System\UnAKGDY.exe
  C:\Windows\System\UnAKGDY.exe
  2⤵
  PID:7056
- C:\Windows\System\ICXnoBO.exe
  C:\Windows\System\ICXnoBO.exe
  2⤵
  PID:7072
- C:\Windows\System\didPUbp.exe
  C:\Windows\System\didPUbp.exe
  2⤵
  PID:7088
- C:\Windows\System\xxIbrzR.exe
  C:\Windows\System\xxIbrzR.exe
  2⤵
  PID:7104
- C:\Windows\System\nKVmgRc.exe
  C:\Windows\System\nKVmgRc.exe
  2⤵
  PID:7120
- C:\Windows\System\QrIKWOW.exe
  C:\Windows\System\QrIKWOW.exe
  2⤵
  PID:7136
- C:\Windows\System\HpWXlOs.exe
  C:\Windows\System\HpWXlOs.exe
  2⤵
  PID:7152
- C:\Windows\System\QVpiTQb.exe
  C:\Windows\System\QVpiTQb.exe
  2⤵
  PID:6020
- C:\Windows\System\ukWvVFW.exe
  C:\Windows\System\ukWvVFW.exe
  2⤵
  PID:5840
- C:\Windows\System\bRUonJl.exe
  C:\Windows\System\bRUonJl.exe
  2⤵
  PID:3396
- C:\Windows\System\GcjYRAU.exe
  C:\Windows\System\GcjYRAU.exe
  2⤵
  PID:5320
- C:\Windows\System\bJgSQBE.exe
  C:\Windows\System\bJgSQBE.exe
  2⤵
  PID:5268
- C:\Windows\System\GnsQdac.exe
  C:\Windows\System\GnsQdac.exe
  2⤵
  PID:5908
- C:\Windows\System\PinweZV.exe
  C:\Windows\System\PinweZV.exe
  2⤵
  PID:6184
- C:\Windows\System\hZfNWgb.exe
  C:\Windows\System\hZfNWgb.exe
  2⤵
  PID:6216
- C:\Windows\System\rqAjErE.exe
  C:\Windows\System\rqAjErE.exe
  2⤵
  PID:6128
- C:\Windows\System\rQLxHTE.exe
  C:\Windows\System\rQLxHTE.exe
  2⤵
  PID:5504
- C:\Windows\System\hEKsPQd.exe
  C:\Windows\System\hEKsPQd.exe
  2⤵
  PID:5704
- C:\Windows\System\jkdecLf.exe
  C:\Windows\System\jkdecLf.exe
  2⤵
  PID:5824
- C:\Windows\System\PijZQBV.exe
  C:\Windows\System\PijZQBV.exe
  2⤵
  PID:6200
- C:\Windows\System\RJCKBjb.exe
  C:\Windows\System\RJCKBjb.exe
  2⤵
  PID:6060
- C:\Windows\System\llcwWwU.exe
  C:\Windows\System\llcwWwU.exe
  2⤵
  PID:5140
- C:\Windows\System\cOEtPdi.exe
  C:\Windows\System\cOEtPdi.exe
  2⤵
  PID:5192
- C:\Windows\System\LJWVbzU.exe
  C:\Windows\System\LJWVbzU.exe
  2⤵
  PID:5312
- C:\Windows\System\nXArRPf.exe
  C:\Windows\System\nXArRPf.exe
  2⤵
  PID:5344
- C:\Windows\System\RjPlwuz.exe
  C:\Windows\System\RjPlwuz.exe
  2⤵
  PID:5728
- C:\Windows\System\qkiTrdn.exe
  C:\Windows\System\qkiTrdn.exe
  2⤵
  PID:5924
- C:\Windows\System\EjmpTLJ.exe
  C:\Windows\System\EjmpTLJ.exe
  2⤵
  PID:3208
- C:\Windows\System\NEGABLL.exe
  C:\Windows\System\NEGABLL.exe
  2⤵
  PID:6228
- C:\Windows\System\OcRsxTv.exe
  C:\Windows\System\OcRsxTv.exe
  2⤵
  PID:6408
- C:\Windows\System\zhsxenZ.exe
  C:\Windows\System\zhsxenZ.exe
  2⤵
  PID:5972
- C:\Windows\System\sXyKpyL.exe
  C:\Windows\System\sXyKpyL.exe
  2⤵
  PID:6124
- C:\Windows\System\FoWgdXT.exe
  C:\Windows\System\FoWgdXT.exe
  2⤵
  PID:5560
- C:\Windows\System\HfMhORY.exe
  C:\Windows\System\HfMhORY.exe
  2⤵
  PID:6340
- C:\Windows\System\lGVrgRY.exe
  C:\Windows\System\lGVrgRY.exe
  2⤵
  PID:6336
- C:\Windows\System\umeEazd.exe
  C:\Windows\System\umeEazd.exe
  2⤵
  PID:6168
- C:\Windows\System\NOFEvpH.exe
  C:\Windows\System\NOFEvpH.exe
  2⤵
  PID:6432
- C:\Windows\System\jcrMMXA.exe
  C:\Windows\System\jcrMMXA.exe
  2⤵
  PID:6448
- C:\Windows\System\IfDlINg.exe
  C:\Windows\System\IfDlINg.exe
  2⤵
  PID:6516
- C:\Windows\System\NHbbRuU.exe
  C:\Windows\System\NHbbRuU.exe
  2⤵
  PID:6588
- C:\Windows\System\NAhMZOd.exe
  C:\Windows\System\NAhMZOd.exe
  2⤵
  PID:6652
- C:\Windows\System\DsudXwb.exe
  C:\Windows\System\DsudXwb.exe
  2⤵
  PID:6696
- C:\Windows\System\OkxMHEJ.exe
  C:\Windows\System\OkxMHEJ.exe
  2⤵
  PID:6740
- C:\Windows\System\xrPihfm.exe
  C:\Windows\System\xrPihfm.exe
  2⤵
  PID:6808
- C:\Windows\System\tnngxbJ.exe
  C:\Windows\System\tnngxbJ.exe
  2⤵
  PID:6464
- C:\Windows\System\kaSllcr.exe
  C:\Windows\System\kaSllcr.exe
  2⤵
  PID:6528
- C:\Windows\System\UfeDcDf.exe
  C:\Windows\System\UfeDcDf.exe
  2⤵
  PID:6604
- C:\Windows\System\awkSgOV.exe
  C:\Windows\System\awkSgOV.exe
  2⤵
  PID:6872
- C:\Windows\System\mmHYqqt.exe
  C:\Windows\System\mmHYqqt.exe
  2⤵
  PID:6712
- C:\Windows\System\ARzwDds.exe
  C:\Windows\System\ARzwDds.exe
  2⤵
  PID:6756
- C:\Windows\System\ohHXOzt.exe
  C:\Windows\System\ohHXOzt.exe
  2⤵
  PID:6820
- C:\Windows\System\IHCthCO.exe
  C:\Windows\System\IHCthCO.exe
  2⤵
  PID:6888
- C:\Windows\System\XKeMqRS.exe
  C:\Windows\System\XKeMqRS.exe
  2⤵
  PID:6940
- C:\Windows\System\YYhUXhs.exe
  C:\Windows\System\YYhUXhs.exe
  2⤵
  PID:6924
- C:\Windows\System\gFUGnhB.exe
  C:\Windows\System\gFUGnhB.exe
  2⤵
  PID:6984
- C:\Windows\System\UhoEZLN.exe
  C:\Windows\System\UhoEZLN.exe
  2⤵
  PID:7036
- C:\Windows\System\rKvvBAf.exe
  C:\Windows\System\rKvvBAf.exe
  2⤵
  PID:7020
- C:\Windows\System\EDSZJAd.exe
  C:\Windows\System\EDSZJAd.exe
  2⤵
  PID:7052
- C:\Windows\System\jpQMWEh.exe
  C:\Windows\System\jpQMWEh.exe
  2⤵
  PID:7164
- C:\Windows\System\JpkopGX.exe
  C:\Windows\System\JpkopGX.exe
  2⤵
  PID:5604
- C:\Windows\System\dhPIQmt.exe
  C:\Windows\System\dhPIQmt.exe
  2⤵
  PID:6252
- C:\Windows\System\vCYQEsJ.exe
  C:\Windows\System\vCYQEsJ.exe
  2⤵
  PID:5680
- C:\Windows\System\RaUTmKl.exe
  C:\Windows\System\RaUTmKl.exe
  2⤵
  PID:5224
- C:\Windows\System\JpmstjR.exe
  C:\Windows\System\JpmstjR.exe
  2⤵
  PID:5968
- C:\Windows\System\urezgvw.exe
  C:\Windows\System\urezgvw.exe
  2⤵
  PID:6428
- C:\Windows\System\hOZGHXn.exe
  C:\Windows\System\hOZGHXn.exe
  2⤵
  PID:7084
- C:\Windows\System\vhPJZnG.exe
  C:\Windows\System\vhPJZnG.exe
  2⤵
  PID:6552
- C:\Windows\System\FfwiGbk.exe
  C:\Windows\System\FfwiGbk.exe
  2⤵
  PID:6772
- C:\Windows\System\CXpwENG.exe
  C:\Windows\System\CXpwENG.exe
  2⤵
  PID:6636
- C:\Windows\System\nURBRCx.exe
  C:\Windows\System\nURBRCx.exe
  2⤵
  PID:6852
- C:\Windows\System\UEDeTRb.exe
  C:\Windows\System\UEDeTRb.exe
  2⤵
  PID:6564
- C:\Windows\System\oqOhilR.exe
  C:\Windows\System\oqOhilR.exe
  2⤵
  PID:6180
- C:\Windows\System\KMEjoOl.exe
  C:\Windows\System\KMEjoOl.exe
  2⤵
  PID:6280
- C:\Windows\System\cUInprJ.exe
  C:\Windows\System\cUInprJ.exe
  2⤵
  PID:6028
- C:\Windows\System\jDFsfSx.exe
  C:\Windows\System\jDFsfSx.exe
  2⤵
  PID:6876
- C:\Windows\System\JzNRQdd.exe
  C:\Windows\System\JzNRQdd.exe
  2⤵
  PID:5612
- C:\Windows\System\FXMZfbc.exe
  C:\Windows\System\FXMZfbc.exe
  2⤵
  PID:5364
- C:\Windows\System\xEsReEw.exe
  C:\Windows\System\xEsReEw.exe
  2⤵
  PID:6320
- C:\Windows\System\JPOLbnd.exe
  C:\Windows\System\JPOLbnd.exe
  2⤵
  PID:5984
- C:\Windows\System\RiNlVWd.exe
  C:\Windows\System\RiNlVWd.exe
  2⤵
  PID:7148
- C:\Windows\System\LQlSjRh.exe
  C:\Windows\System\LQlSjRh.exe
  2⤵
  PID:6400
- C:\Windows\System\YKipFRa.exe
  C:\Windows\System\YKipFRa.exe
  2⤵
  PID:6484
- C:\Windows\System\XWazXNQ.exe
  C:\Windows\System\XWazXNQ.exe
  2⤵
  PID:6624
- C:\Windows\System\sKmDKwE.exe
  C:\Windows\System\sKmDKwE.exe
  2⤵
  PID:6920
- C:\Windows\System\CXgxrKg.exe
  C:\Windows\System\CXgxrKg.exe
  2⤵
  PID:6956
- C:\Windows\System\eEnGfZq.exe
  C:\Windows\System\eEnGfZq.exe
  2⤵
  PID:5876
- C:\Windows\System\Xsletwa.exe
  C:\Windows\System\Xsletwa.exe
  2⤵
  PID:6284
- C:\Windows\System\uSginMP.exe
  C:\Windows\System\uSginMP.exe
  2⤵
  PID:6352
- C:\Windows\System\wPAqiph.exe
  C:\Windows\System\wPAqiph.exe
  2⤵
  PID:1536
- C:\Windows\System\UmCZjbq.exe
  C:\Windows\System\UmCZjbq.exe
  2⤵
  PID:6304
- C:\Windows\System\JPjrFmR.exe
  C:\Windows\System\JPjrFmR.exe
  2⤵
  PID:6720
- C:\Windows\System\ZbfvzkL.exe
  C:\Windows\System\ZbfvzkL.exe
  2⤵
  PID:5556
- C:\Windows\System\EUYSjSB.exe
  C:\Windows\System\EUYSjSB.exe
  2⤵
  PID:6936
- C:\Windows\System\IDGLuEz.exe
  C:\Windows\System\IDGLuEz.exe
  2⤵
  PID:5328
- C:\Windows\System\YDNTIkZ.exe
  C:\Windows\System\YDNTIkZ.exe
  2⤵
  PID:6536
- C:\Windows\System\jdoKyOP.exe
  C:\Windows\System\jdoKyOP.exe
  2⤵
  PID:5160
- C:\Windows\System\quvUfqC.exe
  C:\Windows\System\quvUfqC.exe
  2⤵
  PID:908
- C:\Windows\System\zECSwtv.exe
  C:\Windows\System\zECSwtv.exe
  2⤵
  PID:6460
- C:\Windows\System\FZLNMqb.exe
  C:\Windows\System\FZLNMqb.exe
  2⤵
  PID:6004
- C:\Windows\System\wlTdkJm.exe
  C:\Windows\System\wlTdkJm.exe
  2⤵
  PID:6620
- C:\Windows\System\uKwCYNJ.exe
  C:\Windows\System\uKwCYNJ.exe
  2⤵
  PID:7160
- C:\Windows\System\aXOqELP.exe
  C:\Windows\System\aXOqELP.exe
  2⤵
  PID:5696
- C:\Windows\System\NKuYgIX.exe
  C:\Windows\System\NKuYgIX.exe
  2⤵
  PID:6572
- C:\Windows\System\WgZPiAi.exe
  C:\Windows\System\WgZPiAi.exe
  2⤵
  PID:6688
- C:\Windows\System\eVGlCUR.exe
  C:\Windows\System\eVGlCUR.exe
  2⤵
  PID:5152
- C:\Windows\System\YOtTGmH.exe
  C:\Windows\System\YOtTGmH.exe
  2⤵
  PID:6324
- C:\Windows\System\qJEviFJ.exe
  C:\Windows\System\qJEviFJ.exe
  2⤵
  PID:7112
- C:\Windows\System\vYrJerr.exe
  C:\Windows\System\vYrJerr.exe
  2⤵
  PID:5860
- C:\Windows\System\WoBfiWi.exe
  C:\Windows\System\WoBfiWi.exe
  2⤵
  PID:7048
- C:\Windows\System\fAbwMfn.exe
  C:\Windows\System\fAbwMfn.exe
  2⤵
  PID:6268
- C:\Windows\System\zCDGMEP.exe
  C:\Windows\System\zCDGMEP.exe
  2⤵
  PID:6908
- C:\Windows\System\caDmxsZ.exe
  C:\Windows\System\caDmxsZ.exe
  2⤵
  PID:7144
- C:\Windows\System\dFzwnPQ.exe
  C:\Windows\System\dFzwnPQ.exe
  2⤵
  PID:6840
- C:\Windows\System\CXAyMRa.exe
  C:\Windows\System\CXAyMRa.exe
  2⤵
  PID:7180
- C:\Windows\System\YmsYEGX.exe
  C:\Windows\System\YmsYEGX.exe
  2⤵
  PID:7196
- C:\Windows\System\wHjcqnr.exe
  C:\Windows\System\wHjcqnr.exe
  2⤵
  PID:7212
- C:\Windows\System\BXXHxgj.exe
  C:\Windows\System\BXXHxgj.exe
  2⤵
  PID:7228
- C:\Windows\System\PuuMENG.exe
  C:\Windows\System\PuuMENG.exe
  2⤵
  PID:7244
- C:\Windows\System\vakDqNQ.exe
  C:\Windows\System\vakDqNQ.exe
  2⤵
  PID:7260
- C:\Windows\System\JOeufZo.exe
  C:\Windows\System\JOeufZo.exe
  2⤵
  PID:7276
- C:\Windows\System\GhDzYrS.exe
  C:\Windows\System\GhDzYrS.exe
  2⤵
  PID:7292
- C:\Windows\System\HOMoCVM.exe
  C:\Windows\System\HOMoCVM.exe
  2⤵
  PID:7308
- C:\Windows\System\aenDwLW.exe
  C:\Windows\System\aenDwLW.exe
  2⤵
  PID:7324
- C:\Windows\System\WgsqBQV.exe
  C:\Windows\System\WgsqBQV.exe
  2⤵
  PID:7340
- C:\Windows\System\KOifGHd.exe
  C:\Windows\System\KOifGHd.exe
  2⤵
  PID:7356
- C:\Windows\System\WktDrLS.exe
  C:\Windows\System\WktDrLS.exe
  2⤵
  PID:7372
- C:\Windows\System\cRhrPVb.exe
  C:\Windows\System\cRhrPVb.exe
  2⤵
  PID:7388
- C:\Windows\System\TBGLiyL.exe
  C:\Windows\System\TBGLiyL.exe
  2⤵
  PID:7404
- C:\Windows\System\OPkuukN.exe
  C:\Windows\System\OPkuukN.exe
  2⤵
  PID:7420
- C:\Windows\System\XIwVREz.exe
  C:\Windows\System\XIwVREz.exe
  2⤵
  PID:7436
- C:\Windows\System\rsJUvqF.exe
  C:\Windows\System\rsJUvqF.exe
  2⤵
  PID:7452
- C:\Windows\System\ETRJDKL.exe
  C:\Windows\System\ETRJDKL.exe
  2⤵
  PID:7468
- C:\Windows\System\vPOdPFQ.exe
  C:\Windows\System\vPOdPFQ.exe
  2⤵
  PID:7484
- C:\Windows\System\JVmKipH.exe
  C:\Windows\System\JVmKipH.exe
  2⤵
  PID:7500
- C:\Windows\System\FhlQXrO.exe
  C:\Windows\System\FhlQXrO.exe
  2⤵
  PID:7516
- C:\Windows\System\eWbmKJo.exe
  C:\Windows\System\eWbmKJo.exe
  2⤵
  PID:7532
- C:\Windows\System\lZNYzFO.exe
  C:\Windows\System\lZNYzFO.exe
  2⤵
  PID:7548
- C:\Windows\System\OhuwytZ.exe
  C:\Windows\System\OhuwytZ.exe
  2⤵
  PID:7564
- C:\Windows\System\WTqxWao.exe
  C:\Windows\System\WTqxWao.exe
  2⤵
  PID:7580
- C:\Windows\System\LicjaVJ.exe
  C:\Windows\System\LicjaVJ.exe
  2⤵
  PID:7596
- C:\Windows\System\IqjiqoQ.exe
  C:\Windows\System\IqjiqoQ.exe
  2⤵
  PID:7612
- C:\Windows\System\lOIUXkV.exe
  C:\Windows\System\lOIUXkV.exe
  2⤵
  PID:7628
- C:\Windows\System\XEHEyRb.exe
  C:\Windows\System\XEHEyRb.exe
  2⤵
  PID:7644
- C:\Windows\System\uvhYhnn.exe
  C:\Windows\System\uvhYhnn.exe
  2⤵
  PID:7660
- C:\Windows\System\GoXdNWa.exe
  C:\Windows\System\GoXdNWa.exe
  2⤵
  PID:7676
- C:\Windows\System\sBhpNrS.exe
  C:\Windows\System\sBhpNrS.exe
  2⤵
  PID:7692
- C:\Windows\System\NrfyHZH.exe
  C:\Windows\System\NrfyHZH.exe
  2⤵
  PID:7708
- C:\Windows\System\OjPDawb.exe
  C:\Windows\System\OjPDawb.exe
  2⤵
  PID:7724
- C:\Windows\System\wvrrblE.exe
  C:\Windows\System\wvrrblE.exe
  2⤵
  PID:7740
- C:\Windows\System\IsKcVou.exe
  C:\Windows\System\IsKcVou.exe
  2⤵
  PID:7756
- C:\Windows\System\MUsLFwZ.exe
  C:\Windows\System\MUsLFwZ.exe
  2⤵
  PID:7772
- C:\Windows\System\ksuAPHY.exe
  C:\Windows\System\ksuAPHY.exe
  2⤵
  PID:7788
- C:\Windows\System\RWAavSe.exe
  C:\Windows\System\RWAavSe.exe
  2⤵
  PID:7804
- C:\Windows\System\rUePGEY.exe
  C:\Windows\System\rUePGEY.exe
  2⤵
  PID:7820
- C:\Windows\System\DOcALkc.exe
  C:\Windows\System\DOcALkc.exe
  2⤵
  PID:7836
- C:\Windows\System\vxfABSc.exe
  C:\Windows\System\vxfABSc.exe
  2⤵
  PID:7852
- C:\Windows\System\cqwfQBq.exe
  C:\Windows\System\cqwfQBq.exe
  2⤵
  PID:7868
- C:\Windows\System\kKjDrUW.exe
  C:\Windows\System\kKjDrUW.exe
  2⤵
  PID:7912
- C:\Windows\System\NzEcwZA.exe
  C:\Windows\System\NzEcwZA.exe
  2⤵
  PID:7936
- C:\Windows\System\tUmrsbo.exe
  C:\Windows\System\tUmrsbo.exe
  2⤵
  PID:7952
- C:\Windows\System\KAieFCa.exe
  C:\Windows\System\KAieFCa.exe
  2⤵
  PID:7988
- C:\Windows\System\vjquGdJ.exe
  C:\Windows\System\vjquGdJ.exe
  2⤵
  PID:8004
- C:\Windows\System\uARIUuj.exe
  C:\Windows\System\uARIUuj.exe
  2⤵
  PID:8020
- C:\Windows\System\uCKNFjS.exe
  C:\Windows\System\uCKNFjS.exe
  2⤵
  PID:8036
- C:\Windows\System\SEbXwhT.exe
  C:\Windows\System\SEbXwhT.exe
  2⤵
  PID:8052
- C:\Windows\System\PTFhZlj.exe
  C:\Windows\System\PTFhZlj.exe
  2⤵
  PID:8068
- C:\Windows\System\reDhCPp.exe
  C:\Windows\System\reDhCPp.exe
  2⤵
  PID:8084
- C:\Windows\System\ysBwpgu.exe
  C:\Windows\System\ysBwpgu.exe
  2⤵
  PID:8100
- C:\Windows\System\ixLLblj.exe
  C:\Windows\System\ixLLblj.exe
  2⤵
  PID:8116
- C:\Windows\System\juCwsEb.exe
  C:\Windows\System\juCwsEb.exe
  2⤵
  PID:8132
- C:\Windows\System\YDnDtcC.exe
  C:\Windows\System\YDnDtcC.exe
  2⤵
  PID:8148
- C:\Windows\System\KWtDZvH.exe
  C:\Windows\System\KWtDZvH.exe
  2⤵
  PID:8164
- C:\Windows\System\EIsORBg.exe
  C:\Windows\System\EIsORBg.exe
  2⤵
  PID:8180
- C:\Windows\System\lOXTjFV.exe
  C:\Windows\System\lOXTjFV.exe
  2⤵
  PID:7176
- C:\Windows\System\qwdhPgX.exe
  C:\Windows\System\qwdhPgX.exe
  2⤵
  PID:7236
- C:\Windows\System\UhBvWsX.exe
  C:\Windows\System\UhBvWsX.exe
  2⤵
  PID:5452
- C:\Windows\System\vrDGlis.exe
  C:\Windows\System\vrDGlis.exe
  2⤵
  PID:7224
- C:\Windows\System\wQYIsFt.exe
  C:\Windows\System\wQYIsFt.exe
  2⤵
  PID:7272
- C:\Windows\System\cEJLKvO.exe
  C:\Windows\System\cEJLKvO.exe
  2⤵
  PID:7332
- C:\Windows\System\sSsmFVT.exe
  C:\Windows\System\sSsmFVT.exe
  2⤵
  PID:7368
- C:\Windows\System\bilcKQf.exe
  C:\Windows\System\bilcKQf.exe
  2⤵
  PID:7432
- C:\Windows\System\NPXKmDM.exe
  C:\Windows\System\NPXKmDM.exe
  2⤵
  PID:7496
- C:\Windows\System\URVXoNc.exe
  C:\Windows\System\URVXoNc.exe
  2⤵
  PID:7256
- C:\Windows\System\dboohti.exe
  C:\Windows\System\dboohti.exe
  2⤵
  PID:7592
- C:\Windows\System\ENvQgBH.exe
  C:\Windows\System\ENvQgBH.exe
  2⤵
  PID:7652
- C:\Windows\System\TqPmKGa.exe
  C:\Windows\System\TqPmKGa.exe
  2⤵
  PID:7716
- C:\Windows\System\vvGDeFj.exe
  C:\Windows\System\vvGDeFj.exe
  2⤵
  PID:7384
- C:\Windows\System\IlzOphO.exe
  C:\Windows\System\IlzOphO.exe
  2⤵
  PID:7284
- C:\Windows\System\IJfxVsw.exe
  C:\Windows\System\IJfxVsw.exe
  2⤵
  PID:7444
- C:\Windows\System\kzqMbnW.exe
  C:\Windows\System\kzqMbnW.exe
  2⤵
  PID:7780
- C:\Windows\System\giRhCYd.exe
  C:\Windows\System\giRhCYd.exe
  2⤵
  PID:7784
- C:\Windows\System\oymWpOD.exe
  C:\Windows\System\oymWpOD.exe
  2⤵
  PID:7572
- C:\Windows\System\NrmOJcU.exe
  C:\Windows\System\NrmOJcU.exe
  2⤵
  PID:7636
- C:\Windows\System\FsATGCz.exe
  C:\Windows\System\FsATGCz.exe
  2⤵
  PID:7736
- C:\Windows\System\qvnUOae.exe
  C:\Windows\System\qvnUOae.exe
  2⤵
  PID:7812
- C:\Windows\System\htoHTSN.exe
  C:\Windows\System\htoHTSN.exe
  2⤵
  PID:7848
- C:\Windows\System\EEhKxmF.exe
  C:\Windows\System\EEhKxmF.exe
  2⤵
  PID:7860
- C:\Windows\System\GnHjuKm.exe
  C:\Windows\System\GnHjuKm.exe
  2⤵
  PID:7920
- C:\Windows\System\OFxtHmI.exe
  C:\Windows\System\OFxtHmI.exe
  2⤵
  PID:7896
- C:\Windows\System\AKgTHiF.exe
  C:\Windows\System\AKgTHiF.exe
  2⤵
  PID:7924
- C:\Windows\System\uJRePnY.exe
  C:\Windows\System\uJRePnY.exe
  2⤵
  PID:7944
- C:\Windows\System\lYyphro.exe
  C:\Windows\System\lYyphro.exe
  2⤵
  PID:7968
- C:\Windows\System\EGvoKsE.exe
  C:\Windows\System\EGvoKsE.exe
  2⤵
  PID:8028
- C:\Windows\System\DEVNbiR.exe
  C:\Windows\System\DEVNbiR.exe
  2⤵
  PID:8016
- C:\Windows\System\UbXelBH.exe
  C:\Windows\System\UbXelBH.exe
  2⤵
  PID:8096
- C:\Windows\System\FAsoZWr.exe
  C:\Windows\System\FAsoZWr.exe
  2⤵
  PID:8160
- C:\Windows\System\tyCJcQI.exe
  C:\Windows\System\tyCJcQI.exe
  2⤵
  PID:7172
- C:\Windows\System\SrxIjmM.exe
  C:\Windows\System\SrxIjmM.exe
  2⤵
  PID:8108
- C:\Windows\System\PxBOPgW.exe
  C:\Windows\System\PxBOPgW.exe
  2⤵
  PID:5648
- C:\Windows\System\JnhIMdW.exe
  C:\Windows\System\JnhIMdW.exe
  2⤵
  PID:7016
- C:\Windows\System\ORPxgLn.exe
  C:\Windows\System\ORPxgLn.exe
  2⤵
  PID:7336
- C:\Windows\System\ZzarIfl.exe
  C:\Windows\System\ZzarIfl.exe
  2⤵
  PID:7300
- C:\Windows\System\OwVFuUM.exe
  C:\Windows\System\OwVFuUM.exe
  2⤵
  PID:7588
- C:\Windows\System\JgUQLGI.exe
  C:\Windows\System\JgUQLGI.exe
  2⤵
  PID:7620
- C:\Windows\System\UeQfMEU.exe
  C:\Windows\System\UeQfMEU.exe
  2⤵
  PID:7380
- C:\Windows\System\tdIrkgm.exe
  C:\Windows\System\tdIrkgm.exe
  2⤵
  PID:7352
- C:\Windows\System\ICkMhdM.exe
  C:\Windows\System\ICkMhdM.exe
  2⤵
  PID:7476
- C:\Windows\System\XoUJuhu.exe
  C:\Windows\System\XoUJuhu.exe
  2⤵
  PID:7704
- C:\Windows\System\TRpLhdJ.exe
  C:\Windows\System\TRpLhdJ.exe
  2⤵
  PID:7608
- C:\Windows\System\CBQExrV.exe
  C:\Windows\System\CBQExrV.exe
  2⤵
  PID:7876
- C:\Windows\System\ADNnTML.exe
  C:\Windows\System\ADNnTML.exe
  2⤵
  PID:7816
- C:\Windows\System\HxkpdmG.exe
  C:\Windows\System\HxkpdmG.exe
  2⤵
  PID:8060
- C:\Windows\System\LBIMeiU.exe
  C:\Windows\System\LBIMeiU.exe
  2⤵
  PID:7892
- C:\Windows\System\lyEdHjC.exe
  C:\Windows\System\lyEdHjC.exe
  2⤵
  PID:7964
- C:\Windows\System\oHyEAJA.exe
  C:\Windows\System\oHyEAJA.exe
  2⤵
  PID:8064
- C:\Windows\System\jAvSthy.exe
  C:\Windows\System\jAvSthy.exe
  2⤵
  PID:8080
- C:\Windows\System\jPmFdXI.exe
  C:\Windows\System\jPmFdXI.exe
  2⤵
  PID:7204
- C:\Windows\System\NNiVwYf.exe
  C:\Windows\System\NNiVwYf.exe
  2⤵
  PID:7268
- C:\Windows\System\YlRSnWU.exe
  C:\Windows\System\YlRSnWU.exe
  2⤵
  PID:7412
- C:\Windows\System\zKHZOhF.exe
  C:\Windows\System\zKHZOhF.exe
  2⤵
  PID:7844
- C:\Windows\System\spyWiKL.exe
  C:\Windows\System\spyWiKL.exe
  2⤵
  PID:7960
- C:\Windows\System\cQuGsfU.exe
  C:\Windows\System\cQuGsfU.exe
  2⤵
  PID:7464
- C:\Windows\System\tqghJji.exe
  C:\Windows\System\tqghJji.exe
  2⤵
  PID:8076
- C:\Windows\System\yYZIMrO.exe
  C:\Windows\System\yYZIMrO.exe
  2⤵
  PID:7688
- C:\Windows\System\ZgVghFt.exe
  C:\Windows\System\ZgVghFt.exe
  2⤵
  PID:7604
- C:\Windows\System\eHwUIEL.exe
  C:\Windows\System\eHwUIEL.exe
  2⤵
  PID:7828
- C:\Windows\System\uSlHzZU.exe
  C:\Windows\System\uSlHzZU.exe
  2⤵
  PID:7984
- C:\Windows\System\xwPPLIA.exe
  C:\Windows\System\xwPPLIA.exe
  2⤵
  PID:8176
- C:\Windows\System\WrUDoSa.exe
  C:\Windows\System\WrUDoSa.exe
  2⤵
  PID:7904
- C:\Windows\System\vvuykOG.exe
  C:\Windows\System\vvuykOG.exe
  2⤵
  PID:7624
- C:\Windows\System\kRSVbIT.exe
  C:\Windows\System\kRSVbIT.exe
  2⤵
  PID:8204
- C:\Windows\System\HTFNqtm.exe
  C:\Windows\System\HTFNqtm.exe
  2⤵
  PID:8220
- C:\Windows\System\KuNzhWH.exe
  C:\Windows\System\KuNzhWH.exe
  2⤵
  PID:8236
- C:\Windows\System\xSEDHXz.exe
  C:\Windows\System\xSEDHXz.exe
  2⤵
  PID:8252
- C:\Windows\System\ZvlprzX.exe
  C:\Windows\System\ZvlprzX.exe
  2⤵
  PID:8268
- C:\Windows\System\uVDwUUx.exe
  C:\Windows\System\uVDwUUx.exe
  2⤵
  PID:8284
- C:\Windows\System\VGMiMhD.exe
  C:\Windows\System\VGMiMhD.exe
  2⤵
  PID:8300
- C:\Windows\System\TVlvQvV.exe
  C:\Windows\System\TVlvQvV.exe
  2⤵
  PID:8316
- C:\Windows\System\AFDiQRC.exe
  C:\Windows\System\AFDiQRC.exe
  2⤵
  PID:8332
- C:\Windows\System\jpknUro.exe
  C:\Windows\System\jpknUro.exe
  2⤵
  PID:8348
- C:\Windows\System\bEtkBwL.exe
  C:\Windows\System\bEtkBwL.exe
  2⤵
  PID:8364
- C:\Windows\System\XsDmrnz.exe
  C:\Windows\System\XsDmrnz.exe
  2⤵
  PID:8380
- C:\Windows\System\HjlDENL.exe
  C:\Windows\System\HjlDENL.exe
  2⤵
  PID:8396
- C:\Windows\System\UuGOPmq.exe
  C:\Windows\System\UuGOPmq.exe
  2⤵
  PID:8412
- C:\Windows\System\gBCHUzq.exe
  C:\Windows\System\gBCHUzq.exe
  2⤵
  PID:8428
- C:\Windows\System\UqRzsxV.exe
  C:\Windows\System\UqRzsxV.exe
  2⤵
  PID:8444
- C:\Windows\System\uIXDQqB.exe
  C:\Windows\System\uIXDQqB.exe
  2⤵
  PID:8460
- C:\Windows\System\snuvloz.exe
  C:\Windows\System\snuvloz.exe
  2⤵
  PID:8476
- C:\Windows\System\cmgldtd.exe
  C:\Windows\System\cmgldtd.exe
  2⤵
  PID:8492
- C:\Windows\System\KlBYyaX.exe
  C:\Windows\System\KlBYyaX.exe
  2⤵
  PID:8508
- C:\Windows\System\eHRVFqK.exe
  C:\Windows\System\eHRVFqK.exe
  2⤵
  PID:8524
- C:\Windows\System\ZxXukxH.exe
  C:\Windows\System\ZxXukxH.exe
  2⤵
  PID:8540
- C:\Windows\System\xHqJQti.exe
  C:\Windows\System\xHqJQti.exe
  2⤵
  PID:8556
- C:\Windows\System\faUWYus.exe
  C:\Windows\System\faUWYus.exe
  2⤵
  PID:8572
- C:\Windows\System\Cealnqp.exe
  C:\Windows\System\Cealnqp.exe
  2⤵
  PID:8588
- C:\Windows\System\haHBquP.exe
  C:\Windows\System\haHBquP.exe
  2⤵
  PID:8604
- C:\Windows\System\UdDbiMG.exe
  C:\Windows\System\UdDbiMG.exe
  2⤵
  PID:8620
- C:\Windows\System\HHPBfOV.exe
  C:\Windows\System\HHPBfOV.exe
  2⤵
  PID:8636
- C:\Windows\System\JGlFazJ.exe
  C:\Windows\System\JGlFazJ.exe
  2⤵
  PID:8652
- C:\Windows\System\mmTdDas.exe
  C:\Windows\System\mmTdDas.exe
  2⤵
  PID:8668
- C:\Windows\System\jnLowkx.exe
  C:\Windows\System\jnLowkx.exe
  2⤵
  PID:8684
- C:\Windows\System\UMsdBXG.exe
  C:\Windows\System\UMsdBXG.exe
  2⤵
  PID:8700
- C:\Windows\System\rBOjldj.exe
  C:\Windows\System\rBOjldj.exe
  2⤵
  PID:8716
- C:\Windows\System\yPvbGvN.exe
  C:\Windows\System\yPvbGvN.exe
  2⤵
  PID:8732
- C:\Windows\System\JkbZOXZ.exe
  C:\Windows\System\JkbZOXZ.exe
  2⤵
  PID:8748
- C:\Windows\System\MRGGZHj.exe
  C:\Windows\System\MRGGZHj.exe
  2⤵
  PID:8764
- C:\Windows\System\tQjFYQU.exe
  C:\Windows\System\tQjFYQU.exe
  2⤵
  PID:8780
- C:\Windows\System\lHbFZRX.exe
  C:\Windows\System\lHbFZRX.exe
  2⤵
  PID:8796
- C:\Windows\System\aiaCxHb.exe
  C:\Windows\System\aiaCxHb.exe
  2⤵
  PID:8816
- C:\Windows\System\BuNDRjS.exe
  C:\Windows\System\BuNDRjS.exe
  2⤵
  PID:8832
- C:\Windows\System\xOHbkiv.exe
  C:\Windows\System\xOHbkiv.exe
  2⤵
  PID:8848
- C:\Windows\System\ISgGCKE.exe
  C:\Windows\System\ISgGCKE.exe
  2⤵
  PID:8864
- C:\Windows\System\WdxvwTH.exe
  C:\Windows\System\WdxvwTH.exe
  2⤵
  PID:8880
- C:\Windows\System\JbLYdNO.exe
  C:\Windows\System\JbLYdNO.exe
  2⤵
  PID:8896
- C:\Windows\System\wBFplTT.exe
  C:\Windows\System\wBFplTT.exe
  2⤵
  PID:8912
- C:\Windows\System\UIJToGf.exe
  C:\Windows\System\UIJToGf.exe
  2⤵
  PID:8928
- C:\Windows\System\SuODzLH.exe
  C:\Windows\System\SuODzLH.exe
  2⤵
  PID:8944
- C:\Windows\System\UlisSEH.exe
  C:\Windows\System\UlisSEH.exe
  2⤵
  PID:8960
- C:\Windows\System\gFZsYyr.exe
  C:\Windows\System\gFZsYyr.exe
  2⤵
  PID:8976
- C:\Windows\System\pEmIwhw.exe
  C:\Windows\System\pEmIwhw.exe
  2⤵
  PID:8992
- C:\Windows\System\WqLzXXE.exe
  C:\Windows\System\WqLzXXE.exe
  2⤵
  PID:9008
- C:\Windows\System\gezDayO.exe
  C:\Windows\System\gezDayO.exe
  2⤵
  PID:9024
- C:\Windows\System\ODISQeN.exe
  C:\Windows\System\ODISQeN.exe
  2⤵
  PID:9040
- C:\Windows\System\JONmQbE.exe
  C:\Windows\System\JONmQbE.exe
  2⤵
  PID:9056
- C:\Windows\System\jCCyZAp.exe
  C:\Windows\System\jCCyZAp.exe
  2⤵
  PID:9072
- C:\Windows\System\JJKSjEU.exe
  C:\Windows\System\JJKSjEU.exe
  2⤵
  PID:9088
- C:\Windows\System\OfwRwwr.exe
  C:\Windows\System\OfwRwwr.exe
  2⤵
  PID:9104
- C:\Windows\System\xBhQbdM.exe
  C:\Windows\System\xBhQbdM.exe
  2⤵
  PID:9128
- C:\Windows\System\ZhAqhQK.exe
  C:\Windows\System\ZhAqhQK.exe
  2⤵
  PID:9144
- C:\Windows\System\madkVVP.exe
  C:\Windows\System\madkVVP.exe
  2⤵
  PID:9160
- C:\Windows\System\BafwTYN.exe
  C:\Windows\System\BafwTYN.exe
  2⤵
  PID:9180
- C:\Windows\System\wGqBwpV.exe
  C:\Windows\System\wGqBwpV.exe
  2⤵
  PID:9196
- C:\Windows\System\XttUMPp.exe
  C:\Windows\System\XttUMPp.exe
  2⤵
  PID:9212
- C:\Windows\System\FGniKfP.exe
  C:\Windows\System\FGniKfP.exe
  2⤵
  PID:8248
- C:\Windows\System\UIFkOXv.exe
  C:\Windows\System\UIFkOXv.exe
  2⤵
  PID:6692
- C:\Windows\System\mAfFEdj.exe
  C:\Windows\System\mAfFEdj.exe
  2⤵
  PID:8372
- C:\Windows\System\XNZsBPm.exe
  C:\Windows\System\XNZsBPm.exe
  2⤵
  PID:7320
- C:\Windows\System\jtpXHlX.exe
  C:\Windows\System\jtpXHlX.exe
  2⤵
  PID:8128
- C:\Windows\System\cqvRqbT.exe
  C:\Windows\System\cqvRqbT.exe
  2⤵
  PID:8500
- C:\Windows\System\hnHPXSD.exe
  C:\Windows\System\hnHPXSD.exe
  2⤵
  PID:8536
- C:\Windows\System\rKNhHYp.exe
  C:\Windows\System\rKNhHYp.exe
  2⤵
  PID:8564
- C:\Windows\System\XaeAAQi.exe
  C:\Windows\System\XaeAAQi.exe
  2⤵
  PID:8200
- C:\Windows\System\DkeJpPm.exe
  C:\Windows\System\DkeJpPm.exe
  2⤵
  PID:8296
- C:\Windows\System\YaOYlsF.exe
  C:\Windows\System\YaOYlsF.exe
  2⤵
  PID:8548
- C:\Windows\System\BevLkaE.exe
  C:\Windows\System\BevLkaE.exe
  2⤵
  PID:8360
- C:\Windows\System\GKQdLRH.exe
  C:\Windows\System\GKQdLRH.exe
  2⤵
  PID:8580
- C:\Windows\System\ueZTRWR.exe
  C:\Windows\System\ueZTRWR.exe
  2⤵
  PID:8600
- C:\Windows\System\LVzlAvR.exe
  C:\Windows\System\LVzlAvR.exe
  2⤵
  PID:8632
- C:\Windows\System\hWgMoaj.exe
  C:\Windows\System\hWgMoaj.exe
  2⤵
  PID:8660
- C:\Windows\System\iHRBXWA.exe
  C:\Windows\System\iHRBXWA.exe
  2⤵
  PID:8676
- C:\Windows\System\mkoNkaD.exe
  C:\Windows\System\mkoNkaD.exe
  2⤵
  PID:8728
- C:\Windows\System\ArWzrSW.exe
  C:\Windows\System\ArWzrSW.exe
  2⤵
  PID:8760
- C:\Windows\System\NZxbBup.exe
  C:\Windows\System\NZxbBup.exe
  2⤵
  PID:7492
- C:\Windows\System\Igskbmt.exe
  C:\Windows\System\Igskbmt.exe
  2⤵
  PID:8804
- C:\Windows\System\AhjIXzX.exe
  C:\Windows\System\AhjIXzX.exe
  2⤵
  PID:8856
- C:\Windows\System\HbvaKOt.exe
  C:\Windows\System\HbvaKOt.exe
  2⤵
  PID:8920
- C:\Windows\System\kShYFIP.exe
  C:\Windows\System\kShYFIP.exe
  2⤵
  PID:8988
- C:\Windows\System\SDweCYw.exe
  C:\Windows\System\SDweCYw.exe
  2⤵
  PID:9052
- C:\Windows\System\RbaqYUO.exe
  C:\Windows\System\RbaqYUO.exe
  2⤵
  PID:8876
- C:\Windows\System\pFWorwZ.exe
  C:\Windows\System\pFWorwZ.exe
  2⤵
  PID:9084
- C:\Windows\System\jNfwHud.exe
  C:\Windows\System\jNfwHud.exe
  2⤵
  PID:8940
- C:\Windows\System\bhjxtzY.exe
  C:\Windows\System\bhjxtzY.exe
  2⤵
  PID:9068
- C:\Windows\System\qDYwiAP.exe
  C:\Windows\System\qDYwiAP.exe
  2⤵
  PID:9000
- C:\Windows\System\vwSPWJB.exe
  C:\Windows\System\vwSPWJB.exe
  2⤵
  PID:9064
- C:\Windows\System\PWVmjLe.exe
  C:\Windows\System\PWVmjLe.exe
  2⤵
  PID:9176
- C:\Windows\System\dRHHEmp.exe
  C:\Windows\System\dRHHEmp.exe
  2⤵
  PID:9192
- C:\Windows\System\SuTVdzq.exe
  C:\Windows\System\SuTVdzq.exe
  2⤵
  PID:8244
- C:\Windows\System\URKBrBx.exe
  C:\Windows\System\URKBrBx.exe
  2⤵
  PID:7748
- C:\Windows\System\vqTLseE.exe
  C:\Windows\System\vqTLseE.exe
  2⤵
  PID:8392
- C:\Windows\System\QIQAFvE.exe
  C:\Windows\System\QIQAFvE.exe
  2⤵
  PID:8484
- C:\Windows\System\ASMssEA.exe
  C:\Windows\System\ASMssEA.exe
  2⤵
  PID:8612
- C:\Windows\System\MvsjVXE.exe
  C:\Windows\System\MvsjVXE.exe
  2⤵
  PID:8648
- C:\Windows\System\kQJclkN.exe
  C:\Windows\System\kQJclkN.exe
  2⤵
  PID:8404
- C:\Windows\System\LsZsgRQ.exe
  C:\Windows\System\LsZsgRQ.exe
  2⤵
  PID:8552
- C:\Windows\System\ZtCyPBQ.exe
  C:\Windows\System\ZtCyPBQ.exe
  2⤵
  PID:8264
- C:\Windows\System\ZahFAkl.exe
  C:\Windows\System\ZahFAkl.exe
  2⤵
  PID:8696
- C:\Windows\System\gYRwQoj.exe
  C:\Windows\System\gYRwQoj.exe
  2⤵
  PID:8792
- C:\Windows\System\sznuruC.exe
  C:\Windows\System\sznuruC.exe
  2⤵
  PID:8892
- C:\Windows\System\OatLhvA.exe
  C:\Windows\System\OatLhvA.exe
  2⤵
  PID:8952
- C:\Windows\System\IHVezsv.exe
  C:\Windows\System\IHVezsv.exe
  2⤵
  PID:8872
- C:\Windows\System\GIJhnFZ.exe
  C:\Windows\System\GIJhnFZ.exe
  2⤵
  PID:9032
- C:\Windows\System\JITFCYp.exe
  C:\Windows\System\JITFCYp.exe
  2⤵
  PID:9096
- C:\Windows\System\QczUFKE.exe
  C:\Windows\System\QczUFKE.exe
  2⤵
  PID:9172
- C:\Windows\System\fJfVxBp.exe
  C:\Windows\System\fJfVxBp.exe
  2⤵
  PID:9100
- C:\Windows\System\YKMZFZc.exe
  C:\Windows\System\YKMZFZc.exe
  2⤵
  PID:8596
- C:\Windows\System\AKrxmwO.exe
  C:\Windows\System\AKrxmwO.exe
  2⤵
  PID:8712
- C:\Windows\System\EAxcgzZ.exe
  C:\Windows\System\EAxcgzZ.exe
  2⤵
  PID:9048
- C:\Windows\System\faTlKvZ.exe
  C:\Windows\System\faTlKvZ.exe
  2⤵
  PID:8440
- C:\Windows\System\mZgxjIy.exe
  C:\Windows\System\mZgxjIy.exe
  2⤵
  PID:6856
- C:\Windows\System\dhimAiI.exe
  C:\Windows\System\dhimAiI.exe
  2⤵
  PID:8740
- C:\Windows\System\yvcGriq.exe
  C:\Windows\System\yvcGriq.exe
  2⤵
  PID:8908
- C:\Windows\System\mQCyFrG.exe
  C:\Windows\System\mQCyFrG.exe
  2⤵
  PID:8312
- C:\Windows\System\HzdxiWI.exe
  C:\Windows\System\HzdxiWI.exe
  2⤵
  PID:8436
- C:\Windows\System\XrIckBO.exe
  C:\Windows\System\XrIckBO.exe
  2⤵
  PID:8308
- C:\Windows\System\wAUgCvF.exe
  C:\Windows\System\wAUgCvF.exe
  2⤵
  PID:9224
- C:\Windows\System\igpgdRI.exe
  C:\Windows\System\igpgdRI.exe
  2⤵
  PID:9240
- C:\Windows\System\RREoawU.exe
  C:\Windows\System\RREoawU.exe
  2⤵
  PID:9256
- C:\Windows\System\JhwiVVh.exe
  C:\Windows\System\JhwiVVh.exe
  2⤵
  PID:9272
- C:\Windows\System\BWPZalQ.exe
  C:\Windows\System\BWPZalQ.exe
  2⤵
  PID:9288
- C:\Windows\System\qbLRztA.exe
  C:\Windows\System\qbLRztA.exe
  2⤵
  PID:9304
- C:\Windows\System\yvESFfm.exe
  C:\Windows\System\yvESFfm.exe
  2⤵
  PID:9320
- C:\Windows\System\tOQrfza.exe
  C:\Windows\System\tOQrfza.exe
  2⤵
  PID:9336
- C:\Windows\System\EDeUDHa.exe
  C:\Windows\System\EDeUDHa.exe
  2⤵
  PID:9352
- C:\Windows\System\HtvkrTS.exe
  C:\Windows\System\HtvkrTS.exe
  2⤵
  PID:9368
- C:\Windows\System\FnfHAxD.exe
  C:\Windows\System\FnfHAxD.exe
  2⤵
  PID:9384
- C:\Windows\System\SEXqESo.exe
  C:\Windows\System\SEXqESo.exe
  2⤵
  PID:9400
- C:\Windows\System\NEgWeXQ.exe
  C:\Windows\System\NEgWeXQ.exe
  2⤵
  PID:9416
- C:\Windows\System\FlynAOb.exe
  C:\Windows\System\FlynAOb.exe
  2⤵
  PID:9432
- C:\Windows\System\ybYeZur.exe
  C:\Windows\System\ybYeZur.exe
  2⤵
  PID:9448
- C:\Windows\System\ONHneOT.exe
  C:\Windows\System\ONHneOT.exe
  2⤵
  PID:9464
- C:\Windows\System\FQbbBcT.exe
  C:\Windows\System\FQbbBcT.exe
  2⤵
  PID:9480
- C:\Windows\System\gMytdjt.exe
  C:\Windows\System\gMytdjt.exe
  2⤵
  PID:9496
- C:\Windows\System\jiILbSv.exe
  C:\Windows\System\jiILbSv.exe
  2⤵
  PID:9512
- C:\Windows\System\HgrYnZF.exe
  C:\Windows\System\HgrYnZF.exe
  2⤵
  PID:9528
- C:\Windows\System\lxAkVQv.exe
  C:\Windows\System\lxAkVQv.exe
  2⤵
  PID:9544
- C:\Windows\System\cCkKXoh.exe
  C:\Windows\System\cCkKXoh.exe
  2⤵
  PID:9560
- C:\Windows\System\coFemxK.exe
  C:\Windows\System\coFemxK.exe
  2⤵
  PID:9576
- C:\Windows\System\qgIbTiy.exe
  C:\Windows\System\qgIbTiy.exe
  2⤵
  PID:9596
- C:\Windows\System\DYGKYTL.exe
  C:\Windows\System\DYGKYTL.exe
  2⤵
  PID:9612
- C:\Windows\System\wBaPNdF.exe
  C:\Windows\System\wBaPNdF.exe
  2⤵
  PID:9628
- C:\Windows\System\PIybkzA.exe
  C:\Windows\System\PIybkzA.exe
  2⤵
  PID:9644
- C:\Windows\System\qsvPUIu.exe
  C:\Windows\System\qsvPUIu.exe
  2⤵
  PID:9660
- C:\Windows\System\eAhHJTq.exe
  C:\Windows\System\eAhHJTq.exe
  2⤵
  PID:9676
- C:\Windows\System\VPCuOPr.exe
  C:\Windows\System\VPCuOPr.exe
  2⤵
  PID:9692
- C:\Windows\System\RMbBILn.exe
  C:\Windows\System\RMbBILn.exe
  2⤵
  PID:9708
- C:\Windows\System\MNBoOsX.exe
  C:\Windows\System\MNBoOsX.exe
  2⤵
  PID:9724
- C:\Windows\System\sSdZEup.exe
  C:\Windows\System\sSdZEup.exe
  2⤵
  PID:9740
- C:\Windows\System\KuBXmCx.exe
  C:\Windows\System\KuBXmCx.exe
  2⤵
  PID:9756
- C:\Windows\System\SPgMxOO.exe
  C:\Windows\System\SPgMxOO.exe
  2⤵
  PID:9772
- C:\Windows\System\daCPLHP.exe
  C:\Windows\System\daCPLHP.exe
  2⤵
  PID:9788
- C:\Windows\System\XyrJNQy.exe
  C:\Windows\System\XyrJNQy.exe
  2⤵
  PID:9804
- C:\Windows\System\mhLiKXn.exe
  C:\Windows\System\mhLiKXn.exe
  2⤵
  PID:9820
- C:\Windows\System\woSBamZ.exe
  C:\Windows\System\woSBamZ.exe
  2⤵
  PID:9836
- C:\Windows\System\taUlsjh.exe
  C:\Windows\System\taUlsjh.exe
  2⤵
  PID:9852
- C:\Windows\System\IeyTPjf.exe
  C:\Windows\System\IeyTPjf.exe
  2⤵
  PID:9868
- C:\Windows\System\lTaWJPS.exe
  C:\Windows\System\lTaWJPS.exe
  2⤵
  PID:9884
- C:\Windows\System\XBKhsAj.exe
  C:\Windows\System\XBKhsAj.exe
  2⤵
  PID:9900
- C:\Windows\System\feWCukL.exe
  C:\Windows\System\feWCukL.exe
  2⤵
  PID:9916
- C:\Windows\System\sNtvzqP.exe
  C:\Windows\System\sNtvzqP.exe
  2⤵
  PID:9932
- C:\Windows\System\OAwkNZm.exe
  C:\Windows\System\OAwkNZm.exe
  2⤵
  PID:9948
- C:\Windows\System\AIVmFzY.exe
  C:\Windows\System\AIVmFzY.exe
  2⤵
  PID:9964
- C:\Windows\System\VqVYLoK.exe
  C:\Windows\System\VqVYLoK.exe
  2⤵
  PID:9980
- C:\Windows\System\IQwxcyT.exe
  C:\Windows\System\IQwxcyT.exe
  2⤵
  PID:9996
- C:\Windows\System\HOAHrYP.exe
  C:\Windows\System\HOAHrYP.exe
  2⤵
  PID:10016
- C:\Windows\System\WEeWJGw.exe
  C:\Windows\System\WEeWJGw.exe
  2⤵
  PID:10032
- C:\Windows\System\yfnDfys.exe
  C:\Windows\System\yfnDfys.exe
  2⤵
  PID:10048
- C:\Windows\System\eDCGuLv.exe
  C:\Windows\System\eDCGuLv.exe
  2⤵
  PID:10064
- C:\Windows\System\hlJWxRp.exe
  C:\Windows\System\hlJWxRp.exe
  2⤵
  PID:10080
- C:\Windows\System\sdAFARP.exe
  C:\Windows\System\sdAFARP.exe
  2⤵
  PID:10096
- C:\Windows\System\JvvCpaF.exe
  C:\Windows\System\JvvCpaF.exe
  2⤵
  PID:10112
- C:\Windows\System\kOTFDEZ.exe
  C:\Windows\System\kOTFDEZ.exe
  2⤵
  PID:10128
- C:\Windows\System\euFgOlQ.exe
  C:\Windows\System\euFgOlQ.exe
  2⤵
  PID:10144
- C:\Windows\System\OmvTsnP.exe
  C:\Windows\System\OmvTsnP.exe
  2⤵
  PID:10160
- C:\Windows\System\DiFkgXj.exe
  C:\Windows\System\DiFkgXj.exe
  2⤵
  PID:10176
- C:\Windows\System\BIvprPG.exe
  C:\Windows\System\BIvprPG.exe
  2⤵
  PID:10192
- C:\Windows\System\rAxwxGU.exe
  C:\Windows\System\rAxwxGU.exe
  2⤵
  PID:10212
- C:\Windows\System\sFrdAxw.exe
  C:\Windows\System\sFrdAxw.exe
  2⤵
  PID:10228
- C:\Windows\System\ESwSWyU.exe
  C:\Windows\System\ESwSWyU.exe
  2⤵
  PID:9236
- C:\Windows\System\wYCzwXt.exe
  C:\Windows\System\wYCzwXt.exe
  2⤵
  PID:9296
- C:\Windows\System\TOfEPPA.exe
  C:\Windows\System\TOfEPPA.exe
  2⤵
  PID:9332
- C:\Windows\System\rXpDDCS.exe
  C:\Windows\System\rXpDDCS.exe
  2⤵
  PID:8772
- C:\Windows\System\cIBUZxh.exe
  C:\Windows\System\cIBUZxh.exe
  2⤵
  PID:7980
- C:\Windows\System\yhVzWFT.exe
  C:\Windows\System\yhVzWFT.exe
  2⤵
  PID:9208
- C:\Windows\System\DstvWVt.exe
  C:\Windows\System\DstvWVt.exe
  2⤵
  PID:9248
- C:\Windows\System\IavVWgg.exe
  C:\Windows\System\IavVWgg.exe
  2⤵
  PID:9284
- C:\Windows\System\sBgBctp.exe
  C:\Windows\System\sBgBctp.exe
  2⤵
  PID:9316
- C:\Windows\System\FKLSYmB.exe
  C:\Windows\System\FKLSYmB.exe
  2⤵
  PID:9344
- C:\Windows\System\fzqqLeP.exe
  C:\Windows\System\fzqqLeP.exe
  2⤵
  PID:9412
- C:\Windows\System\kqXvVhV.exe
  C:\Windows\System\kqXvVhV.exe
  2⤵
  PID:9444
- C:\Windows\System\wJzpZjo.exe
  C:\Windows\System\wJzpZjo.exe
  2⤵
  PID:9552
- C:\Windows\System\NcPPMGY.exe
  C:\Windows\System\NcPPMGY.exe
  2⤵
  PID:9584
- C:\Windows\System\wXUVGbj.exe
  C:\Windows\System\wXUVGbj.exe
  2⤵
  PID:9592
- C:\Windows\System\iFWvNcX.exe
  C:\Windows\System\iFWvNcX.exe
  2⤵
  PID:9624
- C:\Windows\System\PHoRscH.exe
  C:\Windows\System\PHoRscH.exe
  2⤵
  PID:9652
- C:\Windows\System\FPGdveN.exe
  C:\Windows\System\FPGdveN.exe
  2⤵
  PID:9640
- C:\Windows\System\wUuyXYr.exe
  C:\Windows\System\wUuyXYr.exe
  2⤵
  PID:9688
- C:\Windows\System\djGelBj.exe
  C:\Windows\System\djGelBj.exe
  2⤵
  PID:9700
- C:\Windows\System\OtGwMaj.exe
  C:\Windows\System\OtGwMaj.exe
  2⤵
  PID:9784
- C:\Windows\System\uyEJjJA.exe
  C:\Windows\System\uyEJjJA.exe
  2⤵
  PID:9768
- C:\Windows\System\dLPIurr.exe
  C:\Windows\System\dLPIurr.exe
  2⤵
  PID:9844
- C:\Windows\System\VYRLbuu.exe
  C:\Windows\System\VYRLbuu.exe
  2⤵
  PID:9908
- C:\Windows\System\dLVNByj.exe
  C:\Windows\System\dLVNByj.exe
  2⤵
  PID:10008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EZORkxm.exe

Filesize
1.9MB

MD5
8355c8ee05dc2dfa541109beebac7b9a

SHA1
a8ad288a929bcdf8fda1e89c89a60c4713f13338

SHA256
fb4d9f1df341c948b669d3cba22593161dbe1ece60d4aae975e14d8155130b95

SHA512
ec3f0cf6547b3bdfb44318339464d07dff0b6d47dd209b741003ea5fb99eb395b1e7c4a84e0bc60e51befac8d05e1008d36a72778f92e8462190d80e5e51c51d

Download Submit
C:\Windows\system\FTmjfdx.exe

Filesize
1.9MB

MD5
3f982315c60dc8b5b6b1ab92e21f07e7

SHA1
43c1bad7d2330eb141551d6b046361fb8cd7593a

SHA256
973851ac70cf6000f6a2539c7849c19e25d143130a8728d35ebeddc44168e584

SHA512
f31d013dfa887b59515cb1e962d21f7ce48385a1aa92f1817acdd4498a33746f3c940af93514f4365a9bce7b15f2713daabc3f1b6d313a9138e8c92afe05fb7a

Download Submit
C:\Windows\system\HENRnaB.exe

Filesize
1.9MB

MD5
f4220652c95576a97a853c20c84f80f1

SHA1
fd6b81dbc4c7cd9a442d179d2b0ac33a03be9dfe

SHA256
344e428e06d260d9548b1800919a089c9444b03f3557823ec56b60fa98606d1b

SHA512
b3d893d3738b40b34f8f50178d92a09af98a90e019020ef2b8854a6d81b5007fed36975f708841d36b8db0020d216c9a89be7300f2700b2c4f7915a33ea43d96

Download Submit
C:\Windows\system\IhLiXwM.exe

Filesize
1.9MB

MD5
cf56bb315db76d0bdc91d5a57fa01895

SHA1
190f2ca96b195b98616abcf6a98f1a1cd3cde7c2

SHA256
2386dab4150b8bba4e732487be3d4857c07f1bb42cdaea5434a75bf9e766e279

SHA512
9ea5d9872ae173519c7cd45796728e8c1ef64687ac5bc720124d955a3852fafebfacf0a3fac3718af94ec5650f8ec22e61c50e1279bb61c00279d0b86bf95fde

Download Submit
C:\Windows\system\ImlNHDp.exe

Filesize
1.9MB

MD5
66311370e7f20b404fdc022d90e5d8bd

SHA1
9318797f52aeb1cd16ac3e1f33c238bd3dd63ad2

SHA256
ec57a5b96368bc4ba76d797f80fc997a6f6a9fe5659472a27614f77fba032a02

SHA512
8861b91b528f66d7ba66b15680fd00004dc68796ed85336a71fcbb5309bcb5a533b87b45d0cf9f52f3d831c493207674f61eaf743c3d712b75de0979b2434d08

Download Submit
C:\Windows\system\IpMZowY.exe

Filesize
1.9MB

MD5
b91a89dfcc75de4d4db0a02614dc0638

SHA1
ccdfd9940127f288a61aacfd25d053994f5b5c20

SHA256
df6693855075e9406b87c612ad293ef74b102d75834395401226f6b58a480cb7

SHA512
3767beb8f2f3803daac5d18ed4679205e90fa3bac7c04b515714c0f6f5b00e112e4dad08e40c63f3da296e6738d35d3b094b552f79f3a46b26a1281bd328569f

Download Submit
C:\Windows\system\KBmuUWx.exe

Filesize
1.9MB

MD5
ff219d466143f1bd2829b467ee584454

SHA1
199063b303f131225b1837b5444eae482866edd4

SHA256
a9db791d9f7eb42b6136b656223aad48aacba8d776377a7a26d46b52bc7097a6

SHA512
95a2c96880c49c1e6fe1590bbd475143f1a470def7614c628adc6c1e68325623a64ea22932cc94eff965237ae7315189cb3b2b4f5ef89b761d5604b8ea87b5f1

Download Submit
C:\Windows\system\LykGLnn.exe

Filesize
1.9MB

MD5
5a59536ab203342b19afadd42ea9066c

SHA1
6e07d23f573d6c354d8bd68ad59b5aa640e6792a

SHA256
1a1a285eeff1056f4a287e45d2ea41c284fe5af6487e9ba9a72b9862f758b220

SHA512
a6ef63b3b8059fb30a907fed5c92edc2c5c01fb857a9c3524cc0e96443231fdbc0e710441a86c083cf97a13d6db971e87062ca81cb596c2fe3903453c7a26747

Download Submit
C:\Windows\system\MReuytT.exe

Filesize
1.9MB

MD5
38f1d7a996f21824ca22e4833655d1fd

SHA1
3954d9898448c275fad351e8943bcc0564aa93e5

SHA256
caacbd8fa799e4077013e3b5145d92d45cee0c7ef1a5f78d9f90485a5daf989d

SHA512
db52fec9eff5e77c25a49971709b7eea6188b4ce8a58521714904d1eec87253a20ecae7a80f93cebdcb25679cf0427855b5f8d18f01f335c8b1d035400c44e97

Download Submit
C:\Windows\system\MThOZzo.exe

Filesize
1.9MB

MD5
14ea43e4bb997b2358638ba985499c5e

SHA1
0ed46623a8ddd2daf6baf82730efed8ce2d5d2ca

SHA256
73591717ba2d7b3e8109db6fa6767e55e0a562190bbbcd36bcd61667156c679d

SHA512
f4995cd3b818ee804e26e9f01e6223084b628a92c502f7fd7b741bd287503b8d49c7f7212b29f71cbbf33d34024fc3ea961bb0779146a4ab2b8ef79c941f3eae

Download Submit
C:\Windows\system\RLfQgTY.exe

Filesize
1.9MB

MD5
282aebdd0023788f325630624a9b69a1

SHA1
b017e34f85ea46b4ed700b642b7012be00f5e383

SHA256
51df3b51e66039e7efe82fa1c9f4fa347412fb1e9de5e814a98d27d71d107a56

SHA512
45261e4feaf1d92dbddf034a5c0f7d54fe55218a4735f26ec5517b467e5fc08c2fc73772ad507c40dc981096cc70b2d8a8f8e89d03208c6159c7e3cb8618a565

Download Submit
C:\Windows\system\SlYOQwK.exe

Filesize
1.9MB

MD5
8cc9029f9623fb30a17b49c6ccb27da9

SHA1
754a08c6f79b4c5e4492385e1818b56b55119b89

SHA256
287385aab1975f3b342d389c8e5686dcb946fca0611193725394004431805904

SHA512
512fe20fdb1c697c2df95815040cccb1aaafaa01544c1de3ee110effbdf306e48cee2281f769c6548fabe674ff8fe8824b3a57d62f096acbea3cf30b0e87676a

Download Submit
C:\Windows\system\TmtcJQK.exe

Filesize
1.9MB

MD5
66f086b6a9ab4b5da192f60d517da716

SHA1
6716d70f70bda7b32064c3901330aeb78f88eab3

SHA256
ea385ac28e1c3ac6eebcc01fb07b70e9d71d943ec78ebc869b3cef1b5ef5646b

SHA512
25aed5f6e813f6fb3b6f18bb5ca88c40b6f341956bf7483b046480fd4fd01d45558f5d0b3be28519090814a1b655f0903c013a9f87df70afe6003886da4cbfbc

Download Submit
C:\Windows\system\UvUZbfq.exe

Filesize
1.9MB

MD5
e7d9eac05c9ad8476dcab3884745e888

SHA1
670535a662665036a138124a16484d4aca536afd

SHA256
b3880938276f97fcf0454929473d1ad13e5218981732b858415de622ae754740

SHA512
6570baee142296d55ef2ed8122be9804a0852cddfa37cf0fd4aa096d50e2810870bc6af805d21c54f01a70bae0fc86e52511e2c3c0db7b1ace923a09964eca78

Download Submit
C:\Windows\system\XAdCGyD.exe

Filesize
1.9MB

MD5
d0675a2538c15309b53ca62b95ff3a6e

SHA1
3b595eeeb4caf8e09b084a87e2aa07290e474eab

SHA256
1b5d3139401e3b3005eaaa383299579b3b6f7253416073d9806322847301b930

SHA512
7bd31700942c22466926d7c5819c62c0079440a5eb6758c9cf94d38c0936e2f534b780adc6dc962d480b88432fd202fd6030eb4856b213dc7814409c3ec61dee

Download Submit
C:\Windows\system\dRBQAWD.exe

Filesize
1.9MB

MD5
8a20902bf95338ebb2a69294b9608c79

SHA1
d0736ac6874116e28621b192c17534e3d1061127

SHA256
05e49f6f9a159665c8b0d5ba405c96849980dbe9e44f9343906971d98f929c30

SHA512
1f48a33fdec5fea7bae1256b0d422c3b80dc99b92576c566e1b9c9d09607e7ebeb31cdbb573c70d930ec36fce23d213470a66a70930b6f837bd00a358b83ffb5

Download Submit
C:\Windows\system\gGqudNl.exe

Filesize
1.9MB

MD5
8db9246ce21811c98dcfb6a703f3ca60

SHA1
2c2e13f21273edb48804aad5a074b3fa66904c39

SHA256
da49303fd855c9fafd06ff81ff9f4e6012ea1b7937e13235457e813ff183d1a9

SHA512
119f5041317a4f51c161184ddb32163cbeb81156e9864ccb133caa516315e086a6c5945c7cc410e75bb2a93db09b5c2c695d648c3b379e6c0c997a16b5b95dd7

Download Submit
C:\Windows\system\hzVOufo.exe

Filesize
1.9MB

MD5
63093c84a837192376b6cb09e10e5261

SHA1
2711f282901dd485aee1dd68f1299d980268310c

SHA256
fff5cb5f971b8b63bbc631cedca7363bd0f5dc6014b54a2d241955ee9e06405f

SHA512
a195f5991ab1c579403325aafd187bccb3d700952e812300965307a88c596ef531704ef2172ee9189198ac02838d078adbd0573aad39121ccf03263b4c688369

Download Submit
C:\Windows\system\iCKMoMl.exe

Filesize
1.9MB

MD5
78327d16bfbc1c7c10ff37bc577088ea

SHA1
29f0fc1114b4f8c55e8379618fd579adac0aea8d

SHA256
a9051dd5e878ba0c4edb0d09370cb216bc502ced7164f16431d52d3bb3a0c261

SHA512
8650e2dd77eb2939c9e9ec3612807b0b2add38ff0e7be85282fec53a9912c83b1c1570e108d4713ce057dfdc2657fd40bded00f66cbd7546ddd5307a8d93a854

Download Submit
C:\Windows\system\jddHFvQ.exe

Filesize
1.9MB

MD5
cb2f0bbc299022356cb2a3b2ff82fa46

SHA1
bdf2d54aee23d9b67501487e090a1fc2fa4e9fa0

SHA256
ef86fb4122abb3d33d9e485271432b84b7bddc6f10c3c6f2f1a1956efc06b651

SHA512
033dfd790b9545dc27005da5c9052c8b889b48de68eda45b6d3556a799aa4c0e2e610b86f63d1ec6008dd8732ff87c45fa1937215e648e46a7b9797510bb6c69

Download Submit
C:\Windows\system\nPeOerZ.exe

Filesize
1.9MB

MD5
a7e8ff28b013ca52d90e3c438ea3c11c

SHA1
4f8fd8cf3663e950e7c6ef5682b8b06760f6f9c4

SHA256
2c305c6b631883bf0c0171d0dd2d95d44e5743e739da9fe163b6b4ad251d55f4

SHA512
909beb9eea1f93c826250c3168bdf74b9cf5522708afbb7eb28f98350fecf9e83256903aab561910d957aea03fa981d92284ba902e04be5ee5949c7a86d5aa46

Download Submit
C:\Windows\system\qEwIXca.exe

Filesize
1.9MB

MD5
a5d44cbc847bd5ff34019273c230330d

SHA1
88487839e4be3ca014b4a9ccaa48b1c879259e13

SHA256
a90c0a4cff77c2c0ed43ef9787c5c300fef68367c4d0d845a9596fda4026589e

SHA512
6b2af7e7c820ff35520d244f84809155ace8e4846f42e9b66f529db1917a42f0fed04fa0ae1ccbb0112df6b03a9724063d1af2df5265298e5c06df95832cb71d

Download Submit
C:\Windows\system\qqMcCwN.exe

Filesize
1.9MB

MD5
844086415b58e63ec1b95b07b129652a

SHA1
9f58010da3db95a4af997c0ad727e4e029be5a82

SHA256
7a73dfee0c9296ed495ee9ac4c8494dc109076aa3d69d6db83e06a5cc7ea1bd1

SHA512
3412675356a44957082cd019968e02c60ceec8fdf247c72f2ab0f423c68e8914eee97da9f0e92f06b42541178ceb31188802d1afa4112db89385ada55531d806

Download Submit
C:\Windows\system\sdtfSWa.exe

Filesize
1.9MB

MD5
1819cfabb65129aa9a189bb757c34c44

SHA1
1c7da6d0c52cac64f0c96791570ef30ffd6966be

SHA256
5e1947c34cdc6bbca8c45e18cf43abb5060ece7e81183418a97132a30bc8f514

SHA512
1563b23dd4600c65464a9e7007b25b3903a204a4060ed980054612c1f28d78bf5ad91ed5cbd6dc87cfea8b5cb518c58c2606193ccd362852d29187554f06ca96

Download Submit
C:\Windows\system\sfCtLgh.exe

Filesize
1.9MB

MD5
d83a5157d3116049c362c47a24f62fb6

SHA1
a15a618d28fd9404f1162fc5ba5c66fd9c53c6fd

SHA256
683170ad78d71b127ace19571363fe3b3e4695e903c7c924e841875e37f3b389

SHA512
530f152e0045fb3a763acb418835b1065146051c951d4b0feea9b1209e54153ccbc3d902877af8e62acbbf29d40b371ce66f0ac90bf3db1dda4685e3c43eec22

Download Submit
C:\Windows\system\sohBYqF.exe

Filesize
1.9MB

MD5
14a061067be43578670267372435069f

SHA1
c2157d2854df78662ea5b10c4d5157546d0a6967

SHA256
e1665c5c79baf6ee0d5b40337b86bcca4a96b3b223837967726cedb7b0c34b3a

SHA512
21658aeab21868087992a057ee152f7126666211a041a74cbd4b375355d99e363d795014f11a074104d8db6988fbea3a25aad35fb2d93778fe043e7979f1d1d7

Download Submit
C:\Windows\system\wjGvXmP.exe

Filesize
1.9MB

MD5
c65b87197a2c3d85d7d2faf6ae1a86fc

SHA1
49778b8719a6d9c8d7fe57dc6a44855e7224cbf8

SHA256
875dc5c5f0850cffda8a9b4cc8610b6d8d31b23c47d23e14c17e82cef600bcca

SHA512
3ba6016b2576f40291c8fc1a3289b558c9e4d8469c1d1cc8bd4414af889440392311e2cc22c350ee7547a3d4080972627e75ecd81f25d18b2179ca1623592921

Download Submit
C:\Windows\system\zalGbKk.exe

Filesize
1.9MB

MD5
b6460a387d99c4a5c60c14fdf7711391

SHA1
06ea48f65590c349e0c662bbb349f6700d50d3ad

SHA256
27d437b3b3a6a17781182c2ad533e79dec738081f3003792aacefa11599c419d

SHA512
e205839bbaa894b6adc399eceb4dfc96bddcba92dbcd8ae37cf4666ef526995e5062548621fa698d9fad16bd7793f56804743abf4bb3ea0fa3af99b2d147e55e

Download Submit
\Windows\system\KiZMBIS.exe

Filesize
1.9MB

MD5
2da2cdc66060441178f400832f0a360f

SHA1
4353ae62286b6cf07b1ef25db099a24addc9dd80

SHA256
5d6b53df1d33ccb6393c4a50815b2d19278f3ca84750df4b1324876108e57335

SHA512
d9760735ac9d48a50dbfeafc5480ecdce3bf2122419ff4f643a27c9bdb409481dc39ac70a66adefbb85c29ee5abcfca63680706f1954a70c0edfe69d28d745f8

Download Submit
\Windows\system\NbtelzR.exe

Filesize
1.9MB

MD5
2bffe435b6470639e3b16799c37d8e4a

SHA1
66626709266986f75c6899d7f485da725a7ae8b1

SHA256
7cc750a2ab3be0dc03ee76d8e6801bd2e5abef356f29e9588069d071fd0a339f

SHA512
405797eb0114240697e7ec750aa3ef3193e1b143574c24ef1d9c2dc87d104ce19c549d330050f4495209b52208967add1aba0446545e23b453e6121ff00e1ebe

Download Submit
\Windows\system\PsrclAl.exe

Filesize
1.9MB

MD5
90a3c1388216db4760f439966fcfacc3

SHA1
317396f9a43b70664055ffbe8f0215af461ca452

SHA256
981cab7c6f129c6f4d67cfeb81076c49824f6d5ffdf55867639a5e5f5ebce3b1

SHA512
fd4073af7a4df7b7970acfbf8d37db3d671c2dccd02c060bdce12d61a6b22bfb2eb4e3d4cfdc186994733bcf5b867bfa008abcc19c4ed06ebdc55559951df803

Download Submit
\Windows\system\cvbmMgG.exe

Filesize
1.9MB

MD5
c0fb8416fbcef2b6798159769e7a4ba6

SHA1
fde23de72b06213dd5d90a2e612fdde9daabe42f

SHA256
a74e2e6221643e07bf0e102fcea28ad121a2ce9b7cacaca1cf90ea18d1eff601

SHA512
46fbdc8212eb921949bfb9b1e1f72f1a28250f936479455b43ba6425e5c77fd694ad7843836be52cb93e593ef004b470993a796c7a9f3897a9d9c9e93490f5c5

Download Submit
\Windows\system\evmBvEM.exe

Filesize
1.9MB

MD5
ad83751c5db9974517db6cdcb0b23ee5

SHA1
faf0f2305b315499db9705e1e6e0e8c15ce9d104

SHA256
c8d1f65f46bda1af07e1c1307064a33600633eebf59df744f0aa576a63558fa8

SHA512
6df331683f0429a0feb903c1089f176398a51e302334f8dbd54d1ffbcdc1e0e4a5ea5988012626f436d007736cca13f3c25416fcde0705ef6d26e81c26e8024b

Download Submit
memory/1724-4611-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1724-120-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-178-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-4604-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-175-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-150-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2180-117-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2180-172-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2180-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2180-119-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-179-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-148-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2180-177-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-0-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2180-12-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2180-181-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-165-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2180-170-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2404-157-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2404-4692-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2432-169-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-4606-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-4607-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2456-149-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2568-171-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2568-4603-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2616-4248-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-180-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-116-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-4501-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-13-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-4602-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-4605-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2768-118-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2912-174-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2964-176-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-4691-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-14-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/3024-164-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/3024-15-0x000007FEF5F2E000-0x000007FEF5F2F000-memory.dmp

Filesize
4KB

Download
memory/3024-134-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/3024-115-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-523-0x000007FEF5C70000-0x000007FEF660D000-memory.dmp

Filesize
9.6MB

Download