xmrig | 7430c7e4bc549a066a2a2cd49f17bdc34625a3d3e91e5027d6064ffb1e8005d3

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
Size

2.2MB
MD5

0e29040b94d6a332058e877a631a7c88
SHA1

b5588e323ced6d8e2e4d93744d9274a30be88e0b
SHA256

7430c7e4bc549a066a2a2cd49f17bdc34625a3d3e91e5027d6064ffb1e8005d3
SHA512

c897d4234b912b0a8c0d0fcbe881a063a9f5524f2e8c02c7c2cb76c2161c96e53705116f2c142fe188dd1d99595b6ec764bf60aa242e2af733d1cca81c0586b6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrM:NABL

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-14-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2556-16-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2448-229-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2480-215-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2520-212-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2884-210-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2108-240-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/1204-237-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2492-206-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2524-198-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2412-196-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2448-2038-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/1204-2039-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2480-2040-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2108-2041-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2412-2048-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2556-2047-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/3064-2046-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2884-2045-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2524-2044-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2520-2043-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2492-2042-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3064	argSVCQ.exe
2556	Ayscwfi.exe
2412	xAaQHjo.exe
2524	ssnMyyd.exe
2492	iMswirZ.exe
2884	aWAEwip.exe
2520	wpbXBnV.exe
2480	NsMtqjJ.exe
2448	UVVRJfO.exe
1204	yOaBVmE.exe
2108	TERqWBo.exe
1652	oZtwfxA.exe
592	COMnWSo.exe
276	vsKsiyi.exe
1636	JMSiYuQ.exe
1960	HlyRLTk.exe
2700	ERsyQXU.exe
2040	TSOGbZw.exe
1936	jUAWYrF.exe
1660	pceWeqU.exe
1404	GAfxnSe.exe
1952	xiwSDEr.exe
1668	lMbkVuC.exe
2472	LgNNJzg.exe
836	ewoGAcD.exe
1112	vMDiViY.exe
1100	dtJCxfT.exe
768	lKJkYLg.exe
2296	mmvKNdE.exe
2316	knMcNEi.exe
2936	zpoTpYt.exe
2112	rFYGjkm.exe
1728	aBRIPDE.exe
3008	TIXBCOr.exe
2588	BCQyLHR.exe
708	lMffyCW.exe
828	EuiRFBZ.exe
1160	PmhJhDv.exe
1916	FsXKnof.exe
1332	eXRjBhj.exe
1340	YZVNbGq.exe
1300	VwfBqfL.exe
940	ZPxkXuq.exe
956	TATrXne.exe
1996	MRVYTCd.exe
2016	NnXWmPW.exe
856	hYFOuzb.exe
1780	PZjBDCa.exe
1684	JWYCBfo.exe
704	MCfpdIZ.exe
2788	sUrvFmL.exe
2144	MmUtEOu.exe
2560	KWUhVpe.exe
1620	fITBqCq.exe
1692	mVkPzOf.exe
2656	JyAKlYW.exe
2432	rmTlCtd.exe
1712	qqgWSpQ.exe
2460	pnOOwwJ.exe
2888	WHdOovp.exe
2164	QQIobZd.exe
572	pUdkzjp.exe
2880	MaGZiDd.exe
2956	mKCkqhj.exe

Loads dropped DLL 64 IoCs

pid	Process
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2068-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x000c0000000132c6-7.dat	upx
behavioral1/memory/2068-6-0x0000000002BF0000-0x0000000002FE2000-memory.dmp	upx
behavioral1/files/0x002d0000000134ad-8.dat	upx
behavioral1/memory/3064-14-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2556-16-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0009000000013a4d-33.dat	upx
behavioral1/files/0x000f0000000006fd-25.dat	upx
behavioral1/files/0x000a0000000139d6-10.dat	upx
behavioral1/files/0x00070000000140f2-39.dat	upx
behavioral1/files/0x000800000001450f-41.dat	upx
behavioral1/files/0x0006000000015c69-49.dat	upx
behavioral1/files/0x0006000000015db4-73.dat	upx
behavioral1/files/0x0006000000016042-103.dat	upx
behavioral1/files/0x0006000000015e7c-108.dat	upx
behavioral1/files/0x0013000000013721-110.dat	upx
behavioral1/files/0x0006000000016283-120.dat	upx
behavioral1/files/0x0006000000016476-132.dat	upx
behavioral1/files/0x0006000000016b96-152.dat	upx
behavioral1/memory/2448-229-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2480-215-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2068-386-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2520-212-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2884-210-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2108-240-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/1204-237-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2492-206-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2524-198-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2412-196-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x0006000000016c10-157.dat	upx
behavioral1/files/0x0006000000016c10-154.dat	upx
behavioral1/files/0x0006000000016b5e-148.dat	upx
behavioral1/files/0x00060000000167db-144.dat	upx
behavioral1/files/0x000600000001663d-141.dat	upx
behavioral1/files/0x000600000001663d-138.dat	upx
behavioral1/files/0x00060000000165ae-134.dat	upx
behavioral1/files/0x0006000000016332-128.dat	upx
behavioral1/files/0x0006000000016332-126.dat	upx
behavioral1/files/0x0006000000016283-118.dat	upx
behavioral1/files/0x000600000001604b-116.dat	upx
behavioral1/files/0x0006000000015e02-101.dat	upx
behavioral1/files/0x0006000000015ec0-99.dat	upx
behavioral1/files/0x0006000000015e5b-82.dat	upx
behavioral1/files/0x0006000000016042-106.dat	upx
behavioral1/files/0x0006000000015d88-62.dat	upx
behavioral1/files/0x0006000000015eaf-93.dat	upx
behavioral1/files/0x0006000000015e6f-86.dat	upx
behavioral1/files/0x0006000000015c7c-57.dat	upx
behavioral1/files/0x0006000000015c87-53.dat	upx
behavioral1/files/0x0006000000015cb9-60.dat	upx
behavioral1/memory/2068-13-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2448-2038-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/1204-2039-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2480-2040-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2108-2041-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2412-2048-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2556-2047-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/3064-2046-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2884-2045-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2524-2044-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2520-2043-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2492-2042-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CHxHxzR.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\NQOmYFV.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\gsiojqF.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\yvOYIwE.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\meeSCpj.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\eueMmBQ.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\eUsJdwY.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\fEkxmDE.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\LfbPatW.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\hVlrjeh.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\QKAkARj.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\vlyyMrY.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\knqMYKs.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\ViEfhmu.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\QpUuBZO.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\wuaAQAc.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\womxvPK.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\doNmZVt.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\vcrNwCj.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\jbHnWFB.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\aJDxADa.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\erqDRTL.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\sgJRWJH.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\ZeaOEmq.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\iaMyEjz.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\rmtACMF.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\JNaTCZH.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\KIJLkwK.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\nWEZhMX.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\CJfxOQO.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\YCGepej.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\TATrXne.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\FxXLKXD.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\DAcmNiv.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\lEeDood.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\xpgTTTP.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\PKeECGK.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\AIHoTRX.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\shjZTzg.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\bbLDwRw.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\wMyGKOX.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\TcLRYap.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\ohCzJMC.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\DmCcxDQ.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\EJrSvqb.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\OZmQqKY.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\mdACFxd.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\mbSNpFS.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\ENpCwWR.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\ryKfRhe.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\fJRbvrS.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\pnOOwwJ.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\smgtCiR.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\ogbbqpo.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\dqMjEzL.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\lVBcdrB.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\cocNAwx.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\pdgHwPz.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\mQfTDfs.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\VjfHKvE.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\ANeBGQf.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\RxXmvNc.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\qDOVfyd.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
File created	C:\Windows\System\oCshvCi.exe	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
Token: SeDebugPrivilege	2696	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2696	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	29
PID 2068 wrote to memory of 2696	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	29
PID 2068 wrote to memory of 2696	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	29
PID 2068 wrote to memory of 3064	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	30
PID 2068 wrote to memory of 3064	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	30
PID 2068 wrote to memory of 2556	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2556	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2556	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	31
PID 2068 wrote to memory of 2412	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2412	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2412	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	32
PID 2068 wrote to memory of 2524	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2524	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2524	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	33
PID 2068 wrote to memory of 2492	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	34
PID 2068 wrote to memory of 2492	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	34
PID 2068 wrote to memory of 2492	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	34
PID 2068 wrote to memory of 2884	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	35
PID 2068 wrote to memory of 2884	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	35
PID 2068 wrote to memory of 2884	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	35
PID 2068 wrote to memory of 2520	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	36
PID 2068 wrote to memory of 2520	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	36
PID 2068 wrote to memory of 2520	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	36
PID 2068 wrote to memory of 2480	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2480	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2480	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	37
PID 2068 wrote to memory of 2448	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2448	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2448	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	38
PID 2068 wrote to memory of 2108	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2108	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	39
PID 2068 wrote to memory of 2108	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	39
PID 2068 wrote to memory of 1204	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	40
PID 2068 wrote to memory of 1204	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	40
PID 2068 wrote to memory of 1204	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	40
PID 2068 wrote to memory of 1652	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	41
PID 2068 wrote to memory of 1652	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	41
PID 2068 wrote to memory of 1652	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	41
PID 2068 wrote to memory of 592	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	42
PID 2068 wrote to memory of 592	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	42
PID 2068 wrote to memory of 592	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	42
PID 2068 wrote to memory of 2700	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	43
PID 2068 wrote to memory of 2700	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	43
PID 2068 wrote to memory of 2700	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	43
PID 2068 wrote to memory of 276	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	44
PID 2068 wrote to memory of 276	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	44
PID 2068 wrote to memory of 276	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	44
PID 2068 wrote to memory of 1936	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	45
PID 2068 wrote to memory of 1936	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	45
PID 2068 wrote to memory of 1936	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	45
PID 2068 wrote to memory of 1636	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1636	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1636	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	46
PID 2068 wrote to memory of 1660	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	47
PID 2068 wrote to memory of 1660	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	47
PID 2068 wrote to memory of 1660	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	47
PID 2068 wrote to memory of 1960	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1960	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1960	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	48
PID 2068 wrote to memory of 1404	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	49
PID 2068 wrote to memory of 1404	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	49
PID 2068 wrote to memory of 1404	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	49
PID 2068 wrote to memory of 2040	2068	0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0e29040b94d6a332058e877a631a7c88_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\System\argSVCQ.exe
  C:\Windows\System\argSVCQ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\Ayscwfi.exe
  C:\Windows\System\Ayscwfi.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\xAaQHjo.exe
  C:\Windows\System\xAaQHjo.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ssnMyyd.exe
  C:\Windows\System\ssnMyyd.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\iMswirZ.exe
  C:\Windows\System\iMswirZ.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\aWAEwip.exe
  C:\Windows\System\aWAEwip.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\wpbXBnV.exe
  C:\Windows\System\wpbXBnV.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\NsMtqjJ.exe
  C:\Windows\System\NsMtqjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\UVVRJfO.exe
  C:\Windows\System\UVVRJfO.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\TERqWBo.exe
  C:\Windows\System\TERqWBo.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\yOaBVmE.exe
  C:\Windows\System\yOaBVmE.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\oZtwfxA.exe
  C:\Windows\System\oZtwfxA.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\COMnWSo.exe
  C:\Windows\System\COMnWSo.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\ERsyQXU.exe
  C:\Windows\System\ERsyQXU.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\vsKsiyi.exe
  C:\Windows\System\vsKsiyi.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\jUAWYrF.exe
  C:\Windows\System\jUAWYrF.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\JMSiYuQ.exe
  C:\Windows\System\JMSiYuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\pceWeqU.exe
  C:\Windows\System\pceWeqU.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\HlyRLTk.exe
  C:\Windows\System\HlyRLTk.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\GAfxnSe.exe
  C:\Windows\System\GAfxnSe.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\TSOGbZw.exe
  C:\Windows\System\TSOGbZw.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\xiwSDEr.exe
  C:\Windows\System\xiwSDEr.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\lMbkVuC.exe
  C:\Windows\System\lMbkVuC.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\LgNNJzg.exe
  C:\Windows\System\LgNNJzg.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\ewoGAcD.exe
  C:\Windows\System\ewoGAcD.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\vMDiViY.exe
  C:\Windows\System\vMDiViY.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\dtJCxfT.exe
  C:\Windows\System\dtJCxfT.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\lKJkYLg.exe
  C:\Windows\System\lKJkYLg.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\mmvKNdE.exe
  C:\Windows\System\mmvKNdE.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\knMcNEi.exe
  C:\Windows\System\knMcNEi.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\zpoTpYt.exe
  C:\Windows\System\zpoTpYt.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\rFYGjkm.exe
  C:\Windows\System\rFYGjkm.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\aBRIPDE.exe
  C:\Windows\System\aBRIPDE.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\TIXBCOr.exe
  C:\Windows\System\TIXBCOr.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\BCQyLHR.exe
  C:\Windows\System\BCQyLHR.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\lMffyCW.exe
  C:\Windows\System\lMffyCW.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\EuiRFBZ.exe
  C:\Windows\System\EuiRFBZ.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\FsXKnof.exe
  C:\Windows\System\FsXKnof.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\PmhJhDv.exe
  C:\Windows\System\PmhJhDv.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\eXRjBhj.exe
  C:\Windows\System\eXRjBhj.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\YZVNbGq.exe
  C:\Windows\System\YZVNbGq.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\VwfBqfL.exe
  C:\Windows\System\VwfBqfL.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\ZPxkXuq.exe
  C:\Windows\System\ZPxkXuq.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\hYFOuzb.exe
  C:\Windows\System\hYFOuzb.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\TATrXne.exe
  C:\Windows\System\TATrXne.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\PZjBDCa.exe
  C:\Windows\System\PZjBDCa.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\MRVYTCd.exe
  C:\Windows\System\MRVYTCd.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\JWYCBfo.exe
  C:\Windows\System\JWYCBfo.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\NnXWmPW.exe
  C:\Windows\System\NnXWmPW.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\MCfpdIZ.exe
  C:\Windows\System\MCfpdIZ.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\sUrvFmL.exe
  C:\Windows\System\sUrvFmL.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\MmUtEOu.exe
  C:\Windows\System\MmUtEOu.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\KWUhVpe.exe
  C:\Windows\System\KWUhVpe.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\fITBqCq.exe
  C:\Windows\System\fITBqCq.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\mVkPzOf.exe
  C:\Windows\System\mVkPzOf.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\JyAKlYW.exe
  C:\Windows\System\JyAKlYW.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\rmTlCtd.exe
  C:\Windows\System\rmTlCtd.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\qqgWSpQ.exe
  C:\Windows\System\qqgWSpQ.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\pnOOwwJ.exe
  C:\Windows\System\pnOOwwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\WHdOovp.exe
  C:\Windows\System\WHdOovp.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\QQIobZd.exe
  C:\Windows\System\QQIobZd.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\pUdkzjp.exe
  C:\Windows\System\pUdkzjp.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\MaGZiDd.exe
  C:\Windows\System\MaGZiDd.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\mKCkqhj.exe
  C:\Windows\System\mKCkqhj.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\wJnefEw.exe
  C:\Windows\System\wJnefEw.exe
  2⤵
  PID:1628
- C:\Windows\System\LaoHmsp.exe
  C:\Windows\System\LaoHmsp.exe
  2⤵
  PID:3012
- C:\Windows\System\yUTKGVr.exe
  C:\Windows\System\yUTKGVr.exe
  2⤵
  PID:2824
- C:\Windows\System\PyfMEJY.exe
  C:\Windows\System\PyfMEJY.exe
  2⤵
  PID:1412
- C:\Windows\System\niUeWAu.exe
  C:\Windows\System\niUeWAu.exe
  2⤵
  PID:2168
- C:\Windows\System\ckPjHFV.exe
  C:\Windows\System\ckPjHFV.exe
  2⤵
  PID:1988
- C:\Windows\System\eXjcAZc.exe
  C:\Windows\System\eXjcAZc.exe
  2⤵
  PID:2348
- C:\Windows\System\PLxqMcU.exe
  C:\Windows\System\PLxqMcU.exe
  2⤵
  PID:2664
- C:\Windows\System\CYCKTRP.exe
  C:\Windows\System\CYCKTRP.exe
  2⤵
  PID:1096
- C:\Windows\System\Blcrwtp.exe
  C:\Windows\System\Blcrwtp.exe
  2⤵
  PID:2260
- C:\Windows\System\pywASfn.exe
  C:\Windows\System\pywASfn.exe
  2⤵
  PID:2128
- C:\Windows\System\pjooGAB.exe
  C:\Windows\System\pjooGAB.exe
  2⤵
  PID:516
- C:\Windows\System\XbTtiOg.exe
  C:\Windows\System\XbTtiOg.exe
  2⤵
  PID:2180
- C:\Windows\System\UfzIWem.exe
  C:\Windows\System\UfzIWem.exe
  2⤵
  PID:1828
- C:\Windows\System\fJRbvrS.exe
  C:\Windows\System\fJRbvrS.exe
  2⤵
  PID:1700
- C:\Windows\System\xIgueRB.exe
  C:\Windows\System\xIgueRB.exe
  2⤵
  PID:1436
- C:\Windows\System\xkyrQxS.exe
  C:\Windows\System\xkyrQxS.exe
  2⤵
  PID:1632
- C:\Windows\System\eGrcYSl.exe
  C:\Windows\System\eGrcYSl.exe
  2⤵
  PID:1152
- C:\Windows\System\RgSFrWQ.exe
  C:\Windows\System\RgSFrWQ.exe
  2⤵
  PID:2580
- C:\Windows\System\NPyzcMx.exe
  C:\Windows\System\NPyzcMx.exe
  2⤵
  PID:1560
- C:\Windows\System\dsWPlhn.exe
  C:\Windows\System\dsWPlhn.exe
  2⤵
  PID:2372
- C:\Windows\System\omsaMQw.exe
  C:\Windows\System\omsaMQw.exe
  2⤵
  PID:2896
- C:\Windows\System\qxZCcKz.exe
  C:\Windows\System\qxZCcKz.exe
  2⤵
  PID:1920
- C:\Windows\System\JQbhmPB.exe
  C:\Windows\System\JQbhmPB.exe
  2⤵
  PID:896
- C:\Windows\System\zpSDJYe.exe
  C:\Windows\System\zpSDJYe.exe
  2⤵
  PID:2236
- C:\Windows\System\ByhPoOE.exe
  C:\Windows\System\ByhPoOE.exe
  2⤵
  PID:1816
- C:\Windows\System\bnVNegB.exe
  C:\Windows\System\bnVNegB.exe
  2⤵
  PID:2044
- C:\Windows\System\oDKpCzc.exe
  C:\Windows\System\oDKpCzc.exe
  2⤵
  PID:2240
- C:\Windows\System\hvsvwIq.exe
  C:\Windows\System\hvsvwIq.exe
  2⤵
  PID:2908
- C:\Windows\System\bkdIaZb.exe
  C:\Windows\System\bkdIaZb.exe
  2⤵
  PID:1344
- C:\Windows\System\RANbVZD.exe
  C:\Windows\System\RANbVZD.exe
  2⤵
  PID:324
- C:\Windows\System\eixkzIz.exe
  C:\Windows\System\eixkzIz.exe
  2⤵
  PID:240
- C:\Windows\System\vhgccpO.exe
  C:\Windows\System\vhgccpO.exe
  2⤵
  PID:2268
- C:\Windows\System\skZEsQo.exe
  C:\Windows\System\skZEsQo.exe
  2⤵
  PID:1400
- C:\Windows\System\ZquVTdX.exe
  C:\Windows\System\ZquVTdX.exe
  2⤵
  PID:300
- C:\Windows\System\SYXKXVv.exe
  C:\Windows\System\SYXKXVv.exe
  2⤵
  PID:2088
- C:\Windows\System\leJlHRP.exe
  C:\Windows\System\leJlHRP.exe
  2⤵
  PID:2552
- C:\Windows\System\sVCkwuk.exe
  C:\Windows\System\sVCkwuk.exe
  2⤵
  PID:2600
- C:\Windows\System\BRbLtfZ.exe
  C:\Windows\System\BRbLtfZ.exe
  2⤵
  PID:1556
- C:\Windows\System\shjZTzg.exe
  C:\Windows\System\shjZTzg.exe
  2⤵
  PID:2440
- C:\Windows\System\eMXaCFZ.exe
  C:\Windows\System\eMXaCFZ.exe
  2⤵
  PID:2420
- C:\Windows\System\oqSkSCg.exe
  C:\Windows\System\oqSkSCg.exe
  2⤵
  PID:468
- C:\Windows\System\FUqxCSZ.exe
  C:\Windows\System\FUqxCSZ.exe
  2⤵
  PID:2384
- C:\Windows\System\pjGrGAX.exe
  C:\Windows\System\pjGrGAX.exe
  2⤵
  PID:1724
- C:\Windows\System\HVwFbzY.exe
  C:\Windows\System\HVwFbzY.exe
  2⤵
  PID:1316
- C:\Windows\System\DngJSmY.exe
  C:\Windows\System\DngJSmY.exe
  2⤵
  PID:1968
- C:\Windows\System\loIDPGa.exe
  C:\Windows\System\loIDPGa.exe
  2⤵
  PID:2676
- C:\Windows\System\kcDQVrp.exe
  C:\Windows\System\kcDQVrp.exe
  2⤵
  PID:2392
- C:\Windows\System\AJfViBq.exe
  C:\Windows\System\AJfViBq.exe
  2⤵
  PID:320
- C:\Windows\System\jrGkaZd.exe
  C:\Windows\System\jrGkaZd.exe
  2⤵
  PID:2920
- C:\Windows\System\RqAGRyN.exe
  C:\Windows\System\RqAGRyN.exe
  2⤵
  PID:2772
- C:\Windows\System\RbjvQLX.exe
  C:\Windows\System\RbjvQLX.exe
  2⤵
  PID:1956
- C:\Windows\System\FKnEYoV.exe
  C:\Windows\System\FKnEYoV.exe
  2⤵
  PID:3024
- C:\Windows\System\tjrRKBd.exe
  C:\Windows\System\tjrRKBd.exe
  2⤵
  PID:380
- C:\Windows\System\DAobnoQ.exe
  C:\Windows\System\DAobnoQ.exe
  2⤵
  PID:2196
- C:\Windows\System\pJkSGEl.exe
  C:\Windows\System\pJkSGEl.exe
  2⤵
  PID:2284
- C:\Windows\System\AscAVCj.exe
  C:\Windows\System\AscAVCj.exe
  2⤵
  PID:2272
- C:\Windows\System\keSOuFU.exe
  C:\Windows\System\keSOuFU.exe
  2⤵
  PID:2452
- C:\Windows\System\EnanvQX.exe
  C:\Windows\System\EnanvQX.exe
  2⤵
  PID:928
- C:\Windows\System\tOMxbFE.exe
  C:\Windows\System\tOMxbFE.exe
  2⤵
  PID:1076
- C:\Windows\System\CJfxOQO.exe
  C:\Windows\System\CJfxOQO.exe
  2⤵
  PID:1812
- C:\Windows\System\tGpqZxp.exe
  C:\Windows\System\tGpqZxp.exe
  2⤵
  PID:1756
- C:\Windows\System\rwHAVIN.exe
  C:\Windows\System\rwHAVIN.exe
  2⤵
  PID:2916
- C:\Windows\System\zweEAkw.exe
  C:\Windows\System\zweEAkw.exe
  2⤵
  PID:2336
- C:\Windows\System\yTKUrVg.exe
  C:\Windows\System\yTKUrVg.exe
  2⤵
  PID:1776
- C:\Windows\System\PSuLgqN.exe
  C:\Windows\System\PSuLgqN.exe
  2⤵
  PID:2404
- C:\Windows\System\JQOVBsk.exe
  C:\Windows\System\JQOVBsk.exe
  2⤵
  PID:2020
- C:\Windows\System\mFPCTMj.exe
  C:\Windows\System\mFPCTMj.exe
  2⤵
  PID:1004
- C:\Windows\System\VAWplrJ.exe
  C:\Windows\System\VAWplrJ.exe
  2⤵
  PID:1664
- C:\Windows\System\BDOFTDf.exe
  C:\Windows\System\BDOFTDf.exe
  2⤵
  PID:1256
- C:\Windows\System\EbzwVzl.exe
  C:\Windows\System\EbzwVzl.exe
  2⤵
  PID:2624
- C:\Windows\System\AVQXyGv.exe
  C:\Windows\System\AVQXyGv.exe
  2⤵
  PID:2756
- C:\Windows\System\gLWQLGy.exe
  C:\Windows\System\gLWQLGy.exe
  2⤵
  PID:1224
- C:\Windows\System\JROcDqy.exe
  C:\Windows\System\JROcDqy.exe
  2⤵
  PID:2400
- C:\Windows\System\BVIvKOb.exe
  C:\Windows\System\BVIvKOb.exe
  2⤵
  PID:2960
- C:\Windows\System\JTfdSKN.exe
  C:\Windows\System\JTfdSKN.exe
  2⤵
  PID:1964
- C:\Windows\System\mXJDOyx.exe
  C:\Windows\System\mXJDOyx.exe
  2⤵
  PID:2660
- C:\Windows\System\UqvJtLb.exe
  C:\Windows\System\UqvJtLb.exe
  2⤵
  PID:1476
- C:\Windows\System\LPNUCrp.exe
  C:\Windows\System\LPNUCrp.exe
  2⤵
  PID:936
- C:\Windows\System\dkDKnoy.exe
  C:\Windows\System\dkDKnoy.exe
  2⤵
  PID:2572
- C:\Windows\System\VBXJLzP.exe
  C:\Windows\System\VBXJLzP.exe
  2⤵
  PID:2084
- C:\Windows\System\QeLLQUv.exe
  C:\Windows\System\QeLLQUv.exe
  2⤵
  PID:2160
- C:\Windows\System\UjFEfjR.exe
  C:\Windows\System\UjFEfjR.exe
  2⤵
  PID:3060
- C:\Windows\System\YCOMAln.exe
  C:\Windows\System\YCOMAln.exe
  2⤵
  PID:3020
- C:\Windows\System\UdFryWO.exe
  C:\Windows\System\UdFryWO.exe
  2⤵
  PID:1764
- C:\Windows\System\UAoMLsc.exe
  C:\Windows\System\UAoMLsc.exe
  2⤵
  PID:2276
- C:\Windows\System\ekMXoif.exe
  C:\Windows\System\ekMXoif.exe
  2⤵
  PID:2724
- C:\Windows\System\nXEJTcu.exe
  C:\Windows\System\nXEJTcu.exe
  2⤵
  PID:1424
- C:\Windows\System\kwlDknI.exe
  C:\Windows\System\kwlDknI.exe
  2⤵
  PID:2300
- C:\Windows\System\kcmtmcB.exe
  C:\Windows\System\kcmtmcB.exe
  2⤵
  PID:2104
- C:\Windows\System\fEkxmDE.exe
  C:\Windows\System\fEkxmDE.exe
  2⤵
  PID:1376
- C:\Windows\System\vybYCHe.exe
  C:\Windows\System\vybYCHe.exe
  2⤵
  PID:1800
- C:\Windows\System\iYwAvAl.exe
  C:\Windows\System\iYwAvAl.exe
  2⤵
  PID:2792
- C:\Windows\System\mjzSpwj.exe
  C:\Windows\System\mjzSpwj.exe
  2⤵
  PID:2692
- C:\Windows\System\OZmQqKY.exe
  C:\Windows\System\OZmQqKY.exe
  2⤵
  PID:1992
- C:\Windows\System\MFkmatR.exe
  C:\Windows\System\MFkmatR.exe
  2⤵
  PID:3076
- C:\Windows\System\XeYZbpf.exe
  C:\Windows\System\XeYZbpf.exe
  2⤵
  PID:3092
- C:\Windows\System\PMokGqG.exe
  C:\Windows\System\PMokGqG.exe
  2⤵
  PID:3108
- C:\Windows\System\fafrFtx.exe
  C:\Windows\System\fafrFtx.exe
  2⤵
  PID:3124
- C:\Windows\System\Pugfpvz.exe
  C:\Windows\System\Pugfpvz.exe
  2⤵
  PID:3140
- C:\Windows\System\NdiiguS.exe
  C:\Windows\System\NdiiguS.exe
  2⤵
  PID:3156
- C:\Windows\System\jfqxTQc.exe
  C:\Windows\System\jfqxTQc.exe
  2⤵
  PID:3172
- C:\Windows\System\KdKnCay.exe
  C:\Windows\System\KdKnCay.exe
  2⤵
  PID:3192
- C:\Windows\System\jTMyxVm.exe
  C:\Windows\System\jTMyxVm.exe
  2⤵
  PID:3208
- C:\Windows\System\PQSOngc.exe
  C:\Windows\System\PQSOngc.exe
  2⤵
  PID:3228
- C:\Windows\System\NgMLyGG.exe
  C:\Windows\System\NgMLyGG.exe
  2⤵
  PID:3260
- C:\Windows\System\uBSDoPl.exe
  C:\Windows\System\uBSDoPl.exe
  2⤵
  PID:3276
- C:\Windows\System\djTyDvq.exe
  C:\Windows\System\djTyDvq.exe
  2⤵
  PID:3292
- C:\Windows\System\lgnHPQT.exe
  C:\Windows\System\lgnHPQT.exe
  2⤵
  PID:3308
- C:\Windows\System\zrWWaNs.exe
  C:\Windows\System\zrWWaNs.exe
  2⤵
  PID:3324
- C:\Windows\System\bRcPBaj.exe
  C:\Windows\System\bRcPBaj.exe
  2⤵
  PID:3340
- C:\Windows\System\ltpqMUO.exe
  C:\Windows\System\ltpqMUO.exe
  2⤵
  PID:3356
- C:\Windows\System\xMEfjqg.exe
  C:\Windows\System\xMEfjqg.exe
  2⤵
  PID:3372
- C:\Windows\System\pjkDTnt.exe
  C:\Windows\System\pjkDTnt.exe
  2⤵
  PID:3388
- C:\Windows\System\bVpWNIE.exe
  C:\Windows\System\bVpWNIE.exe
  2⤵
  PID:3404
- C:\Windows\System\aYPjHUC.exe
  C:\Windows\System\aYPjHUC.exe
  2⤵
  PID:3420
- C:\Windows\System\mdBijHV.exe
  C:\Windows\System\mdBijHV.exe
  2⤵
  PID:3436
- C:\Windows\System\yoMmIga.exe
  C:\Windows\System\yoMmIga.exe
  2⤵
  PID:3452
- C:\Windows\System\fDJcAhU.exe
  C:\Windows\System\fDJcAhU.exe
  2⤵
  PID:3468
- C:\Windows\System\fAGDGex.exe
  C:\Windows\System\fAGDGex.exe
  2⤵
  PID:3484
- C:\Windows\System\cnxRJmY.exe
  C:\Windows\System\cnxRJmY.exe
  2⤵
  PID:3504
- C:\Windows\System\dRKxSpZ.exe
  C:\Windows\System\dRKxSpZ.exe
  2⤵
  PID:3520
- C:\Windows\System\IqQxRJv.exe
  C:\Windows\System\IqQxRJv.exe
  2⤵
  PID:3536
- C:\Windows\System\zhYFUyR.exe
  C:\Windows\System\zhYFUyR.exe
  2⤵
  PID:3552
- C:\Windows\System\OBUPFxX.exe
  C:\Windows\System\OBUPFxX.exe
  2⤵
  PID:3572
- C:\Windows\System\bxxRFKY.exe
  C:\Windows\System\bxxRFKY.exe
  2⤵
  PID:3588
- C:\Windows\System\qfgFVQz.exe
  C:\Windows\System\qfgFVQz.exe
  2⤵
  PID:3604
- C:\Windows\System\BVFoFkr.exe
  C:\Windows\System\BVFoFkr.exe
  2⤵
  PID:3620
- C:\Windows\System\wiOJNVe.exe
  C:\Windows\System\wiOJNVe.exe
  2⤵
  PID:3636
- C:\Windows\System\ExnXdJF.exe
  C:\Windows\System\ExnXdJF.exe
  2⤵
  PID:3652
- C:\Windows\System\aPgIYRo.exe
  C:\Windows\System\aPgIYRo.exe
  2⤵
  PID:3668
- C:\Windows\System\tdoTkxQ.exe
  C:\Windows\System\tdoTkxQ.exe
  2⤵
  PID:3684
- C:\Windows\System\hoezAjX.exe
  C:\Windows\System\hoezAjX.exe
  2⤵
  PID:3700
- C:\Windows\System\CYmVhpF.exe
  C:\Windows\System\CYmVhpF.exe
  2⤵
  PID:3716
- C:\Windows\System\BPERUcx.exe
  C:\Windows\System\BPERUcx.exe
  2⤵
  PID:3732
- C:\Windows\System\CKulvNH.exe
  C:\Windows\System\CKulvNH.exe
  2⤵
  PID:3748
- C:\Windows\System\xHYUxPg.exe
  C:\Windows\System\xHYUxPg.exe
  2⤵
  PID:3764
- C:\Windows\System\TkLNkNs.exe
  C:\Windows\System\TkLNkNs.exe
  2⤵
  PID:3780
- C:\Windows\System\XwQTDxH.exe
  C:\Windows\System\XwQTDxH.exe
  2⤵
  PID:3796
- C:\Windows\System\pPXdtvz.exe
  C:\Windows\System\pPXdtvz.exe
  2⤵
  PID:3812
- C:\Windows\System\SaqdJou.exe
  C:\Windows\System\SaqdJou.exe
  2⤵
  PID:3828
- C:\Windows\System\YWfQuQX.exe
  C:\Windows\System\YWfQuQX.exe
  2⤵
  PID:3844
- C:\Windows\System\mLljTub.exe
  C:\Windows\System\mLljTub.exe
  2⤵
  PID:3860
- C:\Windows\System\HPAKIsX.exe
  C:\Windows\System\HPAKIsX.exe
  2⤵
  PID:3876
- C:\Windows\System\xioSPoz.exe
  C:\Windows\System\xioSPoz.exe
  2⤵
  PID:3892
- C:\Windows\System\sGuutCd.exe
  C:\Windows\System\sGuutCd.exe
  2⤵
  PID:3908
- C:\Windows\System\pArwvda.exe
  C:\Windows\System\pArwvda.exe
  2⤵
  PID:3924
- C:\Windows\System\muKTZhA.exe
  C:\Windows\System\muKTZhA.exe
  2⤵
  PID:3940
- C:\Windows\System\ahGcXgC.exe
  C:\Windows\System\ahGcXgC.exe
  2⤵
  PID:3956
- C:\Windows\System\HzhBICD.exe
  C:\Windows\System\HzhBICD.exe
  2⤵
  PID:3972
- C:\Windows\System\mAzauki.exe
  C:\Windows\System\mAzauki.exe
  2⤵
  PID:3988
- C:\Windows\System\sZUKIHM.exe
  C:\Windows\System\sZUKIHM.exe
  2⤵
  PID:4004
- C:\Windows\System\kHdNxdI.exe
  C:\Windows\System\kHdNxdI.exe
  2⤵
  PID:4020
- C:\Windows\System\VVhGbTO.exe
  C:\Windows\System\VVhGbTO.exe
  2⤵
  PID:4036
- C:\Windows\System\IIWkrbf.exe
  C:\Windows\System\IIWkrbf.exe
  2⤵
  PID:4052
- C:\Windows\System\OmRyAab.exe
  C:\Windows\System\OmRyAab.exe
  2⤵
  PID:4068
- C:\Windows\System\VcSpixw.exe
  C:\Windows\System\VcSpixw.exe
  2⤵
  PID:4084
- C:\Windows\System\RTFORih.exe
  C:\Windows\System\RTFORih.exe
  2⤵
  PID:2548
- C:\Windows\System\vaPcZSP.exe
  C:\Windows\System\vaPcZSP.exe
  2⤵
  PID:3132
- C:\Windows\System\rgycNjU.exe
  C:\Windows\System\rgycNjU.exe
  2⤵
  PID:3164
- C:\Windows\System\uEIYvdm.exe
  C:\Windows\System\uEIYvdm.exe
  2⤵
  PID:1640
- C:\Windows\System\vKHwHGx.exe
  C:\Windows\System\vKHwHGx.exe
  2⤵
  PID:2184
- C:\Windows\System\iImuUzR.exe
  C:\Windows\System\iImuUzR.exe
  2⤵
  PID:2604
- C:\Windows\System\rhJWUIJ.exe
  C:\Windows\System\rhJWUIJ.exe
  2⤵
  PID:3148
- C:\Windows\System\xLGaNFl.exe
  C:\Windows\System\xLGaNFl.exe
  2⤵
  PID:1716
- C:\Windows\System\aSSIQZe.exe
  C:\Windows\System\aSSIQZe.exe
  2⤵
  PID:1352
- C:\Windows\System\LWmBSwd.exe
  C:\Windows\System\LWmBSwd.exe
  2⤵
  PID:3188
- C:\Windows\System\AAXvGxM.exe
  C:\Windows\System\AAXvGxM.exe
  2⤵
  PID:1324
- C:\Windows\System\sFabZqV.exe
  C:\Windows\System\sFabZqV.exe
  2⤵
  PID:1624
- C:\Windows\System\zUUDVXQ.exe
  C:\Windows\System\zUUDVXQ.exe
  2⤵
  PID:3316
- C:\Windows\System\xVFIyZB.exe
  C:\Windows\System\xVFIyZB.exe
  2⤵
  PID:3352
- C:\Windows\System\IItnKyn.exe
  C:\Windows\System\IItnKyn.exe
  2⤵
  PID:3384
- C:\Windows\System\onhBauO.exe
  C:\Windows\System\onhBauO.exe
  2⤵
  PID:3448
- C:\Windows\System\KkFuozn.exe
  C:\Windows\System\KkFuozn.exe
  2⤵
  PID:3364
- C:\Windows\System\nHJVoIK.exe
  C:\Windows\System\nHJVoIK.exe
  2⤵
  PID:3428
- C:\Windows\System\PhhRfnj.exe
  C:\Windows\System\PhhRfnj.exe
  2⤵
  PID:3476
- C:\Windows\System\rcCryjx.exe
  C:\Windows\System\rcCryjx.exe
  2⤵
  PID:3496
- C:\Windows\System\nOMWzKl.exe
  C:\Windows\System\nOMWzKl.exe
  2⤵
  PID:3548
- C:\Windows\System\zqUakuf.exe
  C:\Windows\System\zqUakuf.exe
  2⤵
  PID:3528
- C:\Windows\System\CrfwPkc.exe
  C:\Windows\System\CrfwPkc.exe
  2⤵
  PID:3560
- C:\Windows\System\AvexuQd.exe
  C:\Windows\System\AvexuQd.exe
  2⤵
  PID:3708
- C:\Windows\System\WxRNnmi.exe
  C:\Windows\System\WxRNnmi.exe
  2⤵
  PID:3744
- C:\Windows\System\zTXYLhS.exe
  C:\Windows\System\zTXYLhS.exe
  2⤵
  PID:3804
- C:\Windows\System\iZjXrlx.exe
  C:\Windows\System\iZjXrlx.exe
  2⤵
  PID:3564
- C:\Windows\System\QMDYKyI.exe
  C:\Windows\System\QMDYKyI.exe
  2⤵
  PID:3660
- C:\Windows\System\eHZcJCb.exe
  C:\Windows\System\eHZcJCb.exe
  2⤵
  PID:3788
- C:\Windows\System\WTVCjbS.exe
  C:\Windows\System\WTVCjbS.exe
  2⤵
  PID:3692
- C:\Windows\System\iJonSTZ.exe
  C:\Windows\System\iJonSTZ.exe
  2⤵
  PID:2684
- C:\Windows\System\sZcMHmx.exe
  C:\Windows\System\sZcMHmx.exe
  2⤵
  PID:3868
- C:\Windows\System\mppCKyK.exe
  C:\Windows\System\mppCKyK.exe
  2⤵
  PID:3932
- C:\Windows\System\RPaDDrY.exe
  C:\Windows\System\RPaDDrY.exe
  2⤵
  PID:3996
- C:\Windows\System\dBatSFd.exe
  C:\Windows\System\dBatSFd.exe
  2⤵
  PID:3916
- C:\Windows\System\RHXDExv.exe
  C:\Windows\System\RHXDExv.exe
  2⤵
  PID:3888
- C:\Windows\System\LfbPatW.exe
  C:\Windows\System\LfbPatW.exe
  2⤵
  PID:4016
- C:\Windows\System\YFxqqzO.exe
  C:\Windows\System\YFxqqzO.exe
  2⤵
  PID:4060
- C:\Windows\System\LiWBmSz.exe
  C:\Windows\System\LiWBmSz.exe
  2⤵
  PID:4076
- C:\Windows\System\uwdqCMv.exe
  C:\Windows\System\uwdqCMv.exe
  2⤵
  PID:2800
- C:\Windows\System\jOiTFFg.exe
  C:\Windows\System\jOiTFFg.exe
  2⤵
  PID:2220
- C:\Windows\System\etCYgYY.exe
  C:\Windows\System\etCYgYY.exe
  2⤵
  PID:3240
- C:\Windows\System\WXDaFRI.exe
  C:\Windows\System\WXDaFRI.exe
  2⤵
  PID:1260
- C:\Windows\System\OtCvQCQ.exe
  C:\Windows\System\OtCvQCQ.exe
  2⤵
  PID:1740
- C:\Windows\System\KyKnmEz.exe
  C:\Windows\System\KyKnmEz.exe
  2⤵
  PID:3256
- C:\Windows\System\Xudqnqk.exe
  C:\Windows\System\Xudqnqk.exe
  2⤵
  PID:2584
- C:\Windows\System\kVjzkMj.exe
  C:\Windows\System\kVjzkMj.exe
  2⤵
  PID:3120
- C:\Windows\System\wMFQtjc.exe
  C:\Windows\System\wMFQtjc.exe
  2⤵
  PID:3272
- C:\Windows\System\bsAFMEF.exe
  C:\Windows\System\bsAFMEF.exe
  2⤵
  PID:3516
- C:\Windows\System\AXWtJEj.exe
  C:\Windows\System\AXWtJEj.exe
  2⤵
  PID:3464
- C:\Windows\System\mdACFxd.exe
  C:\Windows\System\mdACFxd.exe
  2⤵
  PID:3400
- C:\Windows\System\sdGdUEe.exe
  C:\Windows\System\sdGdUEe.exe
  2⤵
  PID:3740
- C:\Windows\System\GokulZB.exe
  C:\Windows\System\GokulZB.exe
  2⤵
  PID:3680
- C:\Windows\System\QVHnuon.exe
  C:\Windows\System\QVHnuon.exe
  2⤵
  PID:3760
- C:\Windows\System\IwPcotv.exe
  C:\Windows\System\IwPcotv.exe
  2⤵
  PID:3696
- C:\Windows\System\hBWtDvT.exe
  C:\Windows\System\hBWtDvT.exe
  2⤵
  PID:3900
- C:\Windows\System\VjfHKvE.exe
  C:\Windows\System\VjfHKvE.exe
  2⤵
  PID:4028
- C:\Windows\System\itfLCeL.exe
  C:\Windows\System\itfLCeL.exe
  2⤵
  PID:3952
- C:\Windows\System\WyeGQSP.exe
  C:\Windows\System\WyeGQSP.exe
  2⤵
  PID:4064
- C:\Windows\System\kcFlMCr.exe
  C:\Windows\System\kcFlMCr.exe
  2⤵
  PID:2932
- C:\Windows\System\ccbfsvU.exe
  C:\Windows\System\ccbfsvU.exe
  2⤵
  PID:2752
- C:\Windows\System\LLGMjjT.exe
  C:\Windows\System\LLGMjjT.exe
  2⤵
  PID:2608
- C:\Windows\System\EbEtjgm.exe
  C:\Windows\System\EbEtjgm.exe
  2⤵
  PID:3088
- C:\Windows\System\icPLYvQ.exe
  C:\Windows\System\icPLYvQ.exe
  2⤵
  PID:3480
- C:\Windows\System\PwYJjUS.exe
  C:\Windows\System\PwYJjUS.exe
  2⤵
  PID:3676
- C:\Windows\System\MlFmmIV.exe
  C:\Windows\System\MlFmmIV.exe
  2⤵
  PID:3612
- C:\Windows\System\LNaqkLj.exe
  C:\Windows\System\LNaqkLj.exe
  2⤵
  PID:3824
- C:\Windows\System\lbZSpsQ.exe
  C:\Windows\System\lbZSpsQ.exe
  2⤵
  PID:3632
- C:\Windows\System\tXYRgfI.exe
  C:\Windows\System\tXYRgfI.exe
  2⤵
  PID:4032
- C:\Windows\System\vWwtuZs.exe
  C:\Windows\System\vWwtuZs.exe
  2⤵
  PID:2304
- C:\Windows\System\HJbUZEC.exe
  C:\Windows\System\HJbUZEC.exe
  2⤵
  PID:3884
- C:\Windows\System\gcVrdkJ.exe
  C:\Windows\System\gcVrdkJ.exe
  2⤵
  PID:3500
- C:\Windows\System\FafhjZv.exe
  C:\Windows\System\FafhjZv.exe
  2⤵
  PID:3968
- C:\Windows\System\QgiqPaL.exe
  C:\Windows\System\QgiqPaL.exe
  2⤵
  PID:4012
- C:\Windows\System\TTJNvmX.exe
  C:\Windows\System\TTJNvmX.exe
  2⤵
  PID:3856
- C:\Windows\System\JzmLpDR.exe
  C:\Windows\System\JzmLpDR.exe
  2⤵
  PID:1940
- C:\Windows\System\DESOZxA.exe
  C:\Windows\System\DESOZxA.exe
  2⤵
  PID:2292
- C:\Windows\System\NlqaAwG.exe
  C:\Windows\System\NlqaAwG.exe
  2⤵
  PID:772
- C:\Windows\System\LqcavEL.exe
  C:\Windows\System\LqcavEL.exe
  2⤵
  PID:4112
- C:\Windows\System\JhukNqy.exe
  C:\Windows\System\JhukNqy.exe
  2⤵
  PID:4132
- C:\Windows\System\eiIAntB.exe
  C:\Windows\System\eiIAntB.exe
  2⤵
  PID:4148
- C:\Windows\System\YCGepej.exe
  C:\Windows\System\YCGepej.exe
  2⤵
  PID:4164
- C:\Windows\System\bRUfuXm.exe
  C:\Windows\System\bRUfuXm.exe
  2⤵
  PID:4180
- C:\Windows\System\smgtCiR.exe
  C:\Windows\System\smgtCiR.exe
  2⤵
  PID:4196
- C:\Windows\System\EkSBvOn.exe
  C:\Windows\System\EkSBvOn.exe
  2⤵
  PID:4212
- C:\Windows\System\QiZtzyf.exe
  C:\Windows\System\QiZtzyf.exe
  2⤵
  PID:4228
- C:\Windows\System\iopscvp.exe
  C:\Windows\System\iopscvp.exe
  2⤵
  PID:4244
- C:\Windows\System\IcZzoOO.exe
  C:\Windows\System\IcZzoOO.exe
  2⤵
  PID:4260
- C:\Windows\System\bjbnMzh.exe
  C:\Windows\System\bjbnMzh.exe
  2⤵
  PID:4276
- C:\Windows\System\TBBujkP.exe
  C:\Windows\System\TBBujkP.exe
  2⤵
  PID:4292
- C:\Windows\System\LCrkWJS.exe
  C:\Windows\System\LCrkWJS.exe
  2⤵
  PID:4308
- C:\Windows\System\UVqhlBW.exe
  C:\Windows\System\UVqhlBW.exe
  2⤵
  PID:4324
- C:\Windows\System\agSYgth.exe
  C:\Windows\System\agSYgth.exe
  2⤵
  PID:4340
- C:\Windows\System\qwZYZfj.exe
  C:\Windows\System\qwZYZfj.exe
  2⤵
  PID:4356
- C:\Windows\System\orlsyqE.exe
  C:\Windows\System\orlsyqE.exe
  2⤵
  PID:4372
- C:\Windows\System\vMGWBBP.exe
  C:\Windows\System\vMGWBBP.exe
  2⤵
  PID:4388
- C:\Windows\System\cCjORVG.exe
  C:\Windows\System\cCjORVG.exe
  2⤵
  PID:4404
- C:\Windows\System\sgJRWJH.exe
  C:\Windows\System\sgJRWJH.exe
  2⤵
  PID:4420
- C:\Windows\System\GdWxPzZ.exe
  C:\Windows\System\GdWxPzZ.exe
  2⤵
  PID:4436
- C:\Windows\System\OtwIUTG.exe
  C:\Windows\System\OtwIUTG.exe
  2⤵
  PID:4452
- C:\Windows\System\UcmUPTz.exe
  C:\Windows\System\UcmUPTz.exe
  2⤵
  PID:4468
- C:\Windows\System\sCgNElo.exe
  C:\Windows\System\sCgNElo.exe
  2⤵
  PID:4484
- C:\Windows\System\FMoGyiy.exe
  C:\Windows\System\FMoGyiy.exe
  2⤵
  PID:4500
- C:\Windows\System\yHvNgmf.exe
  C:\Windows\System\yHvNgmf.exe
  2⤵
  PID:4516
- C:\Windows\System\TYczmtD.exe
  C:\Windows\System\TYczmtD.exe
  2⤵
  PID:4532
- C:\Windows\System\SQQCGDN.exe
  C:\Windows\System\SQQCGDN.exe
  2⤵
  PID:4548
- C:\Windows\System\nOqQRCx.exe
  C:\Windows\System\nOqQRCx.exe
  2⤵
  PID:4564
- C:\Windows\System\vbovgMH.exe
  C:\Windows\System\vbovgMH.exe
  2⤵
  PID:4580
- C:\Windows\System\KTwEeRu.exe
  C:\Windows\System\KTwEeRu.exe
  2⤵
  PID:4596
- C:\Windows\System\Yilauzh.exe
  C:\Windows\System\Yilauzh.exe
  2⤵
  PID:4612
- C:\Windows\System\LYQnCDX.exe
  C:\Windows\System\LYQnCDX.exe
  2⤵
  PID:4628
- C:\Windows\System\AGHSbry.exe
  C:\Windows\System\AGHSbry.exe
  2⤵
  PID:4644
- C:\Windows\System\SXZotCe.exe
  C:\Windows\System\SXZotCe.exe
  2⤵
  PID:4660
- C:\Windows\System\DxYEZFi.exe
  C:\Windows\System\DxYEZFi.exe
  2⤵
  PID:4676
- C:\Windows\System\vaqPCwQ.exe
  C:\Windows\System\vaqPCwQ.exe
  2⤵
  PID:4692
- C:\Windows\System\rtEOnLr.exe
  C:\Windows\System\rtEOnLr.exe
  2⤵
  PID:4708
- C:\Windows\System\xqQFkys.exe
  C:\Windows\System\xqQFkys.exe
  2⤵
  PID:4728
- C:\Windows\System\ohCzJMC.exe
  C:\Windows\System\ohCzJMC.exe
  2⤵
  PID:4744
- C:\Windows\System\KXAXAnN.exe
  C:\Windows\System\KXAXAnN.exe
  2⤵
  PID:4760
- C:\Windows\System\RcpxfEU.exe
  C:\Windows\System\RcpxfEU.exe
  2⤵
  PID:4776
- C:\Windows\System\XcVcBYs.exe
  C:\Windows\System\XcVcBYs.exe
  2⤵
  PID:4792
- C:\Windows\System\WXIibLf.exe
  C:\Windows\System\WXIibLf.exe
  2⤵
  PID:4808
- C:\Windows\System\GmnHLXb.exe
  C:\Windows\System\GmnHLXb.exe
  2⤵
  PID:4824
- C:\Windows\System\QqafsSB.exe
  C:\Windows\System\QqafsSB.exe
  2⤵
  PID:4840
- C:\Windows\System\ETktpce.exe
  C:\Windows\System\ETktpce.exe
  2⤵
  PID:4856
- C:\Windows\System\ASZvKhk.exe
  C:\Windows\System\ASZvKhk.exe
  2⤵
  PID:4872
- C:\Windows\System\OtrPMBY.exe
  C:\Windows\System\OtrPMBY.exe
  2⤵
  PID:4888
- C:\Windows\System\wOvUyXx.exe
  C:\Windows\System\wOvUyXx.exe
  2⤵
  PID:4908
- C:\Windows\System\ZGcNDUS.exe
  C:\Windows\System\ZGcNDUS.exe
  2⤵
  PID:4924
- C:\Windows\System\kJweUal.exe
  C:\Windows\System\kJweUal.exe
  2⤵
  PID:4940
- C:\Windows\System\VKRVWPX.exe
  C:\Windows\System\VKRVWPX.exe
  2⤵
  PID:4956
- C:\Windows\System\gUbVpGp.exe
  C:\Windows\System\gUbVpGp.exe
  2⤵
  PID:4972
- C:\Windows\System\FEUtshc.exe
  C:\Windows\System\FEUtshc.exe
  2⤵
  PID:4988
- C:\Windows\System\aGRQcUB.exe
  C:\Windows\System\aGRQcUB.exe
  2⤵
  PID:5004
- C:\Windows\System\XRaDcHK.exe
  C:\Windows\System\XRaDcHK.exe
  2⤵
  PID:5020
- C:\Windows\System\IpGstpV.exe
  C:\Windows\System\IpGstpV.exe
  2⤵
  PID:5036
- C:\Windows\System\LwswTdj.exe
  C:\Windows\System\LwswTdj.exe
  2⤵
  PID:5052
- C:\Windows\System\tveMtqI.exe
  C:\Windows\System\tveMtqI.exe
  2⤵
  PID:5068
- C:\Windows\System\PmaXXQb.exe
  C:\Windows\System\PmaXXQb.exe
  2⤵
  PID:5084
- C:\Windows\System\eSLAWvr.exe
  C:\Windows\System\eSLAWvr.exe
  2⤵
  PID:5100
- C:\Windows\System\YjkyPIP.exe
  C:\Windows\System\YjkyPIP.exe
  2⤵
  PID:5116
- C:\Windows\System\XfdzCIs.exe
  C:\Windows\System\XfdzCIs.exe
  2⤵
  PID:4104
- C:\Windows\System\uiQrdJW.exe
  C:\Windows\System\uiQrdJW.exe
  2⤵
  PID:4144
- C:\Windows\System\cuRDomv.exe
  C:\Windows\System\cuRDomv.exe
  2⤵
  PID:3268
- C:\Windows\System\oZYgUtd.exe
  C:\Windows\System\oZYgUtd.exe
  2⤵
  PID:4172
- C:\Windows\System\IycYQas.exe
  C:\Windows\System\IycYQas.exe
  2⤵
  PID:4188
- C:\Windows\System\FsadwgB.exe
  C:\Windows\System\FsadwgB.exe
  2⤵
  PID:4208
- C:\Windows\System\YEvdkhf.exe
  C:\Windows\System\YEvdkhf.exe
  2⤵
  PID:4256
- C:\Windows\System\qWAJqzF.exe
  C:\Windows\System\qWAJqzF.exe
  2⤵
  PID:308
- C:\Windows\System\XdJBiuz.exe
  C:\Windows\System\XdJBiuz.exe
  2⤵
  PID:4304
- C:\Windows\System\dJWvXZw.exe
  C:\Windows\System\dJWvXZw.exe
  2⤵
  PID:4364
- C:\Windows\System\lsDSqNQ.exe
  C:\Windows\System\lsDSqNQ.exe
  2⤵
  PID:4320
- C:\Windows\System\XHGPSLW.exe
  C:\Windows\System\XHGPSLW.exe
  2⤵
  PID:4400
- C:\Windows\System\ujQidbe.exe
  C:\Windows\System\ujQidbe.exe
  2⤵
  PID:4460
- C:\Windows\System\GmtEyXg.exe
  C:\Windows\System\GmtEyXg.exe
  2⤵
  PID:4496
- C:\Windows\System\TgVYavP.exe
  C:\Windows\System\TgVYavP.exe
  2⤵
  PID:4448
- C:\Windows\System\vFqrHYY.exe
  C:\Windows\System\vFqrHYY.exe
  2⤵
  PID:4512
- C:\Windows\System\ksfKKPD.exe
  C:\Windows\System\ksfKKPD.exe
  2⤵
  PID:4560
- C:\Windows\System\ptPCHlp.exe
  C:\Windows\System\ptPCHlp.exe
  2⤵
  PID:4952
- C:\Windows\System\wenzilG.exe
  C:\Windows\System\wenzilG.exe
  2⤵
  PID:4724
- C:\Windows\System\lVBcdrB.exe
  C:\Windows\System\lVBcdrB.exe
  2⤵
  PID:4444
- C:\Windows\System\irwwnPV.exe
  C:\Windows\System\irwwnPV.exe
  2⤵
  PID:3100
- C:\Windows\System\JTUxDaV.exe
  C:\Windows\System\JTUxDaV.exe
  2⤵
  PID:5012
- C:\Windows\System\DgqXLEE.exe
  C:\Windows\System\DgqXLEE.exe
  2⤵
  PID:2784
- C:\Windows\System\vkTwsJd.exe
  C:\Windows\System\vkTwsJd.exe
  2⤵
  PID:5092
- C:\Windows\System\BaCEhRH.exe
  C:\Windows\System\BaCEhRH.exe
  2⤵
  PID:5080
- C:\Windows\System\qorwjse.exe
  C:\Windows\System\qorwjse.exe
  2⤵
  PID:4204
- C:\Windows\System\CdwoGBA.exe
  C:\Windows\System\CdwoGBA.exe
  2⤵
  PID:4672
- C:\Windows\System\nwBZVsk.exe
  C:\Windows\System\nwBZVsk.exe
  2⤵
  PID:4124
- C:\Windows\System\LPrqNlF.exe
  C:\Windows\System\LPrqNlF.exe
  2⤵
  PID:4268
- C:\Windows\System\yVYlyRL.exe
  C:\Windows\System\yVYlyRL.exe
  2⤵
  PID:4284
- C:\Windows\System\HfEmHWx.exe
  C:\Windows\System\HfEmHWx.exe
  2⤵
  PID:4396
- C:\Windows\System\trhqzjy.exe
  C:\Windows\System\trhqzjy.exe
  2⤵
  PID:4288
- C:\Windows\System\XOsqKOf.exe
  C:\Windows\System\XOsqKOf.exe
  2⤵
  PID:4528
- C:\Windows\System\REKFlZg.exe
  C:\Windows\System\REKFlZg.exe
  2⤵
  PID:4896
- C:\Windows\System\FKERuYJ.exe
  C:\Windows\System\FKERuYJ.exe
  2⤵
  PID:868
- C:\Windows\System\lvjhbwS.exe
  C:\Windows\System\lvjhbwS.exe
  2⤵
  PID:3432
- C:\Windows\System\cPueexY.exe
  C:\Windows\System\cPueexY.exe
  2⤵
  PID:4920
- C:\Windows\System\JefnKbb.exe
  C:\Windows\System\JefnKbb.exe
  2⤵
  PID:3068
- C:\Windows\System\VKXWARy.exe
  C:\Windows\System\VKXWARy.exe
  2⤵
  PID:5076
- C:\Windows\System\yvOYIwE.exe
  C:\Windows\System\yvOYIwE.exe
  2⤵
  PID:4700
- C:\Windows\System\ykzrDlp.exe
  C:\Windows\System\ykzrDlp.exe
  2⤵
  PID:4684
- C:\Windows\System\buqwmJm.exe
  C:\Windows\System\buqwmJm.exe
  2⤵
  PID:4588
- C:\Windows\System\YxCyvha.exe
  C:\Windows\System\YxCyvha.exe
  2⤵
  PID:4848
- C:\Windows\System\JSoPjXj.exe
  C:\Windows\System\JSoPjXj.exe
  2⤵
  PID:4884
- C:\Windows\System\FqRXaPm.exe
  C:\Windows\System\FqRXaPm.exe
  2⤵
  PID:4332
- C:\Windows\System\HRbECNv.exe
  C:\Windows\System\HRbECNv.exe
  2⤵
  PID:2668
- C:\Windows\System\HtLbBSB.exe
  C:\Windows\System\HtLbBSB.exe
  2⤵
  PID:4640
- C:\Windows\System\WRrLCSN.exe
  C:\Windows\System\WRrLCSN.exe
  2⤵
  PID:4968
- C:\Windows\System\SkfvVAR.exe
  C:\Windows\System\SkfvVAR.exe
  2⤵
  PID:3348
- C:\Windows\System\zIraKyt.exe
  C:\Windows\System\zIraKyt.exe
  2⤵
  PID:4656
- C:\Windows\System\nrNqbHO.exe
  C:\Windows\System\nrNqbHO.exe
  2⤵
  PID:4592
- C:\Windows\System\WdcckIw.exe
  C:\Windows\System\WdcckIw.exe
  2⤵
  PID:4668
- C:\Windows\System\gOgdgTN.exe
  C:\Windows\System\gOgdgTN.exe
  2⤵
  PID:4868
- C:\Windows\System\lCHjsNz.exe
  C:\Windows\System\lCHjsNz.exe
  2⤵
  PID:4784
- C:\Windows\System\itFLmTk.exe
  C:\Windows\System\itFLmTk.exe
  2⤵
  PID:5108
- C:\Windows\System\Wcidpcs.exe
  C:\Windows\System\Wcidpcs.exe
  2⤵
  PID:4836
- C:\Windows\System\KiEXtxa.exe
  C:\Windows\System\KiEXtxa.exe
  2⤵
  PID:4880
- C:\Windows\System\aIVtcyw.exe
  C:\Windows\System\aIVtcyw.exe
  2⤵
  PID:4492
- C:\Windows\System\pgmpwzq.exe
  C:\Windows\System\pgmpwzq.exe
  2⤵
  PID:4820
- C:\Windows\System\YCuGIbp.exe
  C:\Windows\System\YCuGIbp.exe
  2⤵
  PID:4236
- C:\Windows\System\pwTdaOb.exe
  C:\Windows\System\pwTdaOb.exe
  2⤵
  PID:2704
- C:\Windows\System\pwlwMrb.exe
  C:\Windows\System\pwlwMrb.exe
  2⤵
  PID:4636
- C:\Windows\System\WWFctmY.exe
  C:\Windows\System\WWFctmY.exe
  2⤵
  PID:4984
- C:\Windows\System\sswxyhj.exe
  C:\Windows\System\sswxyhj.exe
  2⤵
  PID:1688
- C:\Windows\System\DIzhHyP.exe
  C:\Windows\System\DIzhHyP.exe
  2⤵
  PID:616
- C:\Windows\System\sCUCRRn.exe
  C:\Windows\System\sCUCRRn.exe
  2⤵
  PID:108
- C:\Windows\System\YavlmYw.exe
  C:\Windows\System\YavlmYw.exe
  2⤵
  PID:4128
- C:\Windows\System\jqMbPJE.exe
  C:\Windows\System\jqMbPJE.exe
  2⤵
  PID:4816
- C:\Windows\System\ckbBEuP.exe
  C:\Windows\System\ckbBEuP.exe
  2⤵
  PID:4508
- C:\Windows\System\AZqcSiI.exe
  C:\Windows\System\AZqcSiI.exe
  2⤵
  PID:5128
- C:\Windows\System\tEicLbw.exe
  C:\Windows\System\tEicLbw.exe
  2⤵
  PID:5152
- C:\Windows\System\GOgspVv.exe
  C:\Windows\System\GOgspVv.exe
  2⤵
  PID:5168
- C:\Windows\System\cocNAwx.exe
  C:\Windows\System\cocNAwx.exe
  2⤵
  PID:5184
- C:\Windows\System\ULBnMmC.exe
  C:\Windows\System\ULBnMmC.exe
  2⤵
  PID:5200
- C:\Windows\System\krjxfNi.exe
  C:\Windows\System\krjxfNi.exe
  2⤵
  PID:5216
- C:\Windows\System\GkRAmyq.exe
  C:\Windows\System\GkRAmyq.exe
  2⤵
  PID:5232
- C:\Windows\System\lDPRtoA.exe
  C:\Windows\System\lDPRtoA.exe
  2⤵
  PID:5248
- C:\Windows\System\iwuRdJH.exe
  C:\Windows\System\iwuRdJH.exe
  2⤵
  PID:5264
- C:\Windows\System\WHMRVQT.exe
  C:\Windows\System\WHMRVQT.exe
  2⤵
  PID:5280
- C:\Windows\System\RZArpRH.exe
  C:\Windows\System\RZArpRH.exe
  2⤵
  PID:5296
- C:\Windows\System\TMITvxN.exe
  C:\Windows\System\TMITvxN.exe
  2⤵
  PID:5312
- C:\Windows\System\nFNrvPp.exe
  C:\Windows\System\nFNrvPp.exe
  2⤵
  PID:5328
- C:\Windows\System\qDOVfyd.exe
  C:\Windows\System\qDOVfyd.exe
  2⤵
  PID:5344
- C:\Windows\System\nJjfzsD.exe
  C:\Windows\System\nJjfzsD.exe
  2⤵
  PID:5360
- C:\Windows\System\nWsRiMl.exe
  C:\Windows\System\nWsRiMl.exe
  2⤵
  PID:5376
- C:\Windows\System\KgpKqee.exe
  C:\Windows\System\KgpKqee.exe
  2⤵
  PID:5392
- C:\Windows\System\bIwbTJN.exe
  C:\Windows\System\bIwbTJN.exe
  2⤵
  PID:5408
- C:\Windows\System\zDaRjto.exe
  C:\Windows\System\zDaRjto.exe
  2⤵
  PID:5424
- C:\Windows\System\YuGnbii.exe
  C:\Windows\System\YuGnbii.exe
  2⤵
  PID:5440
- C:\Windows\System\XhDxPCm.exe
  C:\Windows\System\XhDxPCm.exe
  2⤵
  PID:5456
- C:\Windows\System\dmfbcWN.exe
  C:\Windows\System\dmfbcWN.exe
  2⤵
  PID:5472
- C:\Windows\System\fVghpyD.exe
  C:\Windows\System\fVghpyD.exe
  2⤵
  PID:5488
- C:\Windows\System\GsXnuik.exe
  C:\Windows\System\GsXnuik.exe
  2⤵
  PID:5504
- C:\Windows\System\PqpDClu.exe
  C:\Windows\System\PqpDClu.exe
  2⤵
  PID:5520
- C:\Windows\System\vEgXujV.exe
  C:\Windows\System\vEgXujV.exe
  2⤵
  PID:5536
- C:\Windows\System\NjswDCP.exe
  C:\Windows\System\NjswDCP.exe
  2⤵
  PID:5552
- C:\Windows\System\jleeMWm.exe
  C:\Windows\System\jleeMWm.exe
  2⤵
  PID:5568
- C:\Windows\System\zlFZhPp.exe
  C:\Windows\System\zlFZhPp.exe
  2⤵
  PID:5584
- C:\Windows\System\EanIwud.exe
  C:\Windows\System\EanIwud.exe
  2⤵
  PID:5600
- C:\Windows\System\LTGlaKY.exe
  C:\Windows\System\LTGlaKY.exe
  2⤵
  PID:5616
- C:\Windows\System\KnZGBpI.exe
  C:\Windows\System\KnZGBpI.exe
  2⤵
  PID:5640
- C:\Windows\System\tRfsxQH.exe
  C:\Windows\System\tRfsxQH.exe
  2⤵
  PID:5656
- C:\Windows\System\vdnHyuF.exe
  C:\Windows\System\vdnHyuF.exe
  2⤵
  PID:5672
- C:\Windows\System\cnIkWTl.exe
  C:\Windows\System\cnIkWTl.exe
  2⤵
  PID:5688
- C:\Windows\System\NiAItnY.exe
  C:\Windows\System\NiAItnY.exe
  2⤵
  PID:5704
- C:\Windows\System\UnxDlSR.exe
  C:\Windows\System\UnxDlSR.exe
  2⤵
  PID:5720
- C:\Windows\System\AieDiwg.exe
  C:\Windows\System\AieDiwg.exe
  2⤵
  PID:5736
- C:\Windows\System\iJgUqqg.exe
  C:\Windows\System\iJgUqqg.exe
  2⤵
  PID:5752
- C:\Windows\System\guunqyn.exe
  C:\Windows\System\guunqyn.exe
  2⤵
  PID:5768
- C:\Windows\System\efJpNrk.exe
  C:\Windows\System\efJpNrk.exe
  2⤵
  PID:5784
- C:\Windows\System\WFtiVsQ.exe
  C:\Windows\System\WFtiVsQ.exe
  2⤵
  PID:5800
- C:\Windows\System\VnFoCZh.exe
  C:\Windows\System\VnFoCZh.exe
  2⤵
  PID:5816
- C:\Windows\System\CgjjEhf.exe
  C:\Windows\System\CgjjEhf.exe
  2⤵
  PID:5832
- C:\Windows\System\gEogahM.exe
  C:\Windows\System\gEogahM.exe
  2⤵
  PID:5848
- C:\Windows\System\REGYUVA.exe
  C:\Windows\System\REGYUVA.exe
  2⤵
  PID:5864
- C:\Windows\System\zpZtbXh.exe
  C:\Windows\System\zpZtbXh.exe
  2⤵
  PID:5880
- C:\Windows\System\rkohNEe.exe
  C:\Windows\System\rkohNEe.exe
  2⤵
  PID:5896
- C:\Windows\System\vpbSaYY.exe
  C:\Windows\System\vpbSaYY.exe
  2⤵
  PID:5912
- C:\Windows\System\AYovBvO.exe
  C:\Windows\System\AYovBvO.exe
  2⤵
  PID:5928
- C:\Windows\System\ZjXSkIV.exe
  C:\Windows\System\ZjXSkIV.exe
  2⤵
  PID:5952
- C:\Windows\System\sZSGCmY.exe
  C:\Windows\System\sZSGCmY.exe
  2⤵
  PID:5972
- C:\Windows\System\RXlpebZ.exe
  C:\Windows\System\RXlpebZ.exe
  2⤵
  PID:5480
- C:\Windows\System\dzoWcCs.exe
  C:\Windows\System\dzoWcCs.exe
  2⤵
  PID:5496
- C:\Windows\System\CSlhkFG.exe
  C:\Windows\System\CSlhkFG.exe
  2⤵
  PID:5564
- C:\Windows\System\ABBskVl.exe
  C:\Windows\System\ABBskVl.exe
  2⤵
  PID:5748
- C:\Windows\System\YOHKXbU.exe
  C:\Windows\System\YOHKXbU.exe
  2⤵
  PID:5700
- C:\Windows\System\FIXKSEb.exe
  C:\Windows\System\FIXKSEb.exe
  2⤵
  PID:5764
- C:\Windows\System\JVWVAiI.exe
  C:\Windows\System\JVWVAiI.exe
  2⤵
  PID:5732
- C:\Windows\System\sBAXHoy.exe
  C:\Windows\System\sBAXHoy.exe
  2⤵
  PID:5844
- C:\Windows\System\mMhfCAD.exe
  C:\Windows\System\mMhfCAD.exe
  2⤵
  PID:5908
- C:\Windows\System\JiMgYjH.exe
  C:\Windows\System\JiMgYjH.exe
  2⤵
  PID:5856
- C:\Windows\System\hXBfvvC.exe
  C:\Windows\System\hXBfvvC.exe
  2⤵
  PID:6008
- C:\Windows\System\PuukClM.exe
  C:\Windows\System\PuukClM.exe
  2⤵
  PID:6028
- C:\Windows\System\VClOPlk.exe
  C:\Windows\System\VClOPlk.exe
  2⤵
  PID:6056
- C:\Windows\System\xlmAJcE.exe
  C:\Windows\System\xlmAJcE.exe
  2⤵
  PID:6076
- C:\Windows\System\nKSQkRL.exe
  C:\Windows\System\nKSQkRL.exe
  2⤵
  PID:6096
- C:\Windows\System\qaqqGbL.exe
  C:\Windows\System\qaqqGbL.exe
  2⤵
  PID:6120
- C:\Windows\System\zLEBiHm.exe
  C:\Windows\System\zLEBiHm.exe
  2⤵
  PID:6136
- C:\Windows\System\NmWsEut.exe
  C:\Windows\System\NmWsEut.exe
  2⤵
  PID:5124
- C:\Windows\System\ZWJEIUJ.exe
  C:\Windows\System\ZWJEIUJ.exe
  2⤵
  PID:2504
- C:\Windows\System\koTRepg.exe
  C:\Windows\System\koTRepg.exe
  2⤵
  PID:5192
- C:\Windows\System\IGhOjkG.exe
  C:\Windows\System\IGhOjkG.exe
  2⤵
  PID:5244
- C:\Windows\System\hARVFEF.exe
  C:\Windows\System\hARVFEF.exe
  2⤵
  PID:5148
- C:\Windows\System\VrSLnXr.exe
  C:\Windows\System\VrSLnXr.exe
  2⤵
  PID:5288
- C:\Windows\System\MCThwEP.exe
  C:\Windows\System\MCThwEP.exe
  2⤵
  PID:5356
- C:\Windows\System\cqUmEoc.exe
  C:\Windows\System\cqUmEoc.exe
  2⤵
  PID:6040
- C:\Windows\System\qrFbUUR.exe
  C:\Windows\System\qrFbUUR.exe
  2⤵
  PID:5776
- C:\Windows\System\MZOFjdr.exe
  C:\Windows\System\MZOFjdr.exe
  2⤵
  PID:5904
- C:\Windows\System\ZfUMKjs.exe
  C:\Windows\System\ZfUMKjs.exe
  2⤵
  PID:5988
- C:\Windows\System\wdFPSvP.exe
  C:\Windows\System\wdFPSvP.exe
  2⤵
  PID:5828
- C:\Windows\System\nNYOgBU.exe
  C:\Windows\System\nNYOgBU.exe
  2⤵
  PID:6032
- C:\Windows\System\pSBVHdM.exe
  C:\Windows\System\pSBVHdM.exe
  2⤵
  PID:5308
- C:\Windows\System\FApTPUu.exe
  C:\Windows\System\FApTPUu.exe
  2⤵
  PID:5628
- C:\Windows\System\DqDAzYM.exe
  C:\Windows\System\DqDAzYM.exe
  2⤵
  PID:5464
- C:\Windows\System\hyZKtvX.exe
  C:\Windows\System\hyZKtvX.exe
  2⤵
  PID:5824
- C:\Windows\System\urTwXHJ.exe
  C:\Windows\System\urTwXHJ.exe
  2⤵
  PID:5548
- C:\Windows\System\GWLfFnp.exe
  C:\Windows\System\GWLfFnp.exe
  2⤵
  PID:5612
- C:\Windows\System\NvcxRxd.exe
  C:\Windows\System\NvcxRxd.exe
  2⤵
  PID:6048
- C:\Windows\System\yGUuMTA.exe
  C:\Windows\System\yGUuMTA.exe
  2⤵
  PID:5196
- C:\Windows\System\rNyWDeM.exe
  C:\Windows\System\rNyWDeM.exe
  2⤵
  PID:5032
- C:\Windows\System\GDiyHXZ.exe
  C:\Windows\System\GDiyHXZ.exe
  2⤵
  PID:4948
- C:\Windows\System\xjwAgoM.exe
  C:\Windows\System\xjwAgoM.exe
  2⤵
  PID:5176
- C:\Windows\System\MFNPqKB.exe
  C:\Windows\System\MFNPqKB.exe
  2⤵
  PID:5384
- C:\Windows\System\Jipufep.exe
  C:\Windows\System\Jipufep.exe
  2⤵
  PID:5272
- C:\Windows\System\LkZkqbP.exe
  C:\Windows\System\LkZkqbP.exe
  2⤵
  PID:5624
- C:\Windows\System\XEBwQBo.exe
  C:\Windows\System\XEBwQBo.exe
  2⤵
  PID:5968
- C:\Windows\System\ZMjTCvK.exe
  C:\Windows\System\ZMjTCvK.exe
  2⤵
  PID:5876
- C:\Windows\System\BWQftjv.exe
  C:\Windows\System\BWQftjv.exe
  2⤵
  PID:6108
- C:\Windows\System\GXuEXnc.exe
  C:\Windows\System\GXuEXnc.exe
  2⤵
  PID:284
- C:\Windows\System\cRZBHSD.exe
  C:\Windows\System\cRZBHSD.exe
  2⤵
  PID:5136
- C:\Windows\System\lGAFJQw.exe
  C:\Windows\System\lGAFJQw.exe
  2⤵
  PID:6080
- C:\Windows\System\rWASqok.exe
  C:\Windows\System\rWASqok.exe
  2⤵
  PID:5940
- C:\Windows\System\CDNogcX.exe
  C:\Windows\System\CDNogcX.exe
  2⤵
  PID:5892
- C:\Windows\System\HRqOQoh.exe
  C:\Windows\System\HRqOQoh.exe
  2⤵
  PID:5516
- C:\Windows\System\cHkOOeG.exe
  C:\Windows\System\cHkOOeG.exe
  2⤵
  PID:5368
- C:\Windows\System\yruqJhp.exe
  C:\Windows\System\yruqJhp.exe
  2⤵
  PID:5716
- C:\Windows\System\ocyzemZ.exe
  C:\Windows\System\ocyzemZ.exe
  2⤵
  PID:2672
- C:\Windows\System\FuhQYQS.exe
  C:\Windows\System\FuhQYQS.exe
  2⤵
  PID:5304
- C:\Windows\System\wXSStTi.exe
  C:\Windows\System\wXSStTi.exe
  2⤵
  PID:5840
- C:\Windows\System\MKPQghg.exe
  C:\Windows\System\MKPQghg.exe
  2⤵
  PID:4916
- C:\Windows\System\jnETAbP.exe
  C:\Windows\System\jnETAbP.exe
  2⤵
  PID:5992
- C:\Windows\System\CoqhDUy.exe
  C:\Windows\System\CoqhDUy.exe
  2⤵
  PID:5636
- C:\Windows\System\yvzdFuT.exe
  C:\Windows\System\yvzdFuT.exe
  2⤵
  PID:5212
- C:\Windows\System\FdbHclr.exe
  C:\Windows\System\FdbHclr.exe
  2⤵
  PID:6020
- C:\Windows\System\wnGhnFm.exe
  C:\Windows\System\wnGhnFm.exe
  2⤵
  PID:6012
- C:\Windows\System\PnZLOYE.exe
  C:\Windows\System\PnZLOYE.exe
  2⤵
  PID:5224
- C:\Windows\System\OVRrCGi.exe
  C:\Windows\System\OVRrCGi.exe
  2⤵
  PID:5164
- C:\Windows\System\bKEadBO.exe
  C:\Windows\System\bKEadBO.exe
  2⤵
  PID:6128
- C:\Windows\System\YgwNjTl.exe
  C:\Windows\System\YgwNjTl.exe
  2⤵
  PID:5684
- C:\Windows\System\xmbMLUp.exe
  C:\Windows\System\xmbMLUp.exe
  2⤵
  PID:5792
- C:\Windows\System\ZeaOEmq.exe
  C:\Windows\System\ZeaOEmq.exe
  2⤵
  PID:6152
- C:\Windows\System\vizZRVu.exe
  C:\Windows\System\vizZRVu.exe
  2⤵
  PID:6168
- C:\Windows\System\DsodsAx.exe
  C:\Windows\System\DsodsAx.exe
  2⤵
  PID:6188
- C:\Windows\System\AmKLhyx.exe
  C:\Windows\System\AmKLhyx.exe
  2⤵
  PID:6212
- C:\Windows\System\VszvVrN.exe
  C:\Windows\System\VszvVrN.exe
  2⤵
  PID:6284
- C:\Windows\System\CynWdJq.exe
  C:\Windows\System\CynWdJq.exe
  2⤵
  PID:6300
- C:\Windows\System\qGORpTI.exe
  C:\Windows\System\qGORpTI.exe
  2⤵
  PID:6316
- C:\Windows\System\MaTpIdt.exe
  C:\Windows\System\MaTpIdt.exe
  2⤵
  PID:6332
- C:\Windows\System\YHrfngy.exe
  C:\Windows\System\YHrfngy.exe
  2⤵
  PID:6352
- C:\Windows\System\mFAHGty.exe
  C:\Windows\System\mFAHGty.exe
  2⤵
  PID:6368
- C:\Windows\System\yDmuIjx.exe
  C:\Windows\System\yDmuIjx.exe
  2⤵
  PID:6384
- C:\Windows\System\VXryWqt.exe
  C:\Windows\System\VXryWqt.exe
  2⤵
  PID:6408
- C:\Windows\System\PEwkxIk.exe
  C:\Windows\System\PEwkxIk.exe
  2⤵
  PID:6424
- C:\Windows\System\ItlWwGq.exe
  C:\Windows\System\ItlWwGq.exe
  2⤵
  PID:6444
- C:\Windows\System\SOcsVsw.exe
  C:\Windows\System\SOcsVsw.exe
  2⤵
  PID:6460
- C:\Windows\System\jbHnWFB.exe
  C:\Windows\System\jbHnWFB.exe
  2⤵
  PID:6480
- C:\Windows\System\nuymLnu.exe
  C:\Windows\System\nuymLnu.exe
  2⤵
  PID:6500
- C:\Windows\System\LJqvhKU.exe
  C:\Windows\System\LJqvhKU.exe
  2⤵
  PID:6540
- C:\Windows\System\OHKwQgW.exe
  C:\Windows\System\OHKwQgW.exe
  2⤵
  PID:6556
- C:\Windows\System\EInLeEx.exe
  C:\Windows\System\EInLeEx.exe
  2⤵
  PID:6576
- C:\Windows\System\gypZJrC.exe
  C:\Windows\System\gypZJrC.exe
  2⤵
  PID:6592
- C:\Windows\System\YXKlcYC.exe
  C:\Windows\System\YXKlcYC.exe
  2⤵
  PID:6608
- C:\Windows\System\ZZJmsqy.exe
  C:\Windows\System\ZZJmsqy.exe
  2⤵
  PID:6628
- C:\Windows\System\EJzUtOt.exe
  C:\Windows\System\EJzUtOt.exe
  2⤵
  PID:6660
- C:\Windows\System\KLrPXUW.exe
  C:\Windows\System\KLrPXUW.exe
  2⤵
  PID:6676
- C:\Windows\System\UXpauPE.exe
  C:\Windows\System\UXpauPE.exe
  2⤵
  PID:6712
- C:\Windows\System\TuPGIAr.exe
  C:\Windows\System\TuPGIAr.exe
  2⤵
  PID:6728
- C:\Windows\System\cBEdqYB.exe
  C:\Windows\System\cBEdqYB.exe
  2⤵
  PID:6772
- C:\Windows\System\fCJpliS.exe
  C:\Windows\System\fCJpliS.exe
  2⤵
  PID:6788
- C:\Windows\System\EHWUnLW.exe
  C:\Windows\System\EHWUnLW.exe
  2⤵
  PID:6808
- C:\Windows\System\tqkNVOh.exe
  C:\Windows\System\tqkNVOh.exe
  2⤵
  PID:6824
- C:\Windows\System\tbmDkPh.exe
  C:\Windows\System\tbmDkPh.exe
  2⤵
  PID:6840
- C:\Windows\System\hVlrjeh.exe
  C:\Windows\System\hVlrjeh.exe
  2⤵
  PID:6856
- C:\Windows\System\SrmMOHW.exe
  C:\Windows\System\SrmMOHW.exe
  2⤵
  PID:6876
- C:\Windows\System\doNmZVt.exe
  C:\Windows\System\doNmZVt.exe
  2⤵
  PID:6892
- C:\Windows\System\DODgzsO.exe
  C:\Windows\System\DODgzsO.exe
  2⤵
  PID:6908
- C:\Windows\System\brSKHKu.exe
  C:\Windows\System\brSKHKu.exe
  2⤵
  PID:6980
- C:\Windows\System\KhFyqtU.exe
  C:\Windows\System\KhFyqtU.exe
  2⤵
  PID:6996
- C:\Windows\System\IWBsYFw.exe
  C:\Windows\System\IWBsYFw.exe
  2⤵
  PID:7012
- C:\Windows\System\yJmNPwx.exe
  C:\Windows\System\yJmNPwx.exe
  2⤵
  PID:7048
- C:\Windows\System\aFMwsLV.exe
  C:\Windows\System\aFMwsLV.exe
  2⤵
  PID:7072
- C:\Windows\System\upyjLYZ.exe
  C:\Windows\System\upyjLYZ.exe
  2⤵
  PID:7092
- C:\Windows\System\xwkwMHJ.exe
  C:\Windows\System\xwkwMHJ.exe
  2⤵
  PID:7128
- C:\Windows\System\AYMMxVj.exe
  C:\Windows\System\AYMMxVj.exe
  2⤵
  PID:7144
- C:\Windows\System\MtZCwxn.exe
  C:\Windows\System\MtZCwxn.exe
  2⤵
  PID:7160
- C:\Windows\System\IDlAMJj.exe
  C:\Windows\System\IDlAMJj.exe
  2⤵
  PID:6148
- C:\Windows\System\sSAYQxa.exe
  C:\Windows\System\sSAYQxa.exe
  2⤵
  PID:4900
- C:\Windows\System\FKanepv.exe
  C:\Windows\System\FKanepv.exe
  2⤵
  PID:6204
- C:\Windows\System\aJDxADa.exe
  C:\Windows\System\aJDxADa.exe
  2⤵
  PID:6160
- C:\Windows\System\xSBMxva.exe
  C:\Windows\System\xSBMxva.exe
  2⤵
  PID:5924
- C:\Windows\System\zXDDUwR.exe
  C:\Windows\System\zXDDUwR.exe
  2⤵
  PID:6224
- C:\Windows\System\lgnanty.exe
  C:\Windows\System\lgnanty.exe
  2⤵
  PID:6240
- C:\Windows\System\YiQYxHV.exe
  C:\Windows\System\YiQYxHV.exe
  2⤵
  PID:6256
- C:\Windows\System\sFFBeWy.exe
  C:\Windows\System\sFFBeWy.exe
  2⤵
  PID:6280
- C:\Windows\System\ZEeUdFq.exe
  C:\Windows\System\ZEeUdFq.exe
  2⤵
  PID:6296
- C:\Windows\System\jhboAxE.exe
  C:\Windows\System\jhboAxE.exe
  2⤵
  PID:6360
- C:\Windows\System\PUURPBW.exe
  C:\Windows\System\PUURPBW.exe
  2⤵
  PID:6432
- C:\Windows\System\YydPHkV.exe
  C:\Windows\System\YydPHkV.exe
  2⤵
  PID:6468
- C:\Windows\System\FsFhzNB.exe
  C:\Windows\System\FsFhzNB.exe
  2⤵
  PID:6584
- C:\Windows\System\RpHHXge.exe
  C:\Windows\System\RpHHXge.exe
  2⤵
  PID:6516
- C:\Windows\System\kZloBHZ.exe
  C:\Windows\System\kZloBHZ.exe
  2⤵
  PID:6572
- C:\Windows\System\nscqDFo.exe
  C:\Windows\System\nscqDFo.exe
  2⤵
  PID:6620
- C:\Windows\System\ekLQsQR.exe
  C:\Windows\System\ekLQsQR.exe
  2⤵
  PID:6648
- C:\Windows\System\YizSSDX.exe
  C:\Windows\System\YizSSDX.exe
  2⤵
  PID:6668
- C:\Windows\System\kShIMuu.exe
  C:\Windows\System\kShIMuu.exe
  2⤵
  PID:6700
- C:\Windows\System\XNHNSNc.exe
  C:\Windows\System\XNHNSNc.exe
  2⤵
  PID:6848
- C:\Windows\System\InCvDcZ.exe
  C:\Windows\System\InCvDcZ.exe
  2⤵
  PID:6748
- C:\Windows\System\BicQCce.exe
  C:\Windows\System\BicQCce.exe
  2⤵
  PID:6796
- C:\Windows\System\qWdKTIA.exe
  C:\Windows\System\qWdKTIA.exe
  2⤵
  PID:6760
- C:\Windows\System\QapSlSt.exe
  C:\Windows\System\QapSlSt.exe
  2⤵
  PID:6904
- C:\Windows\System\RaSsyhH.exe
  C:\Windows\System\RaSsyhH.exe
  2⤵
  PID:6920
- C:\Windows\System\cZvcJKH.exe
  C:\Windows\System\cZvcJKH.exe
  2⤵
  PID:6932
- C:\Windows\System\fCMTArr.exe
  C:\Windows\System\fCMTArr.exe
  2⤵
  PID:6948
- C:\Windows\System\ijMLYXv.exe
  C:\Windows\System\ijMLYXv.exe
  2⤵
  PID:7004
- C:\Windows\System\wGEClgQ.exe
  C:\Windows\System\wGEClgQ.exe
  2⤵
  PID:7060
- C:\Windows\System\npQsExH.exe
  C:\Windows\System\npQsExH.exe
  2⤵
  PID:6992
- C:\Windows\System\vwcblkg.exe
  C:\Windows\System\vwcblkg.exe
  2⤵
  PID:7032
- C:\Windows\System\DZiahuO.exe
  C:\Windows\System\DZiahuO.exe
  2⤵
  PID:7088
- C:\Windows\System\kpVUKTx.exe
  C:\Windows\System\kpVUKTx.exe
  2⤵
  PID:7120
- C:\Windows\System\ZYMIsbO.exe
  C:\Windows\System\ZYMIsbO.exe
  2⤵
  PID:6180
- C:\Windows\System\xpnKuBF.exe
  C:\Windows\System\xpnKuBF.exe
  2⤵
  PID:6196
- C:\Windows\System\vuoPOKp.exe
  C:\Windows\System\vuoPOKp.exe
  2⤵
  PID:6024
- C:\Windows\System\WgSuotd.exe
  C:\Windows\System\WgSuotd.exe
  2⤵
  PID:7140
- C:\Windows\System\EXEKePF.exe
  C:\Windows\System\EXEKePF.exe
  2⤵
  PID:6236
- C:\Windows\System\EgdzdvQ.exe
  C:\Windows\System\EgdzdvQ.exe
  2⤵
  PID:6308
- C:\Windows\System\oGnUDPH.exe
  C:\Windows\System\oGnUDPH.exe
  2⤵
  PID:6348
- C:\Windows\System\aAKOLor.exe
  C:\Windows\System\aAKOLor.exe
  2⤵
  PID:6220
- C:\Windows\System\CcApfRU.exe
  C:\Windows\System\CcApfRU.exe
  2⤵
  PID:6364
- C:\Windows\System\tiAjcCv.exe
  C:\Windows\System\tiAjcCv.exe
  2⤵
  PID:6396
- C:\Windows\System\pUFvFOg.exe
  C:\Windows\System\pUFvFOg.exe
  2⤵
  PID:6488
- C:\Windows\System\DevJMgI.exe
  C:\Windows\System\DevJMgI.exe
  2⤵
  PID:6968
- C:\Windows\System\ThpIeHs.exe
  C:\Windows\System\ThpIeHs.exe
  2⤵
  PID:6436
- C:\Windows\System\uMkttCF.exe
  C:\Windows\System\uMkttCF.exe
  2⤵
  PID:6724
- C:\Windows\System\TXDPNLi.exe
  C:\Windows\System\TXDPNLi.exe
  2⤵
  PID:7080
- C:\Windows\System\wKZmvds.exe
  C:\Windows\System\wKZmvds.exe
  2⤵
  PID:5260
- C:\Windows\System\WmeurCR.exe
  C:\Windows\System\WmeurCR.exe
  2⤵
  PID:7108
- C:\Windows\System\AhbyIMN.exe
  C:\Windows\System\AhbyIMN.exe
  2⤵
  PID:6252
- C:\Windows\System\jceGZiw.exe
  C:\Windows\System\jceGZiw.exe
  2⤵
  PID:7136
- C:\Windows\System\btqivFu.exe
  C:\Windows\System\btqivFu.exe
  2⤵
  PID:6376
- C:\Windows\System\cbMPRjq.exe
  C:\Windows\System\cbMPRjq.exe
  2⤵
  PID:2032
- C:\Windows\System\yIlJQks.exe
  C:\Windows\System\yIlJQks.exe
  2⤵
  PID:6272
- C:\Windows\System\Pduneoy.exe
  C:\Windows\System\Pduneoy.exe
  2⤵
  PID:6548
- C:\Windows\System\MyKKcKY.exe
  C:\Windows\System\MyKKcKY.exe
  2⤵
  PID:6624
- C:\Windows\System\bilCaQv.exe
  C:\Windows\System\bilCaQv.exe
  2⤵
  PID:6916
- C:\Windows\System\XyCIThL.exe
  C:\Windows\System\XyCIThL.exe
  2⤵
  PID:7176
- C:\Windows\System\CiMTpCA.exe
  C:\Windows\System\CiMTpCA.exe
  2⤵
  PID:7192
- C:\Windows\System\BfEpZxa.exe
  C:\Windows\System\BfEpZxa.exe
  2⤵
  PID:7212
- C:\Windows\System\sRVeqnO.exe
  C:\Windows\System\sRVeqnO.exe
  2⤵
  PID:7228
- C:\Windows\System\xwVHGnM.exe
  C:\Windows\System\xwVHGnM.exe
  2⤵
  PID:7244
- C:\Windows\System\UOqXYBM.exe
  C:\Windows\System\UOqXYBM.exe
  2⤵
  PID:7260
- C:\Windows\System\qCLplyT.exe
  C:\Windows\System\qCLplyT.exe
  2⤵
  PID:7276
- C:\Windows\System\pyMMgXu.exe
  C:\Windows\System\pyMMgXu.exe
  2⤵
  PID:7292
- C:\Windows\System\YdzGUjJ.exe
  C:\Windows\System\YdzGUjJ.exe
  2⤵
  PID:7372
- C:\Windows\System\hpvvcWs.exe
  C:\Windows\System\hpvvcWs.exe
  2⤵
  PID:7392
- C:\Windows\System\MRLPCUw.exe
  C:\Windows\System\MRLPCUw.exe
  2⤵
  PID:7420
- C:\Windows\System\JktnYGx.exe
  C:\Windows\System\JktnYGx.exe
  2⤵
  PID:7436
- C:\Windows\System\KAxiVAd.exe
  C:\Windows\System\KAxiVAd.exe
  2⤵
  PID:7464
- C:\Windows\System\owTAJjj.exe
  C:\Windows\System\owTAJjj.exe
  2⤵
  PID:7480
- C:\Windows\System\QNwHHDU.exe
  C:\Windows\System\QNwHHDU.exe
  2⤵
  PID:7496
- C:\Windows\System\pdgHwPz.exe
  C:\Windows\System\pdgHwPz.exe
  2⤵
  PID:7816
- C:\Windows\System\gaIsrOE.exe
  C:\Windows\System\gaIsrOE.exe
  2⤵
  PID:7832
- C:\Windows\System\DmCcxDQ.exe
  C:\Windows\System\DmCcxDQ.exe
  2⤵
  PID:7848
- C:\Windows\System\zUrsrGs.exe
  C:\Windows\System\zUrsrGs.exe
  2⤵
  PID:7864
- C:\Windows\System\fDARizz.exe
  C:\Windows\System\fDARizz.exe
  2⤵
  PID:7880
- C:\Windows\System\YiDmvpN.exe
  C:\Windows\System\YiDmvpN.exe
  2⤵
  PID:7896
- C:\Windows\System\LPdAbUE.exe
  C:\Windows\System\LPdAbUE.exe
  2⤵
  PID:7912
- C:\Windows\System\JtHFHAa.exe
  C:\Windows\System\JtHFHAa.exe
  2⤵
  PID:7928
- C:\Windows\System\kMIVsaG.exe
  C:\Windows\System\kMIVsaG.exe
  2⤵
  PID:7944
- C:\Windows\System\qLCBaaK.exe
  C:\Windows\System\qLCBaaK.exe
  2⤵
  PID:7976
- C:\Windows\System\FPiybyH.exe
  C:\Windows\System\FPiybyH.exe
  2⤵
  PID:7992
- C:\Windows\System\uZyeHCK.exe
  C:\Windows\System\uZyeHCK.exe
  2⤵
  PID:8012
- C:\Windows\System\uDeYota.exe
  C:\Windows\System\uDeYota.exe
  2⤵
  PID:8044
- C:\Windows\System\kONhjyo.exe
  C:\Windows\System\kONhjyo.exe
  2⤵
  PID:8060
- C:\Windows\System\gbwJSiO.exe
  C:\Windows\System\gbwJSiO.exe
  2⤵
  PID:8168
- C:\Windows\System\DcnBBpI.exe
  C:\Windows\System\DcnBBpI.exe
  2⤵
  PID:7036
- C:\Windows\System\lbmbKVJ.exe
  C:\Windows\System\lbmbKVJ.exe
  2⤵
  PID:6960
- C:\Windows\System\meeSCpj.exe
  C:\Windows\System\meeSCpj.exe
  2⤵
  PID:6764
- C:\Windows\System\EYaLKic.exe
  C:\Windows\System\EYaLKic.exe
  2⤵
  PID:6324
- C:\Windows\System\DqafyGQ.exe
  C:\Windows\System\DqafyGQ.exe
  2⤵
  PID:7220
- C:\Windows\System\kMxhDKj.exe
  C:\Windows\System\kMxhDKj.exe
  2⤵
  PID:7288
- C:\Windows\System\Zkjrtlt.exe
  C:\Windows\System\Zkjrtlt.exe
  2⤵
  PID:7152
- C:\Windows\System\hOghPOc.exe
  C:\Windows\System\hOghPOc.exe
  2⤵
  PID:6312
- C:\Windows\System\FdrfYNu.exe
  C:\Windows\System\FdrfYNu.exe
  2⤵
  PID:6888
- C:\Windows\System\DrUCxmT.exe
  C:\Windows\System\DrUCxmT.exe
  2⤵
  PID:6784
- C:\Windows\System\mNxkrHf.exe
  C:\Windows\System\mNxkrHf.exe
  2⤵
  PID:7172
- C:\Windows\System\kuhLXfv.exe
  C:\Windows\System\kuhLXfv.exe
  2⤵
  PID:7268
- C:\Windows\System\cwiwLbx.exe
  C:\Windows\System\cwiwLbx.exe
  2⤵
  PID:7328
- C:\Windows\System\wjQHMKr.exe
  C:\Windows\System\wjQHMKr.exe
  2⤵
  PID:7352
- C:\Windows\System\hWntIta.exe
  C:\Windows\System\hWntIta.exe
  2⤵
  PID:7428
- C:\Windows\System\QKAkARj.exe
  C:\Windows\System\QKAkARj.exe
  2⤵
  PID:7516
- C:\Windows\System\KEFrpaW.exe
  C:\Windows\System\KEFrpaW.exe
  2⤵
  PID:7520
- C:\Windows\System\xKfamWf.exe
  C:\Windows\System\xKfamWf.exe
  2⤵
  PID:7576
- C:\Windows\System\sfBArvi.exe
  C:\Windows\System\sfBArvi.exe
  2⤵
  PID:7596
- C:\Windows\System\XIrssGt.exe
  C:\Windows\System\XIrssGt.exe
  2⤵
  PID:7608
- C:\Windows\System\teWdbqG.exe
  C:\Windows\System\teWdbqG.exe
  2⤵
  PID:7448
- C:\Windows\System\juvNLGG.exe
  C:\Windows\System\juvNLGG.exe
  2⤵
  PID:7640
- C:\Windows\System\nKmMlSF.exe
  C:\Windows\System\nKmMlSF.exe
  2⤵
  PID:7628
- C:\Windows\System\dRDgAVo.exe
  C:\Windows\System\dRDgAVo.exe
  2⤵
  PID:6740
- C:\Windows\System\qszAjrR.exe
  C:\Windows\System\qszAjrR.exe
  2⤵
  PID:7356
- C:\Windows\System\uElwKWG.exe
  C:\Windows\System\uElwKWG.exe
  2⤵
  PID:7684
- C:\Windows\System\ybtwOFc.exe
  C:\Windows\System\ybtwOFc.exe
  2⤵
  PID:7724
- C:\Windows\System\lDDYklT.exe
  C:\Windows\System\lDDYklT.exe
  2⤵
  PID:7736
- C:\Windows\System\yUqOsZT.exe
  C:\Windows\System\yUqOsZT.exe
  2⤵
  PID:7792
- C:\Windows\System\AcMAMdx.exe
  C:\Windows\System\AcMAMdx.exe
  2⤵
  PID:7780
- C:\Windows\System\sxeUdba.exe
  C:\Windows\System\sxeUdba.exe
  2⤵
  PID:8092
- C:\Windows\System\oGLjoxz.exe
  C:\Windows\System\oGLjoxz.exe
  2⤵
  PID:8124
- C:\Windows\System\kurKVaT.exe
  C:\Windows\System\kurKVaT.exe
  2⤵
  PID:8164
- C:\Windows\System\GevTsNF.exe
  C:\Windows\System\GevTsNF.exe
  2⤵
  PID:8184
- C:\Windows\System\gdcuQDk.exe
  C:\Windows\System\gdcuQDk.exe
  2⤵
  PID:6988
- C:\Windows\System\bHHDShz.exe
  C:\Windows\System\bHHDShz.exe
  2⤵
  PID:6416
- C:\Windows\System\HOelakc.exe
  C:\Windows\System\HOelakc.exe
  2⤵
  PID:7476
- C:\Windows\System\AeOiIsM.exe
  C:\Windows\System\AeOiIsM.exe
  2⤵
  PID:7572
- C:\Windows\System\TRjVAmZ.exe
  C:\Windows\System\TRjVAmZ.exe
  2⤵
  PID:7408
- C:\Windows\System\AiYcWoI.exe
  C:\Windows\System\AiYcWoI.exe
  2⤵
  PID:7364
- C:\Windows\System\LeLJUef.exe
  C:\Windows\System\LeLJUef.exe
  2⤵
  PID:7888
- C:\Windows\System\HIkhxKR.exe
  C:\Windows\System\HIkhxKR.exe
  2⤵
  PID:7456
- C:\Windows\System\RJfJmqe.exe
  C:\Windows\System\RJfJmqe.exe
  2⤵
  PID:7704
- C:\Windows\System\nTnZqRW.exe
  C:\Windows\System\nTnZqRW.exe
  2⤵
  PID:7804
- C:\Windows\System\qHmAbRR.exe
  C:\Windows\System\qHmAbRR.exe
  2⤵
  PID:7808
- C:\Windows\System\VlUhuyj.exe
  C:\Windows\System\VlUhuyj.exe
  2⤵
  PID:7872
- C:\Windows\System\iBEYQeS.exe
  C:\Windows\System\iBEYQeS.exe
  2⤵
  PID:7940
- C:\Windows\System\EJrSvqb.exe
  C:\Windows\System\EJrSvqb.exe
  2⤵
  PID:8104
- C:\Windows\System\isGAXcQ.exe
  C:\Windows\System\isGAXcQ.exe
  2⤵
  PID:8080
- C:\Windows\System\VxiSwCn.exe
  C:\Windows\System\VxiSwCn.exe
  2⤵
  PID:6976
- C:\Windows\System\ENeEYLM.exe
  C:\Windows\System\ENeEYLM.exe
  2⤵
  PID:7320
- C:\Windows\System\NVpBkMU.exe
  C:\Windows\System\NVpBkMU.exe
  2⤵
  PID:8156
- C:\Windows\System\csHAGkp.exe
  C:\Windows\System\csHAGkp.exe
  2⤵
  PID:2216
- C:\Windows\System\gbfpadm.exe
  C:\Windows\System\gbfpadm.exe
  2⤵
  PID:1744
- C:\Windows\System\yJIXtlF.exe
  C:\Windows\System\yJIXtlF.exe
  2⤵
  PID:2064
- C:\Windows\System\XjaMFeo.exe
  C:\Windows\System\XjaMFeo.exe
  2⤵
  PID:2712
- C:\Windows\System\bXLpfkv.exe
  C:\Windows\System\bXLpfkv.exe
  2⤵
  PID:7224
- C:\Windows\System\aqhLTLq.exe
  C:\Windows\System\aqhLTLq.exe
  2⤵
  PID:7252
- C:\Windows\System\ApyfxJc.exe
  C:\Windows\System\ApyfxJc.exe
  2⤵
  PID:2872
- C:\Windows\System\ExHqEUS.exe
  C:\Windows\System\ExHqEUS.exe
  2⤵
  PID:8108
- C:\Windows\System\eueMmBQ.exe
  C:\Windows\System\eueMmBQ.exe
  2⤵
  PID:7388
- C:\Windows\System\ulWiUcp.exe
  C:\Windows\System\ulWiUcp.exe
  2⤵
  PID:7400
- C:\Windows\System\tmUVwaR.exe
  C:\Windows\System\tmUVwaR.exe
  2⤵
  PID:7660
- C:\Windows\System\xxLeZVC.exe
  C:\Windows\System\xxLeZVC.exe
  2⤵
  PID:7676
- C:\Windows\System\FHldNFA.exe
  C:\Windows\System\FHldNFA.exe
  2⤵
  PID:7776
- C:\Windows\System\hFXeKcM.exe
  C:\Windows\System\hFXeKcM.exe
  2⤵
  PID:6524
- C:\Windows\System\YHwnqHR.exe
  C:\Windows\System\YHwnqHR.exe
  2⤵
  PID:7756
- C:\Windows\System\YwTXjqe.exe
  C:\Windows\System\YwTXjqe.exe
  2⤵
  PID:7920
- C:\Windows\System\zsesSuw.exe
  C:\Windows\System\zsesSuw.exe
  2⤵
  PID:8040
- C:\Windows\System\qgSYcfG.exe
  C:\Windows\System\qgSYcfG.exe
  2⤵
  PID:7668
- C:\Windows\System\krxCdaj.exe
  C:\Windows\System\krxCdaj.exe
  2⤵
  PID:3028
- C:\Windows\System\CQWlLhl.exe
  C:\Windows\System\CQWlLhl.exe
  2⤵
  PID:7952
- C:\Windows\System\qWdoXaR.exe
  C:\Windows\System\qWdoXaR.exe
  2⤵
  PID:8120
- C:\Windows\System\gaCfWuY.exe
  C:\Windows\System\gaCfWuY.exe
  2⤵
  PID:3004
- C:\Windows\System\fiowyPA.exe
  C:\Windows\System\fiowyPA.exe
  2⤵
  PID:7308
- C:\Windows\System\XihsbpO.exe
  C:\Windows\System\XihsbpO.exe
  2⤵
  PID:1360
- C:\Windows\System\jesTKiC.exe
  C:\Windows\System\jesTKiC.exe
  2⤵
  PID:8100
- C:\Windows\System\TdijPLA.exe
  C:\Windows\System\TdijPLA.exe
  2⤵
  PID:7256
- C:\Windows\System\DKAkMQk.exe
  C:\Windows\System\DKAkMQk.exe
  2⤵
  PID:7380
- C:\Windows\System\EsFaqCy.exe
  C:\Windows\System\EsFaqCy.exe
  2⤵
  PID:6112
- C:\Windows\System\GNcbjCD.exe
  C:\Windows\System\GNcbjCD.exe
  2⤵
  PID:7100
- C:\Windows\System\VDxTMob.exe
  C:\Windows\System\VDxTMob.exe
  2⤵
  PID:7960
- C:\Windows\System\mQfTDfs.exe
  C:\Windows\System\mQfTDfs.exe
  2⤵
  PID:7512
- C:\Windows\System\UjMVyzH.exe
  C:\Windows\System\UjMVyzH.exe
  2⤵
  PID:6696
- C:\Windows\System\sdYdDYc.exe
  C:\Windows\System\sdYdDYc.exe
  2⤵
  PID:7672
- C:\Windows\System\WRepLPT.exe
  C:\Windows\System\WRepLPT.exe
  2⤵
  PID:7968
- C:\Windows\System\WmuIpcN.exe
  C:\Windows\System\WmuIpcN.exe
  2⤵
  PID:7312
- C:\Windows\System\ibNLMnh.exe
  C:\Windows\System\ibNLMnh.exe
  2⤵
  PID:8116
- C:\Windows\System\wuaAQAc.exe
  C:\Windows\System\wuaAQAc.exe
  2⤵
  PID:7068
- C:\Windows\System\ORXKMgA.exe
  C:\Windows\System\ORXKMgA.exe
  2⤵
  PID:7488
- C:\Windows\System\klQveFJ.exe
  C:\Windows\System\klQveFJ.exe
  2⤵
  PID:7184
- C:\Windows\System\BiIPaCL.exe
  C:\Windows\System\BiIPaCL.exe
  2⤵
  PID:6940
- C:\Windows\System\CHxHxzR.exe
  C:\Windows\System\CHxHxzR.exe
  2⤵
  PID:536
- C:\Windows\System\pDmTVib.exe
  C:\Windows\System\pDmTVib.exe
  2⤵
  PID:1180
- C:\Windows\System\PYvslzh.exe
  C:\Windows\System\PYvslzh.exe
  2⤵
  PID:7664
- C:\Windows\System\YhpJcey.exe
  C:\Windows\System\YhpJcey.exe
  2⤵
  PID:7492
- C:\Windows\System\IgtVRRA.exe
  C:\Windows\System\IgtVRRA.exe
  2⤵
  PID:6816
- C:\Windows\System\WpYBuvc.exe
  C:\Windows\System\WpYBuvc.exe
  2⤵
  PID:5372
- C:\Windows\System\MlPWOsw.exe
  C:\Windows\System\MlPWOsw.exe
  2⤵
  PID:8056
- C:\Windows\System\RaSrfSz.exe
  C:\Windows\System\RaSrfSz.exe
  2⤵
  PID:7716
- C:\Windows\System\fMgeSsH.exe
  C:\Windows\System\fMgeSsH.exe
  2⤵
  PID:8072
- C:\Windows\System\fFEksgM.exe
  C:\Windows\System\fFEksgM.exe
  2⤵
  PID:7844
- C:\Windows\System\ryYvNiK.exe
  C:\Windows\System\ryYvNiK.exe
  2⤵
  PID:7708
- C:\Windows\System\QXnEZby.exe
  C:\Windows\System\QXnEZby.exe
  2⤵
  PID:7956
- C:\Windows\System\UEEjdIZ.exe
  C:\Windows\System\UEEjdIZ.exe
  2⤵
  PID:7908
- C:\Windows\System\KzkbCHd.exe
  C:\Windows\System\KzkbCHd.exe
  2⤵
  PID:8332
- C:\Windows\System\mLdymcm.exe
  C:\Windows\System\mLdymcm.exe
  2⤵
  PID:8348
- C:\Windows\System\XHGfBWd.exe
  C:\Windows\System\XHGfBWd.exe
  2⤵
  PID:8364
- C:\Windows\System\yPbAwbC.exe
  C:\Windows\System\yPbAwbC.exe
  2⤵
  PID:8380
- C:\Windows\System\snkdutf.exe
  C:\Windows\System\snkdutf.exe
  2⤵
  PID:8396
- C:\Windows\System\kdWPvlT.exe
  C:\Windows\System\kdWPvlT.exe
  2⤵
  PID:8412
- C:\Windows\System\rTDhKgB.exe
  C:\Windows\System\rTDhKgB.exe
  2⤵
  PID:8428
- C:\Windows\System\vUFvVkb.exe
  C:\Windows\System\vUFvVkb.exe
  2⤵
  PID:8444
- C:\Windows\System\WowZULX.exe
  C:\Windows\System\WowZULX.exe
  2⤵
  PID:8468
- C:\Windows\System\xpgTTTP.exe
  C:\Windows\System\xpgTTTP.exe
  2⤵
  PID:8492
- C:\Windows\System\ogbbqpo.exe
  C:\Windows\System\ogbbqpo.exe
  2⤵
  PID:8508
- C:\Windows\System\CWOgxjB.exe
  C:\Windows\System\CWOgxjB.exe
  2⤵
  PID:8524
- C:\Windows\System\RkCsImo.exe
  C:\Windows\System\RkCsImo.exe
  2⤵
  PID:8540
- C:\Windows\System\lHoFqVO.exe
  C:\Windows\System\lHoFqVO.exe
  2⤵
  PID:8556
- C:\Windows\System\XhcmpTi.exe
  C:\Windows\System\XhcmpTi.exe
  2⤵
  PID:8572
- C:\Windows\System\FiMSBmu.exe
  C:\Windows\System\FiMSBmu.exe
  2⤵
  PID:8588
- C:\Windows\System\CXIiZlS.exe
  C:\Windows\System\CXIiZlS.exe
  2⤵
  PID:8604
- C:\Windows\System\WcMoKjo.exe
  C:\Windows\System\WcMoKjo.exe
  2⤵
  PID:8620
- C:\Windows\System\lJaGQTe.exe
  C:\Windows\System\lJaGQTe.exe
  2⤵
  PID:8636
- C:\Windows\System\HKIfBlG.exe
  C:\Windows\System\HKIfBlG.exe
  2⤵
  PID:8652
- C:\Windows\System\DkCGKPV.exe
  C:\Windows\System\DkCGKPV.exe
  2⤵
  PID:8668
- C:\Windows\System\SdCQMei.exe
  C:\Windows\System\SdCQMei.exe
  2⤵
  PID:8684
- C:\Windows\System\JIsFFoN.exe
  C:\Windows\System\JIsFFoN.exe
  2⤵
  PID:8700
- C:\Windows\System\Kbbqrnj.exe
  C:\Windows\System\Kbbqrnj.exe
  2⤵
  PID:8716
- C:\Windows\System\eVDmhND.exe
  C:\Windows\System\eVDmhND.exe
  2⤵
  PID:8732
- C:\Windows\System\GOkGnXN.exe
  C:\Windows\System\GOkGnXN.exe
  2⤵
  PID:8748
- C:\Windows\System\KTzbwPU.exe
  C:\Windows\System\KTzbwPU.exe
  2⤵
  PID:8764
- C:\Windows\System\GpodWeJ.exe
  C:\Windows\System\GpodWeJ.exe
  2⤵
  PID:8780
- C:\Windows\System\qRYFDrc.exe
  C:\Windows\System\qRYFDrc.exe
  2⤵
  PID:8796
- C:\Windows\System\BttaIhQ.exe
  C:\Windows\System\BttaIhQ.exe
  2⤵
  PID:8812
- C:\Windows\System\wsNcNHh.exe
  C:\Windows\System\wsNcNHh.exe
  2⤵
  PID:8828
- C:\Windows\System\TdkXlHH.exe
  C:\Windows\System\TdkXlHH.exe
  2⤵
  PID:8844
- C:\Windows\System\WbmNDXm.exe
  C:\Windows\System\WbmNDXm.exe
  2⤵
  PID:8876
- C:\Windows\System\IkUaOff.exe
  C:\Windows\System\IkUaOff.exe
  2⤵
  PID:8892
- C:\Windows\System\vUHozlN.exe
  C:\Windows\System\vUHozlN.exe
  2⤵
  PID:8908
- C:\Windows\System\EAUhRmX.exe
  C:\Windows\System\EAUhRmX.exe
  2⤵
  PID:8924
- C:\Windows\System\WDIwUQM.exe
  C:\Windows\System\WDIwUQM.exe
  2⤵
  PID:8940
- C:\Windows\System\genqfHM.exe
  C:\Windows\System\genqfHM.exe
  2⤵
  PID:8956
- C:\Windows\System\vKAvyav.exe
  C:\Windows\System\vKAvyav.exe
  2⤵
  PID:8972
- C:\Windows\System\pUrxMxX.exe
  C:\Windows\System\pUrxMxX.exe
  2⤵
  PID:8988
- C:\Windows\System\ETWEtjb.exe
  C:\Windows\System\ETWEtjb.exe
  2⤵
  PID:9004
- C:\Windows\System\krdxxWE.exe
  C:\Windows\System\krdxxWE.exe
  2⤵
  PID:9020
- C:\Windows\System\BVfebGy.exe
  C:\Windows\System\BVfebGy.exe
  2⤵
  PID:9036
- C:\Windows\System\VvQdKwM.exe
  C:\Windows\System\VvQdKwM.exe
  2⤵
  PID:9056
- C:\Windows\System\ZslCEQm.exe
  C:\Windows\System\ZslCEQm.exe
  2⤵
  PID:9084
- C:\Windows\System\uaZsEgf.exe
  C:\Windows\System\uaZsEgf.exe
  2⤵
  PID:9104
- C:\Windows\System\UjHIfzk.exe
  C:\Windows\System\UjHIfzk.exe
  2⤵
  PID:9120
- C:\Windows\System\iaVDvEP.exe
  C:\Windows\System\iaVDvEP.exe
  2⤵
  PID:9136
- C:\Windows\System\BKzVJSu.exe
  C:\Windows\System\BKzVJSu.exe
  2⤵
  PID:9152
- C:\Windows\System\mJsVQdZ.exe
  C:\Windows\System\mJsVQdZ.exe
  2⤵
  PID:9168
- C:\Windows\System\LhPdgjL.exe
  C:\Windows\System\LhPdgjL.exe
  2⤵
  PID:9188
- C:\Windows\System\JNaTCZH.exe
  C:\Windows\System\JNaTCZH.exe
  2⤵
  PID:9204
- C:\Windows\System\MnYoLzT.exe
  C:\Windows\System\MnYoLzT.exe
  2⤵
  PID:6744
- C:\Windows\System\POSjxYo.exe
  C:\Windows\System\POSjxYo.exe
  2⤵
  PID:7336
- C:\Windows\System\MNLddGc.exe
  C:\Windows\System\MNLddGc.exe
  2⤵
  PID:7788
- C:\Windows\System\jasdRHk.exe
  C:\Windows\System\jasdRHk.exe
  2⤵
  PID:8344
- C:\Windows\System\wDMuzSY.exe
  C:\Windows\System\wDMuzSY.exe
  2⤵
  PID:8376
- C:\Windows\System\ciiAXcm.exe
  C:\Windows\System\ciiAXcm.exe
  2⤵
  PID:8520
- C:\Windows\System\FZvkAQc.exe
  C:\Windows\System\FZvkAQc.exe
  2⤵
  PID:8484
- C:\Windows\System\ssbTCdy.exe
  C:\Windows\System\ssbTCdy.exe
  2⤵
  PID:8648
- C:\Windows\System\tMnIFsX.exe
  C:\Windows\System\tMnIFsX.exe
  2⤵
  PID:7592
- C:\Windows\System\ZlIICDZ.exe
  C:\Windows\System\ZlIICDZ.exe
  2⤵
  PID:7936
- C:\Windows\System\XlSZNIj.exe
  C:\Windows\System\XlSZNIj.exe
  2⤵
  PID:7432
- C:\Windows\System\onifXaO.exe
  C:\Windows\System\onifXaO.exe
  2⤵
  PID:6092
- C:\Windows\System\jgaoiVx.exe
  C:\Windows\System\jgaoiVx.exe
  2⤵
  PID:7528
- C:\Windows\System\aOmlPxl.exe
  C:\Windows\System\aOmlPxl.exe
  2⤵
  PID:7304
- C:\Windows\System\MXgmqYB.exe
  C:\Windows\System\MXgmqYB.exe
  2⤵
  PID:8204
- C:\Windows\System\crnVVGn.exe
  C:\Windows\System\crnVVGn.exe
  2⤵
  PID:8280
- C:\Windows\System\TOoskPS.exe
  C:\Windows\System\TOoskPS.exe
  2⤵
  PID:8356
- C:\Windows\System\ntfyKCo.exe
  C:\Windows\System\ntfyKCo.exe
  2⤵
  PID:8420
- C:\Windows\System\qmPfSSF.exe
  C:\Windows\System\qmPfSSF.exe
  2⤵
  PID:8464
- C:\Windows\System\QtBIMXB.exe
  C:\Windows\System\QtBIMXB.exe
  2⤵
  PID:8696
- C:\Windows\System\qFwIHUw.exe
  C:\Windows\System\qFwIHUw.exe
  2⤵
  PID:8760
- C:\Windows\System\gyGbDGx.exe
  C:\Windows\System\gyGbDGx.exe
  2⤵
  PID:8856
- C:\Windows\System\wZEgjoJ.exe
  C:\Windows\System\wZEgjoJ.exe
  2⤵
  PID:8772
- C:\Windows\System\VUXskHr.exe
  C:\Windows\System\VUXskHr.exe
  2⤵
  PID:8916
- C:\Windows\System\JiVAIaQ.exe
  C:\Windows\System\JiVAIaQ.exe
  2⤵
  PID:8952
- C:\Windows\System\nkeHzDz.exe
  C:\Windows\System\nkeHzDz.exe
  2⤵
  PID:9016
- C:\Windows\System\uDuOWTH.exe
  C:\Windows\System\uDuOWTH.exe
  2⤵
  PID:9116
- C:\Windows\System\mCKmJID.exe
  C:\Windows\System\mCKmJID.exe
  2⤵
  PID:8980
- C:\Windows\System\LHlMeQK.exe
  C:\Windows\System\LHlMeQK.exe
  2⤵
  PID:9212
- C:\Windows\System\IglWwYc.exe
  C:\Windows\System\IglWwYc.exe
  2⤵
  PID:1348
- C:\Windows\System\gFVLIjL.exe
  C:\Windows\System\gFVLIjL.exe
  2⤵
  PID:9128
- C:\Windows\System\OSUFLXd.exe
  C:\Windows\System\OSUFLXd.exe
  2⤵
  PID:6552
- C:\Windows\System\GRysZVV.exe
  C:\Windows\System\GRysZVV.exe
  2⤵
  PID:8516
- C:\Windows\System\WXycnAQ.exe
  C:\Windows\System\WXycnAQ.exe
  2⤵
  PID:8680
- C:\Windows\System\FkIanhe.exe
  C:\Windows\System\FkIanhe.exe
  2⤵
  PID:6684
- C:\Windows\System\HUGOvpo.exe
  C:\Windows\System\HUGOvpo.exe
  2⤵
  PID:7620
- C:\Windows\System\JpGhgvb.exe
  C:\Windows\System\JpGhgvb.exe
  2⤵
  PID:7624
- C:\Windows\System\MZbLmDd.exe
  C:\Windows\System\MZbLmDd.exe
  2⤵
  PID:8196
- C:\Windows\System\NBlUIJD.exe
  C:\Windows\System\NBlUIJD.exe
  2⤵
  PID:7648
- C:\Windows\System\mCFyaAP.exe
  C:\Windows\System\mCFyaAP.exe
  2⤵
  PID:7412
- C:\Windows\System\vLrMLOA.exe
  C:\Windows\System\vLrMLOA.exe
  2⤵
  PID:8216
- C:\Windows\System\DGsanxb.exe
  C:\Windows\System\DGsanxb.exe
  2⤵
  PID:8300
- C:\Windows\System\FNhMVEL.exe
  C:\Windows\System\FNhMVEL.exe
  2⤵
  PID:8320
- C:\Windows\System\rcAkYWD.exe
  C:\Windows\System\rcAkYWD.exe
  2⤵
  PID:8328
- C:\Windows\System\NQOmYFV.exe
  C:\Windows\System\NQOmYFV.exe
  2⤵
  PID:8232
- C:\Windows\System\hYYioGZ.exe
  C:\Windows\System\hYYioGZ.exe
  2⤵
  PID:8256
- C:\Windows\System\pSwxLhV.exe
  C:\Windows\System\pSwxLhV.exe
  2⤵
  PID:8388
- C:\Windows\System\KigczYF.exe
  C:\Windows\System\KigczYF.exe
  2⤵
  PID:8504
- C:\Windows\System\pfeMLYy.exe
  C:\Windows\System\pfeMLYy.exe
  2⤵
  PID:2744
- C:\Windows\System\hFVpFcE.exe
  C:\Windows\System\hFVpFcE.exe
  2⤵
  PID:8568
- C:\Windows\System\ZuTaXFj.exe
  C:\Windows\System\ZuTaXFj.exe
  2⤵
  PID:8564
- C:\Windows\System\IfbOewC.exe
  C:\Windows\System\IfbOewC.exe
  2⤵
  PID:8692
- C:\Windows\System\ImpieLk.exe
  C:\Windows\System\ImpieLk.exe
  2⤵
  PID:8900
- C:\Windows\System\FzcZclH.exe
  C:\Windows\System\FzcZclH.exe
  2⤵
  PID:8904
- C:\Windows\System\hutUVNB.exe
  C:\Windows\System\hutUVNB.exe
  2⤵
  PID:8600
- C:\Windows\System\HEHRwdj.exe
  C:\Windows\System\HEHRwdj.exe
  2⤵
  PID:9076
- C:\Windows\System\fVNqSgk.exe
  C:\Windows\System\fVNqSgk.exe
  2⤵
  PID:9100
- C:\Windows\System\QlLsLIo.exe
  C:\Windows\System\QlLsLIo.exe
  2⤵
  PID:8584
- C:\Windows\System\NAaXOzi.exe
  C:\Windows\System\NAaXOzi.exe
  2⤵
  PID:9064
- C:\Windows\System\nPdADDU.exe
  C:\Windows\System\nPdADDU.exe
  2⤵
  PID:8984
- C:\Windows\System\FhOwHal.exe
  C:\Windows\System\FhOwHal.exe
  2⤵
  PID:1188
- C:\Windows\System\HegYDEE.exe
  C:\Windows\System\HegYDEE.exe
  2⤵
  PID:7720
- C:\Windows\System\jqEgaOc.exe
  C:\Windows\System\jqEgaOc.exe
  2⤵
  PID:7740
- C:\Windows\System\YqKYeJS.exe
  C:\Windows\System\YqKYeJS.exe
  2⤵
  PID:6756
- C:\Windows\System\sPjrfSy.exe
  C:\Windows\System\sPjrfSy.exe
  2⤵
  PID:7040
- C:\Windows\System\iMXXseI.exe
  C:\Windows\System\iMXXseI.exe
  2⤵
  PID:588
- C:\Windows\System\otCMchh.exe
  C:\Windows\System\otCMchh.exe
  2⤵
  PID:7240
- C:\Windows\System\CGbQkJT.exe
  C:\Windows\System\CGbQkJT.exe
  2⤵
  PID:8200
- C:\Windows\System\bEOXYzY.exe
  C:\Windows\System\bEOXYzY.exe
  2⤵
  PID:8292
- C:\Windows\System\ToqwQUG.exe
  C:\Windows\System\ToqwQUG.exe
  2⤵
  PID:8248
- C:\Windows\System\bPHgMCV.exe
  C:\Windows\System\bPHgMCV.exe
  2⤵
  PID:8840
- C:\Windows\System\nMeMRTe.exe
  C:\Windows\System\nMeMRTe.exe
  2⤵
  PID:8536
- C:\Windows\System\vlyyMrY.exe
  C:\Windows\System\vlyyMrY.exe
  2⤵
  PID:8852
- C:\Windows\System\EQyOzmg.exe
  C:\Windows\System\EQyOzmg.exe
  2⤵
  PID:9180
- C:\Windows\System\eYKZsVj.exe
  C:\Windows\System\eYKZsVj.exe
  2⤵
  PID:9048
- C:\Windows\System\MfkSPvy.exe
  C:\Windows\System\MfkSPvy.exe
  2⤵
  PID:9012
- C:\Windows\System\VcqaXLe.exe
  C:\Windows\System\VcqaXLe.exe
  2⤵
  PID:9148
- C:\Windows\System\nStOlxm.exe
  C:\Windows\System\nStOlxm.exe
  2⤵
  PID:2964
- C:\Windows\System\HzgNAPx.exe
  C:\Windows\System\HzgNAPx.exe
  2⤵
  PID:8220
- C:\Windows\System\fpmydiC.exe
  C:\Windows\System\fpmydiC.exe
  2⤵
  PID:7696
- C:\Windows\System\tChdolk.exe
  C:\Windows\System\tChdolk.exe
  2⤵
  PID:8644
- C:\Windows\System\PnKMIDG.exe
  C:\Windows\System\PnKMIDG.exe
  2⤵
  PID:8824
- C:\Windows\System\oWlfVTI.exe
  C:\Windows\System\oWlfVTI.exe
  2⤵
  PID:8460
- C:\Windows\System\NnRXBld.exe
  C:\Windows\System\NnRXBld.exe
  2⤵
  PID:8808
- C:\Windows\System\viyISHl.exe
  C:\Windows\System\viyISHl.exe
  2⤵
  PID:8304
- C:\Windows\System\YhumaAi.exe
  C:\Windows\System\YhumaAi.exe
  2⤵
  PID:8296
- C:\Windows\System\TWzlIsO.exe
  C:\Windows\System\TWzlIsO.exe
  2⤵
  PID:8884
- C:\Windows\System\rdDIGFV.exe
  C:\Windows\System\rdDIGFV.exe
  2⤵
  PID:8712
- C:\Windows\System\lBiDGyw.exe
  C:\Windows\System\lBiDGyw.exe
  2⤵
  PID:8632
- C:\Windows\System\ZhHdvSN.exe
  C:\Windows\System\ZhHdvSN.exe
  2⤵
  PID:8288
- C:\Windows\System\QSWsADu.exe
  C:\Windows\System\QSWsADu.exe
  2⤵
  PID:8756
- C:\Windows\System\vQMUiwc.exe
  C:\Windows\System\vQMUiwc.exe
  2⤵
  PID:8868
- C:\Windows\System\yiBTLUH.exe
  C:\Windows\System\yiBTLUH.exe
  2⤵
  PID:6508
- C:\Windows\System\xJIHVAe.exe
  C:\Windows\System\xJIHVAe.exe
  2⤵
  PID:9272
- C:\Windows\System\oIyUfZY.exe
  C:\Windows\System\oIyUfZY.exe
  2⤵
  PID:9288
- C:\Windows\System\XQIMRBo.exe
  C:\Windows\System\XQIMRBo.exe
  2⤵
  PID:9336
- C:\Windows\System\mazoiOL.exe
  C:\Windows\System\mazoiOL.exe
  2⤵
  PID:9352
- C:\Windows\System\DJJgfmm.exe
  C:\Windows\System\DJJgfmm.exe
  2⤵
  PID:9368
- C:\Windows\System\YVuxHxq.exe
  C:\Windows\System\YVuxHxq.exe
  2⤵
  PID:9384
- C:\Windows\System\knqMYKs.exe
  C:\Windows\System\knqMYKs.exe
  2⤵
  PID:9400
- C:\Windows\System\ZQLlTaz.exe
  C:\Windows\System\ZQLlTaz.exe
  2⤵
  PID:9424
- C:\Windows\System\dKgnGGX.exe
  C:\Windows\System\dKgnGGX.exe
  2⤵
  PID:9440
- C:\Windows\System\lrWcEor.exe
  C:\Windows\System\lrWcEor.exe
  2⤵
  PID:9456
- C:\Windows\System\wRtvFGF.exe
  C:\Windows\System\wRtvFGF.exe
  2⤵
  PID:9472
- C:\Windows\System\fbHhYhT.exe
  C:\Windows\System\fbHhYhT.exe
  2⤵
  PID:9488
- C:\Windows\System\XbiKtaS.exe
  C:\Windows\System\XbiKtaS.exe
  2⤵
  PID:9508
- C:\Windows\System\talDKUI.exe
  C:\Windows\System\talDKUI.exe
  2⤵
  PID:9528
- C:\Windows\System\HRdbZRi.exe
  C:\Windows\System\HRdbZRi.exe
  2⤵
  PID:9544
- C:\Windows\System\SYTQsQx.exe
  C:\Windows\System\SYTQsQx.exe
  2⤵
  PID:9560
- C:\Windows\System\NIFsTgS.exe
  C:\Windows\System\NIFsTgS.exe
  2⤵
  PID:9576
- C:\Windows\System\dywVCrp.exe
  C:\Windows\System\dywVCrp.exe
  2⤵
  PID:9596
- C:\Windows\System\mapXRTA.exe
  C:\Windows\System\mapXRTA.exe
  2⤵
  PID:9612
- C:\Windows\System\vAaePOX.exe
  C:\Windows\System\vAaePOX.exe
  2⤵
  PID:9628
- C:\Windows\System\BvCkDeQ.exe
  C:\Windows\System\BvCkDeQ.exe
  2⤵
  PID:9644
- C:\Windows\System\kOyWWTJ.exe
  C:\Windows\System\kOyWWTJ.exe
  2⤵
  PID:9668
- C:\Windows\System\fcokNVo.exe
  C:\Windows\System\fcokNVo.exe
  2⤵
  PID:9684
- C:\Windows\System\SVLXfMu.exe
  C:\Windows\System\SVLXfMu.exe
  2⤵
  PID:9700
- C:\Windows\System\fYHrhvd.exe
  C:\Windows\System\fYHrhvd.exe
  2⤵
  PID:9716
- C:\Windows\System\aiiFueJ.exe
  C:\Windows\System\aiiFueJ.exe
  2⤵
  PID:9732
- C:\Windows\System\HFxBaXk.exe
  C:\Windows\System\HFxBaXk.exe
  2⤵
  PID:9748
- C:\Windows\System\VCewars.exe
  C:\Windows\System\VCewars.exe
  2⤵
  PID:9764
- C:\Windows\System\PzzEpJn.exe
  C:\Windows\System\PzzEpJn.exe
  2⤵
  PID:9780
- C:\Windows\System\pCdNoWj.exe
  C:\Windows\System\pCdNoWj.exe
  2⤵
  PID:9800
- C:\Windows\System\gZCCOFn.exe
  C:\Windows\System\gZCCOFn.exe
  2⤵
  PID:9824
- C:\Windows\System\iMYPMiR.exe
  C:\Windows\System\iMYPMiR.exe
  2⤵
  PID:9844
- C:\Windows\System\EjNGkxB.exe
  C:\Windows\System\EjNGkxB.exe
  2⤵
  PID:9860
- C:\Windows\System\UWtbTqa.exe
  C:\Windows\System\UWtbTqa.exe
  2⤵
  PID:9876
- C:\Windows\System\KelRGWS.exe
  C:\Windows\System\KelRGWS.exe
  2⤵
  PID:9908
- C:\Windows\System\LNuoVho.exe
  C:\Windows\System\LNuoVho.exe
  2⤵
  PID:9928
- C:\Windows\System\OlIzTNF.exe
  C:\Windows\System\OlIzTNF.exe
  2⤵
  PID:9944
- C:\Windows\System\nneEIbU.exe
  C:\Windows\System\nneEIbU.exe
  2⤵
  PID:9968
- C:\Windows\System\tvHBARA.exe
  C:\Windows\System\tvHBARA.exe
  2⤵
  PID:9984
- C:\Windows\System\YISJhkl.exe
  C:\Windows\System\YISJhkl.exe
  2⤵
  PID:10000
- C:\Windows\System\ePnzIeW.exe
  C:\Windows\System\ePnzIeW.exe
  2⤵
  PID:10016
- C:\Windows\System\vUhVYiz.exe
  C:\Windows\System\vUhVYiz.exe
  2⤵
  PID:10040
- C:\Windows\System\vcrNwCj.exe
  C:\Windows\System\vcrNwCj.exe
  2⤵
  PID:10056
- C:\Windows\System\lvdWEsw.exe
  C:\Windows\System\lvdWEsw.exe
  2⤵
  PID:10072
- C:\Windows\System\BSDIruX.exe
  C:\Windows\System\BSDIruX.exe
  2⤵
  PID:10092
- C:\Windows\System\ckqHjNN.exe
  C:\Windows\System\ckqHjNN.exe
  2⤵
  PID:10108
- C:\Windows\System\wRvGBXg.exe
  C:\Windows\System\wRvGBXg.exe
  2⤵
  PID:10124
- C:\Windows\System\BLloDPo.exe
  C:\Windows\System\BLloDPo.exe
  2⤵
  PID:10144
- C:\Windows\System\afQNuZa.exe
  C:\Windows\System\afQNuZa.exe
  2⤵
  PID:10160
- C:\Windows\System\vpnbFAZ.exe
  C:\Windows\System\vpnbFAZ.exe
  2⤵
  PID:10176
- C:\Windows\System\szvTFDE.exe
  C:\Windows\System\szvTFDE.exe
  2⤵
  PID:10192
- C:\Windows\System\zbTrNNA.exe
  C:\Windows\System\zbTrNNA.exe
  2⤵
  PID:10232
- C:\Windows\System\mJgjWOB.exe
  C:\Windows\System\mJgjWOB.exe
  2⤵
  PID:9220
- C:\Windows\System\LfjVhjS.exe
  C:\Windows\System\LfjVhjS.exe
  2⤵
  PID:9160
- C:\Windows\System\iqusbus.exe
  C:\Windows\System\iqusbus.exe
  2⤵
  PID:8236
- C:\Windows\System\VKooZfv.exe
  C:\Windows\System\VKooZfv.exe
  2⤵
  PID:9236
- C:\Windows\System\rgpLxpc.exe
  C:\Windows\System\rgpLxpc.exe
  2⤵
  PID:9252
- C:\Windows\System\vKpbpig.exe
  C:\Windows\System\vKpbpig.exe
  2⤵
  PID:9284
- C:\Windows\System\txCQgUU.exe
  C:\Windows\System\txCQgUU.exe
  2⤵
  PID:9304
- C:\Windows\System\ttfoZgl.exe
  C:\Windows\System\ttfoZgl.exe
  2⤵
  PID:9416
- C:\Windows\System\Vpubgyo.exe
  C:\Windows\System\Vpubgyo.exe
  2⤵
  PID:9392
- C:\Windows\System\HTttxZs.exe
  C:\Windows\System\HTttxZs.exe
  2⤵
  PID:9504
- C:\Windows\System\QmnIxsn.exe
  C:\Windows\System\QmnIxsn.exe
  2⤵
  PID:9436
- C:\Windows\System\iksWUxd.exe
  C:\Windows\System\iksWUxd.exe
  2⤵
  PID:9540
- C:\Windows\System\hUDSKfy.exe
  C:\Windows\System\hUDSKfy.exe
  2⤵
  PID:9588
- C:\Windows\System\qShIWPm.exe
  C:\Windows\System\qShIWPm.exe
  2⤵
  PID:9652
- C:\Windows\System\ZaFLPAM.exe
  C:\Windows\System\ZaFLPAM.exe
  2⤵
  PID:9664
- C:\Windows\System\lNlfQuE.exe
  C:\Windows\System\lNlfQuE.exe
  2⤵
  PID:9792
- C:\Windows\System\OFTMZGV.exe
  C:\Windows\System\OFTMZGV.exe
  2⤵
  PID:9708
- C:\Windows\System\nEojwNQ.exe
  C:\Windows\System\nEojwNQ.exe
  2⤵
  PID:9772
- C:\Windows\System\YuSwDWD.exe
  C:\Windows\System\YuSwDWD.exe
  2⤵
  PID:9812
- C:\Windows\System\fhjgWWF.exe
  C:\Windows\System\fhjgWWF.exe
  2⤵
  PID:9868
- C:\Windows\System\eIdAcwP.exe
  C:\Windows\System\eIdAcwP.exe
  2⤵
  PID:924
- C:\Windows\System\ovKdggn.exe
  C:\Windows\System\ovKdggn.exe
  2⤵
  PID:9952
- C:\Windows\System\jUEwMiI.exe
  C:\Windows\System\jUEwMiI.exe
  2⤵
  PID:9964
- C:\Windows\System\rXjdMqo.exe
  C:\Windows\System\rXjdMqo.exe
  2⤵
  PID:9888
- C:\Windows\System\lKGWrAW.exe
  C:\Windows\System\lKGWrAW.exe
  2⤵
  PID:9936
- C:\Windows\System\yxWwZHo.exe
  C:\Windows\System\yxWwZHo.exe
  2⤵
  PID:10064
- C:\Windows\System\LHSxrCD.exe
  C:\Windows\System\LHSxrCD.exe
  2⤵
  PID:10100
- C:\Windows\System\NjYevRZ.exe
  C:\Windows\System\NjYevRZ.exe
  2⤵
  PID:10140
- C:\Windows\System\ImmRcBd.exe
  C:\Windows\System\ImmRcBd.exe
  2⤵
  PID:10048
- C:\Windows\System\mqCCdiq.exe
  C:\Windows\System\mqCCdiq.exe
  2⤵
  PID:10156
- C:\Windows\System\kpGunen.exe
  C:\Windows\System\kpGunen.exe
  2⤵
  PID:10188
- C:\Windows\System\NRlOFoK.exe
  C:\Windows\System\NRlOFoK.exe
  2⤵
  PID:8440
- C:\Windows\System\CUhfFFV.exe
  C:\Windows\System\CUhfFFV.exe
  2⤵
  PID:9268
- C:\Windows\System\loSpDRH.exe
  C:\Windows\System\loSpDRH.exe
  2⤵
  PID:9312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\COMnWSo.exe

Filesize
2.2MB

MD5
10b9ff1765ede4bd8d43c3e2a40231a7

SHA1
7a75d640bb65767e71d22928f426b1e6e2020064

SHA256
51a58de5a20794547ea67539e6075746364047f96324a81d33f7f3fcdac554f3

SHA512
e9e36ed8630d220aadb58c1ef8f52ae7e40bb5d9a7964daa98684dc0a8b43a14cbce87e02c910c41f2604624d6e410aa66d7860319911430ccbef3ea1db4dd17

Download Submit
C:\Windows\system\ERsyQXU.exe

Filesize
2.2MB

MD5
89f46391298b4666f348d3adb4ef7500

SHA1
64dfee520e9e566b4e1f3931fd107da7b39cab69

SHA256
b45d5fd178b6a2b53644433489ca2359b2e849bc72a12a866d6dc578a8a5f909

SHA512
1e651a075dbfd9c44d29faf03bf12d577a22302733171f76e33bf494e89601bceb3c9afe66dca79c1217ced8733743d00fc60cb3e441901cbb71be70a1f27b80

Download Submit
C:\Windows\system\LgNNJzg.exe

Filesize
1.8MB

MD5
aa840ddb7834c5e278ca94c2338ab178

SHA1
334a75a73a4a5db35b7b1d825531bf0d38075e86

SHA256
9a1b340eff398757b4f739d30bc3b0edcb8355ff9416f7f9f0505e7230f87362

SHA512
c183b0afdadce0eba062a6a71ae9dc1437a85e454f86dc3ece5e5f7de553d8f577593630ba2c52c058ef5274295a54737128777114a4bf97658da32c1405365b

Download Submit
C:\Windows\system\NsMtqjJ.exe

Filesize
2.2MB

MD5
f01bcb3bf3ebb74a396f755634daf22d

SHA1
609a5716f954374c38da1b86a3fddb15a8041015

SHA256
7044c07d8d0902a598391b6b3943d48a076b7ed152a0bf56ff9a45a406177bfc

SHA512
69ce88aac71cca90243350bb79e6cf1f1458f8179c6b91e7309780caa93bfc1b6c6839dea3dd807265f77f473f903693fc3c265094b1e7b23fa60fcf70c43371

Download Submit
C:\Windows\system\TSOGbZw.exe

Filesize
1.5MB

MD5
a088ee82676640244a92db908d2e324c

SHA1
52fab920a0d6ef7e6bb18c8012ed380d1c954925

SHA256
2b4b181ebc55170941b16ad5511c27ff9effa712aeb1aa375f0fd536090cb5a3

SHA512
74d592a8c66083f2f6fe304cf132ece7f40d7bbb67562331ec99d0d8eb0ec692881c5f2a96fa1caf6e94819e8db1e372eed8b051fa346329f3c43314228587cf

Download Submit
C:\Windows\system\UVVRJfO.exe

Filesize
2.2MB

MD5
b30a5b919d3c8b4c6875fa29cb7cdfa1

SHA1
0e2fd6911820e000f68de4a0dc875fd943ef26e4

SHA256
2610ee4e7d9af92dfd87d2efde865efb0cf8d130b414199dde34a8e3adc1bbf2

SHA512
76286c5e2a959a8a558d975c5267aff69686de0fd591d3c97e75d967bcf812508b722c5217e17b67c003986a2759786906d5e2d3af619093c431429b10642dde

Download Submit
C:\Windows\system\aWAEwip.exe

Filesize
2.2MB

MD5
df058befe3377a4f320ae852f989ffca

SHA1
8feb5a30ac33ffce1ed9196638fc56d0b2dfe652

SHA256
fcb7c7b34b150987841f5e869519234805315a33b382306351a33ac48da48435

SHA512
62f9f5f3a041d29765b5222cdb5a9d7bc0cb1bd015e67102277faff429d79473c677ffc1730bafa2be481647ab397eead5d13cae013554f782f3279fb3d23303

Download Submit
C:\Windows\system\argSVCQ.exe

Filesize
2.2MB

MD5
f80acb4ecf78741f1f7ce6fb709805a5

SHA1
8cf34bfd482ae5c9d9f365a8914e92f68bc12498

SHA256
d46a14c06165d6cfaf06c89f2bb556924948928cccc68c042de8e819d4e27430

SHA512
d23d2ab0cf68425ecf283af95e761f15f5259e3a1b179ca8b421227bc2ed65e6ae486e5eced22ef75c6541ef498c00501997136bca4bdc1ca2b9a771f301015f

Download Submit
C:\Windows\system\ewoGAcD.exe

Filesize
1.6MB

MD5
81d4d5d084f2338fcab1c1e236092bb3

SHA1
ee0b958744bb2fd528f1aa07609f1f9854820f7a

SHA256
3742b9beb6804ddb5b5635936966540b5e0948346c1efd3b6b4617c3d434181e

SHA512
2f1ee474ed548c818e4158ecbf211a45f39660ae74934d94f499b49d9b783a7d95fc08f967e7162374901354af5dfd6e85a76c2c7ac54b2be707a0efa67c0541

Download Submit
C:\Windows\system\iMswirZ.exe

Filesize
2.2MB

MD5
9ab4abb604ec31ab417663d7f50d3565

SHA1
2263160533aec675bd3bf1381fd1d28f9b1eb968

SHA256
94ff81b3dd850e7dcba3b3e278bf0a8a63924fff1633482f55c5a0d4cfe0eb06

SHA512
a7ab1fdcd4035ac04524f6ecf74c9c04bcffa2645da86679330f00384bde78a7bed4ebab55752e474b9c01eb90e6a5dc249d3c1e48895f8ea38e08320a281b8a

Download Submit
C:\Windows\system\knMcNEi.exe

Filesize
2.2MB

MD5
0fdf8904595bac8b537e620dbe3c6f06

SHA1
0edaf87925ba5d587cb6593ab7a6dd301f9f2cd8

SHA256
54986d52520ded5a543e6a4f9c82e6272827994839c33d04f08eeda629cbbe79

SHA512
5aff325b1f3f6ad1e4053300e2e39b5e4fc8d287ae0c132f6d493f597f2c7b3332d6f517f0360059cbafdd059993dbaa787060d875cc1273e3a06c09b99d647a

Download Submit
C:\Windows\system\lKJkYLg.exe

Filesize
1.7MB

MD5
e83d411bc34dd0a14d29931b1721c9ae

SHA1
36ece05a39a11834710319aa726b7ae48b512a1f

SHA256
fc84a86cd59711741ca784c46f8dcbb19d0098ff7e70096fd82e9b5ba7c49315

SHA512
3d4d31143ffdf48c0718e32199a475f458c8041e3cb4ffae0f510ac5646c8fec353ad94bb7b44bf85ba910ca8d5fde42a8b9af22549050a5bd1f2a77c419467b

Download Submit
C:\Windows\system\lMbkVuC.exe

Filesize
2.2MB

MD5
aae54f5fef091351ca1202107655696c

SHA1
9e968b7679558316bedcf356cf040f5185fd58a0

SHA256
8b9bb903145775b8abddab8bc24f3abde71a193123fe895ffcaf66161599edd1

SHA512
d297ecf32aec0b8eab9410b4403a32faf92a0019dc85202eae8a1fa4e08c9b1deb57500463fd1b817ba23a4f9051bedbbcf95853f54478199526bd02863f112e

Download Submit
C:\Windows\system\mmvKNdE.exe

Filesize
2.2MB

MD5
7d0e8efbcfaf6d381dd654bfe6e46fa0

SHA1
51c3a70bfd6fc2270a44ab4c6a02452e90cc6523

SHA256
e3749fc358b80e75671769cdbf4f87c8e12d54e26dd45205f3973df8a02896a7

SHA512
fc7e2d08542d63ef8040697aca3861edc9f4912a7ade29edd2ab1d2e811865fcf92c8d79ca4f9f1546cd3e35ed1880f20bf1441b71cd7b4b31be48b342ad6ef6

Download Submit
C:\Windows\system\pceWeqU.exe

Filesize
2.2MB

MD5
a3622887650fa9223da0f6be06ea31c4

SHA1
c1900ff3b1b86376ae5b69ccf53dbbda53b25619

SHA256
969cd827385ffb29520350cff5737915f350936bac14b56ea03d73814c8a8351

SHA512
4e4a3a24fe3cf41762faee8902212f79e1773a03ab8c9469c221cc359d66ca86000d0d1e0255e1af13a07878dfe98da765a4807552648b6a72d1669078c33325

Download Submit
C:\Windows\system\rFYGjkm.exe

Filesize
1.6MB

MD5
7890b48ae3163491590762dcbfbb7dcf

SHA1
bd4df87638273f7b1ca15f37cef42d150c1d0ea8

SHA256
debec8d904251ab14e25594c9435c8818db91fcadfc559e5b35f5d52bbdec995

SHA512
ae1e55655a6e20410efb4314e7155497ee02ed6219f7668c77df48c429e716eafe8827fbd63c5e7f5ef1b506227c5401ff9356cb2e24b44ebe1755a2a645ffaa

Download Submit
C:\Windows\system\vMDiViY.exe

Filesize
2.2MB

MD5
f2da2163244219f815fb78b4db48f801

SHA1
1914dde06afdf294cf2df03797c9d8d34354fe91

SHA256
3bbb358dc4f21836253ff4b50760b91ee0c5c3437ed3699c3d3e1879f77fc429

SHA512
c073733be0c0107a41bb2d96af41562443ff70c23375f6028d24064f140754e1c4235e48d1ffd51fb3a50d20bcf171d2e99ac01e9387cb87420d5ffea09664a1

Download Submit
C:\Windows\system\xAaQHjo.exe

Filesize
2.2MB

MD5
b1ba6e2cd8f0f6b181d8ea83bc6c64e9

SHA1
6ef5ef3d6d3b3f1cd75f8bbb8868a93215417f78

SHA256
d3913e8967a424388a1311d12dc84a51cb89651eda1bed34ed4a5ef121227ea6

SHA512
0068ca62604fb45af5a1fa698eb1e05e55f4f9ddfbb5870c11be48812ccb1fe220945bcca02bc36586fdac92c74ec9a5bc49a67c03086792bd82dd7e048660d4

Download Submit
C:\Windows\system\yOaBVmE.exe

Filesize
2.2MB

MD5
2a8842a8a6a884718b69a9836329b182

SHA1
f65ec717005b0269569e01e798b31b43c051caf0

SHA256
b81b546fa6a40b7b2c76126ce0a3a67572a0eb8d7343e89dcf2b72655588fde8

SHA512
f5fefd8031251636db653bda05f2b4c42b26130505bfc9b93eefde4c1f0fc744a127d18a1b596a0c73edcc295d0c543ce8ac47d6cfa3dadc7b0ea5e9c4f86fbc

Download Submit
C:\Windows\system\zpoTpYt.exe

Filesize
2.2MB

MD5
9ac1abefae7e7f3dcf27ce51e9e7fe08

SHA1
6e9af4acc5d6247a48e62c49d128746568ace744

SHA256
645ded7e4357e5dcfd3936c000d502eebcc7f79f9ee0fc5cfc66368f70532aa4

SHA512
61210f0b12bf2921b735d29e4e5a82818b92516158b6067a7dcd5e70ed362fbf9833d0b7c3e541c97bc7a3328d4d211ce327de59b0b232fd3b6376c4814e8d6a

Download Submit
\Windows\system\Ayscwfi.exe

Filesize
2.2MB

MD5
3524bfc81ad772e3472eb035ba4d6dfe

SHA1
22c17f87cc9faaf78e9e2281ae74480cbd2c7929

SHA256
2f32e3ec498c0cae563e530f4e84d4f214ef3fb2574a521c8b6527bde3ccee6d

SHA512
b4d82b3799c513bffdf49c18107a221be2d48e67c3e56bec74b84d21bc679788f0681b7c352da4d2b269c9bb4367250038f89191a0bf315cc6e33f73f03ef6f0

Download Submit
\Windows\system\GAfxnSe.exe

Filesize
2.2MB

MD5
4e141183705b6e8aa0ed3467ffb78395

SHA1
86f318989053260d12a53fe749ab819659d70a6c

SHA256
343020f03d22ed6910c12bc4d1cf8e7078491b3a5a96883cda621d5b87b37274

SHA512
5b65f0a9a0993833db96a9215aad2d3bae9c4c1da91e356017a7f541f100d7fcdd9d7e57a191bfd214ef51274cf191ec7a02e1cf4ba3e8561815c57716c727fc

Download Submit
\Windows\system\HlyRLTk.exe

Filesize
2.2MB

MD5
848468146b9201640e184e367800f573

SHA1
62379fb4d3263b82dea5fe86919a81e9ad7846fd

SHA256
180412aab59a96a71034ed01bcdff9fe453864c90723746fc3d0431ef67600d1

SHA512
54adc54d18b4ade6caa98773afbc45c20dbb66f43beab2c03535797b751beca0b82d7470d5837a668b38ca30b100be9a2d42a925497da8ed850e28cd9d58f91f

Download Submit
\Windows\system\JMSiYuQ.exe

Filesize
2.2MB

MD5
6c48bf854438f4538274033ce315d312

SHA1
7343d2feba1e496b25c02e93823a2a65f3b98d35

SHA256
21d3334638b4ce6f8888711bbf1c9345e2904ac1a4b5558e92f6cc52a3c69b6c

SHA512
6ad2d96e4d354ef26ee7f244fc7b684f7077ddf5d22ffe5212feda9f06597751a04ef3d9dc2a4842b32db5fc686e19819191a0c17eeeafd195b23cf52a0be69d

Download Submit
\Windows\system\LgNNJzg.exe

Filesize
1.4MB

MD5
397eb3836d39fabe3f019720b0315a81

SHA1
05af587fb661a0ba07575b11d381c6e5d9a6d1d5

SHA256
e981ef35761237773d83a14363cc87eda8247a10fb748d8dafa9ac1cc2a2f8ec

SHA512
d93e0b64368bda6694e13096193a7ee6f207c21d3e5adc23725bc4f6a3bd7005ca9179f67907d078c703a9816da55e6a72223fbd0cc487e3ae2aac212b525917

Download Submit
\Windows\system\TERqWBo.exe

Filesize
2.2MB

MD5
9c3ded7ee70062230a20bd0d8d222020

SHA1
f344e38701a6dca253651193febd067c91779dcd

SHA256
a1b5678307decd6fab7d561427f1ea5dcedea7268cb50d17ab596460a374aa1f

SHA512
7e7caf5a665897fada939762ea906757c55d40c723cabbbe3056c4af372ac292f10b2736456c8e5dbc633b460ebfdf12293d363a786241fa0ef45a938f8611c9

Download Submit
\Windows\system\TSOGbZw.exe

Filesize
2.2MB

MD5
7e0f219ca02d07a95b91045943915681

SHA1
2f67b312bd887f4870c3d1aa7dd833c7ba047d20

SHA256
db7150b79549e886afb19056ed8d5cb1446be81919f87e4aa1db3deb5a78a662

SHA512
3ffea10c95b626b99595245caad6e9ff5918ffd00fe4b8ae1efe88f30109b18d353e2a822b968fdb121f54a0f39a7a34b78b9035d7f8b64f3a161338cc6a177f

Download Submit
\Windows\system\dtJCxfT.exe

Filesize
2.2MB

MD5
5576200697c20c6b665af14d38f82e44

SHA1
3c1243d75b53cf81ca697ab2636f20ca1b7c6700

SHA256
72e3bd5a7f8c681f7b6918ccae8dfccef60af73cf4e0c1cda2cc0d30d9e0cc65

SHA512
073e29d482ede23866bb8f210226d83194cbd5183ca194851d76463de3cf709460fd1da879038ae2ebf18bb2cbc02a00ff74dbc2d4b35af2fe97c5eb116c69d4

Download Submit
\Windows\system\ewoGAcD.exe

Filesize
2.2MB

MD5
c9fec5fc07020a8b93d01e3b78f429b1

SHA1
e0f3a75f7933e79f96acad9160630e72c2e0eb58

SHA256
726e3e75456b53ddfaeef962c464e3a03ae55a7acb00d50deb24f4213f535c18

SHA512
97f838134b8263ef1ffda10c2db7c116b514a55e8a9aabe57c3656fe206686341efa0678e4ee3f39a0e84be3757499ea9328a0a8df5c13c75bcfb715c257b047

Download Submit
\Windows\system\jUAWYrF.exe

Filesize
2.2MB

MD5
cd968c2ba84308d3f877970419e4aa86

SHA1
22df002047580ce7306c4a2a5b5471c001147139

SHA256
dfb118fa38059c6c5e6f1b202f177f57368d6b8ef8ee39219d7ae76b2d5a6266

SHA512
06e284b5ac45b48414e6f48f414af8529511ff17133982b7254e7c7d12c1bfceb54440418126467107c9113a029fcf4461398767bdbadbb404aa910d1809089c

Download Submit
\Windows\system\lKJkYLg.exe

Filesize
2.2MB

MD5
68236ad67638eb325c714d08a23f4444

SHA1
52dc07d973f4717551cb3c47a4b1337b6673502f

SHA256
9c5ed2c1c1c1e401e6d5a6bbdf7c19518a8868854549ddc5b7e9572a01720971

SHA512
1c06325684b77ac7a89f8fbf30bd8fc9c736a5dcf5be16a42c4c45de508e311177c1da048acd22b7e1adf0657656dbaa20eaeb05e24133e8053742f800b1778a

Download Submit
\Windows\system\oZtwfxA.exe

Filesize
2.2MB

MD5
42ad80b54c0f9da3bc14f125e609247f

SHA1
ced1f1f27e827961a769a30129903d1eeade0c6a

SHA256
30ddd95b82dc5b4a9aa022e678e2207d6459a5c23eee35616aeb07821ac181b2

SHA512
d56f6f173b652f3ff9154c469d5faab6ea587760da57aecc5745f139c69ae60245f9bf39e53e744e80614c7f8ac4c444fb561417954316feafdb715a660f6319

Download Submit
\Windows\system\rFYGjkm.exe

Filesize
1.9MB

MD5
3b793a0eb8c793336e3ae85470439c63

SHA1
8ff87c37b9665c10653d7a22e815b4206e92fa41

SHA256
a297c76ef355986d07fb33c323763df0ed3d11c611388f593efd05a686009a11

SHA512
f7518309dacf76c51d6caa2c64ce499f170e494820b507d3e6f6f2ae88e70381555935e18a9c74bc30bce3b8b846fc262a8853e493aa6b67a3be13ffe18a2adf

Download Submit
\Windows\system\ssnMyyd.exe

Filesize
2.2MB

MD5
cf7cbc88e5ac8c2141fb46a437450957

SHA1
9a80da8206af8f3888cc840b829408c6e82d3a9d

SHA256
a29a46828797b916c2cb969aa94fd6ebe45b95d5ea9c4b9b9c4d0b4cfc9b8993

SHA512
3c1e59c4687a6a3d47c61d6e0bb17b46b0741e4965688a1c18f66564395e4a3c4a9f6f347be7b4f0dc2e28586a37587f88f044f97519f895c279d7643efd0f82

Download Submit
\Windows\system\wpbXBnV.exe

Filesize
2.2MB

MD5
646a11c670b582af3eacd5a98cbb3574

SHA1
b627237373ac4cd3f7c5151bc673a8c86d5e1994

SHA256
f056c0d7018f1f8180f7ef9df546f904f3b01f4c53e5031b3d5d717dd92cd90f

SHA512
3161935065271b499d60d292c365a2bf95658b23c64ac9b0da4ae8fe2ac24209d9ce3c5f58bd3a46b2be3093f7f2aad3667ff07c5ae739c55075e57ee83c9ea7

Download Submit
\Windows\system\xiwSDEr.exe

Filesize
2.2MB

MD5
8534cde36d86f5dd1c7c95c85c9d684f

SHA1
6cdf09648bccdc197b3e8cf1fae42671ba782e94

SHA256
488149fb4d0c290b3b2d495c5328d6061038bc32a300d606a49800f51760e24a

SHA512
d431dd5e70110145bf9a9f9beef83513dd38b3f19cd848fcfb8389d3b7dc940b7904ee277358518f9fd5259164429565513abd79ecbaa25a88946003689d92bf

Download Submit
memory/1204-2039-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-237-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-211-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-0-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-205-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-386-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-214-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2068-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2068-13-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2068-6-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-219-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-239-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-209-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-234-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-242-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-238-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2068-243-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-240-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2108-2041-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2412-196-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-2048-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-2038-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-229-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-2040-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-215-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-206-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-2042-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-212-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-2043-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-198-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2524-2044-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2556-2047-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2556-16-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2696-195-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-180-0x00000000024E0000-0x00000000024E8000-memory.dmp

Filesize
32KB

Download
memory/2696-158-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/2696-197-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-244-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/2696-28-0x000007FEF603E000-0x000007FEF603F000-memory.dmp

Filesize
4KB

Download
memory/2696-501-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-2045-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2884-210-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/3064-14-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/3064-2046-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download