xmrig | c9817f1fb32bd47a5b01a6cf52b8466ca515b174f101c2ffa23d4737b0d1bd1c

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
Size

1.4MB
MD5

0fb5d09eda876bbda55b4d6f94dc97a2
SHA1

29342319a9ae78e7347e203a0626e1aa0a716cb2
SHA256

c9817f1fb32bd47a5b01a6cf52b8466ca515b174f101c2ffa23d4737b0d1bd1c
SHA512

c5097485237f4ed3df6d707a1d2a587a556ce199033453c756690cf1748dfbf977a91a3bec38ee1b7a8e09ec0d27298e55ff5696091aab23e7c9423ebb826dcb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwA+:Lz071uv4BPMkibTIA5CJj+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2776-9-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/860-20-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2360-135-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2472-124-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2700-122-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2732-121-0x0000000003070000-0x0000000003462000-memory.dmp	xmrig
behavioral1/memory/2604-120-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2756-118-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2704-116-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2948-113-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2732-112-0x0000000003070000-0x0000000003462000-memory.dmp	xmrig
behavioral1/memory/1152-111-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/3032-132-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2560-128-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/860-6540-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/1152-6539-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2948-6615-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2704-6576-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2896	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2776	kXXsKVt.exe
860	xweDMDy.exe
1152	idDLFLY.exe
2948	Jhuoodx.exe
2704	skqudqC.exe
2756	awQWJgC.exe
2604	GTwzqJH.exe
2700	wNNYIYr.exe
2472	vkvlgVx.exe
2560	jzXwdLA.exe
3032	MXbpYCs.exe
2360	ITOPkyr.exe
1428	RfwlpYy.exe
2740	elTsluQ.exe
2512	FTPjcGN.exe
1588	WthRogC.exe
2856	TYCtDNl.exe
1968	mJMPVva.exe
380	dEPuBAk.exe
2328	RxJGbzP.exe
2324	konfumB.exe
1320	RaAMvQG.exe
2280	umfYPqa.exe
2248	RKevyMi.exe
2420	cUWzaMo.exe
1652	DpAGPdo.exe
1480	HvWZCDJ.exe
1752	GIMIgJE.exe
548	qezHfKO.exe
1508	CfRIDTR.exe
692	DSHaQOs.exe
1092	dPMEDge.exe
2132	naVfIYT.exe
2092	PZQwFSa.exe
1784	LFHHccJ.exe
1776	CtVYxQj.exe
1284	hJcsaaF.exe
1360	pLFjDRo.exe
752	ROFyTtL.exe
2796	nuWQbvn.exe
1304	GVnyISz.exe
1960	XCdQufR.exe
908	JIWGrLa.exe
916	bDuhZax.exe
708	ykzKBHx.exe
2044	yLEOmSI.exe
2780	wAEqqPq.exe
1540	CPgHBoz.exe
292	xSoUlyC.exe
2952	KISvCQF.exe
1796	nxNkLJa.exe
1748	rLHoDeq.exe
896	JZajaYx.exe
1708	ovquYhR.exe
2240	EgAHqVO.exe
2068	feRvGat.exe
2912	gyTHBLJ.exe
2232	ONqANXA.exe
1580	rMqljVb.exe
2584	OxqSsrl.exe
2684	xLjzgSA.exe
1328	jNCINCI.exe
2728	JPGdQyw.exe
2468	hxVmPPv.exe

Loads dropped DLL 64 IoCs

pid	Process
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2732-1-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x000b000000014284-3.dat	upx
behavioral1/files/0x00330000000144e1-13.dat	upx
behavioral1/memory/2776-9-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x0008000000014665-26.dat	upx
behavioral1/files/0x001400000000549e-31.dat	upx
behavioral1/files/0x0008000000014817-32.dat	upx
behavioral1/memory/860-20-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x0007000000014983-40.dat	upx
behavioral1/files/0x00090000000149ea-46.dat	upx
behavioral1/files/0x0006000000015c7c-55.dat	upx
behavioral1/files/0x0006000000015c86-59.dat	upx
behavioral1/files/0x0006000000015cad-73.dat	upx
behavioral1/files/0x0006000000015cc1-80.dat	upx
behavioral1/files/0x0006000000015cf7-100.dat	upx
behavioral1/files/0x0006000000015ca5-70.dat	upx
behavioral1/files/0x0006000000015cb9-89.dat	upx
behavioral1/files/0x0006000000015cca-84.dat	upx
behavioral1/files/0x0006000000015d5d-127.dat	upx
behavioral1/memory/2360-135-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/files/0x00330000000144e9-147.dat	upx
behavioral1/files/0x0006000000016056-157.dat	upx
behavioral1/files/0x00060000000167ef-183.dat	upx
behavioral1/files/0x0006000000016597-179.dat	upx
behavioral1/files/0x0006000000016525-175.dat	upx
behavioral1/files/0x0006000000016411-171.dat	upx
behavioral1/files/0x0006000000016277-167.dat	upx
behavioral1/files/0x00060000000160f8-162.dat	upx
behavioral1/files/0x0006000000015f1b-151.dat	upx
behavioral1/files/0x0006000000015d6e-144.dat	upx
behavioral1/files/0x0006000000015f9e-155.dat	upx
behavioral1/files/0x0006000000015cec-126.dat	upx
behavioral1/memory/2472-124-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2700-122-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2604-120-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2756-118-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2704-116-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2948-113-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/1152-111-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/files/0x0006000000015d06-106.dat	upx
behavioral1/memory/3032-132-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2560-128-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x0006000000015cdb-92.dat	upx
behavioral1/files/0x0006000000015c9c-64.dat	upx
behavioral1/files/0x0008000000015c6d-50.dat	upx
behavioral1/memory/860-6540-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/1152-6539-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2948-6615-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2704-6576-0x000000013FE50000-0x0000000140242000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HoqessU.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\tytCxpi.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\WALdLDn.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\zywnLZT.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\YTjmJuS.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\iJnzyqM.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\pjWXHIA.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\vVKHagG.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ntvwtpG.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\WlnCzuU.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\GauHSkx.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\xtcgaGx.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\dVGroBI.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\XRtltet.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\DyAuKDP.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\NplnhjQ.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\UBxWyEA.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\JuTUpnt.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\OPIrGZf.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\OVfWKxj.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\OUnTido.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\vPZMEiA.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\QJYzLYW.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\BdYWcoJ.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ORfFuek.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\dTHavUj.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\jMqxSte.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\htZzNEk.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\hRtiWhN.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\uVcEFnM.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ZzRJKNw.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\FDGWgQI.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\jgIoveT.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\FNIBMch.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\twoDqcD.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\wKiihrI.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\OzZDsUR.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\LGopbeG.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\NGQsRIU.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\AoUBatK.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\WUSSVtl.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\IaOItYD.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\UmdPEyc.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\KSihXIB.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\suCLVdq.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\TgeQYOL.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\VGjHeto.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\GrTsQXv.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\dnAEuLD.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\cjUwmVH.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\tNvUaZB.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ffavwpq.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\JaYiZYU.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\utUgaoH.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\ZdoRrfg.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\vLeFQfh.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\hJbOihp.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\CfTOrnt.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\KPTRsnO.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\njmbyAO.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\oOdTcCf.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\nFTWquj.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\whagUnQ.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
File created	C:\Windows\System\uOogzcb.exe	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2896	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
Token: SeDebugPrivilege	2896	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2896	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	29
PID 2732 wrote to memory of 2896	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	29
PID 2732 wrote to memory of 2896	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	29
PID 2732 wrote to memory of 2776	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2776	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	30
PID 2732 wrote to memory of 2776	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	30
PID 2732 wrote to memory of 860	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	31
PID 2732 wrote to memory of 860	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	31
PID 2732 wrote to memory of 860	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	31
PID 2732 wrote to memory of 1152	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	32
PID 2732 wrote to memory of 1152	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	32
PID 2732 wrote to memory of 1152	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	32
PID 2732 wrote to memory of 2948	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	33
PID 2732 wrote to memory of 2948	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	33
PID 2732 wrote to memory of 2948	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	33
PID 2732 wrote to memory of 2704	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	34
PID 2732 wrote to memory of 2704	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	34
PID 2732 wrote to memory of 2704	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	34
PID 2732 wrote to memory of 2756	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	35
PID 2732 wrote to memory of 2756	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	35
PID 2732 wrote to memory of 2756	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	35
PID 2732 wrote to memory of 2604	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	36
PID 2732 wrote to memory of 2604	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	36
PID 2732 wrote to memory of 2604	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	36
PID 2732 wrote to memory of 2700	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	37
PID 2732 wrote to memory of 2700	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	37
PID 2732 wrote to memory of 2700	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	37
PID 2732 wrote to memory of 2472	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	38
PID 2732 wrote to memory of 2472	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	38
PID 2732 wrote to memory of 2472	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	38
PID 2732 wrote to memory of 2560	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	39
PID 2732 wrote to memory of 2560	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	39
PID 2732 wrote to memory of 2560	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	39
PID 2732 wrote to memory of 3032	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	40
PID 2732 wrote to memory of 3032	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	40
PID 2732 wrote to memory of 3032	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	40
PID 2732 wrote to memory of 2360	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	41
PID 2732 wrote to memory of 2360	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	41
PID 2732 wrote to memory of 2360	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	41
PID 2732 wrote to memory of 1428	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	42
PID 2732 wrote to memory of 1428	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	42
PID 2732 wrote to memory of 1428	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	42
PID 2732 wrote to memory of 2512	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	43
PID 2732 wrote to memory of 2512	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	43
PID 2732 wrote to memory of 2512	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	43
PID 2732 wrote to memory of 2740	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	44
PID 2732 wrote to memory of 2740	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	44
PID 2732 wrote to memory of 2740	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	44
PID 2732 wrote to memory of 2856	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	45
PID 2732 wrote to memory of 2856	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	45
PID 2732 wrote to memory of 2856	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	45
PID 2732 wrote to memory of 1588	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	46
PID 2732 wrote to memory of 1588	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	46
PID 2732 wrote to memory of 1588	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	46
PID 2732 wrote to memory of 380	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	47
PID 2732 wrote to memory of 380	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	47
PID 2732 wrote to memory of 380	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	47
PID 2732 wrote to memory of 1968	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	48
PID 2732 wrote to memory of 1968	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	48
PID 2732 wrote to memory of 1968	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	48
PID 2732 wrote to memory of 2324	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	49
PID 2732 wrote to memory of 2324	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	49
PID 2732 wrote to memory of 2324	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	49
PID 2732 wrote to memory of 2328	2732	0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fb5d09eda876bbda55b4d6f94dc97a2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System\kXXsKVt.exe
  C:\Windows\System\kXXsKVt.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\xweDMDy.exe
  C:\Windows\System\xweDMDy.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\idDLFLY.exe
  C:\Windows\System\idDLFLY.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\Jhuoodx.exe
  C:\Windows\System\Jhuoodx.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\skqudqC.exe
  C:\Windows\System\skqudqC.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\awQWJgC.exe
  C:\Windows\System\awQWJgC.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\GTwzqJH.exe
  C:\Windows\System\GTwzqJH.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\wNNYIYr.exe
  C:\Windows\System\wNNYIYr.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\vkvlgVx.exe
  C:\Windows\System\vkvlgVx.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\jzXwdLA.exe
  C:\Windows\System\jzXwdLA.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\MXbpYCs.exe
  C:\Windows\System\MXbpYCs.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ITOPkyr.exe
  C:\Windows\System\ITOPkyr.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\RfwlpYy.exe
  C:\Windows\System\RfwlpYy.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\FTPjcGN.exe
  C:\Windows\System\FTPjcGN.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\elTsluQ.exe
  C:\Windows\System\elTsluQ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\TYCtDNl.exe
  C:\Windows\System\TYCtDNl.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\WthRogC.exe
  C:\Windows\System\WthRogC.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\dEPuBAk.exe
  C:\Windows\System\dEPuBAk.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\mJMPVva.exe
  C:\Windows\System\mJMPVva.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\konfumB.exe
  C:\Windows\System\konfumB.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\RxJGbzP.exe
  C:\Windows\System\RxJGbzP.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\RaAMvQG.exe
  C:\Windows\System\RaAMvQG.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\umfYPqa.exe
  C:\Windows\System\umfYPqa.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\RKevyMi.exe
  C:\Windows\System\RKevyMi.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\cUWzaMo.exe
  C:\Windows\System\cUWzaMo.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\HvWZCDJ.exe
  C:\Windows\System\HvWZCDJ.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\DpAGPdo.exe
  C:\Windows\System\DpAGPdo.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\GIMIgJE.exe
  C:\Windows\System\GIMIgJE.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\qezHfKO.exe
  C:\Windows\System\qezHfKO.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\CfRIDTR.exe
  C:\Windows\System\CfRIDTR.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\DSHaQOs.exe
  C:\Windows\System\DSHaQOs.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\dPMEDge.exe
  C:\Windows\System\dPMEDge.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\naVfIYT.exe
  C:\Windows\System\naVfIYT.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\PZQwFSa.exe
  C:\Windows\System\PZQwFSa.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\LFHHccJ.exe
  C:\Windows\System\LFHHccJ.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\CtVYxQj.exe
  C:\Windows\System\CtVYxQj.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\hJcsaaF.exe
  C:\Windows\System\hJcsaaF.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\pLFjDRo.exe
  C:\Windows\System\pLFjDRo.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ROFyTtL.exe
  C:\Windows\System\ROFyTtL.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\nuWQbvn.exe
  C:\Windows\System\nuWQbvn.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\GVnyISz.exe
  C:\Windows\System\GVnyISz.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\XCdQufR.exe
  C:\Windows\System\XCdQufR.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\JIWGrLa.exe
  C:\Windows\System\JIWGrLa.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\bDuhZax.exe
  C:\Windows\System\bDuhZax.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\ykzKBHx.exe
  C:\Windows\System\ykzKBHx.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\yLEOmSI.exe
  C:\Windows\System\yLEOmSI.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\wAEqqPq.exe
  C:\Windows\System\wAEqqPq.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\CPgHBoz.exe
  C:\Windows\System\CPgHBoz.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\xSoUlyC.exe
  C:\Windows\System\xSoUlyC.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\KISvCQF.exe
  C:\Windows\System\KISvCQF.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\nxNkLJa.exe
  C:\Windows\System\nxNkLJa.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\rLHoDeq.exe
  C:\Windows\System\rLHoDeq.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\JZajaYx.exe
  C:\Windows\System\JZajaYx.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\ovquYhR.exe
  C:\Windows\System\ovquYhR.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\EgAHqVO.exe
  C:\Windows\System\EgAHqVO.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\feRvGat.exe
  C:\Windows\System\feRvGat.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\gyTHBLJ.exe
  C:\Windows\System\gyTHBLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\ONqANXA.exe
  C:\Windows\System\ONqANXA.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\rMqljVb.exe
  C:\Windows\System\rMqljVb.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\OxqSsrl.exe
  C:\Windows\System\OxqSsrl.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\xLjzgSA.exe
  C:\Windows\System\xLjzgSA.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\jNCINCI.exe
  C:\Windows\System\jNCINCI.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\JPGdQyw.exe
  C:\Windows\System\JPGdQyw.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\hxVmPPv.exe
  C:\Windows\System\hxVmPPv.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\AqqkGKx.exe
  C:\Windows\System\AqqkGKx.exe
  2⤵
  PID:2576
- C:\Windows\System\UyxdoMf.exe
  C:\Windows\System\UyxdoMf.exe
  2⤵
  PID:2436
- C:\Windows\System\kFyQwzz.exe
  C:\Windows\System\kFyQwzz.exe
  2⤵
  PID:2520
- C:\Windows\System\QjfBlja.exe
  C:\Windows\System\QjfBlja.exe
  2⤵
  PID:2736
- C:\Windows\System\jxRqpxH.exe
  C:\Windows\System\jxRqpxH.exe
  2⤵
  PID:2892
- C:\Windows\System\WjuDMiV.exe
  C:\Windows\System\WjuDMiV.exe
  2⤵
  PID:1824
- C:\Windows\System\WasRSIi.exe
  C:\Windows\System\WasRSIi.exe
  2⤵
  PID:1964
- C:\Windows\System\LQBPvBC.exe
  C:\Windows\System\LQBPvBC.exe
  2⤵
  PID:1944
- C:\Windows\System\Bcrickb.exe
  C:\Windows\System\Bcrickb.exe
  2⤵
  PID:2624
- C:\Windows\System\bnEaPPW.exe
  C:\Windows\System\bnEaPPW.exe
  2⤵
  PID:2564
- C:\Windows\System\swUOAJy.exe
  C:\Windows\System\swUOAJy.exe
  2⤵
  PID:2972
- C:\Windows\System\TBVNbJn.exe
  C:\Windows\System\TBVNbJn.exe
  2⤵
  PID:1020
- C:\Windows\System\ttZYEZB.exe
  C:\Windows\System\ttZYEZB.exe
  2⤵
  PID:1764
- C:\Windows\System\SFlUbGs.exe
  C:\Windows\System\SFlUbGs.exe
  2⤵
  PID:2272
- C:\Windows\System\KPPZQBy.exe
  C:\Windows\System\KPPZQBy.exe
  2⤵
  PID:2228
- C:\Windows\System\qviWIjS.exe
  C:\Windows\System\qviWIjS.exe
  2⤵
  PID:584
- C:\Windows\System\RyYTXJI.exe
  C:\Windows\System\RyYTXJI.exe
  2⤵
  PID:2708
- C:\Windows\System\oHDWFoZ.exe
  C:\Windows\System\oHDWFoZ.exe
  2⤵
  PID:2312
- C:\Windows\System\BEVLukl.exe
  C:\Windows\System\BEVLukl.exe
  2⤵
  PID:3036
- C:\Windows\System\JOupNbJ.exe
  C:\Windows\System\JOupNbJ.exe
  2⤵
  PID:1700
- C:\Windows\System\KeYShJE.exe
  C:\Windows\System\KeYShJE.exe
  2⤵
  PID:1556
- C:\Windows\System\ofmsygh.exe
  C:\Windows\System\ofmsygh.exe
  2⤵
  PID:2492
- C:\Windows\System\NRNusGH.exe
  C:\Windows\System\NRNusGH.exe
  2⤵
  PID:956
- C:\Windows\System\LGnAdMr.exe
  C:\Windows\System\LGnAdMr.exe
  2⤵
  PID:1372
- C:\Windows\System\CDDkPto.exe
  C:\Windows\System\CDDkPto.exe
  2⤵
  PID:2288
- C:\Windows\System\vypyOAa.exe
  C:\Windows\System\vypyOAa.exe
  2⤵
  PID:1312
- C:\Windows\System\jxUFzxw.exe
  C:\Windows\System\jxUFzxw.exe
  2⤵
  PID:596
- C:\Windows\System\GxsSwye.exe
  C:\Windows\System\GxsSwye.exe
  2⤵
  PID:2916
- C:\Windows\System\FFRqurb.exe
  C:\Windows\System\FFRqurb.exe
  2⤵
  PID:1888
- C:\Windows\System\IhJlisZ.exe
  C:\Windows\System\IhJlisZ.exe
  2⤵
  PID:868
- C:\Windows\System\qqPqnyT.exe
  C:\Windows\System\qqPqnyT.exe
  2⤵
  PID:3060
- C:\Windows\System\TaEyqYb.exe
  C:\Windows\System\TaEyqYb.exe
  2⤵
  PID:888
- C:\Windows\System\HjraNMz.exe
  C:\Windows\System\HjraNMz.exe
  2⤵
  PID:2336
- C:\Windows\System\MDTiXss.exe
  C:\Windows\System\MDTiXss.exe
  2⤵
  PID:2876
- C:\Windows\System\ettleMZ.exe
  C:\Windows\System\ettleMZ.exe
  2⤵
  PID:2664
- C:\Windows\System\VKsNveQ.exe
  C:\Windows\System\VKsNveQ.exe
  2⤵
  PID:2696
- C:\Windows\System\XYdnJUF.exe
  C:\Windows\System\XYdnJUF.exe
  2⤵
  PID:2600
- C:\Windows\System\CsGInMC.exe
  C:\Windows\System\CsGInMC.exe
  2⤵
  PID:2500
- C:\Windows\System\vPXqTmA.exe
  C:\Windows\System\vPXqTmA.exe
  2⤵
  PID:2592
- C:\Windows\System\XBKhPgw.exe
  C:\Windows\System\XBKhPgw.exe
  2⤵
  PID:2864
- C:\Windows\System\GpgBkjT.exe
  C:\Windows\System\GpgBkjT.exe
  2⤵
  PID:272
- C:\Windows\System\GxXRdyt.exe
  C:\Windows\System\GxXRdyt.exe
  2⤵
  PID:2768
- C:\Windows\System\gQJCuJS.exe
  C:\Windows\System\gQJCuJS.exe
  2⤵
  PID:2268
- C:\Windows\System\MHCJHbz.exe
  C:\Windows\System\MHCJHbz.exe
  2⤵
  PID:1128
- C:\Windows\System\viLqCaO.exe
  C:\Windows\System\viLqCaO.exe
  2⤵
  PID:2256
- C:\Windows\System\WeDNIHx.exe
  C:\Windows\System\WeDNIHx.exe
  2⤵
  PID:1472
- C:\Windows\System\YGrXjVX.exe
  C:\Windows\System\YGrXjVX.exe
  2⤵
  PID:3068
- C:\Windows\System\hwevWte.exe
  C:\Windows\System\hwevWte.exe
  2⤵
  PID:2128
- C:\Windows\System\YmuyOvP.exe
  C:\Windows\System\YmuyOvP.exe
  2⤵
  PID:1676
- C:\Windows\System\WsCbVEY.exe
  C:\Windows\System\WsCbVEY.exe
  2⤵
  PID:544
- C:\Windows\System\sgDxvjK.exe
  C:\Windows\System\sgDxvjK.exe
  2⤵
  PID:2516
- C:\Windows\System\bxNWTii.exe
  C:\Windows\System\bxNWTii.exe
  2⤵
  PID:1648
- C:\Windows\System\ukzCJZp.exe
  C:\Windows\System\ukzCJZp.exe
  2⤵
  PID:2304
- C:\Windows\System\MrQtwMM.exe
  C:\Windows\System\MrQtwMM.exe
  2⤵
  PID:2308
- C:\Windows\System\eETTmwk.exe
  C:\Windows\System\eETTmwk.exe
  2⤵
  PID:2368
- C:\Windows\System\TGCMvQG.exe
  C:\Windows\System\TGCMvQG.exe
  2⤵
  PID:2848
- C:\Windows\System\wqdNCKa.exe
  C:\Windows\System\wqdNCKa.exe
  2⤵
  PID:2204
- C:\Windows\System\eJaTRev.exe
  C:\Windows\System\eJaTRev.exe
  2⤵
  PID:2556
- C:\Windows\System\Ciyjjgb.exe
  C:\Windows\System\Ciyjjgb.exe
  2⤵
  PID:2932
- C:\Windows\System\ksXVnyg.exe
  C:\Windows\System\ksXVnyg.exe
  2⤵
  PID:2428
- C:\Windows\System\uGosdIB.exe
  C:\Windows\System\uGosdIB.exe
  2⤵
  PID:1040
- C:\Windows\System\ncWmMJq.exe
  C:\Windows\System\ncWmMJq.exe
  2⤵
  PID:1516
- C:\Windows\System\sTpFouK.exe
  C:\Windows\System\sTpFouK.exe
  2⤵
  PID:1940
- C:\Windows\System\miHKriG.exe
  C:\Windows\System\miHKriG.exe
  2⤵
  PID:2752
- C:\Windows\System\cifvEvh.exe
  C:\Windows\System\cifvEvh.exe
  2⤵
  PID:836
- C:\Windows\System\qYgQtap.exe
  C:\Windows\System\qYgQtap.exe
  2⤵
  PID:3080
- C:\Windows\System\AJYmfBs.exe
  C:\Windows\System\AJYmfBs.exe
  2⤵
  PID:3096
- C:\Windows\System\UatWoYj.exe
  C:\Windows\System\UatWoYj.exe
  2⤵
  PID:3112
- C:\Windows\System\IfDrkCS.exe
  C:\Windows\System\IfDrkCS.exe
  2⤵
  PID:3128
- C:\Windows\System\PTeTxZn.exe
  C:\Windows\System\PTeTxZn.exe
  2⤵
  PID:3144
- C:\Windows\System\VbDvenI.exe
  C:\Windows\System\VbDvenI.exe
  2⤵
  PID:3160
- C:\Windows\System\IIFERcf.exe
  C:\Windows\System\IIFERcf.exe
  2⤵
  PID:3176
- C:\Windows\System\HRhazXE.exe
  C:\Windows\System\HRhazXE.exe
  2⤵
  PID:3192
- C:\Windows\System\RoQNSZK.exe
  C:\Windows\System\RoQNSZK.exe
  2⤵
  PID:3208
- C:\Windows\System\CepNbKu.exe
  C:\Windows\System\CepNbKu.exe
  2⤵
  PID:3224
- C:\Windows\System\jBdyxcK.exe
  C:\Windows\System\jBdyxcK.exe
  2⤵
  PID:3240
- C:\Windows\System\HvVczsu.exe
  C:\Windows\System\HvVczsu.exe
  2⤵
  PID:3256
- C:\Windows\System\NyFYUdG.exe
  C:\Windows\System\NyFYUdG.exe
  2⤵
  PID:3272
- C:\Windows\System\KQwhuQL.exe
  C:\Windows\System\KQwhuQL.exe
  2⤵
  PID:3288
- C:\Windows\System\XGrZVGY.exe
  C:\Windows\System\XGrZVGY.exe
  2⤵
  PID:3304
- C:\Windows\System\IFdxmbc.exe
  C:\Windows\System\IFdxmbc.exe
  2⤵
  PID:3320
- C:\Windows\System\JyXSJud.exe
  C:\Windows\System\JyXSJud.exe
  2⤵
  PID:3336
- C:\Windows\System\vLeFQfh.exe
  C:\Windows\System\vLeFQfh.exe
  2⤵
  PID:3352
- C:\Windows\System\CHmXtgx.exe
  C:\Windows\System\CHmXtgx.exe
  2⤵
  PID:3368
- C:\Windows\System\iTLzEBQ.exe
  C:\Windows\System\iTLzEBQ.exe
  2⤵
  PID:3384
- C:\Windows\System\MuCSDvI.exe
  C:\Windows\System\MuCSDvI.exe
  2⤵
  PID:3400
- C:\Windows\System\FOVXgvr.exe
  C:\Windows\System\FOVXgvr.exe
  2⤵
  PID:3416
- C:\Windows\System\gDgKkqy.exe
  C:\Windows\System\gDgKkqy.exe
  2⤵
  PID:3432
- C:\Windows\System\oFKXvCP.exe
  C:\Windows\System\oFKXvCP.exe
  2⤵
  PID:3448
- C:\Windows\System\SQGYSOY.exe
  C:\Windows\System\SQGYSOY.exe
  2⤵
  PID:3464
- C:\Windows\System\ikmqIOq.exe
  C:\Windows\System\ikmqIOq.exe
  2⤵
  PID:3480
- C:\Windows\System\eNavKwH.exe
  C:\Windows\System\eNavKwH.exe
  2⤵
  PID:3496
- C:\Windows\System\fImodWa.exe
  C:\Windows\System\fImodWa.exe
  2⤵
  PID:3512
- C:\Windows\System\zpCFIaG.exe
  C:\Windows\System\zpCFIaG.exe
  2⤵
  PID:3528
- C:\Windows\System\JZhhoqq.exe
  C:\Windows\System\JZhhoqq.exe
  2⤵
  PID:3544
- C:\Windows\System\jlANPKl.exe
  C:\Windows\System\jlANPKl.exe
  2⤵
  PID:3560
- C:\Windows\System\jTuZFVv.exe
  C:\Windows\System\jTuZFVv.exe
  2⤵
  PID:3576
- C:\Windows\System\XOdmFPj.exe
  C:\Windows\System\XOdmFPj.exe
  2⤵
  PID:3592
- C:\Windows\System\cpPAUjj.exe
  C:\Windows\System\cpPAUjj.exe
  2⤵
  PID:3608
- C:\Windows\System\SBSpkHR.exe
  C:\Windows\System\SBSpkHR.exe
  2⤵
  PID:3624
- C:\Windows\System\nUFqldb.exe
  C:\Windows\System\nUFqldb.exe
  2⤵
  PID:3640
- C:\Windows\System\LYlTCuU.exe
  C:\Windows\System\LYlTCuU.exe
  2⤵
  PID:3656
- C:\Windows\System\ptuMiXk.exe
  C:\Windows\System\ptuMiXk.exe
  2⤵
  PID:3672
- C:\Windows\System\SUiiVcG.exe
  C:\Windows\System\SUiiVcG.exe
  2⤵
  PID:3688
- C:\Windows\System\voqiKwy.exe
  C:\Windows\System\voqiKwy.exe
  2⤵
  PID:3704
- C:\Windows\System\AzlDsrs.exe
  C:\Windows\System\AzlDsrs.exe
  2⤵
  PID:3720
- C:\Windows\System\WUovjdt.exe
  C:\Windows\System\WUovjdt.exe
  2⤵
  PID:3736
- C:\Windows\System\mETMwsB.exe
  C:\Windows\System\mETMwsB.exe
  2⤵
  PID:3752
- C:\Windows\System\WkDKbmL.exe
  C:\Windows\System\WkDKbmL.exe
  2⤵
  PID:3768
- C:\Windows\System\asHmgBp.exe
  C:\Windows\System\asHmgBp.exe
  2⤵
  PID:3784
- C:\Windows\System\oVLbeBB.exe
  C:\Windows\System\oVLbeBB.exe
  2⤵
  PID:3800
- C:\Windows\System\VlQQoXr.exe
  C:\Windows\System\VlQQoXr.exe
  2⤵
  PID:3816
- C:\Windows\System\YMGfqxI.exe
  C:\Windows\System\YMGfqxI.exe
  2⤵
  PID:3832
- C:\Windows\System\hLiADME.exe
  C:\Windows\System\hLiADME.exe
  2⤵
  PID:3848
- C:\Windows\System\fEjvrUj.exe
  C:\Windows\System\fEjvrUj.exe
  2⤵
  PID:3864
- C:\Windows\System\pIdblLl.exe
  C:\Windows\System\pIdblLl.exe
  2⤵
  PID:3880
- C:\Windows\System\BbPOQEg.exe
  C:\Windows\System\BbPOQEg.exe
  2⤵
  PID:3896
- C:\Windows\System\lZfnjYf.exe
  C:\Windows\System\lZfnjYf.exe
  2⤵
  PID:3912
- C:\Windows\System\sukFOHi.exe
  C:\Windows\System\sukFOHi.exe
  2⤵
  PID:3928
- C:\Windows\System\JXCfkzG.exe
  C:\Windows\System\JXCfkzG.exe
  2⤵
  PID:3944
- C:\Windows\System\VwBelFn.exe
  C:\Windows\System\VwBelFn.exe
  2⤵
  PID:3960
- C:\Windows\System\cuWgGsw.exe
  C:\Windows\System\cuWgGsw.exe
  2⤵
  PID:3976
- C:\Windows\System\kYDyVAY.exe
  C:\Windows\System\kYDyVAY.exe
  2⤵
  PID:3992
- C:\Windows\System\OhmEIKj.exe
  C:\Windows\System\OhmEIKj.exe
  2⤵
  PID:4008
- C:\Windows\System\dBxeWks.exe
  C:\Windows\System\dBxeWks.exe
  2⤵
  PID:4024
- C:\Windows\System\cRgYBNk.exe
  C:\Windows\System\cRgYBNk.exe
  2⤵
  PID:4044
- C:\Windows\System\MZdTLCx.exe
  C:\Windows\System\MZdTLCx.exe
  2⤵
  PID:4060
- C:\Windows\System\aHNYkss.exe
  C:\Windows\System\aHNYkss.exe
  2⤵
  PID:4076
- C:\Windows\System\YdlcBUx.exe
  C:\Windows\System\YdlcBUx.exe
  2⤵
  PID:4092
- C:\Windows\System\KnaMFjJ.exe
  C:\Windows\System\KnaMFjJ.exe
  2⤵
  PID:1828
- C:\Windows\System\WdGenRC.exe
  C:\Windows\System\WdGenRC.exe
  2⤵
  PID:2580
- C:\Windows\System\pMNmmWP.exe
  C:\Windows\System\pMNmmWP.exe
  2⤵
  PID:1032
- C:\Windows\System\sEyFJlP.exe
  C:\Windows\System\sEyFJlP.exe
  2⤵
  PID:2824
- C:\Windows\System\FykSWbJ.exe
  C:\Windows\System\FykSWbJ.exe
  2⤵
  PID:2628
- C:\Windows\System\eHHrYOO.exe
  C:\Windows\System\eHHrYOO.exe
  2⤵
  PID:2720
- C:\Windows\System\InIGlxa.exe
  C:\Windows\System\InIGlxa.exe
  2⤵
  PID:2636
- C:\Windows\System\alctZSx.exe
  C:\Windows\System\alctZSx.exe
  2⤵
  PID:3104
- C:\Windows\System\uITCKFj.exe
  C:\Windows\System\uITCKFj.exe
  2⤵
  PID:1868
- C:\Windows\System\HIxIEFX.exe
  C:\Windows\System\HIxIEFX.exe
  2⤵
  PID:3140
- C:\Windows\System\DnYjRnC.exe
  C:\Windows\System\DnYjRnC.exe
  2⤵
  PID:3156
- C:\Windows\System\wBddrKp.exe
  C:\Windows\System\wBddrKp.exe
  2⤵
  PID:3232
- C:\Windows\System\DAubIZw.exe
  C:\Windows\System\DAubIZw.exe
  2⤵
  PID:3264
- C:\Windows\System\PqXYXXc.exe
  C:\Windows\System\PqXYXXc.exe
  2⤵
  PID:3252
- C:\Windows\System\vVaNzQY.exe
  C:\Windows\System\vVaNzQY.exe
  2⤵
  PID:3300
- C:\Windows\System\wbQtGNV.exe
  C:\Windows\System\wbQtGNV.exe
  2⤵
  PID:3360
- C:\Windows\System\ZuSjmiu.exe
  C:\Windows\System\ZuSjmiu.exe
  2⤵
  PID:3348
- C:\Windows\System\HenrexX.exe
  C:\Windows\System\HenrexX.exe
  2⤵
  PID:3380
- C:\Windows\System\AdNIFgE.exe
  C:\Windows\System\AdNIFgE.exe
  2⤵
  PID:3412
- C:\Windows\System\YxJtYqp.exe
  C:\Windows\System\YxJtYqp.exe
  2⤵
  PID:3488
- C:\Windows\System\RIsMHzn.exe
  C:\Windows\System\RIsMHzn.exe
  2⤵
  PID:3472
- C:\Windows\System\SxznvkL.exe
  C:\Windows\System\SxznvkL.exe
  2⤵
  PID:3508
- C:\Windows\System\kTcJLrG.exe
  C:\Windows\System\kTcJLrG.exe
  2⤵
  PID:3540
- C:\Windows\System\DQemBMu.exe
  C:\Windows\System\DQemBMu.exe
  2⤵
  PID:3616
- C:\Windows\System\UPcbXLH.exe
  C:\Windows\System\UPcbXLH.exe
  2⤵
  PID:3648
- C:\Windows\System\fpYUyuG.exe
  C:\Windows\System\fpYUyuG.exe
  2⤵
  PID:3664
- C:\Windows\System\uDmEeZY.exe
  C:\Windows\System\uDmEeZY.exe
  2⤵
  PID:3712
- C:\Windows\System\jQXqVqq.exe
  C:\Windows\System\jQXqVqq.exe
  2⤵
  PID:3744
- C:\Windows\System\ePtckcK.exe
  C:\Windows\System\ePtckcK.exe
  2⤵
  PID:3748
- C:\Windows\System\JyBrcWI.exe
  C:\Windows\System\JyBrcWI.exe
  2⤵
  PID:3780
- C:\Windows\System\awUCcDO.exe
  C:\Windows\System\awUCcDO.exe
  2⤵
  PID:1952
- C:\Windows\System\sREqkOT.exe
  C:\Windows\System\sREqkOT.exe
  2⤵
  PID:3844
- C:\Windows\System\kwYOBpH.exe
  C:\Windows\System\kwYOBpH.exe
  2⤵
  PID:3828
- C:\Windows\System\kuUsWJO.exe
  C:\Windows\System\kuUsWJO.exe
  2⤵
  PID:3936
- C:\Windows\System\KqYgjNJ.exe
  C:\Windows\System\KqYgjNJ.exe
  2⤵
  PID:3940
- C:\Windows\System\yrlTefq.exe
  C:\Windows\System\yrlTefq.exe
  2⤵
  PID:4032
- C:\Windows\System\JpVuYNu.exe
  C:\Windows\System\JpVuYNu.exe
  2⤵
  PID:2672
- C:\Windows\System\YZDmfAI.exe
  C:\Windows\System\YZDmfAI.exe
  2⤵
  PID:2656
- C:\Windows\System\XIoNmSV.exe
  C:\Windows\System\XIoNmSV.exe
  2⤵
  PID:768
- C:\Windows\System\gtKKvho.exe
  C:\Windows\System\gtKKvho.exe
  2⤵
  PID:3984
- C:\Windows\System\ISauYeE.exe
  C:\Windows\System\ISauYeE.exe
  2⤵
  PID:3956
- C:\Windows\System\egqtTnh.exe
  C:\Windows\System\egqtTnh.exe
  2⤵
  PID:4084
- C:\Windows\System\dnLWbet.exe
  C:\Windows\System\dnLWbet.exe
  2⤵
  PID:2480
- C:\Windows\System\ojDjZkP.exe
  C:\Windows\System\ojDjZkP.exe
  2⤵
  PID:1668
- C:\Windows\System\AzxjjjR.exe
  C:\Windows\System\AzxjjjR.exe
  2⤵
  PID:3076
- C:\Windows\System\xrJqsMG.exe
  C:\Windows\System\xrJqsMG.exe
  2⤵
  PID:3184
- C:\Windows\System\VeevOwG.exe
  C:\Windows\System\VeevOwG.exe
  2⤵
  PID:3328
- C:\Windows\System\ohLjUHc.exe
  C:\Windows\System\ohLjUHc.exe
  2⤵
  PID:3460
- C:\Windows\System\OiVibpa.exe
  C:\Windows\System\OiVibpa.exe
  2⤵
  PID:3568
- C:\Windows\System\djEOTDh.exe
  C:\Windows\System\djEOTDh.exe
  2⤵
  PID:3700
- C:\Windows\System\fZKgyIV.exe
  C:\Windows\System\fZKgyIV.exe
  2⤵
  PID:3216
- C:\Windows\System\bbnTIpM.exe
  C:\Windows\System\bbnTIpM.exe
  2⤵
  PID:3296
- C:\Windows\System\CCLxUQK.exe
  C:\Windows\System\CCLxUQK.exe
  2⤵
  PID:3428
- C:\Windows\System\HaCHgeA.exe
  C:\Windows\System\HaCHgeA.exe
  2⤵
  PID:3536
- C:\Windows\System\qvCvmBr.exe
  C:\Windows\System\qvCvmBr.exe
  2⤵
  PID:3668
- C:\Windows\System\PIWnLRP.exe
  C:\Windows\System\PIWnLRP.exe
  2⤵
  PID:3840
- C:\Windows\System\NrBhznW.exe
  C:\Windows\System\NrBhznW.exe
  2⤵
  PID:3892
- C:\Windows\System\lSjOvHi.exe
  C:\Windows\System\lSjOvHi.exe
  2⤵
  PID:4072
- C:\Windows\System\pwzWMBq.exe
  C:\Windows\System\pwzWMBq.exe
  2⤵
  PID:1696
- C:\Windows\System\HICUdmt.exe
  C:\Windows\System\HICUdmt.exe
  2⤵
  PID:3824
- C:\Windows\System\NRsUBJe.exe
  C:\Windows\System\NRsUBJe.exe
  2⤵
  PID:4004
- C:\Windows\System\cFkhFqO.exe
  C:\Windows\System\cFkhFqO.exe
  2⤵
  PID:4020
- C:\Windows\System\gRqDCXf.exe
  C:\Windows\System\gRqDCXf.exe
  2⤵
  PID:4056
- C:\Windows\System\NyhdBds.exe
  C:\Windows\System\NyhdBds.exe
  2⤵
  PID:3124
- C:\Windows\System\NNZhfOW.exe
  C:\Windows\System\NNZhfOW.exe
  2⤵
  PID:3680
- C:\Windows\System\ciTeATC.exe
  C:\Windows\System\ciTeATC.exe
  2⤵
  PID:2424
- C:\Windows\System\ekDNLMf.exe
  C:\Windows\System\ekDNLMf.exe
  2⤵
  PID:2532
- C:\Windows\System\ymnkWed.exe
  C:\Windows\System\ymnkWed.exe
  2⤵
  PID:4108
- C:\Windows\System\LDzgxCv.exe
  C:\Windows\System\LDzgxCv.exe
  2⤵
  PID:4124
- C:\Windows\System\TVlOodo.exe
  C:\Windows\System\TVlOodo.exe
  2⤵
  PID:4140
- C:\Windows\System\zXjZRsn.exe
  C:\Windows\System\zXjZRsn.exe
  2⤵
  PID:4156
- C:\Windows\System\JjBXlSx.exe
  C:\Windows\System\JjBXlSx.exe
  2⤵
  PID:4172
- C:\Windows\System\qhbwHnC.exe
  C:\Windows\System\qhbwHnC.exe
  2⤵
  PID:4188
- C:\Windows\System\PDtQpSm.exe
  C:\Windows\System\PDtQpSm.exe
  2⤵
  PID:4204
- C:\Windows\System\YUAqTvw.exe
  C:\Windows\System\YUAqTvw.exe
  2⤵
  PID:4220
- C:\Windows\System\LEULPVN.exe
  C:\Windows\System\LEULPVN.exe
  2⤵
  PID:4236
- C:\Windows\System\vtdamNG.exe
  C:\Windows\System\vtdamNG.exe
  2⤵
  PID:4252
- C:\Windows\System\ovkzCat.exe
  C:\Windows\System\ovkzCat.exe
  2⤵
  PID:4268
- C:\Windows\System\KZOKVgt.exe
  C:\Windows\System\KZOKVgt.exe
  2⤵
  PID:4284
- C:\Windows\System\gmIRqDN.exe
  C:\Windows\System\gmIRqDN.exe
  2⤵
  PID:4300
- C:\Windows\System\cpJaMQV.exe
  C:\Windows\System\cpJaMQV.exe
  2⤵
  PID:4316
- C:\Windows\System\LaXnhFu.exe
  C:\Windows\System\LaXnhFu.exe
  2⤵
  PID:4332
- C:\Windows\System\CdoLHpP.exe
  C:\Windows\System\CdoLHpP.exe
  2⤵
  PID:4348
- C:\Windows\System\dWOpoOI.exe
  C:\Windows\System\dWOpoOI.exe
  2⤵
  PID:4364
- C:\Windows\System\WLQpKeu.exe
  C:\Windows\System\WLQpKeu.exe
  2⤵
  PID:4380
- C:\Windows\System\beCuYtC.exe
  C:\Windows\System\beCuYtC.exe
  2⤵
  PID:4396
- C:\Windows\System\GYTxgxc.exe
  C:\Windows\System\GYTxgxc.exe
  2⤵
  PID:4412
- C:\Windows\System\DJBIOJw.exe
  C:\Windows\System\DJBIOJw.exe
  2⤵
  PID:4428
- C:\Windows\System\USlPJOV.exe
  C:\Windows\System\USlPJOV.exe
  2⤵
  PID:4444
- C:\Windows\System\PtmCEEo.exe
  C:\Windows\System\PtmCEEo.exe
  2⤵
  PID:4460
- C:\Windows\System\fXgLGXR.exe
  C:\Windows\System\fXgLGXR.exe
  2⤵
  PID:4476
- C:\Windows\System\WDfldtv.exe
  C:\Windows\System\WDfldtv.exe
  2⤵
  PID:4492
- C:\Windows\System\qXVmcmV.exe
  C:\Windows\System\qXVmcmV.exe
  2⤵
  PID:4508
- C:\Windows\System\FNOBbil.exe
  C:\Windows\System\FNOBbil.exe
  2⤵
  PID:4524
- C:\Windows\System\TIcPlxM.exe
  C:\Windows\System\TIcPlxM.exe
  2⤵
  PID:4540
- C:\Windows\System\NlaCBvq.exe
  C:\Windows\System\NlaCBvq.exe
  2⤵
  PID:4556
- C:\Windows\System\peBExJh.exe
  C:\Windows\System\peBExJh.exe
  2⤵
  PID:4572
- C:\Windows\System\SWVZJQz.exe
  C:\Windows\System\SWVZJQz.exe
  2⤵
  PID:4588
- C:\Windows\System\MplHJnl.exe
  C:\Windows\System\MplHJnl.exe
  2⤵
  PID:4604
- C:\Windows\System\AbtEwzE.exe
  C:\Windows\System\AbtEwzE.exe
  2⤵
  PID:4620
- C:\Windows\System\cRfkwfn.exe
  C:\Windows\System\cRfkwfn.exe
  2⤵
  PID:4636
- C:\Windows\System\PsNnLxv.exe
  C:\Windows\System\PsNnLxv.exe
  2⤵
  PID:4652
- C:\Windows\System\HIvsZeL.exe
  C:\Windows\System\HIvsZeL.exe
  2⤵
  PID:4668
- C:\Windows\System\CEIizjL.exe
  C:\Windows\System\CEIizjL.exe
  2⤵
  PID:4684
- C:\Windows\System\nBouhDJ.exe
  C:\Windows\System\nBouhDJ.exe
  2⤵
  PID:4700
- C:\Windows\System\lMcohXn.exe
  C:\Windows\System\lMcohXn.exe
  2⤵
  PID:4724
- C:\Windows\System\UxTbpPq.exe
  C:\Windows\System\UxTbpPq.exe
  2⤵
  PID:4740
- C:\Windows\System\ddymIFE.exe
  C:\Windows\System\ddymIFE.exe
  2⤵
  PID:4756
- C:\Windows\System\WNpXZJQ.exe
  C:\Windows\System\WNpXZJQ.exe
  2⤵
  PID:4772
- C:\Windows\System\riYIADa.exe
  C:\Windows\System\riYIADa.exe
  2⤵
  PID:4788
- C:\Windows\System\XgXWhjW.exe
  C:\Windows\System\XgXWhjW.exe
  2⤵
  PID:4804
- C:\Windows\System\kjiiNSo.exe
  C:\Windows\System\kjiiNSo.exe
  2⤵
  PID:4820
- C:\Windows\System\OaIhvkK.exe
  C:\Windows\System\OaIhvkK.exe
  2⤵
  PID:4836
- C:\Windows\System\dqozJLO.exe
  C:\Windows\System\dqozJLO.exe
  2⤵
  PID:4852
- C:\Windows\System\FhsvFRX.exe
  C:\Windows\System\FhsvFRX.exe
  2⤵
  PID:4868
- C:\Windows\System\rnLdgod.exe
  C:\Windows\System\rnLdgod.exe
  2⤵
  PID:4884
- C:\Windows\System\HAWFMro.exe
  C:\Windows\System\HAWFMro.exe
  2⤵
  PID:4900
- C:\Windows\System\eYSjcJF.exe
  C:\Windows\System\eYSjcJF.exe
  2⤵
  PID:4916
- C:\Windows\System\WoJsRIC.exe
  C:\Windows\System\WoJsRIC.exe
  2⤵
  PID:4932
- C:\Windows\System\NfBSHgE.exe
  C:\Windows\System\NfBSHgE.exe
  2⤵
  PID:4948
- C:\Windows\System\xLMgZJm.exe
  C:\Windows\System\xLMgZJm.exe
  2⤵
  PID:4964
- C:\Windows\System\tgbkxUK.exe
  C:\Windows\System\tgbkxUK.exe
  2⤵
  PID:4980
- C:\Windows\System\BFdjPxh.exe
  C:\Windows\System\BFdjPxh.exe
  2⤵
  PID:4996
- C:\Windows\System\HwuYvuM.exe
  C:\Windows\System\HwuYvuM.exe
  2⤵
  PID:5012
- C:\Windows\System\LmdcsVL.exe
  C:\Windows\System\LmdcsVL.exe
  2⤵
  PID:5028
- C:\Windows\System\pnnORqU.exe
  C:\Windows\System\pnnORqU.exe
  2⤵
  PID:5044
- C:\Windows\System\IOoOXdY.exe
  C:\Windows\System\IOoOXdY.exe
  2⤵
  PID:5060
- C:\Windows\System\rVDtQyP.exe
  C:\Windows\System\rVDtQyP.exe
  2⤵
  PID:5076
- C:\Windows\System\rUWcxGJ.exe
  C:\Windows\System\rUWcxGJ.exe
  2⤵
  PID:5092
- C:\Windows\System\sqgQpDc.exe
  C:\Windows\System\sqgQpDc.exe
  2⤵
  PID:5108
- C:\Windows\System\gSOHWaD.exe
  C:\Windows\System\gSOHWaD.exe
  2⤵
  PID:2900
- C:\Windows\System\XrBIviF.exe
  C:\Windows\System\XrBIviF.exe
  2⤵
  PID:3220
- C:\Windows\System\aSnVWVs.exe
  C:\Windows\System\aSnVWVs.exe
  2⤵
  PID:3904
- C:\Windows\System\EEwRvsx.exe
  C:\Windows\System\EEwRvsx.exe
  2⤵
  PID:3760
- C:\Windows\System\geFSKVN.exe
  C:\Windows\System\geFSKVN.exe
  2⤵
  PID:2264
- C:\Windows\System\CrLUsFB.exe
  C:\Windows\System\CrLUsFB.exe
  2⤵
  PID:3988
- C:\Windows\System\cGJigTS.exe
  C:\Windows\System\cGJigTS.exe
  2⤵
  PID:3120
- C:\Windows\System\xpRyDdX.exe
  C:\Windows\System\xpRyDdX.exe
  2⤵
  PID:448
- C:\Windows\System\aOpREjj.exe
  C:\Windows\System\aOpREjj.exe
  2⤵
  PID:4120
- C:\Windows\System\VuMagHX.exe
  C:\Windows\System\VuMagHX.exe
  2⤵
  PID:3860
- C:\Windows\System\ncGvApT.exe
  C:\Windows\System\ncGvApT.exe
  2⤵
  PID:4052
- C:\Windows\System\CVSNbyi.exe
  C:\Windows\System\CVSNbyi.exe
  2⤵
  PID:2032
- C:\Windows\System\bYlEhWs.exe
  C:\Windows\System\bYlEhWs.exe
  2⤵
  PID:4180
- C:\Windows\System\lcOAcGB.exe
  C:\Windows\System\lcOAcGB.exe
  2⤵
  PID:1864
- C:\Windows\System\txUWrMx.exe
  C:\Windows\System\txUWrMx.exe
  2⤵
  PID:4340
- C:\Windows\System\cVjkdXj.exe
  C:\Windows\System\cVjkdXj.exe
  2⤵
  PID:4408
- C:\Windows\System\REuqwOW.exe
  C:\Windows\System\REuqwOW.exe
  2⤵
  PID:4468
- C:\Windows\System\gAMFdUk.exe
  C:\Windows\System\gAMFdUk.exe
  2⤵
  PID:3920
- C:\Windows\System\kItdrWI.exe
  C:\Windows\System\kItdrWI.exe
  2⤵
  PID:4260
- C:\Windows\System\NZbUImh.exe
  C:\Windows\System\NZbUImh.exe
  2⤵
  PID:4324
- C:\Windows\System\jcfLJOE.exe
  C:\Windows\System\jcfLJOE.exe
  2⤵
  PID:4356
- C:\Windows\System\HxJJGee.exe
  C:\Windows\System\HxJJGee.exe
  2⤵
  PID:4424
- C:\Windows\System\HAOwrqz.exe
  C:\Windows\System\HAOwrqz.exe
  2⤵
  PID:2120
- C:\Windows\System\KdgWTnr.exe
  C:\Windows\System\KdgWTnr.exe
  2⤵
  PID:2792
- C:\Windows\System\tNHOcwB.exe
  C:\Windows\System\tNHOcwB.exe
  2⤵
  PID:4132
- C:\Windows\System\kbDuXGL.exe
  C:\Windows\System\kbDuXGL.exe
  2⤵
  PID:4228
- C:\Windows\System\OyQjhER.exe
  C:\Windows\System\OyQjhER.exe
  2⤵
  PID:4552
- C:\Windows\System\ivNFNDb.exe
  C:\Windows\System\ivNFNDb.exe
  2⤵
  PID:4504
- C:\Windows\System\vLfhsiP.exe
  C:\Windows\System\vLfhsiP.exe
  2⤵
  PID:4568
- C:\Windows\System\zXWKBZg.exe
  C:\Windows\System\zXWKBZg.exe
  2⤵
  PID:4632
- C:\Windows\System\QlrfhPt.exe
  C:\Windows\System\QlrfhPt.exe
  2⤵
  PID:4388
- C:\Windows\System\ITuTFBJ.exe
  C:\Windows\System\ITuTFBJ.exe
  2⤵
  PID:4584
- C:\Windows\System\eyWVKtR.exe
  C:\Windows\System\eyWVKtR.exe
  2⤵
  PID:4488
- C:\Windows\System\YLArqmS.exe
  C:\Windows\System\YLArqmS.exe
  2⤵
  PID:2284
- C:\Windows\System\rHbgjiE.exe
  C:\Windows\System\rHbgjiE.exe
  2⤵
  PID:4752
- C:\Windows\System\fZxLtSS.exe
  C:\Windows\System\fZxLtSS.exe
  2⤵
  PID:4784
- C:\Windows\System\KLFtIYS.exe
  C:\Windows\System\KLFtIYS.exe
  2⤵
  PID:4736
- C:\Windows\System\wpHtdMR.exe
  C:\Windows\System\wpHtdMR.exe
  2⤵
  PID:4800
- C:\Windows\System\UEgEuXc.exe
  C:\Windows\System\UEgEuXc.exe
  2⤵
  PID:4844
- C:\Windows\System\adNcDRS.exe
  C:\Windows\System\adNcDRS.exe
  2⤵
  PID:4880
- C:\Windows\System\MRGIuFO.exe
  C:\Windows\System\MRGIuFO.exe
  2⤵
  PID:4940
- C:\Windows\System\MvNKXfz.exe
  C:\Windows\System\MvNKXfz.exe
  2⤵
  PID:4976
- C:\Windows\System\MNbWWzb.exe
  C:\Windows\System\MNbWWzb.exe
  2⤵
  PID:4924
- C:\Windows\System\JwmNLeb.exe
  C:\Windows\System\JwmNLeb.exe
  2⤵
  PID:5072
- C:\Windows\System\flQPsFE.exe
  C:\Windows\System\flQPsFE.exe
  2⤵
  PID:5100
- C:\Windows\System\usHhMQU.exe
  C:\Windows\System\usHhMQU.exe
  2⤵
  PID:4988
- C:\Windows\System\FCytUpb.exe
  C:\Windows\System\FCytUpb.exe
  2⤵
  PID:5024
- C:\Windows\System\kKbYGOf.exe
  C:\Windows\System\kKbYGOf.exe
  2⤵
  PID:5088
- C:\Windows\System\pnRZoSu.exe
  C:\Windows\System\pnRZoSu.exe
  2⤵
  PID:3248
- C:\Windows\System\SWmsedE.exe
  C:\Windows\System\SWmsedE.exe
  2⤵
  PID:2680
- C:\Windows\System\mYetPba.exe
  C:\Windows\System\mYetPba.exe
  2⤵
  PID:2452
- C:\Windows\System\OBUHHES.exe
  C:\Windows\System\OBUHHES.exe
  2⤵
  PID:3004
- C:\Windows\System\kFoagWi.exe
  C:\Windows\System\kFoagWi.exe
  2⤵
  PID:4152
- C:\Windows\System\PDOcGov.exe
  C:\Windows\System\PDOcGov.exe
  2⤵
  PID:2152
- C:\Windows\System\LATvkVM.exe
  C:\Windows\System\LATvkVM.exe
  2⤵
  PID:4404
- C:\Windows\System\XnKiAvw.exe
  C:\Windows\System\XnKiAvw.exe
  2⤵
  PID:4296
- C:\Windows\System\JglDMRH.exe
  C:\Windows\System\JglDMRH.exe
  2⤵
  PID:3856
- C:\Windows\System\ijyVXoE.exe
  C:\Windows\System\ijyVXoE.exe
  2⤵
  PID:4500
- C:\Windows\System\yCcDBhF.exe
  C:\Windows\System\yCcDBhF.exe
  2⤵
  PID:4372
- C:\Windows\System\CkdeDDF.exe
  C:\Windows\System\CkdeDDF.exe
  2⤵
  PID:4440
- C:\Windows\System\Ygxbege.exe
  C:\Windows\System\Ygxbege.exe
  2⤵
  PID:1684
- C:\Windows\System\OCCEBLe.exe
  C:\Windows\System\OCCEBLe.exe
  2⤵
  PID:4104
- C:\Windows\System\HTozwNx.exe
  C:\Windows\System\HTozwNx.exe
  2⤵
  PID:4564
- C:\Windows\System\evQHHaz.exe
  C:\Windows\System\evQHHaz.exe
  2⤵
  PID:4692
- C:\Windows\System\KDHkwgq.exe
  C:\Windows\System\KDHkwgq.exe
  2⤵
  PID:4520
- C:\Windows\System\yNeViLn.exe
  C:\Windows\System\yNeViLn.exe
  2⤵
  PID:4780
- C:\Windows\System\CTCymoN.exe
  C:\Windows\System\CTCymoN.exe
  2⤵
  PID:4796
- C:\Windows\System\CuNuZfG.exe
  C:\Windows\System\CuNuZfG.exe
  2⤵
  PID:4732
- C:\Windows\System\YCjfbMx.exe
  C:\Windows\System\YCjfbMx.exe
  2⤵
  PID:4912
- C:\Windows\System\alUcSpp.exe
  C:\Windows\System\alUcSpp.exe
  2⤵
  PID:4864
- C:\Windows\System\VLEyxSg.exe
  C:\Windows\System\VLEyxSg.exe
  2⤵
  PID:4992
- C:\Windows\System\hrItlrJ.exe
  C:\Windows\System\hrItlrJ.exe
  2⤵
  PID:5056
- C:\Windows\System\kPlTEjd.exe
  C:\Windows\System\kPlTEjd.exe
  2⤵
  PID:1820
- C:\Windows\System\WJGiOyr.exe
  C:\Windows\System\WJGiOyr.exe
  2⤵
  PID:3520
- C:\Windows\System\cFkoLFM.exe
  C:\Windows\System\cFkoLFM.exe
  2⤵
  PID:3620
- C:\Windows\System\EuOJcxK.exe
  C:\Windows\System\EuOJcxK.exe
  2⤵
  PID:2688
- C:\Windows\System\rEYnorB.exe
  C:\Windows\System\rEYnorB.exe
  2⤵
  PID:4548
- C:\Windows\System\yXReFos.exe
  C:\Windows\System\yXReFos.exe
  2⤵
  PID:4580
- C:\Windows\System\BcafaPH.exe
  C:\Windows\System\BcafaPH.exe
  2⤵
  PID:556
- C:\Windows\System\gdSeFae.exe
  C:\Windows\System\gdSeFae.exe
  2⤵
  PID:4312
- C:\Windows\System\xpJEQPw.exe
  C:\Windows\System\xpJEQPw.exe
  2⤵
  PID:4628
- C:\Windows\System\DilPWdy.exe
  C:\Windows\System\DilPWdy.exe
  2⤵
  PID:4860
- C:\Windows\System\Tocpfet.exe
  C:\Windows\System\Tocpfet.exe
  2⤵
  PID:5040
- C:\Windows\System\DTJpmPI.exe
  C:\Windows\System\DTJpmPI.exe
  2⤵
  PID:2608
- C:\Windows\System\jtiqeQl.exe
  C:\Windows\System\jtiqeQl.exe
  2⤵
  PID:5008
- C:\Windows\System\ECWFwck.exe
  C:\Windows\System\ECWFwck.exe
  2⤵
  PID:4896
- C:\Windows\System\cTuamFg.exe
  C:\Windows\System\cTuamFg.exe
  2⤵
  PID:2136
- C:\Windows\System\nZxHKBD.exe
  C:\Windows\System\nZxHKBD.exe
  2⤵
  PID:2388
- C:\Windows\System\rNHPEex.exe
  C:\Windows\System\rNHPEex.exe
  2⤵
  PID:636
- C:\Windows\System\YCXfwGw.exe
  C:\Windows\System\YCXfwGw.exe
  2⤵
  PID:4768
- C:\Windows\System\rKzjiOX.exe
  C:\Windows\System\rKzjiOX.exe
  2⤵
  PID:5124
- C:\Windows\System\QaRBRLb.exe
  C:\Windows\System\QaRBRLb.exe
  2⤵
  PID:5196
- C:\Windows\System\GrZxrho.exe
  C:\Windows\System\GrZxrho.exe
  2⤵
  PID:5212
- C:\Windows\System\WLgxfuL.exe
  C:\Windows\System\WLgxfuL.exe
  2⤵
  PID:5228
- C:\Windows\System\dokrefC.exe
  C:\Windows\System\dokrefC.exe
  2⤵
  PID:5244
- C:\Windows\System\UfejRtV.exe
  C:\Windows\System\UfejRtV.exe
  2⤵
  PID:5260
- C:\Windows\System\dVmZpHg.exe
  C:\Windows\System\dVmZpHg.exe
  2⤵
  PID:5276
- C:\Windows\System\fPDzAzT.exe
  C:\Windows\System\fPDzAzT.exe
  2⤵
  PID:5308
- C:\Windows\System\TncQsRZ.exe
  C:\Windows\System\TncQsRZ.exe
  2⤵
  PID:5332
- C:\Windows\System\XkPiGTd.exe
  C:\Windows\System\XkPiGTd.exe
  2⤵
  PID:5348
- C:\Windows\System\nnfvcUO.exe
  C:\Windows\System\nnfvcUO.exe
  2⤵
  PID:5364
- C:\Windows\System\jkYbWKy.exe
  C:\Windows\System\jkYbWKy.exe
  2⤵
  PID:5380
- C:\Windows\System\VPlGIIh.exe
  C:\Windows\System\VPlGIIh.exe
  2⤵
  PID:5396
- C:\Windows\System\ydSpdmr.exe
  C:\Windows\System\ydSpdmr.exe
  2⤵
  PID:5412
- C:\Windows\System\tCmfdrG.exe
  C:\Windows\System\tCmfdrG.exe
  2⤵
  PID:5428
- C:\Windows\System\ueQrjgj.exe
  C:\Windows\System\ueQrjgj.exe
  2⤵
  PID:5444
- C:\Windows\System\rAOgRxO.exe
  C:\Windows\System\rAOgRxO.exe
  2⤵
  PID:5460
- C:\Windows\System\ccsdlOe.exe
  C:\Windows\System\ccsdlOe.exe
  2⤵
  PID:5476
- C:\Windows\System\TbRxkEj.exe
  C:\Windows\System\TbRxkEj.exe
  2⤵
  PID:5492
- C:\Windows\System\MutCSuP.exe
  C:\Windows\System\MutCSuP.exe
  2⤵
  PID:5508
- C:\Windows\System\KlcWFpS.exe
  C:\Windows\System\KlcWFpS.exe
  2⤵
  PID:5524
- C:\Windows\System\SGXfBTz.exe
  C:\Windows\System\SGXfBTz.exe
  2⤵
  PID:5540
- C:\Windows\System\dDDnkfM.exe
  C:\Windows\System\dDDnkfM.exe
  2⤵
  PID:5556
- C:\Windows\System\HSEAjsZ.exe
  C:\Windows\System\HSEAjsZ.exe
  2⤵
  PID:5572
- C:\Windows\System\NXfkkLz.exe
  C:\Windows\System\NXfkkLz.exe
  2⤵
  PID:5588
- C:\Windows\System\vXvqVrz.exe
  C:\Windows\System\vXvqVrz.exe
  2⤵
  PID:5676
- C:\Windows\System\lOnFcOw.exe
  C:\Windows\System\lOnFcOw.exe
  2⤵
  PID:5752
- C:\Windows\System\uKQqkTT.exe
  C:\Windows\System\uKQqkTT.exe
  2⤵
  PID:5768
- C:\Windows\System\IJRozDD.exe
  C:\Windows\System\IJRozDD.exe
  2⤵
  PID:5784
- C:\Windows\System\vZxusAg.exe
  C:\Windows\System\vZxusAg.exe
  2⤵
  PID:5800
- C:\Windows\System\hVeKYZV.exe
  C:\Windows\System\hVeKYZV.exe
  2⤵
  PID:5816
- C:\Windows\System\jbtbfsC.exe
  C:\Windows\System\jbtbfsC.exe
  2⤵
  PID:5832
- C:\Windows\System\BDFddOh.exe
  C:\Windows\System\BDFddOh.exe
  2⤵
  PID:5848
- C:\Windows\System\ISctFnO.exe
  C:\Windows\System\ISctFnO.exe
  2⤵
  PID:5864
- C:\Windows\System\KFJhNWG.exe
  C:\Windows\System\KFJhNWG.exe
  2⤵
  PID:5880
- C:\Windows\System\NOurAds.exe
  C:\Windows\System\NOurAds.exe
  2⤵
  PID:5896
- C:\Windows\System\mJEYkXE.exe
  C:\Windows\System\mJEYkXE.exe
  2⤵
  PID:5912
- C:\Windows\System\IUNjaKY.exe
  C:\Windows\System\IUNjaKY.exe
  2⤵
  PID:5928
- C:\Windows\System\hFVwkWx.exe
  C:\Windows\System\hFVwkWx.exe
  2⤵
  PID:5960
- C:\Windows\System\pPPktXK.exe
  C:\Windows\System\pPPktXK.exe
  2⤵
  PID:5976
- C:\Windows\System\aeGxZjl.exe
  C:\Windows\System\aeGxZjl.exe
  2⤵
  PID:5992
- C:\Windows\System\FKsrtyW.exe
  C:\Windows\System\FKsrtyW.exe
  2⤵
  PID:6008
- C:\Windows\System\XKhxpZa.exe
  C:\Windows\System\XKhxpZa.exe
  2⤵
  PID:6024
- C:\Windows\System\ohdYGEw.exe
  C:\Windows\System\ohdYGEw.exe
  2⤵
  PID:6044
- C:\Windows\System\sIKTQTg.exe
  C:\Windows\System\sIKTQTg.exe
  2⤵
  PID:6060
- C:\Windows\System\dSrRQqZ.exe
  C:\Windows\System\dSrRQqZ.exe
  2⤵
  PID:6076
- C:\Windows\System\fapkzHG.exe
  C:\Windows\System\fapkzHG.exe
  2⤵
  PID:6092
- C:\Windows\System\NYRsEEA.exe
  C:\Windows\System\NYRsEEA.exe
  2⤵
  PID:6108
- C:\Windows\System\FgQvGuF.exe
  C:\Windows\System\FgQvGuF.exe
  2⤵
  PID:6124
- C:\Windows\System\QFsJnNF.exe
  C:\Windows\System\QFsJnNF.exe
  2⤵
  PID:6140
- C:\Windows\System\OzWQlBH.exe
  C:\Windows\System\OzWQlBH.exe
  2⤵
  PID:4376
- C:\Windows\System\hpjnkCg.exe
  C:\Windows\System\hpjnkCg.exe
  2⤵
  PID:5148
- C:\Windows\System\UwcMVQb.exe
  C:\Windows\System\UwcMVQb.exe
  2⤵
  PID:5164
- C:\Windows\System\XJZumpy.exe
  C:\Windows\System\XJZumpy.exe
  2⤵
  PID:284
- C:\Windows\System\hgiBOky.exe
  C:\Windows\System\hgiBOky.exe
  2⤵
  PID:5156
- C:\Windows\System\nUBmkXC.exe
  C:\Windows\System\nUBmkXC.exe
  2⤵
  PID:5176
- C:\Windows\System\WugPFyT.exe
  C:\Windows\System\WugPFyT.exe
  2⤵
  PID:5208
- C:\Windows\System\yeZWnpm.exe
  C:\Windows\System\yeZWnpm.exe
  2⤵
  PID:5268
- C:\Windows\System\pSYpgJU.exe
  C:\Windows\System\pSYpgJU.exe
  2⤵
  PID:5320
- C:\Windows\System\uWFwxOh.exe
  C:\Windows\System\uWFwxOh.exe
  2⤵
  PID:5388
- C:\Windows\System\VXKxmHu.exe
  C:\Windows\System\VXKxmHu.exe
  2⤵
  PID:5456
- C:\Windows\System\XeqFOVV.exe
  C:\Windows\System\XeqFOVV.exe
  2⤵
  PID:5548
- C:\Windows\System\nQdEHMB.exe
  C:\Windows\System\nQdEHMB.exe
  2⤵
  PID:5584
- C:\Windows\System\beqOLDK.exe
  C:\Windows\System\beqOLDK.exe
  2⤵
  PID:5192
- C:\Windows\System\hZFjVMS.exe
  C:\Windows\System\hZFjVMS.exe
  2⤵
  PID:5304
- C:\Windows\System\OTDXzII.exe
  C:\Windows\System\OTDXzII.exe
  2⤵
  PID:5284
- C:\Windows\System\bjQRGar.exe
  C:\Windows\System\bjQRGar.exe
  2⤵
  PID:5436
- C:\Windows\System\OhUjIAB.exe
  C:\Windows\System\OhUjIAB.exe
  2⤵
  PID:5500
- C:\Windows\System\BHllMll.exe
  C:\Windows\System\BHllMll.exe
  2⤵
  PID:5564
- C:\Windows\System\KkKPCSX.exe
  C:\Windows\System\KkKPCSX.exe
  2⤵
  PID:5604
- C:\Windows\System\wHDZuJf.exe
  C:\Windows\System\wHDZuJf.exe
  2⤵
  PID:5632
- C:\Windows\System\oTVcLlV.exe
  C:\Windows\System\oTVcLlV.exe
  2⤵
  PID:5340
- C:\Windows\System\LCXABMl.exe
  C:\Windows\System\LCXABMl.exe
  2⤵
  PID:5224
- C:\Windows\System\AhPguUn.exe
  C:\Windows\System\AhPguUn.exe
  2⤵
  PID:5656
- C:\Windows\System\TPpCEfY.exe
  C:\Windows\System\TPpCEfY.exe
  2⤵
  PID:5672
- C:\Windows\System\zlbYigr.exe
  C:\Windows\System\zlbYigr.exe
  2⤵
  PID:5692
- C:\Windows\System\vKtGbQk.exe
  C:\Windows\System\vKtGbQk.exe
  2⤵
  PID:5708
- C:\Windows\System\pCrbRUC.exe
  C:\Windows\System\pCrbRUC.exe
  2⤵
  PID:5724
- C:\Windows\System\uqLavVu.exe
  C:\Windows\System\uqLavVu.exe
  2⤵
  PID:5740
- C:\Windows\System\XFSBETB.exe
  C:\Windows\System\XFSBETB.exe
  2⤵
  PID:5760
- C:\Windows\System\LsvZGPt.exe
  C:\Windows\System\LsvZGPt.exe
  2⤵
  PID:5824
- C:\Windows\System\bOBdhOu.exe
  C:\Windows\System\bOBdhOu.exe
  2⤵
  PID:5888
- C:\Windows\System\VZZYhlQ.exe
  C:\Windows\System\VZZYhlQ.exe
  2⤵
  PID:5808
- C:\Windows\System\OjRTLVq.exe
  C:\Windows\System\OjRTLVq.exe
  2⤵
  PID:5972
- C:\Windows\System\mxiBnPm.exe
  C:\Windows\System\mxiBnPm.exe
  2⤵
  PID:6036
- C:\Windows\System\eCGXIiQ.exe
  C:\Windows\System\eCGXIiQ.exe
  2⤵
  PID:6100
- C:\Windows\System\xlmQAcO.exe
  C:\Windows\System\xlmQAcO.exe
  2⤵
  PID:5132
- C:\Windows\System\jeztmtI.exe
  C:\Windows\System\jeztmtI.exe
  2⤵
  PID:5812
- C:\Windows\System\MomiTPM.exe
  C:\Windows\System\MomiTPM.exe
  2⤵
  PID:5876
- C:\Windows\System\MgUsdbv.exe
  C:\Windows\System\MgUsdbv.exe
  2⤵
  PID:5172
- C:\Windows\System\gDJOAks.exe
  C:\Windows\System\gDJOAks.exe
  2⤵
  PID:5944
- C:\Windows\System\yjEHUTa.exe
  C:\Windows\System\yjEHUTa.exe
  2⤵
  PID:5240
- C:\Windows\System\LXPSyDs.exe
  C:\Windows\System\LXPSyDs.exe
  2⤵
  PID:5984
- C:\Windows\System\fEwuhfx.exe
  C:\Windows\System\fEwuhfx.exe
  2⤵
  PID:6016
- C:\Windows\System\nxBJSZS.exe
  C:\Windows\System\nxBJSZS.exe
  2⤵
  PID:5628
- C:\Windows\System\MLcHcOZ.exe
  C:\Windows\System\MLcHcOZ.exe
  2⤵
  PID:5644
- C:\Windows\System\pvbyrmS.exe
  C:\Windows\System\pvbyrmS.exe
  2⤵
  PID:5648
- C:\Windows\System\nfJnEAm.exe
  C:\Windows\System\nfJnEAm.exe
  2⤵
  PID:5688
- C:\Windows\System\mTpdlOr.exe
  C:\Windows\System\mTpdlOr.exe
  2⤵
  PID:6116
- C:\Windows\System\xDpkLOC.exe
  C:\Windows\System\xDpkLOC.exe
  2⤵
  PID:312
- C:\Windows\System\sAxqAeo.exe
  C:\Windows\System\sAxqAeo.exe
  2⤵
  PID:5180
- C:\Windows\System\XtsEdRX.exe
  C:\Windows\System\XtsEdRX.exe
  2⤵
  PID:5420
- C:\Windows\System\tuxknYE.exe
  C:\Windows\System\tuxknYE.exe
  2⤵
  PID:5296
- C:\Windows\System\xZvwQBf.exe
  C:\Windows\System\xZvwQBf.exe
  2⤵
  PID:5404
- C:\Windows\System\iHrkjit.exe
  C:\Windows\System\iHrkjit.exe
  2⤵
  PID:5620
- C:\Windows\System\dokrUCu.exe
  C:\Windows\System\dokrUCu.exe
  2⤵
  PID:1404
- C:\Windows\System\kmiJIBR.exe
  C:\Windows\System\kmiJIBR.exe
  2⤵
  PID:5856
- C:\Windows\System\uAZyVIr.exe
  C:\Windows\System\uAZyVIr.exe
  2⤵
  PID:5144
- C:\Windows\System\mpgSLdJ.exe
  C:\Windows\System\mpgSLdJ.exe
  2⤵
  PID:1300
- C:\Windows\System\LMulEMr.exe
  C:\Windows\System\LMulEMr.exe
  2⤵
  PID:5968
- C:\Windows\System\KfkQQjY.exe
  C:\Windows\System\KfkQQjY.exe
  2⤵
  PID:5636
- C:\Windows\System\XGjyPET.exe
  C:\Windows\System\XGjyPET.exe
  2⤵
  PID:4168
- C:\Windows\System\EqqyHuR.exe
  C:\Windows\System\EqqyHuR.exe
  2⤵
  PID:5376
- C:\Windows\System\LSXMgxM.exe
  C:\Windows\System\LSXMgxM.exe
  2⤵
  PID:6156
- C:\Windows\System\DXQFKhX.exe
  C:\Windows\System\DXQFKhX.exe
  2⤵
  PID:6172
- C:\Windows\System\MxtnCtK.exe
  C:\Windows\System\MxtnCtK.exe
  2⤵
  PID:6188
- C:\Windows\System\BMlAFCk.exe
  C:\Windows\System\BMlAFCk.exe
  2⤵
  PID:6204
- C:\Windows\System\JxcevdQ.exe
  C:\Windows\System\JxcevdQ.exe
  2⤵
  PID:6220
- C:\Windows\System\GpciGOL.exe
  C:\Windows\System\GpciGOL.exe
  2⤵
  PID:6236
- C:\Windows\System\XCxOvPv.exe
  C:\Windows\System\XCxOvPv.exe
  2⤵
  PID:6252
- C:\Windows\System\quqMeGg.exe
  C:\Windows\System\quqMeGg.exe
  2⤵
  PID:6268
- C:\Windows\System\aQDljyc.exe
  C:\Windows\System\aQDljyc.exe
  2⤵
  PID:6284
- C:\Windows\System\GnfKnwc.exe
  C:\Windows\System\GnfKnwc.exe
  2⤵
  PID:6300
- C:\Windows\System\MMaqIcu.exe
  C:\Windows\System\MMaqIcu.exe
  2⤵
  PID:6316
- C:\Windows\System\HSGyyuK.exe
  C:\Windows\System\HSGyyuK.exe
  2⤵
  PID:6332
- C:\Windows\System\OTmlrMJ.exe
  C:\Windows\System\OTmlrMJ.exe
  2⤵
  PID:6348
- C:\Windows\System\SkBcVSs.exe
  C:\Windows\System\SkBcVSs.exe
  2⤵
  PID:6364
- C:\Windows\System\ZuNuqSK.exe
  C:\Windows\System\ZuNuqSK.exe
  2⤵
  PID:6380
- C:\Windows\System\TywdTzE.exe
  C:\Windows\System\TywdTzE.exe
  2⤵
  PID:6396
- C:\Windows\System\lLqVUVU.exe
  C:\Windows\System\lLqVUVU.exe
  2⤵
  PID:6412
- C:\Windows\System\DHmbulb.exe
  C:\Windows\System\DHmbulb.exe
  2⤵
  PID:6428
- C:\Windows\System\yGNwUdu.exe
  C:\Windows\System\yGNwUdu.exe
  2⤵
  PID:6444
- C:\Windows\System\smdzmli.exe
  C:\Windows\System\smdzmli.exe
  2⤵
  PID:6460
- C:\Windows\System\fZCRwqy.exe
  C:\Windows\System\fZCRwqy.exe
  2⤵
  PID:6476
- C:\Windows\System\gmyQDsZ.exe
  C:\Windows\System\gmyQDsZ.exe
  2⤵
  PID:6492
- C:\Windows\System\ITnOHyo.exe
  C:\Windows\System\ITnOHyo.exe
  2⤵
  PID:6508
- C:\Windows\System\kqHezEl.exe
  C:\Windows\System\kqHezEl.exe
  2⤵
  PID:6524
- C:\Windows\System\CcEWsqt.exe
  C:\Windows\System\CcEWsqt.exe
  2⤵
  PID:6540
- C:\Windows\System\xLiWRrs.exe
  C:\Windows\System\xLiWRrs.exe
  2⤵
  PID:6556
- C:\Windows\System\AlLEgCk.exe
  C:\Windows\System\AlLEgCk.exe
  2⤵
  PID:6572
- C:\Windows\System\FpUTuyA.exe
  C:\Windows\System\FpUTuyA.exe
  2⤵
  PID:6588
- C:\Windows\System\quXjhVe.exe
  C:\Windows\System\quXjhVe.exe
  2⤵
  PID:6608
- C:\Windows\System\corjPrJ.exe
  C:\Windows\System\corjPrJ.exe
  2⤵
  PID:6624
- C:\Windows\System\KccMtMR.exe
  C:\Windows\System\KccMtMR.exe
  2⤵
  PID:6640
- C:\Windows\System\neNqrif.exe
  C:\Windows\System\neNqrif.exe
  2⤵
  PID:6656
- C:\Windows\System\bijXgpd.exe
  C:\Windows\System\bijXgpd.exe
  2⤵
  PID:6672
- C:\Windows\System\xTlAKxb.exe
  C:\Windows\System\xTlAKxb.exe
  2⤵
  PID:6688
- C:\Windows\System\lyTLWbo.exe
  C:\Windows\System\lyTLWbo.exe
  2⤵
  PID:6704
- C:\Windows\System\AFjRJvc.exe
  C:\Windows\System\AFjRJvc.exe
  2⤵
  PID:6720
- C:\Windows\System\hCQYIwP.exe
  C:\Windows\System\hCQYIwP.exe
  2⤵
  PID:6736
- C:\Windows\System\SpYDSdP.exe
  C:\Windows\System\SpYDSdP.exe
  2⤵
  PID:6752
- C:\Windows\System\iuxotJE.exe
  C:\Windows\System\iuxotJE.exe
  2⤵
  PID:6768
- C:\Windows\System\ATnPCUV.exe
  C:\Windows\System\ATnPCUV.exe
  2⤵
  PID:6784
- C:\Windows\System\yeWtQXT.exe
  C:\Windows\System\yeWtQXT.exe
  2⤵
  PID:6800
- C:\Windows\System\GMgLBkF.exe
  C:\Windows\System\GMgLBkF.exe
  2⤵
  PID:6816
- C:\Windows\System\XqibTXh.exe
  C:\Windows\System\XqibTXh.exe
  2⤵
  PID:6832
- C:\Windows\System\BckZvyv.exe
  C:\Windows\System\BckZvyv.exe
  2⤵
  PID:6848
- C:\Windows\System\ZLisyob.exe
  C:\Windows\System\ZLisyob.exe
  2⤵
  PID:6864
- C:\Windows\System\ZrOWLRj.exe
  C:\Windows\System\ZrOWLRj.exe
  2⤵
  PID:6880
- C:\Windows\System\DjrvRba.exe
  C:\Windows\System\DjrvRba.exe
  2⤵
  PID:6896
- C:\Windows\System\qRPisuJ.exe
  C:\Windows\System\qRPisuJ.exe
  2⤵
  PID:6912
- C:\Windows\System\apngrpu.exe
  C:\Windows\System\apngrpu.exe
  2⤵
  PID:6928
- C:\Windows\System\dllFOgj.exe
  C:\Windows\System\dllFOgj.exe
  2⤵
  PID:6944
- C:\Windows\System\ZKhBMof.exe
  C:\Windows\System\ZKhBMof.exe
  2⤵
  PID:6960
- C:\Windows\System\kXRNkvJ.exe
  C:\Windows\System\kXRNkvJ.exe
  2⤵
  PID:6976
- C:\Windows\System\eOgWZBb.exe
  C:\Windows\System\eOgWZBb.exe
  2⤵
  PID:6992
- C:\Windows\System\NcHrJfi.exe
  C:\Windows\System\NcHrJfi.exe
  2⤵
  PID:7012
- C:\Windows\System\ZjTAIxl.exe
  C:\Windows\System\ZjTAIxl.exe
  2⤵
  PID:7028
- C:\Windows\System\EOvaftR.exe
  C:\Windows\System\EOvaftR.exe
  2⤵
  PID:7044
- C:\Windows\System\pYiKqVi.exe
  C:\Windows\System\pYiKqVi.exe
  2⤵
  PID:7060
- C:\Windows\System\oeLirrC.exe
  C:\Windows\System\oeLirrC.exe
  2⤵
  PID:7076
- C:\Windows\System\EEFQvMO.exe
  C:\Windows\System\EEFQvMO.exe
  2⤵
  PID:7092
- C:\Windows\System\TzRByWg.exe
  C:\Windows\System\TzRByWg.exe
  2⤵
  PID:7108
- C:\Windows\System\HfoAMcW.exe
  C:\Windows\System\HfoAMcW.exe
  2⤵
  PID:7124
- C:\Windows\System\OacbYTt.exe
  C:\Windows\System\OacbYTt.exe
  2⤵
  PID:7140
- C:\Windows\System\vdAeaqH.exe
  C:\Windows\System\vdAeaqH.exe
  2⤵
  PID:7156
- C:\Windows\System\yJlASXt.exe
  C:\Windows\System\yJlASXt.exe
  2⤵
  PID:5316
- C:\Windows\System\wCQaVkn.exe
  C:\Windows\System\wCQaVkn.exe
  2⤵
  PID:5700
- C:\Windows\System\PPqoroZ.exe
  C:\Windows\System\PPqoroZ.exe
  2⤵
  PID:5792
- C:\Windows\System\nvSGPUF.exe
  C:\Windows\System\nvSGPUF.exe
  2⤵
  PID:6148
- C:\Windows\System\JFuIWXv.exe
  C:\Windows\System\JFuIWXv.exe
  2⤵
  PID:6184
- C:\Windows\System\xJSnxvk.exe
  C:\Windows\System\xJSnxvk.exe
  2⤵
  PID:5844
- C:\Windows\System\LooZqrg.exe
  C:\Windows\System\LooZqrg.exe
  2⤵
  PID:6308
- C:\Windows\System\hQNPqiu.exe
  C:\Windows\System\hQNPqiu.exe
  2⤵
  PID:5908
- C:\Windows\System\DcyVSnw.exe
  C:\Windows\System\DcyVSnw.exe
  2⤵
  PID:5920
- C:\Windows\System\SbKYtsW.exe
  C:\Windows\System\SbKYtsW.exe
  2⤵
  PID:6404
- C:\Windows\System\FBkgjSu.exe
  C:\Windows\System\FBkgjSu.exe
  2⤵
  PID:6468
- C:\Windows\System\fMswfeO.exe
  C:\Windows\System\fMswfeO.exe
  2⤵
  PID:6264
- C:\Windows\System\NtNLyzj.exe
  C:\Windows\System\NtNLyzj.exe
  2⤵
  PID:5580
- C:\Windows\System\bcSxFYH.exe
  C:\Windows\System\bcSxFYH.exe
  2⤵
  PID:2260
- C:\Windows\System\SzLzCYz.exe
  C:\Windows\System\SzLzCYz.exe
  2⤵
  PID:6504
- C:\Windows\System\luXjhMc.exe
  C:\Windows\System\luXjhMc.exe
  2⤵
  PID:5328
- C:\Windows\System\KdQLLJu.exe
  C:\Windows\System\KdQLLJu.exe
  2⤵
  PID:5904
- C:\Windows\System\dhAKglg.exe
  C:\Windows\System\dhAKglg.exe
  2⤵
  PID:5472
- C:\Windows\System\tnfaDex.exe
  C:\Windows\System\tnfaDex.exe
  2⤵
  PID:6196
- C:\Windows\System\iMIwWHE.exe
  C:\Windows\System\iMIwWHE.exe
  2⤵
  PID:6536
- C:\Windows\System\KtBbeQU.exe
  C:\Windows\System\KtBbeQU.exe
  2⤵
  PID:6084
- C:\Windows\System\fGRgykf.exe
  C:\Windows\System\fGRgykf.exe
  2⤵
  PID:6600
- C:\Windows\System\RwiWGOD.exe
  C:\Windows\System\RwiWGOD.exe
  2⤵
  PID:6636
- C:\Windows\System\nnNCUNO.exe
  C:\Windows\System\nnNCUNO.exe
  2⤵
  PID:5552
- C:\Windows\System\mQVDtvg.exe
  C:\Windows\System\mQVDtvg.exe
  2⤵
  PID:6696
- C:\Windows\System\NBSahoy.exe
  C:\Windows\System\NBSahoy.exe
  2⤵
  PID:6620
- C:\Windows\System\bojITCy.exe
  C:\Windows\System\bojITCy.exe
  2⤵
  PID:6648
- C:\Windows\System\JOdnJwJ.exe
  C:\Windows\System\JOdnJwJ.exe
  2⤵
  PID:6328
- C:\Windows\System\hxrdCyS.exe
  C:\Windows\System\hxrdCyS.exe
  2⤵
  PID:6616
- C:\Windows\System\ejDApIY.exe
  C:\Windows\System\ejDApIY.exe
  2⤵
  PID:6680
- C:\Windows\System\qJIYeds.exe
  C:\Windows\System\qJIYeds.exe
  2⤵
  PID:6520
- C:\Windows\System\kXBUTHa.exe
  C:\Windows\System\kXBUTHa.exe
  2⤵
  PID:6760
- C:\Windows\System\QLthuBY.exe
  C:\Windows\System\QLthuBY.exe
  2⤵
  PID:6860
- C:\Windows\System\kNqZaRg.exe
  C:\Windows\System\kNqZaRg.exe
  2⤵
  PID:6924
- C:\Windows\System\gJoZgLs.exe
  C:\Windows\System\gJoZgLs.exe
  2⤵
  PID:6652
- C:\Windows\System\lHKdcOP.exe
  C:\Windows\System\lHKdcOP.exe
  2⤵
  PID:6888
- C:\Windows\System\CKExEck.exe
  C:\Windows\System\CKExEck.exe
  2⤵
  PID:6988
- C:\Windows\System\OSaiQTb.exe
  C:\Windows\System\OSaiQTb.exe
  2⤵
  PID:6808
- C:\Windows\System\wzaimbs.exe
  C:\Windows\System\wzaimbs.exe
  2⤵
  PID:7152
- C:\Windows\System\QfGbwyl.exe
  C:\Windows\System\QfGbwyl.exe
  2⤵
  PID:6812
- C:\Windows\System\psOzXYh.exe
  C:\Windows\System\psOzXYh.exe
  2⤵
  PID:6876
- C:\Windows\System\dPCyeWy.exe
  C:\Windows\System\dPCyeWy.exe
  2⤵
  PID:5596
- C:\Windows\System\fVJOryY.exe
  C:\Windows\System\fVJOryY.exe
  2⤵
  PID:6968
- C:\Windows\System\QrlqojH.exe
  C:\Windows\System\QrlqojH.exe
  2⤵
  PID:7008
- C:\Windows\System\uyVNUWj.exe
  C:\Windows\System\uyVNUWj.exe
  2⤵
  PID:6212
- C:\Windows\System\dmsvjDo.exe
  C:\Windows\System\dmsvjDo.exe
  2⤵
  PID:7072
- C:\Windows\System\vKYfLxE.exe
  C:\Windows\System\vKYfLxE.exe
  2⤵
  PID:7164
- C:\Windows\System\ojVQnVF.exe
  C:\Windows\System\ojVQnVF.exe
  2⤵
  PID:5664
- C:\Windows\System\rJUJUPZ.exe
  C:\Windows\System\rJUJUPZ.exe
  2⤵
  PID:6280
- C:\Windows\System\mWXlsaG.exe
  C:\Windows\System\mWXlsaG.exe
  2⤵
  PID:6376
- C:\Windows\System\TfsDDpr.exe
  C:\Windows\System\TfsDDpr.exe
  2⤵
  PID:1612
- C:\Windows\System\akKofus.exe
  C:\Windows\System\akKofus.exe
  2⤵
  PID:6472
- C:\Windows\System\CPRdOzE.exe
  C:\Windows\System\CPRdOzE.exe
  2⤵
  PID:5940
- C:\Windows\System\fHThyEB.exe
  C:\Windows\System\fHThyEB.exe
  2⤵
  PID:5988
- C:\Windows\System\SJCslVo.exe
  C:\Windows\System\SJCslVo.exe
  2⤵
  PID:5684
- C:\Windows\System\fOmOhnZ.exe
  C:\Windows\System\fOmOhnZ.exe
  2⤵
  PID:6668
- C:\Windows\System\uwPPZRc.exe
  C:\Windows\System\uwPPZRc.exe
  2⤵
  PID:6552
- C:\Windows\System\qrdkWdV.exe
  C:\Windows\System\qrdkWdV.exe
  2⤵
  PID:6296
- C:\Windows\System\ePoInuo.exe
  C:\Windows\System\ePoInuo.exe
  2⤵
  PID:6712
- C:\Windows\System\EjwBXIo.exe
  C:\Windows\System\EjwBXIo.exe
  2⤵
  PID:6632
- C:\Windows\System\OIWpGlh.exe
  C:\Windows\System\OIWpGlh.exe
  2⤵
  PID:6716
- C:\Windows\System\KWefBCW.exe
  C:\Windows\System\KWefBCW.exe
  2⤵
  PID:6776
- C:\Windows\System\PYOKeLt.exe
  C:\Windows\System\PYOKeLt.exe
  2⤵
  PID:7120
- C:\Windows\System\zsyfmeZ.exe
  C:\Windows\System\zsyfmeZ.exe
  2⤵
  PID:6232
- C:\Windows\System\GjmFxDw.exe
  C:\Windows\System\GjmFxDw.exe
  2⤵
  PID:6488
- C:\Windows\System\FTifbwa.exe
  C:\Windows\System\FTifbwa.exe
  2⤵
  PID:6824
- C:\Windows\System\FXDsStU.exe
  C:\Windows\System\FXDsStU.exe
  2⤵
  PID:6908
- C:\Windows\System\bvApuLy.exe
  C:\Windows\System\bvApuLy.exe
  2⤵
  PID:7004
- C:\Windows\System\ndzxweH.exe
  C:\Windows\System\ndzxweH.exe
  2⤵
  PID:1640
- C:\Windows\System\QRMuQDd.exe
  C:\Windows\System\QRMuQDd.exe
  2⤵
  PID:5732
- C:\Windows\System\FFSUMtR.exe
  C:\Windows\System\FFSUMtR.exe
  2⤵
  PID:6052
- C:\Windows\System\WeZZmPO.exe
  C:\Windows\System\WeZZmPO.exe
  2⤵
  PID:1432
- C:\Windows\System\EAnlYPI.exe
  C:\Windows\System\EAnlYPI.exe
  2⤵
  PID:6568
- C:\Windows\System\fhLKSqL.exe
  C:\Windows\System\fhLKSqL.exe
  2⤵
  PID:7040
- C:\Windows\System\PmqnPRi.exe
  C:\Windows\System\PmqnPRi.exe
  2⤵
  PID:6228
- C:\Windows\System\uOogzcb.exe
  C:\Windows\System\uOogzcb.exe
  2⤵
  PID:6856
- C:\Windows\System\RpUKobu.exe
  C:\Windows\System\RpUKobu.exe
  2⤵
  PID:2080
- C:\Windows\System\vVKaHCW.exe
  C:\Windows\System\vVKaHCW.exe
  2⤵
  PID:1592
- C:\Windows\System\fQSJpnR.exe
  C:\Windows\System\fQSJpnR.exe
  2⤵
  PID:6340
- C:\Windows\System\gSeZSYQ.exe
  C:\Windows\System\gSeZSYQ.exe
  2⤵
  PID:1876
- C:\Windows\System\BKeIGEj.exe
  C:\Windows\System\BKeIGEj.exe
  2⤵
  PID:5872
- C:\Windows\System\pFaWjWD.exe
  C:\Windows\System\pFaWjWD.exe
  2⤵
  PID:6732
- C:\Windows\System\TfMacFp.exe
  C:\Windows\System\TfMacFp.exe
  2⤵
  PID:6828
- C:\Windows\System\oxEvnJQ.exe
  C:\Windows\System\oxEvnJQ.exe
  2⤵
  PID:6684
- C:\Windows\System\mMZjdQU.exe
  C:\Windows\System\mMZjdQU.exe
  2⤵
  PID:6796
- C:\Windows\System\uTcbBwO.exe
  C:\Windows\System\uTcbBwO.exe
  2⤵
  PID:828
- C:\Windows\System\eQZYTth.exe
  C:\Windows\System\eQZYTth.exe
  2⤵
  PID:6440
- C:\Windows\System\YPSWNPw.exe
  C:\Windows\System\YPSWNPw.exe
  2⤵
  PID:2196
- C:\Windows\System\ItBQRav.exe
  C:\Windows\System\ItBQRav.exe
  2⤵
  PID:7068
- C:\Windows\System\MdzaZFb.exe
  C:\Windows\System\MdzaZFb.exe
  2⤵
  PID:7148
- C:\Windows\System\CsfuhHh.exe
  C:\Windows\System\CsfuhHh.exe
  2⤵
  PID:1636
- C:\Windows\System\OiMtgqh.exe
  C:\Windows\System\OiMtgqh.exe
  2⤵
  PID:6452
- C:\Windows\System\jUiwnQt.exe
  C:\Windows\System\jUiwnQt.exe
  2⤵
  PID:7176
- C:\Windows\System\QwXZqhA.exe
  C:\Windows\System\QwXZqhA.exe
  2⤵
  PID:7192
- C:\Windows\System\NjSkoIW.exe
  C:\Windows\System\NjSkoIW.exe
  2⤵
  PID:7212
- C:\Windows\System\smWxxQR.exe
  C:\Windows\System\smWxxQR.exe
  2⤵
  PID:7228
- C:\Windows\System\iVPUzfi.exe
  C:\Windows\System\iVPUzfi.exe
  2⤵
  PID:7244
- C:\Windows\System\GZoiCJu.exe
  C:\Windows\System\GZoiCJu.exe
  2⤵
  PID:7260
- C:\Windows\System\OLLvLfW.exe
  C:\Windows\System\OLLvLfW.exe
  2⤵
  PID:7280
- C:\Windows\System\tzfnwBg.exe
  C:\Windows\System\tzfnwBg.exe
  2⤵
  PID:7296
- C:\Windows\System\pKEDsxl.exe
  C:\Windows\System\pKEDsxl.exe
  2⤵
  PID:7312
- C:\Windows\System\GqQNpUt.exe
  C:\Windows\System\GqQNpUt.exe
  2⤵
  PID:7328
- C:\Windows\System\yDnsSps.exe
  C:\Windows\System\yDnsSps.exe
  2⤵
  PID:7344
- C:\Windows\System\wXYIdKB.exe
  C:\Windows\System\wXYIdKB.exe
  2⤵
  PID:7360
- C:\Windows\System\fvCSzoZ.exe
  C:\Windows\System\fvCSzoZ.exe
  2⤵
  PID:7376
- C:\Windows\System\MOkpuOZ.exe
  C:\Windows\System\MOkpuOZ.exe
  2⤵
  PID:7392
- C:\Windows\System\STuZJac.exe
  C:\Windows\System\STuZJac.exe
  2⤵
  PID:7408
- C:\Windows\System\GKqkkXN.exe
  C:\Windows\System\GKqkkXN.exe
  2⤵
  PID:7428
- C:\Windows\System\NDuyuZk.exe
  C:\Windows\System\NDuyuZk.exe
  2⤵
  PID:7444
- C:\Windows\System\sNVXyZq.exe
  C:\Windows\System\sNVXyZq.exe
  2⤵
  PID:7460
- C:\Windows\System\rcoyGCA.exe
  C:\Windows\System\rcoyGCA.exe
  2⤵
  PID:7480
- C:\Windows\System\ErXnhyd.exe
  C:\Windows\System\ErXnhyd.exe
  2⤵
  PID:7496
- C:\Windows\System\VrjsGUo.exe
  C:\Windows\System\VrjsGUo.exe
  2⤵
  PID:7512
- C:\Windows\System\yRNAQLF.exe
  C:\Windows\System\yRNAQLF.exe
  2⤵
  PID:7532
- C:\Windows\System\kBnxQXS.exe
  C:\Windows\System\kBnxQXS.exe
  2⤵
  PID:7548
- C:\Windows\System\bASPBUl.exe
  C:\Windows\System\bASPBUl.exe
  2⤵
  PID:7564
- C:\Windows\System\ICMeUEZ.exe
  C:\Windows\System\ICMeUEZ.exe
  2⤵
  PID:7580
- C:\Windows\System\zQumjdU.exe
  C:\Windows\System\zQumjdU.exe
  2⤵
  PID:7600
- C:\Windows\System\IobZwEZ.exe
  C:\Windows\System\IobZwEZ.exe
  2⤵
  PID:7616
- C:\Windows\System\UwlpjIP.exe
  C:\Windows\System\UwlpjIP.exe
  2⤵
  PID:7632
- C:\Windows\System\gEeXrMr.exe
  C:\Windows\System\gEeXrMr.exe
  2⤵
  PID:7648
- C:\Windows\System\zXyVBdk.exe
  C:\Windows\System\zXyVBdk.exe
  2⤵
  PID:7668
- C:\Windows\System\fXwfowo.exe
  C:\Windows\System\fXwfowo.exe
  2⤵
  PID:7684
- C:\Windows\System\AoUBatK.exe
  C:\Windows\System\AoUBatK.exe
  2⤵
  PID:7700
- C:\Windows\System\YyPfLqb.exe
  C:\Windows\System\YyPfLqb.exe
  2⤵
  PID:7720
- C:\Windows\System\QNfDayp.exe
  C:\Windows\System\QNfDayp.exe
  2⤵
  PID:7736
- C:\Windows\System\hDxHjYB.exe
  C:\Windows\System\hDxHjYB.exe
  2⤵
  PID:7752
- C:\Windows\System\IMOcTEl.exe
  C:\Windows\System\IMOcTEl.exe
  2⤵
  PID:7768
- C:\Windows\System\lWEFyAY.exe
  C:\Windows\System\lWEFyAY.exe
  2⤵
  PID:7784
- C:\Windows\System\CSWYpVQ.exe
  C:\Windows\System\CSWYpVQ.exe
  2⤵
  PID:7800
- C:\Windows\System\LHkZwkR.exe
  C:\Windows\System\LHkZwkR.exe
  2⤵
  PID:7816
- C:\Windows\System\QhPGYmE.exe
  C:\Windows\System\QhPGYmE.exe
  2⤵
  PID:7832
- C:\Windows\System\kJkYGPh.exe
  C:\Windows\System\kJkYGPh.exe
  2⤵
  PID:7852
- C:\Windows\System\FReOzec.exe
  C:\Windows\System\FReOzec.exe
  2⤵
  PID:7868
- C:\Windows\System\UppdwuB.exe
  C:\Windows\System\UppdwuB.exe
  2⤵
  PID:7884
- C:\Windows\System\hNQobVQ.exe
  C:\Windows\System\hNQobVQ.exe
  2⤵
  PID:7904
- C:\Windows\System\GquTxEs.exe
  C:\Windows\System\GquTxEs.exe
  2⤵
  PID:7920
- C:\Windows\System\EFFPSfY.exe
  C:\Windows\System\EFFPSfY.exe
  2⤵
  PID:7936
- C:\Windows\System\MTbMDaH.exe
  C:\Windows\System\MTbMDaH.exe
  2⤵
  PID:7952
- C:\Windows\System\CzeEXiu.exe
  C:\Windows\System\CzeEXiu.exe
  2⤵
  PID:7968
- C:\Windows\System\LgjSecS.exe
  C:\Windows\System\LgjSecS.exe
  2⤵
  PID:7988
- C:\Windows\System\NeVRtvb.exe
  C:\Windows\System\NeVRtvb.exe
  2⤵
  PID:8004
- C:\Windows\System\VnvOWdk.exe
  C:\Windows\System\VnvOWdk.exe
  2⤵
  PID:8020
- C:\Windows\System\ZevwPxl.exe
  C:\Windows\System\ZevwPxl.exe
  2⤵
  PID:8040
- C:\Windows\System\BtmkPjU.exe
  C:\Windows\System\BtmkPjU.exe
  2⤵
  PID:8056
- C:\Windows\System\SPPJIEP.exe
  C:\Windows\System\SPPJIEP.exe
  2⤵
  PID:8072
- C:\Windows\System\mvNjCOm.exe
  C:\Windows\System\mvNjCOm.exe
  2⤵
  PID:8088
- C:\Windows\System\JcCpWDR.exe
  C:\Windows\System\JcCpWDR.exe
  2⤵
  PID:8104
- C:\Windows\System\hYkNdnm.exe
  C:\Windows\System\hYkNdnm.exe
  2⤵
  PID:8120
- C:\Windows\System\PJfAYme.exe
  C:\Windows\System\PJfAYme.exe
  2⤵
  PID:8140
- C:\Windows\System\sxUIQnm.exe
  C:\Windows\System\sxUIQnm.exe
  2⤵
  PID:8156
- C:\Windows\System\EIjsyWZ.exe
  C:\Windows\System\EIjsyWZ.exe
  2⤵
  PID:8172
- C:\Windows\System\fQWvzeu.exe
  C:\Windows\System\fQWvzeu.exe
  2⤵
  PID:8188
- C:\Windows\System\jKYxrnQ.exe
  C:\Windows\System\jKYxrnQ.exe
  2⤵
  PID:7184
- C:\Windows\System\RkLWAed.exe
  C:\Windows\System\RkLWAed.exe
  2⤵
  PID:1620
- C:\Windows\System\cYRbOAI.exe
  C:\Windows\System\cYRbOAI.exe
  2⤵
  PID:6940
- C:\Windows\System\pMhwYQC.exe
  C:\Windows\System\pMhwYQC.exe
  2⤵
  PID:7204
- C:\Windows\System\WFGUckt.exe
  C:\Windows\System\WFGUckt.exe
  2⤵
  PID:7240
- C:\Windows\System\ZTqTQCk.exe
  C:\Windows\System\ZTqTQCk.exe
  2⤵
  PID:7320
- C:\Windows\System\HhjkATh.exe
  C:\Windows\System\HhjkATh.exe
  2⤵
  PID:7384
- C:\Windows\System\YquuYSq.exe
  C:\Windows\System\YquuYSq.exe
  2⤵
  PID:7452
- C:\Windows\System\wcSypmw.exe
  C:\Windows\System\wcSypmw.exe
  2⤵
  PID:7524
- C:\Windows\System\PhenGFJ.exe
  C:\Windows\System\PhenGFJ.exe
  2⤵
  PID:7588
- C:\Windows\System\rkVpowq.exe
  C:\Windows\System\rkVpowq.exe
  2⤵
  PID:7268
- C:\Windows\System\sCtKBfE.exe
  C:\Windows\System\sCtKBfE.exe
  2⤵
  PID:7664
- C:\Windows\System\xOetXsZ.exe
  C:\Windows\System\xOetXsZ.exe
  2⤵
  PID:7728
- C:\Windows\System\dmVqEup.exe
  C:\Windows\System\dmVqEup.exe
  2⤵
  PID:7540
- C:\Windows\System\aodCSot.exe
  C:\Windows\System\aodCSot.exe
  2⤵
  PID:7340
- C:\Windows\System\RoblNVh.exe
  C:\Windows\System\RoblNVh.exe
  2⤵
  PID:7304
- C:\Windows\System\QvLEtmc.exe
  C:\Windows\System\QvLEtmc.exe
  2⤵
  PID:7824
- C:\Windows\System\EcbmNlm.exe
  C:\Windows\System\EcbmNlm.exe
  2⤵
  PID:7828
- C:\Windows\System\QssBDcP.exe
  C:\Windows\System\QssBDcP.exe
  2⤵
  PID:7400
- C:\Windows\System\HNbZImo.exe
  C:\Windows\System\HNbZImo.exe
  2⤵
  PID:7472
- C:\Windows\System\CUSEpBJ.exe
  C:\Windows\System\CUSEpBJ.exe
  2⤵
  PID:7572
- C:\Windows\System\ucWJHKo.exe
  C:\Windows\System\ucWJHKo.exe
  2⤵
  PID:7676
- C:\Windows\System\TXdTlBL.exe
  C:\Windows\System\TXdTlBL.exe
  2⤵
  PID:7932
- C:\Windows\System\rEAxzRT.exe
  C:\Windows\System\rEAxzRT.exe
  2⤵
  PID:7708
- C:\Windows\System\TKIjWMg.exe
  C:\Windows\System\TKIjWMg.exe
  2⤵
  PID:7748
- C:\Windows\System\zAONjvK.exe
  C:\Windows\System\zAONjvK.exe
  2⤵
  PID:7812
- C:\Windows\System\iyXdaOF.exe
  C:\Windows\System\iyXdaOF.exe
  2⤵
  PID:8064
- C:\Windows\System\YWkkCUH.exe
  C:\Windows\System\YWkkCUH.exe
  2⤵
  PID:7844
- C:\Windows\System\RpcTBlZ.exe
  C:\Windows\System\RpcTBlZ.exe
  2⤵
  PID:7980
- C:\Windows\System\GxVxinj.exe
  C:\Windows\System\GxVxinj.exe
  2⤵
  PID:7976
- C:\Windows\System\zvgWdSy.exe
  C:\Windows\System\zvgWdSy.exe
  2⤵
  PID:7984
- C:\Windows\System\YVyajMJ.exe
  C:\Windows\System\YVyajMJ.exe
  2⤵
  PID:8148
- C:\Windows\System\JiddHRT.exe
  C:\Windows\System\JiddHRT.exe
  2⤵
  PID:6436
- C:\Windows\System\bQMXVIN.exe
  C:\Windows\System\bQMXVIN.exe
  2⤵
  PID:8080
- C:\Windows\System\AHKkjJr.exe
  C:\Windows\System\AHKkjJr.exe
  2⤵
  PID:6872
- C:\Windows\System\ZfrWoNT.exe
  C:\Windows\System\ZfrWoNT.exe
  2⤵
  PID:7356
- C:\Windows\System\tcgZYcZ.exe
  C:\Windows\System\tcgZYcZ.exe
  2⤵
  PID:8012
- C:\Windows\System\rkeUrgZ.exe
  C:\Windows\System\rkeUrgZ.exe
  2⤵
  PID:7220
- C:\Windows\System\dXDoAJO.exe
  C:\Windows\System\dXDoAJO.exe
  2⤵
  PID:7656
- C:\Windows\System\GAYBFdC.exe
  C:\Windows\System\GAYBFdC.exe
  2⤵
  PID:7796
- C:\Windows\System\ZAcfJNu.exe
  C:\Windows\System\ZAcfJNu.exe
  2⤵
  PID:7900
- C:\Windows\System\aYonEVL.exe
  C:\Windows\System\aYonEVL.exe
  2⤵
  PID:7288
- C:\Windows\System\JuhvMlt.exe
  C:\Windows\System\JuhvMlt.exe
  2⤵
  PID:7424
- C:\Windows\System\oaorNXV.exe
  C:\Windows\System\oaorNXV.exe
  2⤵
  PID:7760
- C:\Windows\System\BOjzzno.exe
  C:\Windows\System\BOjzzno.exe
  2⤵
  PID:7612
- C:\Windows\System\PmCeEEx.exe
  C:\Windows\System\PmCeEEx.exe
  2⤵
  PID:7640
- C:\Windows\System\HsmdwyM.exe
  C:\Windows\System\HsmdwyM.exe
  2⤵
  PID:7964
- C:\Windows\System\oeeNdIr.exe
  C:\Windows\System\oeeNdIr.exe
  2⤵
  PID:7944
- C:\Windows\System\ODBvsVl.exe
  C:\Windows\System\ODBvsVl.exe
  2⤵
  PID:8128
- C:\Windows\System\DNoVBSi.exe
  C:\Windows\System\DNoVBSi.exe
  2⤵
  PID:7840
- C:\Windows\System\nthTBoe.exe
  C:\Windows\System\nthTBoe.exe
  2⤵
  PID:8116
- C:\Windows\System\NwtDEEZ.exe
  C:\Windows\System\NwtDEEZ.exe
  2⤵
  PID:8152
- C:\Windows\System\OrMBUeN.exe
  C:\Windows\System\OrMBUeN.exe
  2⤵
  PID:7416
- C:\Windows\System\Tgtfbol.exe
  C:\Windows\System\Tgtfbol.exe
  2⤵
  PID:2400
- C:\Windows\System\RDNkkhn.exe
  C:\Windows\System\RDNkkhn.exe
  2⤵
  PID:7916
- C:\Windows\System\GqQnwyp.exe
  C:\Windows\System\GqQnwyp.exe
  2⤵
  PID:8164
- C:\Windows\System\XHVrwVJ.exe
  C:\Windows\System\XHVrwVJ.exe
  2⤵
  PID:6748
- C:\Windows\System\RXdiFOV.exe
  C:\Windows\System\RXdiFOV.exe
  2⤵
  PID:6260
- C:\Windows\System\gFybkpp.exe
  C:\Windows\System\gFybkpp.exe
  2⤵
  PID:7628
- C:\Windows\System\WffEecl.exe
  C:\Windows\System\WffEecl.exe
  2⤵
  PID:7440
- C:\Windows\System\KmRLsiY.exe
  C:\Windows\System\KmRLsiY.exe
  2⤵
  PID:7492
- C:\Windows\System\eaaczCz.exe
  C:\Windows\System\eaaczCz.exe
  2⤵
  PID:8208
- C:\Windows\System\XpgnZLn.exe
  C:\Windows\System\XpgnZLn.exe
  2⤵
  PID:8224
- C:\Windows\System\mlxalic.exe
  C:\Windows\System\mlxalic.exe
  2⤵
  PID:8240
- C:\Windows\System\wCMLoZo.exe
  C:\Windows\System\wCMLoZo.exe
  2⤵
  PID:8260
- C:\Windows\System\iFSWbrk.exe
  C:\Windows\System\iFSWbrk.exe
  2⤵
  PID:8276
- C:\Windows\System\rgsnLnM.exe
  C:\Windows\System\rgsnLnM.exe
  2⤵
  PID:8292
- C:\Windows\System\RcLNZml.exe
  C:\Windows\System\RcLNZml.exe
  2⤵
  PID:8312
- C:\Windows\System\xaVgHxM.exe
  C:\Windows\System\xaVgHxM.exe
  2⤵
  PID:8328
- C:\Windows\System\NGItXZx.exe
  C:\Windows\System\NGItXZx.exe
  2⤵
  PID:8344
- C:\Windows\System\FpPXkFH.exe
  C:\Windows\System\FpPXkFH.exe
  2⤵
  PID:8364
- C:\Windows\System\TtDfixr.exe
  C:\Windows\System\TtDfixr.exe
  2⤵
  PID:8380
- C:\Windows\System\uoXtCem.exe
  C:\Windows\System\uoXtCem.exe
  2⤵
  PID:8400
- C:\Windows\System\OPIrGZf.exe
  C:\Windows\System\OPIrGZf.exe
  2⤵
  PID:8416
- C:\Windows\System\EPtRJfD.exe
  C:\Windows\System\EPtRJfD.exe
  2⤵
  PID:8432
- C:\Windows\System\JTgWiHJ.exe
  C:\Windows\System\JTgWiHJ.exe
  2⤵
  PID:8452
- C:\Windows\System\STvjVum.exe
  C:\Windows\System\STvjVum.exe
  2⤵
  PID:8468
- C:\Windows\System\hWFysoQ.exe
  C:\Windows\System\hWFysoQ.exe
  2⤵
  PID:8484
- C:\Windows\System\QkhRzgA.exe
  C:\Windows\System\QkhRzgA.exe
  2⤵
  PID:8504
- C:\Windows\System\rwDqSKw.exe
  C:\Windows\System\rwDqSKw.exe
  2⤵
  PID:8520
- C:\Windows\System\sGoxmie.exe
  C:\Windows\System\sGoxmie.exe
  2⤵
  PID:8536
- C:\Windows\System\RyQEcFe.exe
  C:\Windows\System\RyQEcFe.exe
  2⤵
  PID:8552
- C:\Windows\System\bnABcQw.exe
  C:\Windows\System\bnABcQw.exe
  2⤵
  PID:8572
- C:\Windows\System\cbXIbEF.exe
  C:\Windows\System\cbXIbEF.exe
  2⤵
  PID:8588
- C:\Windows\System\rTzrsWe.exe
  C:\Windows\System\rTzrsWe.exe
  2⤵
  PID:8604
- C:\Windows\System\zitvqzv.exe
  C:\Windows\System\zitvqzv.exe
  2⤵
  PID:8624
- C:\Windows\System\wIiUVGG.exe
  C:\Windows\System\wIiUVGG.exe
  2⤵
  PID:8640
- C:\Windows\System\iuSOSah.exe
  C:\Windows\System\iuSOSah.exe
  2⤵
  PID:8656
- C:\Windows\System\ththkyu.exe
  C:\Windows\System\ththkyu.exe
  2⤵
  PID:8676
- C:\Windows\System\UikSWuz.exe
  C:\Windows\System\UikSWuz.exe
  2⤵
  PID:8692
- C:\Windows\System\smVOhAB.exe
  C:\Windows\System\smVOhAB.exe
  2⤵
  PID:8708
- C:\Windows\System\mVasGyX.exe
  C:\Windows\System\mVasGyX.exe
  2⤵
  PID:8728
- C:\Windows\System\OLqSTiw.exe
  C:\Windows\System\OLqSTiw.exe
  2⤵
  PID:8744
- C:\Windows\System\BkRguOP.exe
  C:\Windows\System\BkRguOP.exe
  2⤵
  PID:8760
- C:\Windows\System\FNXDrmT.exe
  C:\Windows\System\FNXDrmT.exe
  2⤵
  PID:8776
- C:\Windows\System\XdsQBIv.exe
  C:\Windows\System\XdsQBIv.exe
  2⤵
  PID:8792
- C:\Windows\System\zydJjJZ.exe
  C:\Windows\System\zydJjJZ.exe
  2⤵
  PID:8808
- C:\Windows\System\FgLgfWw.exe
  C:\Windows\System\FgLgfWw.exe
  2⤵
  PID:8824
- C:\Windows\System\BgOyTdB.exe
  C:\Windows\System\BgOyTdB.exe
  2⤵
  PID:8844
- C:\Windows\System\spPyKvI.exe
  C:\Windows\System\spPyKvI.exe
  2⤵
  PID:8860
- C:\Windows\System\wEpHjgG.exe
  C:\Windows\System\wEpHjgG.exe
  2⤵
  PID:8880
- C:\Windows\System\lUdYxhF.exe
  C:\Windows\System\lUdYxhF.exe
  2⤵
  PID:8896
- C:\Windows\System\gWzgybV.exe
  C:\Windows\System\gWzgybV.exe
  2⤵
  PID:8916
- C:\Windows\System\TQqPHeh.exe
  C:\Windows\System\TQqPHeh.exe
  2⤵
  PID:8932
- C:\Windows\System\kUnWoBn.exe
  C:\Windows\System\kUnWoBn.exe
  2⤵
  PID:8948
- C:\Windows\System\ZQVygYz.exe
  C:\Windows\System\ZQVygYz.exe
  2⤵
  PID:8968
- C:\Windows\System\TYUDvUS.exe
  C:\Windows\System\TYUDvUS.exe
  2⤵
  PID:8984
- C:\Windows\System\WyPgcYL.exe
  C:\Windows\System\WyPgcYL.exe
  2⤵
  PID:9000
- C:\Windows\System\QygxImC.exe
  C:\Windows\System\QygxImC.exe
  2⤵
  PID:9016
- C:\Windows\System\nGVihqF.exe
  C:\Windows\System\nGVihqF.exe
  2⤵
  PID:9036
- C:\Windows\System\kWNmmll.exe
  C:\Windows\System\kWNmmll.exe
  2⤵
  PID:9052
- C:\Windows\System\HhNbHpb.exe
  C:\Windows\System\HhNbHpb.exe
  2⤵
  PID:9068
- C:\Windows\System\torahwZ.exe
  C:\Windows\System\torahwZ.exe
  2⤵
  PID:9084
- C:\Windows\System\FjgQTXz.exe
  C:\Windows\System\FjgQTXz.exe
  2⤵
  PID:9104
- C:\Windows\System\kGuJdzN.exe
  C:\Windows\System\kGuJdzN.exe
  2⤵
  PID:9120
- C:\Windows\System\MAjFbyo.exe
  C:\Windows\System\MAjFbyo.exe
  2⤵
  PID:9136
- C:\Windows\System\qUzyIux.exe
  C:\Windows\System\qUzyIux.exe
  2⤵
  PID:9156
- C:\Windows\System\mjhOVPb.exe
  C:\Windows\System\mjhOVPb.exe
  2⤵
  PID:9172
- C:\Windows\System\UDyWCzQ.exe
  C:\Windows\System\UDyWCzQ.exe
  2⤵
  PID:9188
- C:\Windows\System\rGzFuBh.exe
  C:\Windows\System\rGzFuBh.exe
  2⤵
  PID:9204
- C:\Windows\System\BNZNWCA.exe
  C:\Windows\System\BNZNWCA.exe
  2⤵
  PID:3732
- C:\Windows\System\iQtVYYN.exe
  C:\Windows\System\iQtVYYN.exe
  2⤵
  PID:8220
- C:\Windows\System\TQzzxnR.exe
  C:\Windows\System\TQzzxnR.exe
  2⤵
  PID:7172
- C:\Windows\System\ivhkIWO.exe
  C:\Windows\System\ivhkIWO.exe
  2⤵
  PID:6164
- C:\Windows\System\BwbiVsw.exe
  C:\Windows\System\BwbiVsw.exe
  2⤵
  PID:8288
- C:\Windows\System\lsdCodj.exe
  C:\Windows\System\lsdCodj.exe
  2⤵
  PID:7880
- C:\Windows\System\oBsSMvL.exe
  C:\Windows\System\oBsSMvL.exe
  2⤵
  PID:8184
- C:\Windows\System\LAuYoKC.exe
  C:\Windows\System\LAuYoKC.exe
  2⤵
  PID:8200
- C:\Windows\System\IMhYXAN.exe
  C:\Windows\System\IMhYXAN.exe
  2⤵
  PID:8268
- C:\Windows\System\BieUjag.exe
  C:\Windows\System\BieUjag.exe
  2⤵
  PID:8388
- C:\Windows\System\jeoTiJr.exe
  C:\Windows\System\jeoTiJr.exe
  2⤵
  PID:8392
- C:\Windows\System\zAAPIzR.exe
  C:\Windows\System\zAAPIzR.exe
  2⤵
  PID:8336
- C:\Windows\System\IMjBqhY.exe
  C:\Windows\System\IMjBqhY.exe
  2⤵
  PID:8464
- C:\Windows\System\iTjDNon.exe
  C:\Windows\System\iTjDNon.exe
  2⤵
  PID:8596
- C:\Windows\System\pErAAMz.exe
  C:\Windows\System\pErAAMz.exe
  2⤵
  PID:8560
- C:\Windows\System\DOdrwUL.exe
  C:\Windows\System\DOdrwUL.exe
  2⤵
  PID:8636
- C:\Windows\System\lzdXCCT.exe
  C:\Windows\System\lzdXCCT.exe
  2⤵
  PID:8672
- C:\Windows\System\TKeZOnR.exe
  C:\Windows\System\TKeZOnR.exe
  2⤵
  PID:8444
- C:\Windows\System\DJDMGDr.exe
  C:\Windows\System\DJDMGDr.exe
  2⤵
  PID:8476
- C:\Windows\System\IsEoHlH.exe
  C:\Windows\System\IsEoHlH.exe
  2⤵
  PID:8544
- C:\Windows\System\irztcOx.exe
  C:\Windows\System\irztcOx.exe
  2⤵
  PID:8616
- C:\Windows\System\tViZLyc.exe
  C:\Windows\System\tViZLyc.exe
  2⤵
  PID:8684
- C:\Windows\System\vVlpVaM.exe
  C:\Windows\System\vVlpVaM.exe
  2⤵
  PID:8752
- C:\Windows\System\vJwTljn.exe
  C:\Windows\System\vJwTljn.exe
  2⤵
  PID:8756
- C:\Windows\System\twvCyyw.exe
  C:\Windows\System\twvCyyw.exe
  2⤵
  PID:8804
- C:\Windows\System\cMYvAEv.exe
  C:\Windows\System\cMYvAEv.exe
  2⤵
  PID:8868
- C:\Windows\System\rliNAxV.exe
  C:\Windows\System\rliNAxV.exe
  2⤵
  PID:8912
- C:\Windows\System\XJuZGpr.exe
  C:\Windows\System\XJuZGpr.exe
  2⤵
  PID:8852
- C:\Windows\System\eWHKtyF.exe
  C:\Windows\System\eWHKtyF.exe
  2⤵
  PID:8924
- C:\Windows\System\EOGgskT.exe
  C:\Windows\System\EOGgskT.exe
  2⤵
  PID:8964
- C:\Windows\System\owPSBFj.exe
  C:\Windows\System\owPSBFj.exe
  2⤵
  PID:9012
- C:\Windows\System\uqGKcrH.exe
  C:\Windows\System\uqGKcrH.exe
  2⤵
  PID:8996
- C:\Windows\System\gjEajfB.exe
  C:\Windows\System\gjEajfB.exe
  2⤵
  PID:9060
- C:\Windows\System\JliEhLb.exe
  C:\Windows\System\JliEhLb.exe
  2⤵
  PID:9100
- C:\Windows\System\QsxWEOs.exe
  C:\Windows\System\QsxWEOs.exe
  2⤵
  PID:9112
- C:\Windows\System\ghRApuB.exe
  C:\Windows\System\ghRApuB.exe
  2⤵
  PID:9152
- C:\Windows\System\ORvqOdo.exe
  C:\Windows\System\ORvqOdo.exe
  2⤵
  PID:8016
- C:\Windows\System\EZneVps.exe
  C:\Windows\System\EZneVps.exe
  2⤵
  PID:9180
- C:\Windows\System\hMFVPdG.exe
  C:\Windows\System\hMFVPdG.exe
  2⤵
  PID:8248
- C:\Windows\System\QznSqct.exe
  C:\Windows\System\QznSqct.exe
  2⤵
  PID:8136
- C:\Windows\System\XJTTtZn.exe
  C:\Windows\System\XJTTtZn.exe
  2⤵
  PID:8424
- C:\Windows\System\OtCyZjh.exe
  C:\Windows\System\OtCyZjh.exe
  2⤵
  PID:8460
- C:\Windows\System\HbDXyuN.exe
  C:\Windows\System\HbDXyuN.exe
  2⤵
  PID:8668
- C:\Windows\System\qDHydKH.exe
  C:\Windows\System\qDHydKH.exe
  2⤵
  PID:8584
- C:\Windows\System\dvdDeTe.exe
  C:\Windows\System\dvdDeTe.exe
  2⤵
  PID:8772
- C:\Windows\System\oKhmeCM.exe
  C:\Windows\System\oKhmeCM.exe
  2⤵
  PID:8908
- C:\Windows\System\BqDNhcZ.exe
  C:\Windows\System\BqDNhcZ.exe
  2⤵
  PID:7056
- C:\Windows\System\BaJdwHb.exe
  C:\Windows\System\BaJdwHb.exe
  2⤵
  PID:9032
- C:\Windows\System\fikUFaY.exe
  C:\Windows\System\fikUFaY.exe
  2⤵
  PID:7716
- C:\Windows\System\qRUmpJJ.exe
  C:\Windows\System\qRUmpJJ.exe
  2⤵
  PID:7368
- C:\Windows\System\CtsCJDm.exe
  C:\Windows\System\CtsCJDm.exe
  2⤵
  PID:8784
- C:\Windows\System\PDCuMQe.exe
  C:\Windows\System\PDCuMQe.exe
  2⤵
  PID:8820
- C:\Windows\System\RPMARem.exe
  C:\Windows\System\RPMARem.exe
  2⤵
  PID:8532
- C:\Windows\System\wcNtWEg.exe
  C:\Windows\System\wcNtWEg.exe
  2⤵
  PID:8196
- C:\Windows\System\nxDVQHw.exe
  C:\Windows\System\nxDVQHw.exe
  2⤵
  PID:8304
- C:\Windows\System\TpEPIqV.exe
  C:\Windows\System\TpEPIqV.exe
  2⤵
  PID:8408
- C:\Windows\System\QGLdMms.exe
  C:\Windows\System\QGLdMms.exe
  2⤵
  PID:8956
- C:\Windows\System\OpoXVrR.exe
  C:\Windows\System\OpoXVrR.exe
  2⤵
  PID:9092
- C:\Windows\System\CUYuFhb.exe
  C:\Windows\System\CUYuFhb.exe
  2⤵
  PID:7696
- C:\Windows\System\LIcwziu.exe
  C:\Windows\System\LIcwziu.exe
  2⤵
  PID:9212
- C:\Windows\System\xONkxJz.exe
  C:\Windows\System\xONkxJz.exe
  2⤵
  PID:8720
- C:\Windows\System\dgbJPFs.exe
  C:\Windows\System\dgbJPFs.exe
  2⤵
  PID:8412
- C:\Windows\System\FwOQBgy.exe
  C:\Windows\System\FwOQBgy.exe
  2⤵
  PID:8632
- C:\Windows\System\FgPHwYF.exe
  C:\Windows\System\FgPHwYF.exe
  2⤵
  PID:8356
- C:\Windows\System\YSylLcR.exe
  C:\Windows\System\YSylLcR.exe
  2⤵
  PID:8788
- C:\Windows\System\xMtWIrc.exe
  C:\Windows\System\xMtWIrc.exe
  2⤵
  PID:8440
- C:\Windows\System\fxOjZiE.exe
  C:\Windows\System\fxOjZiE.exe
  2⤵
  PID:8360
- C:\Windows\System\svoBqrU.exe
  C:\Windows\System\svoBqrU.exe
  2⤵
  PID:8500
- C:\Windows\System\OlIOShl.exe
  C:\Windows\System\OlIOShl.exe
  2⤵
  PID:9196
- C:\Windows\System\hAVcUEk.exe
  C:\Windows\System\hAVcUEk.exe
  2⤵
  PID:7468
- C:\Windows\System\kKEjnVQ.exe
  C:\Windows\System\kKEjnVQ.exe
  2⤵
  PID:8992
- C:\Windows\System\DlcJXKM.exe
  C:\Windows\System\DlcJXKM.exe
  2⤵
  PID:8252
- C:\Windows\System\eYwshiI.exe
  C:\Windows\System\eYwshiI.exe
  2⤵
  PID:8904
- C:\Windows\System\bzJjYfl.exe
  C:\Windows\System\bzJjYfl.exe
  2⤵
  PID:8704
- C:\Windows\System\jGCGYwl.exe
  C:\Windows\System\jGCGYwl.exe
  2⤵
  PID:8736
- C:\Windows\System\swCrnNP.exe
  C:\Windows\System\swCrnNP.exe
  2⤵
  PID:9028
- C:\Windows\System\pRFYdqe.exe
  C:\Windows\System\pRFYdqe.exe
  2⤵
  PID:9224
- C:\Windows\System\MhoHVjk.exe
  C:\Windows\System\MhoHVjk.exe
  2⤵
  PID:9244
- C:\Windows\System\sAmKByw.exe
  C:\Windows\System\sAmKByw.exe
  2⤵
  PID:9260
- C:\Windows\System\TppqAAb.exe
  C:\Windows\System\TppqAAb.exe
  2⤵
  PID:9276
- C:\Windows\System\BQdwFrU.exe
  C:\Windows\System\BQdwFrU.exe
  2⤵
  PID:9296
- C:\Windows\System\stYMHDi.exe
  C:\Windows\System\stYMHDi.exe
  2⤵
  PID:9320
- C:\Windows\System\BByThCI.exe
  C:\Windows\System\BByThCI.exe
  2⤵
  PID:9336
- C:\Windows\System\KIzKWeT.exe
  C:\Windows\System\KIzKWeT.exe
  2⤵
  PID:9352
- C:\Windows\System\BwHVMwB.exe
  C:\Windows\System\BwHVMwB.exe
  2⤵
  PID:9368
- C:\Windows\System\GyZUtMv.exe
  C:\Windows\System\GyZUtMv.exe
  2⤵
  PID:9384
- C:\Windows\System\amheMum.exe
  C:\Windows\System\amheMum.exe
  2⤵
  PID:9400
- C:\Windows\System\DFOfHER.exe
  C:\Windows\System\DFOfHER.exe
  2⤵
  PID:9416
- C:\Windows\System\PbfOZfu.exe
  C:\Windows\System\PbfOZfu.exe
  2⤵
  PID:9432
- C:\Windows\System\mCszxtS.exe
  C:\Windows\System\mCszxtS.exe
  2⤵
  PID:9448
- C:\Windows\System\vVlwfhJ.exe
  C:\Windows\System\vVlwfhJ.exe
  2⤵
  PID:9468
- C:\Windows\System\lrtfGcE.exe
  C:\Windows\System\lrtfGcE.exe
  2⤵
  PID:9484
- C:\Windows\System\jmzzJse.exe
  C:\Windows\System\jmzzJse.exe
  2⤵
  PID:9500
- C:\Windows\System\GdcAdcN.exe
  C:\Windows\System\GdcAdcN.exe
  2⤵
  PID:9516
- C:\Windows\System\PpIZGCe.exe
  C:\Windows\System\PpIZGCe.exe
  2⤵
  PID:9532
- C:\Windows\System\ehrNFYV.exe
  C:\Windows\System\ehrNFYV.exe
  2⤵
  PID:9548
- C:\Windows\System\TqQyVZe.exe
  C:\Windows\System\TqQyVZe.exe
  2⤵
  PID:9564
- C:\Windows\System\UrvrWGI.exe
  C:\Windows\System\UrvrWGI.exe
  2⤵
  PID:9584
- C:\Windows\System\oIvNAVc.exe
  C:\Windows\System\oIvNAVc.exe
  2⤵
  PID:9600
- C:\Windows\System\MlbmycM.exe
  C:\Windows\System\MlbmycM.exe
  2⤵
  PID:9616
- C:\Windows\System\IqtXani.exe
  C:\Windows\System\IqtXani.exe
  2⤵
  PID:9636
- C:\Windows\System\cdKwqcE.exe
  C:\Windows\System\cdKwqcE.exe
  2⤵
  PID:9652
- C:\Windows\System\pvqxSmG.exe
  C:\Windows\System\pvqxSmG.exe
  2⤵
  PID:9668
- C:\Windows\System\xMQamsu.exe
  C:\Windows\System\xMQamsu.exe
  2⤵
  PID:9684
- C:\Windows\System\rmDhLSE.exe
  C:\Windows\System\rmDhLSE.exe
  2⤵
  PID:9700
- C:\Windows\System\VitWoVI.exe
  C:\Windows\System\VitWoVI.exe
  2⤵
  PID:9716
- C:\Windows\System\CMNvPHS.exe
  C:\Windows\System\CMNvPHS.exe
  2⤵
  PID:9732
- C:\Windows\System\mtmxwwA.exe
  C:\Windows\System\mtmxwwA.exe
  2⤵
  PID:9748
- C:\Windows\System\efhQGDP.exe
  C:\Windows\System\efhQGDP.exe
  2⤵
  PID:9764
- C:\Windows\System\YGHoePa.exe
  C:\Windows\System\YGHoePa.exe
  2⤵
  PID:9780
- C:\Windows\System\uKefwvM.exe
  C:\Windows\System\uKefwvM.exe
  2⤵
  PID:9796
- C:\Windows\System\PeiKntI.exe
  C:\Windows\System\PeiKntI.exe
  2⤵
  PID:9812
- C:\Windows\System\byrgpqx.exe
  C:\Windows\System\byrgpqx.exe
  2⤵
  PID:9828
- C:\Windows\System\dOoDaVg.exe
  C:\Windows\System\dOoDaVg.exe
  2⤵
  PID:9844
- C:\Windows\System\JQmgZzb.exe
  C:\Windows\System\JQmgZzb.exe
  2⤵
  PID:9864
- C:\Windows\System\akxxxtG.exe
  C:\Windows\System\akxxxtG.exe
  2⤵
  PID:9884
- C:\Windows\System\RkYkvGX.exe
  C:\Windows\System\RkYkvGX.exe
  2⤵
  PID:9900
- C:\Windows\System\hkrPZqf.exe
  C:\Windows\System\hkrPZqf.exe
  2⤵
  PID:9916
- C:\Windows\System\tYwtEqJ.exe
  C:\Windows\System\tYwtEqJ.exe
  2⤵
  PID:9932
- C:\Windows\System\jsCiIDn.exe
  C:\Windows\System\jsCiIDn.exe
  2⤵
  PID:9948
- C:\Windows\System\szkeWQE.exe
  C:\Windows\System\szkeWQE.exe
  2⤵
  PID:9964
- C:\Windows\System\ZfLcIpE.exe
  C:\Windows\System\ZfLcIpE.exe
  2⤵
  PID:9980
- C:\Windows\System\lVwWLke.exe
  C:\Windows\System\lVwWLke.exe
  2⤵
  PID:9996
- C:\Windows\System\sQJFkwh.exe
  C:\Windows\System\sQJFkwh.exe
  2⤵
  PID:10012
- C:\Windows\System\CHLbCni.exe
  C:\Windows\System\CHLbCni.exe
  2⤵
  PID:10028
- C:\Windows\System\BMyPnsc.exe
  C:\Windows\System\BMyPnsc.exe
  2⤵
  PID:10048
- C:\Windows\System\pQLsIih.exe
  C:\Windows\System\pQLsIih.exe
  2⤵
  PID:10064
- C:\Windows\System\Izyjwro.exe
  C:\Windows\System\Izyjwro.exe
  2⤵
  PID:10080
- C:\Windows\System\nghlXFH.exe
  C:\Windows\System\nghlXFH.exe
  2⤵
  PID:10100
- C:\Windows\System\klcLlhf.exe
  C:\Windows\System\klcLlhf.exe
  2⤵
  PID:10116
- C:\Windows\System\LknSfcX.exe
  C:\Windows\System\LknSfcX.exe
  2⤵
  PID:10136
- C:\Windows\System\OfxDFfs.exe
  C:\Windows\System\OfxDFfs.exe
  2⤵
  PID:10156
- C:\Windows\System\tvdUwvj.exe
  C:\Windows\System\tvdUwvj.exe
  2⤵
  PID:10172
- C:\Windows\System\BCXJrYn.exe
  C:\Windows\System\BCXJrYn.exe
  2⤵
  PID:10188
- C:\Windows\System\THvxAhP.exe
  C:\Windows\System\THvxAhP.exe
  2⤵
  PID:10204
- C:\Windows\System\hcohASh.exe
  C:\Windows\System\hcohASh.exe
  2⤵
  PID:10220
- C:\Windows\System\MaIXKwT.exe
  C:\Windows\System\MaIXKwT.exe
  2⤵
  PID:8236
- C:\Windows\System\gcnXNXc.exe
  C:\Windows\System\gcnXNXc.exe
  2⤵
  PID:9284
- C:\Windows\System\fENwhHj.exe
  C:\Windows\System\fENwhHj.exe
  2⤵
  PID:9288
- C:\Windows\System\QYnbGuu.exe
  C:\Windows\System\QYnbGuu.exe
  2⤵
  PID:9236
- C:\Windows\System\YjfTaCS.exe
  C:\Windows\System\YjfTaCS.exe
  2⤵
  PID:9304
- C:\Windows\System\qOTjwKc.exe
  C:\Windows\System\qOTjwKc.exe
  2⤵
  PID:9332
- C:\Windows\System\GIKJLmn.exe
  C:\Windows\System\GIKJLmn.exe
  2⤵
  PID:9396
- C:\Windows\System\zmbgDTy.exe
  C:\Windows\System\zmbgDTy.exe
  2⤵
  PID:9464
- C:\Windows\System\aHiAGcI.exe
  C:\Windows\System\aHiAGcI.exe
  2⤵
  PID:9380
- C:\Windows\System\mzRwNOA.exe
  C:\Windows\System\mzRwNOA.exe
  2⤵
  PID:9524
- C:\Windows\System\JmzwGyT.exe
  C:\Windows\System\JmzwGyT.exe
  2⤵
  PID:9444
- C:\Windows\System\jJJaNFc.exe
  C:\Windows\System\jJJaNFc.exe
  2⤵
  PID:9440
- C:\Windows\System\mJfOQMA.exe
  C:\Windows\System\mJfOQMA.exe
  2⤵
  PID:9560
- C:\Windows\System\kJKiOjO.exe
  C:\Windows\System\kJKiOjO.exe
  2⤵
  PID:9596
- C:\Windows\System\PrsBPNN.exe
  C:\Windows\System\PrsBPNN.exe
  2⤵
  PID:9572
- C:\Windows\System\fHyhYNv.exe
  C:\Windows\System\fHyhYNv.exe
  2⤵
  PID:9612
- C:\Windows\System\ptFBXTX.exe
  C:\Windows\System\ptFBXTX.exe
  2⤵
  PID:9708
- C:\Windows\System\HcnlnUL.exe
  C:\Windows\System\HcnlnUL.exe
  2⤵
  PID:9728
- C:\Windows\System\IOixMeN.exe
  C:\Windows\System\IOixMeN.exe
  2⤵
  PID:9680
- C:\Windows\System\ldQWbKy.exe
  C:\Windows\System\ldQWbKy.exe
  2⤵
  PID:9744
- C:\Windows\System\UNvYToY.exe
  C:\Windows\System\UNvYToY.exe
  2⤵
  PID:9820
- C:\Windows\System\kdEwllQ.exe
  C:\Windows\System\kdEwllQ.exe
  2⤵
  PID:9856
- C:\Windows\System\ECMRYii.exe
  C:\Windows\System\ECMRYii.exe
  2⤵
  PID:9840
- C:\Windows\System\nanHkqq.exe
  C:\Windows\System\nanHkqq.exe
  2⤵
  PID:9924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CfRIDTR.exe

Filesize
1.4MB

MD5
664fc92c971f1743f0ded4137a628597

SHA1
e652d465a9b85c571e46fb44e46ffe7e6d02e861

SHA256
1e2a8339f4975848e3b17036c72c3592ffb9535ef094b2f973b2f49a43c89f1e

SHA512
9e6bcea5c7c5d9c8579af16e9a96644a119ebb07aac0b54d0edc93db93b66a609a2e49bdc3d20e44330c3cb746da7f7ad7753b119a47210993260bd9ea567903

Download Submit
C:\Windows\system\DSHaQOs.exe

Filesize
1.4MB

MD5
59106d9fbdfafc1eecd62fe423627887

SHA1
3a7617775375517b381f678ca1848d2faf253ac5

SHA256
40fd90f3d673d9b12f609b091ef81ea046c1cf6571149de54197fb67096a229b

SHA512
f861ae6b137b4c5154a693488632436d8dac53263160cb0ec1226159b27c7fd4f1a9a7799ddca5bb062cdf7300e54963a567f137dff8bc4044cb66979458cbcb

Download Submit
C:\Windows\system\DpAGPdo.exe

Filesize
1.4MB

MD5
4ad0b5a0969564bc5b1bd029c8e9b41e

SHA1
864cdc525ebfa681df26ade08dbf1339e682720f

SHA256
301e935c03974029b9ffb0eecfa7e5f3f55e0542582c11788a7b43de3f4bfc47

SHA512
d04ddc144accf77b1ff9b5766fdcb32269734ce152572266e9d7482e6880b724e112932728ec59d40aceb232d7705b95b4c76cab6c55dcfc198f537796eaad19

Download Submit
C:\Windows\system\FTPjcGN.exe

Filesize
1.4MB

MD5
4ae10da65299423b1ad1148fc7106523

SHA1
cb6390dd0cb9306109966fe2cfe81b7c0eccbdb2

SHA256
378aed6e327c76b4ae369475cff8227f7d7276151eeedc463eda99cd87a39551

SHA512
e5d57dad51cd1551846b7d9543db01694e4087e14a81a5f8e89cb318f7f7be9b456d4a5a758eaa7201cbfeba81ab5749efbb0d0ee3fe6111b0e484f617e6db25

Download Submit
C:\Windows\system\GIMIgJE.exe

Filesize
1.4MB

MD5
7e2eafc99d871a596731dcf125505911

SHA1
1385cbbc01ad46128d8c5e17e21074c329b4e10b

SHA256
0e78a7389aa67e92b8852407ae34275c3d1b1fde12856a04482b11203067e0b3

SHA512
87cc5c45d7345c08944f012dce84b2b086f45ecbfc3112adb6ff01879cdb3550c915922c8c285f2a48c3620e8639e5186198cd0f5b647aec6abbfa5f1e9fcbe3

Download Submit
C:\Windows\system\GTwzqJH.exe

Filesize
1.4MB

MD5
04a2bddb38782aaa10ed17c7786f948c

SHA1
2fc8970a4cbe3d03099ad5329184d0ffc1adb5e2

SHA256
31496e7894ff0e5ea2a2c50881ab818ca9938140ffbfd7cb021d9d1e6beb6d9c

SHA512
edc7347dada885e830ac89189f88fa4fc416eee699cfcd6fea66f09b7c5163ea06e371e9166ad9c985e0dc3eaaf9fb5db204b3a95c7b55d76984a92e066c5b8e

Download Submit
C:\Windows\system\ITOPkyr.exe

Filesize
1.4MB

MD5
2daca068cd76c3aebf94a63a973330e1

SHA1
ed37ec7ae56243f022e8ee2957b4420c68f3e1cd

SHA256
d3722be5ccad310c6e03924dec44624d00453d96ec7ce947a3642619ae1c0ed8

SHA512
65509caf3afe929f704fc54099e4434a2455b90ee1d94f6a27920fbb0eb7b0f200cd1b861338615697289bb8b31bf2ef2b80b5f44c7a0daa3414c9ef95ae1526

Download Submit
C:\Windows\system\Jhuoodx.exe

Filesize
1.4MB

MD5
0f56a298a34447689e1adb120a46e147

SHA1
1f9c4c0f0e15484d46286a36d366e4cb91d57c7c

SHA256
d0b1ed71b0da540180f4b0b1ab769041a47a575fde617e8f93e146a529b58012

SHA512
e6fe28955b258e2dab665af64fc76ba5a8da77651046e0e6dac941ffb1486ef541e2beae85532038778888f9288888df3fc4260796a78e6cb4367eff992e0454

Download Submit
C:\Windows\system\MXbpYCs.exe

Filesize
1.4MB

MD5
f96187707929dc435cb42cb0c049cb1c

SHA1
80288bcc6b19af4bdcc81944c5c362bcb183fb80

SHA256
556ab8de3034828ead872354f07e04418dfaecf5c77be85b283a5121828f441c

SHA512
12cb666d17e4cd2bb94b1674054978c5d09a97bc58020f26e754f228e71f02d8d4b6c7ebdfa9558a04eaf561f9db080249d68240c69bcbbbddd6472c05e775f5

Download Submit
C:\Windows\system\RKevyMi.exe

Filesize
1.4MB

MD5
39a131320e259e6649b958c0cf9fbe15

SHA1
bd00db335ed471e482b042584a8d69abd48c3425

SHA256
0ac21ee6ae18bd81c060fcb0837ff3a5725d8fc9deb1ceefb463ca3625282258

SHA512
5c6bfca3ede7e57478a8460b5d51b932b85a9c7618e1700dc33fdf19e63cdaa75edd588a7682bdbb24b0f41f2e86ce4d58a819fe59cc3e74a640c3893ac3d99f

Download Submit
C:\Windows\system\RaAMvQG.exe

Filesize
1.4MB

MD5
fa69a2e7f55684efef69a719be654fe5

SHA1
508f7a1d1b92b8fa46b056ffc8a62138f544d222

SHA256
ba99f46f9ab2d0bc049cd2e188880eb4591d312e6848f117d1209586525b4c66

SHA512
9bfc6467313d1dcad6d9072ca5c496d1c26041f416b5cd87cee8275cc2a129a2172270491674ffcb2d8de1a4a22c9b3f701ce6d4c2fd55a1f94b9074c1a8a724

Download Submit
C:\Windows\system\RfwlpYy.exe

Filesize
1.4MB

MD5
1f4cdb9401e30c8315a8bafa6cf2901e

SHA1
aeafe1e59093c2b782f11cbff5dad54add0e4f45

SHA256
051f10d45ff3e699348ff38361c83d9e10a282614926ba8e2f4cd906cd2a1d2f

SHA512
eb9db20731a4c39867841f3df84852b2e6f2dc6de549d8e66cb9fff7c47e8f1ff29d2c36a64d871bcbc062881ca3bbd7a8ffec9369f319f507c7eaf5e3a343ab

Download Submit
C:\Windows\system\WthRogC.exe

Filesize
1.4MB

MD5
d30371eff9d21bc9e6feb82e82ab31f1

SHA1
a9e971ca17f60f9b1cb90dd732127a037382a3cf

SHA256
dee1d139ee31ba1c467864bf69f3f1364f875715e36a05dda75a9e50b126513a

SHA512
df8b856dc174dfd9ccf4ffd04f0439e3feb59f00f4ad51c83ee23fce78e2ce49ede659629f617a4fcfd827d13fd87a118e2ead221be6626d8df1800fd0e228d4

Download Submit
C:\Windows\system\awQWJgC.exe

Filesize
1.4MB

MD5
085d70d708e958ebc774912c77d956f5

SHA1
bf5e5131474fa3fd71f0d13336b1dd9732577b38

SHA256
eda5e05636c336dfafec399e9b42b54c2e67e01421760a292e72541095ad6ff2

SHA512
70dee43ca06dff68639ea4d1c99642eb082494c920e9c8db7cb8ccea649b199a30a3bf523da4ce5abe619c63fdb38786a3f289fd7c5323dc41575c7358912fa9

Download Submit
C:\Windows\system\cUWzaMo.exe

Filesize
1.4MB

MD5
e46dcd60f4ca562faacc56c358592f61

SHA1
4f5af6ca992ec4f19a9ac2582e1bd559beae022a

SHA256
d17293113c3604e5bf38bb1655e4313a7ed4944e5f3e681f9c32e0aec7cf8aa0

SHA512
d1d3fe6f0801917fdd2a8ebbe2babe5d4964bc4dbee809585a6eb055d2a5c61f6ab9e9a84c27beeaf700627f78c378f275f50b28a9204441e6e05ba1e525831b

Download Submit
C:\Windows\system\dEPuBAk.exe

Filesize
1.4MB

MD5
f18ada940088c2f8364daac7c1c6ca15

SHA1
5f627ec6e1c945f0ca0545fa9bc1280e4b0433e3

SHA256
4ef484132d6b5df093d757133c31a46b70df3ffcceb068b7115c74e7b6d0bb93

SHA512
6503932f170e98a8efd9a4fd40a3aa882b022c8d98a7fd4facebe82a0a2100df5f0df61755fe9e2a5376f87ee1e95c541d0416bb1b1fff57da9649607f5d3ffe

Download Submit
C:\Windows\system\dPMEDge.exe

Filesize
1.4MB

MD5
8accb1658ab7f827333c8aef85c1b718

SHA1
07047f3549774b84a7411076eb00e0b2618bf066

SHA256
10758d6dd76e54cc4ca1696552f1c3af6724c91e42ae894296563392bc2d1fd4

SHA512
1773a41690932ffa35ec091999af910b618450cbe714b18339d72f6c2d357352d7f7ee43d3422cfbfe127883dd091ff595f8d63824ff9dfa4004b400e21947fa

Download Submit
C:\Windows\system\idDLFLY.exe

Filesize
1.4MB

MD5
8ea9e5d9bdf154b6b9e6b5a09e285db3

SHA1
003cdd77e77b15d59e81d4baceba29343e4feac3

SHA256
061ca9d0377663dd1ae39373f35f0faf123371bf59e6cd2d7d9fad5d44f3b63f

SHA512
19ddb95add6f52acd472cf4bb6f64be4e66d4897deb8bd9eacf1dd362a897d1208b7ff1464425844ccafdda7110b48d1642e63b1b29120ac9f5da03af80c7941

Download Submit
C:\Windows\system\jzXwdLA.exe

Filesize
1.4MB

MD5
45fb0a1bd536d73ea4604855f09af36c

SHA1
795cf21bd8eb5c683e0b94f1114fe7665224d36e

SHA256
4f84c399dd8b6b25b4d693d8ec06b7e09726ad8422922e7a5c7951574588078a

SHA512
f34e9d7d46eec0e8fb053e0b1937d39ce1f80e017117561773d52078abba97132e5262e23a1f32a8d5ef05965707d3f4943c414d53d513a4008f8067c8ef4b77

Download Submit
C:\Windows\system\qezHfKO.exe

Filesize
1.4MB

MD5
9c7241b5c0551311de093f1e6c1ec19f

SHA1
ba1459f8ac8e91182435800e95509b081bc7b964

SHA256
e4355e0c04df2c73f0dc87eaa1813eafd3fe0a3ea9e7617831771633e796b39b

SHA512
aae5c34d4f285576a6363952fb509b5c88a8610630b3558f3a1c1ca46f6fd2305c81b2b5666941d64561fde5cff471de3edaa81b9c9d431705d920e0188dc3bf

Download Submit
C:\Windows\system\umfYPqa.exe

Filesize
1.4MB

MD5
c3d9428cfb7b0211ffcd015061f48515

SHA1
90bc809a1e8dbd109e7adb531b354acdf91eac39

SHA256
4402ce49c4eee2615528f2b2b5c987d6d2040ecf48fbca0fc336e3c8f6a13c15

SHA512
2aa5e6a5441f1e881b1a646113526a3ca79fd907bdaf25d408338077325e9f76ed0ecb4ba9e0e29a7c3a7c05b20c3d34058ce147b9b125ffcae739bab9fc0e47

Download Submit
C:\Windows\system\vkvlgVx.exe

Filesize
1.4MB

MD5
246488b1bfe78d40448337cf03cb70f6

SHA1
aac3a1f312204be5ce13cc41ccec6218d78119d6

SHA256
9364b54da1fdd0887e8263da5fcf97530ca6cb14f92c8d8cf433de596049e8c5

SHA512
e955a5e136d45f633a0fcbc4a595c5e27e245f7395f0c4538aa1df0085b1f6d5d2fb6a34131e4d920c30a4b2b47acd25aa2d9fed0f0dc2614c3ff2220a3f6c4d

Download Submit
C:\Windows\system\wNNYIYr.exe

Filesize
1.4MB

MD5
2f46f611648f3f857556247817482e7f

SHA1
fa2e0e1e4193af3b0d00252b9684fbc735fa10e6

SHA256
8a369f55e1eab5ee9eb4930084aa40e5087caeffcd8d8cc46894952618e7a25e

SHA512
d394e97d4c7a23cd0983bd7085e6b1ae0ade7a06dff7dc597f0a897221b6092875ae980610ed8420989ab9148e729e5eec9406cc736c75353519b2ca5b3c0519

Download Submit
C:\Windows\system\wqdVJmS.exe

Filesize
18B

MD5
a308bab96af0d8b0405ced0df2e422de

SHA1
d1952ddc6ffadb32bc26dbd87f63673fe488019c

SHA256
8b1e86aaa211a5c5f8f89e89db4748f4041ce6a7eadabf706546f1da8a4c933b

SHA512
febe4ebe7f32e7b2ee0bea8360d9cfbd617f1e619f185f40ee924ced488e4b9c2a3a234ad49a740a246b10397b83d94709c1498bb18d2a41eaa09bad38561ccc

Download Submit
C:\Windows\system\xweDMDy.exe

Filesize
1.4MB

MD5
13e83b983a1ed8ba41376a2b453d4739

SHA1
97584fecc0f14f9821b8aedfda637514ac36dc8b

SHA256
038d2f96b2dafc247e458928ce4120884eb7b9407a4810b5413b163876daed2f

SHA512
36cc1094ce6a5f360420aa2651dd95efe64a408fae3c5db3d78b0df64099b1e84b6891305db2832c702436ab3b22f41fefbf7d7913ee33a702cde3b1bb5bb0b7

Download Submit
\Windows\system\HvWZCDJ.exe

Filesize
1.4MB

MD5
95f89e10e0c3eef158dbee7bd46e6452

SHA1
ad7077aa741d5c6709ca244f16521cde99350ecf

SHA256
6914e64c2c95c6a3a023fffe93f49e097035f5da2f7446a1a844ca4b82f08391

SHA512
1f47abf47019820e7ca04025c6af0964784e50bcd1e8dde6d08891ad9a61b3002027a439b7c9d40b8b59afabb10725f5a954829d658b0164694adb26ad777294

Download Submit
\Windows\system\RxJGbzP.exe

Filesize
1.4MB

MD5
3dc9a4b83fd1ad4d8eeab5d734831d5c

SHA1
d975205e8e17c8ea95b16cae0bea08160e40616c

SHA256
e85e0af93c8e833904c60c052d8e103941dede70e8e651a7b6e103d6143ee632

SHA512
6d9bd2bc8e55c2a8de7ff6bd176e16f0558ea604e73b254cd86926224b124af29296d9dcc64df0b0f1dc01c495a37e8ed9fcfbfa977b39a64701f77f3a69375f

Download Submit
\Windows\system\TYCtDNl.exe

Filesize
1.4MB

MD5
cd8f743fc5b92bfc99126e8c5e2f4d61

SHA1
a0a0c34d2d0b6567854c17c1872c8f60fb8d457a

SHA256
ac710a513543df4cbc3fad202fbe6ca1c2b8fcd1260a24660e9fa277a7280ad1

SHA512
55e1b686d8987f5ee4373692ddba299efb5cbb76cee58c0e3208cc8f16908103ad658aed8200064c4f6fcf6565fc8154f3ce25302ce1d7c70b285e2dc12d6e69

Download Submit
\Windows\system\elTsluQ.exe

Filesize
1.4MB

MD5
1a3e8eaac066d28f54a0767334fae72c

SHA1
ae93cae4cf0963c44ae1f75914da697a5c5e7740

SHA256
647e2b09b0e31f40955bd550be7d991fb8ad62ccadb80bf7b1bd3e862de19c33

SHA512
38cbf369391722ca28d1a4b745b53d4cae81d24933c7d7b09f901586466a2466c1d93f316d61074ac3417954ca4c04e7d57484d57985cd4a198f5a146de8f236

Download Submit
\Windows\system\kXXsKVt.exe

Filesize
1.4MB

MD5
a923654f96e5ffa5f128fb64ab873925

SHA1
47951c1778d675da7e0fb6f98149a0bc2c692ca9

SHA256
3743c3c35018ba3706d3d22e25b18d8bc78db3b8158e80a19b4d7a8d90fa8989

SHA512
becbc86dc16f3cef01332905e8f8c548cace070e8053c9efe63c273dfa7de9a4f75ccf5db0906572cfb3450ed14ddc78e69bc102d7078d105504b61f715cb48f

Download Submit
\Windows\system\konfumB.exe

Filesize
1.4MB

MD5
00987807a4388eb8590177e17fa29030

SHA1
253ac3a3e7500d939f8406d710f38b24ec463a44

SHA256
2444aefc1f9eb84b90cd86e36e770d4b15578e8940d0082bd2906e43d087d7f3

SHA512
9bfaac9757bb7fb3e6f05c5875c5167db98098bc2f40aec0f1e1149bc91cc222d84f317d7591b31ad0d6b01684c9d7c3bcb9be0e343e374b870bd3ba26306e9a

Download Submit
\Windows\system\mJMPVva.exe

Filesize
1.4MB

MD5
acffdba2f18be695e1e9ca7fe0b219d4

SHA1
051c646b91f643076f55d48af28da9cf80a5f22c

SHA256
9f35f693bafe1def23055051bc481383765605dcfe5999b5e82a64abdde906ac

SHA512
6571b009536174f6d4446b1c0c76019891d64962c6cb16834008704421a8d72012f81104efa39bc58a5c6753196f6ef993f9e6d5b0ab966521af1acd2526394a

Download Submit
\Windows\system\skqudqC.exe

Filesize
1.4MB

MD5
605c3e2df7cc70f96d42c30fa602ad68

SHA1
79bd4277ea66d8f82d6d19fa582708674d938bf9

SHA256
b577d4e5e42aac2a93e7c63880401e39572aa58e18e1b839e4a52ba423314d38

SHA512
0c06e9c320058ad4f7d7a1730d8e73da1498273d46fbc0244c4e259f241e27ea6f7c0fbfab58a7a068b4ded00b43ff372a1b44f5b7cae6668030cadc654cd781

Download Submit
memory/860-6540-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/860-20-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-6539-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-111-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-135-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2472-124-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-128-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2604-120-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-122-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2704-116-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2704-6576-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2732-129-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2732-134-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2732-117-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2732-119-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-115-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2732-139-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-1-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-112-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2732-121-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2732-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2732-15-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-123-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2732-8-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-125-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2756-118-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2776-9-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-619-0x000007FEF5590000-0x000007FEF5F2D000-memory.dmp

Filesize
9.6MB

Download
memory/2896-138-0x000007FEF5590000-0x000007FEF5F2D000-memory.dmp

Filesize
9.6MB

Download
memory/2896-22-0x000007FEF584E000-0x000007FEF584F000-memory.dmp

Filesize
4KB

Download
memory/2896-109-0x000007FEF5590000-0x000007FEF5F2D000-memory.dmp

Filesize
9.6MB

Download
memory/2896-110-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2896-21-0x0000000002880000-0x0000000002900000-memory.dmp

Filesize
512KB

Download
memory/2896-114-0x0000000002850000-0x0000000002858000-memory.dmp

Filesize
32KB

Download
memory/2948-113-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-6615-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-132-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download