xmrig | 3c6b09f8c486c812cd4c77f4a30660aab7a1b8d0dd93b6377037357eba86bb25

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
Size

1.3MB
MD5

1fb57d036bbee6902c17193afe015ed3
SHA1

b99aee472efadc0c4528813c540a960906bc3692
SHA256

3c6b09f8c486c812cd4c77f4a30660aab7a1b8d0dd93b6377037357eba86bb25
SHA512

ab19e6ab5e2bd0fe59cfbf0078ce5f0d53e7dabbbd9545e09e55c2323fed0171cf14c4607c4bf515565fbcc135cc3749f35029e97cca00a4cb4cd81bf291937c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vxf:Lz071uv4BPMkibTIA5CJB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/1540-1-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2952-13-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/1540-109-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2368-108-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2780-106-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2428-104-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2348-102-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2400-100-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2856-97-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2624-95-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2600-93-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/856-116-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2244-114-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2500-87-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/1540-4007-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2952-4009-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2500-4012-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2600-4013-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2348-4021-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2624-4020-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2400-4017-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2856-4016-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2428-4025-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2244-4029-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2368-4028-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2780-4024-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/856-4031-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2196	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2952	OiAiNfT.exe
2500	PgXfCDF.exe
2600	gRfnGNJ.exe
2624	kNLRNjD.exe
2856	FUFQheu.exe
2400	tLaijZf.exe
2348	MKWZexC.exe
2428	ORWPKUx.exe
2780	lgSXVUY.exe
2368	TtboauN.exe
2244	nsBUkoX.exe
856	qxjVtGs.exe
348	worGFvV.exe
2636	KmEiiAf.exe
760	dEDCzDi.exe
2124	vCutGCC.exe
1564	LSeCjwg.exe
2812	uKkqjDW.exe
1232	skgZhFK.exe
1976	gSKdQUA.exe
1508	hhnLaaS.exe
656	WDlwgQv.exe
812	CctrfNn.exe
1300	TbctGqi.exe
3028	ZKpIxQg.exe
1848	QygqlIX.exe
1888	YFRFsUi.exe
268	nGhDidv.exe
1476	rmxGXFr.exe
1776	iqkulvz.exe
2304	xJAAGdT.exe
2528	sSEBNnZ.exe
552	SuHOUBv.exe
1620	jUwnbIJ.exe
1516	gGbrdOx.exe
1304	SBGFUlw.exe
1292	qDGvYzG.exe
2756	JxmpDJV.exe
2852	mbSZSiQ.exe
2844	DqUmame.exe
904	rCYdtfA.exe
932	NmcBnrM.exe
2976	dwRTEov.exe
1056	dzVANYN.exe
2228	tnztWdA.exe
1572	XXCFoZE.exe
1940	ghshgKu.exe
564	SDptJrq.exe
1148	lPPQTCq.exe
2840	gORKmbQ.exe
3048	DqRAUiq.exe
1428	BIcWYpJ.exe
2220	ErWbzYH.exe
1996	aQZEANv.exe
1928	SaoxbDN.exe
2696	PQDInJT.exe
1532	hjNtCdi.exe
2832	jsEMHFU.exe
2560	qycTGEA.exe
2456	fgwZHKQ.exe
2672	WUVaahb.exe
2352	otVpyoo.exe
2192	hTsHALw.exe
2340	uQWuYww.exe

Loads dropped DLL 64 IoCs

pid	Process
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1540-1-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0010000000014dae-5.dat	upx
behavioral1/memory/2952-13-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0030000000016cb2-19.dat	upx
behavioral1/files/0x001800000000558a-23.dat	upx
behavioral1/files/0x0008000000016d16-25.dat	upx
behavioral1/files/0x0007000000016d1f-34.dat	upx
behavioral1/files/0x0007000000016d32-38.dat	upx
behavioral1/files/0x000a000000016d36-44.dat	upx
behavioral1/files/0x0007000000016d9f-48.dat	upx
behavioral1/files/0x00050000000186c1-58.dat	upx
behavioral1/files/0x00050000000186d3-63.dat	upx
behavioral1/files/0x000500000001874c-78.dat	upx
behavioral1/files/0x00050000000193e2-165.dat	upx
behavioral1/files/0x0005000000019417-185.dat	upx
behavioral1/files/0x00050000000193f4-168.dat	upx
behavioral1/files/0x000500000001935b-164.dat	upx
behavioral1/files/0x000500000001936e-160.dat	upx
behavioral1/files/0x000500000001934a-154.dat	upx
behavioral1/files/0x0005000000019254-146.dat	upx
behavioral1/files/0x0005000000019235-138.dat	upx
behavioral1/files/0x0005000000019233-131.dat	upx
behavioral1/files/0x0005000000019413-175.dat	upx
behavioral1/files/0x00050000000191eb-122.dat	upx
behavioral1/files/0x0005000000019223-119.dat	upx
behavioral1/memory/2368-108-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2780-106-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0005000000019331-153.dat	upx
behavioral1/memory/2428-104-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2348-102-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2400-100-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2856-97-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2624-95-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2600-93-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/files/0x0005000000019248-144.dat	upx
behavioral1/files/0x0030000000016ce4-136.dat	upx
behavioral1/files/0x0005000000019227-125.dat	upx
behavioral1/memory/856-116-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2244-114-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x00050000000191ed-113.dat	upx
behavioral1/memory/2500-87-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x0006000000018bba-83.dat	upx
behavioral1/files/0x0005000000018700-68.dat	upx
behavioral1/files/0x000500000001874a-73.dat	upx
behavioral1/files/0x000500000001865a-53.dat	upx
behavioral1/memory/1540-4007-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2952-4009-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2500-4012-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2600-4013-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2348-4021-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2624-4020-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2400-4017-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2856-4016-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2428-4025-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2244-4029-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2368-4028-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2780-4024-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/856-4031-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AZdooru.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\rUrIGlg.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\rTSoulu.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\TNlBQJx.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\FoFfYCz.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\PxdfZkW.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\VFOvboc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\lChwFEr.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\nnqTEON.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\uVrkkQk.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\gKwWhxT.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\dnxtZbW.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\gORKmbQ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\aqraGJW.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\lPPQTCq.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\rUszIOc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\GBfRJhM.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\JnDWIpC.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\vnqykMm.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\mMGAHvE.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\LCgIPQt.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\KSBGQqa.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\JeCpeWK.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\SLvpHjZ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\FYtUOdR.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\UlFOzpC.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\XXBBYiQ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\QmvIXFQ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\xAxUWjv.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\UQirZfU.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\eqnVQjT.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\ySIwRZV.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\iiekvZB.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\nEvQATm.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\klGOGLu.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\RMLhIUI.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\QMHBDfC.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\KyrWEbe.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\NlpPiFP.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\oTEpIwp.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\dEDCzDi.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\bXyysZk.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\NyINcow.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\NWjGJlp.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\mxmjsCd.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\wDbgLsu.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\eNhcKrc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\tterMeZ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\DuXqsgS.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\VWcvENx.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\MpeFLaM.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\pguTBqI.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\YionaIv.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\uJVHhQc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\XZPJWBJ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\qvzCdXd.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\CYoiAIe.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\VZospKJ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\nsBUkoX.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\EfULvtD.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\uWvawzP.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\DAPOvoW.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\rOONkQu.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\RiXSIsJ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2196	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	29
PID 1540 wrote to memory of 2196	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	29
PID 1540 wrote to memory of 2196	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	29
PID 1540 wrote to memory of 2952	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	30
PID 1540 wrote to memory of 2952	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	30
PID 1540 wrote to memory of 2952	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	30
PID 1540 wrote to memory of 2500	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	31
PID 1540 wrote to memory of 2500	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	31
PID 1540 wrote to memory of 2500	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	31
PID 1540 wrote to memory of 2600	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	32
PID 1540 wrote to memory of 2600	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	32
PID 1540 wrote to memory of 2600	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	32
PID 1540 wrote to memory of 2624	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	33
PID 1540 wrote to memory of 2624	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	33
PID 1540 wrote to memory of 2624	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	33
PID 1540 wrote to memory of 2856	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	34
PID 1540 wrote to memory of 2856	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	34
PID 1540 wrote to memory of 2856	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	34
PID 1540 wrote to memory of 2400	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	35
PID 1540 wrote to memory of 2400	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	35
PID 1540 wrote to memory of 2400	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	35
PID 1540 wrote to memory of 2348	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	36
PID 1540 wrote to memory of 2348	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	36
PID 1540 wrote to memory of 2348	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	36
PID 1540 wrote to memory of 2428	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	37
PID 1540 wrote to memory of 2428	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	37
PID 1540 wrote to memory of 2428	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	37
PID 1540 wrote to memory of 2780	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	38
PID 1540 wrote to memory of 2780	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	38
PID 1540 wrote to memory of 2780	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	38
PID 1540 wrote to memory of 2368	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	39
PID 1540 wrote to memory of 2368	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	39
PID 1540 wrote to memory of 2368	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	39
PID 1540 wrote to memory of 2244	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	40
PID 1540 wrote to memory of 2244	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	40
PID 1540 wrote to memory of 2244	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	40
PID 1540 wrote to memory of 856	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	41
PID 1540 wrote to memory of 856	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	41
PID 1540 wrote to memory of 856	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	41
PID 1540 wrote to memory of 348	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	42
PID 1540 wrote to memory of 348	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	42
PID 1540 wrote to memory of 348	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	42
PID 1540 wrote to memory of 2636	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	43
PID 1540 wrote to memory of 2636	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	43
PID 1540 wrote to memory of 2636	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	43
PID 1540 wrote to memory of 760	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	44
PID 1540 wrote to memory of 760	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	44
PID 1540 wrote to memory of 760	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	44
PID 1540 wrote to memory of 1564	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	45
PID 1540 wrote to memory of 1564	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	45
PID 1540 wrote to memory of 1564	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	45
PID 1540 wrote to memory of 2124	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	46
PID 1540 wrote to memory of 2124	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	46
PID 1540 wrote to memory of 2124	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	46
PID 1540 wrote to memory of 1232	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	47
PID 1540 wrote to memory of 1232	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	47
PID 1540 wrote to memory of 1232	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	47
PID 1540 wrote to memory of 2812	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	48
PID 1540 wrote to memory of 2812	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	48
PID 1540 wrote to memory of 2812	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	48
PID 1540 wrote to memory of 1848	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	49
PID 1540 wrote to memory of 1848	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	49
PID 1540 wrote to memory of 1848	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	49
PID 1540 wrote to memory of 1976	1540	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System\OiAiNfT.exe
  C:\Windows\System\OiAiNfT.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\PgXfCDF.exe
  C:\Windows\System\PgXfCDF.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\gRfnGNJ.exe
  C:\Windows\System\gRfnGNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\kNLRNjD.exe
  C:\Windows\System\kNLRNjD.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\FUFQheu.exe
  C:\Windows\System\FUFQheu.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\tLaijZf.exe
  C:\Windows\System\tLaijZf.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\MKWZexC.exe
  C:\Windows\System\MKWZexC.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ORWPKUx.exe
  C:\Windows\System\ORWPKUx.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\lgSXVUY.exe
  C:\Windows\System\lgSXVUY.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\TtboauN.exe
  C:\Windows\System\TtboauN.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\nsBUkoX.exe
  C:\Windows\System\nsBUkoX.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\qxjVtGs.exe
  C:\Windows\System\qxjVtGs.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\worGFvV.exe
  C:\Windows\System\worGFvV.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\KmEiiAf.exe
  C:\Windows\System\KmEiiAf.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\dEDCzDi.exe
  C:\Windows\System\dEDCzDi.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\LSeCjwg.exe
  C:\Windows\System\LSeCjwg.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\vCutGCC.exe
  C:\Windows\System\vCutGCC.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\skgZhFK.exe
  C:\Windows\System\skgZhFK.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\uKkqjDW.exe
  C:\Windows\System\uKkqjDW.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QygqlIX.exe
  C:\Windows\System\QygqlIX.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\gSKdQUA.exe
  C:\Windows\System\gSKdQUA.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\YFRFsUi.exe
  C:\Windows\System\YFRFsUi.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\hhnLaaS.exe
  C:\Windows\System\hhnLaaS.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\nGhDidv.exe
  C:\Windows\System\nGhDidv.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\WDlwgQv.exe
  C:\Windows\System\WDlwgQv.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\rmxGXFr.exe
  C:\Windows\System\rmxGXFr.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\CctrfNn.exe
  C:\Windows\System\CctrfNn.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\iqkulvz.exe
  C:\Windows\System\iqkulvz.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\TbctGqi.exe
  C:\Windows\System\TbctGqi.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\xJAAGdT.exe
  C:\Windows\System\xJAAGdT.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\ZKpIxQg.exe
  C:\Windows\System\ZKpIxQg.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\sSEBNnZ.exe
  C:\Windows\System\sSEBNnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\SuHOUBv.exe
  C:\Windows\System\SuHOUBv.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\jUwnbIJ.exe
  C:\Windows\System\jUwnbIJ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\gGbrdOx.exe
  C:\Windows\System\gGbrdOx.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\SBGFUlw.exe
  C:\Windows\System\SBGFUlw.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\qDGvYzG.exe
  C:\Windows\System\qDGvYzG.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\JxmpDJV.exe
  C:\Windows\System\JxmpDJV.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\mbSZSiQ.exe
  C:\Windows\System\mbSZSiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\DqUmame.exe
  C:\Windows\System\DqUmame.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\rCYdtfA.exe
  C:\Windows\System\rCYdtfA.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\NmcBnrM.exe
  C:\Windows\System\NmcBnrM.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\dwRTEov.exe
  C:\Windows\System\dwRTEov.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\dzVANYN.exe
  C:\Windows\System\dzVANYN.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\tnztWdA.exe
  C:\Windows\System\tnztWdA.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\XXCFoZE.exe
  C:\Windows\System\XXCFoZE.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\ghshgKu.exe
  C:\Windows\System\ghshgKu.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\SDptJrq.exe
  C:\Windows\System\SDptJrq.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\lPPQTCq.exe
  C:\Windows\System\lPPQTCq.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\gORKmbQ.exe
  C:\Windows\System\gORKmbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\DqRAUiq.exe
  C:\Windows\System\DqRAUiq.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\BIcWYpJ.exe
  C:\Windows\System\BIcWYpJ.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\ErWbzYH.exe
  C:\Windows\System\ErWbzYH.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\aQZEANv.exe
  C:\Windows\System\aQZEANv.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\SaoxbDN.exe
  C:\Windows\System\SaoxbDN.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\PQDInJT.exe
  C:\Windows\System\PQDInJT.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\hjNtCdi.exe
  C:\Windows\System\hjNtCdi.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\jsEMHFU.exe
  C:\Windows\System\jsEMHFU.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\qycTGEA.exe
  C:\Windows\System\qycTGEA.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\eBBBznj.exe
  C:\Windows\System\eBBBznj.exe
  2⤵
  PID:1924
- C:\Windows\System\fgwZHKQ.exe
  C:\Windows\System\fgwZHKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\JOPQQWg.exe
  C:\Windows\System\JOPQQWg.exe
  2⤵
  PID:2504
- C:\Windows\System\WUVaahb.exe
  C:\Windows\System\WUVaahb.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ryjXXeZ.exe
  C:\Windows\System\ryjXXeZ.exe
  2⤵
  PID:2516
- C:\Windows\System\otVpyoo.exe
  C:\Windows\System\otVpyoo.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\zkheVJY.exe
  C:\Windows\System\zkheVJY.exe
  2⤵
  PID:2776
- C:\Windows\System\hTsHALw.exe
  C:\Windows\System\hTsHALw.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\RFLHPHF.exe
  C:\Windows\System\RFLHPHF.exe
  2⤵
  PID:2316
- C:\Windows\System\uQWuYww.exe
  C:\Windows\System\uQWuYww.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\yfHknpT.exe
  C:\Windows\System\yfHknpT.exe
  2⤵
  PID:1712
- C:\Windows\System\BOnaOay.exe
  C:\Windows\System\BOnaOay.exe
  2⤵
  PID:1512
- C:\Windows\System\JUMzPbc.exe
  C:\Windows\System\JUMzPbc.exe
  2⤵
  PID:2020
- C:\Windows\System\cZxSDvZ.exe
  C:\Windows\System\cZxSDvZ.exe
  2⤵
  PID:740
- C:\Windows\System\BTGikJz.exe
  C:\Windows\System\BTGikJz.exe
  2⤵
  PID:1736
- C:\Windows\System\LchEdEF.exe
  C:\Windows\System\LchEdEF.exe
  2⤵
  PID:3004
- C:\Windows\System\gbwhhta.exe
  C:\Windows\System\gbwhhta.exe
  2⤵
  PID:1480
- C:\Windows\System\SKvHdXF.exe
  C:\Windows\System\SKvHdXF.exe
  2⤵
  PID:1784
- C:\Windows\System\rZikUMa.exe
  C:\Windows\System\rZikUMa.exe
  2⤵
  PID:896
- C:\Windows\System\pXgpMMF.exe
  C:\Windows\System\pXgpMMF.exe
  2⤵
  PID:912
- C:\Windows\System\KyekVfM.exe
  C:\Windows\System\KyekVfM.exe
  2⤵
  PID:684
- C:\Windows\System\zibsnAY.exe
  C:\Windows\System\zibsnAY.exe
  2⤵
  PID:2120
- C:\Windows\System\BeEMckY.exe
  C:\Windows\System\BeEMckY.exe
  2⤵
  PID:1832
- C:\Windows\System\frVkOIu.exe
  C:\Windows\System\frVkOIu.exe
  2⤵
  PID:2148
- C:\Windows\System\KIsiFwJ.exe
  C:\Windows\System\KIsiFwJ.exe
  2⤵
  PID:2480
- C:\Windows\System\JOcCNGl.exe
  C:\Windows\System\JOcCNGl.exe
  2⤵
  PID:2592
- C:\Windows\System\ztJTegD.exe
  C:\Windows\System\ztJTegD.exe
  2⤵
  PID:2588
- C:\Windows\System\JGtOhRN.exe
  C:\Windows\System\JGtOhRN.exe
  2⤵
  PID:1740
- C:\Windows\System\jiVnbpa.exe
  C:\Windows\System\jiVnbpa.exe
  2⤵
  PID:2036
- C:\Windows\System\VRvkcMr.exe
  C:\Windows\System\VRvkcMr.exe
  2⤵
  PID:2828
- C:\Windows\System\vBOtVvS.exe
  C:\Windows\System\vBOtVvS.exe
  2⤵
  PID:2888
- C:\Windows\System\juYUIIV.exe
  C:\Windows\System\juYUIIV.exe
  2⤵
  PID:1588
- C:\Windows\System\YionaIv.exe
  C:\Windows\System\YionaIv.exe
  2⤵
  PID:2572
- C:\Windows\System\uWJXKsK.exe
  C:\Windows\System\uWJXKsK.exe
  2⤵
  PID:1728
- C:\Windows\System\BZBuOrh.exe
  C:\Windows\System\BZBuOrh.exe
  2⤵
  PID:2716
- C:\Windows\System\ExUbLCr.exe
  C:\Windows\System\ExUbLCr.exe
  2⤵
  PID:1720
- C:\Windows\System\EKMumvv.exe
  C:\Windows\System\EKMumvv.exe
  2⤵
  PID:2272
- C:\Windows\System\sAEuguN.exe
  C:\Windows\System\sAEuguN.exe
  2⤵
  PID:2868
- C:\Windows\System\vdSUCWZ.exe
  C:\Windows\System\vdSUCWZ.exe
  2⤵
  PID:2556
- C:\Windows\System\ObYlggl.exe
  C:\Windows\System\ObYlggl.exe
  2⤵
  PID:2820
- C:\Windows\System\bgZkCtv.exe
  C:\Windows\System\bgZkCtv.exe
  2⤵
  PID:2596
- C:\Windows\System\lsmSlgw.exe
  C:\Windows\System\lsmSlgw.exe
  2⤵
  PID:1456
- C:\Windows\System\wQWZzUB.exe
  C:\Windows\System\wQWZzUB.exe
  2⤵
  PID:2388
- C:\Windows\System\YvNuBxT.exe
  C:\Windows\System\YvNuBxT.exe
  2⤵
  PID:1404
- C:\Windows\System\CdXsgeS.exe
  C:\Windows\System\CdXsgeS.exe
  2⤵
  PID:2448
- C:\Windows\System\XrYHGPI.exe
  C:\Windows\System\XrYHGPI.exe
  2⤵
  PID:1700
- C:\Windows\System\mtVPUpR.exe
  C:\Windows\System\mtVPUpR.exe
  2⤵
  PID:1616
- C:\Windows\System\HadvzAx.exe
  C:\Windows\System\HadvzAx.exe
  2⤵
  PID:1956
- C:\Windows\System\MCzUXRG.exe
  C:\Windows\System\MCzUXRG.exe
  2⤵
  PID:2084
- C:\Windows\System\egUAMCd.exe
  C:\Windows\System\egUAMCd.exe
  2⤵
  PID:1264
- C:\Windows\System\FfISsXS.exe
  C:\Windows\System\FfISsXS.exe
  2⤵
  PID:2324
- C:\Windows\System\vaYuZTN.exe
  C:\Windows\System\vaYuZTN.exe
  2⤵
  PID:2440
- C:\Windows\System\wdsPttl.exe
  C:\Windows\System\wdsPttl.exe
  2⤵
  PID:2784
- C:\Windows\System\JiCstEB.exe
  C:\Windows\System\JiCstEB.exe
  2⤵
  PID:1356
- C:\Windows\System\pDJodfA.exe
  C:\Windows\System\pDJodfA.exe
  2⤵
  PID:2796
- C:\Windows\System\kxWkdEk.exe
  C:\Windows\System\kxWkdEk.exe
  2⤵
  PID:536
- C:\Windows\System\HlwzdMH.exe
  C:\Windows\System\HlwzdMH.exe
  2⤵
  PID:2128
- C:\Windows\System\jNrNHmb.exe
  C:\Windows\System\jNrNHmb.exe
  2⤵
  PID:1324
- C:\Windows\System\YftnmGB.exe
  C:\Windows\System\YftnmGB.exe
  2⤵
  PID:1416
- C:\Windows\System\LYEKHsK.exe
  C:\Windows\System\LYEKHsK.exe
  2⤵
  PID:2296
- C:\Windows\System\UwHahGT.exe
  C:\Windows\System\UwHahGT.exe
  2⤵
  PID:1612
- C:\Windows\System\RCNcBvs.exe
  C:\Windows\System\RCNcBvs.exe
  2⤵
  PID:2648
- C:\Windows\System\CdTwhdq.exe
  C:\Windows\System\CdTwhdq.exe
  2⤵
  PID:2544
- C:\Windows\System\JeCpeWK.exe
  C:\Windows\System\JeCpeWK.exe
  2⤵
  PID:880
- C:\Windows\System\xyLRmuh.exe
  C:\Windows\System\xyLRmuh.exe
  2⤵
  PID:1072
- C:\Windows\System\mumRJAx.exe
  C:\Windows\System\mumRJAx.exe
  2⤵
  PID:2356
- C:\Windows\System\aHRmWeN.exe
  C:\Windows\System\aHRmWeN.exe
  2⤵
  PID:788
- C:\Windows\System\PxlzwCA.exe
  C:\Windows\System\PxlzwCA.exe
  2⤵
  PID:836
- C:\Windows\System\UshUKRD.exe
  C:\Windows\System\UshUKRD.exe
  2⤵
  PID:872
- C:\Windows\System\FHVyaVy.exe
  C:\Windows\System\FHVyaVy.exe
  2⤵
  PID:1896
- C:\Windows\System\gFUJusN.exe
  C:\Windows\System\gFUJusN.exe
  2⤵
  PID:2424
- C:\Windows\System\zzmnHqd.exe
  C:\Windows\System\zzmnHqd.exe
  2⤵
  PID:2608
- C:\Windows\System\FemLhDZ.exe
  C:\Windows\System\FemLhDZ.exe
  2⤵
  PID:2664
- C:\Windows\System\HbdclQR.exe
  C:\Windows\System\HbdclQR.exe
  2⤵
  PID:1724
- C:\Windows\System\hQHlAMQ.exe
  C:\Windows\System\hQHlAMQ.exe
  2⤵
  PID:1892
- C:\Windows\System\YPEuizb.exe
  C:\Windows\System\YPEuizb.exe
  2⤵
  PID:2984
- C:\Windows\System\xjPzqMa.exe
  C:\Windows\System\xjPzqMa.exe
  2⤵
  PID:1104
- C:\Windows\System\FHikWVA.exe
  C:\Windows\System\FHikWVA.exe
  2⤵
  PID:2080
- C:\Windows\System\YglRoyU.exe
  C:\Windows\System\YglRoyU.exe
  2⤵
  PID:1548
- C:\Windows\System\mTXBgza.exe
  C:\Windows\System\mTXBgza.exe
  2⤵
  PID:984
- C:\Windows\System\VrzIYop.exe
  C:\Windows\System\VrzIYop.exe
  2⤵
  PID:1884
- C:\Windows\System\rbRlgJc.exe
  C:\Windows\System\rbRlgJc.exe
  2⤵
  PID:1256
- C:\Windows\System\eKWRuDv.exe
  C:\Windows\System\eKWRuDv.exe
  2⤵
  PID:768
- C:\Windows\System\znYcYsE.exe
  C:\Windows\System\znYcYsE.exe
  2⤵
  PID:2740
- C:\Windows\System\qBbOdNv.exe
  C:\Windows\System\qBbOdNv.exe
  2⤵
  PID:1684
- C:\Windows\System\ukCQNSs.exe
  C:\Windows\System\ukCQNSs.exe
  2⤵
  PID:680
- C:\Windows\System\nPcYwpJ.exe
  C:\Windows\System\nPcYwpJ.exe
  2⤵
  PID:2452
- C:\Windows\System\zCuibfe.exe
  C:\Windows\System\zCuibfe.exe
  2⤵
  PID:1012
- C:\Windows\System\XwgMODj.exe
  C:\Windows\System\XwgMODj.exe
  2⤵
  PID:2140
- C:\Windows\System\KdLUkKx.exe
  C:\Windows\System\KdLUkKx.exe
  2⤵
  PID:1212
- C:\Windows\System\suIQgpR.exe
  C:\Windows\System\suIQgpR.exe
  2⤵
  PID:2944
- C:\Windows\System\gZhuvkg.exe
  C:\Windows\System\gZhuvkg.exe
  2⤵
  PID:2924
- C:\Windows\System\IqRXJvr.exe
  C:\Windows\System\IqRXJvr.exe
  2⤵
  PID:2004
- C:\Windows\System\GNMWlEo.exe
  C:\Windows\System\GNMWlEo.exe
  2⤵
  PID:1640
- C:\Windows\System\scoBimQ.exe
  C:\Windows\System\scoBimQ.exe
  2⤵
  PID:2992
- C:\Windows\System\lnRWzZv.exe
  C:\Windows\System\lnRWzZv.exe
  2⤵
  PID:2728
- C:\Windows\System\MHcucRV.exe
  C:\Windows\System\MHcucRV.exe
  2⤵
  PID:2408
- C:\Windows\System\ZwIhsfl.exe
  C:\Windows\System\ZwIhsfl.exe
  2⤵
  PID:916
- C:\Windows\System\nIyryos.exe
  C:\Windows\System\nIyryos.exe
  2⤵
  PID:1676
- C:\Windows\System\AhvZNTE.exe
  C:\Windows\System\AhvZNTE.exe
  2⤵
  PID:1636
- C:\Windows\System\nNuEEpB.exe
  C:\Windows\System\nNuEEpB.exe
  2⤵
  PID:1668
- C:\Windows\System\XBElRrv.exe
  C:\Windows\System\XBElRrv.exe
  2⤵
  PID:1652
- C:\Windows\System\IQCKAbc.exe
  C:\Windows\System\IQCKAbc.exe
  2⤵
  PID:2308
- C:\Windows\System\UIzIpdV.exe
  C:\Windows\System\UIzIpdV.exe
  2⤵
  PID:2508
- C:\Windows\System\KkcKIpT.exe
  C:\Windows\System\KkcKIpT.exe
  2⤵
  PID:2744
- C:\Windows\System\YVbhBvI.exe
  C:\Windows\System\YVbhBvI.exe
  2⤵
  PID:1064
- C:\Windows\System\CDabcYr.exe
  C:\Windows\System\CDabcYr.exe
  2⤵
  PID:2136
- C:\Windows\System\whEpHoX.exe
  C:\Windows\System\whEpHoX.exe
  2⤵
  PID:2160
- C:\Windows\System\CgKXoDu.exe
  C:\Windows\System\CgKXoDu.exe
  2⤵
  PID:2496
- C:\Windows\System\SLvpHjZ.exe
  C:\Windows\System\SLvpHjZ.exe
  2⤵
  PID:2052
- C:\Windows\System\DAPOvoW.exe
  C:\Windows\System\DAPOvoW.exe
  2⤵
  PID:1528
- C:\Windows\System\NDZwZJh.exe
  C:\Windows\System\NDZwZJh.exe
  2⤵
  PID:2612
- C:\Windows\System\ybUGUSU.exe
  C:\Windows\System\ybUGUSU.exe
  2⤵
  PID:2392
- C:\Windows\System\Axutosu.exe
  C:\Windows\System\Axutosu.exe
  2⤵
  PID:400
- C:\Windows\System\FZWGotx.exe
  C:\Windows\System\FZWGotx.exe
  2⤵
  PID:1576
- C:\Windows\System\QpTmKPW.exe
  C:\Windows\System\QpTmKPW.exe
  2⤵
  PID:832
- C:\Windows\System\ByTOlek.exe
  C:\Windows\System\ByTOlek.exe
  2⤵
  PID:296
- C:\Windows\System\PnBCzWh.exe
  C:\Windows\System\PnBCzWh.exe
  2⤵
  PID:1184
- C:\Windows\System\vQiujhT.exe
  C:\Windows\System\vQiujhT.exe
  2⤵
  PID:1216
- C:\Windows\System\VFgZHgl.exe
  C:\Windows\System\VFgZHgl.exe
  2⤵
  PID:1036
- C:\Windows\System\WkUmGDK.exe
  C:\Windows\System\WkUmGDK.exe
  2⤵
  PID:320
- C:\Windows\System\qKQXuRa.exe
  C:\Windows\System\qKQXuRa.exe
  2⤵
  PID:1836
- C:\Windows\System\gjbFAiY.exe
  C:\Windows\System\gjbFAiY.exe
  2⤵
  PID:1448
- C:\Windows\System\bXyysZk.exe
  C:\Windows\System\bXyysZk.exe
  2⤵
  PID:2072
- C:\Windows\System\IYscsNO.exe
  C:\Windows\System\IYscsNO.exe
  2⤵
  PID:2284
- C:\Windows\System\rOISwsH.exe
  C:\Windows\System\rOISwsH.exe
  2⤵
  PID:2848
- C:\Windows\System\ZSAgZzH.exe
  C:\Windows\System\ZSAgZzH.exe
  2⤵
  PID:3088
- C:\Windows\System\NBhXEps.exe
  C:\Windows\System\NBhXEps.exe
  2⤵
  PID:3104
- C:\Windows\System\KUAzuNB.exe
  C:\Windows\System\KUAzuNB.exe
  2⤵
  PID:3128
- C:\Windows\System\lbpZAoq.exe
  C:\Windows\System\lbpZAoq.exe
  2⤵
  PID:3144
- C:\Windows\System\JnDWIpC.exe
  C:\Windows\System\JnDWIpC.exe
  2⤵
  PID:3164
- C:\Windows\System\DFbquPB.exe
  C:\Windows\System\DFbquPB.exe
  2⤵
  PID:3180
- C:\Windows\System\lxBGAdh.exe
  C:\Windows\System\lxBGAdh.exe
  2⤵
  PID:3196
- C:\Windows\System\ruRebdp.exe
  C:\Windows\System\ruRebdp.exe
  2⤵
  PID:3212
- C:\Windows\System\kgdWJhi.exe
  C:\Windows\System\kgdWJhi.exe
  2⤵
  PID:3228
- C:\Windows\System\RkVQZbq.exe
  C:\Windows\System\RkVQZbq.exe
  2⤵
  PID:3248
- C:\Windows\System\Ilgjzbl.exe
  C:\Windows\System\Ilgjzbl.exe
  2⤵
  PID:3284
- C:\Windows\System\VWcvENx.exe
  C:\Windows\System\VWcvENx.exe
  2⤵
  PID:3304
- C:\Windows\System\RDvkZPi.exe
  C:\Windows\System\RDvkZPi.exe
  2⤵
  PID:3320
- C:\Windows\System\JyYdzwp.exe
  C:\Windows\System\JyYdzwp.exe
  2⤵
  PID:3336
- C:\Windows\System\hWHQXOv.exe
  C:\Windows\System\hWHQXOv.exe
  2⤵
  PID:3352
- C:\Windows\System\dvnxNOP.exe
  C:\Windows\System\dvnxNOP.exe
  2⤵
  PID:3368
- C:\Windows\System\PZOAqkU.exe
  C:\Windows\System\PZOAqkU.exe
  2⤵
  PID:3384
- C:\Windows\System\KyrWEbe.exe
  C:\Windows\System\KyrWEbe.exe
  2⤵
  PID:3400
- C:\Windows\System\YZmFYvZ.exe
  C:\Windows\System\YZmFYvZ.exe
  2⤵
  PID:3416
- C:\Windows\System\hbYvFUr.exe
  C:\Windows\System\hbYvFUr.exe
  2⤵
  PID:3432
- C:\Windows\System\XVVwMfA.exe
  C:\Windows\System\XVVwMfA.exe
  2⤵
  PID:3452
- C:\Windows\System\YFTZhEV.exe
  C:\Windows\System\YFTZhEV.exe
  2⤵
  PID:3468
- C:\Windows\System\FslRXYd.exe
  C:\Windows\System\FslRXYd.exe
  2⤵
  PID:3488
- C:\Windows\System\fPsEzPw.exe
  C:\Windows\System\fPsEzPw.exe
  2⤵
  PID:3504
- C:\Windows\System\lbqASPV.exe
  C:\Windows\System\lbqASPV.exe
  2⤵
  PID:3524
- C:\Windows\System\ByJVPgd.exe
  C:\Windows\System\ByJVPgd.exe
  2⤵
  PID:3540
- C:\Windows\System\ZZXFnxD.exe
  C:\Windows\System\ZZXFnxD.exe
  2⤵
  PID:3556
- C:\Windows\System\LMzGeso.exe
  C:\Windows\System\LMzGeso.exe
  2⤵
  PID:3572
- C:\Windows\System\wCafOVV.exe
  C:\Windows\System\wCafOVV.exe
  2⤵
  PID:3588
- C:\Windows\System\VthZyXt.exe
  C:\Windows\System\VthZyXt.exe
  2⤵
  PID:3604
- C:\Windows\System\ptDoOvo.exe
  C:\Windows\System\ptDoOvo.exe
  2⤵
  PID:3620
- C:\Windows\System\JydvKIO.exe
  C:\Windows\System\JydvKIO.exe
  2⤵
  PID:3640
- C:\Windows\System\tXvFNft.exe
  C:\Windows\System\tXvFNft.exe
  2⤵
  PID:3656
- C:\Windows\System\nYKsBHM.exe
  C:\Windows\System\nYKsBHM.exe
  2⤵
  PID:3672
- C:\Windows\System\Kmecldv.exe
  C:\Windows\System\Kmecldv.exe
  2⤵
  PID:3688
- C:\Windows\System\ghMzJIb.exe
  C:\Windows\System\ghMzJIb.exe
  2⤵
  PID:3704
- C:\Windows\System\AsVLiZL.exe
  C:\Windows\System\AsVLiZL.exe
  2⤵
  PID:3720
- C:\Windows\System\PENincK.exe
  C:\Windows\System\PENincK.exe
  2⤵
  PID:3736
- C:\Windows\System\zIQmZFG.exe
  C:\Windows\System\zIQmZFG.exe
  2⤵
  PID:3756
- C:\Windows\System\RWLKtbv.exe
  C:\Windows\System\RWLKtbv.exe
  2⤵
  PID:3772
- C:\Windows\System\sAnIkwK.exe
  C:\Windows\System\sAnIkwK.exe
  2⤵
  PID:3788
- C:\Windows\System\mErrgLT.exe
  C:\Windows\System\mErrgLT.exe
  2⤵
  PID:3804
- C:\Windows\System\fqlSuBr.exe
  C:\Windows\System\fqlSuBr.exe
  2⤵
  PID:3820
- C:\Windows\System\kaBsLbM.exe
  C:\Windows\System\kaBsLbM.exe
  2⤵
  PID:3836
- C:\Windows\System\KtFkVrS.exe
  C:\Windows\System\KtFkVrS.exe
  2⤵
  PID:3856
- C:\Windows\System\jNJbiWc.exe
  C:\Windows\System\jNJbiWc.exe
  2⤵
  PID:3872
- C:\Windows\System\quXSeas.exe
  C:\Windows\System\quXSeas.exe
  2⤵
  PID:3888
- C:\Windows\System\iLdEEzL.exe
  C:\Windows\System\iLdEEzL.exe
  2⤵
  PID:3904
- C:\Windows\System\YDiVReS.exe
  C:\Windows\System\YDiVReS.exe
  2⤵
  PID:3920
- C:\Windows\System\CYrWdsd.exe
  C:\Windows\System\CYrWdsd.exe
  2⤵
  PID:3940
- C:\Windows\System\ipAqeeO.exe
  C:\Windows\System\ipAqeeO.exe
  2⤵
  PID:3956
- C:\Windows\System\KZdZGsa.exe
  C:\Windows\System\KZdZGsa.exe
  2⤵
  PID:3976
- C:\Windows\System\jhjlQWR.exe
  C:\Windows\System\jhjlQWR.exe
  2⤵
  PID:3992
- C:\Windows\System\zKCVzTH.exe
  C:\Windows\System\zKCVzTH.exe
  2⤵
  PID:4008
- C:\Windows\System\jrIhGcC.exe
  C:\Windows\System\jrIhGcC.exe
  2⤵
  PID:3188
- C:\Windows\System\HNbncvy.exe
  C:\Windows\System\HNbncvy.exe
  2⤵
  PID:3256
- C:\Windows\System\sRYomUl.exe
  C:\Windows\System\sRYomUl.exe
  2⤵
  PID:3276
- C:\Windows\System\uMjLHux.exe
  C:\Windows\System\uMjLHux.exe
  2⤵
  PID:3240
- C:\Windows\System\YISQzme.exe
  C:\Windows\System\YISQzme.exe
  2⤵
  PID:3296
- C:\Windows\System\pmHNyZB.exe
  C:\Windows\System\pmHNyZB.exe
  2⤵
  PID:3392
- C:\Windows\System\TJFFumI.exe
  C:\Windows\System\TJFFumI.exe
  2⤵
  PID:3460
- C:\Windows\System\hYHdNen.exe
  C:\Windows\System\hYHdNen.exe
  2⤵
  PID:3316
- C:\Windows\System\VLKfGhd.exe
  C:\Windows\System\VLKfGhd.exe
  2⤵
  PID:3568
- C:\Windows\System\bRyiTCQ.exe
  C:\Windows\System\bRyiTCQ.exe
  2⤵
  PID:3344
- C:\Windows\System\MPFgfjA.exe
  C:\Windows\System\MPFgfjA.exe
  2⤵
  PID:3548
- C:\Windows\System\pAFJhfk.exe
  C:\Windows\System\pAFJhfk.exe
  2⤵
  PID:3728
- C:\Windows\System\tkkFurS.exe
  C:\Windows\System\tkkFurS.exe
  2⤵
  PID:3444
- C:\Windows\System\AJeiiyu.exe
  C:\Windows\System\AJeiiyu.exe
  2⤵
  PID:3480
- C:\Windows\System\zwEBywg.exe
  C:\Windows\System\zwEBywg.exe
  2⤵
  PID:3580
- C:\Windows\System\NyINcow.exe
  C:\Windows\System\NyINcow.exe
  2⤵
  PID:3648
- C:\Windows\System\rOONkQu.exe
  C:\Windows\System\rOONkQu.exe
  2⤵
  PID:3852
- C:\Windows\System\cKHFsRe.exe
  C:\Windows\System\cKHFsRe.exe
  2⤵
  PID:3784
- C:\Windows\System\xMaGCQh.exe
  C:\Windows\System\xMaGCQh.exe
  2⤵
  PID:3716
- C:\Windows\System\zAFJlCn.exe
  C:\Windows\System\zAFJlCn.exe
  2⤵
  PID:3952
- C:\Windows\System\USFgpaK.exe
  C:\Windows\System\USFgpaK.exe
  2⤵
  PID:3916
- C:\Windows\System\uJVHhQc.exe
  C:\Windows\System\uJVHhQc.exe
  2⤵
  PID:4036
- C:\Windows\System\JLxDxGp.exe
  C:\Windows\System\JLxDxGp.exe
  2⤵
  PID:4048
- C:\Windows\System\RiXSIsJ.exe
  C:\Windows\System\RiXSIsJ.exe
  2⤵
  PID:4068
- C:\Windows\System\AcphmKv.exe
  C:\Windows\System\AcphmKv.exe
  2⤵
  PID:4092
- C:\Windows\System\SIHAcQw.exe
  C:\Windows\System\SIHAcQw.exe
  2⤵
  PID:3076
- C:\Windows\System\ueobbQX.exe
  C:\Windows\System\ueobbQX.exe
  2⤵
  PID:3100
- C:\Windows\System\CxrwLlq.exe
  C:\Windows\System\CxrwLlq.exe
  2⤵
  PID:3116
- C:\Windows\System\YokVQtv.exe
  C:\Windows\System\YokVQtv.exe
  2⤵
  PID:3864
- C:\Windows\System\bgnrItE.exe
  C:\Windows\System\bgnrItE.exe
  2⤵
  PID:3928
- C:\Windows\System\ORQRmej.exe
  C:\Windows\System\ORQRmej.exe
  2⤵
  PID:3204
- C:\Windows\System\CMBRePr.exe
  C:\Windows\System\CMBRePr.exe
  2⤵
  PID:3268
- C:\Windows\System\JbEBkln.exe
  C:\Windows\System\JbEBkln.exe
  2⤵
  PID:3668
- C:\Windows\System\vQlCsYu.exe
  C:\Windows\System\vQlCsYu.exe
  2⤵
  PID:3768
- C:\Windows\System\ewBpzLJ.exe
  C:\Windows\System\ewBpzLJ.exe
  2⤵
  PID:3936
- C:\Windows\System\CJgNUCP.exe
  C:\Windows\System\CJgNUCP.exe
  2⤵
  PID:4004
- C:\Windows\System\GFBEAAo.exe
  C:\Windows\System\GFBEAAo.exe
  2⤵
  PID:4100
- C:\Windows\System\YGcRyYS.exe
  C:\Windows\System\YGcRyYS.exe
  2⤵
  PID:4116
- C:\Windows\System\pSwZfQJ.exe
  C:\Windows\System\pSwZfQJ.exe
  2⤵
  PID:4132
- C:\Windows\System\cPInNFL.exe
  C:\Windows\System\cPInNFL.exe
  2⤵
  PID:4148
- C:\Windows\System\twFONUE.exe
  C:\Windows\System\twFONUE.exe
  2⤵
  PID:4168
- C:\Windows\System\GdMjHvZ.exe
  C:\Windows\System\GdMjHvZ.exe
  2⤵
  PID:4184
- C:\Windows\System\iSvaCWN.exe
  C:\Windows\System\iSvaCWN.exe
  2⤵
  PID:4200
- C:\Windows\System\tNdngUQ.exe
  C:\Windows\System\tNdngUQ.exe
  2⤵
  PID:4216
- C:\Windows\System\DPEpLBn.exe
  C:\Windows\System\DPEpLBn.exe
  2⤵
  PID:4232
- C:\Windows\System\nKxvwax.exe
  C:\Windows\System\nKxvwax.exe
  2⤵
  PID:4248
- C:\Windows\System\yejtKeY.exe
  C:\Windows\System\yejtKeY.exe
  2⤵
  PID:4268
- C:\Windows\System\kXGCpEG.exe
  C:\Windows\System\kXGCpEG.exe
  2⤵
  PID:4284
- C:\Windows\System\qzIFoWO.exe
  C:\Windows\System\qzIFoWO.exe
  2⤵
  PID:4300
- C:\Windows\System\caNCOTE.exe
  C:\Windows\System\caNCOTE.exe
  2⤵
  PID:4316
- C:\Windows\System\pHZsecH.exe
  C:\Windows\System\pHZsecH.exe
  2⤵
  PID:4332
- C:\Windows\System\BIIHZqF.exe
  C:\Windows\System\BIIHZqF.exe
  2⤵
  PID:4352
- C:\Windows\System\CRaNYYt.exe
  C:\Windows\System\CRaNYYt.exe
  2⤵
  PID:4368
- C:\Windows\System\bSdMcRH.exe
  C:\Windows\System\bSdMcRH.exe
  2⤵
  PID:4384
- C:\Windows\System\oAPUyRx.exe
  C:\Windows\System\oAPUyRx.exe
  2⤵
  PID:4400
- C:\Windows\System\fOyHRtO.exe
  C:\Windows\System\fOyHRtO.exe
  2⤵
  PID:4416
- C:\Windows\System\NElhTDu.exe
  C:\Windows\System\NElhTDu.exe
  2⤵
  PID:4436
- C:\Windows\System\pSjHZay.exe
  C:\Windows\System\pSjHZay.exe
  2⤵
  PID:4452
- C:\Windows\System\RRbRctt.exe
  C:\Windows\System\RRbRctt.exe
  2⤵
  PID:4468
- C:\Windows\System\AtCMrRo.exe
  C:\Windows\System\AtCMrRo.exe
  2⤵
  PID:4484
- C:\Windows\System\IhANECi.exe
  C:\Windows\System\IhANECi.exe
  2⤵
  PID:4500
- C:\Windows\System\oiGTuet.exe
  C:\Windows\System\oiGTuet.exe
  2⤵
  PID:4516
- C:\Windows\System\jyLiZHW.exe
  C:\Windows\System\jyLiZHW.exe
  2⤵
  PID:4532
- C:\Windows\System\ZcoSoWp.exe
  C:\Windows\System\ZcoSoWp.exe
  2⤵
  PID:4552
- C:\Windows\System\kQWZdbH.exe
  C:\Windows\System\kQWZdbH.exe
  2⤵
  PID:4568
- C:\Windows\System\tlUOawY.exe
  C:\Windows\System\tlUOawY.exe
  2⤵
  PID:4584
- C:\Windows\System\WJUkEFC.exe
  C:\Windows\System\WJUkEFC.exe
  2⤵
  PID:4600
- C:\Windows\System\vzftuxN.exe
  C:\Windows\System\vzftuxN.exe
  2⤵
  PID:4620
- C:\Windows\System\AeQxwwv.exe
  C:\Windows\System\AeQxwwv.exe
  2⤵
  PID:4640
- C:\Windows\System\xzOdZwG.exe
  C:\Windows\System\xzOdZwG.exe
  2⤵
  PID:4656
- C:\Windows\System\QdaRMlJ.exe
  C:\Windows\System\QdaRMlJ.exe
  2⤵
  PID:4672
- C:\Windows\System\BbnauWA.exe
  C:\Windows\System\BbnauWA.exe
  2⤵
  PID:4688
- C:\Windows\System\OeNLize.exe
  C:\Windows\System\OeNLize.exe
  2⤵
  PID:4704
- C:\Windows\System\FInumHF.exe
  C:\Windows\System\FInumHF.exe
  2⤵
  PID:4720
- C:\Windows\System\XrgdXQM.exe
  C:\Windows\System\XrgdXQM.exe
  2⤵
  PID:4736
- C:\Windows\System\BPeBHqY.exe
  C:\Windows\System\BPeBHqY.exe
  2⤵
  PID:4760
- C:\Windows\System\XZPJWBJ.exe
  C:\Windows\System\XZPJWBJ.exe
  2⤵
  PID:4952
- C:\Windows\System\nurYqhc.exe
  C:\Windows\System\nurYqhc.exe
  2⤵
  PID:4976
- C:\Windows\System\vSsLNTE.exe
  C:\Windows\System\vSsLNTE.exe
  2⤵
  PID:5104
- C:\Windows\System\RENVeMQ.exe
  C:\Windows\System\RENVeMQ.exe
  2⤵
  PID:3744
- C:\Windows\System\sqwwFYF.exe
  C:\Windows\System\sqwwFYF.exe
  2⤵
  PID:3080
- C:\Windows\System\aldqFdr.exe
  C:\Windows\System\aldqFdr.exe
  2⤵
  PID:3600
- C:\Windows\System\SfJIFcY.exe
  C:\Windows\System\SfJIFcY.exe
  2⤵
  PID:3932
- C:\Windows\System\WMDnbHq.exe
  C:\Windows\System\WMDnbHq.exe
  2⤵
  PID:3748
- C:\Windows\System\KEVxnlR.exe
  C:\Windows\System\KEVxnlR.exe
  2⤵
  PID:4164
- C:\Windows\System\rLnvEhz.exe
  C:\Windows\System\rLnvEhz.exe
  2⤵
  PID:4264
- C:\Windows\System\SJXgHke.exe
  C:\Windows\System\SJXgHke.exe
  2⤵
  PID:4360
- C:\Windows\System\eweeRQS.exe
  C:\Windows\System\eweeRQS.exe
  2⤵
  PID:3412
- C:\Windows\System\AtXnEbW.exe
  C:\Windows\System\AtXnEbW.exe
  2⤵
  PID:4428
- C:\Windows\System\aIuinYm.exe
  C:\Windows\System\aIuinYm.exe
  2⤵
  PID:3884
- C:\Windows\System\ZevAtyW.exe
  C:\Windows\System\ZevAtyW.exe
  2⤵
  PID:4464
- C:\Windows\System\CQEOkAs.exe
  C:\Windows\System\CQEOkAs.exe
  2⤵
  PID:4560
- C:\Windows\System\PxtIoih.exe
  C:\Windows\System\PxtIoih.exe
  2⤵
  PID:4076
- C:\Windows\System\WHYOKUN.exe
  C:\Windows\System\WHYOKUN.exe
  2⤵
  PID:4432
- C:\Windows\System\rLmCMgn.exe
  C:\Windows\System\rLmCMgn.exe
  2⤵
  PID:3328
- C:\Windows\System\jxqIzKu.exe
  C:\Windows\System\jxqIzKu.exe
  2⤵
  PID:3312
- C:\Windows\System\xOxZWLb.exe
  C:\Windows\System\xOxZWLb.exe
  2⤵
  PID:4668
- C:\Windows\System\QjeDqlJ.exe
  C:\Windows\System\QjeDqlJ.exe
  2⤵
  PID:4732
- C:\Windows\System\crtTxZz.exe
  C:\Windows\System\crtTxZz.exe
  2⤵
  PID:3732
- C:\Windows\System\XXBBYiQ.exe
  C:\Windows\System\XXBBYiQ.exe
  2⤵
  PID:4376
- C:\Windows\System\RtGaxSC.exe
  C:\Windows\System\RtGaxSC.exe
  2⤵
  PID:4312
- C:\Windows\System\KsaRQVX.exe
  C:\Windows\System\KsaRQVX.exe
  2⤵
  PID:4000
- C:\Windows\System\pVURmEL.exe
  C:\Windows\System\pVURmEL.exe
  2⤵
  PID:4512
- C:\Windows\System\dfagzvS.exe
  C:\Windows\System\dfagzvS.exe
  2⤵
  PID:4636
- C:\Windows\System\mLhQdrX.exe
  C:\Windows\System\mLhQdrX.exe
  2⤵
  PID:4684
- C:\Windows\System\NWjGJlp.exe
  C:\Windows\System\NWjGJlp.exe
  2⤵
  PID:4784
- C:\Windows\System\TEkXJCw.exe
  C:\Windows\System\TEkXJCw.exe
  2⤵
  PID:4508
- C:\Windows\System\PNEXyxn.exe
  C:\Windows\System\PNEXyxn.exe
  2⤵
  PID:4680
- C:\Windows\System\tBBQFhk.exe
  C:\Windows\System\tBBQFhk.exe
  2⤵
  PID:3812
- C:\Windows\System\Kzwacax.exe
  C:\Windows\System\Kzwacax.exe
  2⤵
  PID:4060
- C:\Windows\System\ntJnaru.exe
  C:\Windows\System\ntJnaru.exe
  2⤵
  PID:4276
- C:\Windows\System\rFCETge.exe
  C:\Windows\System\rFCETge.exe
  2⤵
  PID:4796
- C:\Windows\System\CNMFhNS.exe
  C:\Windows\System\CNMFhNS.exe
  2⤵
  PID:4820
- C:\Windows\System\yTHhvWO.exe
  C:\Windows\System\yTHhvWO.exe
  2⤵
  PID:4836
- C:\Windows\System\SmpLmlI.exe
  C:\Windows\System\SmpLmlI.exe
  2⤵
  PID:4880
- C:\Windows\System\fHSPUDC.exe
  C:\Windows\System\fHSPUDC.exe
  2⤵
  PID:4892
- C:\Windows\System\onuzeOd.exe
  C:\Windows\System\onuzeOd.exe
  2⤵
  PID:4912
- C:\Windows\System\HaZxCgN.exe
  C:\Windows\System\HaZxCgN.exe
  2⤵
  PID:4932
- C:\Windows\System\VxQKzIq.exe
  C:\Windows\System\VxQKzIq.exe
  2⤵
  PID:5044
- C:\Windows\System\mxmjsCd.exe
  C:\Windows\System\mxmjsCd.exe
  2⤵
  PID:5064
- C:\Windows\System\BtYqtxL.exe
  C:\Windows\System\BtYqtxL.exe
  2⤵
  PID:5080
- C:\Windows\System\mGHILwb.exe
  C:\Windows\System\mGHILwb.exe
  2⤵
  PID:5096
- C:\Windows\System\CfxCqFn.exe
  C:\Windows\System\CfxCqFn.exe
  2⤵
  PID:3828
- C:\Windows\System\vhWDLre.exe
  C:\Windows\System\vhWDLre.exe
  2⤵
  PID:3516
- C:\Windows\System\wDmrKWf.exe
  C:\Windows\System\wDmrKWf.exe
  2⤵
  PID:4128
- C:\Windows\System\rNPJkaT.exe
  C:\Windows\System\rNPJkaT.exe
  2⤵
  PID:3564
- C:\Windows\System\xtbyxbR.exe
  C:\Windows\System\xtbyxbR.exe
  2⤵
  PID:4296
- C:\Windows\System\MkRGllx.exe
  C:\Windows\System\MkRGllx.exe
  2⤵
  PID:4424
- C:\Windows\System\GAFeDEH.exe
  C:\Windows\System\GAFeDEH.exe
  2⤵
  PID:3752
- C:\Windows\System\uvAVsEQ.exe
  C:\Windows\System\uvAVsEQ.exe
  2⤵
  PID:4664
- C:\Windows\System\AkksPDW.exe
  C:\Windows\System\AkksPDW.exe
  2⤵
  PID:4592
- C:\Windows\System\NlpPiFP.exe
  C:\Windows\System\NlpPiFP.exe
  2⤵
  PID:4696
- C:\Windows\System\yGMApdy.exe
  C:\Windows\System\yGMApdy.exe
  2⤵
  PID:4344
- C:\Windows\System\UfzVuPP.exe
  C:\Windows\System\UfzVuPP.exe
  2⤵
  PID:3332
- C:\Windows\System\yqGuuIL.exe
  C:\Windows\System\yqGuuIL.exe
  2⤵
  PID:5084
- C:\Windows\System\zHfyOZZ.exe
  C:\Windows\System\zHfyOZZ.exe
  2⤵
  PID:4144
- C:\Windows\System\voVIIHL.exe
  C:\Windows\System\voVIIHL.exe
  2⤵
  PID:4448
- C:\Windows\System\RaDzKDI.exe
  C:\Windows\System\RaDzKDI.exe
  2⤵
  PID:4612
- C:\Windows\System\GDIPdnK.exe
  C:\Windows\System\GDIPdnK.exe
  2⤵
  PID:3280
- C:\Windows\System\RVQRkKT.exe
  C:\Windows\System\RVQRkKT.exe
  2⤵
  PID:4140
- C:\Windows\System\OppDqCs.exe
  C:\Windows\System\OppDqCs.exe
  2⤵
  PID:4544
- C:\Windows\System\fmeKsCi.exe
  C:\Windows\System\fmeKsCi.exe
  2⤵
  PID:3616
- C:\Windows\System\QmvIXFQ.exe
  C:\Windows\System\QmvIXFQ.exe
  2⤵
  PID:3120
- C:\Windows\System\fRtNEoV.exe
  C:\Windows\System\fRtNEoV.exe
  2⤵
  PID:3900
- C:\Windows\System\SLzUFZs.exe
  C:\Windows\System\SLzUFZs.exe
  2⤵
  PID:4792
- C:\Windows\System\HlOiqge.exe
  C:\Windows\System\HlOiqge.exe
  2⤵
  PID:4804
- C:\Windows\System\LRduWim.exe
  C:\Windows\System\LRduWim.exe
  2⤵
  PID:4872
- C:\Windows\System\cfNeDBc.exe
  C:\Windows\System\cfNeDBc.exe
  2⤵
  PID:4780
- C:\Windows\System\TcpUBwJ.exe
  C:\Windows\System\TcpUBwJ.exe
  2⤵
  PID:5112
- C:\Windows\System\RJXIRrc.exe
  C:\Windows\System\RJXIRrc.exe
  2⤵
  PID:3300
- C:\Windows\System\BITPcuP.exe
  C:\Windows\System\BITPcuP.exe
  2⤵
  PID:4072
- C:\Windows\System\uAHxKcP.exe
  C:\Windows\System\uAHxKcP.exe
  2⤵
  PID:4256
- C:\Windows\System\EXzqrWZ.exe
  C:\Windows\System\EXzqrWZ.exe
  2⤵
  PID:4412
- C:\Windows\System\QIwmXRN.exe
  C:\Windows\System\QIwmXRN.exe
  2⤵
  PID:4548
- C:\Windows\System\MaXpKtU.exe
  C:\Windows\System\MaXpKtU.exe
  2⤵
  PID:3612
- C:\Windows\System\GqHNbVZ.exe
  C:\Windows\System\GqHNbVZ.exe
  2⤵
  PID:3968
- C:\Windows\System\IvRlcMt.exe
  C:\Windows\System\IvRlcMt.exe
  2⤵
  PID:4828
- C:\Windows\System\wHurdYs.exe
  C:\Windows\System\wHurdYs.exe
  2⤵
  PID:4832
- C:\Windows\System\OHXlrSc.exe
  C:\Windows\System\OHXlrSc.exe
  2⤵
  PID:4840
- C:\Windows\System\xAvZhBO.exe
  C:\Windows\System\xAvZhBO.exe
  2⤵
  PID:4852
- C:\Windows\System\IwuyzTH.exe
  C:\Windows\System\IwuyzTH.exe
  2⤵
  PID:4868
- C:\Windows\System\XzurQVx.exe
  C:\Windows\System\XzurQVx.exe
  2⤵
  PID:4480
- C:\Windows\System\CnWhSgF.exe
  C:\Windows\System\CnWhSgF.exe
  2⤵
  PID:4240
- C:\Windows\System\cxTOFzA.exe
  C:\Windows\System\cxTOFzA.exe
  2⤵
  PID:4772
- C:\Windows\System\CMGzvrR.exe
  C:\Windows\System\CMGzvrR.exe
  2⤵
  PID:4088
- C:\Windows\System\XKGxbAn.exe
  C:\Windows\System\XKGxbAn.exe
  2⤵
  PID:4940
- C:\Windows\System\XFjEgDK.exe
  C:\Windows\System\XFjEgDK.exe
  2⤵
  PID:4960
- C:\Windows\System\EYPfOVm.exe
  C:\Windows\System\EYPfOVm.exe
  2⤵
  PID:4888
- C:\Windows\System\UFmbcfS.exe
  C:\Windows\System\UFmbcfS.exe
  2⤵
  PID:4996
- C:\Windows\System\qUVjOUu.exe
  C:\Windows\System\qUVjOUu.exe
  2⤵
  PID:5028
- C:\Windows\System\YFnRqDD.exe
  C:\Windows\System\YFnRqDD.exe
  2⤵
  PID:5076
- C:\Windows\System\dNBzBFe.exe
  C:\Windows\System\dNBzBFe.exe
  2⤵
  PID:4040
- C:\Windows\System\atdWvIe.exe
  C:\Windows\System\atdWvIe.exe
  2⤵
  PID:4180
- C:\Windows\System\xLbrbEs.exe
  C:\Windows\System\xLbrbEs.exe
  2⤵
  PID:4904
- C:\Windows\System\aWxyDbp.exe
  C:\Windows\System\aWxyDbp.exe
  2⤵
  PID:3160
- C:\Windows\System\UwRBhEz.exe
  C:\Windows\System\UwRBhEz.exe
  2⤵
  PID:4176
- C:\Windows\System\WbSdohE.exe
  C:\Windows\System\WbSdohE.exe
  2⤵
  PID:4652
- C:\Windows\System\SCXGheu.exe
  C:\Windows\System\SCXGheu.exe
  2⤵
  PID:4212
- C:\Windows\System\LsVccHr.exe
  C:\Windows\System\LsVccHr.exe
  2⤵
  PID:1660
- C:\Windows\System\pmhcxuO.exe
  C:\Windows\System\pmhcxuO.exe
  2⤵
  PID:4864
- C:\Windows\System\XJJbJJF.exe
  C:\Windows\System\XJJbJJF.exe
  2⤵
  PID:5116
- C:\Windows\System\aqraGJW.exe
  C:\Windows\System\aqraGJW.exe
  2⤵
  PID:996
- C:\Windows\System\nbUTQxM.exe
  C:\Windows\System\nbUTQxM.exe
  2⤵
  PID:4028
- C:\Windows\System\uahIXYh.exe
  C:\Windows\System\uahIXYh.exe
  2⤵
  PID:4928
- C:\Windows\System\ueEzyFP.exe
  C:\Windows\System\ueEzyFP.exe
  2⤵
  PID:3896
- C:\Windows\System\VfnAIjB.exe
  C:\Windows\System\VfnAIjB.exe
  2⤵
  PID:4044
- C:\Windows\System\vtbjijk.exe
  C:\Windows\System\vtbjijk.exe
  2⤵
  PID:3208
- C:\Windows\System\NxTeFTj.exe
  C:\Windows\System\NxTeFTj.exe
  2⤵
  PID:5136
- C:\Windows\System\auoEsha.exe
  C:\Windows\System\auoEsha.exe
  2⤵
  PID:5152
- C:\Windows\System\hYqABLI.exe
  C:\Windows\System\hYqABLI.exe
  2⤵
  PID:5168
- C:\Windows\System\eNhcKrc.exe
  C:\Windows\System\eNhcKrc.exe
  2⤵
  PID:5184
- C:\Windows\System\eBVcSnW.exe
  C:\Windows\System\eBVcSnW.exe
  2⤵
  PID:5200
- C:\Windows\System\YsNnunq.exe
  C:\Windows\System\YsNnunq.exe
  2⤵
  PID:5216
- C:\Windows\System\sybRDEg.exe
  C:\Windows\System\sybRDEg.exe
  2⤵
  PID:5232
- C:\Windows\System\WjGIRLp.exe
  C:\Windows\System\WjGIRLp.exe
  2⤵
  PID:5248
- C:\Windows\System\qvzCdXd.exe
  C:\Windows\System\qvzCdXd.exe
  2⤵
  PID:5272
- C:\Windows\System\yzQSmXR.exe
  C:\Windows\System\yzQSmXR.exe
  2⤵
  PID:5288
- C:\Windows\System\smxNpFn.exe
  C:\Windows\System\smxNpFn.exe
  2⤵
  PID:5304
- C:\Windows\System\DNRnYXW.exe
  C:\Windows\System\DNRnYXW.exe
  2⤵
  PID:5320
- C:\Windows\System\nRWAwpg.exe
  C:\Windows\System\nRWAwpg.exe
  2⤵
  PID:5336
- C:\Windows\System\QqPlckb.exe
  C:\Windows\System\QqPlckb.exe
  2⤵
  PID:5356
- C:\Windows\System\ENHIFfw.exe
  C:\Windows\System\ENHIFfw.exe
  2⤵
  PID:5372
- C:\Windows\System\KHtNRTc.exe
  C:\Windows\System\KHtNRTc.exe
  2⤵
  PID:5388
- C:\Windows\System\djTpTpB.exe
  C:\Windows\System\djTpTpB.exe
  2⤵
  PID:5404
- C:\Windows\System\cpTwGvY.exe
  C:\Windows\System\cpTwGvY.exe
  2⤵
  PID:5424
- C:\Windows\System\KnuFQtP.exe
  C:\Windows\System\KnuFQtP.exe
  2⤵
  PID:5440
- C:\Windows\System\QYpTKLS.exe
  C:\Windows\System\QYpTKLS.exe
  2⤵
  PID:5456
- C:\Windows\System\fLTnSQn.exe
  C:\Windows\System\fLTnSQn.exe
  2⤵
  PID:5472
- C:\Windows\System\AickDwO.exe
  C:\Windows\System\AickDwO.exe
  2⤵
  PID:5488
- C:\Windows\System\meycXPC.exe
  C:\Windows\System\meycXPC.exe
  2⤵
  PID:5508
- C:\Windows\System\oHCBtRX.exe
  C:\Windows\System\oHCBtRX.exe
  2⤵
  PID:5524
- C:\Windows\System\fWVWxIS.exe
  C:\Windows\System\fWVWxIS.exe
  2⤵
  PID:5540
- C:\Windows\System\NyHmIWp.exe
  C:\Windows\System\NyHmIWp.exe
  2⤵
  PID:5716
- C:\Windows\System\POvChjh.exe
  C:\Windows\System\POvChjh.exe
  2⤵
  PID:5736
- C:\Windows\System\mGrpxke.exe
  C:\Windows\System\mGrpxke.exe
  2⤵
  PID:5752
- C:\Windows\System\TGnmbva.exe
  C:\Windows\System\TGnmbva.exe
  2⤵
  PID:5768
- C:\Windows\System\BkAhFLa.exe
  C:\Windows\System\BkAhFLa.exe
  2⤵
  PID:5784
- C:\Windows\System\IDtxCpl.exe
  C:\Windows\System\IDtxCpl.exe
  2⤵
  PID:5800
- C:\Windows\System\AlBqNWo.exe
  C:\Windows\System\AlBqNWo.exe
  2⤵
  PID:5816
- C:\Windows\System\qzSJhEi.exe
  C:\Windows\System\qzSJhEi.exe
  2⤵
  PID:5832
- C:\Windows\System\vrowwRu.exe
  C:\Windows\System\vrowwRu.exe
  2⤵
  PID:5848
- C:\Windows\System\iuyUHGr.exe
  C:\Windows\System\iuyUHGr.exe
  2⤵
  PID:5864
- C:\Windows\System\gAjHNEG.exe
  C:\Windows\System\gAjHNEG.exe
  2⤵
  PID:5880
- C:\Windows\System\esvEqQH.exe
  C:\Windows\System\esvEqQH.exe
  2⤵
  PID:5896
- C:\Windows\System\QRxERJR.exe
  C:\Windows\System\QRxERJR.exe
  2⤵
  PID:5912
- C:\Windows\System\lxcxXBC.exe
  C:\Windows\System\lxcxXBC.exe
  2⤵
  PID:5928
- C:\Windows\System\IuscxNa.exe
  C:\Windows\System\IuscxNa.exe
  2⤵
  PID:5952
- C:\Windows\System\afKsVij.exe
  C:\Windows\System\afKsVij.exe
  2⤵
  PID:5968
- C:\Windows\System\pUGWgkF.exe
  C:\Windows\System\pUGWgkF.exe
  2⤵
  PID:5984
- C:\Windows\System\BbiOFkD.exe
  C:\Windows\System\BbiOFkD.exe
  2⤵
  PID:6000
- C:\Windows\System\rqOyGRN.exe
  C:\Windows\System\rqOyGRN.exe
  2⤵
  PID:6016
- C:\Windows\System\NXnhWar.exe
  C:\Windows\System\NXnhWar.exe
  2⤵
  PID:6032
- C:\Windows\System\xvkmaFP.exe
  C:\Windows\System\xvkmaFP.exe
  2⤵
  PID:6052
- C:\Windows\System\GISanCJ.exe
  C:\Windows\System\GISanCJ.exe
  2⤵
  PID:6068
- C:\Windows\System\uHfEKvs.exe
  C:\Windows\System\uHfEKvs.exe
  2⤵
  PID:6084
- C:\Windows\System\zNzcfyz.exe
  C:\Windows\System\zNzcfyz.exe
  2⤵
  PID:6100
- C:\Windows\System\ciUOeft.exe
  C:\Windows\System\ciUOeft.exe
  2⤵
  PID:6120
- C:\Windows\System\RDDwYjv.exe
  C:\Windows\System\RDDwYjv.exe
  2⤵
  PID:6136
- C:\Windows\System\XZBtzHG.exe
  C:\Windows\System\XZBtzHG.exe
  2⤵
  PID:5148
- C:\Windows\System\gVgQLTC.exe
  C:\Windows\System\gVgQLTC.exe
  2⤵
  PID:5180
- C:\Windows\System\eElSlHK.exe
  C:\Windows\System\eElSlHK.exe
  2⤵
  PID:5012
- C:\Windows\System\EejhKQm.exe
  C:\Windows\System\EejhKQm.exe
  2⤵
  PID:5348
- C:\Windows\System\UaSZtge.exe
  C:\Windows\System\UaSZtge.exe
  2⤵
  PID:5412
- C:\Windows\System\wlJGoHt.exe
  C:\Windows\System\wlJGoHt.exe
  2⤵
  PID:4528
- C:\Windows\System\RmLmvLO.exe
  C:\Windows\System\RmLmvLO.exe
  2⤵
  PID:4876
- C:\Windows\System\alaAdwW.exe
  C:\Windows\System\alaAdwW.exe
  2⤵
  PID:4460
- C:\Windows\System\TvkKanI.exe
  C:\Windows\System\TvkKanI.exe
  2⤵
  PID:5164
- C:\Windows\System\tAPRuFD.exe
  C:\Windows\System\tAPRuFD.exe
  2⤵
  PID:5228
- C:\Windows\System\OrlMESC.exe
  C:\Windows\System\OrlMESC.exe
  2⤵
  PID:5268
- C:\Windows\System\qPySRID.exe
  C:\Windows\System\qPySRID.exe
  2⤵
  PID:5364
- C:\Windows\System\NWXdwno.exe
  C:\Windows\System\NWXdwno.exe
  2⤵
  PID:5432
- C:\Windows\System\fAhCKsP.exe
  C:\Windows\System\fAhCKsP.exe
  2⤵
  PID:5496
- C:\Windows\System\SfRHCrN.exe
  C:\Windows\System\SfRHCrN.exe
  2⤵
  PID:5548
- C:\Windows\System\AnGfHSR.exe
  C:\Windows\System\AnGfHSR.exe
  2⤵
  PID:5604
- C:\Windows\System\kDzdqnN.exe
  C:\Windows\System\kDzdqnN.exe
  2⤵
  PID:5612
- C:\Windows\System\CEMtoqk.exe
  C:\Windows\System\CEMtoqk.exe
  2⤵
  PID:5636
- C:\Windows\System\WvKVwTQ.exe
  C:\Windows\System\WvKVwTQ.exe
  2⤵
  PID:5652
- C:\Windows\System\lOCRpYW.exe
  C:\Windows\System\lOCRpYW.exe
  2⤵
  PID:5668
- C:\Windows\System\sqldVtA.exe
  C:\Windows\System\sqldVtA.exe
  2⤵
  PID:5684
- C:\Windows\System\gxTyGzS.exe
  C:\Windows\System\gxTyGzS.exe
  2⤵
  PID:5700
- C:\Windows\System\wqbHYES.exe
  C:\Windows\System\wqbHYES.exe
  2⤵
  PID:5532
- C:\Windows\System\YtoGqga.exe
  C:\Windows\System\YtoGqga.exe
  2⤵
  PID:5744
- C:\Windows\System\KlXuOpz.exe
  C:\Windows\System\KlXuOpz.exe
  2⤵
  PID:5776
- C:\Windows\System\VZnxpoD.exe
  C:\Windows\System\VZnxpoD.exe
  2⤵
  PID:6076
- C:\Windows\System\hkVfCza.exe
  C:\Windows\System\hkVfCza.exe
  2⤵
  PID:5992
- C:\Windows\System\plBPRfd.exe
  C:\Windows\System\plBPRfd.exe
  2⤵
  PID:5796
- C:\Windows\System\dqrQEBO.exe
  C:\Windows\System\dqrQEBO.exe
  2⤵
  PID:5352
- C:\Windows\System\CYoiAIe.exe
  C:\Windows\System\CYoiAIe.exe
  2⤵
  PID:5312
- C:\Windows\System\XXjkiQG.exe
  C:\Windows\System\XXjkiQG.exe
  2⤵
  PID:6132
- C:\Windows\System\mmHUWVP.exe
  C:\Windows\System\mmHUWVP.exe
  2⤵
  PID:6060
- C:\Windows\System\uvKskNB.exe
  C:\Windows\System\uvKskNB.exe
  2⤵
  PID:5892
- C:\Windows\System\xyZcNPS.exe
  C:\Windows\System\xyZcNPS.exe
  2⤵
  PID:5824
- C:\Windows\System\aOdlcRX.exe
  C:\Windows\System\aOdlcRX.exe
  2⤵
  PID:5452
- C:\Windows\System\LNJRMBm.exe
  C:\Windows\System\LNJRMBm.exe
  2⤵
  PID:5516
- C:\Windows\System\xBkoHPs.exe
  C:\Windows\System\xBkoHPs.exe
  2⤵
  PID:5940
- C:\Windows\System\VgWaOai.exe
  C:\Windows\System\VgWaOai.exe
  2⤵
  PID:6080
- C:\Windows\System\KldSqMH.exe
  C:\Windows\System\KldSqMH.exe
  2⤵
  PID:4816
- C:\Windows\System\gvkUfdl.exe
  C:\Windows\System\gvkUfdl.exe
  2⤵
  PID:4160
- C:\Windows\System\mNumSZK.exe
  C:\Windows\System\mNumSZK.exe
  2⤵
  PID:5396
- C:\Windows\System\vALKoKu.exe
  C:\Windows\System\vALKoKu.exe
  2⤵
  PID:5616
- C:\Windows\System\xMRtEhT.exe
  C:\Windows\System\xMRtEhT.exe
  2⤵
  PID:5680
- C:\Windows\System\anRXitj.exe
  C:\Windows\System\anRXitj.exe
  2⤵
  PID:6108
- C:\Windows\System\rUrIGlg.exe
  C:\Windows\System\rUrIGlg.exe
  2⤵
  PID:5936
- C:\Windows\System\zZLiYkm.exe
  C:\Windows\System\zZLiYkm.exe
  2⤵
  PID:5208
- C:\Windows\System\RVWHQpc.exe
  C:\Windows\System\RVWHQpc.exe
  2⤵
  PID:5924
- C:\Windows\System\xJaNqKV.exe
  C:\Windows\System\xJaNqKV.exe
  2⤵
  PID:5196
- C:\Windows\System\nnqTEON.exe
  C:\Windows\System\nnqTEON.exe
  2⤵
  PID:5632
- C:\Windows\System\pqdLEGy.exe
  C:\Windows\System\pqdLEGy.exe
  2⤵
  PID:5828
- C:\Windows\System\IOsiagD.exe
  C:\Windows\System\IOsiagD.exe
  2⤵
  PID:5856
- C:\Windows\System\UhelBcg.exe
  C:\Windows\System\UhelBcg.exe
  2⤵
  PID:5468
- C:\Windows\System\zVAAenu.exe
  C:\Windows\System\zVAAenu.exe
  2⤵
  PID:5660
- C:\Windows\System\MpOyLvS.exe
  C:\Windows\System\MpOyLvS.exe
  2⤵
  PID:6048
- C:\Windows\System\KpkUyNy.exe
  C:\Windows\System\KpkUyNy.exe
  2⤵
  PID:5860
- C:\Windows\System\rUcDSOl.exe
  C:\Windows\System\rUcDSOl.exe
  2⤵
  PID:5780
- C:\Windows\System\VSkOBHK.exe
  C:\Windows\System\VSkOBHK.exe
  2⤵
  PID:5904
- C:\Windows\System\YLXpFWV.exe
  C:\Windows\System\YLXpFWV.exe
  2⤵
  PID:5380
- C:\Windows\System\OozSFRg.exe
  C:\Windows\System\OozSFRg.exe
  2⤵
  PID:5760
- C:\Windows\System\wpmtJMk.exe
  C:\Windows\System\wpmtJMk.exe
  2⤵
  PID:6092
- C:\Windows\System\rIPnDQF.exe
  C:\Windows\System\rIPnDQF.exe
  2⤵
  PID:5600
- C:\Windows\System\CAidPwg.exe
  C:\Windows\System\CAidPwg.exe
  2⤵
  PID:5872
- C:\Windows\System\dpKpgBV.exe
  C:\Windows\System\dpKpgBV.exe
  2⤵
  PID:5280
- C:\Windows\System\sjheckd.exe
  C:\Windows\System\sjheckd.exe
  2⤵
  PID:4608
- C:\Windows\System\qVMNMyL.exe
  C:\Windows\System\qVMNMyL.exe
  2⤵
  PID:5976
- C:\Windows\System\xjpKuGC.exe
  C:\Windows\System\xjpKuGC.exe
  2⤵
  PID:5676
- C:\Windows\System\yWpDsfO.exe
  C:\Windows\System\yWpDsfO.exe
  2⤵
  PID:5996
- C:\Windows\System\wgWQXfD.exe
  C:\Windows\System\wgWQXfD.exe
  2⤵
  PID:5448
- C:\Windows\System\KQZObqY.exe
  C:\Windows\System\KQZObqY.exe
  2⤵
  PID:5920
- C:\Windows\System\DQjoGNz.exe
  C:\Windows\System\DQjoGNz.exe
  2⤵
  PID:5732
- C:\Windows\System\FYtUOdR.exe
  C:\Windows\System\FYtUOdR.exe
  2⤵
  PID:5244
- C:\Windows\System\yAinGUx.exe
  C:\Windows\System\yAinGUx.exe
  2⤵
  PID:5420
- C:\Windows\System\CxaYPwg.exe
  C:\Windows\System\CxaYPwg.exe
  2⤵
  PID:5648
- C:\Windows\System\OUEoBxx.exe
  C:\Windows\System\OUEoBxx.exe
  2⤵
  PID:5264
- C:\Windows\System\SToTxeh.exe
  C:\Windows\System\SToTxeh.exe
  2⤵
  PID:5712
- C:\Windows\System\lATzLOz.exe
  C:\Windows\System\lATzLOz.exe
  2⤵
  PID:5464
- C:\Windows\System\yHwUwkw.exe
  C:\Windows\System\yHwUwkw.exe
  2⤵
  PID:6156
- C:\Windows\System\yccrQPC.exe
  C:\Windows\System\yccrQPC.exe
  2⤵
  PID:6172
- C:\Windows\System\cyZQduF.exe
  C:\Windows\System\cyZQduF.exe
  2⤵
  PID:6188
- C:\Windows\System\CuerUmk.exe
  C:\Windows\System\CuerUmk.exe
  2⤵
  PID:6204
- C:\Windows\System\JDLoLSe.exe
  C:\Windows\System\JDLoLSe.exe
  2⤵
  PID:6224
- C:\Windows\System\bNGpxnL.exe
  C:\Windows\System\bNGpxnL.exe
  2⤵
  PID:6240
- C:\Windows\System\cCAQIlO.exe
  C:\Windows\System\cCAQIlO.exe
  2⤵
  PID:6256
- C:\Windows\System\IpDbTzd.exe
  C:\Windows\System\IpDbTzd.exe
  2⤵
  PID:6272
- C:\Windows\System\XdxzLgN.exe
  C:\Windows\System\XdxzLgN.exe
  2⤵
  PID:6288
- C:\Windows\System\SqXHBRK.exe
  C:\Windows\System\SqXHBRK.exe
  2⤵
  PID:6304
- C:\Windows\System\sudGyAg.exe
  C:\Windows\System\sudGyAg.exe
  2⤵
  PID:6320
- C:\Windows\System\noJwFNY.exe
  C:\Windows\System\noJwFNY.exe
  2⤵
  PID:6340
- C:\Windows\System\LLoDtPo.exe
  C:\Windows\System\LLoDtPo.exe
  2⤵
  PID:6356
- C:\Windows\System\yyANGys.exe
  C:\Windows\System\yyANGys.exe
  2⤵
  PID:6372
- C:\Windows\System\fBNlmTo.exe
  C:\Windows\System\fBNlmTo.exe
  2⤵
  PID:6388
- C:\Windows\System\zYrIwHb.exe
  C:\Windows\System\zYrIwHb.exe
  2⤵
  PID:6404
- C:\Windows\System\hozQoZu.exe
  C:\Windows\System\hozQoZu.exe
  2⤵
  PID:6420
- C:\Windows\System\SpJgDuG.exe
  C:\Windows\System\SpJgDuG.exe
  2⤵
  PID:6436
- C:\Windows\System\tnPGbQt.exe
  C:\Windows\System\tnPGbQt.exe
  2⤵
  PID:6452
- C:\Windows\System\BaFFeiH.exe
  C:\Windows\System\BaFFeiH.exe
  2⤵
  PID:6472
- C:\Windows\System\mQmcLOx.exe
  C:\Windows\System\mQmcLOx.exe
  2⤵
  PID:6488
- C:\Windows\System\yHKPrZa.exe
  C:\Windows\System\yHKPrZa.exe
  2⤵
  PID:6504
- C:\Windows\System\MtsPukT.exe
  C:\Windows\System\MtsPukT.exe
  2⤵
  PID:6520
- C:\Windows\System\fmItKME.exe
  C:\Windows\System\fmItKME.exe
  2⤵
  PID:6536
- C:\Windows\System\OjrciBj.exe
  C:\Windows\System\OjrciBj.exe
  2⤵
  PID:6552
- C:\Windows\System\sDwmEIS.exe
  C:\Windows\System\sDwmEIS.exe
  2⤵
  PID:6568
- C:\Windows\System\VGixNxH.exe
  C:\Windows\System\VGixNxH.exe
  2⤵
  PID:6584
- C:\Windows\System\qMHPOsk.exe
  C:\Windows\System\qMHPOsk.exe
  2⤵
  PID:6600
- C:\Windows\System\IBEpQOi.exe
  C:\Windows\System\IBEpQOi.exe
  2⤵
  PID:6620
- C:\Windows\System\NxuQZYk.exe
  C:\Windows\System\NxuQZYk.exe
  2⤵
  PID:6636
- C:\Windows\System\ZYgFmxL.exe
  C:\Windows\System\ZYgFmxL.exe
  2⤵
  PID:6652
- C:\Windows\System\XBoHWcJ.exe
  C:\Windows\System\XBoHWcJ.exe
  2⤵
  PID:6668
- C:\Windows\System\bXXfJFH.exe
  C:\Windows\System\bXXfJFH.exe
  2⤵
  PID:6684
- C:\Windows\System\vZdrWWN.exe
  C:\Windows\System\vZdrWWN.exe
  2⤵
  PID:6700
- C:\Windows\System\EcUoBRy.exe
  C:\Windows\System\EcUoBRy.exe
  2⤵
  PID:6720
- C:\Windows\System\EvfAsPK.exe
  C:\Windows\System\EvfAsPK.exe
  2⤵
  PID:6736
- C:\Windows\System\Jrsmznh.exe
  C:\Windows\System\Jrsmznh.exe
  2⤵
  PID:6752
- C:\Windows\System\KJzYZTp.exe
  C:\Windows\System\KJzYZTp.exe
  2⤵
  PID:6772
- C:\Windows\System\BLtdBhw.exe
  C:\Windows\System\BLtdBhw.exe
  2⤵
  PID:6788
- C:\Windows\System\eqnVQjT.exe
  C:\Windows\System\eqnVQjT.exe
  2⤵
  PID:6804
- C:\Windows\System\ZDwgFfh.exe
  C:\Windows\System\ZDwgFfh.exe
  2⤵
  PID:6820
- C:\Windows\System\pWvJTBD.exe
  C:\Windows\System\pWvJTBD.exe
  2⤵
  PID:6836
- C:\Windows\System\aBqlrpw.exe
  C:\Windows\System\aBqlrpw.exe
  2⤵
  PID:6852
- C:\Windows\System\ZpXBcxL.exe
  C:\Windows\System\ZpXBcxL.exe
  2⤵
  PID:6868
- C:\Windows\System\dfQdflp.exe
  C:\Windows\System\dfQdflp.exe
  2⤵
  PID:6972
- C:\Windows\System\yJJkErt.exe
  C:\Windows\System\yJJkErt.exe
  2⤵
  PID:6988
- C:\Windows\System\whnzaeb.exe
  C:\Windows\System\whnzaeb.exe
  2⤵
  PID:7004
- C:\Windows\System\TpRazJt.exe
  C:\Windows\System\TpRazJt.exe
  2⤵
  PID:7020
- C:\Windows\System\tcJzPKx.exe
  C:\Windows\System\tcJzPKx.exe
  2⤵
  PID:7040
- C:\Windows\System\IvOLptf.exe
  C:\Windows\System\IvOLptf.exe
  2⤵
  PID:7056
- C:\Windows\System\sKrDSTK.exe
  C:\Windows\System\sKrDSTK.exe
  2⤵
  PID:7072
- C:\Windows\System\cyMglrt.exe
  C:\Windows\System\cyMglrt.exe
  2⤵
  PID:7092
- C:\Windows\System\nPShlJS.exe
  C:\Windows\System\nPShlJS.exe
  2⤵
  PID:7108
- C:\Windows\System\ULGjRpG.exe
  C:\Windows\System\ULGjRpG.exe
  2⤵
  PID:7128
- C:\Windows\System\CeytWIW.exe
  C:\Windows\System\CeytWIW.exe
  2⤵
  PID:7144
- C:\Windows\System\PrjBtdG.exe
  C:\Windows\System\PrjBtdG.exe
  2⤵
  PID:7160
- C:\Windows\System\TNlBQJx.exe
  C:\Windows\System\TNlBQJx.exe
  2⤵
  PID:6180
- C:\Windows\System\NyJXJxQ.exe
  C:\Windows\System\NyJXJxQ.exe
  2⤵
  PID:6220
- C:\Windows\System\LMxMgKd.exe
  C:\Windows\System\LMxMgKd.exe
  2⤵
  PID:6284
- C:\Windows\System\WnvetOo.exe
  C:\Windows\System\WnvetOo.exe
  2⤵
  PID:4244
- C:\Windows\System\fggZtJJ.exe
  C:\Windows\System\fggZtJJ.exe
  2⤵
  PID:6116
- C:\Windows\System\ZlUKMCh.exe
  C:\Windows\System\ZlUKMCh.exe
  2⤵
  PID:6232
- C:\Windows\System\XnvZkKy.exe
  C:\Windows\System\XnvZkKy.exe
  2⤵
  PID:6444
- C:\Windows\System\TyYbZTg.exe
  C:\Windows\System\TyYbZTg.exe
  2⤵
  PID:6300
- C:\Windows\System\IPmzOTq.exe
  C:\Windows\System\IPmzOTq.exe
  2⤵
  PID:6480
- C:\Windows\System\gOpINQh.exe
  C:\Windows\System\gOpINQh.exe
  2⤵
  PID:6200
- C:\Windows\System\VKgdDkj.exe
  C:\Windows\System\VKgdDkj.exe
  2⤵
  PID:6336
- C:\Windows\System\NUUvngT.exe
  C:\Windows\System\NUUvngT.exe
  2⤵
  PID:6432
- C:\Windows\System\EsbvQlR.exe
  C:\Windows\System\EsbvQlR.exe
  2⤵
  PID:6576
- C:\Windows\System\EfULvtD.exe
  C:\Windows\System\EfULvtD.exe
  2⤵
  PID:6780
- C:\Windows\System\uxkXONS.exe
  C:\Windows\System\uxkXONS.exe
  2⤵
  PID:6628
- C:\Windows\System\opAnKic.exe
  C:\Windows\System\opAnKic.exe
  2⤵
  PID:6764
- C:\Windows\System\VPamDZi.exe
  C:\Windows\System\VPamDZi.exe
  2⤵
  PID:6844
- C:\Windows\System\PnBwGQJ.exe
  C:\Windows\System\PnBwGQJ.exe
  2⤵
  PID:6832
- C:\Windows\System\bQGwfcP.exe
  C:\Windows\System\bQGwfcP.exe
  2⤵
  PID:6916
- C:\Windows\System\gaeeqLZ.exe
  C:\Windows\System\gaeeqLZ.exe
  2⤵
  PID:6884
- C:\Windows\System\jXFAftn.exe
  C:\Windows\System\jXFAftn.exe
  2⤵
  PID:6900
- C:\Windows\System\wRgDjce.exe
  C:\Windows\System\wRgDjce.exe
  2⤵
  PID:6928
- C:\Windows\System\sumkFNt.exe
  C:\Windows\System\sumkFNt.exe
  2⤵
  PID:6952
- C:\Windows\System\AcQQgGq.exe
  C:\Windows\System\AcQQgGq.exe
  2⤵
  PID:6964
- C:\Windows\System\MrPMjnB.exe
  C:\Windows\System\MrPMjnB.exe
  2⤵
  PID:7032
- C:\Windows\System\XdcPkVd.exe
  C:\Windows\System\XdcPkVd.exe
  2⤵
  PID:6984
- C:\Windows\System\lFufLMR.exe
  C:\Windows\System\lFufLMR.exe
  2⤵
  PID:7048
- C:\Windows\System\phQBkuZ.exe
  C:\Windows\System\phQBkuZ.exe
  2⤵
  PID:6980
- C:\Windows\System\pnCfuTm.exe
  C:\Windows\System\pnCfuTm.exe
  2⤵
  PID:7140
- C:\Windows\System\YiPZmUj.exe
  C:\Windows\System\YiPZmUj.exe
  2⤵
  PID:6280
- C:\Windows\System\XfERLQr.exe
  C:\Windows\System\XfERLQr.exe
  2⤵
  PID:6416
- C:\Windows\System\gsNXbpQ.exe
  C:\Windows\System\gsNXbpQ.exe
  2⤵
  PID:6484
- C:\Windows\System\worNEWx.exe
  C:\Windows\System\worNEWx.exe
  2⤵
  PID:6548
- C:\Windows\System\TQPwNxh.exe
  C:\Windows\System\TQPwNxh.exe
  2⤵
  PID:7156
- C:\Windows\System\CtKaQSL.exe
  C:\Windows\System\CtKaQSL.exe
  2⤵
  PID:6196
- C:\Windows\System\oUOLQdu.exe
  C:\Windows\System\oUOLQdu.exe
  2⤵
  PID:6364
- C:\Windows\System\zbxPmzc.exe
  C:\Windows\System\zbxPmzc.exe
  2⤵
  PID:6460
- C:\Windows\System\tbXJnaO.exe
  C:\Windows\System\tbXJnaO.exe
  2⤵
  PID:6644
- C:\Windows\System\agNDqqe.exe
  C:\Windows\System\agNDqqe.exe
  2⤵
  PID:6496
- C:\Windows\System\xkTidXR.exe
  C:\Windows\System\xkTidXR.exe
  2⤵
  PID:6676
- C:\Windows\System\elruWDF.exe
  C:\Windows\System\elruWDF.exe
  2⤵
  PID:6660
- C:\Windows\System\wSgsJZb.exe
  C:\Windows\System\wSgsJZb.exe
  2⤵
  PID:6696
- C:\Windows\System\yVdDFVn.exe
  C:\Windows\System\yVdDFVn.exe
  2⤵
  PID:6860
- C:\Windows\System\bhiaQZO.exe
  C:\Windows\System\bhiaQZO.exe
  2⤵
  PID:6940
- C:\Windows\System\dBFPOsO.exe
  C:\Windows\System\dBFPOsO.exe
  2⤵
  PID:7028
- C:\Windows\System\pHAvTJe.exe
  C:\Windows\System\pHAvTJe.exe
  2⤵
  PID:7136
- C:\Windows\System\BkXFuzc.exe
  C:\Windows\System\BkXFuzc.exe
  2⤵
  PID:6960
- C:\Windows\System\OJwTiuA.exe
  C:\Windows\System\OJwTiuA.exe
  2⤵
  PID:6152
- C:\Windows\System\blGAilw.exe
  C:\Windows\System\blGAilw.exe
  2⤵
  PID:6428
- C:\Windows\System\fnZkBNg.exe
  C:\Windows\System\fnZkBNg.exe
  2⤵
  PID:6212
- C:\Windows\System\PGDMZFQ.exe
  C:\Windows\System\PGDMZFQ.exe
  2⤵
  PID:6528
- C:\Windows\System\XBXcsXg.exe
  C:\Windows\System\XBXcsXg.exe
  2⤵
  PID:6044
- C:\Windows\System\ktQbejU.exe
  C:\Windows\System\ktQbejU.exe
  2⤵
  PID:6748
- C:\Windows\System\dVXOInt.exe
  C:\Windows\System\dVXOInt.exe
  2⤵
  PID:6944
- C:\Windows\System\tWRgeRu.exe
  C:\Windows\System\tWRgeRu.exe
  2⤵
  PID:6648
- C:\Windows\System\xZLNVuX.exe
  C:\Windows\System\xZLNVuX.exe
  2⤵
  PID:7088
- C:\Windows\System\rQwcdCv.exe
  C:\Windows\System\rQwcdCv.exe
  2⤵
  PID:6716
- C:\Windows\System\ndfiibS.exe
  C:\Windows\System\ndfiibS.exe
  2⤵
  PID:6864
- C:\Windows\System\pAbvBpw.exe
  C:\Windows\System\pAbvBpw.exe
  2⤵
  PID:6532
- C:\Windows\System\wdnPILd.exe
  C:\Windows\System\wdnPILd.exe
  2⤵
  PID:6892
- C:\Windows\System\rKPLGop.exe
  C:\Windows\System\rKPLGop.exe
  2⤵
  PID:6768
- C:\Windows\System\StVinjU.exe
  C:\Windows\System\StVinjU.exe
  2⤵
  PID:6908
- C:\Windows\System\yrMohXV.exe
  C:\Windows\System\yrMohXV.exe
  2⤵
  PID:7176
- C:\Windows\System\HpwYyuy.exe
  C:\Windows\System\HpwYyuy.exe
  2⤵
  PID:7192
- C:\Windows\System\RqKorOt.exe
  C:\Windows\System\RqKorOt.exe
  2⤵
  PID:7208
- C:\Windows\System\MnJvHSh.exe
  C:\Windows\System\MnJvHSh.exe
  2⤵
  PID:7228
- C:\Windows\System\LdtTPDB.exe
  C:\Windows\System\LdtTPDB.exe
  2⤵
  PID:7248
- C:\Windows\System\eJpmFuO.exe
  C:\Windows\System\eJpmFuO.exe
  2⤵
  PID:7272
- C:\Windows\System\eRpsmls.exe
  C:\Windows\System\eRpsmls.exe
  2⤵
  PID:7288
- C:\Windows\System\uYEuYCC.exe
  C:\Windows\System\uYEuYCC.exe
  2⤵
  PID:7304
- C:\Windows\System\jbEtBBf.exe
  C:\Windows\System\jbEtBBf.exe
  2⤵
  PID:7324
- C:\Windows\System\iqcRfEG.exe
  C:\Windows\System\iqcRfEG.exe
  2⤵
  PID:7340
- C:\Windows\System\aHCuCks.exe
  C:\Windows\System\aHCuCks.exe
  2⤵
  PID:7356
- C:\Windows\System\jFOygeX.exe
  C:\Windows\System\jFOygeX.exe
  2⤵
  PID:7372
- C:\Windows\System\rTSoulu.exe
  C:\Windows\System\rTSoulu.exe
  2⤵
  PID:7388
- C:\Windows\System\YighMft.exe
  C:\Windows\System\YighMft.exe
  2⤵
  PID:7404
- C:\Windows\System\BvSUdvd.exe
  C:\Windows\System\BvSUdvd.exe
  2⤵
  PID:7420
- C:\Windows\System\iLwsVuw.exe
  C:\Windows\System\iLwsVuw.exe
  2⤵
  PID:7436
- C:\Windows\System\tTATyaC.exe
  C:\Windows\System\tTATyaC.exe
  2⤵
  PID:7452
- C:\Windows\System\zqnzcsN.exe
  C:\Windows\System\zqnzcsN.exe
  2⤵
  PID:7468
- C:\Windows\System\ARYdOoC.exe
  C:\Windows\System\ARYdOoC.exe
  2⤵
  PID:7484
- C:\Windows\System\NYkmJdX.exe
  C:\Windows\System\NYkmJdX.exe
  2⤵
  PID:7500
- C:\Windows\System\nInFNsL.exe
  C:\Windows\System\nInFNsL.exe
  2⤵
  PID:7516
- C:\Windows\System\MgVxOTK.exe
  C:\Windows\System\MgVxOTK.exe
  2⤵
  PID:7536
- C:\Windows\System\QwgPaOf.exe
  C:\Windows\System\QwgPaOf.exe
  2⤵
  PID:7552
- C:\Windows\System\VZospKJ.exe
  C:\Windows\System\VZospKJ.exe
  2⤵
  PID:7568
- C:\Windows\System\ySIwRZV.exe
  C:\Windows\System\ySIwRZV.exe
  2⤵
  PID:7584
- C:\Windows\System\vdLXAUP.exe
  C:\Windows\System\vdLXAUP.exe
  2⤵
  PID:7600
- C:\Windows\System\cRIRcOI.exe
  C:\Windows\System\cRIRcOI.exe
  2⤵
  PID:7616
- C:\Windows\System\sGIKzyv.exe
  C:\Windows\System\sGIKzyv.exe
  2⤵
  PID:7632
- C:\Windows\System\bcsrsDW.exe
  C:\Windows\System\bcsrsDW.exe
  2⤵
  PID:7648
- C:\Windows\System\dUpHlHj.exe
  C:\Windows\System\dUpHlHj.exe
  2⤵
  PID:7768
- C:\Windows\System\ZHBZNfo.exe
  C:\Windows\System\ZHBZNfo.exe
  2⤵
  PID:7784
- C:\Windows\System\NmaRhOG.exe
  C:\Windows\System\NmaRhOG.exe
  2⤵
  PID:7804
- C:\Windows\System\JxsAlFh.exe
  C:\Windows\System\JxsAlFh.exe
  2⤵
  PID:7820
- C:\Windows\System\sUNsNvQ.exe
  C:\Windows\System\sUNsNvQ.exe
  2⤵
  PID:7836
- C:\Windows\System\JkwGQET.exe
  C:\Windows\System\JkwGQET.exe
  2⤵
  PID:7852
- C:\Windows\System\uWvawzP.exe
  C:\Windows\System\uWvawzP.exe
  2⤵
  PID:7872
- C:\Windows\System\BRhTnPI.exe
  C:\Windows\System\BRhTnPI.exe
  2⤵
  PID:7888
- C:\Windows\System\jAPrIPD.exe
  C:\Windows\System\jAPrIPD.exe
  2⤵
  PID:7904
- C:\Windows\System\JDGQfPI.exe
  C:\Windows\System\JDGQfPI.exe
  2⤵
  PID:7920
- C:\Windows\System\oTEpIwp.exe
  C:\Windows\System\oTEpIwp.exe
  2⤵
  PID:7936
- C:\Windows\System\HsSowFY.exe
  C:\Windows\System\HsSowFY.exe
  2⤵
  PID:8080
- C:\Windows\System\FtdjpKt.exe
  C:\Windows\System\FtdjpKt.exe
  2⤵
  PID:8096
- C:\Windows\System\ezBjuyL.exe
  C:\Windows\System\ezBjuyL.exe
  2⤵
  PID:8116
- C:\Windows\System\NyQefek.exe
  C:\Windows\System\NyQefek.exe
  2⤵
  PID:8136
- C:\Windows\System\BssyWIk.exe
  C:\Windows\System\BssyWIk.exe
  2⤵
  PID:8152
- C:\Windows\System\yLWGGuy.exe
  C:\Windows\System\yLWGGuy.exe
  2⤵
  PID:8168
- C:\Windows\System\PpSLFcJ.exe
  C:\Windows\System\PpSLFcJ.exe
  2⤵
  PID:8184
- C:\Windows\System\qZYdVNI.exe
  C:\Windows\System\qZYdVNI.exe
  2⤵
  PID:7236
- C:\Windows\System\ZwGlRDM.exe
  C:\Windows\System\ZwGlRDM.exe
  2⤵
  PID:6412
- C:\Windows\System\UNTPtgB.exe
  C:\Windows\System\UNTPtgB.exe
  2⤵
  PID:7084
- C:\Windows\System\ePMaCVd.exe
  C:\Windows\System\ePMaCVd.exe
  2⤵
  PID:6268
- C:\Windows\System\pTNoqfs.exe
  C:\Windows\System\pTNoqfs.exe
  2⤵
  PID:7224
- C:\Windows\System\bsnmbNM.exe
  C:\Windows\System\bsnmbNM.exe
  2⤵
  PID:6316
- C:\Windows\System\RtMLHWM.exe
  C:\Windows\System\RtMLHWM.exe
  2⤵
  PID:7284
- C:\Windows\System\MNsTJwk.exe
  C:\Windows\System\MNsTJwk.exe
  2⤵
  PID:6544
- C:\Windows\System\HGbqjif.exe
  C:\Windows\System\HGbqjif.exe
  2⤵
  PID:7352
- C:\Windows\System\Tqbyjho.exe
  C:\Windows\System\Tqbyjho.exe
  2⤵
  PID:7384
- C:\Windows\System\ZQlHXKa.exe
  C:\Windows\System\ZQlHXKa.exe
  2⤵
  PID:7412
- C:\Windows\System\RcwtZop.exe
  C:\Windows\System\RcwtZop.exe
  2⤵
  PID:7416
- C:\Windows\System\aLiuAeY.exe
  C:\Windows\System\aLiuAeY.exe
  2⤵
  PID:7476
- C:\Windows\System\UojCESI.exe
  C:\Windows\System\UojCESI.exe
  2⤵
  PID:7184
- C:\Windows\System\kIwbmts.exe
  C:\Windows\System\kIwbmts.exe
  2⤵
  PID:7464
- C:\Windows\System\EDHQHeu.exe
  C:\Windows\System\EDHQHeu.exe
  2⤵
  PID:7512
- C:\Windows\System\OocAqNE.exe
  C:\Windows\System\OocAqNE.exe
  2⤵
  PID:7524
- C:\Windows\System\njkTPTz.exe
  C:\Windows\System\njkTPTz.exe
  2⤵
  PID:7544
- C:\Windows\System\mvATwji.exe
  C:\Windows\System\mvATwji.exe
  2⤵
  PID:7692
- C:\Windows\System\OKgXYVQ.exe
  C:\Windows\System\OKgXYVQ.exe
  2⤵
  PID:7708
- C:\Windows\System\ssRXPlU.exe
  C:\Windows\System\ssRXPlU.exe
  2⤵
  PID:7724
- C:\Windows\System\lUHhavv.exe
  C:\Windows\System\lUHhavv.exe
  2⤵
  PID:7740
- C:\Windows\System\iWpSZjm.exe
  C:\Windows\System\iWpSZjm.exe
  2⤵
  PID:7756
- C:\Windows\System\ngsWApg.exe
  C:\Windows\System\ngsWApg.exe
  2⤵
  PID:7780
- C:\Windows\System\pVWFsZE.exe
  C:\Windows\System\pVWFsZE.exe
  2⤵
  PID:7848
- C:\Windows\System\wyONYFW.exe
  C:\Windows\System\wyONYFW.exe
  2⤵
  PID:7860
- C:\Windows\System\kUgqpUR.exe
  C:\Windows\System\kUgqpUR.exe
  2⤵
  PID:7944
- C:\Windows\System\AzSrpap.exe
  C:\Windows\System\AzSrpap.exe
  2⤵
  PID:7796
- C:\Windows\System\uWRRYOv.exe
  C:\Windows\System\uWRRYOv.exe
  2⤵
  PID:7900
- C:\Windows\System\cHnpdrJ.exe
  C:\Windows\System\cHnpdrJ.exe
  2⤵
  PID:7956
- C:\Windows\System\zrUGrlh.exe
  C:\Windows\System\zrUGrlh.exe
  2⤵
  PID:7972
- C:\Windows\System\sjYfidi.exe
  C:\Windows\System\sjYfidi.exe
  2⤵
  PID:7988
- C:\Windows\System\CJkIvPa.exe
  C:\Windows\System\CJkIvPa.exe
  2⤵
  PID:8004
- C:\Windows\System\bxijYdl.exe
  C:\Windows\System\bxijYdl.exe
  2⤵
  PID:8020
- C:\Windows\System\MpeFLaM.exe
  C:\Windows\System\MpeFLaM.exe
  2⤵
  PID:8036
- C:\Windows\System\eCXomQF.exe
  C:\Windows\System\eCXomQF.exe
  2⤵
  PID:8052
- C:\Windows\System\QAsQrPt.exe
  C:\Windows\System\QAsQrPt.exe
  2⤵
  PID:8068
- C:\Windows\System\KWyQrAc.exe
  C:\Windows\System\KWyQrAc.exe
  2⤵
  PID:8104
- C:\Windows\System\AOoNQlN.exe
  C:\Windows\System\AOoNQlN.exe
  2⤵
  PID:8180
- C:\Windows\System\YLfAdPA.exe
  C:\Windows\System\YLfAdPA.exe
  2⤵
  PID:7312
- C:\Windows\System\kjaAbPm.exe
  C:\Windows\System\kjaAbPm.exe
  2⤵
  PID:7216
- C:\Windows\System\QOXogKp.exe
  C:\Windows\System\QOXogKp.exe
  2⤵
  PID:7336
- C:\Windows\System\AEKloLw.exe
  C:\Windows\System\AEKloLw.exe
  2⤵
  PID:7492
- C:\Windows\System\AubXvWh.exe
  C:\Windows\System\AubXvWh.exe
  2⤵
  PID:8128
- C:\Windows\System\FmlxQkl.exe
  C:\Windows\System\FmlxQkl.exe
  2⤵
  PID:7204
- C:\Windows\System\wFVFpeY.exe
  C:\Windows\System\wFVFpeY.exe
  2⤵
  PID:7280
- C:\Windows\System\tWClTpL.exe
  C:\Windows\System\tWClTpL.exe
  2⤵
  PID:6712
- C:\Windows\System\UVSJkfP.exe
  C:\Windows\System\UVSJkfP.exe
  2⤵
  PID:7444
- C:\Windows\System\gIwZEHB.exe
  C:\Windows\System\gIwZEHB.exe
  2⤵
  PID:6848
- C:\Windows\System\sjmAKJP.exe
  C:\Windows\System\sjmAKJP.exe
  2⤵
  PID:7548
- C:\Windows\System\BqdAjcR.exe
  C:\Windows\System\BqdAjcR.exe
  2⤵
  PID:7612
- C:\Windows\System\jBPguzk.exe
  C:\Windows\System\jBPguzk.exe
  2⤵
  PID:7624
- C:\Windows\System\ZTMEVXQ.exe
  C:\Windows\System\ZTMEVXQ.exe
  2⤵
  PID:7672
- C:\Windows\System\CjPdGjX.exe
  C:\Windows\System\CjPdGjX.exe
  2⤵
  PID:7700
- C:\Windows\System\xAxUWjv.exe
  C:\Windows\System\xAxUWjv.exe
  2⤵
  PID:7764
- C:\Windows\System\RMJHpPo.exe
  C:\Windows\System\RMJHpPo.exe
  2⤵
  PID:7752
- C:\Windows\System\AFwfWZe.exe
  C:\Windows\System\AFwfWZe.exe
  2⤵
  PID:7800
- C:\Windows\System\UPQnlGN.exe
  C:\Windows\System\UPQnlGN.exe
  2⤵
  PID:7984
- C:\Windows\System\YXRvtQv.exe
  C:\Windows\System\YXRvtQv.exe
  2⤵
  PID:8048
- C:\Windows\System\iwMTXzH.exe
  C:\Windows\System\iwMTXzH.exe
  2⤵
  PID:7260
- C:\Windows\System\GiZBHFs.exe
  C:\Windows\System\GiZBHFs.exe
  2⤵
  PID:7716
- C:\Windows\System\vwLfvAS.exe
  C:\Windows\System\vwLfvAS.exe
  2⤵
  PID:8092
- C:\Windows\System\loGquQI.exe
  C:\Windows\System\loGquQI.exe
  2⤵
  PID:7832
- C:\Windows\System\rOZOsMN.exe
  C:\Windows\System\rOZOsMN.exe
  2⤵
  PID:7964
- C:\Windows\System\BWjajGT.exe
  C:\Windows\System\BWjajGT.exe
  2⤵
  PID:8032
- C:\Windows\System\OMvpCdm.exe
  C:\Windows\System\OMvpCdm.exe
  2⤵
  PID:8144
- C:\Windows\System\ojxjQGs.exe
  C:\Windows\System\ojxjQGs.exe
  2⤵
  PID:7296
- C:\Windows\System\dIskzex.exe
  C:\Windows\System\dIskzex.exe
  2⤵
  PID:7068
- C:\Windows\System\UTRBwiP.exe
  C:\Windows\System\UTRBwiP.exe
  2⤵
  PID:6744
- C:\Windows\System\JwazRMO.exe
  C:\Windows\System\JwazRMO.exe
  2⤵
  PID:7592
- C:\Windows\System\QUmLcaz.exe
  C:\Windows\System\QUmLcaz.exe
  2⤵
  PID:8088
- C:\Windows\System\vnqykMm.exe
  C:\Windows\System\vnqykMm.exe
  2⤵
  PID:7732
- C:\Windows\System\fNrFLKK.exe
  C:\Windows\System\fNrFLKK.exe
  2⤵
  PID:7596
- C:\Windows\System\pabpjEt.exe
  C:\Windows\System\pabpjEt.exe
  2⤵
  PID:7952
- C:\Windows\System\YcdQJKy.exe
  C:\Windows\System\YcdQJKy.exe
  2⤵
  PID:7508
- C:\Windows\System\rwhnjUv.exe
  C:\Windows\System\rwhnjUv.exe
  2⤵
  PID:8064
- C:\Windows\System\FBpeQzV.exe
  C:\Windows\System\FBpeQzV.exe
  2⤵
  PID:7736
- C:\Windows\System\ueqoPPd.exe
  C:\Windows\System\ueqoPPd.exe
  2⤵
  PID:7932
- C:\Windows\System\MeSPysP.exe
  C:\Windows\System\MeSPysP.exe
  2⤵
  PID:7608
- C:\Windows\System\IqfrMQM.exe
  C:\Windows\System\IqfrMQM.exe
  2⤵
  PID:7844
- C:\Windows\System\YpGIZSc.exe
  C:\Windows\System\YpGIZSc.exe
  2⤵
  PID:8044
- C:\Windows\System\cOIPfJQ.exe
  C:\Windows\System\cOIPfJQ.exe
  2⤵
  PID:7656
- C:\Windows\System\CMwzOMI.exe
  C:\Windows\System\CMwzOMI.exe
  2⤵
  PID:6332
- C:\Windows\System\MDLrnim.exe
  C:\Windows\System\MDLrnim.exe
  2⤵
  PID:7200
- C:\Windows\System\bBvAFBP.exe
  C:\Windows\System\bBvAFBP.exe
  2⤵
  PID:8108
- C:\Windows\System\plBtNPi.exe
  C:\Windows\System\plBtNPi.exe
  2⤵
  PID:7188
- C:\Windows\System\vUVnOeW.exe
  C:\Windows\System\vUVnOeW.exe
  2⤵
  PID:7828
- C:\Windows\System\eALaigU.exe
  C:\Windows\System\eALaigU.exe
  2⤵
  PID:1496
- C:\Windows\System\DroGfwP.exe
  C:\Windows\System\DroGfwP.exe
  2⤵
  PID:8208
- C:\Windows\System\RNhyWyt.exe
  C:\Windows\System\RNhyWyt.exe
  2⤵
  PID:8224
- C:\Windows\System\vDqxTsG.exe
  C:\Windows\System\vDqxTsG.exe
  2⤵
  PID:8240
- C:\Windows\System\qvPIBOh.exe
  C:\Windows\System\qvPIBOh.exe
  2⤵
  PID:8256
- C:\Windows\System\FsoIbET.exe
  C:\Windows\System\FsoIbET.exe
  2⤵
  PID:8272
- C:\Windows\System\fAYScDK.exe
  C:\Windows\System\fAYScDK.exe
  2⤵
  PID:8288
- C:\Windows\System\aEZhwzV.exe
  C:\Windows\System\aEZhwzV.exe
  2⤵
  PID:8304
- C:\Windows\System\pJFBbfg.exe
  C:\Windows\System\pJFBbfg.exe
  2⤵
  PID:8320
- C:\Windows\System\sMTaVHq.exe
  C:\Windows\System\sMTaVHq.exe
  2⤵
  PID:8380
- C:\Windows\System\ifVAYmb.exe
  C:\Windows\System\ifVAYmb.exe
  2⤵
  PID:8396
- C:\Windows\System\gSEZSwT.exe
  C:\Windows\System\gSEZSwT.exe
  2⤵
  PID:8412
- C:\Windows\System\RHXldOf.exe
  C:\Windows\System\RHXldOf.exe
  2⤵
  PID:8428
- C:\Windows\System\qgdnWzR.exe
  C:\Windows\System\qgdnWzR.exe
  2⤵
  PID:8448
- C:\Windows\System\DxJmBDG.exe
  C:\Windows\System\DxJmBDG.exe
  2⤵
  PID:8464
- C:\Windows\System\YXpVnsA.exe
  C:\Windows\System\YXpVnsA.exe
  2⤵
  PID:8480
- C:\Windows\System\RkRosbW.exe
  C:\Windows\System\RkRosbW.exe
  2⤵
  PID:8496
- C:\Windows\System\RjnGFdv.exe
  C:\Windows\System\RjnGFdv.exe
  2⤵
  PID:8512
- C:\Windows\System\WaPllBH.exe
  C:\Windows\System\WaPllBH.exe
  2⤵
  PID:8528
- C:\Windows\System\wRttEpX.exe
  C:\Windows\System\wRttEpX.exe
  2⤵
  PID:8544
- C:\Windows\System\kgjhosW.exe
  C:\Windows\System\kgjhosW.exe
  2⤵
  PID:8560
- C:\Windows\System\SNPSEkt.exe
  C:\Windows\System\SNPSEkt.exe
  2⤵
  PID:8576
- C:\Windows\System\efpuhdL.exe
  C:\Windows\System\efpuhdL.exe
  2⤵
  PID:8592
- C:\Windows\System\FoFfYCz.exe
  C:\Windows\System\FoFfYCz.exe
  2⤵
  PID:8608
- C:\Windows\System\kRnsTHY.exe
  C:\Windows\System\kRnsTHY.exe
  2⤵
  PID:8624
- C:\Windows\System\dAeibRW.exe
  C:\Windows\System\dAeibRW.exe
  2⤵
  PID:8640
- C:\Windows\System\CBmUluP.exe
  C:\Windows\System\CBmUluP.exe
  2⤵
  PID:8656
- C:\Windows\System\dpoexgs.exe
  C:\Windows\System\dpoexgs.exe
  2⤵
  PID:8672
- C:\Windows\System\ZpvqqoE.exe
  C:\Windows\System\ZpvqqoE.exe
  2⤵
  PID:8688
- C:\Windows\System\kAzHYQF.exe
  C:\Windows\System\kAzHYQF.exe
  2⤵
  PID:8704
- C:\Windows\System\uKhLlHC.exe
  C:\Windows\System\uKhLlHC.exe
  2⤵
  PID:8720
- C:\Windows\System\nDUZHhD.exe
  C:\Windows\System\nDUZHhD.exe
  2⤵
  PID:8736
- C:\Windows\System\QbwlLuJ.exe
  C:\Windows\System\QbwlLuJ.exe
  2⤵
  PID:8752
- C:\Windows\System\uAwQoaL.exe
  C:\Windows\System\uAwQoaL.exe
  2⤵
  PID:8768
- C:\Windows\System\wdAqfYi.exe
  C:\Windows\System\wdAqfYi.exe
  2⤵
  PID:8784
- C:\Windows\System\pIlSSCC.exe
  C:\Windows\System\pIlSSCC.exe
  2⤵
  PID:8800
- C:\Windows\System\WuwQvKi.exe
  C:\Windows\System\WuwQvKi.exe
  2⤵
  PID:8816
- C:\Windows\System\TBbBdVw.exe
  C:\Windows\System\TBbBdVw.exe
  2⤵
  PID:8832
- C:\Windows\System\jONqMyy.exe
  C:\Windows\System\jONqMyy.exe
  2⤵
  PID:8848
- C:\Windows\System\IpMbdgm.exe
  C:\Windows\System\IpMbdgm.exe
  2⤵
  PID:8864
- C:\Windows\System\BpwIXvV.exe
  C:\Windows\System\BpwIXvV.exe
  2⤵
  PID:8880
- C:\Windows\System\XYeepar.exe
  C:\Windows\System\XYeepar.exe
  2⤵
  PID:8896
- C:\Windows\System\TfkPOgX.exe
  C:\Windows\System\TfkPOgX.exe
  2⤵
  PID:8912
- C:\Windows\System\vfTgXgk.exe
  C:\Windows\System\vfTgXgk.exe
  2⤵
  PID:8928
- C:\Windows\System\UxVmLwV.exe
  C:\Windows\System\UxVmLwV.exe
  2⤵
  PID:8944
- C:\Windows\System\GmXipfd.exe
  C:\Windows\System\GmXipfd.exe
  2⤵
  PID:8960
- C:\Windows\System\RmYSwHd.exe
  C:\Windows\System\RmYSwHd.exe
  2⤵
  PID:8976
- C:\Windows\System\aPJoeQt.exe
  C:\Windows\System\aPJoeQt.exe
  2⤵
  PID:8992
- C:\Windows\System\DqzDHpo.exe
  C:\Windows\System\DqzDHpo.exe
  2⤵
  PID:9008
- C:\Windows\System\VdWHDgm.exe
  C:\Windows\System\VdWHDgm.exe
  2⤵
  PID:9112
- C:\Windows\System\bqkEhXx.exe
  C:\Windows\System\bqkEhXx.exe
  2⤵
  PID:9132
- C:\Windows\System\MRNbXSH.exe
  C:\Windows\System\MRNbXSH.exe
  2⤵
  PID:9148
- C:\Windows\System\lLoBDZn.exe
  C:\Windows\System\lLoBDZn.exe
  2⤵
  PID:9164
- C:\Windows\System\AKieTyd.exe
  C:\Windows\System\AKieTyd.exe
  2⤵
  PID:9180
- C:\Windows\System\xVbApgS.exe
  C:\Windows\System\xVbApgS.exe
  2⤵
  PID:9196
- C:\Windows\System\gkmArNg.exe
  C:\Windows\System\gkmArNg.exe
  2⤵
  PID:7244
- C:\Windows\System\dupxlhD.exe
  C:\Windows\System\dupxlhD.exe
  2⤵
  PID:7912
- C:\Windows\System\IfnHsPx.exe
  C:\Windows\System\IfnHsPx.exe
  2⤵
  PID:8000
- C:\Windows\System\IGODIdQ.exe
  C:\Windows\System\IGODIdQ.exe
  2⤵
  PID:8312
- C:\Windows\System\BWKHkNM.exe
  C:\Windows\System\BWKHkNM.exe
  2⤵
  PID:8236
- C:\Windows\System\aOPkksQ.exe
  C:\Windows\System\aOPkksQ.exe
  2⤵
  PID:8296
- C:\Windows\System\uOaWZcV.exe
  C:\Windows\System\uOaWZcV.exe
  2⤵
  PID:8340
- C:\Windows\System\gTCUZne.exe
  C:\Windows\System\gTCUZne.exe
  2⤵
  PID:8356
- C:\Windows\System\bxrthrR.exe
  C:\Windows\System\bxrthrR.exe
  2⤵
  PID:8372
- C:\Windows\System\PmSpcAG.exe
  C:\Windows\System\PmSpcAG.exe
  2⤵
  PID:8420
- C:\Windows\System\uDYvjfr.exe
  C:\Windows\System\uDYvjfr.exe
  2⤵
  PID:8440
- C:\Windows\System\GfBTdRL.exe
  C:\Windows\System\GfBTdRL.exe
  2⤵
  PID:8520
- C:\Windows\System\FgADVMr.exe
  C:\Windows\System\FgADVMr.exe
  2⤵
  PID:8584
- C:\Windows\System\cdSxMjw.exe
  C:\Windows\System\cdSxMjw.exe
  2⤵
  PID:8620
- C:\Windows\System\AZdooru.exe
  C:\Windows\System\AZdooru.exe
  2⤵
  PID:8680
- C:\Windows\System\MLDcfEE.exe
  C:\Windows\System\MLDcfEE.exe
  2⤵
  PID:8748
- C:\Windows\System\tZgwTsR.exe
  C:\Windows\System\tZgwTsR.exe
  2⤵
  PID:8668
- C:\Windows\System\QBxmwhY.exe
  C:\Windows\System\QBxmwhY.exe
  2⤵
  PID:8780
- C:\Windows\System\hJpCrfe.exe
  C:\Windows\System\hJpCrfe.exe
  2⤵
  PID:8476
- C:\Windows\System\RIZevIk.exe
  C:\Windows\System\RIZevIk.exe
  2⤵
  PID:8700
- C:\Windows\System\NBJklhT.exe
  C:\Windows\System\NBJklhT.exe
  2⤵
  PID:8844
- C:\Windows\System\UklaVts.exe
  C:\Windows\System\UklaVts.exe
  2⤵
  PID:8824
- C:\Windows\System\oLIzktJ.exe
  C:\Windows\System\oLIzktJ.exe
  2⤵
  PID:8604
- C:\Windows\System\GRGigBi.exe
  C:\Windows\System\GRGigBi.exe
  2⤵
  PID:8792
- C:\Windows\System\NMXWJli.exe
  C:\Windows\System\NMXWJli.exe
  2⤵
  PID:8972
- C:\Windows\System\JmpjrYR.exe
  C:\Windows\System\JmpjrYR.exe
  2⤵
  PID:8924
- C:\Windows\System\UUUXbBl.exe
  C:\Windows\System\UUUXbBl.exe
  2⤵
  PID:8888
- C:\Windows\System\Mqheoud.exe
  C:\Windows\System\Mqheoud.exe
  2⤵
  PID:9016
- C:\Windows\System\pwSUZqL.exe
  C:\Windows\System\pwSUZqL.exe
  2⤵
  PID:9032
- C:\Windows\System\khAYPYq.exe
  C:\Windows\System\khAYPYq.exe
  2⤵
  PID:9048
- C:\Windows\System\LQSHVxd.exe
  C:\Windows\System\LQSHVxd.exe
  2⤵
  PID:9064
- C:\Windows\System\izExjsr.exe
  C:\Windows\System\izExjsr.exe
  2⤵
  PID:9076
- C:\Windows\System\SllCfIK.exe
  C:\Windows\System\SllCfIK.exe
  2⤵
  PID:9100
- C:\Windows\System\naTJHqd.exe
  C:\Windows\System\naTJHqd.exe
  2⤵
  PID:9128
- C:\Windows\System\sdzvyhI.exe
  C:\Windows\System\sdzvyhI.exe
  2⤵
  PID:8216
- C:\Windows\System\liShmUz.exe
  C:\Windows\System\liShmUz.exe
  2⤵
  PID:8284
- C:\Windows\System\fWaPLhg.exe
  C:\Windows\System\fWaPLhg.exe
  2⤵
  PID:8388
- C:\Windows\System\zUsJwjL.exe
  C:\Windows\System\zUsJwjL.exe
  2⤵
  PID:8492
- C:\Windows\System\UQirZfU.exe
  C:\Windows\System\UQirZfU.exe
  2⤵
  PID:8716
- C:\Windows\System\LzpjMrf.exe
  C:\Windows\System\LzpjMrf.exe
  2⤵
  PID:7396
- C:\Windows\System\OmwHdAR.exe
  C:\Windows\System\OmwHdAR.exe
  2⤵
  PID:9212
- C:\Windows\System\QolBKJo.exe
  C:\Windows\System\QolBKJo.exe
  2⤵
  PID:9144
- C:\Windows\System\fcWbiHq.exe
  C:\Windows\System\fcWbiHq.exe
  2⤵
  PID:8360
- C:\Windows\System\SwQKvMl.exe
  C:\Windows\System\SwQKvMl.exe
  2⤵
  PID:8556
- C:\Windows\System\ghUYyre.exe
  C:\Windows\System\ghUYyre.exe
  2⤵
  PID:8728
- C:\Windows\System\rSFiZWp.exe
  C:\Windows\System\rSFiZWp.exe
  2⤵
  PID:8732
- C:\Windows\System\swTxpPC.exe
  C:\Windows\System\swTxpPC.exe
  2⤵
  PID:8876
- C:\Windows\System\RVGMtUC.exe
  C:\Windows\System\RVGMtUC.exe
  2⤵
  PID:7560
- C:\Windows\System\XZjsVVe.exe
  C:\Windows\System\XZjsVVe.exe
  2⤵
  PID:9044
- C:\Windows\System\NaaYnHv.exe
  C:\Windows\System\NaaYnHv.exe
  2⤵
  PID:9080
- C:\Windows\System\fYvUfuA.exe
  C:\Windows\System\fYvUfuA.exe
  2⤵
  PID:8204
- C:\Windows\System\gqbRDlQ.exe
  C:\Windows\System\gqbRDlQ.exe
  2⤵
  PID:8488
- C:\Windows\System\XMYVixh.exe
  C:\Windows\System\XMYVixh.exe
  2⤵
  PID:8892
- C:\Windows\System\nBnaVEE.exe
  C:\Windows\System\nBnaVEE.exe
  2⤵
  PID:9056
- C:\Windows\System\weqIDlq.exe
  C:\Windows\System\weqIDlq.exe
  2⤵
  PID:9188
- C:\Windows\System\jmpTiCZ.exe
  C:\Windows\System\jmpTiCZ.exe
  2⤵
  PID:9192
- C:\Windows\System\FOCpHoS.exe
  C:\Windows\System\FOCpHoS.exe
  2⤵
  PID:8936
- C:\Windows\System\SfMEWQw.exe
  C:\Windows\System\SfMEWQw.exe
  2⤵
  PID:8684
- C:\Windows\System\NHITLPH.exe
  C:\Windows\System\NHITLPH.exe
  2⤵
  PID:8248
- C:\Windows\System\ZRKcFhc.exe
  C:\Windows\System\ZRKcFhc.exe
  2⤵
  PID:8572
- C:\Windows\System\ygwJlZi.exe
  C:\Windows\System\ygwJlZi.exe
  2⤵
  PID:8776
- C:\Windows\System\LxjQJvO.exe
  C:\Windows\System\LxjQJvO.exe
  2⤵
  PID:8952
- C:\Windows\System\rfjfcyl.exe
  C:\Windows\System\rfjfcyl.exe
  2⤵
  PID:8404
- C:\Windows\System\ayMjVsx.exe
  C:\Windows\System\ayMjVsx.exe
  2⤵
  PID:9124
- C:\Windows\System\NVSeXYE.exe
  C:\Windows\System\NVSeXYE.exe
  2⤵
  PID:9352
- C:\Windows\System\dwvOzyn.exe
  C:\Windows\System\dwvOzyn.exe
  2⤵
  PID:9368
- C:\Windows\System\GnAxAof.exe
  C:\Windows\System\GnAxAof.exe
  2⤵
  PID:9384
- C:\Windows\System\RpBFgqs.exe
  C:\Windows\System\RpBFgqs.exe
  2⤵
  PID:9556
- C:\Windows\System\KyzlWpQ.exe
  C:\Windows\System\KyzlWpQ.exe
  2⤵
  PID:9572
- C:\Windows\System\kCsivLE.exe
  C:\Windows\System\kCsivLE.exe
  2⤵
  PID:9588
- C:\Windows\System\KKyIHwC.exe
  C:\Windows\System\KKyIHwC.exe
  2⤵
  PID:9604
- C:\Windows\System\EHyFAns.exe
  C:\Windows\System\EHyFAns.exe
  2⤵
  PID:9624
- C:\Windows\System\gBNfvNj.exe
  C:\Windows\System\gBNfvNj.exe
  2⤵
  PID:9640
- C:\Windows\System\GtrfvyR.exe
  C:\Windows\System\GtrfvyR.exe
  2⤵
  PID:9656
- C:\Windows\System\EUoVbBk.exe
  C:\Windows\System\EUoVbBk.exe
  2⤵
  PID:9672
- C:\Windows\System\XymdziA.exe
  C:\Windows\System\XymdziA.exe
  2⤵
  PID:9688
- C:\Windows\System\VvsogjK.exe
  C:\Windows\System\VvsogjK.exe
  2⤵
  PID:9704
- C:\Windows\System\ewKolCe.exe
  C:\Windows\System\ewKolCe.exe
  2⤵
  PID:9720
- C:\Windows\System\DeHMUwU.exe
  C:\Windows\System\DeHMUwU.exe
  2⤵
  PID:9740
- C:\Windows\System\TTuaCsQ.exe
  C:\Windows\System\TTuaCsQ.exe
  2⤵
  PID:9880
- C:\Windows\System\ZpLQdan.exe
  C:\Windows\System\ZpLQdan.exe
  2⤵
  PID:9896
- C:\Windows\System\lmBteyo.exe
  C:\Windows\System\lmBteyo.exe
  2⤵
  PID:9920
- C:\Windows\System\gQOKxzw.exe
  C:\Windows\System\gQOKxzw.exe
  2⤵
  PID:9936
- C:\Windows\System\IRaYzYM.exe
  C:\Windows\System\IRaYzYM.exe
  2⤵
  PID:9956
- C:\Windows\System\FJaKseJ.exe
  C:\Windows\System\FJaKseJ.exe
  2⤵
  PID:9972
- C:\Windows\System\rUszIOc.exe
  C:\Windows\System\rUszIOc.exe
  2⤵
  PID:9992
- C:\Windows\System\LCfPQwc.exe
  C:\Windows\System\LCfPQwc.exe
  2⤵
  PID:10008
- C:\Windows\System\PLTBGQq.exe
  C:\Windows\System\PLTBGQq.exe
  2⤵
  PID:10024
- C:\Windows\System\mNikNcj.exe
  C:\Windows\System\mNikNcj.exe
  2⤵
  PID:10040
- C:\Windows\System\HOplSLp.exe
  C:\Windows\System\HOplSLp.exe
  2⤵
  PID:10060
- C:\Windows\System\ZfMyZNh.exe
  C:\Windows\System\ZfMyZNh.exe
  2⤵
  PID:10192
- C:\Windows\System\yhjhFQK.exe
  C:\Windows\System\yhjhFQK.exe
  2⤵
  PID:10212
- C:\Windows\System\EsGxFAw.exe
  C:\Windows\System\EsGxFAw.exe
  2⤵
  PID:10228
- C:\Windows\System\tterMeZ.exe
  C:\Windows\System\tterMeZ.exe
  2⤵
  PID:8252
- C:\Windows\System\gHmwpNI.exe
  C:\Windows\System\gHmwpNI.exe
  2⤵
  PID:9004
- C:\Windows\System\NdDkQiR.exe
  C:\Windows\System\NdDkQiR.exe
  2⤵
  PID:9232
- C:\Windows\System\qDmaEns.exe
  C:\Windows\System\qDmaEns.exe
  2⤵
  PID:9280
- C:\Windows\System\cNzRSFE.exe
  C:\Windows\System\cNzRSFE.exe
  2⤵
  PID:9296
- C:\Windows\System\NYuWpyH.exe
  C:\Windows\System\NYuWpyH.exe
  2⤵
  PID:9316
- C:\Windows\System\YePeBkm.exe
  C:\Windows\System\YePeBkm.exe
  2⤵
  PID:9332
- C:\Windows\System\TIjOJNU.exe
  C:\Windows\System\TIjOJNU.exe
  2⤵
  PID:8472
- C:\Windows\System\RPVRtIB.exe
  C:\Windows\System\RPVRtIB.exe
  2⤵
  PID:8352
- C:\Windows\System\zcfXsAK.exe
  C:\Windows\System\zcfXsAK.exe
  2⤵
  PID:8160
- C:\Windows\System\LiZGcyp.exe
  C:\Windows\System\LiZGcyp.exe
  2⤵
  PID:9120
- C:\Windows\System\RIWeuRv.exe
  C:\Windows\System\RIWeuRv.exe
  2⤵
  PID:8268
- C:\Windows\System\OOekcoL.exe
  C:\Windows\System\OOekcoL.exe
  2⤵
  PID:8332
- C:\Windows\System\SfjRErm.exe
  C:\Windows\System\SfjRErm.exe
  2⤵
  PID:9252
- C:\Windows\System\XVOayys.exe
  C:\Windows\System\XVOayys.exe
  2⤵
  PID:9360
- C:\Windows\System\VdLQycP.exe
  C:\Windows\System\VdLQycP.exe
  2⤵
  PID:9392
- C:\Windows\System\DTAlIoD.exe
  C:\Windows\System\DTAlIoD.exe
  2⤵
  PID:9508
- C:\Windows\System\JzzakPQ.exe
  C:\Windows\System\JzzakPQ.exe
  2⤵
  PID:9536
- C:\Windows\System\pfnhaac.exe
  C:\Windows\System\pfnhaac.exe
  2⤵
  PID:9552
- C:\Windows\System\rpnavQO.exe
  C:\Windows\System\rpnavQO.exe
  2⤵
  PID:9612
- C:\Windows\System\IETmeFe.exe
  C:\Windows\System\IETmeFe.exe
  2⤵
  PID:9568
- C:\Windows\System\MpUZRNO.exe
  C:\Windows\System\MpUZRNO.exe
  2⤵
  PID:9632
- C:\Windows\System\VFOvboc.exe
  C:\Windows\System\VFOvboc.exe
  2⤵
  PID:9684
- C:\Windows\System\ubvMpOD.exe
  C:\Windows\System\ubvMpOD.exe
  2⤵
  PID:9696
- C:\Windows\System\iVWykmK.exe
  C:\Windows\System\iVWykmK.exe
  2⤵
  PID:9732
- C:\Windows\System\TkmPwde.exe
  C:\Windows\System\TkmPwde.exe
  2⤵
  PID:9760
- C:\Windows\System\zDREMEm.exe
  C:\Windows\System\zDREMEm.exe
  2⤵
  PID:9780
- C:\Windows\System\vgbPWdP.exe
  C:\Windows\System\vgbPWdP.exe
  2⤵
  PID:9796
- C:\Windows\System\nODeRsN.exe
  C:\Windows\System\nODeRsN.exe
  2⤵
  PID:9816
- C:\Windows\System\TPSivZN.exe
  C:\Windows\System\TPSivZN.exe
  2⤵
  PID:9824
- C:\Windows\System\vIxMHMz.exe
  C:\Windows\System\vIxMHMz.exe
  2⤵
  PID:10056
- C:\Windows\System\vBuSAlF.exe
  C:\Windows\System\vBuSAlF.exe
  2⤵
  PID:10004
- C:\Windows\System\KgIQtIF.exe
  C:\Windows\System\KgIQtIF.exe
  2⤵
  PID:9964
- C:\Windows\System\iIytCEX.exe
  C:\Windows\System\iIytCEX.exe
  2⤵
  PID:10080
- C:\Windows\System\GhcAgMV.exe
  C:\Windows\System\GhcAgMV.exe
  2⤵
  PID:10100
- C:\Windows\System\BSXIZQI.exe
  C:\Windows\System\BSXIZQI.exe
  2⤵
  PID:10112
- C:\Windows\System\nMrhxzI.exe
  C:\Windows\System\nMrhxzI.exe
  2⤵
  PID:10132
- C:\Windows\System\ixDFfgP.exe
  C:\Windows\System\ixDFfgP.exe
  2⤵
  PID:10152
- C:\Windows\System\ejVafFS.exe
  C:\Windows\System\ejVafFS.exe
  2⤵
  PID:10160
- C:\Windows\System\ZzUyQgB.exe
  C:\Windows\System\ZzUyQgB.exe
  2⤵
  PID:10180
- C:\Windows\System\uVrkkQk.exe
  C:\Windows\System\uVrkkQk.exe
  2⤵
  PID:10208
- C:\Windows\System\xSkSfxS.exe
  C:\Windows\System\xSkSfxS.exe
  2⤵
  PID:9220
- C:\Windows\System\TYtxPOO.exe
  C:\Windows\System\TYtxPOO.exe
  2⤵
  PID:9276
- C:\Windows\System\xmdiCtA.exe
  C:\Windows\System\xmdiCtA.exe
  2⤵
  PID:8552
- C:\Windows\System\MaPslRd.exe
  C:\Windows\System\MaPslRd.exe
  2⤵
  PID:8840
- C:\Windows\System\QALfkPb.exe
  C:\Windows\System\QALfkPb.exe
  2⤵
  PID:9312
- C:\Windows\System\MrssmVE.exe
  C:\Windows\System\MrssmVE.exe
  2⤵
  PID:8696
- C:\Windows\System\nfMPKmW.exe
  C:\Windows\System\nfMPKmW.exe
  2⤵
  PID:8968
- C:\Windows\System\JqfKUff.exe
  C:\Windows\System\JqfKUff.exe
  2⤵
  PID:10224
- C:\Windows\System\mHbdFKB.exe
  C:\Windows\System\mHbdFKB.exe
  2⤵
  PID:9404
- C:\Windows\System\EJUqhYk.exe
  C:\Windows\System\EJUqhYk.exe
  2⤵
  PID:9416
- C:\Windows\System\ItIYtGc.exe
  C:\Windows\System\ItIYtGc.exe
  2⤵
  PID:9432
- C:\Windows\System\FZnLcKi.exe
  C:\Windows\System\FZnLcKi.exe
  2⤵
  PID:9448
- C:\Windows\System\UMWwgmn.exe
  C:\Windows\System\UMWwgmn.exe
  2⤵
  PID:9664
- C:\Windows\System\nNczqlD.exe
  C:\Windows\System\nNczqlD.exe
  2⤵
  PID:9668
- C:\Windows\System\GzZycDb.exe
  C:\Windows\System\GzZycDb.exe
  2⤵
  PID:9716
- C:\Windows\System\fAzRNdY.exe
  C:\Windows\System\fAzRNdY.exe
  2⤵
  PID:9768
- C:\Windows\System\lVrgtFJ.exe
  C:\Windows\System\lVrgtFJ.exe
  2⤵
  PID:9792
- C:\Windows\System\uzbvlik.exe
  C:\Windows\System\uzbvlik.exe
  2⤵
  PID:9840
- C:\Windows\System\iJyObAz.exe
  C:\Windows\System\iJyObAz.exe
  2⤵
  PID:9848
- C:\Windows\System\vLVpyPL.exe
  C:\Windows\System\vLVpyPL.exe
  2⤵
  PID:9852
- C:\Windows\System\QgepnBG.exe
  C:\Windows\System\QgepnBG.exe
  2⤵
  PID:9904
- C:\Windows\System\cTTfski.exe
  C:\Windows\System\cTTfski.exe
  2⤵
  PID:9888
- C:\Windows\System\SJCxmEq.exe
  C:\Windows\System\SJCxmEq.exe
  2⤵
  PID:9944
- C:\Windows\System\JZdrcFj.exe
  C:\Windows\System\JZdrcFj.exe
  2⤵
  PID:9984
- C:\Windows\System\ZBcvzGC.exe
  C:\Windows\System\ZBcvzGC.exe
  2⤵
  PID:10052
- C:\Windows\System\qAhgZnH.exe
  C:\Windows\System\qAhgZnH.exe
  2⤵
  PID:10068
- C:\Windows\System\PrEzLod.exe
  C:\Windows\System\PrEzLod.exe
  2⤵
  PID:10000
- C:\Windows\System\PJRUaQM.exe
  C:\Windows\System\PJRUaQM.exe
  2⤵
  PID:10188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CctrfNn.exe

Filesize
1.4MB

MD5
8373a1b476648e0b00df3ddbb8de8b46

SHA1
e750380268659606c9c7c2932c2cad4ce84ba76b

SHA256
c15c513c48883b1bd13aa78626485ce802a7fb6e4afeb43307931f05ad3131ad

SHA512
477909dd5795e4bfb3e1da819d7c647145a8cd5a73b79ae0f65cb74900e898004981c3f2464750f79ef12db146648142cca8211258ec23f9c42f58635cb7b437

Download Submit
C:\Windows\system\FUFQheu.exe

Filesize
1.3MB

MD5
f8c5364e2c7cc998be5a77719f6ac5c3

SHA1
021c9534a54b27098a34ed06e1713a525c3a2c3e

SHA256
128a78cec8639173671be487ba2b520d17526e8b9ad58e17862a621c17c36131

SHA512
acfffda4e35fecf70bd81153baf02a8c7486a7c3038ec181cf18856f085bd7fcebaecb3a678772255258c5065f59887fccd1389f277ba57c007f7e760f63bbab

Download Submit
C:\Windows\system\KmEiiAf.exe

Filesize
1.4MB

MD5
e680def1ca2f5f1d267a8a98909c1e2f

SHA1
96215fae5cd3ef9fb8bfa0e0e5c64228a85973fe

SHA256
03be665a698f65812e282b23f30f802598b6ef70c58dcf8b36e507b9ea1fda64

SHA512
03effe914da14e3ad2442f2ceb0e06de9e14de4be41771af5576daf7b9d092ac23f10fda4e4658d2a80ef4de8d46323a7e028fb3a27ad6fa0bdf1f5109ba168e

Download Submit
C:\Windows\system\LSeCjwg.exe

Filesize
1.4MB

MD5
89349c76d43b4e91ea570610eb724257

SHA1
73d53ecb140e77f193c448316ddc842e1a7c20b6

SHA256
9ec08b781cdbc89904845973bfd0884bded8e50891989ae805016fa69442037d

SHA512
218a5f46761c7278b837b2b52d7a4ee474d894d0cdfbfc78f4214b7d65c427bad80e44d58990f47ccbd894b61d6ec982d7c941d336c44a8450d542aa916068ae

Download Submit
C:\Windows\system\MKWZexC.exe

Filesize
1.4MB

MD5
5faa8c8535cddaaa7b67a210849500e5

SHA1
f4f1e7fe29ea6d32992dd9cd8c53a6ae75a822ab

SHA256
488e5eea0bc33240b1a0c904b79e3641ac02d2030326d8115178bb46fd945ccd

SHA512
4a9d138e269ea4d6c009ff955a016bead22bcbaa80c9fdf5937b2c5b1fd28321bc6192ab08a8277c49e6978cc14c4aedba6a7f9f0e018a0e9df9250e967120af

Download Submit
C:\Windows\system\ORWPKUx.exe

Filesize
1.4MB

MD5
1e7884733961271db4d4df2f50fe1da0

SHA1
cf86abadb4fe125f3eb38846a39d4e92107c75ec

SHA256
492b1556d0759f83e2e1459d7963719c7bb51c006a240c074559c7d099e0a49e

SHA512
80bb738153fe3b03f75ce72cbe2785f554acb22d96f085f83de57fa01130abc7a262c8509688cf0b4c0050f6643cf12e6d3604dc9a7741d3edeef56e6a987af5

Download Submit
C:\Windows\system\OiAiNfT.exe

Filesize
1.3MB

MD5
a490f0077e4dd1efb3ee59ac975121ae

SHA1
5c37ff4657c8be0643ff00715f24bcca64438e73

SHA256
06d83c2c1b739a89381306faa2ee47e31f707dbb74639be0dfb7fcd468a9c3aa

SHA512
cfd765bee53493877cc106fadf808a1b01308289e2930530045764d73af609e0c60730760ce0d542b82c5454828c649199dfa8c7622cfb8469537f71b9ee9c5e

Download Submit
C:\Windows\system\PgXfCDF.exe

Filesize
1.3MB

MD5
41f194dd7c36ccfc13c3a09cc3fec883

SHA1
99759a28580fd8fef96d237a2bef168f5cf2cc59

SHA256
63123ebcc46c35e50d763237ee571fcae59038f9e1303ace188554de6a77a6e3

SHA512
d12a94dc4549aba3c92be024f3f7e4cf4ef00c7fb2f01a38cd792fcf0e5021221a6a80dbad8ad8b479ff7c6575fe317fc132f29df61efe8acb38f5817e68ffc9

Download Submit
C:\Windows\system\TtboauN.exe

Filesize
1.4MB

MD5
d63ea1a33f2ca86a8b23b1b02b2f6ca4

SHA1
28cb44835fcf4a3afefa11aae3794ca9ed3a08e0

SHA256
6322e51bbb47da8a8ec6d800ae42bd1c9c555bc073f90a99e45860b038bd66bc

SHA512
afa75f3e06b825a592e5005c228996157bceffdc22922e3c61e2ddb006a3a69e829237880fe9fa70b99386ad7c989decdc665b807c5e4d88db85d1f00a396386

Download Submit
C:\Windows\system\WDlwgQv.exe

Filesize
1.4MB

MD5
0841dd50c2629c8d6152aea9f7abcf25

SHA1
5d62a84f017baa59423a934a0d4c0baa15f47a15

SHA256
efb2396760c2ff31545261eb8f123377865560334d50baf027aab02a6141dd0c

SHA512
eb30da551d86f05ded3644c739e877d1a9311953c7e8c4057bace92bb38e72b331874ca1aa2de87998d86ae0c2eac4a98366e6701df36c24c8b99ee610ec7b38

Download Submit
C:\Windows\system\ZKpIxQg.exe

Filesize
1.4MB

MD5
81e6e4b1507832700fab240ebadd1852

SHA1
87421a0465f9504666fd59bb88adb3ff155229f8

SHA256
b80070ea06e1b856f2cf6ceec9f5c149f33cb1c1c651fc30241baa9d3d46e036

SHA512
c8a493cca8f687a5f21b434219d3779bfdbb14454da591f325a2e5edd4a4280802e6b1d89d6d4dd3e0fa004b04de5f8b1421d1bbb9c77b7726c990cd575ee9c4

Download Submit
C:\Windows\system\dEDCzDi.exe

Filesize
1.4MB

MD5
dd08915074d6f23517cde6aee88ac59f

SHA1
0a0b463be96b535e9e0ca043d27df846c27f6731

SHA256
1eaa3efa656f774c6df5b9a9eaf577d9faa2f960a6da777d82a33d21e9737729

SHA512
4683939645fbd5ec692a1b65fe8623a02418c36c63851dea6e5aba2327c1183303b7d2de23a088dbd06e3cc21898488c3a7aa128130cadb84400e07d14ca2a1c

Download Submit
C:\Windows\system\gRfnGNJ.exe

Filesize
1.3MB

MD5
4f75755da899c1ea563a8ae34ce4d304

SHA1
4c7ad342ba396676806b84bb15b5e8aecd84be7f

SHA256
7bbcd27620c65ee7592afa2103e84a3c9d89271e5688d2d02ad6450387d2e506

SHA512
e07acf5f39338f6236de360d7f4fa062462731cc15d4703515149c98dd4267310ec48221f6334bc24d29a68178a49266901c6ff9a9311d2feda838fc444b7879

Download Submit
C:\Windows\system\gSKdQUA.exe

Filesize
1.4MB

MD5
67b4d781ab5357f066f2ebb7eb624323

SHA1
8575eccc96a72aa9b155c0026c919ab845a74975

SHA256
aedf5f716f9deb3bc2b329414e82f8aca628be3d127cb1089f8b8baa30d63119

SHA512
368e050f60c7161e0f4878cad2c6f620a90cf57f5c11360966d247a55582da22dcf22b5c990488dc574b5a9dcc7b3d862308caf14809530001e529902c1bf38a

Download Submit
C:\Windows\system\hhnLaaS.exe

Filesize
1.4MB

MD5
2540075560bf51edfb4bfa66b3626774

SHA1
3fe8d3f34a7a0b92ba127eb3efd86dd88105f9b3

SHA256
0610b6d034cd7468a82fdeac2f7beb8ab8ae2f11c1f2a314814457dbc0411708

SHA512
d107b3d7047187e0fa6e0945f776cc4addb61e2b0dba6f4080ae2f17954541167ce6fef0ee9ce5df7fb0facd874546563a07af7c156bacb20277e30b4b721ed7

Download Submit
C:\Windows\system\lgSXVUY.exe

Filesize
1.4MB

MD5
c00e1e5e869239905ed771f8eeec952f

SHA1
267da185b38b53ba15829943e798941efe5274e4

SHA256
2a0bcd81de34e93fe0463933e18e655d6de361f051a236510258a484eb218bbb

SHA512
eab69eb11aaec889de3071c4d45c221f05b6bd44fd9620981a572ba90f35e79276b7dd38b8a037f192f3a3fb2a4cb75edf8a7143ceb27e45dfbbda25dc0bc5e4

Download Submit
C:\Windows\system\nsBUkoX.exe

Filesize
1.4MB

MD5
4718d949256c702ce5564d17615d7081

SHA1
d9c31d330be8fad977cec9d1481cbb393948f291

SHA256
10e8e1677ca1f0a3cb91b86757a1558c5e555168ee5d542ec8034f0c5f2d5b9a

SHA512
33df187da789ffb78af6c1d99c90312b503a26c2c1d3ae3e4cd7295cb16fc044e3b22e356ed36b5ea9427fc6d3dcf4313a8a44b335147d18ac307c4188a832d9

Download Submit
C:\Windows\system\qxjVtGs.exe

Filesize
1.4MB

MD5
c1c64a0d6cb8f939f0d07edea20f320e

SHA1
4eaf7ad84e4506723f1114f50c1b7349cf9015cc

SHA256
9f0d48275dcacdcbb6ed11a1eca0ae477f1fed2dba82b5e4121c2f78ae9569c1

SHA512
60908ee5e123345e011eaa88e8e354a23846c426c47a27ebfa6c432bf19540790230af63119d63a78eafedf37b2c3084dc5fd5adad1e5288daccda0d4f8d6116

Download Submit
C:\Windows\system\sSEBNnZ.exe

Filesize
1.4MB

MD5
f81d5e88ea3253a83c5f52fc6373113c

SHA1
33fb9c7aa758c56c5478e9444e4ee92a0a198f69

SHA256
653285960cf11c336df6bd1c2db52dae54844588b93dca096da6e51e672b212b

SHA512
081130ebee2dd80ca4c4fc2460a62f8a5f7c84e39fa8ad49c2c5d21d7c509d73629d01d3b3116196b979daeb8e75203e5649033ec48018dcd4678ef8a75be2b3

Download Submit
C:\Windows\system\tLaijZf.exe

Filesize
1.3MB

MD5
fadd6f5b8437f9a0d5cc1b6ea30f69ea

SHA1
811978ab40cc86a5ea78e974c4a91de8220bba51

SHA256
1c505fcbb1affc96fa56ffb0ccb100b98492121a35778517e2181eb2d3c15de0

SHA512
a14c66e9b6115f0f2b6edd96bda61554c5739b1d3caf63068a5ebd00b0fda2d5b0c1b4d69a07e9038e8e2384efa2f9737ac58f9c7408f5d570fa125b41fc142e

Download Submit
C:\Windows\system\uKkqjDW.exe

Filesize
1.4MB

MD5
65f8e6b93d2f688b5883e78e2e30bbd2

SHA1
43ff2527134843047c198e37ae0997d94e436c39

SHA256
ac0da0ce56124dee3c4dcd4e9110d40229385bad41f99a63e14406283350eb27

SHA512
f19c6dd319d6166d44895fc8a9d38ea5b63c77c76128c4870752229b9f41b2e5134cbd5e31d430e05e1c669040574412b5af94e5e112b8db55922f30b3845fc7

Download Submit
C:\Windows\system\vCutGCC.exe

Filesize
1.4MB

MD5
b0989741db699bda53dae88e39882ea2

SHA1
f56247edafcbcff7766e1f90f64b3d6f51f0180a

SHA256
56957dfaea28cf057614c95ea48c5af93c572dabeb39c720ea6cdf958953ecf8

SHA512
906ccdcaf59676e0b81b0992ca5b568e4013fa289ad70a267e08c3a868e2779e8399cae176f5a096f8fe32004087e2cd41c63a19e56f5c1534bc782b1b44ae91

Download Submit
C:\Windows\system\worGFvV.exe

Filesize
1.4MB

MD5
1acafa94a0efae9233cf95c92615ff5f

SHA1
919a2e3f169b4c3cdaf883a26564b810f0bc4610

SHA256
19808c306c6a54178a5f2504978f18b7bdae20accfded3bf696ad6a789b0ade0

SHA512
28b9be59d7b25aa13172dbb1ace3a38daf06756a78bf8d215c8dd79b0aa1b0cd39fce4a736b343cb3614f5990d0a29056c3894d2987dfb1fd07c681e30004f76

Download Submit
\Windows\system\QygqlIX.exe

Filesize
1.4MB

MD5
2219e16a1dcdbd16799a3a79916d3cd7

SHA1
f9d9a00e1ef8cde76a99f371700ee77f25adb4d9

SHA256
2c8e8b1da8495cb60883867989235afc8cceeb8b6a06e1102692a106f575a47f

SHA512
c479725184deeea33285adfc4462bb9c4aae9d5fdd2377ca98e2c9699397a1463129837137f40d3385cfc435bddf1418b82220afdb530a4ed2cfcdded6fec1b3

Download Submit
\Windows\system\TbctGqi.exe

Filesize
1.4MB

MD5
5c56cb42e7b80d2e5a5fa737f14fb465

SHA1
0522f5991f6e208ea30cda08decccda70207456b

SHA256
8f14aa7f72e2ae3adf11907382704b67bf48e37dcff0ffcd03e69ca4bdf3bb2c

SHA512
c20c6e32d70194d3162958133a7c97d9deafec39958bf31715ecccd4c895aac21112e65f6d7d93cd75c39dba017ae649912903bed03c661f542ab52edb8dc84b

Download Submit
\Windows\system\YFRFsUi.exe

Filesize
1.4MB

MD5
4d1a6917d02bbd195024f0d37ea704a6

SHA1
22f4a939ba6057e61624226551c17952ce0acb86

SHA256
1b1d7a420312fac01fdba7bc7637278aca2612c26ad977ca10d897428d8c6081

SHA512
a2e14c4a0ca6c7961eac857257d400ded9bee430d1d2a83b2290976177f85bdf7e749f443ccd47b963399d02389acc51b41a867f6ffd0606d7889b33afdd4422

Download Submit
\Windows\system\iqkulvz.exe

Filesize
1.4MB

MD5
11cced2bd4b83b42eb601321951ff0b9

SHA1
9464b987a10b6a300765506bd66de8e469274e01

SHA256
e61d3b71a474f77f4e4ef5fef403b7c4c133c125c4feff7a3bdb4880b612d114

SHA512
967c810ba62f6df0b208e401e4ae7cfbeb30e15bf28a73a38cb13330a600cfc23a70a0db0574762a00522b0aeda1b19de17b45cda3c59b45f88b8562823dfe7d

Download Submit
\Windows\system\kNLRNjD.exe

Filesize
1.3MB

MD5
09c3212cd62e10b9e6b7b3fdffdf0b78

SHA1
079ea0d6300232f797a6fae0417740d49879e521

SHA256
a1883b478dd256b738301ba5096de4058496c65fe247d9a0b1f1bfa17d0f9d4a

SHA512
9eb26dc98f182acbb82e03fed2c9f3c4ad530563ce38333e57e391357c9165ad2138928568b38b0dc5a98801b0296721659755c27e4c9c14d2a06a23388a7138

Download Submit
\Windows\system\nGhDidv.exe

Filesize
1.4MB

MD5
423f630c89123ad0a4c5bb4d8156760a

SHA1
ad52f2106a22d74178be8d93e101c31a50014ff6

SHA256
66110bc31b48f9f58fc8111ae0da816557a9c78a4c554198792826533013aaf8

SHA512
d23ce3441eb6ddd91522ed0723cd433afe0f8e931217ed169ee5c7e1b1401f0ab03c85557e0942611d9100bfd186408ab9c35fb495b52c1e5d30065efb32f534

Download Submit
\Windows\system\rmxGXFr.exe

Filesize
1.4MB

MD5
c70dab256f686f9c20267c29dcb79131

SHA1
c1b5f5afabde170b7bfbcaa81ff125398a13f7f3

SHA256
4cf6405994f1eb3b371f638e1052e7eec9dd65ec1f92fe58ecdfe7c610fad53e

SHA512
7d809f6f4b63c2e9f67f3a9418caadec58e375f12a51940dd8e691a7adcb974cf0c678f4fb80b8979bbcd54e19d6abf65e9a4460e70b6b28875f3759346f66d7

Download Submit
\Windows\system\skgZhFK.exe

Filesize
1.4MB

MD5
6671300e6652684b72ee8b61f88b0aa8

SHA1
b31e33fe24a2678dca82d4180ebed684ac248fd5

SHA256
6767fa8a45a6204d31ae9711c77f9baff941d9f6b5fb634eb4f5d7f87e10a515

SHA512
dff3153a113b254e95e48e974042292c8bbab1a3dbca2202cf75208dde4e4d0974780d625e245131a9b4ce676eac8d9b841e7b1a821124bd5d2ffa0039596d28

Download Submit
\Windows\system\xJAAGdT.exe

Filesize
1.4MB

MD5
5d8c58d19a8c5d3fa978e8ee6b029f63

SHA1
02aec55ae0e6cb9c7608c2363a6125f8c65bea5e

SHA256
b23844a9dcbc5904c6aad72c8bd492b89a29a7fe8f53d4bf5488a4205789c074

SHA512
914b6f81853c18df16015d6db6725eaff4a125b0f661862c436a8e2f01f5473c75ebf9e36fd08759c089404b737ba7e41e42c93cf1210a75c0644ff45383f14a

Download Submit
memory/856-116-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/856-4031-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-101-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-107-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1540-4007-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-103-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/1540-12-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/1540-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1540-88-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/1540-115-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-98-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/1540-1-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-96-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/1540-105-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1540-94-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-109-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-118-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2196-86-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-15-0x000007FEF5E1E000-0x000007FEF5E1F000-memory.dmp

Filesize
4KB

Download
memory/2196-14-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/2196-92-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2196-303-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-99-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2244-114-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-4029-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-102-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-4021-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-108-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2368-4028-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2400-100-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2400-4017-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2428-104-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-4025-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-87-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-4012-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-4013-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2600-93-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2624-95-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-4020-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-106-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2780-4024-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2856-4016-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-97-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-4009-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2952-13-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download