xmrig | 817d881d612228a9e059b2c8461e925bda24793e91786e510bac72684efa3660

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
Size

2.2MB
MD5

02f0e154b5af11cefdd1e87c3dbd5eb5
SHA1

fc050ff0c1ed4e00ec07230f7a40d9faabc04796
SHA256

817d881d612228a9e059b2c8461e925bda24793e91786e510bac72684efa3660
SHA512

e982679e7f1b56fe9137408f40fdea97c3ced312149f4840c96649f61ecf5894a753bd76bc8d28dc1be0f82b5249897190470f0687fd58bb60b143970d2b291e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD0:NABv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2912-44-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2496-52-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/3048-21-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2348-51-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2364-47-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2272-73-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/1452-121-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/1360-116-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2376-1019-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2912-86-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2656-39-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2480-34-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3048	waapcFx.exe
2480	rMvLYEc.exe
2656	CyiIhqb.exe
2348	tJUIxDN.exe
2364	uFwTCdU.exe
2496	BXjLBYc.exe
2376	QmMxsLN.exe
2060	WyhfyjF.exe
2800	UoCcKgc.exe
2272	jXdgUyC.exe
1360	cUvMtkt.exe
1452	rRvhowC.exe
1552	xpbmrPx.exe
2328	vtwPXlr.exe
1544	PunDmVh.exe
1796	LOVpliR.exe
1736	CYBzBNQ.exe
1772	EZmzPwA.exe
1744	HOMnPvE.exe
2124	fEaeQZK.exe
2608	xFJgpIu.exe
1200	HXMROsL.exe
672	BerEUwZ.exe
572	bvICkVv.exe
2408	uwLOapn.exe
2936	BKFaAIy.exe
2312	APxQQQV.exe
2748	kZfonIm.exe
2244	SGzUNUg.exe
816	kjvGsgf.exe
2052	ZCUUMqj.exe
888	WwkYweD.exe
2568	gwIGUxe.exe
1572	nwJCwCb.exe
1688	prvlrka.exe
1608	YaYtGsz.exe
2736	ySGpJHt.exe
2172	oMnjiwj.exe
1892	xTAGvdm.exe
1496	hlBTYVm.exe
2492	POWbXTR.exe
2532	XULdRLt.exe
2644	JODtdxh.exe
2632	vlPrJsu.exe
3040	XkpaQaw.exe
808	cxuqWcQ.exe
2068	mgckJnZ.exe
2588	scEtGOh.exe
1652	vZBpfhU.exe
528	DxFlCaS.exe
1196	EgzBblt.exe
2504	ojQgoQF.exe
360	SNyLmRx.exe
988	pqYZxjf.exe
2852	CTRVuPG.exe
2464	JjNcLDT.exe
2100	bmGwymE.exe
980	sXQbSYP.exe
2168	JtDtDsn.exe
2624	rbHNSWx.exe
2164	iYemgYa.exe
3044	tSrcFNO.exe
1404	RlQSwYV.exe
1396	uUAUjZm.exe

Loads dropped DLL 64 IoCs

pid	Process
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2912-0-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x000b000000014457-3.dat	upx
behavioral1/files/0x0007000000014b1c-13.dat	upx
behavioral1/files/0x0007000000014c2d-37.dat	upx
behavioral1/memory/2496-52-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-30.dat	upx
behavioral1/files/0x0007000000015cc5-55.dat	upx
behavioral1/memory/2912-56-0x0000000003930000-0x0000000003D22000-memory.dmp	upx
behavioral1/memory/2376-54-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/3048-21-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2348-51-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0006000000015cd2-60.dat	upx
behavioral1/memory/2364-47-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0006000000015cee-74.dat	upx
behavioral1/memory/2272-73-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-72.dat	upx
behavioral1/memory/2060-70-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/files/0x0038000000014713-80.dat	upx
behavioral1/files/0x0006000000015cf8-87.dat	upx
behavioral1/files/0x0006000000015d59-102.dat	upx
behavioral1/files/0x0006000000015f23-125.dat	upx
behavioral1/files/0x0006000000015d9c-135.dat	upx
behavioral1/files/0x0006000000015d61-129.dat	upx
behavioral1/files/0x0006000000016013-139.dat	upx
behavioral1/files/0x0006000000015d39-127.dat	upx
behavioral1/files/0x0006000000015d85-124.dat	upx
behavioral1/files/0x0006000000015d21-122.dat	upx
behavioral1/memory/1452-121-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/files/0x0006000000015d0a-108.dat	upx
behavioral1/files/0x0006000000016ce0-189.dat	upx
behavioral1/files/0x0006000000016c84-182.dat	upx
behavioral1/files/0x0006000000016c30-175.dat	upx
behavioral1/files/0x0006000000016a28-167.dat	upx
behavioral1/files/0x0006000000016575-160.dat	upx
behavioral1/files/0x00060000000163eb-152.dat	upx
behavioral1/files/0x0006000000016122-143.dat	upx
behavioral1/files/0x0006000000015fa6-136.dat	upx
behavioral1/memory/1360-116-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2376-1019-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/files/0x0006000000016cb5-187.dat	upx
behavioral1/files/0x0006000000016c38-180.dat	upx
behavioral1/files/0x0006000000016c1f-173.dat	upx
behavioral1/files/0x00060000000167bf-165.dat	upx
behavioral1/files/0x00060000000164ec-157.dat	upx
behavioral1/files/0x00060000000161ee-148.dat	upx
behavioral1/memory/2912-86-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0007000000014bd7-41.dat	upx
behavioral1/memory/2656-39-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x000a00000001507a-38.dat	upx
behavioral1/memory/2480-34-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/files/0x0038000000014709-11.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kfWQBnz.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\noDubCS.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\iJUdqVj.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\ADreiMA.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\HEjLNXc.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\qrVyjgk.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\ObRWppb.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\DpxtTva.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\PhRxBCW.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\UNzGMpl.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\BTfSbDM.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\ZdCHGtV.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\FZHqaKp.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\BuldMcu.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\jXdgUyC.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\eyuhezx.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\VqUXomH.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\kRGPyPu.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\QNacWYK.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\XdnnoCV.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\VolDpvP.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\MohnNVz.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\nqdnZEL.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\AezYGhR.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\jdCizUe.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\tftOVGA.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\QmMxsLN.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\SGzUNUg.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\OQPtlZW.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\kBcELFH.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\uKHBSnx.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\tfotkgB.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\AtFiyjy.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\QWeHslk.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\YNIwUMe.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\UPlDEHV.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\YiTJeKw.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\GZQLgSc.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\VkTGzvW.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\dmNKfwE.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\hotLqUE.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\wfATjJW.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\SJbZRLB.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\TvpSMRV.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\RlCruli.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\vCGtbYn.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\gNATaXi.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\mmygQsw.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\NvEPHOF.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\hlBTYVm.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\KSdSGVy.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\uKpPuKm.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\QzgXsnE.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\YysBbsN.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\hbvxgtL.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\AKEKKTL.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\JWATeWc.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\tiFmQoX.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\HqCPETa.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\fuUWiUM.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\AfDYzTU.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\RkbyGZv.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\dGCrrjv.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
File created	C:\Windows\System\YoCXiyD.exe	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3000	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
Token: SeDebugPrivilege	3000	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3000	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	29
PID 2912 wrote to memory of 3000	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	29
PID 2912 wrote to memory of 3000	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	29
PID 2912 wrote to memory of 3048	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	30
PID 2912 wrote to memory of 3048	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	30
PID 2912 wrote to memory of 3048	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2480	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	31
PID 2912 wrote to memory of 2480	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	31
PID 2912 wrote to memory of 2480	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	31
PID 2912 wrote to memory of 2656	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2656	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2656	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	32
PID 2912 wrote to memory of 2496	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2496	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2496	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	33
PID 2912 wrote to memory of 2348	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2348	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2348	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	34
PID 2912 wrote to memory of 2376	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	35
PID 2912 wrote to memory of 2376	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	35
PID 2912 wrote to memory of 2376	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	35
PID 2912 wrote to memory of 2364	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	36
PID 2912 wrote to memory of 2364	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	36
PID 2912 wrote to memory of 2364	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	36
PID 2912 wrote to memory of 2800	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	37
PID 2912 wrote to memory of 2800	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	37
PID 2912 wrote to memory of 2800	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	37
PID 2912 wrote to memory of 2060	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	38
PID 2912 wrote to memory of 2060	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	38
PID 2912 wrote to memory of 2060	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	38
PID 2912 wrote to memory of 2272	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	39
PID 2912 wrote to memory of 2272	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	39
PID 2912 wrote to memory of 2272	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	39
PID 2912 wrote to memory of 1360	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	40
PID 2912 wrote to memory of 1360	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	40
PID 2912 wrote to memory of 1360	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	40
PID 2912 wrote to memory of 1452	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	41
PID 2912 wrote to memory of 1452	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	41
PID 2912 wrote to memory of 1452	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	41
PID 2912 wrote to memory of 1552	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	42
PID 2912 wrote to memory of 1552	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	42
PID 2912 wrote to memory of 1552	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	42
PID 2912 wrote to memory of 2328	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	43
PID 2912 wrote to memory of 2328	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	43
PID 2912 wrote to memory of 2328	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	43
PID 2912 wrote to memory of 1544	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	44
PID 2912 wrote to memory of 1544	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	44
PID 2912 wrote to memory of 1544	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	44
PID 2912 wrote to memory of 1744	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	45
PID 2912 wrote to memory of 1744	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	45
PID 2912 wrote to memory of 1744	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	45
PID 2912 wrote to memory of 1796	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	46
PID 2912 wrote to memory of 1796	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	46
PID 2912 wrote to memory of 1796	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	46
PID 2912 wrote to memory of 2124	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	47
PID 2912 wrote to memory of 2124	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	47
PID 2912 wrote to memory of 2124	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	47
PID 2912 wrote to memory of 1736	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	48
PID 2912 wrote to memory of 1736	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	48
PID 2912 wrote to memory of 1736	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	48
PID 2912 wrote to memory of 2608	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	49
PID 2912 wrote to memory of 2608	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	49
PID 2912 wrote to memory of 2608	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	49
PID 2912 wrote to memory of 1772	2912	02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f0e154b5af11cefdd1e87c3dbd5eb5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\System\waapcFx.exe
  C:\Windows\System\waapcFx.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\rMvLYEc.exe
  C:\Windows\System\rMvLYEc.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\CyiIhqb.exe
  C:\Windows\System\CyiIhqb.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\BXjLBYc.exe
  C:\Windows\System\BXjLBYc.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\tJUIxDN.exe
  C:\Windows\System\tJUIxDN.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\QmMxsLN.exe
  C:\Windows\System\QmMxsLN.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\uFwTCdU.exe
  C:\Windows\System\uFwTCdU.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\UoCcKgc.exe
  C:\Windows\System\UoCcKgc.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\WyhfyjF.exe
  C:\Windows\System\WyhfyjF.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\jXdgUyC.exe
  C:\Windows\System\jXdgUyC.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\cUvMtkt.exe
  C:\Windows\System\cUvMtkt.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\rRvhowC.exe
  C:\Windows\System\rRvhowC.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\xpbmrPx.exe
  C:\Windows\System\xpbmrPx.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\vtwPXlr.exe
  C:\Windows\System\vtwPXlr.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\PunDmVh.exe
  C:\Windows\System\PunDmVh.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\HOMnPvE.exe
  C:\Windows\System\HOMnPvE.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\LOVpliR.exe
  C:\Windows\System\LOVpliR.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fEaeQZK.exe
  C:\Windows\System\fEaeQZK.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\CYBzBNQ.exe
  C:\Windows\System\CYBzBNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\xFJgpIu.exe
  C:\Windows\System\xFJgpIu.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\EZmzPwA.exe
  C:\Windows\System\EZmzPwA.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\iYemgYa.exe
  C:\Windows\System\iYemgYa.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\HXMROsL.exe
  C:\Windows\System\HXMROsL.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\tSrcFNO.exe
  C:\Windows\System\tSrcFNO.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\BerEUwZ.exe
  C:\Windows\System\BerEUwZ.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\RlQSwYV.exe
  C:\Windows\System\RlQSwYV.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\bvICkVv.exe
  C:\Windows\System\bvICkVv.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\uUAUjZm.exe
  C:\Windows\System\uUAUjZm.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\uwLOapn.exe
  C:\Windows\System\uwLOapn.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\mURmCVb.exe
  C:\Windows\System\mURmCVb.exe
  2⤵
  PID:836
- C:\Windows\System\BKFaAIy.exe
  C:\Windows\System\BKFaAIy.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\WRrRFPn.exe
  C:\Windows\System\WRrRFPn.exe
  2⤵
  PID:2840
- C:\Windows\System\APxQQQV.exe
  C:\Windows\System\APxQQQV.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\KwFDiKc.exe
  C:\Windows\System\KwFDiKc.exe
  2⤵
  PID:3068
- C:\Windows\System\kZfonIm.exe
  C:\Windows\System\kZfonIm.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\tvPLiLU.exe
  C:\Windows\System\tvPLiLU.exe
  2⤵
  PID:1204
- C:\Windows\System\SGzUNUg.exe
  C:\Windows\System\SGzUNUg.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\wPtcOox.exe
  C:\Windows\System\wPtcOox.exe
  2⤵
  PID:1280
- C:\Windows\System\kjvGsgf.exe
  C:\Windows\System\kjvGsgf.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\abuGsea.exe
  C:\Windows\System\abuGsea.exe
  2⤵
  PID:760
- C:\Windows\System\ZCUUMqj.exe
  C:\Windows\System\ZCUUMqj.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\texgqma.exe
  C:\Windows\System\texgqma.exe
  2⤵
  PID:332
- C:\Windows\System\WwkYweD.exe
  C:\Windows\System\WwkYweD.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\jGuniwq.exe
  C:\Windows\System\jGuniwq.exe
  2⤵
  PID:1120
- C:\Windows\System\gwIGUxe.exe
  C:\Windows\System\gwIGUxe.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\lyxZfDM.exe
  C:\Windows\System\lyxZfDM.exe
  2⤵
  PID:2028
- C:\Windows\System\nwJCwCb.exe
  C:\Windows\System\nwJCwCb.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\VHihPMl.exe
  C:\Windows\System\VHihPMl.exe
  2⤵
  PID:1700
- C:\Windows\System\prvlrka.exe
  C:\Windows\System\prvlrka.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\dGCrrjv.exe
  C:\Windows\System\dGCrrjv.exe
  2⤵
  PID:2216
- C:\Windows\System\YaYtGsz.exe
  C:\Windows\System\YaYtGsz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\dPFGBLA.exe
  C:\Windows\System\dPFGBLA.exe
  2⤵
  PID:1992
- C:\Windows\System\ySGpJHt.exe
  C:\Windows\System\ySGpJHt.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\sdTlAwn.exe
  C:\Windows\System\sdTlAwn.exe
  2⤵
  PID:2188
- C:\Windows\System\oMnjiwj.exe
  C:\Windows\System\oMnjiwj.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\dvYnNUu.exe
  C:\Windows\System\dvYnNUu.exe
  2⤵
  PID:2032
- C:\Windows\System\xTAGvdm.exe
  C:\Windows\System\xTAGvdm.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\fkskeZt.exe
  C:\Windows\System\fkskeZt.exe
  2⤵
  PID:2988
- C:\Windows\System\hlBTYVm.exe
  C:\Windows\System\hlBTYVm.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\TxBstYG.exe
  C:\Windows\System\TxBstYG.exe
  2⤵
  PID:1612
- C:\Windows\System\POWbXTR.exe
  C:\Windows\System\POWbXTR.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\TrCfYkt.exe
  C:\Windows\System\TrCfYkt.exe
  2⤵
  PID:2456
- C:\Windows\System\XULdRLt.exe
  C:\Windows\System\XULdRLt.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\KSdSGVy.exe
  C:\Windows\System\KSdSGVy.exe
  2⤵
  PID:2156
- C:\Windows\System\JODtdxh.exe
  C:\Windows\System\JODtdxh.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\zeDePFl.exe
  C:\Windows\System\zeDePFl.exe
  2⤵
  PID:1720
- C:\Windows\System\vlPrJsu.exe
  C:\Windows\System\vlPrJsu.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\oJLuxEa.exe
  C:\Windows\System\oJLuxEa.exe
  2⤵
  PID:296
- C:\Windows\System\XkpaQaw.exe
  C:\Windows\System\XkpaQaw.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\lhGBsHg.exe
  C:\Windows\System\lhGBsHg.exe
  2⤵
  PID:1352
- C:\Windows\System\cxuqWcQ.exe
  C:\Windows\System\cxuqWcQ.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\DufdURv.exe
  C:\Windows\System\DufdURv.exe
  2⤵
  PID:384
- C:\Windows\System\mgckJnZ.exe
  C:\Windows\System\mgckJnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\FBpgpZU.exe
  C:\Windows\System\FBpgpZU.exe
  2⤵
  PID:1780
- C:\Windows\System\scEtGOh.exe
  C:\Windows\System\scEtGOh.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\wbsnXGQ.exe
  C:\Windows\System\wbsnXGQ.exe
  2⤵
  PID:2380
- C:\Windows\System\vZBpfhU.exe
  C:\Windows\System\vZBpfhU.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\eZvORsp.exe
  C:\Windows\System\eZvORsp.exe
  2⤵
  PID:2920
- C:\Windows\System\DxFlCaS.exe
  C:\Windows\System\DxFlCaS.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\tMTsDfl.exe
  C:\Windows\System\tMTsDfl.exe
  2⤵
  PID:2084
- C:\Windows\System\EgzBblt.exe
  C:\Windows\System\EgzBblt.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\lNftzxA.exe
  C:\Windows\System\lNftzxA.exe
  2⤵
  PID:2512
- C:\Windows\System\ojQgoQF.exe
  C:\Windows\System\ojQgoQF.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\dIsZtxL.exe
  C:\Windows\System\dIsZtxL.exe
  2⤵
  PID:952
- C:\Windows\System\SNyLmRx.exe
  C:\Windows\System\SNyLmRx.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\eyuhezx.exe
  C:\Windows\System\eyuhezx.exe
  2⤵
  PID:2208
- C:\Windows\System\pqYZxjf.exe
  C:\Windows\System\pqYZxjf.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\RvtQPKb.exe
  C:\Windows\System\RvtQPKb.exe
  2⤵
  PID:1424
- C:\Windows\System\CTRVuPG.exe
  C:\Windows\System\CTRVuPG.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\qPmTuIW.exe
  C:\Windows\System\qPmTuIW.exe
  2⤵
  PID:1820
- C:\Windows\System\JjNcLDT.exe
  C:\Windows\System\JjNcLDT.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\PdAekml.exe
  C:\Windows\System\PdAekml.exe
  2⤵
  PID:2232
- C:\Windows\System\bmGwymE.exe
  C:\Windows\System\bmGwymE.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\hTDeKEC.exe
  C:\Windows\System\hTDeKEC.exe
  2⤵
  PID:2572
- C:\Windows\System\sXQbSYP.exe
  C:\Windows\System\sXQbSYP.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\NQttdtR.exe
  C:\Windows\System\NQttdtR.exe
  2⤵
  PID:2980
- C:\Windows\System\JtDtDsn.exe
  C:\Windows\System\JtDtDsn.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\MtAIDbP.exe
  C:\Windows\System\MtAIDbP.exe
  2⤵
  PID:2476
- C:\Windows\System\rbHNSWx.exe
  C:\Windows\System\rbHNSWx.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\kFjYwnk.exe
  C:\Windows\System\kFjYwnk.exe
  2⤵
  PID:1628
- C:\Windows\System\vukVWuE.exe
  C:\Windows\System\vukVWuE.exe
  2⤵
  PID:3328
- C:\Windows\System\hsAhcwq.exe
  C:\Windows\System\hsAhcwq.exe
  2⤵
  PID:3372
- C:\Windows\System\hbULcIm.exe
  C:\Windows\System\hbULcIm.exe
  2⤵
  PID:3404
- C:\Windows\System\SsSJIkb.exe
  C:\Windows\System\SsSJIkb.exe
  2⤵
  PID:3444
- C:\Windows\System\YIGznwy.exe
  C:\Windows\System\YIGznwy.exe
  2⤵
  PID:3468
- C:\Windows\System\bKenTHQ.exe
  C:\Windows\System\bKenTHQ.exe
  2⤵
  PID:3496
- C:\Windows\System\JlRpziI.exe
  C:\Windows\System\JlRpziI.exe
  2⤵
  PID:3516
- C:\Windows\System\zhKwMkE.exe
  C:\Windows\System\zhKwMkE.exe
  2⤵
  PID:3536
- C:\Windows\System\gPteuHr.exe
  C:\Windows\System\gPteuHr.exe
  2⤵
  PID:3556
- C:\Windows\System\fWPfoIa.exe
  C:\Windows\System\fWPfoIa.exe
  2⤵
  PID:3576
- C:\Windows\System\nargqyS.exe
  C:\Windows\System\nargqyS.exe
  2⤵
  PID:3596
- C:\Windows\System\TyReIuX.exe
  C:\Windows\System\TyReIuX.exe
  2⤵
  PID:3616
- C:\Windows\System\KYqZjic.exe
  C:\Windows\System\KYqZjic.exe
  2⤵
  PID:3640
- C:\Windows\System\UPlDEHV.exe
  C:\Windows\System\UPlDEHV.exe
  2⤵
  PID:3656
- C:\Windows\System\KwSYnTu.exe
  C:\Windows\System\KwSYnTu.exe
  2⤵
  PID:3684
- C:\Windows\System\Zgpgjne.exe
  C:\Windows\System\Zgpgjne.exe
  2⤵
  PID:3700
- C:\Windows\System\ADRVQbb.exe
  C:\Windows\System\ADRVQbb.exe
  2⤵
  PID:3724
- C:\Windows\System\FRbZfuw.exe
  C:\Windows\System\FRbZfuw.exe
  2⤵
  PID:3740
- C:\Windows\System\VHqdpYn.exe
  C:\Windows\System\VHqdpYn.exe
  2⤵
  PID:3764
- C:\Windows\System\bTkFtZB.exe
  C:\Windows\System\bTkFtZB.exe
  2⤵
  PID:3784
- C:\Windows\System\skJVtub.exe
  C:\Windows\System\skJVtub.exe
  2⤵
  PID:3804
- C:\Windows\System\kfWQBnz.exe
  C:\Windows\System\kfWQBnz.exe
  2⤵
  PID:3824
- C:\Windows\System\vCGtbYn.exe
  C:\Windows\System\vCGtbYn.exe
  2⤵
  PID:3844
- C:\Windows\System\fHoAtrw.exe
  C:\Windows\System\fHoAtrw.exe
  2⤵
  PID:3868
- C:\Windows\System\VbifKVF.exe
  C:\Windows\System\VbifKVF.exe
  2⤵
  PID:3884
- C:\Windows\System\lTTmFEQ.exe
  C:\Windows\System\lTTmFEQ.exe
  2⤵
  PID:3908
- C:\Windows\System\PQDXcns.exe
  C:\Windows\System\PQDXcns.exe
  2⤵
  PID:3924
- C:\Windows\System\VmneCxt.exe
  C:\Windows\System\VmneCxt.exe
  2⤵
  PID:3940
- C:\Windows\System\DeOHtUB.exe
  C:\Windows\System\DeOHtUB.exe
  2⤵
  PID:3964
- C:\Windows\System\GXgBjPP.exe
  C:\Windows\System\GXgBjPP.exe
  2⤵
  PID:3984
- C:\Windows\System\IadaXCk.exe
  C:\Windows\System\IadaXCk.exe
  2⤵
  PID:4000
- C:\Windows\System\PtAksvZ.exe
  C:\Windows\System\PtAksvZ.exe
  2⤵
  PID:4016
- C:\Windows\System\jZhLpOh.exe
  C:\Windows\System\jZhLpOh.exe
  2⤵
  PID:4032
- C:\Windows\System\PNquMar.exe
  C:\Windows\System\PNquMar.exe
  2⤵
  PID:4060
- C:\Windows\System\XZlCJdL.exe
  C:\Windows\System\XZlCJdL.exe
  2⤵
  PID:4076
- C:\Windows\System\crtFCgv.exe
  C:\Windows\System\crtFCgv.exe
  2⤵
  PID:4092
- C:\Windows\System\MuGuYyY.exe
  C:\Windows\System\MuGuYyY.exe
  2⤵
  PID:1100
- C:\Windows\System\jqWPOVD.exe
  C:\Windows\System\jqWPOVD.exe
  2⤵
  PID:1548
- C:\Windows\System\WXkWNAw.exe
  C:\Windows\System\WXkWNAw.exe
  2⤵
  PID:1476
- C:\Windows\System\jOsKICq.exe
  C:\Windows\System\jOsKICq.exe
  2⤵
  PID:908
- C:\Windows\System\FvkbJcA.exe
  C:\Windows\System\FvkbJcA.exe
  2⤵
  PID:2868
- C:\Windows\System\ftxXWyj.exe
  C:\Windows\System\ftxXWyj.exe
  2⤵
  PID:2944
- C:\Windows\System\klQASSH.exe
  C:\Windows\System\klQASSH.exe
  2⤵
  PID:1188
- C:\Windows\System\PMikxLg.exe
  C:\Windows\System\PMikxLg.exe
  2⤵
  PID:3340
- C:\Windows\System\JvgWBXV.exe
  C:\Windows\System\JvgWBXV.exe
  2⤵
  PID:3360
- C:\Windows\System\CoEDTeW.exe
  C:\Windows\System\CoEDTeW.exe
  2⤵
  PID:3344
- C:\Windows\System\kdkQYXj.exe
  C:\Windows\System\kdkQYXj.exe
  2⤵
  PID:1584
- C:\Windows\System\loIYEVT.exe
  C:\Windows\System\loIYEVT.exe
  2⤵
  PID:1952
- C:\Windows\System\nEVbTvL.exe
  C:\Windows\System\nEVbTvL.exe
  2⤵
  PID:3440
- C:\Windows\System\bYvOAhs.exe
  C:\Windows\System\bYvOAhs.exe
  2⤵
  PID:1480
- C:\Windows\System\VWGWWoY.exe
  C:\Windows\System\VWGWWoY.exe
  2⤵
  PID:2076
- C:\Windows\System\heGJmDS.exe
  C:\Windows\System\heGJmDS.exe
  2⤵
  PID:1532
- C:\Windows\System\MhtPEmi.exe
  C:\Windows\System\MhtPEmi.exe
  2⤵
  PID:2536
- C:\Windows\System\aEwPpUl.exe
  C:\Windows\System\aEwPpUl.exe
  2⤵
  PID:3464
- C:\Windows\System\zxPdgJJ.exe
  C:\Windows\System\zxPdgJJ.exe
  2⤵
  PID:1504
- C:\Windows\System\ebyGYbg.exe
  C:\Windows\System\ebyGYbg.exe
  2⤵
  PID:480
- C:\Windows\System\CfwHsUr.exe
  C:\Windows\System\CfwHsUr.exe
  2⤵
  PID:1292
- C:\Windows\System\WeLTyZl.exe
  C:\Windows\System\WeLTyZl.exe
  2⤵
  PID:568
- C:\Windows\System\oKOxPvg.exe
  C:\Windows\System\oKOxPvg.exe
  2⤵
  PID:2344
- C:\Windows\System\gmzpeHl.exe
  C:\Windows\System\gmzpeHl.exe
  2⤵
  PID:784
- C:\Windows\System\wgrXgaV.exe
  C:\Windows\System\wgrXgaV.exe
  2⤵
  PID:1016
- C:\Windows\System\AezYGhR.exe
  C:\Windows\System\AezYGhR.exe
  2⤵
  PID:3092
- C:\Windows\System\BDelOId.exe
  C:\Windows\System\BDelOId.exe
  2⤵
  PID:3108
- C:\Windows\System\cCOylFd.exe
  C:\Windows\System\cCOylFd.exe
  2⤵
  PID:3124
- C:\Windows\System\rFgqjoS.exe
  C:\Windows\System\rFgqjoS.exe
  2⤵
  PID:3140
- C:\Windows\System\QSJblyw.exe
  C:\Windows\System\QSJblyw.exe
  2⤵
  PID:3160
- C:\Windows\System\Douvazq.exe
  C:\Windows\System\Douvazq.exe
  2⤵
  PID:3172
- C:\Windows\System\VolDpvP.exe
  C:\Windows\System\VolDpvP.exe
  2⤵
  PID:3188
- C:\Windows\System\HKLwWYm.exe
  C:\Windows\System\HKLwWYm.exe
  2⤵
  PID:3204
- C:\Windows\System\MUmXOKB.exe
  C:\Windows\System\MUmXOKB.exe
  2⤵
  PID:3224
- C:\Windows\System\HdCZCis.exe
  C:\Windows\System\HdCZCis.exe
  2⤵
  PID:3240
- C:\Windows\System\oUlSZGm.exe
  C:\Windows\System\oUlSZGm.exe
  2⤵
  PID:3256
- C:\Windows\System\vMyPySr.exe
  C:\Windows\System\vMyPySr.exe
  2⤵
  PID:3272
- C:\Windows\System\mrsihHs.exe
  C:\Windows\System\mrsihHs.exe
  2⤵
  PID:3288
- C:\Windows\System\Jgowkdd.exe
  C:\Windows\System\Jgowkdd.exe
  2⤵
  PID:3508
- C:\Windows\System\RUwOWYr.exe
  C:\Windows\System\RUwOWYr.exe
  2⤵
  PID:2552
- C:\Windows\System\gNATaXi.exe
  C:\Windows\System\gNATaXi.exe
  2⤵
  PID:2500
- C:\Windows\System\mpUQDwp.exe
  C:\Windows\System\mpUQDwp.exe
  2⤵
  PID:3612
- C:\Windows\System\stPaFnb.exe
  C:\Windows\System\stPaFnb.exe
  2⤵
  PID:3588
- C:\Windows\System\GGzQsOV.exe
  C:\Windows\System\GGzQsOV.exe
  2⤵
  PID:3636
- C:\Windows\System\wYtdhHu.exe
  C:\Windows\System\wYtdhHu.exe
  2⤵
  PID:2360
- C:\Windows\System\ChSmWLJ.exe
  C:\Windows\System\ChSmWLJ.exe
  2⤵
  PID:2508
- C:\Windows\System\cPTNivA.exe
  C:\Windows\System\cPTNivA.exe
  2⤵
  PID:1576
- C:\Windows\System\UCAjaDD.exe
  C:\Windows\System\UCAjaDD.exe
  2⤵
  PID:1180
- C:\Windows\System\wekeiuQ.exe
  C:\Windows\System\wekeiuQ.exe
  2⤵
  PID:2404
- C:\Windows\System\IRToMqv.exe
  C:\Windows\System\IRToMqv.exe
  2⤵
  PID:3692
- C:\Windows\System\IOMeMpK.exe
  C:\Windows\System\IOMeMpK.exe
  2⤵
  PID:812
- C:\Windows\System\AVFbpFX.exe
  C:\Windows\System\AVFbpFX.exe
  2⤵
  PID:3716
- C:\Windows\System\KXjHeLL.exe
  C:\Windows\System\KXjHeLL.exe
  2⤵
  PID:3732
- C:\Windows\System\QDSicLj.exe
  C:\Windows\System\QDSicLj.exe
  2⤵
  PID:2792
- C:\Windows\System\rltuXwb.exe
  C:\Windows\System\rltuXwb.exe
  2⤵
  PID:3760
- C:\Windows\System\rexRsiC.exe
  C:\Windows\System\rexRsiC.exe
  2⤵
  PID:3780
- C:\Windows\System\SPfqYNh.exe
  C:\Windows\System\SPfqYNh.exe
  2⤵
  PID:3800
- C:\Windows\System\QWeHslk.exe
  C:\Windows\System\QWeHslk.exe
  2⤵
  PID:1580
- C:\Windows\System\AWaQZZg.exe
  C:\Windows\System\AWaQZZg.exe
  2⤵
  PID:2872
- C:\Windows\System\rNUDXhz.exe
  C:\Windows\System\rNUDXhz.exe
  2⤵
  PID:3860
- C:\Windows\System\rZuIfSs.exe
  C:\Windows\System\rZuIfSs.exe
  2⤵
  PID:3880
- C:\Windows\System\SNhljcf.exe
  C:\Windows\System\SNhljcf.exe
  2⤵
  PID:3916
- C:\Windows\System\kyGwjyD.exe
  C:\Windows\System\kyGwjyD.exe
  2⤵
  PID:3936
- C:\Windows\System\pSrpWHy.exe
  C:\Windows\System\pSrpWHy.exe
  2⤵
  PID:3956
- C:\Windows\System\WBBtZoo.exe
  C:\Windows\System\WBBtZoo.exe
  2⤵
  PID:3976
- C:\Windows\System\rpzGRqh.exe
  C:\Windows\System\rpzGRqh.exe
  2⤵
  PID:4040
- C:\Windows\System\cURKByc.exe
  C:\Windows\System\cURKByc.exe
  2⤵
  PID:2620
- C:\Windows\System\ORdzNZI.exe
  C:\Windows\System\ORdzNZI.exe
  2⤵
  PID:4024
- C:\Windows\System\lbvpzDD.exe
  C:\Windows\System\lbvpzDD.exe
  2⤵
  PID:4088
- C:\Windows\System\AeZVCap.exe
  C:\Windows\System\AeZVCap.exe
  2⤵
  PID:1960
- C:\Windows\System\mmygQsw.exe
  C:\Windows\System\mmygQsw.exe
  2⤵
  PID:3056
- C:\Windows\System\EKxEssV.exe
  C:\Windows\System\EKxEssV.exe
  2⤵
  PID:1716
- C:\Windows\System\nmmgSjR.exe
  C:\Windows\System\nmmgSjR.exe
  2⤵
  PID:1708
- C:\Windows\System\pKtVNfN.exe
  C:\Windows\System\pKtVNfN.exe
  2⤵
  PID:1668
- C:\Windows\System\fJTwpXz.exe
  C:\Windows\System\fJTwpXz.exe
  2⤵
  PID:3128
- C:\Windows\System\fAsouzE.exe
  C:\Windows\System\fAsouzE.exe
  2⤵
  PID:3192
- C:\Windows\System\YKdXQag.exe
  C:\Windows\System\YKdXQag.exe
  2⤵
  PID:660
- C:\Windows\System\SeHUoFv.exe
  C:\Windows\System\SeHUoFv.exe
  2⤵
  PID:3428
- C:\Windows\System\CSaUrAI.exe
  C:\Windows\System\CSaUrAI.exe
  2⤵
  PID:884
- C:\Windows\System\fsMpVhH.exe
  C:\Windows\System\fsMpVhH.exe
  2⤵
  PID:2564
- C:\Windows\System\ynHzYbT.exe
  C:\Windows\System\ynHzYbT.exe
  2⤵
  PID:3088
- C:\Windows\System\yXNrOQu.exe
  C:\Windows\System\yXNrOQu.exe
  2⤵
  PID:3184
- C:\Windows\System\LOhzNYx.exe
  C:\Windows\System\LOhzNYx.exe
  2⤵
  PID:3280
- C:\Windows\System\pKGLAdP.exe
  C:\Windows\System\pKGLAdP.exe
  2⤵
  PID:3544
- C:\Windows\System\YiTJeKw.exe
  C:\Windows\System\YiTJeKw.exe
  2⤵
  PID:3568
- C:\Windows\System\QnhqiRI.exe
  C:\Windows\System\QnhqiRI.exe
  2⤵
  PID:3652
- C:\Windows\System\tJxVQsu.exe
  C:\Windows\System\tJxVQsu.exe
  2⤵
  PID:3316
- C:\Windows\System\NKdwsKY.exe
  C:\Windows\System\NKdwsKY.exe
  2⤵
  PID:3392
- C:\Windows\System\jLprdDL.exe
  C:\Windows\System\jLprdDL.exe
  2⤵
  PID:3456
- C:\Windows\System\IMHoRAA.exe
  C:\Windows\System\IMHoRAA.exe
  2⤵
  PID:3504
- C:\Windows\System\viWpjXB.exe
  C:\Windows\System\viWpjXB.exe
  2⤵
  PID:2648
- C:\Windows\System\BJeiauh.exe
  C:\Windows\System\BJeiauh.exe
  2⤵
  PID:2108
- C:\Windows\System\uKpPuKm.exe
  C:\Windows\System\uKpPuKm.exe
  2⤵
  PID:3720
- C:\Windows\System\DtwGVnl.exe
  C:\Windows\System\DtwGVnl.exe
  2⤵
  PID:3832
- C:\Windows\System\Gxessxm.exe
  C:\Windows\System\Gxessxm.exe
  2⤵
  PID:3476
- C:\Windows\System\EjVlTOw.exe
  C:\Windows\System\EjVlTOw.exe
  2⤵
  PID:3320
- C:\Windows\System\JiFifLa.exe
  C:\Windows\System\JiFifLa.exe
  2⤵
  PID:2776
- C:\Windows\System\cRXZhtv.exe
  C:\Windows\System\cRXZhtv.exe
  2⤵
  PID:2268
- C:\Windows\System\RQzxmPB.exe
  C:\Windows\System\RQzxmPB.exe
  2⤵
  PID:3712
- C:\Windows\System\KTVadOo.exe
  C:\Windows\System\KTVadOo.exe
  2⤵
  PID:700
- C:\Windows\System\JAzLXad.exe
  C:\Windows\System\JAzLXad.exe
  2⤵
  PID:292
- C:\Windows\System\WgjQxtO.exe
  C:\Windows\System\WgjQxtO.exe
  2⤵
  PID:4008
- C:\Windows\System\rTvNYTl.exe
  C:\Windows\System\rTvNYTl.exe
  2⤵
  PID:1456
- C:\Windows\System\pcbCibZ.exe
  C:\Windows\System\pcbCibZ.exe
  2⤵
  PID:1464
- C:\Windows\System\zyXicrc.exe
  C:\Windows\System\zyXicrc.exe
  2⤵
  PID:3336
- C:\Windows\System\bXTDXOc.exe
  C:\Windows\System\bXTDXOc.exe
  2⤵
  PID:1012
- C:\Windows\System\tBZPhXH.exe
  C:\Windows\System\tBZPhXH.exe
  2⤵
  PID:2104
- C:\Windows\System\pdDFEwg.exe
  C:\Windows\System\pdDFEwg.exe
  2⤵
  PID:3412
- C:\Windows\System\Qnxtngw.exe
  C:\Windows\System\Qnxtngw.exe
  2⤵
  PID:2744
- C:\Windows\System\tKjaQaG.exe
  C:\Windows\System\tKjaQaG.exe
  2⤵
  PID:3388
- C:\Windows\System\fTaySIg.exe
  C:\Windows\System\fTaySIg.exe
  2⤵
  PID:2096
- C:\Windows\System\gPcZMWg.exe
  C:\Windows\System\gPcZMWg.exe
  2⤵
  PID:536
- C:\Windows\System\aYlZitB.exe
  C:\Windows\System\aYlZitB.exe
  2⤵
  PID:2088
- C:\Windows\System\rWFQtlR.exe
  C:\Windows\System\rWFQtlR.exe
  2⤵
  PID:1980
- C:\Windows\System\YoCXiyD.exe
  C:\Windows\System\YoCXiyD.exe
  2⤵
  PID:764
- C:\Windows\System\WgMnABi.exe
  C:\Windows\System\WgMnABi.exe
  2⤵
  PID:2120
- C:\Windows\System\GZQLgSc.exe
  C:\Windows\System\GZQLgSc.exe
  2⤵
  PID:3876
- C:\Windows\System\wfATjJW.exe
  C:\Windows\System\wfATjJW.exe
  2⤵
  PID:3232
- C:\Windows\System\puuztFX.exe
  C:\Windows\System\puuztFX.exe
  2⤵
  PID:3084
- C:\Windows\System\oPYAavW.exe
  C:\Windows\System\oPYAavW.exe
  2⤵
  PID:4112
- C:\Windows\System\blHjaFh.exe
  C:\Windows\System\blHjaFh.exe
  2⤵
  PID:4128
- C:\Windows\System\JILtOkL.exe
  C:\Windows\System\JILtOkL.exe
  2⤵
  PID:4148
- C:\Windows\System\mwARhYS.exe
  C:\Windows\System\mwARhYS.exe
  2⤵
  PID:4164
- C:\Windows\System\tRlXpFm.exe
  C:\Windows\System\tRlXpFm.exe
  2⤵
  PID:4180
- C:\Windows\System\lsmECIl.exe
  C:\Windows\System\lsmECIl.exe
  2⤵
  PID:4196
- C:\Windows\System\SaZakUm.exe
  C:\Windows\System\SaZakUm.exe
  2⤵
  PID:4212
- C:\Windows\System\SAmcgpO.exe
  C:\Windows\System\SAmcgpO.exe
  2⤵
  PID:4228
- C:\Windows\System\pgtJGqW.exe
  C:\Windows\System\pgtJGqW.exe
  2⤵
  PID:4244
- C:\Windows\System\CsbLyUQ.exe
  C:\Windows\System\CsbLyUQ.exe
  2⤵
  PID:4260
- C:\Windows\System\froYiXZ.exe
  C:\Windows\System\froYiXZ.exe
  2⤵
  PID:4276
- C:\Windows\System\xEeWSSj.exe
  C:\Windows\System\xEeWSSj.exe
  2⤵
  PID:4296
- C:\Windows\System\jxJJtHa.exe
  C:\Windows\System\jxJJtHa.exe
  2⤵
  PID:4312
- C:\Windows\System\pmCLHbo.exe
  C:\Windows\System\pmCLHbo.exe
  2⤵
  PID:4572
- C:\Windows\System\rkaRGuj.exe
  C:\Windows\System\rkaRGuj.exe
  2⤵
  PID:4592
- C:\Windows\System\lQjiyJu.exe
  C:\Windows\System\lQjiyJu.exe
  2⤵
  PID:4608
- C:\Windows\System\Astkgpk.exe
  C:\Windows\System\Astkgpk.exe
  2⤵
  PID:4624
- C:\Windows\System\vufgaGZ.exe
  C:\Windows\System\vufgaGZ.exe
  2⤵
  PID:4640
- C:\Windows\System\MLSnnNG.exe
  C:\Windows\System\MLSnnNG.exe
  2⤵
  PID:4656
- C:\Windows\System\uILcHAm.exe
  C:\Windows\System\uILcHAm.exe
  2⤵
  PID:4672
- C:\Windows\System\ixRuYoM.exe
  C:\Windows\System\ixRuYoM.exe
  2⤵
  PID:4692
- C:\Windows\System\bSUiiBL.exe
  C:\Windows\System\bSUiiBL.exe
  2⤵
  PID:4716
- C:\Windows\System\JuNUAfb.exe
  C:\Windows\System\JuNUAfb.exe
  2⤵
  PID:4732
- C:\Windows\System\vvgQDSh.exe
  C:\Windows\System\vvgQDSh.exe
  2⤵
  PID:4748
- C:\Windows\System\lAusyMy.exe
  C:\Windows\System\lAusyMy.exe
  2⤵
  PID:4764
- C:\Windows\System\itnhIPE.exe
  C:\Windows\System\itnhIPE.exe
  2⤵
  PID:4780
- C:\Windows\System\oxPefal.exe
  C:\Windows\System\oxPefal.exe
  2⤵
  PID:4800
- C:\Windows\System\PtHvvnb.exe
  C:\Windows\System\PtHvvnb.exe
  2⤵
  PID:4816
- C:\Windows\System\exIejri.exe
  C:\Windows\System\exIejri.exe
  2⤵
  PID:4836
- C:\Windows\System\mYOGetn.exe
  C:\Windows\System\mYOGetn.exe
  2⤵
  PID:4852
- C:\Windows\System\WQquUMb.exe
  C:\Windows\System\WQquUMb.exe
  2⤵
  PID:4868
- C:\Windows\System\TwXnwLv.exe
  C:\Windows\System\TwXnwLv.exe
  2⤵
  PID:4884
- C:\Windows\System\aRkKzSh.exe
  C:\Windows\System\aRkKzSh.exe
  2⤵
  PID:4900
- C:\Windows\System\EYdZYex.exe
  C:\Windows\System\EYdZYex.exe
  2⤵
  PID:4916
- C:\Windows\System\rmGgGby.exe
  C:\Windows\System\rmGgGby.exe
  2⤵
  PID:4932
- C:\Windows\System\XHNQSnW.exe
  C:\Windows\System\XHNQSnW.exe
  2⤵
  PID:4948
- C:\Windows\System\LPdDdae.exe
  C:\Windows\System\LPdDdae.exe
  2⤵
  PID:4964
- C:\Windows\System\AKSLhaM.exe
  C:\Windows\System\AKSLhaM.exe
  2⤵
  PID:4988
- C:\Windows\System\sFaUsma.exe
  C:\Windows\System\sFaUsma.exe
  2⤵
  PID:5080
- C:\Windows\System\GPBOchh.exe
  C:\Windows\System\GPBOchh.exe
  2⤵
  PID:5096
- C:\Windows\System\pQxiKeg.exe
  C:\Windows\System\pQxiKeg.exe
  2⤵
  PID:5112
- C:\Windows\System\jdCizUe.exe
  C:\Windows\System\jdCizUe.exe
  2⤵
  PID:3248
- C:\Windows\System\ElIzukw.exe
  C:\Windows\System\ElIzukw.exe
  2⤵
  PID:3400
- C:\Windows\System\FpnxExd.exe
  C:\Windows\System\FpnxExd.exe
  2⤵
  PID:2604
- C:\Windows\System\xvoTxte.exe
  C:\Windows\System\xvoTxte.exe
  2⤵
  PID:3300
- C:\Windows\System\mfsqNOQ.exe
  C:\Windows\System\mfsqNOQ.exe
  2⤵
  PID:3624
- C:\Windows\System\nncaoNQ.exe
  C:\Windows\System\nncaoNQ.exe
  2⤵
  PID:3480
- C:\Windows\System\fPIEbjk.exe
  C:\Windows\System\fPIEbjk.exe
  2⤵
  PID:1816
- C:\Windows\System\xHSayPt.exe
  C:\Windows\System\xHSayPt.exe
  2⤵
  PID:2484
- C:\Windows\System\TlxDmlj.exe
  C:\Windows\System\TlxDmlj.exe
  2⤵
  PID:3952
- C:\Windows\System\kbGbQEM.exe
  C:\Windows\System\kbGbQEM.exe
  2⤵
  PID:2472
- C:\Windows\System\ZLGVJQd.exe
  C:\Windows\System\ZLGVJQd.exe
  2⤵
  PID:3368
- C:\Windows\System\YgdIXkO.exe
  C:\Windows\System\YgdIXkO.exe
  2⤵
  PID:4084
- C:\Windows\System\nwQMCaM.exe
  C:\Windows\System\nwQMCaM.exe
  2⤵
  PID:4236
- C:\Windows\System\BMCeWso.exe
  C:\Windows\System\BMCeWso.exe
  2⤵
  PID:4304
- C:\Windows\System\vsbRWoF.exe
  C:\Windows\System\vsbRWoF.exe
  2⤵
  PID:1876
- C:\Windows\System\PnIKEta.exe
  C:\Windows\System\PnIKEta.exe
  2⤵
  PID:3236
- C:\Windows\System\AXICxuu.exe
  C:\Windows\System\AXICxuu.exe
  2⤵
  PID:1768
- C:\Windows\System\lVwDXoy.exe
  C:\Windows\System\lVwDXoy.exe
  2⤵
  PID:3840
- C:\Windows\System\zpkHVQO.exe
  C:\Windows\System\zpkHVQO.exe
  2⤵
  PID:4284
- C:\Windows\System\mbhZTkd.exe
  C:\Windows\System\mbhZTkd.exe
  2⤵
  PID:2040
- C:\Windows\System\lqNeaJK.exe
  C:\Windows\System\lqNeaJK.exe
  2⤵
  PID:4160
- C:\Windows\System\aFrfdFW.exe
  C:\Windows\System\aFrfdFW.exe
  2⤵
  PID:4224
- C:\Windows\System\koIFzIa.exe
  C:\Windows\System\koIFzIa.exe
  2⤵
  PID:4320
- C:\Windows\System\goWHGxM.exe
  C:\Windows\System\goWHGxM.exe
  2⤵
  PID:4336
- C:\Windows\System\InstrUV.exe
  C:\Windows\System\InstrUV.exe
  2⤵
  PID:4360
- C:\Windows\System\NFAShAz.exe
  C:\Windows\System\NFAShAz.exe
  2⤵
  PID:4380
- C:\Windows\System\EFuumwT.exe
  C:\Windows\System\EFuumwT.exe
  2⤵
  PID:4392
- C:\Windows\System\QrBdOop.exe
  C:\Windows\System\QrBdOop.exe
  2⤵
  PID:4412
- C:\Windows\System\zVHoTFM.exe
  C:\Windows\System\zVHoTFM.exe
  2⤵
  PID:4428
- C:\Windows\System\UUPMFGu.exe
  C:\Windows\System\UUPMFGu.exe
  2⤵
  PID:4448
- C:\Windows\System\EiAWBSu.exe
  C:\Windows\System\EiAWBSu.exe
  2⤵
  PID:4472
- C:\Windows\System\IAjYMyN.exe
  C:\Windows\System\IAjYMyN.exe
  2⤵
  PID:4492
- C:\Windows\System\zNzpWLo.exe
  C:\Windows\System\zNzpWLo.exe
  2⤵
  PID:4508
- C:\Windows\System\ioViPpm.exe
  C:\Windows\System\ioViPpm.exe
  2⤵
  PID:2316
- C:\Windows\System\hbvxgtL.exe
  C:\Windows\System\hbvxgtL.exe
  2⤵
  PID:4568
- C:\Windows\System\YyfmAcI.exe
  C:\Windows\System\YyfmAcI.exe
  2⤵
  PID:4620
- C:\Windows\System\kYREDXD.exe
  C:\Windows\System\kYREDXD.exe
  2⤵
  PID:4600
- C:\Windows\System\KfOjkbl.exe
  C:\Windows\System\KfOjkbl.exe
  2⤵
  PID:4616
- C:\Windows\System\NiBavxs.exe
  C:\Windows\System\NiBavxs.exe
  2⤵
  PID:4680
- C:\Windows\System\fUMwtMF.exe
  C:\Windows\System\fUMwtMF.exe
  2⤵
  PID:4712
- C:\Windows\System\beSyZLx.exe
  C:\Windows\System\beSyZLx.exe
  2⤵
  PID:4808
- C:\Windows\System\KKMsnQN.exe
  C:\Windows\System\KKMsnQN.exe
  2⤵
  PID:4744
- C:\Windows\System\nOLrGdX.exe
  C:\Windows\System\nOLrGdX.exe
  2⤵
  PID:4908
- C:\Windows\System\CGAqFXV.exe
  C:\Windows\System\CGAqFXV.exe
  2⤵
  PID:4944
- C:\Windows\System\xVwBGxI.exe
  C:\Windows\System\xVwBGxI.exe
  2⤵
  PID:4796
- C:\Windows\System\aRRlutO.exe
  C:\Windows\System\aRRlutO.exe
  2⤵
  PID:4756
- C:\Windows\System\fAMqqMC.exe
  C:\Windows\System\fAMqqMC.exe
  2⤵
  PID:4896
- C:\Windows\System\aHMbgTL.exe
  C:\Windows\System\aHMbgTL.exe
  2⤵
  PID:4960
- C:\Windows\System\jtNwCGt.exe
  C:\Windows\System\jtNwCGt.exe
  2⤵
  PID:4740
- C:\Windows\System\WpaFBgH.exe
  C:\Windows\System\WpaFBgH.exe
  2⤵
  PID:5004
- C:\Windows\System\OXNovHQ.exe
  C:\Windows\System\OXNovHQ.exe
  2⤵
  PID:5016
- C:\Windows\System\AYAvQrt.exe
  C:\Windows\System\AYAvQrt.exe
  2⤵
  PID:5024
- C:\Windows\System\TgRDPBx.exe
  C:\Windows\System\TgRDPBx.exe
  2⤵
  PID:5044
- C:\Windows\System\ySsQNmC.exe
  C:\Windows\System\ySsQNmC.exe
  2⤵
  PID:5060
- C:\Windows\System\XFTeKOd.exe
  C:\Windows\System\XFTeKOd.exe
  2⤵
  PID:2200
- C:\Windows\System\qTmFUGz.exe
  C:\Windows\System\qTmFUGz.exe
  2⤵
  PID:5088
- C:\Windows\System\eEkEXYY.exe
  C:\Windows\System\eEkEXYY.exe
  2⤵
  PID:3228
- C:\Windows\System\cWZfgba.exe
  C:\Windows\System\cWZfgba.exe
  2⤵
  PID:3532
- C:\Windows\System\aMZXtkN.exe
  C:\Windows\System\aMZXtkN.exe
  2⤵
  PID:2072
- C:\Windows\System\XXmmvQX.exe
  C:\Windows\System\XXmmvQX.exe
  2⤵
  PID:3120
- C:\Windows\System\hROviuB.exe
  C:\Windows\System\hROviuB.exe
  2⤵
  PID:3356
- C:\Windows\System\uRBLfYk.exe
  C:\Windows\System\uRBLfYk.exe
  2⤵
  PID:3268
- C:\Windows\System\sKOmoQF.exe
  C:\Windows\System\sKOmoQF.exe
  2⤵
  PID:3756
- C:\Windows\System\qACfXji.exe
  C:\Windows\System\qACfXji.exe
  2⤵
  PID:2412
- C:\Windows\System\GCRIHcu.exe
  C:\Windows\System\GCRIHcu.exe
  2⤵
  PID:2928
- C:\Windows\System\yTqZwcX.exe
  C:\Windows\System\yTqZwcX.exe
  2⤵
  PID:4136
- C:\Windows\System\VtJIvHH.exe
  C:\Windows\System\VtJIvHH.exe
  2⤵
  PID:324
- C:\Windows\System\lwZKHvQ.exe
  C:\Windows\System\lwZKHvQ.exe
  2⤵
  PID:4176
- C:\Windows\System\XsptoLi.exe
  C:\Windows\System\XsptoLi.exe
  2⤵
  PID:1740
- C:\Windows\System\xJHfaAf.exe
  C:\Windows\System\xJHfaAf.exe
  2⤵
  PID:2276
- C:\Windows\System\DQMdGeI.exe
  C:\Windows\System\DQMdGeI.exe
  2⤵
  PID:4156
- C:\Windows\System\bESdYTg.exe
  C:\Windows\System\bESdYTg.exe
  2⤵
  PID:3552
- C:\Windows\System\krJijFF.exe
  C:\Windows\System\krJijFF.exe
  2⤵
  PID:3980
- C:\Windows\System\oaeuyXG.exe
  C:\Windows\System\oaeuyXG.exe
  2⤵
  PID:4192
- C:\Windows\System\YIIqPip.exe
  C:\Windows\System\YIIqPip.exe
  2⤵
  PID:4292
- C:\Windows\System\hjdQJTl.exe
  C:\Windows\System\hjdQJTl.exe
  2⤵
  PID:4348
- C:\Windows\System\pAMfiQO.exe
  C:\Windows\System\pAMfiQO.exe
  2⤵
  PID:4376
- C:\Windows\System\GWDlKla.exe
  C:\Windows\System\GWDlKla.exe
  2⤵
  PID:4400
- C:\Windows\System\VOGWMie.exe
  C:\Windows\System\VOGWMie.exe
  2⤵
  PID:4420
- C:\Windows\System\NdsPwQC.exe
  C:\Windows\System\NdsPwQC.exe
  2⤵
  PID:4444
- C:\Windows\System\gnucPCL.exe
  C:\Windows\System\gnucPCL.exe
  2⤵
  PID:4480
- C:\Windows\System\OLqqKxM.exe
  C:\Windows\System\OLqqKxM.exe
  2⤵
  PID:4516
- C:\Windows\System\GkiYROg.exe
  C:\Windows\System\GkiYROg.exe
  2⤵
  PID:4532
- C:\Windows\System\evlAUxs.exe
  C:\Windows\System\evlAUxs.exe
  2⤵
  PID:4564
- C:\Windows\System\ryuhihv.exe
  C:\Windows\System\ryuhihv.exe
  2⤵
  PID:4668
- C:\Windows\System\UDhrqDl.exe
  C:\Windows\System\UDhrqDl.exe
  2⤵
  PID:4880
- C:\Windows\System\kStRrFe.exe
  C:\Windows\System\kStRrFe.exe
  2⤵
  PID:4892
- C:\Windows\System\cbstbEE.exe
  C:\Windows\System\cbstbEE.exe
  2⤵
  PID:4636
- C:\Windows\System\WCkZYmq.exe
  C:\Windows\System\WCkZYmq.exe
  2⤵
  PID:1568
- C:\Windows\System\EUKbSEq.exe
  C:\Windows\System\EUKbSEq.exe
  2⤵
  PID:5032
- C:\Windows\System\FMYnAJF.exe
  C:\Windows\System\FMYnAJF.exe
  2⤵
  PID:5072
- C:\Windows\System\oBTJqVs.exe
  C:\Windows\System\oBTJqVs.exe
  2⤵
  PID:2248
- C:\Windows\System\YNIwUMe.exe
  C:\Windows\System\YNIwUMe.exe
  2⤵
  PID:4828
- C:\Windows\System\qeMgJnB.exe
  C:\Windows\System\qeMgJnB.exe
  2⤵
  PID:4972
- C:\Windows\System\oFYpAOG.exe
  C:\Windows\System\oFYpAOG.exe
  2⤵
  PID:604
- C:\Windows\System\CfZrDHi.exe
  C:\Windows\System\CfZrDHi.exe
  2⤵
  PID:5056
- C:\Windows\System\pxByVEo.exe
  C:\Windows\System\pxByVEo.exe
  2⤵
  PID:2680
- C:\Windows\System\YQqwBfu.exe
  C:\Windows\System\YQqwBfu.exe
  2⤵
  PID:4108
- C:\Windows\System\AMUAUmy.exe
  C:\Windows\System\AMUAUmy.exe
  2⤵
  PID:2916
- C:\Windows\System\XDrPqzy.exe
  C:\Windows\System\XDrPqzy.exe
  2⤵
  PID:3996
- C:\Windows\System\yJUZdws.exe
  C:\Windows\System\yJUZdws.exe
  2⤵
  PID:3708
- C:\Windows\System\fuUWiUM.exe
  C:\Windows\System\fuUWiUM.exe
  2⤵
  PID:3668
- C:\Windows\System\ixVMnjt.exe
  C:\Windows\System\ixVMnjt.exe
  2⤵
  PID:4256
- C:\Windows\System\ZnDLXCx.exe
  C:\Windows\System\ZnDLXCx.exe
  2⤵
  PID:4408
- C:\Windows\System\VkTGzvW.exe
  C:\Windows\System\VkTGzvW.exe
  2⤵
  PID:2140
- C:\Windows\System\UcpVHjn.exe
  C:\Windows\System\UcpVHjn.exe
  2⤵
  PID:4056
- C:\Windows\System\kqjdmrm.exe
  C:\Windows\System\kqjdmrm.exe
  2⤵
  PID:4188
- C:\Windows\System\fUBnwmC.exe
  C:\Windows\System\fUBnwmC.exe
  2⤵
  PID:2228
- C:\Windows\System\jmAIXOD.exe
  C:\Windows\System\jmAIXOD.exe
  2⤵
  PID:4388
- C:\Windows\System\TSjZIZK.exe
  C:\Windows\System\TSjZIZK.exe
  2⤵
  PID:4876
- C:\Windows\System\TSqhMnv.exe
  C:\Windows\System\TSqhMnv.exe
  2⤵
  PID:4332
- C:\Windows\System\eBzesHj.exe
  C:\Windows\System\eBzesHj.exe
  2⤵
  PID:4440
- C:\Windows\System\FRixwLX.exe
  C:\Windows\System\FRixwLX.exe
  2⤵
  PID:2880
- C:\Windows\System\XEIsZDq.exe
  C:\Windows\System\XEIsZDq.exe
  2⤵
  PID:344
- C:\Windows\System\PgXkfse.exe
  C:\Windows\System\PgXkfse.exe
  2⤵
  PID:4240
- C:\Windows\System\bxbFJGU.exe
  C:\Windows\System\bxbFJGU.exe
  2⤵
  PID:5108
- C:\Windows\System\GYgcxVU.exe
  C:\Windows\System\GYgcxVU.exe
  2⤵
  PID:4368
- C:\Windows\System\bIJoKOq.exe
  C:\Windows\System\bIJoKOq.exe
  2⤵
  PID:4604
- C:\Windows\System\DBlvQXX.exe
  C:\Windows\System\DBlvQXX.exe
  2⤵
  PID:4664
- C:\Windows\System\BjRzJnY.exe
  C:\Windows\System\BjRzJnY.exe
  2⤵
  PID:3564
- C:\Windows\System\ZSQlNlC.exe
  C:\Windows\System\ZSQlNlC.exe
  2⤵
  PID:4104
- C:\Windows\System\NUdGHXk.exe
  C:\Windows\System\NUdGHXk.exe
  2⤵
  PID:4560
- C:\Windows\System\dPZmNdX.exe
  C:\Windows\System\dPZmNdX.exe
  2⤵
  PID:4500
- C:\Windows\System\PTdHlJk.exe
  C:\Windows\System\PTdHlJk.exe
  2⤵
  PID:5076
- C:\Windows\System\uaPzMyD.exe
  C:\Windows\System\uaPzMyD.exe
  2⤵
  PID:5092
- C:\Windows\System\VFTTRdK.exe
  C:\Windows\System\VFTTRdK.exe
  2⤵
  PID:2636
- C:\Windows\System\SNZIHlB.exe
  C:\Windows\System\SNZIHlB.exe
  2⤵
  PID:4864
- C:\Windows\System\NOesEwm.exe
  C:\Windows\System\NOesEwm.exe
  2⤵
  PID:5132
- C:\Windows\System\jnCTNre.exe
  C:\Windows\System\jnCTNre.exe
  2⤵
  PID:5148
- C:\Windows\System\YzHnvhk.exe
  C:\Windows\System\YzHnvhk.exe
  2⤵
  PID:5164
- C:\Windows\System\DvWfzyv.exe
  C:\Windows\System\DvWfzyv.exe
  2⤵
  PID:5184
- C:\Windows\System\SismZju.exe
  C:\Windows\System\SismZju.exe
  2⤵
  PID:5204
- C:\Windows\System\OrmgREe.exe
  C:\Windows\System\OrmgREe.exe
  2⤵
  PID:5220
- C:\Windows\System\sJAlzuV.exe
  C:\Windows\System\sJAlzuV.exe
  2⤵
  PID:5236
- C:\Windows\System\JxZTjEY.exe
  C:\Windows\System\JxZTjEY.exe
  2⤵
  PID:5252
- C:\Windows\System\dAdQPYs.exe
  C:\Windows\System\dAdQPYs.exe
  2⤵
  PID:5268
- C:\Windows\System\fDfmOVY.exe
  C:\Windows\System\fDfmOVY.exe
  2⤵
  PID:5288
- C:\Windows\System\ybxZGzv.exe
  C:\Windows\System\ybxZGzv.exe
  2⤵
  PID:5304
- C:\Windows\System\HwemeAz.exe
  C:\Windows\System\HwemeAz.exe
  2⤵
  PID:5320
- C:\Windows\System\yEgaKAs.exe
  C:\Windows\System\yEgaKAs.exe
  2⤵
  PID:5336
- C:\Windows\System\XnIpzLa.exe
  C:\Windows\System\XnIpzLa.exe
  2⤵
  PID:5352
- C:\Windows\System\NFuttIn.exe
  C:\Windows\System\NFuttIn.exe
  2⤵
  PID:5368
- C:\Windows\System\IoUcOTz.exe
  C:\Windows\System\IoUcOTz.exe
  2⤵
  PID:5384
- C:\Windows\System\fyYkatx.exe
  C:\Windows\System\fyYkatx.exe
  2⤵
  PID:5408
- C:\Windows\System\QTirhsU.exe
  C:\Windows\System\QTirhsU.exe
  2⤵
  PID:5424
- C:\Windows\System\Hvkcmax.exe
  C:\Windows\System\Hvkcmax.exe
  2⤵
  PID:5440
- C:\Windows\System\LXcDaBP.exe
  C:\Windows\System\LXcDaBP.exe
  2⤵
  PID:5456
- C:\Windows\System\cIWdJhU.exe
  C:\Windows\System\cIWdJhU.exe
  2⤵
  PID:5472
- C:\Windows\System\sBoUymZ.exe
  C:\Windows\System\sBoUymZ.exe
  2⤵
  PID:5488
- C:\Windows\System\YNUyOhp.exe
  C:\Windows\System\YNUyOhp.exe
  2⤵
  PID:5504
- C:\Windows\System\pOAnCli.exe
  C:\Windows\System\pOAnCli.exe
  2⤵
  PID:5520
- C:\Windows\System\uIXbZzC.exe
  C:\Windows\System\uIXbZzC.exe
  2⤵
  PID:5536
- C:\Windows\System\aOJXnBC.exe
  C:\Windows\System\aOJXnBC.exe
  2⤵
  PID:5552
- C:\Windows\System\HaHEjFn.exe
  C:\Windows\System\HaHEjFn.exe
  2⤵
  PID:5700
- C:\Windows\System\diawDaq.exe
  C:\Windows\System\diawDaq.exe
  2⤵
  PID:5716
- C:\Windows\System\drnnZyj.exe
  C:\Windows\System\drnnZyj.exe
  2⤵
  PID:5736
- C:\Windows\System\gbdvvDV.exe
  C:\Windows\System\gbdvvDV.exe
  2⤵
  PID:5752
- C:\Windows\System\SJbZRLB.exe
  C:\Windows\System\SJbZRLB.exe
  2⤵
  PID:5768
- C:\Windows\System\ldJlbVe.exe
  C:\Windows\System\ldJlbVe.exe
  2⤵
  PID:5784
- C:\Windows\System\fVbmLVN.exe
  C:\Windows\System\fVbmLVN.exe
  2⤵
  PID:5800
- C:\Windows\System\MfRwrId.exe
  C:\Windows\System\MfRwrId.exe
  2⤵
  PID:5820
- C:\Windows\System\JyUWVKl.exe
  C:\Windows\System\JyUWVKl.exe
  2⤵
  PID:5840
- C:\Windows\System\GoVHELn.exe
  C:\Windows\System\GoVHELn.exe
  2⤵
  PID:5856
- C:\Windows\System\LtFfsFw.exe
  C:\Windows\System\LtFfsFw.exe
  2⤵
  PID:5872
- C:\Windows\System\TcfqQWf.exe
  C:\Windows\System\TcfqQWf.exe
  2⤵
  PID:5892
- C:\Windows\System\pitfznv.exe
  C:\Windows\System\pitfznv.exe
  2⤵
  PID:5908
- C:\Windows\System\IEwfeIP.exe
  C:\Windows\System\IEwfeIP.exe
  2⤵
  PID:5924
- C:\Windows\System\noDubCS.exe
  C:\Windows\System\noDubCS.exe
  2⤵
  PID:5940
- C:\Windows\System\QJSbcyi.exe
  C:\Windows\System\QJSbcyi.exe
  2⤵
  PID:5956
- C:\Windows\System\kJLtVXO.exe
  C:\Windows\System\kJLtVXO.exe
  2⤵
  PID:5972
- C:\Windows\System\kVbAbhD.exe
  C:\Windows\System\kVbAbhD.exe
  2⤵
  PID:5992
- C:\Windows\System\STZajmj.exe
  C:\Windows\System\STZajmj.exe
  2⤵
  PID:6012
- C:\Windows\System\UPQqYLU.exe
  C:\Windows\System\UPQqYLU.exe
  2⤵
  PID:6028
- C:\Windows\System\CDzFNzi.exe
  C:\Windows\System\CDzFNzi.exe
  2⤵
  PID:6044
- C:\Windows\System\UBLfSCY.exe
  C:\Windows\System\UBLfSCY.exe
  2⤵
  PID:6060
- C:\Windows\System\JpxosAM.exe
  C:\Windows\System\JpxosAM.exe
  2⤵
  PID:4584
- C:\Windows\System\BRZzleU.exe
  C:\Windows\System\BRZzleU.exe
  2⤵
  PID:4956
- C:\Windows\System\vuSCOSY.exe
  C:\Windows\System\vuSCOSY.exe
  2⤵
  PID:4120
- C:\Windows\System\MohnNVz.exe
  C:\Windows\System\MohnNVz.exe
  2⤵
  PID:3776
- C:\Windows\System\nizRhzv.exe
  C:\Windows\System\nizRhzv.exe
  2⤵
  PID:5172
- C:\Windows\System\VRAlcmu.exe
  C:\Windows\System\VRAlcmu.exe
  2⤵
  PID:5216
- C:\Windows\System\CrjZBwx.exe
  C:\Windows\System\CrjZBwx.exe
  2⤵
  PID:5280
- C:\Windows\System\tftOVGA.exe
  C:\Windows\System\tftOVGA.exe
  2⤵
  PID:5344
- C:\Windows\System\feLUwcj.exe
  C:\Windows\System\feLUwcj.exe
  2⤵
  PID:5012
- C:\Windows\System\hnjrSQF.exe
  C:\Windows\System\hnjrSQF.exe
  2⤵
  PID:5404
- C:\Windows\System\NupQfYg.exe
  C:\Windows\System\NupQfYg.exe
  2⤵
  PID:5500
- C:\Windows\System\CkFYniK.exe
  C:\Windows\System\CkFYniK.exe
  2⤵
  PID:4928
- C:\Windows\System\NcWVqcV.exe
  C:\Windows\System\NcWVqcV.exe
  2⤵
  PID:5448
- C:\Windows\System\dmNKfwE.exe
  C:\Windows\System\dmNKfwE.exe
  2⤵
  PID:5008
- C:\Windows\System\dmfSRwA.exe
  C:\Windows\System\dmfSRwA.exe
  2⤵
  PID:5232
- C:\Windows\System\KJSgNpl.exe
  C:\Windows\System\KJSgNpl.exe
  2⤵
  PID:5516
- C:\Windows\System\EvykPys.exe
  C:\Windows\System\EvykPys.exe
  2⤵
  PID:5544
- C:\Windows\System\IttQncX.exe
  C:\Windows\System\IttQncX.exe
  2⤵
  PID:5196
- C:\Windows\System\gzAILbz.exe
  C:\Windows\System\gzAILbz.exe
  2⤵
  PID:5360
- C:\Windows\System\pYDpghh.exe
  C:\Windows\System\pYDpghh.exe
  2⤵
  PID:5400
- C:\Windows\System\FYVJayA.exe
  C:\Windows\System\FYVJayA.exe
  2⤵
  PID:5572
- C:\Windows\System\hmYmOCp.exe
  C:\Windows\System\hmYmOCp.exe
  2⤵
  PID:5592
- C:\Windows\System\ZFflMOQ.exe
  C:\Windows\System\ZFflMOQ.exe
  2⤵
  PID:5616
- C:\Windows\System\salrEcI.exe
  C:\Windows\System\salrEcI.exe
  2⤵
  PID:5632
- C:\Windows\System\yXpvTyn.exe
  C:\Windows\System\yXpvTyn.exe
  2⤵
  PID:5776
- C:\Windows\System\irfYBTi.exe
  C:\Windows\System\irfYBTi.exe
  2⤵
  PID:5808
- C:\Windows\System\MnFDqfG.exe
  C:\Windows\System\MnFDqfG.exe
  2⤵
  PID:5888
- C:\Windows\System\AKEKKTL.exe
  C:\Windows\System\AKEKKTL.exe
  2⤵
  PID:5920
- C:\Windows\System\RNRKXsT.exe
  C:\Windows\System\RNRKXsT.exe
  2⤵
  PID:5984
- C:\Windows\System\LpAruSE.exe
  C:\Windows\System\LpAruSE.exe
  2⤵
  PID:6056
- C:\Windows\System\EMvWkKt.exe
  C:\Windows\System\EMvWkKt.exe
  2⤵
  PID:5668
- C:\Windows\System\AfDYzTU.exe
  C:\Windows\System\AfDYzTU.exe
  2⤵
  PID:5644
- C:\Windows\System\rmVQdSB.exe
  C:\Windows\System\rmVQdSB.exe
  2⤵
  PID:5832
- C:\Windows\System\OQPtlZW.exe
  C:\Windows\System\OQPtlZW.exe
  2⤵
  PID:5932
- C:\Windows\System\ymrmwfA.exe
  C:\Windows\System\ymrmwfA.exe
  2⤵
  PID:6004
- C:\Windows\System\QvmHslJ.exe
  C:\Windows\System\QvmHslJ.exe
  2⤵
  PID:5676
- C:\Windows\System\OpCUMwT.exe
  C:\Windows\System\OpCUMwT.exe
  2⤵
  PID:5696
- C:\Windows\System\Zqxisri.exe
  C:\Windows\System\Zqxisri.exe
  2⤵
  PID:5760
- C:\Windows\System\BNyKRlY.exe
  C:\Windows\System\BNyKRlY.exe
  2⤵
  PID:6096
- C:\Windows\System\LRJyRkS.exe
  C:\Windows\System\LRJyRkS.exe
  2⤵
  PID:5968
- C:\Windows\System\UtKAlvW.exe
  C:\Windows\System\UtKAlvW.exe
  2⤵
  PID:6136
- C:\Windows\System\jOFCWkr.exe
  C:\Windows\System\jOFCWkr.exe
  2⤵
  PID:6088
- C:\Windows\System\VXVwiST.exe
  C:\Windows\System\VXVwiST.exe
  2⤵
  PID:6112
- C:\Windows\System\IzEsnEc.exe
  C:\Windows\System\IzEsnEc.exe
  2⤵
  PID:6132
- C:\Windows\System\rKpqLEy.exe
  C:\Windows\System\rKpqLEy.exe
  2⤵
  PID:4792
- C:\Windows\System\zMqCCKn.exe
  C:\Windows\System\zMqCCKn.exe
  2⤵
  PID:5316
- C:\Windows\System\ytLEnCZ.exe
  C:\Windows\System\ytLEnCZ.exe
  2⤵
  PID:6024
- C:\Windows\System\rlKQYjP.exe
  C:\Windows\System\rlKQYjP.exe
  2⤵
  PID:5812
- C:\Windows\System\cNugALy.exe
  C:\Windows\System\cNugALy.exe
  2⤵
  PID:5588
- C:\Windows\System\UdDwMDl.exe
  C:\Windows\System\UdDwMDl.exe
  2⤵
  PID:2236
- C:\Windows\System\ZOhnhmN.exe
  C:\Windows\System\ZOhnhmN.exe
  2⤵
  PID:5468
- C:\Windows\System\AirFuJz.exe
  C:\Windows\System\AirFuJz.exe
  2⤵
  PID:5564
- C:\Windows\System\EHhEEZn.exe
  C:\Windows\System\EHhEEZn.exe
  2⤵
  PID:5904
- C:\Windows\System\ohPuUpM.exe
  C:\Windows\System\ohPuUpM.exe
  2⤵
  PID:6160
- C:\Windows\System\IKDKjcN.exe
  C:\Windows\System\IKDKjcN.exe
  2⤵
  PID:6176
- C:\Windows\System\IMAkFfp.exe
  C:\Windows\System\IMAkFfp.exe
  2⤵
  PID:6192
- C:\Windows\System\jALAfCi.exe
  C:\Windows\System\jALAfCi.exe
  2⤵
  PID:6400
- C:\Windows\System\cMDVlDL.exe
  C:\Windows\System\cMDVlDL.exe
  2⤵
  PID:6424
- C:\Windows\System\fQliUwI.exe
  C:\Windows\System\fQliUwI.exe
  2⤵
  PID:6440
- C:\Windows\System\rSzuGcS.exe
  C:\Windows\System\rSzuGcS.exe
  2⤵
  PID:6456
- C:\Windows\System\FSbKRGh.exe
  C:\Windows\System\FSbKRGh.exe
  2⤵
  PID:6476
- C:\Windows\System\kBcELFH.exe
  C:\Windows\System\kBcELFH.exe
  2⤵
  PID:6492
- C:\Windows\System\KNiMZkW.exe
  C:\Windows\System\KNiMZkW.exe
  2⤵
  PID:6508
- C:\Windows\System\mMqpCvt.exe
  C:\Windows\System\mMqpCvt.exe
  2⤵
  PID:6528
- C:\Windows\System\XAbShpk.exe
  C:\Windows\System\XAbShpk.exe
  2⤵
  PID:6544
- C:\Windows\System\JHlwtNd.exe
  C:\Windows\System\JHlwtNd.exe
  2⤵
  PID:6560
- C:\Windows\System\yGRkwmc.exe
  C:\Windows\System\yGRkwmc.exe
  2⤵
  PID:6576
- C:\Windows\System\taUiAfN.exe
  C:\Windows\System\taUiAfN.exe
  2⤵
  PID:6596
- C:\Windows\System\tbOyhnL.exe
  C:\Windows\System\tbOyhnL.exe
  2⤵
  PID:6612
- C:\Windows\System\jSLlBEm.exe
  C:\Windows\System\jSLlBEm.exe
  2⤵
  PID:6628
- C:\Windows\System\tScIgCt.exe
  C:\Windows\System\tScIgCt.exe
  2⤵
  PID:6644
- C:\Windows\System\oRfqFIq.exe
  C:\Windows\System\oRfqFIq.exe
  2⤵
  PID:6660
- C:\Windows\System\xoSSYSN.exe
  C:\Windows\System\xoSSYSN.exe
  2⤵
  PID:6680
- C:\Windows\System\TaoYKuw.exe
  C:\Windows\System\TaoYKuw.exe
  2⤵
  PID:6696
- C:\Windows\System\VqUXomH.exe
  C:\Windows\System\VqUXomH.exe
  2⤵
  PID:6712
- C:\Windows\System\bcpmiBo.exe
  C:\Windows\System\bcpmiBo.exe
  2⤵
  PID:6728
- C:\Windows\System\PhRxBCW.exe
  C:\Windows\System\PhRxBCW.exe
  2⤵
  PID:6744
- C:\Windows\System\ocixLGn.exe
  C:\Windows\System\ocixLGn.exe
  2⤵
  PID:6760
- C:\Windows\System\aQRmNCG.exe
  C:\Windows\System\aQRmNCG.exe
  2⤵
  PID:6780
- C:\Windows\System\SxpBrku.exe
  C:\Windows\System\SxpBrku.exe
  2⤵
  PID:6796
- C:\Windows\System\WbPMOMk.exe
  C:\Windows\System\WbPMOMk.exe
  2⤵
  PID:6812
- C:\Windows\System\XjfjUgP.exe
  C:\Windows\System\XjfjUgP.exe
  2⤵
  PID:6904
- C:\Windows\System\gdyJwFZ.exe
  C:\Windows\System\gdyJwFZ.exe
  2⤵
  PID:6924
- C:\Windows\System\aExnaON.exe
  C:\Windows\System\aExnaON.exe
  2⤵
  PID:6940
- C:\Windows\System\QbIlusf.exe
  C:\Windows\System\QbIlusf.exe
  2⤵
  PID:6956
- C:\Windows\System\bTdExRh.exe
  C:\Windows\System\bTdExRh.exe
  2⤵
  PID:6976
- C:\Windows\System\OuMezZv.exe
  C:\Windows\System\OuMezZv.exe
  2⤵
  PID:7004
- C:\Windows\System\oVuRUTU.exe
  C:\Windows\System\oVuRUTU.exe
  2⤵
  PID:7020
- C:\Windows\System\yYZBUgY.exe
  C:\Windows\System\yYZBUgY.exe
  2⤵
  PID:7036
- C:\Windows\System\bgafLXt.exe
  C:\Windows\System\bgafLXt.exe
  2⤵
  PID:7052
- C:\Windows\System\VRtZcoS.exe
  C:\Windows\System\VRtZcoS.exe
  2⤵
  PID:7068
- C:\Windows\System\tuHybOd.exe
  C:\Windows\System\tuHybOd.exe
  2⤵
  PID:7084
- C:\Windows\System\dGDvjnD.exe
  C:\Windows\System\dGDvjnD.exe
  2⤵
  PID:7100
- C:\Windows\System\qpNBNyR.exe
  C:\Windows\System\qpNBNyR.exe
  2⤵
  PID:7116
- C:\Windows\System\QsDqRWD.exe
  C:\Windows\System\QsDqRWD.exe
  2⤵
  PID:7136
- C:\Windows\System\ontSHCa.exe
  C:\Windows\System\ontSHCa.exe
  2⤵
  PID:7152
- C:\Windows\System\fIRkhHA.exe
  C:\Windows\System\fIRkhHA.exe
  2⤵
  PID:6000
- C:\Windows\System\JBzMtNT.exe
  C:\Windows\System\JBzMtNT.exe
  2⤵
  PID:5764
- C:\Windows\System\lYNUydw.exe
  C:\Windows\System\lYNUydw.exe
  2⤵
  PID:6108
- C:\Windows\System\TvpSMRV.exe
  C:\Windows\System\TvpSMRV.exe
  2⤵
  PID:4352
- C:\Windows\System\mHMoTlr.exe
  C:\Windows\System\mHMoTlr.exe
  2⤵
  PID:5160
- C:\Windows\System\ZRrUnlp.exe
  C:\Windows\System\ZRrUnlp.exe
  2⤵
  PID:6172
- C:\Windows\System\TIyoHrA.exe
  C:\Windows\System\TIyoHrA.exe
  2⤵
  PID:5276
- C:\Windows\System\vuIDaaO.exe
  C:\Windows\System\vuIDaaO.exe
  2⤵
  PID:5436
- C:\Windows\System\pIYVhHI.exe
  C:\Windows\System\pIYVhHI.exe
  2⤵
  PID:5416
- C:\Windows\System\hDzbsdw.exe
  C:\Windows\System\hDzbsdw.exe
  2⤵
  PID:5128
- C:\Windows\System\NCPYisg.exe
  C:\Windows\System\NCPYisg.exe
  2⤵
  PID:5728
- C:\Windows\System\PLuMQLR.exe
  C:\Windows\System\PLuMQLR.exe
  2⤵
  PID:6084
- C:\Windows\System\CaJngil.exe
  C:\Windows\System\CaJngil.exe
  2⤵
  PID:5916
- C:\Windows\System\dYbZzqz.exe
  C:\Windows\System\dYbZzqz.exe
  2⤵
  PID:5484
- C:\Windows\System\QFSpIjB.exe
  C:\Windows\System\QFSpIjB.exe
  2⤵
  PID:6184
- C:\Windows\System\vJYzlPf.exe
  C:\Windows\System\vJYzlPf.exe
  2⤵
  PID:5732
- C:\Windows\System\HMZlmOV.exe
  C:\Windows\System\HMZlmOV.exe
  2⤵
  PID:6232
- C:\Windows\System\BMgFNkK.exe
  C:\Windows\System\BMgFNkK.exe
  2⤵
  PID:6296
- C:\Windows\System\JanvjaL.exe
  C:\Windows\System\JanvjaL.exe
  2⤵
  PID:6336
- C:\Windows\System\QzgXsnE.exe
  C:\Windows\System\QzgXsnE.exe
  2⤵
  PID:6328
- C:\Windows\System\SqbLnsN.exe
  C:\Windows\System\SqbLnsN.exe
  2⤵
  PID:6376
- C:\Windows\System\fyKlBEv.exe
  C:\Windows\System\fyKlBEv.exe
  2⤵
  PID:6248
- C:\Windows\System\UnnmqQg.exe
  C:\Windows\System\UnnmqQg.exe
  2⤵
  PID:6268
- C:\Windows\System\RkbyGZv.exe
  C:\Windows\System\RkbyGZv.exe
  2⤵
  PID:6300
- C:\Windows\System\TKviBec.exe
  C:\Windows\System\TKviBec.exe
  2⤵
  PID:6344
- C:\Windows\System\dnbmADU.exe
  C:\Windows\System\dnbmADU.exe
  2⤵
  PID:6364
- C:\Windows\System\imSJIlk.exe
  C:\Windows\System\imSJIlk.exe
  2⤵
  PID:6392
- C:\Windows\System\tafQhUz.exe
  C:\Windows\System\tafQhUz.exe
  2⤵
  PID:6412
- C:\Windows\System\WemFeoi.exe
  C:\Windows\System\WemFeoi.exe
  2⤵
  PID:6484
- C:\Windows\System\PTFhTLZ.exe
  C:\Windows\System\PTFhTLZ.exe
  2⤵
  PID:6452
- C:\Windows\System\rvOApIi.exe
  C:\Windows\System\rvOApIi.exe
  2⤵
  PID:6588
- C:\Windows\System\SoueOzq.exe
  C:\Windows\System\SoueOzq.exe
  2⤵
  PID:6652
- C:\Windows\System\YOOIIPS.exe
  C:\Windows\System\YOOIIPS.exe
  2⤵
  PID:6792
- C:\Windows\System\bMIxAyH.exe
  C:\Windows\System\bMIxAyH.exe
  2⤵
  PID:6724
- C:\Windows\System\gdgtLGa.exe
  C:\Windows\System\gdgtLGa.exe
  2⤵
  PID:6656
- C:\Windows\System\gmSRcKq.exe
  C:\Windows\System\gmSRcKq.exe
  2⤵
  PID:6852
- C:\Windows\System\XyTVbSK.exe
  C:\Windows\System\XyTVbSK.exe
  2⤵
  PID:6880
- C:\Windows\System\JpjYKCk.exe
  C:\Windows\System\JpjYKCk.exe
  2⤵
  PID:6864
- C:\Windows\System\tTXtOhh.exe
  C:\Windows\System\tTXtOhh.exe
  2⤵
  PID:6804
- C:\Windows\System\QwvLYpx.exe
  C:\Windows\System\QwvLYpx.exe
  2⤵
  PID:6568
- C:\Windows\System\RQBPtVo.exe
  C:\Windows\System\RQBPtVo.exe
  2⤵
  PID:6672
- C:\Windows\System\ZliZGSn.exe
  C:\Windows\System\ZliZGSn.exe
  2⤵
  PID:6768
- C:\Windows\System\XMgQjET.exe
  C:\Windows\System\XMgQjET.exe
  2⤵
  PID:6932
- C:\Windows\System\nTKcWvY.exe
  C:\Windows\System\nTKcWvY.exe
  2⤵
  PID:6668
- C:\Windows\System\vEabwvk.exe
  C:\Windows\System\vEabwvk.exe
  2⤵
  PID:6772
- C:\Windows\System\ulDntQg.exe
  C:\Windows\System\ulDntQg.exe
  2⤵
  PID:6984
- C:\Windows\System\ArdjIiI.exe
  C:\Windows\System\ArdjIiI.exe
  2⤵
  PID:6968
- C:\Windows\System\AyWHLam.exe
  C:\Windows\System\AyWHLam.exe
  2⤵
  PID:7012
- C:\Windows\System\nhPcbri.exe
  C:\Windows\System\nhPcbri.exe
  2⤵
  PID:7048
- C:\Windows\System\TyKTUro.exe
  C:\Windows\System\TyKTUro.exe
  2⤵
  PID:7144
- C:\Windows\System\rNgtSnE.exe
  C:\Windows\System\rNgtSnE.exe
  2⤵
  PID:5300
- C:\Windows\System\SiiVlWH.exe
  C:\Windows\System\SiiVlWH.exe
  2⤵
  PID:7032
- C:\Windows\System\VGKWJkC.exe
  C:\Windows\System\VGKWJkC.exe
  2⤵
  PID:7096
- C:\Windows\System\syjyNAb.exe
  C:\Windows\System\syjyNAb.exe
  2⤵
  PID:7132
- C:\Windows\System\BvIlCvp.exe
  C:\Windows\System\BvIlCvp.exe
  2⤵
  PID:5608
- C:\Windows\System\pnekbgA.exe
  C:\Windows\System\pnekbgA.exe
  2⤵
  PID:5312
- C:\Windows\System\ZkNPyPy.exe
  C:\Windows\System\ZkNPyPy.exe
  2⤵
  PID:5664
- C:\Windows\System\IZSwYek.exe
  C:\Windows\System\IZSwYek.exe
  2⤵
  PID:6204
- C:\Windows\System\trtbGGN.exe
  C:\Windows\System\trtbGGN.exe
  2⤵
  PID:6220
- C:\Windows\System\QOhuZGl.exe
  C:\Windows\System\QOhuZGl.exe
  2⤵
  PID:6128
- C:\Windows\System\CoAuRsW.exe
  C:\Windows\System\CoAuRsW.exe
  2⤵
  PID:2128
- C:\Windows\System\ZHRGyjD.exe
  C:\Windows\System\ZHRGyjD.exe
  2⤵
  PID:6320
- C:\Windows\System\ORgTquW.exe
  C:\Windows\System\ORgTquW.exe
  2⤵
  PID:6284
- C:\Windows\System\rHBZGTr.exe
  C:\Windows\System\rHBZGTr.exe
  2⤵
  PID:6380
- C:\Windows\System\WpajCRV.exe
  C:\Windows\System\WpajCRV.exe
  2⤵
  PID:6552
- C:\Windows\System\tYNojnF.exe
  C:\Windows\System\tYNojnF.exe
  2⤵
  PID:5144
- C:\Windows\System\jkQZacX.exe
  C:\Windows\System\jkQZacX.exe
  2⤵
  PID:6840
- C:\Windows\System\SJUkAeW.exe
  C:\Windows\System\SJUkAeW.exe
  2⤵
  PID:6340
- C:\Windows\System\XKnGxxS.exe
  C:\Windows\System\XKnGxxS.exe
  2⤵
  PID:6624
- C:\Windows\System\jUQKnrW.exe
  C:\Windows\System\jUQKnrW.exe
  2⤵
  PID:6752
- C:\Windows\System\eVkDZYI.exe
  C:\Windows\System\eVkDZYI.exe
  2⤵
  PID:6892
- C:\Windows\System\bXaSniy.exe
  C:\Windows\System\bXaSniy.exe
  2⤵
  PID:6228
- C:\Windows\System\FhzOjsM.exe
  C:\Windows\System\FhzOjsM.exe
  2⤵
  PID:6572
- C:\Windows\System\UNzGMpl.exe
  C:\Windows\System\UNzGMpl.exe
  2⤵
  PID:6988
- C:\Windows\System\RIVPXPc.exe
  C:\Windows\System\RIVPXPc.exe
  2⤵
  PID:6868
- C:\Windows\System\kZYTjeI.exe
  C:\Windows\System\kZYTjeI.exe
  2⤵
  PID:4524
- C:\Windows\System\KuMtJih.exe
  C:\Windows\System\KuMtJih.exe
  2⤵
  PID:6636
- C:\Windows\System\nrBXdXh.exe
  C:\Windows\System\nrBXdXh.exe
  2⤵
  PID:6936
- C:\Windows\System\zeXHJrB.exe
  C:\Windows\System\zeXHJrB.exe
  2⤵
  PID:6920
- C:\Windows\System\fzEthtH.exe
  C:\Windows\System\fzEthtH.exe
  2⤵
  PID:7112
- C:\Windows\System\aaLfOxD.exe
  C:\Windows\System\aaLfOxD.exe
  2⤵
  PID:5792
- C:\Windows\System\nfyQEIO.exe
  C:\Windows\System\nfyQEIO.exe
  2⤵
  PID:7044
- C:\Windows\System\jsJbKbQ.exe
  C:\Windows\System\jsJbKbQ.exe
  2⤵
  PID:5228
- C:\Windows\System\Ayehwib.exe
  C:\Windows\System\Ayehwib.exe
  2⤵
  PID:7028
- C:\Windows\System\JWATeWc.exe
  C:\Windows\System\JWATeWc.exe
  2⤵
  PID:4208
- C:\Windows\System\NJyxzvN.exe
  C:\Windows\System\NJyxzvN.exe
  2⤵
  PID:5848
- C:\Windows\System\RJyMYzP.exe
  C:\Windows\System\RJyMYzP.exe
  2⤵
  PID:6036
- C:\Windows\System\iaUCzmp.exe
  C:\Windows\System\iaUCzmp.exe
  2⤵
  PID:5560
- C:\Windows\System\ikjbkzI.exe
  C:\Windows\System\ikjbkzI.exe
  2⤵
  PID:6140
- C:\Windows\System\sqIoTFd.exe
  C:\Windows\System\sqIoTFd.exe
  2⤵
  PID:6288
- C:\Windows\System\vbldRPq.exe
  C:\Windows\System\vbldRPq.exe
  2⤵
  PID:6256
- C:\Windows\System\iJUdqVj.exe
  C:\Windows\System\iJUdqVj.exe
  2⤵
  PID:6360
- C:\Windows\System\rWAwrML.exe
  C:\Windows\System\rWAwrML.exe
  2⤵
  PID:6372
- C:\Windows\System\RbZTEqU.exe
  C:\Windows\System\RbZTEqU.exe
  2⤵
  PID:1412
- C:\Windows\System\daVmbbu.exe
  C:\Windows\System\daVmbbu.exe
  2⤵
  PID:5900
- C:\Windows\System\vlZTdFc.exe
  C:\Windows\System\vlZTdFc.exe
  2⤵
  PID:6448
- C:\Windows\System\EKdJTWG.exe
  C:\Windows\System\EKdJTWG.exe
  2⤵
  PID:6736
- C:\Windows\System\hzhdPRR.exe
  C:\Windows\System\hzhdPRR.exe
  2⤵
  PID:6224
- C:\Windows\System\pzafnne.exe
  C:\Windows\System\pzafnne.exe
  2⤵
  PID:6316
- C:\Windows\System\iGdQxVJ.exe
  C:\Windows\System\iGdQxVJ.exe
  2⤵
  PID:6156
- C:\Windows\System\TQqqEHa.exe
  C:\Windows\System\TQqqEHa.exe
  2⤵
  PID:5868
- C:\Windows\System\tKPwtZw.exe
  C:\Windows\System\tKPwtZw.exe
  2⤵
  PID:6972
- C:\Windows\System\vjIjnYV.exe
  C:\Windows\System\vjIjnYV.exe
  2⤵
  PID:5744
- C:\Windows\System\JPRnvsj.exe
  C:\Windows\System\JPRnvsj.exe
  2⤵
  PID:7164
- C:\Windows\System\BzsrrIV.exe
  C:\Windows\System\BzsrrIV.exe
  2⤵
  PID:6276
- C:\Windows\System\dRElcGe.exe
  C:\Windows\System\dRElcGe.exe
  2⤵
  PID:6152
- C:\Windows\System\spICaba.exe
  C:\Windows\System\spICaba.exe
  2⤵
  PID:6756
- C:\Windows\System\SgSpzDW.exe
  C:\Windows\System\SgSpzDW.exe
  2⤵
  PID:6836
- C:\Windows\System\oyqWKKt.exe
  C:\Windows\System\oyqWKKt.exe
  2⤵
  PID:6420
- C:\Windows\System\rVlpjrL.exe
  C:\Windows\System\rVlpjrL.exe
  2⤵
  PID:6888
- C:\Windows\System\IaLSWhm.exe
  C:\Windows\System\IaLSWhm.exe
  2⤵
  PID:6912
- C:\Windows\System\vMqgfuX.exe
  C:\Windows\System\vMqgfuX.exe
  2⤵
  PID:5624
- C:\Windows\System\vKoXprP.exe
  C:\Windows\System\vKoXprP.exe
  2⤵
  PID:6536
- C:\Windows\System\YysBbsN.exe
  C:\Windows\System\YysBbsN.exe
  2⤵
  PID:5964
- C:\Windows\System\ZJOdJPm.exe
  C:\Windows\System\ZJOdJPm.exe
  2⤵
  PID:6556
- C:\Windows\System\BfkmeMI.exe
  C:\Windows\System\BfkmeMI.exe
  2⤵
  PID:5656
- C:\Windows\System\PmZZnTE.exe
  C:\Windows\System\PmZZnTE.exe
  2⤵
  PID:7184
- C:\Windows\System\YBUzBUs.exe
  C:\Windows\System\YBUzBUs.exe
  2⤵
  PID:7200
- C:\Windows\System\xhOqobd.exe
  C:\Windows\System\xhOqobd.exe
  2⤵
  PID:7216
- C:\Windows\System\UjcYBkc.exe
  C:\Windows\System\UjcYBkc.exe
  2⤵
  PID:7232
- C:\Windows\System\gydYpTr.exe
  C:\Windows\System\gydYpTr.exe
  2⤵
  PID:7248
- C:\Windows\System\LbRPoYz.exe
  C:\Windows\System\LbRPoYz.exe
  2⤵
  PID:7264
- C:\Windows\System\MCtsyoe.exe
  C:\Windows\System\MCtsyoe.exe
  2⤵
  PID:7280
- C:\Windows\System\nUbVMPM.exe
  C:\Windows\System\nUbVMPM.exe
  2⤵
  PID:7296
- C:\Windows\System\YDbfLgy.exe
  C:\Windows\System\YDbfLgy.exe
  2⤵
  PID:7312
- C:\Windows\System\DJWTnYQ.exe
  C:\Windows\System\DJWTnYQ.exe
  2⤵
  PID:7328
- C:\Windows\System\dqIJuzw.exe
  C:\Windows\System\dqIJuzw.exe
  2⤵
  PID:7344
- C:\Windows\System\CgPCheJ.exe
  C:\Windows\System\CgPCheJ.exe
  2⤵
  PID:7360
- C:\Windows\System\odPWAwg.exe
  C:\Windows\System\odPWAwg.exe
  2⤵
  PID:7376
- C:\Windows\System\nqdnZEL.exe
  C:\Windows\System\nqdnZEL.exe
  2⤵
  PID:7392
- C:\Windows\System\ADreiMA.exe
  C:\Windows\System\ADreiMA.exe
  2⤵
  PID:7408
- C:\Windows\System\kRGPyPu.exe
  C:\Windows\System\kRGPyPu.exe
  2⤵
  PID:7424
- C:\Windows\System\RBhiWAq.exe
  C:\Windows\System\RBhiWAq.exe
  2⤵
  PID:7440
- C:\Windows\System\VMaXIfh.exe
  C:\Windows\System\VMaXIfh.exe
  2⤵
  PID:7456
- C:\Windows\System\CGssFAw.exe
  C:\Windows\System\CGssFAw.exe
  2⤵
  PID:7476
- C:\Windows\System\pRdObZb.exe
  C:\Windows\System\pRdObZb.exe
  2⤵
  PID:7492
- C:\Windows\System\ohyWxyP.exe
  C:\Windows\System\ohyWxyP.exe
  2⤵
  PID:7508
- C:\Windows\System\Ynhqssy.exe
  C:\Windows\System\Ynhqssy.exe
  2⤵
  PID:7524
- C:\Windows\System\ogbbBqt.exe
  C:\Windows\System\ogbbBqt.exe
  2⤵
  PID:7540
- C:\Windows\System\FZHqaKp.exe
  C:\Windows\System\FZHqaKp.exe
  2⤵
  PID:7556
- C:\Windows\System\IDoBhAk.exe
  C:\Windows\System\IDoBhAk.exe
  2⤵
  PID:7572
- C:\Windows\System\TImtEBx.exe
  C:\Windows\System\TImtEBx.exe
  2⤵
  PID:7588
- C:\Windows\System\TXnLppm.exe
  C:\Windows\System\TXnLppm.exe
  2⤵
  PID:7604
- C:\Windows\System\YVTcsjM.exe
  C:\Windows\System\YVTcsjM.exe
  2⤵
  PID:7620
- C:\Windows\System\wuuoKdS.exe
  C:\Windows\System\wuuoKdS.exe
  2⤵
  PID:7636
- C:\Windows\System\TPLZTXn.exe
  C:\Windows\System\TPLZTXn.exe
  2⤵
  PID:7652
- C:\Windows\System\VMjHmhy.exe
  C:\Windows\System\VMjHmhy.exe
  2⤵
  PID:7668
- C:\Windows\System\LlQuNeN.exe
  C:\Windows\System\LlQuNeN.exe
  2⤵
  PID:7684
- C:\Windows\System\mGaRwaf.exe
  C:\Windows\System\mGaRwaf.exe
  2⤵
  PID:7700
- C:\Windows\System\vqmYjQN.exe
  C:\Windows\System\vqmYjQN.exe
  2⤵
  PID:7716
- C:\Windows\System\YTLnBFK.exe
  C:\Windows\System\YTLnBFK.exe
  2⤵
  PID:7732
- C:\Windows\System\poLTWSo.exe
  C:\Windows\System\poLTWSo.exe
  2⤵
  PID:7748
- C:\Windows\System\YrnhflC.exe
  C:\Windows\System\YrnhflC.exe
  2⤵
  PID:7764
- C:\Windows\System\TzUDRzu.exe
  C:\Windows\System\TzUDRzu.exe
  2⤵
  PID:7780
- C:\Windows\System\kGnggpW.exe
  C:\Windows\System\kGnggpW.exe
  2⤵
  PID:7796
- C:\Windows\System\nCgWMyU.exe
  C:\Windows\System\nCgWMyU.exe
  2⤵
  PID:7812
- C:\Windows\System\ufwKewx.exe
  C:\Windows\System\ufwKewx.exe
  2⤵
  PID:7832
- C:\Windows\System\CRibXhe.exe
  C:\Windows\System\CRibXhe.exe
  2⤵
  PID:7848
- C:\Windows\System\BuldMcu.exe
  C:\Windows\System\BuldMcu.exe
  2⤵
  PID:7864
- C:\Windows\System\MiGvueS.exe
  C:\Windows\System\MiGvueS.exe
  2⤵
  PID:7880
- C:\Windows\System\MBYuwls.exe
  C:\Windows\System\MBYuwls.exe
  2⤵
  PID:7896
- C:\Windows\System\tiFmQoX.exe
  C:\Windows\System\tiFmQoX.exe
  2⤵
  PID:7912
- C:\Windows\System\GjJXEVs.exe
  C:\Windows\System\GjJXEVs.exe
  2⤵
  PID:7928
- C:\Windows\System\gvgSrVS.exe
  C:\Windows\System\gvgSrVS.exe
  2⤵
  PID:7944
- C:\Windows\System\fgPAFru.exe
  C:\Windows\System\fgPAFru.exe
  2⤵
  PID:7960
- C:\Windows\System\sqqncgm.exe
  C:\Windows\System\sqqncgm.exe
  2⤵
  PID:7976
- C:\Windows\System\mhQbzNB.exe
  C:\Windows\System\mhQbzNB.exe
  2⤵
  PID:7992
- C:\Windows\System\LHyEEyB.exe
  C:\Windows\System\LHyEEyB.exe
  2⤵
  PID:8008
- C:\Windows\System\rYzDygZ.exe
  C:\Windows\System\rYzDygZ.exe
  2⤵
  PID:8024
- C:\Windows\System\NOfGSzJ.exe
  C:\Windows\System\NOfGSzJ.exe
  2⤵
  PID:8040
- C:\Windows\System\ZNBGTne.exe
  C:\Windows\System\ZNBGTne.exe
  2⤵
  PID:8056
- C:\Windows\System\skbKVPW.exe
  C:\Windows\System\skbKVPW.exe
  2⤵
  PID:8072
- C:\Windows\System\uhHuEwn.exe
  C:\Windows\System\uhHuEwn.exe
  2⤵
  PID:8088
- C:\Windows\System\rPiLPLY.exe
  C:\Windows\System\rPiLPLY.exe
  2⤵
  PID:8108
- C:\Windows\System\AmLDgvU.exe
  C:\Windows\System\AmLDgvU.exe
  2⤵
  PID:8124
- C:\Windows\System\rqPCVoz.exe
  C:\Windows\System\rqPCVoz.exe
  2⤵
  PID:8140
- C:\Windows\System\byZyMTp.exe
  C:\Windows\System\byZyMTp.exe
  2⤵
  PID:8156
- C:\Windows\System\OCLQVkS.exe
  C:\Windows\System\OCLQVkS.exe
  2⤵
  PID:8172
- C:\Windows\System\uKHBSnx.exe
  C:\Windows\System\uKHBSnx.exe
  2⤵
  PID:8188
- C:\Windows\System\gjOLnyO.exe
  C:\Windows\System\gjOLnyO.exe
  2⤵
  PID:7192
- C:\Windows\System\KfrOkJj.exe
  C:\Windows\System\KfrOkJj.exe
  2⤵
  PID:7256
- C:\Windows\System\HRmULtr.exe
  C:\Windows\System\HRmULtr.exe
  2⤵
  PID:7320
- C:\Windows\System\mPlctOM.exe
  C:\Windows\System\mPlctOM.exe
  2⤵
  PID:7384
- C:\Windows\System\HHwvmDQ.exe
  C:\Windows\System\HHwvmDQ.exe
  2⤵
  PID:7448
- C:\Windows\System\hTdpSvu.exe
  C:\Windows\System\hTdpSvu.exe
  2⤵
  PID:7516
- C:\Windows\System\jeKEIha.exe
  C:\Windows\System\jeKEIha.exe
  2⤵
  PID:5496
- C:\Windows\System\rlxpbvu.exe
  C:\Windows\System\rlxpbvu.exe
  2⤵
  PID:7176
- C:\Windows\System\VsSvRIk.exe
  C:\Windows\System\VsSvRIk.exe
  2⤵
  PID:7240
- C:\Windows\System\MjYBYHB.exe
  C:\Windows\System\MjYBYHB.exe
  2⤵
  PID:7304
- C:\Windows\System\ABqruum.exe
  C:\Windows\System\ABqruum.exe
  2⤵
  PID:7372
- C:\Windows\System\NMeRBIW.exe
  C:\Windows\System\NMeRBIW.exe
  2⤵
  PID:7464
- C:\Windows\System\aqbAaci.exe
  C:\Windows\System\aqbAaci.exe
  2⤵
  PID:7504
- C:\Windows\System\tfotkgB.exe
  C:\Windows\System\tfotkgB.exe
  2⤵
  PID:7584
- C:\Windows\System\RqjmOoN.exe
  C:\Windows\System\RqjmOoN.exe
  2⤵
  PID:7536
- C:\Windows\System\gAezkow.exe
  C:\Windows\System\gAezkow.exe
  2⤵
  PID:7680
- C:\Windows\System\VsZFNKJ.exe
  C:\Windows\System\VsZFNKJ.exe
  2⤵
  PID:7908
- C:\Windows\System\RlCruli.exe
  C:\Windows\System\RlCruli.exe
  2⤵
  PID:7532
- C:\Windows\System\SwssuCa.exe
  C:\Windows\System\SwssuCa.exe
  2⤵
  PID:7632
- C:\Windows\System\HEjLNXc.exe
  C:\Windows\System\HEjLNXc.exe
  2⤵
  PID:7692
- C:\Windows\System\HXrYmCT.exe
  C:\Windows\System\HXrYmCT.exe
  2⤵
  PID:7724
- C:\Windows\System\SkiSlMI.exe
  C:\Windows\System\SkiSlMI.exe
  2⤵
  PID:7792
- C:\Windows\System\dppYghn.exe
  C:\Windows\System\dppYghn.exe
  2⤵
  PID:7924
- C:\Windows\System\GrBVoyd.exe
  C:\Windows\System\GrBVoyd.exe
  2⤵
  PID:8000
- C:\Windows\System\JNikjek.exe
  C:\Windows\System\JNikjek.exe
  2⤵
  PID:8036
- C:\Windows\System\fFbOzaA.exe
  C:\Windows\System\fFbOzaA.exe
  2⤵
  PID:8104
- C:\Windows\System\jrcOgjX.exe
  C:\Windows\System\jrcOgjX.exe
  2⤵
  PID:5248
- C:\Windows\System\IxMpUaW.exe
  C:\Windows\System\IxMpUaW.exe
  2⤵
  PID:7420
- C:\Windows\System\HkPJqqN.exe
  C:\Windows\System\HkPJqqN.exe
  2⤵
  PID:7484
- C:\Windows\System\AhxsgGQ.exe
  C:\Windows\System\AhxsgGQ.exe
  2⤵
  PID:8016
- C:\Windows\System\AoBLtcY.exe
  C:\Windows\System\AoBLtcY.exe
  2⤵
  PID:8116
- C:\Windows\System\WnhLDjz.exe
  C:\Windows\System\WnhLDjz.exe
  2⤵
  PID:6468
- C:\Windows\System\oyKbDKY.exe
  C:\Windows\System\oyKbDKY.exe
  2⤵
  PID:7500
- C:\Windows\System\jnPcldK.exe
  C:\Windows\System\jnPcldK.exe
  2⤵
  PID:7340
- C:\Windows\System\oCyTDZC.exe
  C:\Windows\System\oCyTDZC.exe
  2⤵
  PID:7648
- C:\Windows\System\bmWAKxN.exe
  C:\Windows\System\bmWAKxN.exe
  2⤵
  PID:7712
- C:\Windows\System\hKsXNcm.exe
  C:\Windows\System\hKsXNcm.exe
  2⤵
  PID:7872
- C:\Windows\System\ZeTNcIu.exe
  C:\Windows\System\ZeTNcIu.exe
  2⤵
  PID:7952
- C:\Windows\System\QMisaWf.exe
  C:\Windows\System\QMisaWf.exe
  2⤵
  PID:7936
- C:\Windows\System\IzxXjUd.exe
  C:\Windows\System\IzxXjUd.exe
  2⤵
  PID:7760
- C:\Windows\System\myxCbHw.exe
  C:\Windows\System\myxCbHw.exe
  2⤵
  PID:7968
- C:\Windows\System\idDVFGb.exe
  C:\Windows\System\idDVFGb.exe
  2⤵
  PID:8168
- C:\Windows\System\nrHoOmu.exe
  C:\Windows\System\nrHoOmu.exe
  2⤵
  PID:7292
- C:\Windows\System\VKkixLH.exe
  C:\Windows\System\VKkixLH.exe
  2⤵
  PID:6212
- C:\Windows\System\jMFYHyD.exe
  C:\Windows\System\jMFYHyD.exe
  2⤵
  PID:7368
- C:\Windows\System\XzDvSlI.exe
  C:\Windows\System\XzDvSlI.exe
  2⤵
  PID:6620
- C:\Windows\System\yKukpoV.exe
  C:\Windows\System\yKukpoV.exe
  2⤵
  PID:8180
- C:\Windows\System\VOcQWsQ.exe
  C:\Windows\System\VOcQWsQ.exe
  2⤵
  PID:7352
- C:\Windows\System\doXbmFx.exe
  C:\Windows\System\doXbmFx.exe
  2⤵
  PID:7336
- C:\Windows\System\RICwRFq.exe
  C:\Windows\System\RICwRFq.exe
  2⤵
  PID:7548
- C:\Windows\System\zxCZlEq.exe
  C:\Windows\System\zxCZlEq.exe
  2⤵
  PID:7432
- C:\Windows\System\xDVQiBd.exe
  C:\Windows\System\xDVQiBd.exe
  2⤵
  PID:7776
- C:\Windows\System\KEgWBro.exe
  C:\Windows\System\KEgWBro.exe
  2⤵
  PID:7664
- C:\Windows\System\tImjyBz.exe
  C:\Windows\System\tImjyBz.exe
  2⤵
  PID:7600
- C:\Windows\System\PLwwisc.exe
  C:\Windows\System\PLwwisc.exe
  2⤵
  PID:7856
- C:\Windows\System\VvhTFPd.exe
  C:\Windows\System\VvhTFPd.exe
  2⤵
  PID:8048
- C:\Windows\System\SvjSkIc.exe
  C:\Windows\System\SvjSkIc.exe
  2⤵
  PID:7208
- C:\Windows\System\xtDBoNl.exe
  C:\Windows\System\xtDBoNl.exe
  2⤵
  PID:8032
- C:\Windows\System\SYIEbTD.exe
  C:\Windows\System\SYIEbTD.exe
  2⤵
  PID:7272
- C:\Windows\System\mWdhIzT.exe
  C:\Windows\System\mWdhIzT.exe
  2⤵
  PID:7972
- C:\Windows\System\YVTlXlg.exe
  C:\Windows\System\YVTlXlg.exe
  2⤵
  PID:7808
- C:\Windows\System\hYuUYAe.exe
  C:\Windows\System\hYuUYAe.exe
  2⤵
  PID:7772
- C:\Windows\System\BTRJqTP.exe
  C:\Windows\System\BTRJqTP.exe
  2⤵
  PID:7568
- C:\Windows\System\fHiMYfX.exe
  C:\Windows\System\fHiMYfX.exe
  2⤵
  PID:5380
- C:\Windows\System\NhosqUr.exe
  C:\Windows\System\NhosqUr.exe
  2⤵
  PID:8084
- C:\Windows\System\eEmsVlO.exe
  C:\Windows\System\eEmsVlO.exe
  2⤵
  PID:7616
- C:\Windows\System\dRAcSaM.exe
  C:\Windows\System\dRAcSaM.exe
  2⤵
  PID:8204
- C:\Windows\System\MDDsJPH.exe
  C:\Windows\System\MDDsJPH.exe
  2⤵
  PID:8220
- C:\Windows\System\IoWTrEZ.exe
  C:\Windows\System\IoWTrEZ.exe
  2⤵
  PID:8236
- C:\Windows\System\qrVyjgk.exe
  C:\Windows\System\qrVyjgk.exe
  2⤵
  PID:8252
- C:\Windows\System\MhoCmcZ.exe
  C:\Windows\System\MhoCmcZ.exe
  2⤵
  PID:8268
- C:\Windows\System\ISilpqz.exe
  C:\Windows\System\ISilpqz.exe
  2⤵
  PID:8284
- C:\Windows\System\eYNCqqn.exe
  C:\Windows\System\eYNCqqn.exe
  2⤵
  PID:8300
- C:\Windows\System\MLvVUYh.exe
  C:\Windows\System\MLvVUYh.exe
  2⤵
  PID:8316
- C:\Windows\System\sDjsylv.exe
  C:\Windows\System\sDjsylv.exe
  2⤵
  PID:8332
- C:\Windows\System\mfRvnzd.exe
  C:\Windows\System\mfRvnzd.exe
  2⤵
  PID:8348
- C:\Windows\System\YMFELJs.exe
  C:\Windows\System\YMFELJs.exe
  2⤵
  PID:8364
- C:\Windows\System\lgBnIQc.exe
  C:\Windows\System\lgBnIQc.exe
  2⤵
  PID:8380
- C:\Windows\System\AOwgSiz.exe
  C:\Windows\System\AOwgSiz.exe
  2⤵
  PID:8396
- C:\Windows\System\zsZfbdN.exe
  C:\Windows\System\zsZfbdN.exe
  2⤵
  PID:8412
- C:\Windows\System\eukCNYx.exe
  C:\Windows\System\eukCNYx.exe
  2⤵
  PID:8428
- C:\Windows\System\RpQZhdW.exe
  C:\Windows\System\RpQZhdW.exe
  2⤵
  PID:8444
- C:\Windows\System\aKOcyTN.exe
  C:\Windows\System\aKOcyTN.exe
  2⤵
  PID:8460
- C:\Windows\System\BWHvYIo.exe
  C:\Windows\System\BWHvYIo.exe
  2⤵
  PID:8476
- C:\Windows\System\LGOvwac.exe
  C:\Windows\System\LGOvwac.exe
  2⤵
  PID:8492
- C:\Windows\System\AtFiyjy.exe
  C:\Windows\System\AtFiyjy.exe
  2⤵
  PID:8508
- C:\Windows\System\DNbzeUc.exe
  C:\Windows\System\DNbzeUc.exe
  2⤵
  PID:8524
- C:\Windows\System\IRQEhPH.exe
  C:\Windows\System\IRQEhPH.exe
  2⤵
  PID:8540
- C:\Windows\System\cPorhfV.exe
  C:\Windows\System\cPorhfV.exe
  2⤵
  PID:8556
- C:\Windows\System\afIelaM.exe
  C:\Windows\System\afIelaM.exe
  2⤵
  PID:8572
- C:\Windows\System\BRmzZFw.exe
  C:\Windows\System\BRmzZFw.exe
  2⤵
  PID:8588
- C:\Windows\System\CUnEJWz.exe
  C:\Windows\System\CUnEJWz.exe
  2⤵
  PID:8604
- C:\Windows\System\vXGLYNN.exe
  C:\Windows\System\vXGLYNN.exe
  2⤵
  PID:8620
- C:\Windows\System\xCAJqzU.exe
  C:\Windows\System\xCAJqzU.exe
  2⤵
  PID:8636
- C:\Windows\System\FFKTCoJ.exe
  C:\Windows\System\FFKTCoJ.exe
  2⤵
  PID:8656
- C:\Windows\System\SJPyBKG.exe
  C:\Windows\System\SJPyBKG.exe
  2⤵
  PID:8672
- C:\Windows\System\ppEXWnC.exe
  C:\Windows\System\ppEXWnC.exe
  2⤵
  PID:8688
- C:\Windows\System\CVaVRKB.exe
  C:\Windows\System\CVaVRKB.exe
  2⤵
  PID:8708
- C:\Windows\System\sJiRVCi.exe
  C:\Windows\System\sJiRVCi.exe
  2⤵
  PID:8724
- C:\Windows\System\oSvDdoh.exe
  C:\Windows\System\oSvDdoh.exe
  2⤵
  PID:8740
- C:\Windows\System\WxrUzkh.exe
  C:\Windows\System\WxrUzkh.exe
  2⤵
  PID:8764
- C:\Windows\System\BTfSbDM.exe
  C:\Windows\System\BTfSbDM.exe
  2⤵
  PID:8780
- C:\Windows\System\ZdCHGtV.exe
  C:\Windows\System\ZdCHGtV.exe
  2⤵
  PID:8796
- C:\Windows\System\ToDtkMt.exe
  C:\Windows\System\ToDtkMt.exe
  2⤵
  PID:8812
- C:\Windows\System\pheCDBu.exe
  C:\Windows\System\pheCDBu.exe
  2⤵
  PID:8828
- C:\Windows\System\TgbRmOt.exe
  C:\Windows\System\TgbRmOt.exe
  2⤵
  PID:8844
- C:\Windows\System\SnbQbXr.exe
  C:\Windows\System\SnbQbXr.exe
  2⤵
  PID:8860
- C:\Windows\System\WzRdNaA.exe
  C:\Windows\System\WzRdNaA.exe
  2⤵
  PID:8880
- C:\Windows\System\zmmfLcN.exe
  C:\Windows\System\zmmfLcN.exe
  2⤵
  PID:8896
- C:\Windows\System\QLOfFlC.exe
  C:\Windows\System\QLOfFlC.exe
  2⤵
  PID:8912
- C:\Windows\System\waRFAkT.exe
  C:\Windows\System\waRFAkT.exe
  2⤵
  PID:8928
- C:\Windows\System\onjYyjz.exe
  C:\Windows\System\onjYyjz.exe
  2⤵
  PID:8944
- C:\Windows\System\ArGRDiX.exe
  C:\Windows\System\ArGRDiX.exe
  2⤵
  PID:8964
- C:\Windows\System\EtvKDfm.exe
  C:\Windows\System\EtvKDfm.exe
  2⤵
  PID:8980
- C:\Windows\System\AXXnfBg.exe
  C:\Windows\System\AXXnfBg.exe
  2⤵
  PID:8996
- C:\Windows\System\yqkrRvS.exe
  C:\Windows\System\yqkrRvS.exe
  2⤵
  PID:9012
- C:\Windows\System\vZJnZui.exe
  C:\Windows\System\vZJnZui.exe
  2⤵
  PID:9028
- C:\Windows\System\qjyKQGu.exe
  C:\Windows\System\qjyKQGu.exe
  2⤵
  PID:9044
- C:\Windows\System\usTEKHH.exe
  C:\Windows\System\usTEKHH.exe
  2⤵
  PID:9064
- C:\Windows\System\LUxHMsG.exe
  C:\Windows\System\LUxHMsG.exe
  2⤵
  PID:9080
- C:\Windows\System\OAAqMRI.exe
  C:\Windows\System\OAAqMRI.exe
  2⤵
  PID:9100
- C:\Windows\System\qmRFjou.exe
  C:\Windows\System\qmRFjou.exe
  2⤵
  PID:9116
- C:\Windows\System\hLGRtZh.exe
  C:\Windows\System\hLGRtZh.exe
  2⤵
  PID:9132
- C:\Windows\System\RzSFMaG.exe
  C:\Windows\System\RzSFMaG.exe
  2⤵
  PID:9148
- C:\Windows\System\ThkHwBh.exe
  C:\Windows\System\ThkHwBh.exe
  2⤵
  PID:9164
- C:\Windows\System\fFPaSyl.exe
  C:\Windows\System\fFPaSyl.exe
  2⤵
  PID:9184
- C:\Windows\System\NxlUDgw.exe
  C:\Windows\System\NxlUDgw.exe
  2⤵
  PID:9200
- C:\Windows\System\quQrCgr.exe
  C:\Windows\System\quQrCgr.exe
  2⤵
  PID:8196
- C:\Windows\System\yeCotrC.exe
  C:\Windows\System\yeCotrC.exe
  2⤵
  PID:7708
- C:\Windows\System\bCIkowF.exe
  C:\Windows\System\bCIkowF.exe
  2⤵
  PID:8136
- C:\Windows\System\vfTILoP.exe
  C:\Windows\System\vfTILoP.exe
  2⤵
  PID:8280
- C:\Windows\System\nzLFQvG.exe
  C:\Windows\System\nzLFQvG.exe
  2⤵
  PID:8324
- C:\Windows\System\pVyxCwO.exe
  C:\Windows\System\pVyxCwO.exe
  2⤵
  PID:8388
- C:\Windows\System\GJFiyZf.exe
  C:\Windows\System\GJFiyZf.exe
  2⤵
  PID:8312
- C:\Windows\System\CRlBMZd.exe
  C:\Windows\System\CRlBMZd.exe
  2⤵
  PID:8372
- C:\Windows\System\BJGxAKu.exe
  C:\Windows\System\BJGxAKu.exe
  2⤵
  PID:8436
- C:\Windows\System\GqEsBBQ.exe
  C:\Windows\System\GqEsBBQ.exe
  2⤵
  PID:8488
- C:\Windows\System\mQlKHQJ.exe
  C:\Windows\System\mQlKHQJ.exe
  2⤵
  PID:8440
- C:\Windows\System\LokbDEi.exe
  C:\Windows\System\LokbDEi.exe
  2⤵
  PID:8584
- C:\Windows\System\caHbZUn.exe
  C:\Windows\System\caHbZUn.exe
  2⤵
  PID:8504
- C:\Windows\System\CSpVaBi.exe
  C:\Windows\System\CSpVaBi.exe
  2⤵
  PID:8564
- C:\Windows\System\NrqROJV.exe
  C:\Windows\System\NrqROJV.exe
  2⤵
  PID:8628
- C:\Windows\System\BruvWvZ.exe
  C:\Windows\System\BruvWvZ.exe
  2⤵
  PID:8652
- C:\Windows\System\NvEPHOF.exe
  C:\Windows\System\NvEPHOF.exe
  2⤵
  PID:8720
- C:\Windows\System\pnzjKkv.exe
  C:\Windows\System\pnzjKkv.exe
  2⤵
  PID:8736
- C:\Windows\System\yGEePjO.exe
  C:\Windows\System\yGEePjO.exe
  2⤵
  PID:8704
- C:\Windows\System\WrEkGcb.exe
  C:\Windows\System\WrEkGcb.exe
  2⤵
  PID:8788
- C:\Windows\System\RpVduzp.exe
  C:\Windows\System\RpVduzp.exe
  2⤵
  PID:8852
- C:\Windows\System\wFAoapw.exe
  C:\Windows\System\wFAoapw.exe
  2⤵
  PID:8840
- C:\Windows\System\MZUNYin.exe
  C:\Windows\System\MZUNYin.exe
  2⤵
  PID:8868
- C:\Windows\System\LxssbrF.exe
  C:\Windows\System\LxssbrF.exe
  2⤵
  PID:8920
- C:\Windows\System\AZiSeAz.exe
  C:\Windows\System\AZiSeAz.exe
  2⤵
  PID:8956
- C:\Windows\System\SPDZrZh.exe
  C:\Windows\System\SPDZrZh.exe
  2⤵
  PID:9024
- C:\Windows\System\HGKmqsg.exe
  C:\Windows\System\HGKmqsg.exe
  2⤵
  PID:9092
- C:\Windows\System\TqAAYNe.exe
  C:\Windows\System\TqAAYNe.exe
  2⤵
  PID:9156
- C:\Windows\System\abdlnAf.exe
  C:\Windows\System\abdlnAf.exe
  2⤵
  PID:9004
- C:\Windows\System\sXXzQGO.exe
  C:\Windows\System\sXXzQGO.exe
  2⤵
  PID:9176
- C:\Windows\System\QPLhChW.exe
  C:\Windows\System\QPLhChW.exe
  2⤵
  PID:8940
- C:\Windows\System\srVACCW.exe
  C:\Windows\System\srVACCW.exe
  2⤵
  PID:9040
- C:\Windows\System\lFpcYCv.exe
  C:\Windows\System\lFpcYCv.exe
  2⤵
  PID:9140
- C:\Windows\System\ebibbpy.exe
  C:\Windows\System\ebibbpy.exe
  2⤵
  PID:8228
- C:\Windows\System\ajuQUaU.exe
  C:\Windows\System\ajuQUaU.exe
  2⤵
  PID:9212
- C:\Windows\System\DXqbkIw.exe
  C:\Windows\System\DXqbkIw.exe
  2⤵
  PID:8248
- C:\Windows\System\eOCHYBk.exe
  C:\Windows\System\eOCHYBk.exe
  2⤵
  PID:7288
- C:\Windows\System\lxQCYoQ.exe
  C:\Windows\System\lxQCYoQ.exe
  2⤵
  PID:8356
- C:\Windows\System\wvcyqeQ.exe
  C:\Windows\System\wvcyqeQ.exe
  2⤵
  PID:8340
- C:\Windows\System\ovkEpOK.exe
  C:\Windows\System\ovkEpOK.exe
  2⤵
  PID:8404
- C:\Windows\System\pfCTGAr.exe
  C:\Windows\System\pfCTGAr.exe
  2⤵
  PID:8520
- C:\Windows\System\XenOEki.exe
  C:\Windows\System\XenOEki.exe
  2⤵
  PID:8500
- C:\Windows\System\FjtPPBL.exe
  C:\Windows\System\FjtPPBL.exe
  2⤵
  PID:8664
- C:\Windows\System\ldoTAAs.exe
  C:\Windows\System\ldoTAAs.exe
  2⤵
  PID:8716
- C:\Windows\System\xUQNgDk.exe
  C:\Windows\System\xUQNgDk.exe
  2⤵
  PID:8700
- C:\Windows\System\MFWzvND.exe
  C:\Windows\System\MFWzvND.exe
  2⤵
  PID:8820
- C:\Windows\System\NmBbdKS.exe
  C:\Windows\System\NmBbdKS.exe
  2⤵
  PID:8992
- C:\Windows\System\vXHLjqp.exe
  C:\Windows\System\vXHLjqp.exe
  2⤵
  PID:8960
- C:\Windows\System\GfPPqSX.exe
  C:\Windows\System\GfPPqSX.exe
  2⤵
  PID:9144
- C:\Windows\System\TNRiNcK.exe
  C:\Windows\System\TNRiNcK.exe
  2⤵
  PID:9124
- C:\Windows\System\cibhxua.exe
  C:\Windows\System\cibhxua.exe
  2⤵
  PID:9108
- C:\Windows\System\Rbflaid.exe
  C:\Windows\System\Rbflaid.exe
  2⤵
  PID:8264
- C:\Windows\System\QNacWYK.exe
  C:\Windows\System\QNacWYK.exe
  2⤵
  PID:8232
- C:\Windows\System\UjkVMkd.exe
  C:\Windows\System\UjkVMkd.exe
  2⤵
  PID:8424
- C:\Windows\System\WApFSwE.exe
  C:\Windows\System\WApFSwE.exe
  2⤵
  PID:8468
- C:\Windows\System\ObRWppb.exe
  C:\Windows\System\ObRWppb.exe
  2⤵
  PID:8580
- C:\Windows\System\xkKvsaN.exe
  C:\Windows\System\xkKvsaN.exe
  2⤵
  PID:8836
- C:\Windows\System\iYxCGDH.exe
  C:\Windows\System\iYxCGDH.exe
  2⤵
  PID:8988
- C:\Windows\System\bDRrmOs.exe
  C:\Windows\System\bDRrmOs.exe
  2⤵
  PID:9076
- C:\Windows\System\aGYhsaM.exe
  C:\Windows\System\aGYhsaM.exe
  2⤵
  PID:9228
- C:\Windows\System\NtorCkQ.exe
  C:\Windows\System\NtorCkQ.exe
  2⤵
  PID:9248
- C:\Windows\System\qJAFMMS.exe
  C:\Windows\System\qJAFMMS.exe
  2⤵
  PID:9264
- C:\Windows\System\nYIcIMq.exe
  C:\Windows\System\nYIcIMq.exe
  2⤵
  PID:9280
- C:\Windows\System\vjDoWUZ.exe
  C:\Windows\System\vjDoWUZ.exe
  2⤵
  PID:9296
- C:\Windows\System\tEWaiGN.exe
  C:\Windows\System\tEWaiGN.exe
  2⤵
  PID:9312
- C:\Windows\System\hhUkGXz.exe
  C:\Windows\System\hhUkGXz.exe
  2⤵
  PID:9328
- C:\Windows\System\ZoASnJt.exe
  C:\Windows\System\ZoASnJt.exe
  2⤵
  PID:9344
- C:\Windows\System\bIhcsTY.exe
  C:\Windows\System\bIhcsTY.exe
  2⤵
  PID:9368
- C:\Windows\System\EvZUCGO.exe
  C:\Windows\System\EvZUCGO.exe
  2⤵
  PID:9384
- C:\Windows\System\wjBcBje.exe
  C:\Windows\System\wjBcBje.exe
  2⤵
  PID:9400
- C:\Windows\System\YiiSWzs.exe
  C:\Windows\System\YiiSWzs.exe
  2⤵
  PID:9416
- C:\Windows\System\qVcmRWo.exe
  C:\Windows\System\qVcmRWo.exe
  2⤵
  PID:9436
- C:\Windows\System\lQbVEDM.exe
  C:\Windows\System\lQbVEDM.exe
  2⤵
  PID:9452
- C:\Windows\System\OSnRhsv.exe
  C:\Windows\System\OSnRhsv.exe
  2⤵
  PID:9472
- C:\Windows\System\hBIdmjR.exe
  C:\Windows\System\hBIdmjR.exe
  2⤵
  PID:9488
- C:\Windows\System\ZQlLiUD.exe
  C:\Windows\System\ZQlLiUD.exe
  2⤵
  PID:9504
- C:\Windows\System\zqEwJkm.exe
  C:\Windows\System\zqEwJkm.exe
  2⤵
  PID:9520
- C:\Windows\System\WWwFZrU.exe
  C:\Windows\System\WWwFZrU.exe
  2⤵
  PID:9536
- C:\Windows\System\XdnnoCV.exe
  C:\Windows\System\XdnnoCV.exe
  2⤵
  PID:9556
- C:\Windows\System\PwfMYGD.exe
  C:\Windows\System\PwfMYGD.exe
  2⤵
  PID:9572
- C:\Windows\System\qRnGMQe.exe
  C:\Windows\System\qRnGMQe.exe
  2⤵
  PID:9588
- C:\Windows\System\LWTgwwk.exe
  C:\Windows\System\LWTgwwk.exe
  2⤵
  PID:9604
- C:\Windows\System\tAHsJIW.exe
  C:\Windows\System\tAHsJIW.exe
  2⤵
  PID:9620
- C:\Windows\System\oiuEoRT.exe
  C:\Windows\System\oiuEoRT.exe
  2⤵
  PID:9644
- C:\Windows\System\ZlWozeF.exe
  C:\Windows\System\ZlWozeF.exe
  2⤵
  PID:9660
- C:\Windows\System\qOwLumR.exe
  C:\Windows\System\qOwLumR.exe
  2⤵
  PID:9724
- C:\Windows\System\oMYkDzC.exe
  C:\Windows\System\oMYkDzC.exe
  2⤵
  PID:9744
- C:\Windows\System\URLnwof.exe
  C:\Windows\System\URLnwof.exe
  2⤵
  PID:9760
- C:\Windows\System\cUVHZid.exe
  C:\Windows\System\cUVHZid.exe
  2⤵
  PID:9776
- C:\Windows\System\PiCOcgK.exe
  C:\Windows\System\PiCOcgK.exe
  2⤵
  PID:9792
- C:\Windows\System\JRvBGdU.exe
  C:\Windows\System\JRvBGdU.exe
  2⤵
  PID:9808
- C:\Windows\System\EiKEjdL.exe
  C:\Windows\System\EiKEjdL.exe
  2⤵
  PID:9824
- C:\Windows\System\WTpPLdo.exe
  C:\Windows\System\WTpPLdo.exe
  2⤵
  PID:9840
- C:\Windows\System\KzyZwCz.exe
  C:\Windows\System\KzyZwCz.exe
  2⤵
  PID:9856
- C:\Windows\System\aVDoPTG.exe
  C:\Windows\System\aVDoPTG.exe
  2⤵
  PID:9872
- C:\Windows\System\MpyfZXk.exe
  C:\Windows\System\MpyfZXk.exe
  2⤵
  PID:9888
- C:\Windows\System\nJXLBGC.exe
  C:\Windows\System\nJXLBGC.exe
  2⤵
  PID:9908
- C:\Windows\System\FwcrATc.exe
  C:\Windows\System\FwcrATc.exe
  2⤵
  PID:9924
- C:\Windows\System\WypVyJr.exe
  C:\Windows\System\WypVyJr.exe
  2⤵
  PID:9940
- C:\Windows\System\FXWEkLc.exe
  C:\Windows\System\FXWEkLc.exe
  2⤵
  PID:9956
- C:\Windows\System\xyLJyhU.exe
  C:\Windows\System\xyLJyhU.exe
  2⤵
  PID:9972
- C:\Windows\System\gRomtFW.exe
  C:\Windows\System\gRomtFW.exe
  2⤵
  PID:9988
- C:\Windows\System\KxwiyfT.exe
  C:\Windows\System\KxwiyfT.exe
  2⤵
  PID:10004
- C:\Windows\System\kKcWzRc.exe
  C:\Windows\System\kKcWzRc.exe
  2⤵
  PID:10020
- C:\Windows\System\PodgIdE.exe
  C:\Windows\System\PodgIdE.exe
  2⤵
  PID:10036
- C:\Windows\System\gCYJmgo.exe
  C:\Windows\System\gCYJmgo.exe
  2⤵
  PID:10052
- C:\Windows\System\oGqzznJ.exe
  C:\Windows\System\oGqzznJ.exe
  2⤵
  PID:10068
- C:\Windows\System\XyhqDOG.exe
  C:\Windows\System\XyhqDOG.exe
  2⤵
  PID:10084
- C:\Windows\System\FSGPeKd.exe
  C:\Windows\System\FSGPeKd.exe
  2⤵
  PID:10100
- C:\Windows\System\jlvRVMp.exe
  C:\Windows\System\jlvRVMp.exe
  2⤵
  PID:10116
- C:\Windows\System\lPoavEF.exe
  C:\Windows\System\lPoavEF.exe
  2⤵
  PID:10132
- C:\Windows\System\EtGGhnb.exe
  C:\Windows\System\EtGGhnb.exe
  2⤵
  PID:10148
- C:\Windows\System\HqCPETa.exe
  C:\Windows\System\HqCPETa.exe
  2⤵
  PID:10164
- C:\Windows\System\VBEqPmo.exe
  C:\Windows\System\VBEqPmo.exe
  2⤵
  PID:10180
- C:\Windows\System\FMUaONn.exe
  C:\Windows\System\FMUaONn.exe
  2⤵
  PID:10196
- C:\Windows\System\larnawY.exe
  C:\Windows\System\larnawY.exe
  2⤵
  PID:10212
- C:\Windows\System\AdiuXAb.exe
  C:\Windows\System\AdiuXAb.exe
  2⤵
  PID:10228
- C:\Windows\System\TBRISNk.exe
  C:\Windows\System\TBRISNk.exe
  2⤵
  PID:8892
- C:\Windows\System\FkxsyyM.exe
  C:\Windows\System\FkxsyyM.exe
  2⤵
  PID:9172
- C:\Windows\System\jixaHBG.exe
  C:\Windows\System\jixaHBG.exe
  2⤵
  PID:9208
- C:\Windows\System\jOnvxoG.exe
  C:\Windows\System\jOnvxoG.exe
  2⤵
  PID:8420
- C:\Windows\System\cmOFRmf.exe
  C:\Windows\System\cmOFRmf.exe
  2⤵
  PID:9224
- C:\Windows\System\qVTGjGX.exe
  C:\Windows\System\qVTGjGX.exe
  2⤵
  PID:8596
- C:\Windows\System\TSiloUq.exe
  C:\Windows\System\TSiloUq.exe
  2⤵
  PID:9272
- C:\Windows\System\WXlicsb.exe
  C:\Windows\System\WXlicsb.exe
  2⤵
  PID:9304
- C:\Windows\System\Pieybhj.exe
  C:\Windows\System\Pieybhj.exe
  2⤵
  PID:9320
- C:\Windows\System\HOiBgzx.exe
  C:\Windows\System\HOiBgzx.exe
  2⤵
  PID:9364
- C:\Windows\System\tSfeNKy.exe
  C:\Windows\System\tSfeNKy.exe
  2⤵
  PID:9392
- C:\Windows\System\nAZsXdx.exe
  C:\Windows\System\nAZsXdx.exe
  2⤵
  PID:9432
- C:\Windows\System\EfOYgcS.exe
  C:\Windows\System\EfOYgcS.exe
  2⤵
  PID:9468
- C:\Windows\System\xgCBxJQ.exe
  C:\Windows\System\xgCBxJQ.exe
  2⤵
  PID:9512
- C:\Windows\System\nTjPuSj.exe
  C:\Windows\System\nTjPuSj.exe
  2⤵
  PID:9596
- C:\Windows\System\NYmpYTB.exe
  C:\Windows\System\NYmpYTB.exe
  2⤵
  PID:9640
- C:\Windows\System\sqxNXYX.exe
  C:\Windows\System\sqxNXYX.exe
  2⤵
  PID:9544
- C:\Windows\System\OKnhnms.exe
  C:\Windows\System\OKnhnms.exe
  2⤵
  PID:9584
- C:\Windows\System\CyepklQ.exe
  C:\Windows\System\CyepklQ.exe
  2⤵
  PID:9668
- C:\Windows\System\oNPNCEw.exe
  C:\Windows\System\oNPNCEw.exe
  2⤵
  PID:9704
- C:\Windows\System\gVSflwM.exe
  C:\Windows\System\gVSflwM.exe
  2⤵
  PID:9756
- C:\Windows\System\svOmrsB.exe
  C:\Windows\System\svOmrsB.exe
  2⤵
  PID:9800
- C:\Windows\System\aLWOZsb.exe
  C:\Windows\System\aLWOZsb.exe
  2⤵
  PID:9880
- C:\Windows\System\bqmeRrl.exe
  C:\Windows\System\bqmeRrl.exe
  2⤵
  PID:9864
- C:\Windows\System\LekGrAe.exe
  C:\Windows\System\LekGrAe.exe
  2⤵
  PID:9952
- C:\Windows\System\FaxsUAX.exe
  C:\Windows\System\FaxsUAX.exe
  2⤵
  PID:9836
- C:\Windows\System\CqamCMy.exe
  C:\Windows\System\CqamCMy.exe
  2⤵
  PID:9980
- C:\Windows\System\zxzpfCW.exe
  C:\Windows\System\zxzpfCW.exe
  2⤵
  PID:9996
- C:\Windows\System\FvyVXUm.exe
  C:\Windows\System\FvyVXUm.exe
  2⤵
  PID:10048
- C:\Windows\System\ZKnHdcv.exe
  C:\Windows\System\ZKnHdcv.exe
  2⤵
  PID:10108
- C:\Windows\System\hotLqUE.exe
  C:\Windows\System\hotLqUE.exe
  2⤵
  PID:10112
- C:\Windows\System\DpxtTva.exe
  C:\Windows\System\DpxtTva.exe
  2⤵
  PID:10144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\APxQQQV.exe

Filesize
2.2MB

MD5
8233503b516ec31fd7d5c52afd03fc3a

SHA1
7cb8213c4d723fd010b012ee98e308672a26ebde

SHA256
67f444a621322939c6108b9e628045a47da531e1963f8022de5ef51ec4b025a8

SHA512
99ec312c944b834c5499e42bc18c0af462a78bc60695a78ef54374e2a36c77ae99d03f4f3ee90d42378b0f8a959b9c56523f38753dc2106bfd3514582ee8dfae

Download Submit
C:\Windows\system\BKFaAIy.exe

Filesize
2.2MB

MD5
124fe8596f10a92767e9c53445cae901

SHA1
b12b412d2086aba2d7073cefee943ec776918034

SHA256
4c91af045e436fdae33aaa0fa00ab3f9da9cee1e598890b5c0372a0037415548

SHA512
af9380ca060fc5d6508d5514b996c9bc62975174a6e254db3706ecfe8238d9278a3e6a18f1732b70d25a6f3736430cc716697ce42cdfbed90872b5724a735649

Download Submit
C:\Windows\system\BXjLBYc.exe

Filesize
2.2MB

MD5
b7d6d0c4b445875b2180510a34b3f2b2

SHA1
32bd4a71da07a5e4f81ed8248abcca9bbb629d05

SHA256
9a14165308fe13a78a07403a0b463ca5c41e8f47cb476710a18a51ed2b3deddc

SHA512
c849bc4946a6f743fbdcbc69e1263638b5da8850e96e52e5d34bc3906a9e8638668dbae456ea0e18a1a5891420c2195ec59cfb449110c6fabfc7325397850571

Download Submit
C:\Windows\system\BerEUwZ.exe

Filesize
2.2MB

MD5
4e407651d531cc98847b997b6e01d6b5

SHA1
4b594aa6421784d2099425f36a203cc6f29c7e21

SHA256
0b52b8a12d31054431389822977cacf02a46797c306c2e4ecb10cf40db010a11

SHA512
f4697a006d33973b890500821a1a1d445df48e7512fa3ff2c4c55fd4cb118beda51250b2f7b20ac2e8aa4b5884d0e0423963cd786a24c16948798b0d135e8e1b

Download Submit
C:\Windows\system\CYBzBNQ.exe

Filesize
2.2MB

MD5
9b7b89f06e0b1648cb948f19570d88c0

SHA1
1a9a375d9f23e0850d7650a883e84eb5c8455847

SHA256
fd39cc15f8c7dc3e95c60c3afb2e62d610debf42967427808d870964798239c7

SHA512
c5c51c3cd1f3b329f7837052376b150abacee11352be890efdb8dab349d3210d0e59e80782f6bcbe5173f66fb77c4ae049be657f158ee9f64570d4acbd165b87

Download Submit
C:\Windows\system\EZmzPwA.exe

Filesize
2.2MB

MD5
e467e48b5e59d8f4e6f830fe01611e3a

SHA1
558901b9b5a70d4ab25cc75f9b7fc159e7167289

SHA256
a6d046ebd5c9cd626fa0fc384957394f2de7fad4cc09785d049b7a75ce3271d5

SHA512
136dedda185d4f59067a539e79f480d4dca74c120f6f706c3b3d5eb417479a0155634e8b28171d4326045df623507a2e26eed994926a8611ad8275a614d192c9

Download Submit
C:\Windows\system\HOMnPvE.exe

Filesize
2.2MB

MD5
22c774378e2f21f8631475a0354fa5f2

SHA1
ad9a3e51e250dbefc65df9f825a6a46bc792b28a

SHA256
1da05c21ab87670c14ad30870c91bc175775e808553dd222cee59581ce319afb

SHA512
9637e4cc2c877df9e42ca76b57b7354bd5de48cb371e1628c0a0ace8b17323699c7745fb901f81d4293774c2f3292f9964fac920d1e4216e93aaa1b90b82a7ba

Download Submit
C:\Windows\system\PunDmVh.exe

Filesize
2.2MB

MD5
7ce223efb4f28eeaa83d650b832fb097

SHA1
52b4ef4480adce8c1e40876ec5a60aeec4058260

SHA256
9e807f8b3485dccc86c7bd36dbf113bc2d31143547545297b05a713a6947a743

SHA512
51a35bfea194c45a0e2d4526bb585c9d8870f94029dfe79d3405c8e52fad2c310d8e22bcd98bcc217b7e2614bc2c6da417490ffcf5c0c53ca4200a858c19c72c

Download Submit
C:\Windows\system\bvICkVv.exe

Filesize
2.2MB

MD5
7ac5a21c690a902355e8e264c2bd94c8

SHA1
874a9cae76034ea42f87a43851caf6943626a0da

SHA256
5176873ca05e3097b6d5a611c7e45e0594c8ae03392ee8d0910744751c3833c7

SHA512
b72e925fe485b7a39e3bf19233ade4d76f497685eb941b8f4300daea71d1351967c10c397d8d885c50085b1ed6eadc0a48aab1e30f7aa5341ae06a0833798f8e

Download Submit
C:\Windows\system\fEaeQZK.exe

Filesize
2.2MB

MD5
3d5e8044486b87ca19f3c7e073fe742f

SHA1
c109e3dc37e81f81c5919cdd32bae7e6c8966656

SHA256
ca4a87a115a73c6a9e29bd532f1800f444255378d135de7df4625366da9c95d7

SHA512
4073b669bceb8efa329eb601e11c066e8523a20fedce62eb377cc1ff223d035ec18cfe10fd75754016040885198cf71d3b77dc4aef5991dc247d88eee00c8821

Download Submit
C:\Windows\system\jXdgUyC.exe

Filesize
2.2MB

MD5
602707bf6e5b307d0ffd200625aea757

SHA1
655fc0c91ee338eaad1766111773a6675bbd60ef

SHA256
296e1d92e96dda2aeb392f0c63f220ec3733cb4889e0efdb3a9bc1c2509423c2

SHA512
d688f7724bffba46c51c8929b067f6395646223920588ebe147e68bdf5fa370ae1d76cc10a5b54885d108395e80baa537a1e7cdbd5930783e2797504484b89b3

Download Submit
C:\Windows\system\kZfonIm.exe

Filesize
2.2MB

MD5
b7e389b3f8476360784a3f0ecc0c5b60

SHA1
fa08667f7ab0e10dcc13e59e06f159dc332de9d6

SHA256
731e72b1c16c227278b74df2dcecf12a39b229cffee04c9babaa52d9bf763c14

SHA512
d247612f6c3a99865776e592eebe7aac791a38181993d21dc81c59b288b27934923c7ac32479f0d28af2e5fdf52bc6b20a8832e3d1453f5d7b1552fe845e75b2

Download Submit
C:\Windows\system\rMvLYEc.exe

Filesize
2.2MB

MD5
486029b4dd9befeaac6fe376f1b290f2

SHA1
125ca884727a0b50d5fc13a8bee0cb3a2e32e688

SHA256
b5a82ca4eabf7d7ee3fab4e49ecabf125477725e4d68814615b35a6ac367a33e

SHA512
d86c540c1a269d75512ed0a2e5bd8f795cbe067794e686e63122b9587fab15d221a925fd17286fbbedac9e2c7591280394c7ae4a863c896f4c85624f746a90d3

Download Submit
C:\Windows\system\tJUIxDN.exe

Filesize
2.2MB

MD5
1e0aa7e0b53cbb95d392bd3226d23096

SHA1
0e78f987cc92ed9e4ff3e93231ee5da3e748adae

SHA256
e7ea6cb23bbcca94822af3b7e35f7e86a6aaafa5072a63e10eee74540cf9fac1

SHA512
7fd8fb037b9bf95c5fdc41f0a4c5ba5dc9072f34b8766304ca99c5fa475bb1b43aa76a8e6dc2f284ac923094d422983fb7e98475fb6ab0e79fed8179d3b8fc76

Download Submit
C:\Windows\system\uFwTCdU.exe

Filesize
2.2MB

MD5
b1dce48913285f90dc54bdbb9d637897

SHA1
1c713982d1ac84b0635e6cc76ae8c5c9de9043eb

SHA256
0eb4a89cb709e8910c50f43b3d4dddf4edee4d70a2274a470c28112563aceafd

SHA512
2238c870c1f0f8ea204b343a08960a23d2c319d23b1d76d6a5c782c2fc852868297a31260e8ae7dc00e6793e1c98d216d1afdeeddc3ec6348164a159c59934ea

Download Submit
C:\Windows\system\uwLOapn.exe

Filesize
2.2MB

MD5
17674c5877bf7ce8385f280d337b57c0

SHA1
282bf0b02a69f0730fcb4aee16affa42f850c93b

SHA256
50ec1a7b2a91ef1d25fd9c4378ede7639ddeaf0bbe517d5d8303d99d2683e7d0

SHA512
8159874efc3477acdf0af65a987ab57eab3ceb799b22badfe15b6893eb01d2e5a9afc2db6c3c7f021eefb57d4715f8059dc3d23aa6af9a84f54c2c7dab81f234

Download Submit
C:\Windows\system\vtwPXlr.exe

Filesize
2.2MB

MD5
2493fdf2e406d55d8e9190266e3e6477

SHA1
62eb8dfb773058e2dfd1cabe0f0866534852c468

SHA256
ae017fba09e5d22c671d06fb9259e70ff73a840bb8b3b67d001a6d19e67a677a

SHA512
25aacfee17a3f4cb62c1f7bb85157765f0c406c5e11f4cb443d1f15add254492bd07266225a1b9ac764934b86f53994d75c33844818325231d2e861ae3b65625

Download Submit
C:\Windows\system\xFJgpIu.exe

Filesize
2.2MB

MD5
8f14c110f0bff2c45c53caacda533c6e

SHA1
c68cf1b2236a5c175283781a934ee8dc4d6e53b7

SHA256
84e33ab5f3c09ac9122b1ce30f12771c0cef15f8d3ae7ab4546cebae3ee86701

SHA512
6850d943604bed14f33be6d6aaa3de49361ad878cfd3085cdb7f4b1a402fffc92506c64276587312e8595eabb1f80dfd9cab137204d738e5c21cf53d7489a920

Download Submit
\Windows\system\CyiIhqb.exe

Filesize
2.2MB

MD5
5517f82b5c5eec31a33fdee540acceae

SHA1
dfba32e3a11a49ba0740b727021fcae169ec5caa

SHA256
825381a4e0cfba8f0a432686e27247ef57848cf30e1b1194b51cca3d41c7a7f2

SHA512
1650078efdc3e6638de0dd3a84b2ef68b9410f0fb5ae4b4f6adabd62ea79010a3dbc5cb14728ed21aa0198314b782cebfbfc25b0eef3b8f9dbb48c32c7fe21ed

Download Submit
\Windows\system\HXMROsL.exe

Filesize
2.2MB

MD5
805a588b7b510b4725557d0421517953

SHA1
2d2cbeb3dc5b80cfde7f6bcae9431a0e19e873c2

SHA256
b862d8b3bf2e4f10301fc06a6a69d47ee943f7e3d385ad304155f9eb59908300

SHA512
76bfb95c29daf03dbb14eebfbcaf9c8a14cf7347db5c41e38600154a9e08cf74a9b9b941662400d08fdb3c685d2a46f47f77f21ff4ce642274ac675641427a3e

Download Submit
\Windows\system\KwFDiKc.exe

Filesize
2.2MB

MD5
7b6dade44dda20542cf1fafb5377e484

SHA1
7aa9d488343ab97a54234eaba2041e692febf9b1

SHA256
e558de07ec906d68ae8aa895790f8dee2f74d6c6ce1969846baf5b48f4f97b14

SHA512
c22dc57165d4e8f940f07035b56f5e5d572d1566c258645de9ec15db16bf9b34ed6712e4f2a955e3f7213c7c44257cf1e93754994b145a23634306637374ce56

Download Submit
\Windows\system\LOVpliR.exe

Filesize
2.2MB

MD5
e40d756178bd2b6e14a4be2adf72cb27

SHA1
5a20a084c26de8fc0a9d47f7998ada0a06e91ce3

SHA256
eb1edfa896046d0db495ea1ddac7a5046173c47df8bc4765547b78ec16365e03

SHA512
6f9437f787b38749d0342bd334390756fa49485a77c73a2e961516d2458fa41b9c9baea1bcf0fe6f71cf4a52933c9464e633f2b52ae8f71fb35a198c4e831fdf

Download Submit
\Windows\system\QmMxsLN.exe

Filesize
2.2MB

MD5
2d385b3308d606388628be5258dae40b

SHA1
765cdc950eca38bd20bfa4cdb02cd8486d6135af

SHA256
8205ad481fd5fb2b0c307fde1cc33461c0da7d771bccaad71902d736a620b62e

SHA512
fb8743fdb85f6f192207917f2940bbc67694c3da76f004f5a7222c96eef59118e47c0316e3a1475a95b4978b4339b1cd1ba4762f3b68a391268597c3d37ec9ce

Download Submit
\Windows\system\RlQSwYV.exe

Filesize
2.2MB

MD5
32c69a789965162a3834cef6141ad4d4

SHA1
d9f4cef7bc2da0d42091af2e5e4896bbaac43f68

SHA256
33d81dc56aeeee84a74e388247cba5b29ba70195d9e23242e3ebca85211cfbd1

SHA512
c4e5db8ec20b38fd8666937c53e9d1ea741ae11e3235a09fdd68b94bb84ebb6a198edb825a0cc75cc5e091d1793b800545c633d8229fcbf96af5c63ff0c2b8b9

Download Submit
\Windows\system\UoCcKgc.exe

Filesize
2.2MB

MD5
9f499e7826bfd74d3a39a812833b6ded

SHA1
cca33342bfb9c52a8eeae4543674518ced298cf2

SHA256
2080e6b8bdb27329ffc8d9c95d8f1670c79d70392385cbd89d6b340a0a893a2a

SHA512
fb13570296a5fcbc7429d903c231c783cc30cfa159ffad774727a3d3c306fcf5dab60200b1cda63eedd4c5f2010a3be4b13cf00bd540edefe93ecf71634ba340

Download Submit
\Windows\system\WRrRFPn.exe

Filesize
2.2MB

MD5
409d0bbf3472b41631c58c5ba77c7972

SHA1
8b03cb08541b148fbfef1fca46def01cb57e1e91

SHA256
ce92924adb4823bdc42f768e012d9acf408b33e914146686bb1b79c7603d5359

SHA512
2f702420f70a9a40057f0f318d3852643b494c3dc1ba5e23ad8df45b00ef51508831d1dab09cbfada0a9ab66a9ef7d7ca196af112856ceadf2dffe52ee9dbeb7

Download Submit
\Windows\system\WyhfyjF.exe

Filesize
2.2MB

MD5
f7a2858adff0b2a9a217e2cae6b4d911

SHA1
805157786882bfc1d7b1170134bfd6af02812cda

SHA256
b30aff2b988e11f650ba0469af84c9865e6a511b1c2ff450eb24ab0573d39f11

SHA512
8b8f37d30837debb0a7c41d8a3e7b0daacf04aa48cb0fa69a2801c8bec6c0f40545444233027719769554f28d64e07dbba86bd2dacc8d8ca7b2522527d23f1ac

Download Submit
\Windows\system\cUvMtkt.exe

Filesize
2.2MB

MD5
47aecddcbd4eb547f6fdd6b2d6261a33

SHA1
d4925602789642bf76501fa49129d94cd3529224

SHA256
391a3e456193df7a47aefd84b371919308a0fecc806c029370287cb6af446dd6

SHA512
9313398397094bbb80df3b1a082e34dffd84fb80068202e0f39b78a930367c1fc5038d777af63df016d04a3a3f81d54e96961a3f422fe79c85e9385c319d7f80

Download Submit
\Windows\system\iYemgYa.exe

Filesize
2.2MB

MD5
7087b73aba9473390057376019640468

SHA1
323cc214d47f72ab6b648fdfc04324ab11b9ada9

SHA256
af238510ee599720abd785c11b21f1f4497b1ae09acd246cd02b22e0dc8e9afa

SHA512
7051ba9a1aadca599ca9659040c4e07a44b77ef95fe0bd4d2b4b473376f70f012a9bd570e877cd5af4a6d9ad574ada860faae094e161b2fedbc983eb282b70b8

Download Submit
\Windows\system\mURmCVb.exe

Filesize
2.2MB

MD5
62c8bee8244895e76bc3b16a5430839c

SHA1
9c0a7e771f2c3586ffaf8274035fe9b88250b9e3

SHA256
2e93fe52c9b56ca80ef1f02c29b3d41e455ba1565b2e7ac950cc8d5a16317078

SHA512
20e28d33b5e59664e4d537aa0f0d8a87dcd81aa5dcfb4f8a639f12d150c3683ea2b54731a5b50fea6eac4ae2e9f0f03eb4f3d9fa66a0125ad548ef4125d962b6

Download Submit
\Windows\system\rRvhowC.exe

Filesize
2.2MB

MD5
6bdc50139438410c1c972cceedd358e4

SHA1
00ab664e66482753470217cbb12e063c0d091d9a

SHA256
af6c214afb95846a27b4353d0290f5e48353f44761bcef353c8266f8f6e8c36f

SHA512
53b59fa0cb8e7af8838036bdc5384e95b3c43eb5a4f97e796b5ecd76af452b019cb75a188b595b63680b8d75bdfceb4a382bed18f29cb33d2cc491e624f620ba

Download Submit
\Windows\system\tSrcFNO.exe

Filesize
2.2MB

MD5
20242a9b291d1f7f67973a2b6c0b1e63

SHA1
7d7cb7a7f6a6903a9e58e9563b5e82bfc9a9fd19

SHA256
b1245f93b1ad34e2189fc23f61845e89cee116bf6b5d7127522d7b4e28111a28

SHA512
c7fb5b9358b83b0f139bf4cd1b7f54aade61f331591e35c164682dfdef93001e773bb32ed9b62063b2475255ec9a963465d2948d171f2e273621ba58c1950945

Download Submit
\Windows\system\tvPLiLU.exe

Filesize
2.2MB

MD5
4271129f07f3ed059e8282c2391981be

SHA1
24774eed62e849dfda4fe207484e2eae1bba2281

SHA256
03faa41d49ed4eb501c82a9833794513f4849f3398d507c8019abbd13e1c5df3

SHA512
a7673f90cd475ed643a327aa23d354b8d438ee0a84fefe56f0341ecf8504afe6ebf8156535f089a5791b666647cbf4cdc73ad65f73137b7b73cf098cb7fb7f99

Download Submit
\Windows\system\uUAUjZm.exe

Filesize
2.2MB

MD5
63aa72e61535b9b0ca1d6e59b6d98cea

SHA1
3248335a949ef03e3ea4c36190e112750b2b699e

SHA256
6c2b9bb0c0192763d174e5299ffb5f2b445526f7b601252e5886ff835301e378

SHA512
5c832732f063d6b9b874788e3fe4f65f122077fe5b4861c094933644bec49b1f35aa88e5909ae312e839c2244f72389d4c64d88392d4a115c5a92b8cea98a7f9

Download Submit
\Windows\system\waapcFx.exe

Filesize
2.2MB

MD5
48b0601180f253e7d7d655b791dceffc

SHA1
3ac0e722f20d33913041048ce1afde47ef76e16c

SHA256
f6af9699dad140ec33646a26b327aeb29ce9282217e1e9a3aa3c093f5c25760b

SHA512
bccdb0d9b774e0dc11dda1cbf5c1d9ff60c438ca3c2afd299239bb90c99f181c76f36e4a3b060e0ec3ab66c808e9e2dc10a374ab20484820437a8ae3746cfa43

Download Submit
\Windows\system\xpbmrPx.exe

Filesize
2.2MB

MD5
08e1ca7c78b57be5373d6a9ea54a6ffb

SHA1
2ab604309eed28239769336f3fb53ede476de1cd

SHA256
822856f067bc7a6e1aaa2eb186213f8667ae975b6183f1859459abfe3506a060

SHA512
8fd8209fea033987ce85437725e631ff836139238d91f6e0e93381a7f4145144ac70f765ddc7aee6e4212308d085f07225e71927e0fe899d4c7702e729b4ee5a

Download Submit
memory/1360-116-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/1452-121-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2060-70-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2272-73-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2348-51-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-47-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2376-1019-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2376-54-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2480-34-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-52-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-39-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-56-0x0000000003930000-0x0000000003D22000-memory.dmp

Filesize
3.9MB

Download
memory/2912-76-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1446-0x0000000003930000-0x0000000003D22000-memory.dmp

Filesize
3.9MB

Download
memory/2912-50-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2912-0-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2912-67-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2912-45-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2912-49-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2912-94-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2912-86-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2912-12-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2912-44-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/3000-48-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/3000-40-0x0000000002E20000-0x0000000002EA0000-memory.dmp

Filesize
512KB

Download
memory/3000-59-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/3000-126-0x0000000002E20000-0x0000000002EA0000-memory.dmp

Filesize
512KB

Download
memory/3048-21-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download