xmrig | b07409c6911302d7fd8df5396881e90067ed4478e44f50d0ebadc002131fc584

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
Size

1.8MB
MD5

04291d34f59d3b196aa45f0d04b40cd7
SHA1

0d710adfcbc6a1e3b6201d479fad6768088e436d
SHA256

b07409c6911302d7fd8df5396881e90067ed4478e44f50d0ebadc002131fc584
SHA512

34d35189dbd4d3f875ff9208b298eb43a9dc6069c8284d378f7d4a72e59468801d42e6e738c949e88613d76b87b68b8212c94a6b2253697cd8741da945f5429f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl1:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2188-20-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2936-34-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/1096-293-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/1136-291-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/1156-74-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2360-72-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2692-69-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2560-67-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2588-66-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2504-64-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2936-2080-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2188-2081-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/1096-2083-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2504-3252-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/1156-3356-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2360-3355-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2560-3357-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2588-3391-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2692-3251-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1096	SUMZWDD.exe
2188	XanCreo.exe
2936	FKdOSgd.exe
2504	abgiuMT.exe
2588	zQpxHbE.exe
2560	lGAZOkR.exe
2692	JBePVWY.exe
2360	LzEHDwu.exe
1156	FfbcKQm.exe
2424	RtKQSjQ.exe
1088	aXSEPPS.exe
1672	BkCfUAC.exe
1764	Jeqhgbr.exe
1828	WnzAjYb.exe
1984	itJPPdq.exe
1724	tdcaRaS.exe
2204	vIsCOcN.exe
772	UByYWTV.exe
1108	XSWrcKQ.exe
1452	ggPcepf.exe
2060	tyzjZzF.exe
1912	fCLFyky.exe
1908	SALVHaQ.exe
1464	WywtSVn.exe
1700	AfSTLWD.exe
1436	BdlEqoy.exe
2668	vFPQbca.exe
1648	sXoONkI.exe
2988	fyvsioq.exe
2388	gdZGFzg.exe
2052	BXllKPj.exe
1948	tWtrewF.exe
2136	VfhdMed.exe
2420	qRwECMe.exe
1080	VxMQUsN.exe
692	QOltUmG.exe
2716	vpemfml.exe
324	GctFRkj.exe
1232	EIchHXv.exe
1800	uktPqLU.exe
1680	MGrHOFS.exe
1620	kfikqvW.exe
1180	JBUMiXX.exe
1020	LUZpsSn.exe
2880	wQCZYDM.exe
1688	AlaZtEq.exe
1676	ZBYzLjW.exe
1116	WxmpqQK.exe
1040	gXLlTKT.exe
976	SggASxC.exe
2900	XNafjKS.exe
2708	gyudHxr.exe
2736	oxyKCuz.exe
2760	ezZYfIc.exe
2688	vcQtUlV.exe
3016	JSGWHTK.exe
1716	PngmoZK.exe
2516	lvrFJkg.exe
2812	miCGyFl.exe
2464	COBoehk.exe
936	IMNFoEL.exe
1608	aLYiMhT.exe
2452	ergDzyp.exe
2316	dVKBTmV.exe

Loads dropped DLL 64 IoCs

pid	Process
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1136-0-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x000a00000001466c-3.dat	upx
behavioral1/files/0x000c000000014fe1-7.dat	upx
behavioral1/memory/2188-20-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/1096-13-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/files/0x00080000000155e2-9.dat	upx
behavioral1/files/0x000f0000000006fd-26.dat	upx
behavioral1/files/0x0007000000015c2f-41.dat	upx
behavioral1/files/0x0008000000015a98-40.dat	upx
behavioral1/memory/2936-34-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x000a000000015a2d-33.dat	upx
behavioral1/files/0x0006000000015e6f-61.dat	upx
behavioral1/files/0x0006000000015ec0-94.dat	upx
behavioral1/files/0x0006000000016476-116.dat	upx
behavioral1/files/0x000600000001663d-124.dat	upx
behavioral1/files/0x0006000000016b5e-132.dat	upx
behavioral1/files/0x0006000000016ccf-160.dat	upx
behavioral1/files/0x0006000000016cf0-168.dat	upx
behavioral1/files/0x0006000000016cd4-164.dat	upx
behavioral1/memory/1096-293-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/1136-291-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0006000000016ca9-156.dat	upx
behavioral1/files/0x0006000000016c90-152.dat	upx
behavioral1/files/0x0006000000016c23-148.dat	upx
behavioral1/files/0x0006000000016c1a-144.dat	upx
behavioral1/files/0x0006000000016c10-140.dat	upx
behavioral1/files/0x0006000000016b96-136.dat	upx
behavioral1/files/0x00060000000167db-128.dat	upx
behavioral1/files/0x00060000000165ae-120.dat	upx
behavioral1/files/0x0006000000016332-112.dat	upx
behavioral1/files/0x0006000000016283-108.dat	upx
behavioral1/files/0x000600000001604b-104.dat	upx
behavioral1/files/0x0006000000016042-100.dat	upx
behavioral1/files/0x0006000000015eaf-92.dat	upx
behavioral1/files/0x000a000000015364-88.dat	upx
behavioral1/files/0x0006000000015e7c-82.dat	upx
behavioral1/memory/1156-74-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2360-72-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2692-69-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2560-67-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2588-66-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2504-64-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0006000000015e41-48.dat	upx
behavioral1/files/0x0006000000015e5b-56.dat	upx
behavioral1/memory/2936-2080-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2188-2081-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/1096-2083-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/2504-3252-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/1156-3356-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2360-3355-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2560-3357-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2588-3391-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2692-3251-0x000000013F410000-0x000000013F802000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bnTFmgK.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\ZJVnBrB.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\cJrKldw.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\Ajaapar.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\pDsbXvf.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\atRSRFS.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\URttVrn.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\XlKZfdG.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\gSqaokw.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\fmoHfRC.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\Ikefexn.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\TeaMQWU.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\lyhlNtd.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\zeaspOl.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\iPGMcxq.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\wnwamoT.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\xxSvgNL.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\WhrXbGP.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\guzCJzk.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\UqhZavq.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\hPVNafa.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\EiaeVzT.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\wXXOZPz.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\QqbbumP.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\LMOZKPW.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\QindKVC.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\PBjkXPf.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\OaSnKhS.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\nDmWTyo.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\YNttuVN.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\szfFYGX.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\nDOZdkA.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\fAmBjHl.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\gDDDOlp.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\KiOAKiD.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\etaPyGk.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\eWZeBWC.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\GZVaYsp.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\edLrrzs.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\IzjWXwb.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\iDspUcn.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\hmgVkcv.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\fsIgKJe.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\DiioiUA.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\Xmgwckm.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\SawfUOU.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\bElpdlj.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\eamyvKx.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\GrlLRUL.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\YKWrqTE.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\pkxvxNg.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\DgpISWt.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\eVAmowq.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\AMlAfvJ.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\VfuxHmY.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\DwpkKfj.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\zjhLFai.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\tWpDMZR.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\mgQtNLG.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\pFGNdeR.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\wqAuvCH.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\vbMEbfS.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\pGGAWPq.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
File created	C:\Windows\System\hHTfwWS.exe	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2268	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
Token: SeDebugPrivilege	2268	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2268	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	29
PID 1136 wrote to memory of 2268	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	29
PID 1136 wrote to memory of 2268	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	29
PID 1136 wrote to memory of 1096	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	30
PID 1136 wrote to memory of 1096	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	30
PID 1136 wrote to memory of 1096	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	30
PID 1136 wrote to memory of 2188	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	31
PID 1136 wrote to memory of 2188	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	31
PID 1136 wrote to memory of 2188	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	31
PID 1136 wrote to memory of 2936	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	32
PID 1136 wrote to memory of 2936	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	32
PID 1136 wrote to memory of 2936	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	32
PID 1136 wrote to memory of 2588	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	33
PID 1136 wrote to memory of 2588	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	33
PID 1136 wrote to memory of 2588	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	33
PID 1136 wrote to memory of 2504	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	34
PID 1136 wrote to memory of 2504	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	34
PID 1136 wrote to memory of 2504	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	34
PID 1136 wrote to memory of 2560	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	35
PID 1136 wrote to memory of 2560	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	35
PID 1136 wrote to memory of 2560	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	35
PID 1136 wrote to memory of 2692	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	36
PID 1136 wrote to memory of 2692	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	36
PID 1136 wrote to memory of 2692	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	36
PID 1136 wrote to memory of 1156	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	37
PID 1136 wrote to memory of 1156	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	37
PID 1136 wrote to memory of 1156	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	37
PID 1136 wrote to memory of 2360	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	38
PID 1136 wrote to memory of 2360	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	38
PID 1136 wrote to memory of 2360	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	38
PID 1136 wrote to memory of 2424	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	39
PID 1136 wrote to memory of 2424	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	39
PID 1136 wrote to memory of 2424	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	39
PID 1136 wrote to memory of 1088	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	40
PID 1136 wrote to memory of 1088	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	40
PID 1136 wrote to memory of 1088	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	40
PID 1136 wrote to memory of 1672	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	41
PID 1136 wrote to memory of 1672	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	41
PID 1136 wrote to memory of 1672	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	41
PID 1136 wrote to memory of 1764	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	42
PID 1136 wrote to memory of 1764	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	42
PID 1136 wrote to memory of 1764	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	42
PID 1136 wrote to memory of 1828	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	43
PID 1136 wrote to memory of 1828	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	43
PID 1136 wrote to memory of 1828	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	43
PID 1136 wrote to memory of 1984	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	44
PID 1136 wrote to memory of 1984	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	44
PID 1136 wrote to memory of 1984	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	44
PID 1136 wrote to memory of 1724	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	45
PID 1136 wrote to memory of 1724	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	45
PID 1136 wrote to memory of 1724	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	45
PID 1136 wrote to memory of 2204	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	46
PID 1136 wrote to memory of 2204	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	46
PID 1136 wrote to memory of 2204	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	46
PID 1136 wrote to memory of 772	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	47
PID 1136 wrote to memory of 772	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	47
PID 1136 wrote to memory of 772	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	47
PID 1136 wrote to memory of 1108	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	48
PID 1136 wrote to memory of 1108	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	48
PID 1136 wrote to memory of 1108	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	48
PID 1136 wrote to memory of 1452	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	49
PID 1136 wrote to memory of 1452	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	49
PID 1136 wrote to memory of 1452	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	49
PID 1136 wrote to memory of 2060	1136	04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04291d34f59d3b196aa45f0d04b40cd7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\System\SUMZWDD.exe
  C:\Windows\System\SUMZWDD.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\XanCreo.exe
  C:\Windows\System\XanCreo.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\FKdOSgd.exe
  C:\Windows\System\FKdOSgd.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\zQpxHbE.exe
  C:\Windows\System\zQpxHbE.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\abgiuMT.exe
  C:\Windows\System\abgiuMT.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\lGAZOkR.exe
  C:\Windows\System\lGAZOkR.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\JBePVWY.exe
  C:\Windows\System\JBePVWY.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\FfbcKQm.exe
  C:\Windows\System\FfbcKQm.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\LzEHDwu.exe
  C:\Windows\System\LzEHDwu.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\RtKQSjQ.exe
  C:\Windows\System\RtKQSjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\aXSEPPS.exe
  C:\Windows\System\aXSEPPS.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\BkCfUAC.exe
  C:\Windows\System\BkCfUAC.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\Jeqhgbr.exe
  C:\Windows\System\Jeqhgbr.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\WnzAjYb.exe
  C:\Windows\System\WnzAjYb.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\itJPPdq.exe
  C:\Windows\System\itJPPdq.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\tdcaRaS.exe
  C:\Windows\System\tdcaRaS.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\vIsCOcN.exe
  C:\Windows\System\vIsCOcN.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\UByYWTV.exe
  C:\Windows\System\UByYWTV.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\XSWrcKQ.exe
  C:\Windows\System\XSWrcKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\ggPcepf.exe
  C:\Windows\System\ggPcepf.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\tyzjZzF.exe
  C:\Windows\System\tyzjZzF.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\fCLFyky.exe
  C:\Windows\System\fCLFyky.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\SALVHaQ.exe
  C:\Windows\System\SALVHaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\WywtSVn.exe
  C:\Windows\System\WywtSVn.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\AfSTLWD.exe
  C:\Windows\System\AfSTLWD.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\BdlEqoy.exe
  C:\Windows\System\BdlEqoy.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\vFPQbca.exe
  C:\Windows\System\vFPQbca.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\sXoONkI.exe
  C:\Windows\System\sXoONkI.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\fyvsioq.exe
  C:\Windows\System\fyvsioq.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\gdZGFzg.exe
  C:\Windows\System\gdZGFzg.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\BXllKPj.exe
  C:\Windows\System\BXllKPj.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\tWtrewF.exe
  C:\Windows\System\tWtrewF.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\VfhdMed.exe
  C:\Windows\System\VfhdMed.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\qRwECMe.exe
  C:\Windows\System\qRwECMe.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\VxMQUsN.exe
  C:\Windows\System\VxMQUsN.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\QOltUmG.exe
  C:\Windows\System\QOltUmG.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\vpemfml.exe
  C:\Windows\System\vpemfml.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\GctFRkj.exe
  C:\Windows\System\GctFRkj.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\EIchHXv.exe
  C:\Windows\System\EIchHXv.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\uktPqLU.exe
  C:\Windows\System\uktPqLU.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\MGrHOFS.exe
  C:\Windows\System\MGrHOFS.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\kfikqvW.exe
  C:\Windows\System\kfikqvW.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\JBUMiXX.exe
  C:\Windows\System\JBUMiXX.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\LUZpsSn.exe
  C:\Windows\System\LUZpsSn.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\wQCZYDM.exe
  C:\Windows\System\wQCZYDM.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\AlaZtEq.exe
  C:\Windows\System\AlaZtEq.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ZBYzLjW.exe
  C:\Windows\System\ZBYzLjW.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\WxmpqQK.exe
  C:\Windows\System\WxmpqQK.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\gXLlTKT.exe
  C:\Windows\System\gXLlTKT.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\SggASxC.exe
  C:\Windows\System\SggASxC.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\XNafjKS.exe
  C:\Windows\System\XNafjKS.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\gyudHxr.exe
  C:\Windows\System\gyudHxr.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\oxyKCuz.exe
  C:\Windows\System\oxyKCuz.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\ezZYfIc.exe
  C:\Windows\System\ezZYfIc.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vcQtUlV.exe
  C:\Windows\System\vcQtUlV.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\miCGyFl.exe
  C:\Windows\System\miCGyFl.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\JSGWHTK.exe
  C:\Windows\System\JSGWHTK.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\aLYiMhT.exe
  C:\Windows\System\aLYiMhT.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\PngmoZK.exe
  C:\Windows\System\PngmoZK.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\ergDzyp.exe
  C:\Windows\System\ergDzyp.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\lvrFJkg.exe
  C:\Windows\System\lvrFJkg.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\dVKBTmV.exe
  C:\Windows\System\dVKBTmV.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\COBoehk.exe
  C:\Windows\System\COBoehk.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\MTbpeCM.exe
  C:\Windows\System\MTbpeCM.exe
  2⤵
  PID:2348
- C:\Windows\System\wPqZJgB.exe
  C:\Windows\System\wPqZJgB.exe
  2⤵
  PID:920
- C:\Windows\System\MEMnOMl.exe
  C:\Windows\System\MEMnOMl.exe
  2⤵
  PID:2320
- C:\Windows\System\IMNFoEL.exe
  C:\Windows\System\IMNFoEL.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\irutEmU.exe
  C:\Windows\System\irutEmU.exe
  2⤵
  PID:2324
- C:\Windows\System\eTepAUY.exe
  C:\Windows\System\eTepAUY.exe
  2⤵
  PID:2644
- C:\Windows\System\TRCRDtA.exe
  C:\Windows\System\TRCRDtA.exe
  2⤵
  PID:2968
- C:\Windows\System\ydCWvvZ.exe
  C:\Windows\System\ydCWvvZ.exe
  2⤵
  PID:380
- C:\Windows\System\rjbYJFh.exe
  C:\Windows\System\rjbYJFh.exe
  2⤵
  PID:592
- C:\Windows\System\CxRDcgR.exe
  C:\Windows\System\CxRDcgR.exe
  2⤵
  PID:2408
- C:\Windows\System\LitIlRC.exe
  C:\Windows\System\LitIlRC.exe
  2⤵
  PID:1808
- C:\Windows\System\qCLkkXA.exe
  C:\Windows\System\qCLkkXA.exe
  2⤵
  PID:988
- C:\Windows\System\wbklKvC.exe
  C:\Windows\System\wbklKvC.exe
  2⤵
  PID:1836
- C:\Windows\System\teFIAzP.exe
  C:\Windows\System\teFIAzP.exe
  2⤵
  PID:1664
- C:\Windows\System\wUCfzSG.exe
  C:\Windows\System\wUCfzSG.exe
  2⤵
  PID:1044
- C:\Windows\System\JOegssf.exe
  C:\Windows\System\JOegssf.exe
  2⤵
  PID:1568
- C:\Windows\System\aDPVIrc.exe
  C:\Windows\System\aDPVIrc.exe
  2⤵
  PID:2824
- C:\Windows\System\uAoGNmT.exe
  C:\Windows\System\uAoGNmT.exe
  2⤵
  PID:2184
- C:\Windows\System\VBLysvg.exe
  C:\Windows\System\VBLysvg.exe
  2⤵
  PID:2192
- C:\Windows\System\kXjtiWv.exe
  C:\Windows\System\kXjtiWv.exe
  2⤵
  PID:2272
- C:\Windows\System\rVHqkzE.exe
  C:\Windows\System\rVHqkzE.exe
  2⤵
  PID:2196
- C:\Windows\System\fmgmFoz.exe
  C:\Windows\System\fmgmFoz.exe
  2⤵
  PID:2444
- C:\Windows\System\KGaYCSM.exe
  C:\Windows\System\KGaYCSM.exe
  2⤵
  PID:1744
- C:\Windows\System\kaRMVim.exe
  C:\Windows\System\kaRMVim.exe
  2⤵
  PID:2612
- C:\Windows\System\UfYWeJZ.exe
  C:\Windows\System\UfYWeJZ.exe
  2⤵
  PID:2012
- C:\Windows\System\pTdIdtb.exe
  C:\Windows\System\pTdIdtb.exe
  2⤵
  PID:1200
- C:\Windows\System\EtlyPBs.exe
  C:\Windows\System\EtlyPBs.exe
  2⤵
  PID:2380
- C:\Windows\System\ryQhmko.exe
  C:\Windows\System\ryQhmko.exe
  2⤵
  PID:2328
- C:\Windows\System\hfBtYOK.exe
  C:\Windows\System\hfBtYOK.exe
  2⤵
  PID:2732
- C:\Windows\System\vnhXnKs.exe
  C:\Windows\System\vnhXnKs.exe
  2⤵
  PID:1508
- C:\Windows\System\Ikefexn.exe
  C:\Windows\System\Ikefexn.exe
  2⤵
  PID:896
- C:\Windows\System\SdGKjfs.exe
  C:\Windows\System\SdGKjfs.exe
  2⤵
  PID:2884
- C:\Windows\System\EZDlqtU.exe
  C:\Windows\System\EZDlqtU.exe
  2⤵
  PID:872
- C:\Windows\System\zyAvIvg.exe
  C:\Windows\System\zyAvIvg.exe
  2⤵
  PID:2476
- C:\Windows\System\IwTVMIG.exe
  C:\Windows\System\IwTVMIG.exe
  2⤵
  PID:2232
- C:\Windows\System\pLRuNta.exe
  C:\Windows\System\pLRuNta.exe
  2⤵
  PID:1592
- C:\Windows\System\Esnvain.exe
  C:\Windows\System\Esnvain.exe
  2⤵
  PID:2236
- C:\Windows\System\OsIrNaa.exe
  C:\Windows\System\OsIrNaa.exe
  2⤵
  PID:2556
- C:\Windows\System\kXwTDhL.exe
  C:\Windows\System\kXwTDhL.exe
  2⤵
  PID:2344
- C:\Windows\System\PJzMUyg.exe
  C:\Windows\System\PJzMUyg.exe
  2⤵
  PID:2212
- C:\Windows\System\xlqLzyy.exe
  C:\Windows\System\xlqLzyy.exe
  2⤵
  PID:2332
- C:\Windows\System\gOLDSgB.exe
  C:\Windows\System\gOLDSgB.exe
  2⤵
  PID:1636
- C:\Windows\System\GXBFxQY.exe
  C:\Windows\System\GXBFxQY.exe
  2⤵
  PID:768
- C:\Windows\System\wycSuLm.exe
  C:\Windows\System\wycSuLm.exe
  2⤵
  PID:2664
- C:\Windows\System\hBeTBED.exe
  C:\Windows\System\hBeTBED.exe
  2⤵
  PID:2656
- C:\Windows\System\hEqbphX.exe
  C:\Windows\System\hEqbphX.exe
  2⤵
  PID:956
- C:\Windows\System\YkctxqZ.exe
  C:\Windows\System\YkctxqZ.exe
  2⤵
  PID:2672
- C:\Windows\System\cWluJKs.exe
  C:\Windows\System\cWluJKs.exe
  2⤵
  PID:640
- C:\Windows\System\erVVpUB.exe
  C:\Windows\System\erVVpUB.exe
  2⤵
  PID:2752
- C:\Windows\System\nvvDjJf.exe
  C:\Windows\System\nvvDjJf.exe
  2⤵
  PID:840
- C:\Windows\System\AQvaSHU.exe
  C:\Windows\System\AQvaSHU.exe
  2⤵
  PID:1880
- C:\Windows\System\hrhAckn.exe
  C:\Windows\System\hrhAckn.exe
  2⤵
  PID:2164
- C:\Windows\System\bnTFmgK.exe
  C:\Windows\System\bnTFmgK.exe
  2⤵
  PID:2056
- C:\Windows\System\hUXilrR.exe
  C:\Windows\System\hUXilrR.exe
  2⤵
  PID:1624
- C:\Windows\System\Jrpywjo.exe
  C:\Windows\System\Jrpywjo.exe
  2⤵
  PID:1544
- C:\Windows\System\HgsgicT.exe
  C:\Windows\System\HgsgicT.exe
  2⤵
  PID:2448
- C:\Windows\System\AsMmwSu.exe
  C:\Windows\System\AsMmwSu.exe
  2⤵
  PID:1932
- C:\Windows\System\EgzAvlS.exe
  C:\Windows\System\EgzAvlS.exe
  2⤵
  PID:2888
- C:\Windows\System\guYZuVE.exe
  C:\Windows\System\guYZuVE.exe
  2⤵
  PID:2064
- C:\Windows\System\vvJNncZ.exe
  C:\Windows\System\vvJNncZ.exe
  2⤵
  PID:2872
- C:\Windows\System\KpgPMzC.exe
  C:\Windows\System\KpgPMzC.exe
  2⤵
  PID:2604
- C:\Windows\System\plzgsvY.exe
  C:\Windows\System\plzgsvY.exe
  2⤵
  PID:1628
- C:\Windows\System\mqeCvPU.exe
  C:\Windows\System\mqeCvPU.exe
  2⤵
  PID:2704
- C:\Windows\System\akYMMmW.exe
  C:\Windows\System\akYMMmW.exe
  2⤵
  PID:1736
- C:\Windows\System\aRZAKLs.exe
  C:\Windows\System\aRZAKLs.exe
  2⤵
  PID:1308
- C:\Windows\System\OCaUKnO.exe
  C:\Windows\System\OCaUKnO.exe
  2⤵
  PID:2828
- C:\Windows\System\zAdPSas.exe
  C:\Windows\System\zAdPSas.exe
  2⤵
  PID:2124
- C:\Windows\System\BTMXbfi.exe
  C:\Windows\System\BTMXbfi.exe
  2⤵
  PID:800
- C:\Windows\System\OtAZTGm.exe
  C:\Windows\System\OtAZTGm.exe
  2⤵
  PID:1968
- C:\Windows\System\UITMXwB.exe
  C:\Windows\System\UITMXwB.exe
  2⤵
  PID:2976
- C:\Windows\System\hYRlJHl.exe
  C:\Windows\System\hYRlJHl.exe
  2⤵
  PID:2112
- C:\Windows\System\bFbRjaF.exe
  C:\Windows\System\bFbRjaF.exe
  2⤵
  PID:2700
- C:\Windows\System\vIzvMKm.exe
  C:\Windows\System\vIzvMKm.exe
  2⤵
  PID:1476
- C:\Windows\System\QcWALKg.exe
  C:\Windows\System\QcWALKg.exe
  2⤵
  PID:2832
- C:\Windows\System\cFsvjqB.exe
  C:\Windows\System\cFsvjqB.exe
  2⤵
  PID:1900
- C:\Windows\System\gyXOZEs.exe
  C:\Windows\System\gyXOZEs.exe
  2⤵
  PID:780
- C:\Windows\System\UqIAyBW.exe
  C:\Windows\System\UqIAyBW.exe
  2⤵
  PID:1584
- C:\Windows\System\HPmWXfU.exe
  C:\Windows\System\HPmWXfU.exe
  2⤵
  PID:2944
- C:\Windows\System\RlLzSTf.exe
  C:\Windows\System\RlLzSTf.exe
  2⤵
  PID:2676
- C:\Windows\System\IzjWXwb.exe
  C:\Windows\System\IzjWXwb.exe
  2⤵
  PID:544
- C:\Windows\System\VcqmfDk.exe
  C:\Windows\System\VcqmfDk.exe
  2⤵
  PID:2892
- C:\Windows\System\eMBRWqj.exe
  C:\Windows\System\eMBRWqj.exe
  2⤵
  PID:2304
- C:\Windows\System\XygnKbc.exe
  C:\Windows\System\XygnKbc.exe
  2⤵
  PID:3008
- C:\Windows\System\SSgBdZW.exe
  C:\Windows\System\SSgBdZW.exe
  2⤵
  PID:2488
- C:\Windows\System\tOQYJjs.exe
  C:\Windows\System\tOQYJjs.exe
  2⤵
  PID:2480
- C:\Windows\System\vfxPgoN.exe
  C:\Windows\System\vfxPgoN.exe
  2⤵
  PID:1472
- C:\Windows\System\iWytEGh.exe
  C:\Windows\System\iWytEGh.exe
  2⤵
  PID:1444
- C:\Windows\System\DDRspPL.exe
  C:\Windows\System\DDRspPL.exe
  2⤵
  PID:1980
- C:\Windows\System\rGHSjTc.exe
  C:\Windows\System\rGHSjTc.exe
  2⤵
  PID:2524
- C:\Windows\System\iXdSopH.exe
  C:\Windows\System\iXdSopH.exe
  2⤵
  PID:1344
- C:\Windows\System\GDUTpVW.exe
  C:\Windows\System\GDUTpVW.exe
  2⤵
  PID:2472
- C:\Windows\System\uRRCCDT.exe
  C:\Windows\System\uRRCCDT.exe
  2⤵
  PID:884
- C:\Windows\System\fwHUQmO.exe
  C:\Windows\System\fwHUQmO.exe
  2⤵
  PID:836
- C:\Windows\System\QhGiNEz.exe
  C:\Windows\System\QhGiNEz.exe
  2⤵
  PID:1128
- C:\Windows\System\nfxwWIW.exe
  C:\Windows\System\nfxwWIW.exe
  2⤵
  PID:2540
- C:\Windows\System\GPJsWBH.exe
  C:\Windows\System\GPJsWBH.exe
  2⤵
  PID:3084
- C:\Windows\System\GNdueCR.exe
  C:\Windows\System\GNdueCR.exe
  2⤵
  PID:3104
- C:\Windows\System\OZMxLfv.exe
  C:\Windows\System\OZMxLfv.exe
  2⤵
  PID:3120
- C:\Windows\System\FMJYycn.exe
  C:\Windows\System\FMJYycn.exe
  2⤵
  PID:3136
- C:\Windows\System\ssZYRqo.exe
  C:\Windows\System\ssZYRqo.exe
  2⤵
  PID:3192
- C:\Windows\System\odBZmzL.exe
  C:\Windows\System\odBZmzL.exe
  2⤵
  PID:3208
- C:\Windows\System\fXRHkaw.exe
  C:\Windows\System\fXRHkaw.exe
  2⤵
  PID:3224
- C:\Windows\System\OGnKmoS.exe
  C:\Windows\System\OGnKmoS.exe
  2⤵
  PID:3240
- C:\Windows\System\ivDjzwA.exe
  C:\Windows\System\ivDjzwA.exe
  2⤵
  PID:3260
- C:\Windows\System\WHQFEVB.exe
  C:\Windows\System\WHQFEVB.exe
  2⤵
  PID:3284
- C:\Windows\System\xiPkTFr.exe
  C:\Windows\System\xiPkTFr.exe
  2⤵
  PID:3300
- C:\Windows\System\CFOyACQ.exe
  C:\Windows\System\CFOyACQ.exe
  2⤵
  PID:3316
- C:\Windows\System\BJrZbEy.exe
  C:\Windows\System\BJrZbEy.exe
  2⤵
  PID:3332
- C:\Windows\System\uppigYS.exe
  C:\Windows\System\uppigYS.exe
  2⤵
  PID:3348
- C:\Windows\System\YGdcXWa.exe
  C:\Windows\System\YGdcXWa.exe
  2⤵
  PID:3364
- C:\Windows\System\fHzuDNW.exe
  C:\Windows\System\fHzuDNW.exe
  2⤵
  PID:3388
- C:\Windows\System\HHUOiPi.exe
  C:\Windows\System\HHUOiPi.exe
  2⤵
  PID:3464
- C:\Windows\System\ECXAkEB.exe
  C:\Windows\System\ECXAkEB.exe
  2⤵
  PID:3480
- C:\Windows\System\TLIhxyJ.exe
  C:\Windows\System\TLIhxyJ.exe
  2⤵
  PID:3500
- C:\Windows\System\YGhJCVT.exe
  C:\Windows\System\YGhJCVT.exe
  2⤵
  PID:3516
- C:\Windows\System\JPHYAYF.exe
  C:\Windows\System\JPHYAYF.exe
  2⤵
  PID:3532
- C:\Windows\System\qEsxIsb.exe
  C:\Windows\System\qEsxIsb.exe
  2⤵
  PID:3548
- C:\Windows\System\ZwLFlYA.exe
  C:\Windows\System\ZwLFlYA.exe
  2⤵
  PID:3564
- C:\Windows\System\gjGVPTy.exe
  C:\Windows\System\gjGVPTy.exe
  2⤵
  PID:3580
- C:\Windows\System\ocfFxQc.exe
  C:\Windows\System\ocfFxQc.exe
  2⤵
  PID:3604
- C:\Windows\System\hsVlPST.exe
  C:\Windows\System\hsVlPST.exe
  2⤵
  PID:3620
- C:\Windows\System\zamumYF.exe
  C:\Windows\System\zamumYF.exe
  2⤵
  PID:3636
- C:\Windows\System\JGmjwqv.exe
  C:\Windows\System\JGmjwqv.exe
  2⤵
  PID:3652
- C:\Windows\System\ZsJvTXc.exe
  C:\Windows\System\ZsJvTXc.exe
  2⤵
  PID:3704
- C:\Windows\System\CgQikKy.exe
  C:\Windows\System\CgQikKy.exe
  2⤵
  PID:3720
- C:\Windows\System\YMGJsfa.exe
  C:\Windows\System\YMGJsfa.exe
  2⤵
  PID:3736
- C:\Windows\System\oPLIqAS.exe
  C:\Windows\System\oPLIqAS.exe
  2⤵
  PID:3756
- C:\Windows\System\WybEccD.exe
  C:\Windows\System\WybEccD.exe
  2⤵
  PID:3772
- C:\Windows\System\zxSvmUF.exe
  C:\Windows\System\zxSvmUF.exe
  2⤵
  PID:3792
- C:\Windows\System\hUWROzy.exe
  C:\Windows\System\hUWROzy.exe
  2⤵
  PID:3808
- C:\Windows\System\tZgharv.exe
  C:\Windows\System\tZgharv.exe
  2⤵
  PID:3824
- C:\Windows\System\RAmkRCf.exe
  C:\Windows\System\RAmkRCf.exe
  2⤵
  PID:3844
- C:\Windows\System\SGaFsYz.exe
  C:\Windows\System\SGaFsYz.exe
  2⤵
  PID:3860
- C:\Windows\System\MXUkZvY.exe
  C:\Windows\System\MXUkZvY.exe
  2⤵
  PID:3876
- C:\Windows\System\PzBWmOR.exe
  C:\Windows\System\PzBWmOR.exe
  2⤵
  PID:3896
- C:\Windows\System\QQeYVaY.exe
  C:\Windows\System\QQeYVaY.exe
  2⤵
  PID:3912
- C:\Windows\System\yrJJDrg.exe
  C:\Windows\System\yrJJDrg.exe
  2⤵
  PID:3972
- C:\Windows\System\PReZwJK.exe
  C:\Windows\System\PReZwJK.exe
  2⤵
  PID:3988
- C:\Windows\System\rmRdqjJ.exe
  C:\Windows\System\rmRdqjJ.exe
  2⤵
  PID:4004
- C:\Windows\System\UEqzyDJ.exe
  C:\Windows\System\UEqzyDJ.exe
  2⤵
  PID:4020
- C:\Windows\System\sctDcLQ.exe
  C:\Windows\System\sctDcLQ.exe
  2⤵
  PID:4036
- C:\Windows\System\DJDSTva.exe
  C:\Windows\System\DJDSTva.exe
  2⤵
  PID:4052
- C:\Windows\System\rigoUZk.exe
  C:\Windows\System\rigoUZk.exe
  2⤵
  PID:4068
- C:\Windows\System\QcucNmW.exe
  C:\Windows\System\QcucNmW.exe
  2⤵
  PID:4084
- C:\Windows\System\aqgWvbc.exe
  C:\Windows\System\aqgWvbc.exe
  2⤵
  PID:904
- C:\Windows\System\aITmBkv.exe
  C:\Windows\System\aITmBkv.exe
  2⤵
  PID:2096
- C:\Windows\System\Usbmkeq.exe
  C:\Windows\System\Usbmkeq.exe
  2⤵
  PID:1340
- C:\Windows\System\PuktHDL.exe
  C:\Windows\System\PuktHDL.exe
  2⤵
  PID:1840
- C:\Windows\System\JjnDDwz.exe
  C:\Windows\System\JjnDDwz.exe
  2⤵
  PID:3128
- C:\Windows\System\iTwsfdN.exe
  C:\Windows\System\iTwsfdN.exe
  2⤵
  PID:2764
- C:\Windows\System\ZigOYrF.exe
  C:\Windows\System\ZigOYrF.exe
  2⤵
  PID:2352
- C:\Windows\System\ypJBgOY.exe
  C:\Windows\System\ypJBgOY.exe
  2⤵
  PID:676
- C:\Windows\System\JKmgouc.exe
  C:\Windows\System\JKmgouc.exe
  2⤵
  PID:3148
- C:\Windows\System\zjKYNLd.exe
  C:\Windows\System\zjKYNLd.exe
  2⤵
  PID:3164
- C:\Windows\System\ZSKGveV.exe
  C:\Windows\System\ZSKGveV.exe
  2⤵
  PID:3180
- C:\Windows\System\HVldeqv.exe
  C:\Windows\System\HVldeqv.exe
  2⤵
  PID:3184
- C:\Windows\System\pwmpTvh.exe
  C:\Windows\System\pwmpTvh.exe
  2⤵
  PID:3372
- C:\Windows\System\cJPvGNw.exe
  C:\Windows\System\cJPvGNw.exe
  2⤵
  PID:3272
- C:\Windows\System\zZBWPYs.exe
  C:\Windows\System\zZBWPYs.exe
  2⤵
  PID:3312
- C:\Windows\System\iApnTMC.exe
  C:\Windows\System\iApnTMC.exe
  2⤵
  PID:3380
- C:\Windows\System\uYNumjW.exe
  C:\Windows\System\uYNumjW.exe
  2⤵
  PID:3252
- C:\Windows\System\oURMrsB.exe
  C:\Windows\System\oURMrsB.exe
  2⤵
  PID:3324
- C:\Windows\System\vmqmwfc.exe
  C:\Windows\System\vmqmwfc.exe
  2⤵
  PID:3396
- C:\Windows\System\YBpoiWL.exe
  C:\Windows\System\YBpoiWL.exe
  2⤵
  PID:3416
- C:\Windows\System\UvoZtSG.exe
  C:\Windows\System\UvoZtSG.exe
  2⤵
  PID:3432
- C:\Windows\System\iZtpOds.exe
  C:\Windows\System\iZtpOds.exe
  2⤵
  PID:3448
- C:\Windows\System\pAsJIpI.exe
  C:\Windows\System\pAsJIpI.exe
  2⤵
  PID:3612
- C:\Windows\System\lgUTEHT.exe
  C:\Windows\System\lgUTEHT.exe
  2⤵
  PID:3524
- C:\Windows\System\lyYmZTe.exe
  C:\Windows\System\lyYmZTe.exe
  2⤵
  PID:3596
- C:\Windows\System\SORSbbo.exe
  C:\Windows\System\SORSbbo.exe
  2⤵
  PID:3668
- C:\Windows\System\wczNazc.exe
  C:\Windows\System\wczNazc.exe
  2⤵
  PID:3712
- C:\Windows\System\giaUAfH.exe
  C:\Windows\System\giaUAfH.exe
  2⤵
  PID:3716
- C:\Windows\System\IFgahuQ.exe
  C:\Windows\System\IFgahuQ.exe
  2⤵
  PID:3816
- C:\Windows\System\BxMMoIb.exe
  C:\Windows\System\BxMMoIb.exe
  2⤵
  PID:3764
- C:\Windows\System\HKbHfWT.exe
  C:\Windows\System\HKbHfWT.exe
  2⤵
  PID:3784
- C:\Windows\System\eLrjEiW.exe
  C:\Windows\System\eLrjEiW.exe
  2⤵
  PID:3856
- C:\Windows\System\AngJrLW.exe
  C:\Windows\System\AngJrLW.exe
  2⤵
  PID:3920
- C:\Windows\System\eeDIhAm.exe
  C:\Windows\System\eeDIhAm.exe
  2⤵
  PID:3940
- C:\Windows\System\CleYSWb.exe
  C:\Windows\System\CleYSWb.exe
  2⤵
  PID:3868
- C:\Windows\System\ekhnpdQ.exe
  C:\Windows\System\ekhnpdQ.exe
  2⤵
  PID:3904
- C:\Windows\System\JAjjIWs.exe
  C:\Windows\System\JAjjIWs.exe
  2⤵
  PID:3968
- C:\Windows\System\eqxrYsp.exe
  C:\Windows\System\eqxrYsp.exe
  2⤵
  PID:4076
- C:\Windows\System\EiooxJs.exe
  C:\Windows\System\EiooxJs.exe
  2⤵
  PID:4064
- C:\Windows\System\CnWCLVD.exe
  C:\Windows\System\CnWCLVD.exe
  2⤵
  PID:2024
- C:\Windows\System\MdZiKGC.exe
  C:\Windows\System\MdZiKGC.exe
  2⤵
  PID:2016
- C:\Windows\System\izesONz.exe
  C:\Windows\System\izesONz.exe
  2⤵
  PID:2596
- C:\Windows\System\fYEwWFn.exe
  C:\Windows\System\fYEwWFn.exe
  2⤵
  PID:4016
- C:\Windows\System\kHFDfKB.exe
  C:\Windows\System\kHFDfKB.exe
  2⤵
  PID:3100
- C:\Windows\System\lSOLamp.exe
  C:\Windows\System\lSOLamp.exe
  2⤵
  PID:4044
- C:\Windows\System\EFwSQup.exe
  C:\Windows\System\EFwSQup.exe
  2⤵
  PID:2572
- C:\Windows\System\BriiKQz.exe
  C:\Windows\System\BriiKQz.exe
  2⤵
  PID:1576
- C:\Windows\System\uzQpGAg.exe
  C:\Windows\System\uzQpGAg.exe
  2⤵
  PID:3112
- C:\Windows\System\WCWMzRP.exe
  C:\Windows\System\WCWMzRP.exe
  2⤵
  PID:3172
- C:\Windows\System\sLEiDFa.exe
  C:\Windows\System\sLEiDFa.exe
  2⤵
  PID:3200
- C:\Windows\System\ocfSbIv.exe
  C:\Windows\System\ocfSbIv.exe
  2⤵
  PID:1488
- C:\Windows\System\OnbrAog.exe
  C:\Windows\System\OnbrAog.exe
  2⤵
  PID:3424
- C:\Windows\System\CbaDIgA.exe
  C:\Windows\System\CbaDIgA.exe
  2⤵
  PID:3476
- C:\Windows\System\KLQwYWM.exe
  C:\Windows\System\KLQwYWM.exe
  2⤵
  PID:3512
- C:\Windows\System\ChDgIwt.exe
  C:\Windows\System\ChDgIwt.exe
  2⤵
  PID:3556
- C:\Windows\System\dPRAVYL.exe
  C:\Windows\System\dPRAVYL.exe
  2⤵
  PID:3296
- C:\Windows\System\GgfZubT.exe
  C:\Windows\System\GgfZubT.exe
  2⤵
  PID:3344
- C:\Windows\System\yTuTrLD.exe
  C:\Windows\System\yTuTrLD.exe
  2⤵
  PID:3644
- C:\Windows\System\wAFFxcy.exe
  C:\Windows\System\wAFFxcy.exe
  2⤵
  PID:3888
- C:\Windows\System\azITffz.exe
  C:\Windows\System\azITffz.exe
  2⤵
  PID:3800
- C:\Windows\System\Aqrzcky.exe
  C:\Windows\System\Aqrzcky.exe
  2⤵
  PID:764
- C:\Windows\System\lJXFPWF.exe
  C:\Windows\System\lJXFPWF.exe
  2⤵
  PID:3696
- C:\Windows\System\EWbSvtN.exe
  C:\Windows\System\EWbSvtN.exe
  2⤵
  PID:3936
- C:\Windows\System\LQuvNtI.exe
  C:\Windows\System\LQuvNtI.exe
  2⤵
  PID:3956
- C:\Windows\System\JRhxGyx.exe
  C:\Windows\System\JRhxGyx.exe
  2⤵
  PID:552
- C:\Windows\System\VnmHCLe.exe
  C:\Windows\System\VnmHCLe.exe
  2⤵
  PID:2084
- C:\Windows\System\TNWcqxE.exe
  C:\Windows\System\TNWcqxE.exe
  2⤵
  PID:3840
- C:\Windows\System\ucLuSNp.exe
  C:\Windows\System\ucLuSNp.exe
  2⤵
  PID:4000
- C:\Windows\System\cHCnMLG.exe
  C:\Windows\System\cHCnMLG.exe
  2⤵
  PID:4028
- C:\Windows\System\GzzHzkC.exe
  C:\Windows\System\GzzHzkC.exe
  2⤵
  PID:2756
- C:\Windows\System\JEfoqKs.exe
  C:\Windows\System\JEfoqKs.exe
  2⤵
  PID:2432
- C:\Windows\System\aKvyFaX.exe
  C:\Windows\System\aKvyFaX.exe
  2⤵
  PID:2660
- C:\Windows\System\hsfpesu.exe
  C:\Windows\System\hsfpesu.exe
  2⤵
  PID:4128
- C:\Windows\System\wPpTRrj.exe
  C:\Windows\System\wPpTRrj.exe
  2⤵
  PID:4144
- C:\Windows\System\LKUgRZO.exe
  C:\Windows\System\LKUgRZO.exe
  2⤵
  PID:4184
- C:\Windows\System\arcmaYs.exe
  C:\Windows\System\arcmaYs.exe
  2⤵
  PID:4200
- C:\Windows\System\voiOoeM.exe
  C:\Windows\System\voiOoeM.exe
  2⤵
  PID:4216
- C:\Windows\System\tbGSMaF.exe
  C:\Windows\System\tbGSMaF.exe
  2⤵
  PID:4232
- C:\Windows\System\fAmBjHl.exe
  C:\Windows\System\fAmBjHl.exe
  2⤵
  PID:4252
- C:\Windows\System\rSTuTFY.exe
  C:\Windows\System\rSTuTFY.exe
  2⤵
  PID:4268
- C:\Windows\System\AMlAfvJ.exe
  C:\Windows\System\AMlAfvJ.exe
  2⤵
  PID:4284
- C:\Windows\System\HOgPOyl.exe
  C:\Windows\System\HOgPOyl.exe
  2⤵
  PID:4300
- C:\Windows\System\kqzGGuP.exe
  C:\Windows\System\kqzGGuP.exe
  2⤵
  PID:4320
- C:\Windows\System\CQbWTyL.exe
  C:\Windows\System\CQbWTyL.exe
  2⤵
  PID:4336
- C:\Windows\System\kMFwRWN.exe
  C:\Windows\System\kMFwRWN.exe
  2⤵
  PID:4352
- C:\Windows\System\vMspxHA.exe
  C:\Windows\System\vMspxHA.exe
  2⤵
  PID:4400
- C:\Windows\System\reOdYTt.exe
  C:\Windows\System\reOdYTt.exe
  2⤵
  PID:4432
- C:\Windows\System\AZafvQR.exe
  C:\Windows\System\AZafvQR.exe
  2⤵
  PID:4456
- C:\Windows\System\DUzVuNL.exe
  C:\Windows\System\DUzVuNL.exe
  2⤵
  PID:4476
- C:\Windows\System\bpEUeHZ.exe
  C:\Windows\System\bpEUeHZ.exe
  2⤵
  PID:4496
- C:\Windows\System\smzyZPS.exe
  C:\Windows\System\smzyZPS.exe
  2⤵
  PID:4512
- C:\Windows\System\mgQtNLG.exe
  C:\Windows\System\mgQtNLG.exe
  2⤵
  PID:4528
- C:\Windows\System\atRSRFS.exe
  C:\Windows\System\atRSRFS.exe
  2⤵
  PID:4544
- C:\Windows\System\smRKCxI.exe
  C:\Windows\System\smRKCxI.exe
  2⤵
  PID:4564
- C:\Windows\System\fsIgKJe.exe
  C:\Windows\System\fsIgKJe.exe
  2⤵
  PID:4584
- C:\Windows\System\OLLElyO.exe
  C:\Windows\System\OLLElyO.exe
  2⤵
  PID:4604
- C:\Windows\System\WlNFDjc.exe
  C:\Windows\System\WlNFDjc.exe
  2⤵
  PID:4620
- C:\Windows\System\aZDnHIn.exe
  C:\Windows\System\aZDnHIn.exe
  2⤵
  PID:4636
- C:\Windows\System\uuuBSbR.exe
  C:\Windows\System\uuuBSbR.exe
  2⤵
  PID:4652
- C:\Windows\System\uKhQKRt.exe
  C:\Windows\System\uKhQKRt.exe
  2⤵
  PID:4672
- C:\Windows\System\EIfkxak.exe
  C:\Windows\System\EIfkxak.exe
  2⤵
  PID:4688
- C:\Windows\System\qmgHAbK.exe
  C:\Windows\System\qmgHAbK.exe
  2⤵
  PID:4708
- C:\Windows\System\nZLMQlt.exe
  C:\Windows\System\nZLMQlt.exe
  2⤵
  PID:4732
- C:\Windows\System\TVeXexq.exe
  C:\Windows\System\TVeXexq.exe
  2⤵
  PID:4748
- C:\Windows\System\pbYXSGy.exe
  C:\Windows\System\pbYXSGy.exe
  2⤵
  PID:4764
- C:\Windows\System\htXIJTA.exe
  C:\Windows\System\htXIJTA.exe
  2⤵
  PID:4780
- C:\Windows\System\YkhnwdM.exe
  C:\Windows\System\YkhnwdM.exe
  2⤵
  PID:4796
- C:\Windows\System\SkHqvMe.exe
  C:\Windows\System\SkHqvMe.exe
  2⤵
  PID:4812
- C:\Windows\System\RPkMGYP.exe
  C:\Windows\System\RPkMGYP.exe
  2⤵
  PID:4828
- C:\Windows\System\PjtlodJ.exe
  C:\Windows\System\PjtlodJ.exe
  2⤵
  PID:4844
- C:\Windows\System\HfRNxts.exe
  C:\Windows\System\HfRNxts.exe
  2⤵
  PID:4860
- C:\Windows\System\LcJuqWL.exe
  C:\Windows\System\LcJuqWL.exe
  2⤵
  PID:4876
- C:\Windows\System\XxyYHFL.exe
  C:\Windows\System\XxyYHFL.exe
  2⤵
  PID:4892
- C:\Windows\System\zlHDTEc.exe
  C:\Windows\System\zlHDTEc.exe
  2⤵
  PID:4912
- C:\Windows\System\awlOnFN.exe
  C:\Windows\System\awlOnFN.exe
  2⤵
  PID:4936
- C:\Windows\System\lrvVDiD.exe
  C:\Windows\System\lrvVDiD.exe
  2⤵
  PID:4952
- C:\Windows\System\ncMNhFA.exe
  C:\Windows\System\ncMNhFA.exe
  2⤵
  PID:4968
- C:\Windows\System\mpTWSJU.exe
  C:\Windows\System\mpTWSJU.exe
  2⤵
  PID:4984
- C:\Windows\System\EORuZbn.exe
  C:\Windows\System\EORuZbn.exe
  2⤵
  PID:5000
- C:\Windows\System\LWOVzbx.exe
  C:\Windows\System\LWOVzbx.exe
  2⤵
  PID:5016
- C:\Windows\System\cCMENPz.exe
  C:\Windows\System\cCMENPz.exe
  2⤵
  PID:5036
- C:\Windows\System\xsLFgpj.exe
  C:\Windows\System\xsLFgpj.exe
  2⤵
  PID:5056
- C:\Windows\System\rIBsMox.exe
  C:\Windows\System\rIBsMox.exe
  2⤵
  PID:5072
- C:\Windows\System\LMJOYea.exe
  C:\Windows\System\LMJOYea.exe
  2⤵
  PID:5088
- C:\Windows\System\QTaXbyD.exe
  C:\Windows\System\QTaXbyD.exe
  2⤵
  PID:5104
- C:\Windows\System\BjCLPoN.exe
  C:\Windows\System\BjCLPoN.exe
  2⤵
  PID:3984
- C:\Windows\System\KyzkYKs.exe
  C:\Windows\System\KyzkYKs.exe
  2⤵
  PID:3144
- C:\Windows\System\Lkrvayt.exe
  C:\Windows\System\Lkrvayt.exe
  2⤵
  PID:3496
- C:\Windows\System\TKxiJhM.exe
  C:\Windows\System\TKxiJhM.exe
  2⤵
  PID:3748
- C:\Windows\System\JyOBFEU.exe
  C:\Windows\System\JyOBFEU.exe
  2⤵
  PID:3728
- C:\Windows\System\Bzrglbw.exe
  C:\Windows\System\Bzrglbw.exe
  2⤵
  PID:4060
- C:\Windows\System\frVztXM.exe
  C:\Windows\System\frVztXM.exe
  2⤵
  PID:1572
- C:\Windows\System\DKizXMr.exe
  C:\Windows\System\DKizXMr.exe
  2⤵
  PID:3160
- C:\Windows\System\ZJMUzkZ.exe
  C:\Windows\System\ZJMUzkZ.exe
  2⤵
  PID:2632
- C:\Windows\System\sHySOeG.exe
  C:\Windows\System\sHySOeG.exe
  2⤵
  PID:3544
- C:\Windows\System\hSOQQUh.exe
  C:\Windows\System\hSOQQUh.exe
  2⤵
  PID:3592
- C:\Windows\System\fjUYLuI.exe
  C:\Windows\System\fjUYLuI.exe
  2⤵
  PID:3932
- C:\Windows\System\tJtjvEI.exe
  C:\Windows\System\tJtjvEI.exe
  2⤵
  PID:3832
- C:\Windows\System\mVsMnoz.exe
  C:\Windows\System\mVsMnoz.exe
  2⤵
  PID:3436
- C:\Windows\System\jiGiOmf.exe
  C:\Windows\System\jiGiOmf.exe
  2⤵
  PID:4156
- C:\Windows\System\lnUTnTG.exe
  C:\Windows\System\lnUTnTG.exe
  2⤵
  PID:4168
- C:\Windows\System\BqdUOfM.exe
  C:\Windows\System\BqdUOfM.exe
  2⤵
  PID:4192
- C:\Windows\System\TZgsBat.exe
  C:\Windows\System\TZgsBat.exe
  2⤵
  PID:4248
- C:\Windows\System\jCVJMHx.exe
  C:\Windows\System\jCVJMHx.exe
  2⤵
  PID:4312
- C:\Windows\System\wBAdznp.exe
  C:\Windows\System\wBAdznp.exe
  2⤵
  PID:4332
- C:\Windows\System\mzvzbqJ.exe
  C:\Windows\System\mzvzbqJ.exe
  2⤵
  PID:4348
- C:\Windows\System\ifCxABH.exe
  C:\Windows\System\ifCxABH.exe
  2⤵
  PID:4376
- C:\Windows\System\XplnECk.exe
  C:\Windows\System\XplnECk.exe
  2⤵
  PID:4416
- C:\Windows\System\doDZoYu.exe
  C:\Windows\System\doDZoYu.exe
  2⤵
  PID:4412
- C:\Windows\System\yRDoEKF.exe
  C:\Windows\System\yRDoEKF.exe
  2⤵
  PID:4464
- C:\Windows\System\WrFSCnt.exe
  C:\Windows\System\WrFSCnt.exe
  2⤵
  PID:4452
- C:\Windows\System\IqhQNGy.exe
  C:\Windows\System\IqhQNGy.exe
  2⤵
  PID:4612
- C:\Windows\System\izejULa.exe
  C:\Windows\System\izejULa.exe
  2⤵
  PID:4520
- C:\Windows\System\pQgDKdo.exe
  C:\Windows\System\pQgDKdo.exe
  2⤵
  PID:4560
- C:\Windows\System\SQeGVvF.exe
  C:\Windows\System\SQeGVvF.exe
  2⤵
  PID:4720
- C:\Windows\System\NEdhaKa.exe
  C:\Windows\System\NEdhaKa.exe
  2⤵
  PID:4700
- C:\Windows\System\wUqaSWy.exe
  C:\Windows\System\wUqaSWy.exe
  2⤵
  PID:4756
- C:\Windows\System\xxSvgNL.exe
  C:\Windows\System\xxSvgNL.exe
  2⤵
  PID:4804
- C:\Windows\System\fhbzyRV.exe
  C:\Windows\System\fhbzyRV.exe
  2⤵
  PID:4888
- C:\Windows\System\OLdeYgl.exe
  C:\Windows\System\OLdeYgl.exe
  2⤵
  PID:4976
- C:\Windows\System\XBFsadP.exe
  C:\Windows\System\XBFsadP.exe
  2⤵
  PID:5044
- C:\Windows\System\WYfLwir.exe
  C:\Windows\System\WYfLwir.exe
  2⤵
  PID:4992
- C:\Windows\System\EJFduTf.exe
  C:\Windows\System\EJFduTf.exe
  2⤵
  PID:5048
- C:\Windows\System\UndwrxG.exe
  C:\Windows\System\UndwrxG.exe
  2⤵
  PID:5112
- C:\Windows\System\ETMbeYX.exe
  C:\Windows\System\ETMbeYX.exe
  2⤵
  PID:5068
- C:\Windows\System\YzVGXTd.exe
  C:\Windows\System\YzVGXTd.exe
  2⤵
  PID:2908
- C:\Windows\System\XzMRFGp.exe
  C:\Windows\System\XzMRFGp.exe
  2⤵
  PID:3892
- C:\Windows\System\EcvNgNs.exe
  C:\Windows\System\EcvNgNs.exe
  2⤵
  PID:584
- C:\Windows\System\YQXtdGr.exe
  C:\Windows\System\YQXtdGr.exe
  2⤵
  PID:3412
- C:\Windows\System\cVFQGMV.exe
  C:\Windows\System\cVFQGMV.exe
  2⤵
  PID:1652
- C:\Windows\System\zBpUeQD.exe
  C:\Windows\System\zBpUeQD.exe
  2⤵
  PID:3852
- C:\Windows\System\uKdLTWh.exe
  C:\Windows\System\uKdLTWh.exe
  2⤵
  PID:4116
- C:\Windows\System\BsciUXM.exe
  C:\Windows\System\BsciUXM.exe
  2⤵
  PID:3356
- C:\Windows\System\ITKWEcm.exe
  C:\Windows\System\ITKWEcm.exe
  2⤵
  PID:1212
- C:\Windows\System\FzeFanL.exe
  C:\Windows\System\FzeFanL.exe
  2⤵
  PID:4136
- C:\Windows\System\TVQUkdS.exe
  C:\Windows\System\TVQUkdS.exe
  2⤵
  PID:2924
- C:\Windows\System\aFwOAxb.exe
  C:\Windows\System\aFwOAxb.exe
  2⤵
  PID:3588
- C:\Windows\System\mqvtVZZ.exe
  C:\Windows\System\mqvtVZZ.exe
  2⤵
  PID:4260
- C:\Windows\System\mTCYndj.exe
  C:\Windows\System\mTCYndj.exe
  2⤵
  PID:4308
- C:\Windows\System\LMOZKPW.exe
  C:\Windows\System\LMOZKPW.exe
  2⤵
  PID:4396
- C:\Windows\System\XcWwpsr.exe
  C:\Windows\System\XcWwpsr.exe
  2⤵
  PID:4344
- C:\Windows\System\IEFiZzO.exe
  C:\Windows\System\IEFiZzO.exe
  2⤵
  PID:4540
- C:\Windows\System\LcVpgbh.exe
  C:\Windows\System\LcVpgbh.exe
  2⤵
  PID:1604
- C:\Windows\System\sYHKcpB.exe
  C:\Windows\System\sYHKcpB.exe
  2⤵
  PID:4628
- C:\Windows\System\dqcxVek.exe
  C:\Windows\System\dqcxVek.exe
  2⤵
  PID:4488
- C:\Windows\System\VtWAHqu.exe
  C:\Windows\System\VtWAHqu.exe
  2⤵
  PID:4792
- C:\Windows\System\ZigJHsY.exe
  C:\Windows\System\ZigJHsY.exe
  2⤵
  PID:4728
- C:\Windows\System\ZPiDFtK.exe
  C:\Windows\System\ZPiDFtK.exe
  2⤵
  PID:4924
- C:\Windows\System\IEuInqj.exe
  C:\Windows\System\IEuInqj.exe
  2⤵
  PID:4944
- C:\Windows\System\fDwnXXO.exe
  C:\Windows\System\fDwnXXO.exe
  2⤵
  PID:4964
- C:\Windows\System\QCkCkZG.exe
  C:\Windows\System\QCkCkZG.exe
  2⤵
  PID:3996
- C:\Windows\System\yfJHaRS.exe
  C:\Windows\System\yfJHaRS.exe
  2⤵
  PID:568
- C:\Windows\System\GhAyBwM.exe
  C:\Windows\System\GhAyBwM.exe
  2⤵
  PID:4664
- C:\Windows\System\FcfzvCe.exe
  C:\Windows\System\FcfzvCe.exe
  2⤵
  PID:2500
- C:\Windows\System\cyIfzKx.exe
  C:\Windows\System\cyIfzKx.exe
  2⤵
  PID:4124
- C:\Windows\System\uMSSMVs.exe
  C:\Windows\System\uMSSMVs.exe
  2⤵
  PID:2784
- C:\Windows\System\eCwcEKY.exe
  C:\Windows\System\eCwcEKY.exe
  2⤵
  PID:5064
- C:\Windows\System\WNZtanY.exe
  C:\Windows\System\WNZtanY.exe
  2⤵
  PID:3472
- C:\Windows\System\whTxlUE.exe
  C:\Windows\System\whTxlUE.exe
  2⤵
  PID:4140
- C:\Windows\System\MKuPlAz.exe
  C:\Windows\System\MKuPlAz.exe
  2⤵
  PID:4580
- C:\Windows\System\rhIqMnI.exe
  C:\Windows\System\rhIqMnI.exe
  2⤵
  PID:3576
- C:\Windows\System\SMdjzPM.exe
  C:\Windows\System\SMdjzPM.exe
  2⤵
  PID:4360
- C:\Windows\System\UxvTRrW.exe
  C:\Windows\System\UxvTRrW.exe
  2⤵
  PID:4468
- C:\Windows\System\iLrFGIK.exe
  C:\Windows\System\iLrFGIK.exe
  2⤵
  PID:4772
- C:\Windows\System\vGuFgpm.exe
  C:\Windows\System\vGuFgpm.exe
  2⤵
  PID:4776
- C:\Windows\System\rzXxonP.exe
  C:\Windows\System\rzXxonP.exe
  2⤵
  PID:4840
- C:\Windows\System\jPLclAo.exe
  C:\Windows\System\jPLclAo.exe
  2⤵
  PID:4316
- C:\Windows\System\cvUKffS.exe
  C:\Windows\System\cvUKffS.exe
  2⤵
  PID:108
- C:\Windows\System\ygKpoqm.exe
  C:\Windows\System\ygKpoqm.exe
  2⤵
  PID:3688
- C:\Windows\System\dFMnaoA.exe
  C:\Windows\System\dFMnaoA.exe
  2⤵
  PID:4684
- C:\Windows\System\LaZrbbg.exe
  C:\Windows\System\LaZrbbg.exe
  2⤵
  PID:4576
- C:\Windows\System\ikOTVmy.exe
  C:\Windows\System\ikOTVmy.exe
  2⤵
  PID:4788
- C:\Windows\System\NtWqIoq.exe
  C:\Windows\System\NtWqIoq.exe
  2⤵
  PID:4104
- C:\Windows\System\ITUCWgg.exe
  C:\Windows\System\ITUCWgg.exe
  2⤵
  PID:4852
- C:\Windows\System\pMBnGgQ.exe
  C:\Windows\System\pMBnGgQ.exe
  2⤵
  PID:4668
- C:\Windows\System\zOFacGi.exe
  C:\Windows\System\zOFacGi.exe
  2⤵
  PID:4552
- C:\Windows\System\QkfQJIu.exe
  C:\Windows\System\QkfQJIu.exe
  2⤵
  PID:5132
- C:\Windows\System\KOlKQoj.exe
  C:\Windows\System\KOlKQoj.exe
  2⤵
  PID:5192
- C:\Windows\System\GxFdATd.exe
  C:\Windows\System\GxFdATd.exe
  2⤵
  PID:5208
- C:\Windows\System\PpZLQEm.exe
  C:\Windows\System\PpZLQEm.exe
  2⤵
  PID:5224
- C:\Windows\System\uTJciNO.exe
  C:\Windows\System\uTJciNO.exe
  2⤵
  PID:5240
- C:\Windows\System\ARxuelD.exe
  C:\Windows\System\ARxuelD.exe
  2⤵
  PID:5256
- C:\Windows\System\PnamZnD.exe
  C:\Windows\System\PnamZnD.exe
  2⤵
  PID:5272
- C:\Windows\System\tenJZIn.exe
  C:\Windows\System\tenJZIn.exe
  2⤵
  PID:5288
- C:\Windows\System\pCzZmsj.exe
  C:\Windows\System\pCzZmsj.exe
  2⤵
  PID:5304
- C:\Windows\System\yKJQuxF.exe
  C:\Windows\System\yKJQuxF.exe
  2⤵
  PID:5320
- C:\Windows\System\clAHjru.exe
  C:\Windows\System\clAHjru.exe
  2⤵
  PID:5336
- C:\Windows\System\tBzeoIZ.exe
  C:\Windows\System\tBzeoIZ.exe
  2⤵
  PID:5352
- C:\Windows\System\HeeKMTh.exe
  C:\Windows\System\HeeKMTh.exe
  2⤵
  PID:5392
- C:\Windows\System\wBFUjhV.exe
  C:\Windows\System\wBFUjhV.exe
  2⤵
  PID:5408
- C:\Windows\System\XlJStlc.exe
  C:\Windows\System\XlJStlc.exe
  2⤵
  PID:5424
- C:\Windows\System\OGWAUIF.exe
  C:\Windows\System\OGWAUIF.exe
  2⤵
  PID:5440
- C:\Windows\System\NCwPUBV.exe
  C:\Windows\System\NCwPUBV.exe
  2⤵
  PID:5456
- C:\Windows\System\oiRsNVs.exe
  C:\Windows\System\oiRsNVs.exe
  2⤵
  PID:5472
- C:\Windows\System\AMoFcHW.exe
  C:\Windows\System\AMoFcHW.exe
  2⤵
  PID:5488
- C:\Windows\System\dGqToEh.exe
  C:\Windows\System\dGqToEh.exe
  2⤵
  PID:5504
- C:\Windows\System\uNtloAl.exe
  C:\Windows\System\uNtloAl.exe
  2⤵
  PID:5520
- C:\Windows\System\zJtCYaA.exe
  C:\Windows\System\zJtCYaA.exe
  2⤵
  PID:5536
- C:\Windows\System\XGQlZMW.exe
  C:\Windows\System\XGQlZMW.exe
  2⤵
  PID:5552
- C:\Windows\System\QBArNeE.exe
  C:\Windows\System\QBArNeE.exe
  2⤵
  PID:5568
- C:\Windows\System\vnWvQkt.exe
  C:\Windows\System\vnWvQkt.exe
  2⤵
  PID:5584
- C:\Windows\System\lTFcxUe.exe
  C:\Windows\System\lTFcxUe.exe
  2⤵
  PID:5600
- C:\Windows\System\zemhsdj.exe
  C:\Windows\System\zemhsdj.exe
  2⤵
  PID:5616
- C:\Windows\System\bElpdlj.exe
  C:\Windows\System\bElpdlj.exe
  2⤵
  PID:5632
- C:\Windows\System\LotfqAl.exe
  C:\Windows\System\LotfqAl.exe
  2⤵
  PID:5648
- C:\Windows\System\pBWpcJp.exe
  C:\Windows\System\pBWpcJp.exe
  2⤵
  PID:5664
- C:\Windows\System\OFFoRGC.exe
  C:\Windows\System\OFFoRGC.exe
  2⤵
  PID:5680
- C:\Windows\System\tiCkyEB.exe
  C:\Windows\System\tiCkyEB.exe
  2⤵
  PID:5700
- C:\Windows\System\zLDpUtL.exe
  C:\Windows\System\zLDpUtL.exe
  2⤵
  PID:5716
- C:\Windows\System\gFJAxck.exe
  C:\Windows\System\gFJAxck.exe
  2⤵
  PID:5732
- C:\Windows\System\oNhFukl.exe
  C:\Windows\System\oNhFukl.exe
  2⤵
  PID:5748
- C:\Windows\System\iTmOSvL.exe
  C:\Windows\System\iTmOSvL.exe
  2⤵
  PID:5764
- C:\Windows\System\cRrVSkK.exe
  C:\Windows\System\cRrVSkK.exe
  2⤵
  PID:5780
- C:\Windows\System\MghtrRx.exe
  C:\Windows\System\MghtrRx.exe
  2⤵
  PID:5796
- C:\Windows\System\eFqWlGI.exe
  C:\Windows\System\eFqWlGI.exe
  2⤵
  PID:5812
- C:\Windows\System\WPsAMdh.exe
  C:\Windows\System\WPsAMdh.exe
  2⤵
  PID:5828
- C:\Windows\System\MBuJNqw.exe
  C:\Windows\System\MBuJNqw.exe
  2⤵
  PID:5844
- C:\Windows\System\dKCOSWS.exe
  C:\Windows\System\dKCOSWS.exe
  2⤵
  PID:5860
- C:\Windows\System\RLAZubH.exe
  C:\Windows\System\RLAZubH.exe
  2⤵
  PID:5876
- C:\Windows\System\jrSMvSh.exe
  C:\Windows\System\jrSMvSh.exe
  2⤵
  PID:5892
- C:\Windows\System\uhPRweQ.exe
  C:\Windows\System\uhPRweQ.exe
  2⤵
  PID:5908
- C:\Windows\System\xHBAiGk.exe
  C:\Windows\System\xHBAiGk.exe
  2⤵
  PID:5924
- C:\Windows\System\YHZxlkt.exe
  C:\Windows\System\YHZxlkt.exe
  2⤵
  PID:5940
- C:\Windows\System\UqPmANc.exe
  C:\Windows\System\UqPmANc.exe
  2⤵
  PID:5960
- C:\Windows\System\VwLTKsQ.exe
  C:\Windows\System\VwLTKsQ.exe
  2⤵
  PID:5976
- C:\Windows\System\gyPoRzf.exe
  C:\Windows\System\gyPoRzf.exe
  2⤵
  PID:5992
- C:\Windows\System\keGFbOC.exe
  C:\Windows\System\keGFbOC.exe
  2⤵
  PID:6008
- C:\Windows\System\nOwOPFz.exe
  C:\Windows\System\nOwOPFz.exe
  2⤵
  PID:6024
- C:\Windows\System\hZuwHFK.exe
  C:\Windows\System\hZuwHFK.exe
  2⤵
  PID:6040
- C:\Windows\System\rOEBObs.exe
  C:\Windows\System\rOEBObs.exe
  2⤵
  PID:6056
- C:\Windows\System\vIjozbu.exe
  C:\Windows\System\vIjozbu.exe
  2⤵
  PID:6072
- C:\Windows\System\VTZbhBZ.exe
  C:\Windows\System\VTZbhBZ.exe
  2⤵
  PID:6088
- C:\Windows\System\WNDfZJo.exe
  C:\Windows\System\WNDfZJo.exe
  2⤵
  PID:6104
- C:\Windows\System\tSOMvYS.exe
  C:\Windows\System\tSOMvYS.exe
  2⤵
  PID:6128
- C:\Windows\System\ibGnukj.exe
  C:\Windows\System\ibGnukj.exe
  2⤵
  PID:3400
- C:\Windows\System\OoOWuJe.exe
  C:\Windows\System\OoOWuJe.exe
  2⤵
  PID:4112
- C:\Windows\System\SIFXHZC.exe
  C:\Windows\System\SIFXHZC.exe
  2⤵
  PID:5144
- C:\Windows\System\fvJfpFL.exe
  C:\Windows\System\fvJfpFL.exe
  2⤵
  PID:5160
- C:\Windows\System\bRKZkvi.exe
  C:\Windows\System\bRKZkvi.exe
  2⤵
  PID:1256
- C:\Windows\System\vBTwCkO.exe
  C:\Windows\System\vBTwCkO.exe
  2⤵
  PID:4696
- C:\Windows\System\ECovTdf.exe
  C:\Windows\System\ECovTdf.exe
  2⤵
  PID:5180
- C:\Windows\System\vcjqRRB.exe
  C:\Windows\System\vcjqRRB.exe
  2⤵
  PID:5216
- C:\Windows\System\RPuaLPC.exe
  C:\Windows\System\RPuaLPC.exe
  2⤵
  PID:5248
- C:\Windows\System\DYIchec.exe
  C:\Windows\System\DYIchec.exe
  2⤵
  PID:5312
- C:\Windows\System\NmRZDhZ.exe
  C:\Windows\System\NmRZDhZ.exe
  2⤵
  PID:5052
- C:\Windows\System\eXYUclQ.exe
  C:\Windows\System\eXYUclQ.exe
  2⤵
  PID:5232
- C:\Windows\System\DUvJRrg.exe
  C:\Windows\System\DUvJRrg.exe
  2⤵
  PID:5296
- C:\Windows\System\hFvgYpU.exe
  C:\Windows\System\hFvgYpU.exe
  2⤵
  PID:5360
- C:\Windows\System\WiVtWeQ.exe
  C:\Windows\System\WiVtWeQ.exe
  2⤵
  PID:5416
- C:\Windows\System\HsodLCv.exe
  C:\Windows\System\HsodLCv.exe
  2⤵
  PID:5480
- C:\Windows\System\HvtIAHz.exe
  C:\Windows\System\HvtIAHz.exe
  2⤵
  PID:5516
- C:\Windows\System\TohfVHN.exe
  C:\Windows\System\TohfVHN.exe
  2⤵
  PID:5436
- C:\Windows\System\blNyoMb.exe
  C:\Windows\System\blNyoMb.exe
  2⤵
  PID:5496
- C:\Windows\System\SqoMbAe.exe
  C:\Windows\System\SqoMbAe.exe
  2⤵
  PID:5560
- C:\Windows\System\PDfUDxq.exe
  C:\Windows\System\PDfUDxq.exe
  2⤵
  PID:5640
- C:\Windows\System\jHuQaki.exe
  C:\Windows\System\jHuQaki.exe
  2⤵
  PID:5596
- C:\Windows\System\AKcHccE.exe
  C:\Windows\System\AKcHccE.exe
  2⤵
  PID:5740
- C:\Windows\System\falVGdf.exe
  C:\Windows\System\falVGdf.exe
  2⤵
  PID:5776
- C:\Windows\System\zEmwfBi.exe
  C:\Windows\System\zEmwfBi.exe
  2⤵
  PID:5804
- C:\Windows\System\BzOuwdn.exe
  C:\Windows\System\BzOuwdn.exe
  2⤵
  PID:5756
- C:\Windows\System\mqQgirs.exe
  C:\Windows\System\mqQgirs.exe
  2⤵
  PID:5792
- C:\Windows\System\sUIRgrv.exe
  C:\Windows\System\sUIRgrv.exe
  2⤵
  PID:5836
- C:\Windows\System\pVvyWKc.exe
  C:\Windows\System\pVvyWKc.exe
  2⤵
  PID:5872
- C:\Windows\System\ZJdugoZ.exe
  C:\Windows\System\ZJdugoZ.exe
  2⤵
  PID:5904
- C:\Windows\System\qHGiljv.exe
  C:\Windows\System\qHGiljv.exe
  2⤵
  PID:5936
- C:\Windows\System\YELAvwu.exe
  C:\Windows\System\YELAvwu.exe
  2⤵
  PID:5956
- C:\Windows\System\nsRlAlg.exe
  C:\Windows\System\nsRlAlg.exe
  2⤵
  PID:6068
- C:\Windows\System\wRSSQSF.exe
  C:\Windows\System\wRSSQSF.exe
  2⤵
  PID:6016
- C:\Windows\System\wkaHuOm.exe
  C:\Windows\System\wkaHuOm.exe
  2⤵
  PID:6100
- C:\Windows\System\vQeTTiq.exe
  C:\Windows\System\vQeTTiq.exe
  2⤵
  PID:6140
- C:\Windows\System\hFfUZdS.exe
  C:\Windows\System\hFfUZdS.exe
  2⤵
  PID:6120
- C:\Windows\System\joqPXYE.exe
  C:\Windows\System\joqPXYE.exe
  2⤵
  PID:4228
- C:\Windows\System\ceykIcO.exe
  C:\Windows\System\ceykIcO.exe
  2⤵
  PID:5364
- C:\Windows\System\QNugcIp.exe
  C:\Windows\System\QNugcIp.exe
  2⤵
  PID:5008
- C:\Windows\System\pGGAWPq.exe
  C:\Windows\System\pGGAWPq.exe
  2⤵
  PID:5204
- C:\Windows\System\JZoBEdp.exe
  C:\Windows\System\JZoBEdp.exe
  2⤵
  PID:5448
- C:\Windows\System\kuCsnHl.exe
  C:\Windows\System\kuCsnHl.exe
  2⤵
  PID:5772
- C:\Windows\System\brWXbyU.exe
  C:\Windows\System\brWXbyU.exe
  2⤵
  PID:5140
- C:\Windows\System\xDZdFoY.exe
  C:\Windows\System\xDZdFoY.exe
  2⤵
  PID:5400
- C:\Windows\System\ChFhxbA.exe
  C:\Windows\System\ChFhxbA.exe
  2⤵
  PID:6168
- C:\Windows\System\ITwyhYm.exe
  C:\Windows\System\ITwyhYm.exe
  2⤵
  PID:6184
- C:\Windows\System\uIlecoy.exe
  C:\Windows\System\uIlecoy.exe
  2⤵
  PID:6200
- C:\Windows\System\FKLlEFm.exe
  C:\Windows\System\FKLlEFm.exe
  2⤵
  PID:6216
- C:\Windows\System\DwpkKfj.exe
  C:\Windows\System\DwpkKfj.exe
  2⤵
  PID:6236
- C:\Windows\System\RTuTBkb.exe
  C:\Windows\System\RTuTBkb.exe
  2⤵
  PID:6256
- C:\Windows\System\OmIJuoy.exe
  C:\Windows\System\OmIJuoy.exe
  2⤵
  PID:6272
- C:\Windows\System\QBANgBM.exe
  C:\Windows\System\QBANgBM.exe
  2⤵
  PID:6288
- C:\Windows\System\UpBuxwz.exe
  C:\Windows\System\UpBuxwz.exe
  2⤵
  PID:6304
- C:\Windows\System\yUZmXAO.exe
  C:\Windows\System\yUZmXAO.exe
  2⤵
  PID:6320
- C:\Windows\System\JQmJpFJ.exe
  C:\Windows\System\JQmJpFJ.exe
  2⤵
  PID:6388
- C:\Windows\System\mKcZWAH.exe
  C:\Windows\System\mKcZWAH.exe
  2⤵
  PID:6412
- C:\Windows\System\eirifqh.exe
  C:\Windows\System\eirifqh.exe
  2⤵
  PID:6428
- C:\Windows\System\YrTXImq.exe
  C:\Windows\System\YrTXImq.exe
  2⤵
  PID:6444
- C:\Windows\System\duQXJvm.exe
  C:\Windows\System\duQXJvm.exe
  2⤵
  PID:6472
- C:\Windows\System\TthJHAg.exe
  C:\Windows\System\TthJHAg.exe
  2⤵
  PID:6488
- C:\Windows\System\SmmsJQz.exe
  C:\Windows\System\SmmsJQz.exe
  2⤵
  PID:6504
- C:\Windows\System\gYrAqMv.exe
  C:\Windows\System\gYrAqMv.exe
  2⤵
  PID:6520
- C:\Windows\System\YmkqidU.exe
  C:\Windows\System\YmkqidU.exe
  2⤵
  PID:6536
- C:\Windows\System\zVLCYyW.exe
  C:\Windows\System\zVLCYyW.exe
  2⤵
  PID:6552
- C:\Windows\System\FONvLXW.exe
  C:\Windows\System\FONvLXW.exe
  2⤵
  PID:6568
- C:\Windows\System\GwXtUst.exe
  C:\Windows\System\GwXtUst.exe
  2⤵
  PID:6584
- C:\Windows\System\hZJSEbM.exe
  C:\Windows\System\hZJSEbM.exe
  2⤵
  PID:6608
- C:\Windows\System\yVFfYsc.exe
  C:\Windows\System\yVFfYsc.exe
  2⤵
  PID:6624
- C:\Windows\System\iptXiDw.exe
  C:\Windows\System\iptXiDw.exe
  2⤵
  PID:6644
- C:\Windows\System\emAtkxp.exe
  C:\Windows\System\emAtkxp.exe
  2⤵
  PID:6664
- C:\Windows\System\tCOjkki.exe
  C:\Windows\System\tCOjkki.exe
  2⤵
  PID:6680
- C:\Windows\System\eamyvKx.exe
  C:\Windows\System\eamyvKx.exe
  2⤵
  PID:6700
- C:\Windows\System\VluQjEr.exe
  C:\Windows\System\VluQjEr.exe
  2⤵
  PID:6716
- C:\Windows\System\XMuUvDi.exe
  C:\Windows\System\XMuUvDi.exe
  2⤵
  PID:6732
- C:\Windows\System\KaGdfpK.exe
  C:\Windows\System\KaGdfpK.exe
  2⤵
  PID:6748
- C:\Windows\System\zMlekEo.exe
  C:\Windows\System\zMlekEo.exe
  2⤵
  PID:6764
- C:\Windows\System\hjUXJYM.exe
  C:\Windows\System\hjUXJYM.exe
  2⤵
  PID:6788
- C:\Windows\System\prukOID.exe
  C:\Windows\System\prukOID.exe
  2⤵
  PID:6804
- C:\Windows\System\jllbhQV.exe
  C:\Windows\System\jllbhQV.exe
  2⤵
  PID:6820
- C:\Windows\System\rvWrYWt.exe
  C:\Windows\System\rvWrYWt.exe
  2⤵
  PID:6836
- C:\Windows\System\XluHWRO.exe
  C:\Windows\System\XluHWRO.exe
  2⤵
  PID:6856
- C:\Windows\System\Sfyiyuz.exe
  C:\Windows\System\Sfyiyuz.exe
  2⤵
  PID:6876
- C:\Windows\System\GUfDjKQ.exe
  C:\Windows\System\GUfDjKQ.exe
  2⤵
  PID:6892
- C:\Windows\System\fUbXajP.exe
  C:\Windows\System\fUbXajP.exe
  2⤵
  PID:6908
- C:\Windows\System\RJmUTSh.exe
  C:\Windows\System\RJmUTSh.exe
  2⤵
  PID:6924
- C:\Windows\System\WbsxMSJ.exe
  C:\Windows\System\WbsxMSJ.exe
  2⤵
  PID:6944
- C:\Windows\System\PdnXdBl.exe
  C:\Windows\System\PdnXdBl.exe
  2⤵
  PID:6960
- C:\Windows\System\cCTqpfo.exe
  C:\Windows\System\cCTqpfo.exe
  2⤵
  PID:6976
- C:\Windows\System\zHRjlBR.exe
  C:\Windows\System\zHRjlBR.exe
  2⤵
  PID:6992
- C:\Windows\System\KSnjSPf.exe
  C:\Windows\System\KSnjSPf.exe
  2⤵
  PID:7012
- C:\Windows\System\nhBmoBk.exe
  C:\Windows\System\nhBmoBk.exe
  2⤵
  PID:7028
- C:\Windows\System\gDDDOlp.exe
  C:\Windows\System\gDDDOlp.exe
  2⤵
  PID:7044
- C:\Windows\System\CkUisRd.exe
  C:\Windows\System\CkUisRd.exe
  2⤵
  PID:7060
- C:\Windows\System\cwyVaZr.exe
  C:\Windows\System\cwyVaZr.exe
  2⤵
  PID:7076
- C:\Windows\System\YUygXqp.exe
  C:\Windows\System\YUygXqp.exe
  2⤵
  PID:7096
- C:\Windows\System\SfwvRkW.exe
  C:\Windows\System\SfwvRkW.exe
  2⤵
  PID:7112
- C:\Windows\System\knnHjeN.exe
  C:\Windows\System\knnHjeN.exe
  2⤵
  PID:7128
- C:\Windows\System\RHgzEey.exe
  C:\Windows\System\RHgzEey.exe
  2⤵
  PID:7144
- C:\Windows\System\UgBsaTL.exe
  C:\Windows\System\UgBsaTL.exe
  2⤵
  PID:7160
- C:\Windows\System\ENihWvV.exe
  C:\Windows\System\ENihWvV.exe
  2⤵
  PID:5856
- C:\Windows\System\VNPGiSS.exe
  C:\Windows\System\VNPGiSS.exe
  2⤵
  PID:6048
- C:\Windows\System\vHXxYqf.exe
  C:\Windows\System\vHXxYqf.exe
  2⤵
  PID:5344
- C:\Windows\System\nMEdCJu.exe
  C:\Windows\System\nMEdCJu.exe
  2⤵
  PID:5280
- C:\Windows\System\dsmVluB.exe
  C:\Windows\System\dsmVluB.exe
  2⤵
  PID:5200
- C:\Windows\System\OtKitzl.exe
  C:\Windows\System\OtKitzl.exe
  2⤵
  PID:5484
- C:\Windows\System\huRbmDy.exe
  C:\Windows\System\huRbmDy.exe
  2⤵
  PID:5468
- C:\Windows\System\fHZTAMx.exe
  C:\Windows\System\fHZTAMx.exe
  2⤵
  PID:5608
- C:\Windows\System\zyZKnko.exe
  C:\Windows\System\zyZKnko.exe
  2⤵
  PID:5528
- C:\Windows\System\SYWPDbW.exe
  C:\Windows\System\SYWPDbW.exe
  2⤵
  PID:5628
- C:\Windows\System\qPsmRZp.exe
  C:\Windows\System\qPsmRZp.exe
  2⤵
  PID:4384
- C:\Windows\System\GRiWvPQ.exe
  C:\Windows\System\GRiWvPQ.exe
  2⤵
  PID:6136
- C:\Windows\System\rfBIHSq.exe
  C:\Windows\System\rfBIHSq.exe
  2⤵
  PID:4428
- C:\Windows\System\AewzSTX.exe
  C:\Windows\System\AewzSTX.exe
  2⤵
  PID:6180
- C:\Windows\System\VBfKsXV.exe
  C:\Windows\System\VBfKsXV.exe
  2⤵
  PID:6244
- C:\Windows\System\VfuxHmY.exe
  C:\Windows\System\VfuxHmY.exe
  2⤵
  PID:6284
- C:\Windows\System\YSMyNAH.exe
  C:\Windows\System\YSMyNAH.exe
  2⤵
  PID:6336
- C:\Windows\System\EwNWQhS.exe
  C:\Windows\System\EwNWQhS.exe
  2⤵
  PID:6152
- C:\Windows\System\MmGUVFJ.exe
  C:\Windows\System\MmGUVFJ.exe
  2⤵
  PID:6328
- C:\Windows\System\rWGvrxS.exe
  C:\Windows\System\rWGvrxS.exe
  2⤵
  PID:6352
- C:\Windows\System\jDRYMaV.exe
  C:\Windows\System\jDRYMaV.exe
  2⤵
  PID:6424
- C:\Windows\System\cYWJEjD.exe
  C:\Windows\System\cYWJEjD.exe
  2⤵
  PID:6480
- C:\Windows\System\SBknYVs.exe
  C:\Windows\System\SBknYVs.exe
  2⤵
  PID:6464
- C:\Windows\System\dzHrbKt.exe
  C:\Windows\System\dzHrbKt.exe
  2⤵
  PID:6548
- C:\Windows\System\DVszeaA.exe
  C:\Windows\System\DVszeaA.exe
  2⤵
  PID:6600
- C:\Windows\System\zSFLHlp.exe
  C:\Windows\System\zSFLHlp.exe
  2⤵
  PID:6596
- C:\Windows\System\dMbcHbD.exe
  C:\Windows\System\dMbcHbD.exe
  2⤵
  PID:6724
- C:\Windows\System\PqElHnw.exe
  C:\Windows\System\PqElHnw.exe
  2⤵
  PID:6604
- C:\Windows\System\PBjkXPf.exe
  C:\Windows\System\PBjkXPf.exe
  2⤵
  PID:6744
- C:\Windows\System\aRgqNeA.exe
  C:\Windows\System\aRgqNeA.exe
  2⤵
  PID:6676
- C:\Windows\System\jfJMTRP.exe
  C:\Windows\System\jfJMTRP.exe
  2⤵
  PID:6832
- C:\Windows\System\xMMwoHe.exe
  C:\Windows\System\xMMwoHe.exe
  2⤵
  PID:6900
- C:\Windows\System\KtIaaSJ.exe
  C:\Windows\System\KtIaaSJ.exe
  2⤵
  PID:6968
- C:\Windows\System\WwBbrYO.exe
  C:\Windows\System\WwBbrYO.exe
  2⤵
  PID:6852
- C:\Windows\System\enjeymc.exe
  C:\Windows\System\enjeymc.exe
  2⤵
  PID:6952
- C:\Windows\System\vjrUgQq.exe
  C:\Windows\System\vjrUgQq.exe
  2⤵
  PID:6848
- C:\Windows\System\gIytedI.exe
  C:\Windows\System\gIytedI.exe
  2⤵
  PID:7008
- C:\Windows\System\hvEOQOD.exe
  C:\Windows\System\hvEOQOD.exe
  2⤵
  PID:7040
- C:\Windows\System\COgTlvf.exe
  C:\Windows\System\COgTlvf.exe
  2⤵
  PID:7104
- C:\Windows\System\TknMZou.exe
  C:\Windows\System\TknMZou.exe
  2⤵
  PID:7092
- C:\Windows\System\wknLNmk.exe
  C:\Windows\System\wknLNmk.exe
  2⤵
  PID:5888
- C:\Windows\System\JGCgFcM.exe
  C:\Windows\System\JGCgFcM.exe
  2⤵
  PID:4368
- C:\Windows\System\SJulSNS.exe
  C:\Windows\System\SJulSNS.exe
  2⤵
  PID:7124
- C:\Windows\System\ruyKKNN.exe
  C:\Windows\System\ruyKKNN.exe
  2⤵
  PID:5464
- C:\Windows\System\igeqRJv.exe
  C:\Windows\System\igeqRJv.exe
  2⤵
  PID:5656
- C:\Windows\System\yIiJIXw.exe
  C:\Windows\System\yIiJIXw.exe
  2⤵
  PID:5332
- C:\Windows\System\WhrXbGP.exe
  C:\Windows\System\WhrXbGP.exe
  2⤵
  PID:5532
- C:\Windows\System\YnpYkwX.exe
  C:\Windows\System\YnpYkwX.exe
  2⤵
  PID:5156
- C:\Windows\System\rxUWovQ.exe
  C:\Windows\System\rxUWovQ.exe
  2⤵
  PID:6084
- C:\Windows\System\DlcsRBD.exe
  C:\Windows\System\DlcsRBD.exe
  2⤵
  PID:6264
- C:\Windows\System\BOHikwK.exe
  C:\Windows\System\BOHikwK.exe
  2⤵
  PID:5900
- C:\Windows\System\qtdBiwV.exe
  C:\Windows\System\qtdBiwV.exe
  2⤵
  PID:6196
- C:\Windows\System\XCoisVH.exe
  C:\Windows\System\XCoisVH.exe
  2⤵
  PID:6368
- C:\Windows\System\ofPDNeA.exe
  C:\Windows\System\ofPDNeA.exe
  2⤵
  PID:6300
- C:\Windows\System\HxjwxBE.exe
  C:\Windows\System\HxjwxBE.exe
  2⤵
  PID:6360
- C:\Windows\System\IQGatax.exe
  C:\Windows\System\IQGatax.exe
  2⤵
  PID:6332
- C:\Windows\System\Wpodfel.exe
  C:\Windows\System\Wpodfel.exe
  2⤵
  PID:6460
- C:\Windows\System\vLjqnCI.exe
  C:\Windows\System\vLjqnCI.exe
  2⤵
  PID:6528
- C:\Windows\System\nXZRXos.exe
  C:\Windows\System\nXZRXos.exe
  2⤵
  PID:6560
- C:\Windows\System\vovxhFm.exe
  C:\Windows\System\vovxhFm.exe
  2⤵
  PID:6468
- C:\Windows\System\qvpImPV.exe
  C:\Windows\System\qvpImPV.exe
  2⤵
  PID:6592
- C:\Windows\System\TEHCvmZ.exe
  C:\Windows\System\TEHCvmZ.exe
  2⤵
  PID:6348
- C:\Windows\System\qKiwMMi.exe
  C:\Windows\System\qKiwMMi.exe
  2⤵
  PID:6828
- C:\Windows\System\TGQbZkO.exe
  C:\Windows\System\TGQbZkO.exe
  2⤵
  PID:6672
- C:\Windows\System\nVCmpGj.exe
  C:\Windows\System\nVCmpGj.exe
  2⤵
  PID:6796
- C:\Windows\System\vtpybqg.exe
  C:\Windows\System\vtpybqg.exe
  2⤵
  PID:6868
- C:\Windows\System\oGrVLch.exe
  C:\Windows\System\oGrVLch.exe
  2⤵
  PID:6984
- C:\Windows\System\LEPzOUZ.exe
  C:\Windows\System\LEPzOUZ.exe
  2⤵
  PID:6844
- C:\Windows\System\DZOdpBp.exe
  C:\Windows\System\DZOdpBp.exe
  2⤵
  PID:6988
- C:\Windows\System\BSrFrky.exe
  C:\Windows\System\BSrFrky.exe
  2⤵
  PID:5284
- C:\Windows\System\GlOiHyD.exe
  C:\Windows\System\GlOiHyD.exe
  2⤵
  PID:6032
- C:\Windows\System\GxgWsxf.exe
  C:\Windows\System\GxgWsxf.exe
  2⤵
  PID:5808
- C:\Windows\System\dULvrOb.exe
  C:\Windows\System\dULvrOb.exe
  2⤵
  PID:5852
- C:\Windows\System\eKJqvcn.exe
  C:\Windows\System\eKJqvcn.exe
  2⤵
  PID:4504
- C:\Windows\System\KMUoxyu.exe
  C:\Windows\System\KMUoxyu.exe
  2⤵
  PID:6228
- C:\Windows\System\PesXtIa.exe
  C:\Windows\System\PesXtIa.exe
  2⤵
  PID:6408
- C:\Windows\System\OtTpSbU.exe
  C:\Windows\System\OtTpSbU.exe
  2⤵
  PID:6420
- C:\Windows\System\URttVrn.exe
  C:\Windows\System\URttVrn.exe
  2⤵
  PID:6192
- C:\Windows\System\hPVNafa.exe
  C:\Windows\System\hPVNafa.exe
  2⤵
  PID:6340
- C:\Windows\System\XdTYboc.exe
  C:\Windows\System\XdTYboc.exe
  2⤵
  PID:6580
- C:\Windows\System\UaajccF.exe
  C:\Windows\System\UaajccF.exe
  2⤵
  PID:6696
- C:\Windows\System\bjVPizg.exe
  C:\Windows\System\bjVPizg.exe
  2⤵
  PID:6784
- C:\Windows\System\teetPcZ.exe
  C:\Windows\System\teetPcZ.exe
  2⤵
  PID:6888
- C:\Windows\System\prsqrKu.exe
  C:\Windows\System\prsqrKu.exe
  2⤵
  PID:6956
- C:\Windows\System\Rlgqbbo.exe
  C:\Windows\System\Rlgqbbo.exe
  2⤵
  PID:6280
- C:\Windows\System\swgyRHv.exe
  C:\Windows\System\swgyRHv.exe
  2⤵
  PID:4048
- C:\Windows\System\dbfMmix.exe
  C:\Windows\System\dbfMmix.exe
  2⤵
  PID:6268
- C:\Windows\System\ofGbeRN.exe
  C:\Windows\System\ofGbeRN.exe
  2⤵
  PID:6532
- C:\Windows\System\MNTpqiM.exe
  C:\Windows\System\MNTpqiM.exe
  2⤵
  PID:6656
- C:\Windows\System\IYdFrAy.exe
  C:\Windows\System\IYdFrAy.exe
  2⤵
  PID:6780
- C:\Windows\System\vtJOsRx.exe
  C:\Windows\System\vtJOsRx.exe
  2⤵
  PID:6440
- C:\Windows\System\DiioiUA.exe
  C:\Windows\System\DiioiUA.exe
  2⤵
  PID:6812
- C:\Windows\System\YGKcGnM.exe
  C:\Windows\System\YGKcGnM.exe
  2⤵
  PID:5188
- C:\Windows\System\BKNRWrH.exe
  C:\Windows\System\BKNRWrH.exe
  2⤵
  PID:6564
- C:\Windows\System\ACYgILz.exe
  C:\Windows\System\ACYgILz.exe
  2⤵
  PID:5712
- C:\Windows\System\ihOAPYV.exe
  C:\Windows\System\ihOAPYV.exe
  2⤵
  PID:6252
- C:\Windows\System\NlxyHKE.exe
  C:\Windows\System\NlxyHKE.exe
  2⤵
  PID:6972
- C:\Windows\System\mOJbHzL.exe
  C:\Windows\System\mOJbHzL.exe
  2⤵
  PID:6936
- C:\Windows\System\UmdRERt.exe
  C:\Windows\System\UmdRERt.exe
  2⤵
  PID:6932
- C:\Windows\System\gAYaPeR.exe
  C:\Windows\System\gAYaPeR.exe
  2⤵
  PID:7176
- C:\Windows\System\tDFmmXJ.exe
  C:\Windows\System\tDFmmXJ.exe
  2⤵
  PID:7192
- C:\Windows\System\LTwjinE.exe
  C:\Windows\System\LTwjinE.exe
  2⤵
  PID:7208
- C:\Windows\System\ITrvpcL.exe
  C:\Windows\System\ITrvpcL.exe
  2⤵
  PID:7224
- C:\Windows\System\vOXiUGO.exe
  C:\Windows\System\vOXiUGO.exe
  2⤵
  PID:7240
- C:\Windows\System\kkLIELi.exe
  C:\Windows\System\kkLIELi.exe
  2⤵
  PID:7256
- C:\Windows\System\WrBBuiu.exe
  C:\Windows\System\WrBBuiu.exe
  2⤵
  PID:7272
- C:\Windows\System\dpiFCKf.exe
  C:\Windows\System\dpiFCKf.exe
  2⤵
  PID:7288
- C:\Windows\System\UPMJJGY.exe
  C:\Windows\System\UPMJJGY.exe
  2⤵
  PID:7304
- C:\Windows\System\jvpPyTD.exe
  C:\Windows\System\jvpPyTD.exe
  2⤵
  PID:7320
- C:\Windows\System\DRhOlFj.exe
  C:\Windows\System\DRhOlFj.exe
  2⤵
  PID:7336
- C:\Windows\System\WXuptbK.exe
  C:\Windows\System\WXuptbK.exe
  2⤵
  PID:7352
- C:\Windows\System\FhSwwdf.exe
  C:\Windows\System\FhSwwdf.exe
  2⤵
  PID:7368
- C:\Windows\System\cqqCYQP.exe
  C:\Windows\System\cqqCYQP.exe
  2⤵
  PID:7388
- C:\Windows\System\JarimCV.exe
  C:\Windows\System\JarimCV.exe
  2⤵
  PID:7404
- C:\Windows\System\TGhWAmB.exe
  C:\Windows\System\TGhWAmB.exe
  2⤵
  PID:7420
- C:\Windows\System\GYhUWcR.exe
  C:\Windows\System\GYhUWcR.exe
  2⤵
  PID:7436
- C:\Windows\System\MoTNOuS.exe
  C:\Windows\System\MoTNOuS.exe
  2⤵
  PID:7460
- C:\Windows\System\HWIiaKN.exe
  C:\Windows\System\HWIiaKN.exe
  2⤵
  PID:7476
- C:\Windows\System\sFdxedZ.exe
  C:\Windows\System\sFdxedZ.exe
  2⤵
  PID:7492
- C:\Windows\System\MYGtNKw.exe
  C:\Windows\System\MYGtNKw.exe
  2⤵
  PID:7508
- C:\Windows\System\tbaczVY.exe
  C:\Windows\System\tbaczVY.exe
  2⤵
  PID:7524
- C:\Windows\System\JePAYym.exe
  C:\Windows\System\JePAYym.exe
  2⤵
  PID:7540
- C:\Windows\System\ZHHFVtO.exe
  C:\Windows\System\ZHHFVtO.exe
  2⤵
  PID:7556
- C:\Windows\System\rgNGKGA.exe
  C:\Windows\System\rgNGKGA.exe
  2⤵
  PID:7572
- C:\Windows\System\UOiMDtV.exe
  C:\Windows\System\UOiMDtV.exe
  2⤵
  PID:7588
- C:\Windows\System\flqzLCy.exe
  C:\Windows\System\flqzLCy.exe
  2⤵
  PID:7604
- C:\Windows\System\HZGuGvM.exe
  C:\Windows\System\HZGuGvM.exe
  2⤵
  PID:7620
- C:\Windows\System\cmNEtgt.exe
  C:\Windows\System\cmNEtgt.exe
  2⤵
  PID:7636
- C:\Windows\System\vpHcnfp.exe
  C:\Windows\System\vpHcnfp.exe
  2⤵
  PID:7652
- C:\Windows\System\VyxySnE.exe
  C:\Windows\System\VyxySnE.exe
  2⤵
  PID:7668
- C:\Windows\System\bJnzvBo.exe
  C:\Windows\System\bJnzvBo.exe
  2⤵
  PID:7684
- C:\Windows\System\rePBcFs.exe
  C:\Windows\System\rePBcFs.exe
  2⤵
  PID:7724
- C:\Windows\System\vOAkxfG.exe
  C:\Windows\System\vOAkxfG.exe
  2⤵
  PID:7744
- C:\Windows\System\WcjQJlL.exe
  C:\Windows\System\WcjQJlL.exe
  2⤵
  PID:7780
- C:\Windows\System\qQMGuiW.exe
  C:\Windows\System\qQMGuiW.exe
  2⤵
  PID:7800
- C:\Windows\System\voJHtti.exe
  C:\Windows\System\voJHtti.exe
  2⤵
  PID:7816
- C:\Windows\System\wKtFtVJ.exe
  C:\Windows\System\wKtFtVJ.exe
  2⤵
  PID:7832
- C:\Windows\System\LnQNmPv.exe
  C:\Windows\System\LnQNmPv.exe
  2⤵
  PID:7848
- C:\Windows\System\wXXOZPz.exe
  C:\Windows\System\wXXOZPz.exe
  2⤵
  PID:7864
- C:\Windows\System\HWrwNDz.exe
  C:\Windows\System\HWrwNDz.exe
  2⤵
  PID:7880
- C:\Windows\System\MMDRZnG.exe
  C:\Windows\System\MMDRZnG.exe
  2⤵
  PID:7964
- C:\Windows\System\iOiFFeB.exe
  C:\Windows\System\iOiFFeB.exe
  2⤵
  PID:8040
- C:\Windows\System\ttJJqSy.exe
  C:\Windows\System\ttJJqSy.exe
  2⤵
  PID:8056
- C:\Windows\System\epIBjZd.exe
  C:\Windows\System\epIBjZd.exe
  2⤵
  PID:8072
- C:\Windows\System\tfIiFeq.exe
  C:\Windows\System\tfIiFeq.exe
  2⤵
  PID:8088
- C:\Windows\System\UZHtRWC.exe
  C:\Windows\System\UZHtRWC.exe
  2⤵
  PID:8104
- C:\Windows\System\zjCEJIu.exe
  C:\Windows\System\zjCEJIu.exe
  2⤵
  PID:8120
- C:\Windows\System\bXypGxu.exe
  C:\Windows\System\bXypGxu.exe
  2⤵
  PID:7232
- C:\Windows\System\ZZMyeMV.exe
  C:\Windows\System\ZZMyeMV.exe
  2⤵
  PID:7268
- C:\Windows\System\RhJiGnA.exe
  C:\Windows\System\RhJiGnA.exe
  2⤵
  PID:7328
- C:\Windows\System\wgPtNox.exe
  C:\Windows\System\wgPtNox.exe
  2⤵
  PID:7380
- C:\Windows\System\cgLRMDa.exe
  C:\Windows\System\cgLRMDa.exe
  2⤵
  PID:7452
- C:\Windows\System\ZUEcBvW.exe
  C:\Windows\System\ZUEcBvW.exe
  2⤵
  PID:7432
- C:\Windows\System\VriVxEZ.exe
  C:\Windows\System\VriVxEZ.exe
  2⤵
  PID:7488
- C:\Windows\System\cJrStGr.exe
  C:\Windows\System\cJrStGr.exe
  2⤵
  PID:7504
- C:\Windows\System\TFgPouG.exe
  C:\Windows\System\TFgPouG.exe
  2⤵
  PID:7536
- C:\Windows\System\DxZPFMb.exe
  C:\Windows\System\DxZPFMb.exe
  2⤵
  PID:7564
- C:\Windows\System\rlJisVn.exe
  C:\Windows\System\rlJisVn.exe
  2⤵
  PID:7628
- C:\Windows\System\JQpMLvI.exe
  C:\Windows\System\JQpMLvI.exe
  2⤵
  PID:7660
- C:\Windows\System\SXjrykh.exe
  C:\Windows\System\SXjrykh.exe
  2⤵
  PID:7696
- C:\Windows\System\IAiKCIr.exe
  C:\Windows\System\IAiKCIr.exe
  2⤵
  PID:7760
- C:\Windows\System\awbwiTr.exe
  C:\Windows\System\awbwiTr.exe
  2⤵
  PID:7788
- C:\Windows\System\gXCrKpS.exe
  C:\Windows\System\gXCrKpS.exe
  2⤵
  PID:7828
- C:\Windows\System\edTkoVP.exe
  C:\Windows\System\edTkoVP.exe
  2⤵
  PID:7888
- C:\Windows\System\AXLiyJa.exe
  C:\Windows\System\AXLiyJa.exe
  2⤵
  PID:7812
- C:\Windows\System\DZwHETz.exe
  C:\Windows\System\DZwHETz.exe
  2⤵
  PID:7948
- C:\Windows\System\vsrLMPz.exe
  C:\Windows\System\vsrLMPz.exe
  2⤵
  PID:7712
- C:\Windows\System\RDDPLZc.exe
  C:\Windows\System\RDDPLZc.exe
  2⤵
  PID:7976
- C:\Windows\System\FoByJNY.exe
  C:\Windows\System\FoByJNY.exe
  2⤵
  PID:8012
- C:\Windows\System\OZyWiew.exe
  C:\Windows\System\OZyWiew.exe
  2⤵
  PID:7720
- C:\Windows\System\fnIjmeF.exe
  C:\Windows\System\fnIjmeF.exe
  2⤵
  PID:8096
- C:\Windows\System\VvMVWSe.exe
  C:\Windows\System\VvMVWSe.exe
  2⤵
  PID:8128
- C:\Windows\System\iknmLag.exe
  C:\Windows\System\iknmLag.exe
  2⤵
  PID:8080
- C:\Windows\System\RjcWTTT.exe
  C:\Windows\System\RjcWTTT.exe
  2⤵
  PID:8148
- C:\Windows\System\GIaXWrQ.exe
  C:\Windows\System\GIaXWrQ.exe
  2⤵
  PID:8160
- C:\Windows\System\Dfmzpep.exe
  C:\Windows\System\Dfmzpep.exe
  2⤵
  PID:8172
- C:\Windows\System\ouBuvnS.exe
  C:\Windows\System\ouBuvnS.exe
  2⤵
  PID:7184
- C:\Windows\System\Xmgwckm.exe
  C:\Windows\System\Xmgwckm.exe
  2⤵
  PID:7264
- C:\Windows\System\rwixUrt.exe
  C:\Windows\System\rwixUrt.exe
  2⤵
  PID:7872
- C:\Windows\System\uyycXec.exe
  C:\Windows\System\uyycXec.exe
  2⤵
  PID:5692
- C:\Windows\System\oyuCdfP.exe
  C:\Windows\System\oyuCdfP.exe
  2⤵
  PID:7704
- C:\Windows\System\IiBnThG.exe
  C:\Windows\System\IiBnThG.exe
  2⤵
  PID:7776
- C:\Windows\System\lorGAex.exe
  C:\Windows\System\lorGAex.exe
  2⤵
  PID:7732
- C:\Windows\System\FGhOeLg.exe
  C:\Windows\System\FGhOeLg.exe
  2⤵
  PID:7960
- C:\Windows\System\bYtbphT.exe
  C:\Windows\System\bYtbphT.exe
  2⤵
  PID:8024
- C:\Windows\System\aoVtLfL.exe
  C:\Windows\System\aoVtLfL.exe
  2⤵
  PID:8032
- C:\Windows\System\NxIjibB.exe
  C:\Windows\System\NxIjibB.exe
  2⤵
  PID:8000
- C:\Windows\System\ezDgIds.exe
  C:\Windows\System\ezDgIds.exe
  2⤵
  PID:8176
- C:\Windows\System\pGmusfS.exe
  C:\Windows\System\pGmusfS.exe
  2⤵
  PID:8084
- C:\Windows\System\dFgguhd.exe
  C:\Windows\System\dFgguhd.exe
  2⤵
  PID:7248
- C:\Windows\System\UzHVOrq.exe
  C:\Windows\System\UzHVOrq.exe
  2⤵
  PID:7396
- C:\Windows\System\XLyJkQG.exe
  C:\Windows\System\XLyJkQG.exe
  2⤵
  PID:7204
- C:\Windows\System\mMqzrRp.exe
  C:\Windows\System\mMqzrRp.exe
  2⤵
  PID:7764
- C:\Windows\System\jqxorGI.exe
  C:\Windows\System\jqxorGI.exe
  2⤵
  PID:7600
- C:\Windows\System\dLSYAvA.exe
  C:\Windows\System\dLSYAvA.exe
  2⤵
  PID:7348
- C:\Windows\System\jlQocra.exe
  C:\Windows\System\jlQocra.exe
  2⤵
  PID:7844
- C:\Windows\System\lyhlNtd.exe
  C:\Windows\System\lyhlNtd.exe
  2⤵
  PID:8256
- C:\Windows\System\SRqAXOG.exe
  C:\Windows\System\SRqAXOG.exe
  2⤵
  PID:8272
- C:\Windows\System\TzPLTLt.exe
  C:\Windows\System\TzPLTLt.exe
  2⤵
  PID:8288
- C:\Windows\System\OaSnKhS.exe
  C:\Windows\System\OaSnKhS.exe
  2⤵
  PID:8304
- C:\Windows\System\zjhLFai.exe
  C:\Windows\System\zjhLFai.exe
  2⤵
  PID:8320
- C:\Windows\System\DQpJPPa.exe
  C:\Windows\System\DQpJPPa.exe
  2⤵
  PID:8336
- C:\Windows\System\IQdVFPt.exe
  C:\Windows\System\IQdVFPt.exe
  2⤵
  PID:8352
- C:\Windows\System\cSfHHTb.exe
  C:\Windows\System\cSfHHTb.exe
  2⤵
  PID:8368
- C:\Windows\System\wurgYzi.exe
  C:\Windows\System\wurgYzi.exe
  2⤵
  PID:8388
- C:\Windows\System\exCQlas.exe
  C:\Windows\System\exCQlas.exe
  2⤵
  PID:8468
- C:\Windows\System\hSVKjKS.exe
  C:\Windows\System\hSVKjKS.exe
  2⤵
  PID:8484
- C:\Windows\System\MvbVgej.exe
  C:\Windows\System\MvbVgej.exe
  2⤵
  PID:8500
- C:\Windows\System\NLIcQeX.exe
  C:\Windows\System\NLIcQeX.exe
  2⤵
  PID:8516
- C:\Windows\System\YjifzQK.exe
  C:\Windows\System\YjifzQK.exe
  2⤵
  PID:8532
- C:\Windows\System\MGYZzPt.exe
  C:\Windows\System\MGYZzPt.exe
  2⤵
  PID:8548
- C:\Windows\System\NoehDSp.exe
  C:\Windows\System\NoehDSp.exe
  2⤵
  PID:8564
- C:\Windows\System\EXeldFO.exe
  C:\Windows\System\EXeldFO.exe
  2⤵
  PID:8580
- C:\Windows\System\JIpVrqP.exe
  C:\Windows\System\JIpVrqP.exe
  2⤵
  PID:8676
- C:\Windows\System\LtRzPEJ.exe
  C:\Windows\System\LtRzPEJ.exe
  2⤵
  PID:8692
- C:\Windows\System\jqMRPNJ.exe
  C:\Windows\System\jqMRPNJ.exe
  2⤵
  PID:8708
- C:\Windows\System\pzqcSDw.exe
  C:\Windows\System\pzqcSDw.exe
  2⤵
  PID:8724
- C:\Windows\System\TVAJleE.exe
  C:\Windows\System\TVAJleE.exe
  2⤵
  PID:8740
- C:\Windows\System\HCDSfbf.exe
  C:\Windows\System\HCDSfbf.exe
  2⤵
  PID:8756
- C:\Windows\System\eATEghI.exe
  C:\Windows\System\eATEghI.exe
  2⤵
  PID:8784
- C:\Windows\System\FOGoYQX.exe
  C:\Windows\System\FOGoYQX.exe
  2⤵
  PID:8860
- C:\Windows\System\ChpxOWQ.exe
  C:\Windows\System\ChpxOWQ.exe
  2⤵
  PID:8900
- C:\Windows\System\uaGpYAz.exe
  C:\Windows\System\uaGpYAz.exe
  2⤵
  PID:8920
- C:\Windows\System\lnDJyMP.exe
  C:\Windows\System\lnDJyMP.exe
  2⤵
  PID:8936
- C:\Windows\System\YPRjerB.exe
  C:\Windows\System\YPRjerB.exe
  2⤵
  PID:8952
- C:\Windows\System\vWupqVy.exe
  C:\Windows\System\vWupqVy.exe
  2⤵
  PID:8968
- C:\Windows\System\WNHXEAB.exe
  C:\Windows\System\WNHXEAB.exe
  2⤵
  PID:8984
- C:\Windows\System\VxjjDyx.exe
  C:\Windows\System\VxjjDyx.exe
  2⤵
  PID:9000
- C:\Windows\System\JBYdKaV.exe
  C:\Windows\System\JBYdKaV.exe
  2⤵
  PID:9016
- C:\Windows\System\eMXdWYS.exe
  C:\Windows\System\eMXdWYS.exe
  2⤵
  PID:9032
- C:\Windows\System\WlFMIHR.exe
  C:\Windows\System\WlFMIHR.exe
  2⤵
  PID:9048
- C:\Windows\System\NFRyyvO.exe
  C:\Windows\System\NFRyyvO.exe
  2⤵
  PID:9064
- C:\Windows\System\mbvtNEQ.exe
  C:\Windows\System\mbvtNEQ.exe
  2⤵
  PID:9080
- C:\Windows\System\KSfpsDR.exe
  C:\Windows\System\KSfpsDR.exe
  2⤵
  PID:7344
- C:\Windows\System\emhUDSw.exe
  C:\Windows\System\emhUDSw.exe
  2⤵
  PID:8252
- C:\Windows\System\CHppNbY.exe
  C:\Windows\System\CHppNbY.exe
  2⤵
  PID:8588
- C:\Windows\System\PSkwFLH.exe
  C:\Windows\System\PSkwFLH.exe
  2⤵
  PID:8640
- C:\Windows\System\uyxIRcc.exe
  C:\Windows\System\uyxIRcc.exe
  2⤵
  PID:8764
- C:\Windows\System\CRTqpDd.exe
  C:\Windows\System\CRTqpDd.exe
  2⤵
  PID:8944
- C:\Windows\System\QQFUJPH.exe
  C:\Windows\System\QQFUJPH.exe
  2⤵
  PID:8792
- C:\Windows\System\tGdbPos.exe
  C:\Windows\System\tGdbPos.exe
  2⤵
  PID:9008
- C:\Windows\System\xaJWJZy.exe
  C:\Windows\System\xaJWJZy.exe
  2⤵
  PID:8808
- C:\Windows\System\YIyOYge.exe
  C:\Windows\System\YIyOYge.exe
  2⤵
  PID:9076
- C:\Windows\System\mcUIXNr.exe
  C:\Windows\System\mcUIXNr.exe
  2⤵
  PID:9060
- C:\Windows\System\BbciIba.exe
  C:\Windows\System\BbciIba.exe
  2⤵
  PID:8996
- C:\Windows\System\uHgbUpt.exe
  C:\Windows\System\uHgbUpt.exe
  2⤵
  PID:8872
- C:\Windows\System\CKbcFkZ.exe
  C:\Windows\System\CKbcFkZ.exe
  2⤵
  PID:8704
- C:\Windows\System\hVEGnaF.exe
  C:\Windows\System\hVEGnaF.exe
  2⤵
  PID:8672
- C:\Windows\System\GdOrYvI.exe
  C:\Windows\System\GdOrYvI.exe
  2⤵
  PID:8768
- C:\Windows\System\QaYoxps.exe
  C:\Windows\System\QaYoxps.exe
  2⤵
  PID:8932
- C:\Windows\System\nxAPDsx.exe
  C:\Windows\System\nxAPDsx.exe
  2⤵
  PID:9112
- C:\Windows\System\mCnDxqD.exe
  C:\Windows\System\mCnDxqD.exe
  2⤵
  PID:9172
- C:\Windows\System\AnRmdtl.exe
  C:\Windows\System\AnRmdtl.exe
  2⤵
  PID:7484
- C:\Windows\System\CaZbOIY.exe
  C:\Windows\System\CaZbOIY.exe
  2⤵
  PID:9100
- C:\Windows\System\tpdIRZr.exe
  C:\Windows\System\tpdIRZr.exe
  2⤵
  PID:9136
- C:\Windows\System\oyeMETY.exe
  C:\Windows\System\oyeMETY.exe
  2⤵
  PID:9156
- C:\Windows\System\GituhtF.exe
  C:\Windows\System\GituhtF.exe
  2⤵
  PID:9180
- C:\Windows\System\VlLBKTq.exe
  C:\Windows\System\VlLBKTq.exe
  2⤵
  PID:9208
- C:\Windows\System\wqEkwDl.exe
  C:\Windows\System\wqEkwDl.exe
  2⤵
  PID:7980
- C:\Windows\System\XfXXWTT.exe
  C:\Windows\System\XfXXWTT.exe
  2⤵
  PID:8440
- C:\Windows\System\lbOthWc.exe
  C:\Windows\System\lbOthWc.exe
  2⤵
  PID:7220
- C:\Windows\System\bzdshCG.exe
  C:\Windows\System\bzdshCG.exe
  2⤵
  PID:7944
- C:\Windows\System\QGrETOj.exe
  C:\Windows\System\QGrETOj.exe
  2⤵
  PID:8604
- C:\Windows\System\vcSBGpP.exe
  C:\Windows\System\vcSBGpP.exe
  2⤵
  PID:8612
- C:\Windows\System\WkiSsAa.exe
  C:\Windows\System\WkiSsAa.exe
  2⤵
  PID:2264
- C:\Windows\System\cJrKldw.exe
  C:\Windows\System\cJrKldw.exe
  2⤵
  PID:8636
- C:\Windows\System\nqCsqzF.exe
  C:\Windows\System\nqCsqzF.exe
  2⤵
  PID:8812
- C:\Windows\System\FyUVUVm.exe
  C:\Windows\System\FyUVUVm.exe
  2⤵
  PID:8476
- C:\Windows\System\LsOKkLf.exe
  C:\Windows\System\LsOKkLf.exe
  2⤵
  PID:8492
- C:\Windows\System\UixycZM.exe
  C:\Windows\System\UixycZM.exe
  2⤵
  PID:8464
- C:\Windows\System\aCibroI.exe
  C:\Windows\System\aCibroI.exe
  2⤵
  PID:8748
- C:\Windows\System\IqechOi.exe
  C:\Windows\System\IqechOi.exe
  2⤵
  PID:8664
- C:\Windows\System\qOIomzW.exe
  C:\Windows\System\qOIomzW.exe
  2⤵
  PID:8840
- C:\Windows\System\IFiKPnp.exe
  C:\Windows\System\IFiKPnp.exe
  2⤵
  PID:8880
- C:\Windows\System\XXmiZSo.exe
  C:\Windows\System\XXmiZSo.exe
  2⤵
  PID:9192
- C:\Windows\System\zQWmhca.exe
  C:\Windows\System\zQWmhca.exe
  2⤵
  PID:9164
- C:\Windows\System\RmrbMxJ.exe
  C:\Windows\System\RmrbMxJ.exe
  2⤵
  PID:9148
- C:\Windows\System\HYASsNi.exe
  C:\Windows\System\HYASsNi.exe
  2⤵
  PID:7796
- C:\Windows\System\GRXuPiQ.exe
  C:\Windows\System\GRXuPiQ.exe
  2⤵
  PID:8136
- C:\Windows\System\MfQsaXk.exe
  C:\Windows\System\MfQsaXk.exe
  2⤵
  PID:8020
- C:\Windows\System\euBUdDx.exe
  C:\Windows\System\euBUdDx.exe
  2⤵
  PID:8220
- C:\Windows\System\ILTGfxK.exe
  C:\Windows\System\ILTGfxK.exe
  2⤵
  PID:8624
- C:\Windows\System\MsnYgEM.exe
  C:\Windows\System\MsnYgEM.exe
  2⤵
  PID:8212
- C:\Windows\System\KXslFOR.exe
  C:\Windows\System\KXslFOR.exe
  2⤵
  PID:8232
- C:\Windows\System\dAOMwrE.exe
  C:\Windows\System\dAOMwrE.exe
  2⤵
  PID:8028
- C:\Windows\System\gzAPUXy.exe
  C:\Windows\System\gzAPUXy.exe
  2⤵
  PID:8600
- C:\Windows\System\wIZOwjR.exe
  C:\Windows\System\wIZOwjR.exe
  2⤵
  PID:8540
- C:\Windows\System\FFjtWnp.exe
  C:\Windows\System\FFjtWnp.exe
  2⤵
  PID:8688
- C:\Windows\System\MyNQFkP.exe
  C:\Windows\System\MyNQFkP.exe
  2⤵
  PID:8736
- C:\Windows\System\XcLPQso.exe
  C:\Windows\System\XcLPQso.exe
  2⤵
  PID:9176
- C:\Windows\System\rlKqmCA.exe
  C:\Windows\System\rlKqmCA.exe
  2⤵
  PID:8836
- C:\Windows\System\PRwLpxZ.exe
  C:\Windows\System\PRwLpxZ.exe
  2⤵
  PID:8524
- C:\Windows\System\UtcKyQB.exe
  C:\Windows\System\UtcKyQB.exe
  2⤵
  PID:8384
- C:\Windows\System\WdBOsUD.exe
  C:\Windows\System\WdBOsUD.exe
  2⤵
  PID:8408
- C:\Windows\System\hJgyjBv.exe
  C:\Windows\System\hJgyjBv.exe
  2⤵
  PID:8400
- C:\Windows\System\oojEooK.exe
  C:\Windows\System\oojEooK.exe
  2⤵
  PID:8412
- C:\Windows\System\HumEiaw.exe
  C:\Windows\System\HumEiaw.exe
  2⤵
  PID:9024
- C:\Windows\System\TeaMQWU.exe
  C:\Windows\System\TeaMQWU.exe
  2⤵
  PID:2544
- C:\Windows\System\bvqULuM.exe
  C:\Windows\System\bvqULuM.exe
  2⤵
  PID:7932
- C:\Windows\System\bDGCvFR.exe
  C:\Windows\System\bDGCvFR.exe
  2⤵
  PID:8888
- C:\Windows\System\OawRKda.exe
  C:\Windows\System\OawRKda.exe
  2⤵
  PID:8240
- C:\Windows\System\FUSlzkr.exe
  C:\Windows\System\FUSlzkr.exe
  2⤵
  PID:8404
- C:\Windows\System\TmJNmmF.exe
  C:\Windows\System\TmJNmmF.exe
  2⤵
  PID:9204
- C:\Windows\System\vyfYSXT.exe
  C:\Windows\System\vyfYSXT.exe
  2⤵
  PID:7200
- C:\Windows\System\pFGNdeR.exe
  C:\Windows\System\pFGNdeR.exe
  2⤵
  PID:6652
- C:\Windows\System\EBPBwTF.exe
  C:\Windows\System\EBPBwTF.exe
  2⤵
  PID:8004
- C:\Windows\System\cOVuIgw.exe
  C:\Windows\System\cOVuIgw.exe
  2⤵
  PID:8156
- C:\Windows\System\benJBCQ.exe
  C:\Windows\System\benJBCQ.exe
  2⤵
  PID:7548
- C:\Windows\System\ZdoNHfd.exe
  C:\Windows\System\ZdoNHfd.exe
  2⤵
  PID:8180
- C:\Windows\System\cTrxNvh.exe
  C:\Windows\System\cTrxNvh.exe
  2⤵
  PID:8508
- C:\Windows\System\DAoDgpD.exe
  C:\Windows\System\DAoDgpD.exe
  2⤵
  PID:7928
- C:\Windows\System\jylxUyT.exe
  C:\Windows\System\jylxUyT.exe
  2⤵
  PID:7956
- C:\Windows\System\VWMzmLF.exe
  C:\Windows\System\VWMzmLF.exe
  2⤵
  PID:852
- C:\Windows\System\ZobvgqA.exe
  C:\Windows\System\ZobvgqA.exe
  2⤵
  PID:8144
- C:\Windows\System\byYnpJr.exe
  C:\Windows\System\byYnpJr.exe
  2⤵
  PID:8852
- C:\Windows\System\KgxiAQq.exe
  C:\Windows\System\KgxiAQq.exe
  2⤵
  PID:8856
- C:\Windows\System\giPGriR.exe
  C:\Windows\System\giPGriR.exe
  2⤵
  PID:2528
- C:\Windows\System\oJRAynR.exe
  C:\Windows\System\oJRAynR.exe
  2⤵
  PID:8216
- C:\Windows\System\yydfhde.exe
  C:\Windows\System\yydfhde.exe
  2⤵
  PID:8432
- C:\Windows\System\vrdFUfr.exe
  C:\Windows\System\vrdFUfr.exe
  2⤵
  PID:2384
- C:\Windows\System\tZGmZPb.exe
  C:\Windows\System\tZGmZPb.exe
  2⤵
  PID:5376
- C:\Windows\System\slmUwNE.exe
  C:\Windows\System\slmUwNE.exe
  2⤵
  PID:1484
- C:\Windows\System\mvpvkon.exe
  C:\Windows\System\mvpvkon.exe
  2⤵
  PID:8364
- C:\Windows\System\LMGnfQb.exe
  C:\Windows\System\LMGnfQb.exe
  2⤵
  PID:8776
- C:\Windows\System\nZCnpbc.exe
  C:\Windows\System\nZCnpbc.exe
  2⤵
  PID:8796
- C:\Windows\System\nDmWTyo.exe
  C:\Windows\System\nDmWTyo.exe
  2⤵
  PID:9040
- C:\Windows\System\xwwiwbI.exe
  C:\Windows\System\xwwiwbI.exe
  2⤵
  PID:9088
- C:\Windows\System\jNBqkkG.exe
  C:\Windows\System\jNBqkkG.exe
  2⤵
  PID:9128
- C:\Windows\System\pEUioAW.exe
  C:\Windows\System\pEUioAW.exe
  2⤵
  PID:7924
- C:\Windows\System\wiizeJu.exe
  C:\Windows\System\wiizeJu.exe
  2⤵
  PID:9280
- C:\Windows\System\jGOkPzx.exe
  C:\Windows\System\jGOkPzx.exe
  2⤵
  PID:9296
- C:\Windows\System\KSvZmAo.exe
  C:\Windows\System\KSvZmAo.exe
  2⤵
  PID:9312
- C:\Windows\System\vRbOrSQ.exe
  C:\Windows\System\vRbOrSQ.exe
  2⤵
  PID:9328
- C:\Windows\System\YEniUnl.exe
  C:\Windows\System\YEniUnl.exe
  2⤵
  PID:9344
- C:\Windows\System\SbRBtTy.exe
  C:\Windows\System\SbRBtTy.exe
  2⤵
  PID:9360
- C:\Windows\System\VvIVdCS.exe
  C:\Windows\System\VvIVdCS.exe
  2⤵
  PID:9376
- C:\Windows\System\zeaspOl.exe
  C:\Windows\System\zeaspOl.exe
  2⤵
  PID:9392
- C:\Windows\System\wKrZpwc.exe
  C:\Windows\System\wKrZpwc.exe
  2⤵
  PID:9408
- C:\Windows\System\wZzxQQh.exe
  C:\Windows\System\wZzxQQh.exe
  2⤵
  PID:9604
- C:\Windows\System\xPgfiYT.exe
  C:\Windows\System\xPgfiYT.exe
  2⤵
  PID:9620
- C:\Windows\System\DHETzNt.exe
  C:\Windows\System\DHETzNt.exe
  2⤵
  PID:9636
- C:\Windows\System\HiOZRUy.exe
  C:\Windows\System\HiOZRUy.exe
  2⤵
  PID:9652
- C:\Windows\System\NJupRNS.exe
  C:\Windows\System\NJupRNS.exe
  2⤵
  PID:9668
- C:\Windows\System\ypDmRwh.exe
  C:\Windows\System\ypDmRwh.exe
  2⤵
  PID:9688
- C:\Windows\System\XpRFeeu.exe
  C:\Windows\System\XpRFeeu.exe
  2⤵
  PID:9704
- C:\Windows\System\CYkHYrY.exe
  C:\Windows\System\CYkHYrY.exe
  2⤵
  PID:9720
- C:\Windows\System\DoSAuJG.exe
  C:\Windows\System\DoSAuJG.exe
  2⤵
  PID:9736
- C:\Windows\System\GlquVNJ.exe
  C:\Windows\System\GlquVNJ.exe
  2⤵
  PID:9752
- C:\Windows\System\LgiTzOm.exe
  C:\Windows\System\LgiTzOm.exe
  2⤵
  PID:9848
- C:\Windows\System\fLyMKXh.exe
  C:\Windows\System\fLyMKXh.exe
  2⤵
  PID:9952
- C:\Windows\System\hxtASgX.exe
  C:\Windows\System\hxtASgX.exe
  2⤵
  PID:10120
- C:\Windows\System\DgpISWt.exe
  C:\Windows\System\DgpISWt.exe
  2⤵
  PID:10136
- C:\Windows\System\fwKPeuL.exe
  C:\Windows\System\fwKPeuL.exe
  2⤵
  PID:10152
- C:\Windows\System\TZcSNJe.exe
  C:\Windows\System\TZcSNJe.exe
  2⤵
  PID:10168
- C:\Windows\System\xrNgZgB.exe
  C:\Windows\System\xrNgZgB.exe
  2⤵
  PID:10184
- C:\Windows\System\VpGnoNt.exe
  C:\Windows\System\VpGnoNt.exe
  2⤵
  PID:10200
- C:\Windows\System\uLriqYS.exe
  C:\Windows\System\uLriqYS.exe
  2⤵
  PID:10216
- C:\Windows\System\ZIyBGXZ.exe
  C:\Windows\System\ZIyBGXZ.exe
  2⤵
  PID:9428
- C:\Windows\System\NJLMPlj.exe
  C:\Windows\System\NJLMPlj.exe
  2⤵
  PID:7472
- C:\Windows\System\YOjEAFv.exe
  C:\Windows\System\YOjEAFv.exe
  2⤵
  PID:7996
- C:\Windows\System\coLcewz.exe
  C:\Windows\System\coLcewz.exe
  2⤵
  PID:7892
- C:\Windows\System\ATJjGOT.exe
  C:\Windows\System\ATJjGOT.exe
  2⤵
  PID:8452
- C:\Windows\System\PmWismx.exe
  C:\Windows\System\PmWismx.exe
  2⤵
  PID:2128
- C:\Windows\System\kihISRd.exe
  C:\Windows\System\kihISRd.exe
  2⤵
  PID:9220
- C:\Windows\System\wbXMfuK.exe
  C:\Windows\System\wbXMfuK.exe
  2⤵
  PID:9244
- C:\Windows\System\abxpZBK.exe
  C:\Windows\System\abxpZBK.exe
  2⤵
  PID:9496
- C:\Windows\System\faAGdqk.exe
  C:\Windows\System\faAGdqk.exe
  2⤵
  PID:9520
- C:\Windows\System\oGoLTfg.exe
  C:\Windows\System\oGoLTfg.exe
  2⤵
  PID:9420
- C:\Windows\System\aQBfCeF.exe
  C:\Windows\System\aQBfCeF.exe
  2⤵
  PID:9772
- C:\Windows\System\yMvhxSz.exe
  C:\Windows\System\yMvhxSz.exe
  2⤵
  PID:9588
- C:\Windows\System\HhvgFQX.exe
  C:\Windows\System\HhvgFQX.exe
  2⤵
  PID:9632
- C:\Windows\System\TrwTNho.exe
  C:\Windows\System\TrwTNho.exe
  2⤵
  PID:9728
- C:\Windows\System\LhpPnHx.exe
  C:\Windows\System\LhpPnHx.exe
  2⤵
  PID:9804
- C:\Windows\System\vsBuPuy.exe
  C:\Windows\System\vsBuPuy.exe
  2⤵
  PID:9820
- C:\Windows\System\YKWrqTE.exe
  C:\Windows\System\YKWrqTE.exe
  2⤵
  PID:9836
- C:\Windows\System\vdpuFBC.exe
  C:\Windows\System\vdpuFBC.exe
  2⤵
  PID:9616
- C:\Windows\System\IyWJOAU.exe
  C:\Windows\System\IyWJOAU.exe
  2⤵
  PID:9968
- C:\Windows\System\LxkWGIa.exe
  C:\Windows\System\LxkWGIa.exe
  2⤵
  PID:9992
- C:\Windows\System\htqBLVR.exe
  C:\Windows\System\htqBLVR.exe
  2⤵
  PID:10008
- C:\Windows\System\aibGlvj.exe
  C:\Windows\System\aibGlvj.exe
  2⤵
  PID:10024
- C:\Windows\System\PTAYcnV.exe
  C:\Windows\System\PTAYcnV.exe
  2⤵
  PID:10088
- C:\Windows\System\RxlUKBr.exe
  C:\Windows\System\RxlUKBr.exe
  2⤵
  PID:10144
- C:\Windows\System\MLpMUPd.exe
  C:\Windows\System\MLpMUPd.exe
  2⤵
  PID:10208
- C:\Windows\System\FpnVEZT.exe
  C:\Windows\System\FpnVEZT.exe
  2⤵
  PID:9908
- C:\Windows\System\FfHuDGN.exe
  C:\Windows\System\FfHuDGN.exe
  2⤵
  PID:9904
- C:\Windows\System\CgRvbNl.exe
  C:\Windows\System\CgRvbNl.exe
  2⤵
  PID:9936
- C:\Windows\System\tVhchsD.exe
  C:\Windows\System\tVhchsD.exe
  2⤵
  PID:10132
- C:\Windows\System\MmXMJDu.exe
  C:\Windows\System\MmXMJDu.exe
  2⤵
  PID:10196
- C:\Windows\System\ktwAdQq.exe
  C:\Windows\System\ktwAdQq.exe
  2⤵
  PID:8268
- C:\Windows\System\NkfLGlq.exe
  C:\Windows\System\NkfLGlq.exe
  2⤵
  PID:8344
- C:\Windows\System\beaZcSg.exe
  C:\Windows\System\beaZcSg.exe
  2⤵
  PID:9436
- C:\Windows\System\EzYaJbN.exe
  C:\Windows\System\EzYaJbN.exe
  2⤵
  PID:7876
- C:\Windows\System\sMLKryc.exe
  C:\Windows\System\sMLKryc.exe
  2⤵
  PID:9124
- C:\Windows\System\dmXtpaS.exe
  C:\Windows\System\dmXtpaS.exe
  2⤵
  PID:9232
- C:\Windows\System\yjdUTuH.exe
  C:\Windows\System\yjdUTuH.exe
  2⤵
  PID:7860
- C:\Windows\System\XlKZfdG.exe
  C:\Windows\System\XlKZfdG.exe
  2⤵
  PID:8036
- C:\Windows\System\RnQMvpD.exe
  C:\Windows\System\RnQMvpD.exe
  2⤵
  PID:8064
- C:\Windows\System\yMIdZxn.exe
  C:\Windows\System\yMIdZxn.exe
  2⤵
  PID:8456
- C:\Windows\System\DTprSUz.exe
  C:\Windows\System\DTprSUz.exe
  2⤵
  PID:7236
- C:\Windows\System\huQVOKk.exe
  C:\Windows\System\huQVOKk.exe
  2⤵
  PID:8652
- C:\Windows\System\gUZcTfi.exe
  C:\Windows\System\gUZcTfi.exe
  2⤵
  PID:8576
- C:\Windows\System\xjhlFau.exe
  C:\Windows\System\xjhlFau.exe
  2⤵
  PID:9240
- C:\Windows\System\TlXbCSi.exe
  C:\Windows\System\TlXbCSi.exe
  2⤵
  PID:2896
- C:\Windows\System\kCXdFur.exe
  C:\Windows\System\kCXdFur.exe
  2⤵
  PID:8264
- C:\Windows\System\QindKVC.exe
  C:\Windows\System\QindKVC.exe
  2⤵
  PID:9552
- C:\Windows\System\OunkfqY.exe
  C:\Windows\System\OunkfqY.exe
  2⤵
  PID:9564
- C:\Windows\System\AVfxNKj.exe
  C:\Windows\System\AVfxNKj.exe
  2⤵
  PID:9600
- C:\Windows\System\TcJDcZr.exe
  C:\Windows\System\TcJDcZr.exe
  2⤵
  PID:9776
- C:\Windows\System\kTrOVOF.exe
  C:\Windows\System\kTrOVOF.exe
  2⤵
  PID:9792
- C:\Windows\System\EBZpaRM.exe
  C:\Windows\System\EBZpaRM.exe
  2⤵
  PID:9832
- C:\Windows\System\IiMsIpF.exe
  C:\Windows\System\IiMsIpF.exe
  2⤵
  PID:9256
- C:\Windows\System\rbsQzGo.exe
  C:\Windows\System\rbsQzGo.exe
  2⤵
  PID:9584
- C:\Windows\System\yCBMzte.exe
  C:\Windows\System\yCBMzte.exe
  2⤵
  PID:9812
- C:\Windows\System\dsTsAzO.exe
  C:\Windows\System\dsTsAzO.exe
  2⤵
  PID:9612
- C:\Windows\System\baqmVmj.exe
  C:\Windows\System\baqmVmj.exe
  2⤵
  PID:9744
- C:\Windows\System\cZbxWlp.exe
  C:\Windows\System\cZbxWlp.exe
  2⤵
  PID:1072
- C:\Windows\System\POxhFui.exe
  C:\Windows\System\POxhFui.exe
  2⤵
  PID:9960
- C:\Windows\System\ABGpTky.exe
  C:\Windows\System\ABGpTky.exe
  2⤵
  PID:10044
- C:\Windows\System\iuCVXeT.exe
  C:\Windows\System\iuCVXeT.exe
  2⤵
  PID:9456
- C:\Windows\System\scpkSbs.exe
  C:\Windows\System\scpkSbs.exe
  2⤵
  PID:9484
- C:\Windows\System\dyZMCdY.exe
  C:\Windows\System\dyZMCdY.exe
  2⤵
  PID:10052
- C:\Windows\System\aEOHBnL.exe
  C:\Windows\System\aEOHBnL.exe
  2⤵
  PID:10060
- C:\Windows\System\sVwjqCz.exe
  C:\Windows\System\sVwjqCz.exe
  2⤵
  PID:10080
- C:\Windows\System\rVnQPuh.exe
  C:\Windows\System\rVnQPuh.exe
  2⤵
  PID:9988
- C:\Windows\System\FaQJrJp.exe
  C:\Windows\System\FaQJrJp.exe
  2⤵
  PID:4172
- C:\Windows\System\lrizuoK.exe
  C:\Windows\System\lrizuoK.exe
  2⤵
  PID:9940
- C:\Windows\System\dqJPdBo.exe
  C:\Windows\System\dqJPdBo.exe
  2⤵
  PID:9948
- C:\Windows\System\ZZlXAXL.exe
  C:\Windows\System\ZZlXAXL.exe
  2⤵
  PID:9292
- C:\Windows\System\reayVSw.exe
  C:\Windows\System\reayVSw.exe
  2⤵
  PID:9352
- C:\Windows\System\OLsPPFT.exe
  C:\Windows\System\OLsPPFT.exe
  2⤵
  PID:9868
- C:\Windows\System\gSESDUK.exe
  C:\Windows\System\gSESDUK.exe
  2⤵
  PID:9928
- C:\Windows\System\TfFMkHG.exe
  C:\Windows\System\TfFMkHG.exe
  2⤵
  PID:10108
- C:\Windows\System\XbsWVzY.exe
  C:\Windows\System\XbsWVzY.exe
  2⤵
  PID:9892
- C:\Windows\System\RDsagXw.exe
  C:\Windows\System\RDsagXw.exe
  2⤵
  PID:8448
- C:\Windows\System\jhtVlsn.exe
  C:\Windows\System\jhtVlsn.exe
  2⤵
  PID:10228
- C:\Windows\System\cQVpnVc.exe
  C:\Windows\System\cQVpnVc.exe
  2⤵
  PID:9540
- C:\Windows\System\Pvgfqmv.exe
  C:\Windows\System\Pvgfqmv.exe
  2⤵
  PID:9336
- C:\Windows\System\gSqaokw.exe
  C:\Windows\System\gSqaokw.exe
  2⤵
  PID:10092
- C:\Windows\System\RQZXNLV.exe
  C:\Windows\System\RQZXNLV.exe
  2⤵
  PID:9044
- C:\Windows\System\tlJFDYr.exe
  C:\Windows\System\tlJFDYr.exe
  2⤵
  PID:9304
- C:\Windows\System\EiaeVzT.exe
  C:\Windows\System\EiaeVzT.exe
  2⤵
  PID:8284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AfSTLWD.exe

Filesize
1.8MB

MD5
3c48bc105fcfb735a90bf1126b0fc278

SHA1
5270a96efa3c915e496588a5771d7b5af8393bc8

SHA256
3b3c2b17f0e35c32e8ff9e1c0b16958dc396813095e266cd3e357df20debbe1e

SHA512
64552d206931fd14263f244ad03732f3e7c7cf714d5691a2db540302ac8612bf990f5473293a33def6fd24380ef98f63a2925b5fc0464e147af03f0f73c7da3a

Download Submit
C:\Windows\system\BXllKPj.exe

Filesize
1.8MB

MD5
5ff64b24c09ae024942aa75fe57e6a5e

SHA1
4098388078a045cbc163d0a9ea1fa8b4b6948c69

SHA256
2f75aa786af2f9da2e1faca4d1b03b7d421ea028207edf4f86dc6d7297e51f69

SHA512
343ee34fd36f5f096aee2bb0d60d94a157567113622c04f4892867dbf12740efdb93f0347ff666e54db25fea9240822be9d803b6e1d46be939472e491fbe8f1c

Download Submit
C:\Windows\system\BdlEqoy.exe

Filesize
1.8MB

MD5
5bacd622ab1cd5672feea4f7d5d145e3

SHA1
d048ef34e734d3e04b4c3a1ab196b11e6ec8c833

SHA256
065afc26ab899deccf9e32ac92b7d0abd21a2edf66c050f7dbc8cc4210e074d3

SHA512
49762b1f1491b7f9d3f85016e7ef54a6a43ec613221c0858041cca4b789adea24947b7e2d99bfb17444e0964ccb49623fb3014cda4761e7327bf253dac68a58f

Download Submit
C:\Windows\system\BkCfUAC.exe

Filesize
1.8MB

MD5
e0051f00023c137b580d6d2a78f9d2dd

SHA1
c7fa36e5eefdb021a02d2f0a35b1b9aed11d1d90

SHA256
53770fe58b314d1df984d98418276a6d05eafad19c6045df3330f3be494134bf

SHA512
83afd83e981c89059dbfa4b0a430ea25008c45e4b6007806f914769c10e93876220e1502245f1b49c0a0bcb794221eb3649b1f2429d6d3f7629aa8eff2dcba2c

Download Submit
C:\Windows\system\FKdOSgd.exe

Filesize
1.8MB

MD5
b030be83dafa09a7af66ccad3ba5b1c1

SHA1
0d2ca52f433a7f642e6619002c4a777bb4b10fca

SHA256
6e7a8eccfc954daf6bbb03e9918bda7e438ac65d933120d8c431e281f60b6d28

SHA512
f571ffa80d40ae902e8df2efe922198c2d24b7f7c601d9f65f0eea9a9dbf84b4b165973936a76b7df48549b34510d6649b2c4b862498c5ab1c7c38a5e10cb4d1

Download Submit
C:\Windows\system\Jeqhgbr.exe

Filesize
1.8MB

MD5
89a4c0fae904b3dc03fbe341d8675c8d

SHA1
9a9c9cbd2f32c20434946c2f03556b69f980a879

SHA256
7b4f6c1b880147bd61d28e35d3fc5f7a953c52fec3b2154fa72f9e96850fbb10

SHA512
815f86ebb6cecc5058bd8de629d49258da265c79bcb7b44228a96e103de6f543c4cfe6e1690e94387097fc17ace4a6ebfc79a3bb5425f4daf94fbd9fe384f344

Download Submit
C:\Windows\system\LzEHDwu.exe

Filesize
1.8MB

MD5
be3fcc6256371b05ef7239244e66aff8

SHA1
fe0fb29e55f22c0b3711fcf5675362bb524475c6

SHA256
7b5e4b08891c5930061f07ab255dff2c8191c2249b513adaff39451fd2525e44

SHA512
674d445dbc7d4d91554c9bf65aa3107b94cd62dc9cbafbf47dd9b80061fa49e2f1ee6a2343d0389718ddb4696bfd15faa2ffae29dc7d8c88ff51c7c400578252

Download Submit
C:\Windows\system\RtKQSjQ.exe

Filesize
1.8MB

MD5
9c6b72e6f7ace034f9b90124e220a8a9

SHA1
ef4de6562137fdb87116b5b32ab2cf9011f2e50a

SHA256
9f0aa5fb1fd41ff2aaab7e1387fb336d28cae92bddd54c6ae91083f0ced6806c

SHA512
076868e21d985d230d9ed3bceece362ab5739e41af23de298c9a37b9bff105587f963c031d6490a7ae68d1d09647cb60666e168a91425235fa14a7b4be152f64

Download Submit
C:\Windows\system\SALVHaQ.exe

Filesize
1.8MB

MD5
3049fd5de2df5749d186ef3e0b300c6e

SHA1
3f1fba14a0f61343d771efded2beaaa3765bcb56

SHA256
2339aa9c9f9248494f0e33657128e7e1f558429a014f1b697fb1cb0d7f5249ed

SHA512
fbfdaca2880304a40a27bd35b5a447cf4916381edcd4fa67f79d4ba4e8565d0d91c0074ee5129fe839dac25984aa36afd961341c3216584fb4172f1968ab003a

Download Submit
C:\Windows\system\UByYWTV.exe

Filesize
1.8MB

MD5
3a2c0c5df9313cf9c834439c7b8089bd

SHA1
4414539254f0137addfa3f53206dcff2defdb7e1

SHA256
ff40f7595e46c89b95cb36c4e0a170ec4f74d9acf3e3f0c4e2ca97c25d742857

SHA512
38f14c9f878d16e67aa5ef420409fc9391f6e02d2ae17e96130d26892b891f472927a4af462ce319052844ea628c4474a0aa3df41ccf99950bd7232084f8b128

Download Submit
C:\Windows\system\WywtSVn.exe

Filesize
1.8MB

MD5
76d8e119292d373108907ff88003e301

SHA1
ee92cc1c2e5cbe0d9c83561a1ef5e541812353a8

SHA256
aed4abb2caed6d164550a7b9331d191b9623c7984117fb0493f2e068db18bb47

SHA512
82d72e20f4c8a8ed21453d8492708036189f051f478f82ba6781e377e62b6fdd66e29d36a8d1d2e8a76604cde098ad768d31012dd666d58ba69bdab8a1c8499c

Download Submit
C:\Windows\system\XSWrcKQ.exe

Filesize
1.8MB

MD5
1f2f743925d72fb97b3dd1a39c2bef1c

SHA1
62bc35e5e980d709b7942d95544e3eda43cee6e8

SHA256
5fb24be8d090d00f21c9567cba61735bc49c9da6f2107988593538e801a9fcf0

SHA512
11e40e62a44611f951a71cb752fdd66fc3ac3d8f4b0e5048680a988d43af39f01d1cdee2a0ee8d57311af8a3b19b22ce88f56e16fe129e0997e92709a7d8bea4

Download Submit
C:\Windows\system\aXSEPPS.exe

Filesize
1.8MB

MD5
95eba26d82aaad43cbab4de906040079

SHA1
253b4cff34b0729e3b70f836363292fe267f75d2

SHA256
684367bc41ba9b84320cdaf034876506c041062245df6064fa341bd765b47725

SHA512
c57f3ae63931583e7b78954caf61ca273ad083b9e3a50fba4ce12d34f80c79647be6b6ea14fcc7328e91542306ae54f287b9bd366a372f36a2f1581c13b741d1

Download Submit
C:\Windows\system\abgiuMT.exe

Filesize
1.8MB

MD5
4f39d74bc6c45d5102a5637be3640b4f

SHA1
2d5c9568c819d57e9f00e1d0d900d060473b732d

SHA256
0c3c57a347c187abf2f6b25abf4ff573ee1ddbda8a2778bff0d695b4dba46742

SHA512
e016fdc49ed811647240028207280aeecf65b3a5fbcad4219f9cec3ec5f7b1e1e6c5b403b559e1a80b46900134caf46b9e26f18cb31ac84508ae37123068784f

Download Submit
C:\Windows\system\fCLFyky.exe

Filesize
1.8MB

MD5
3aaf08d6e8090a55764a0abc7eaefafb

SHA1
40a2d90e6b9af6b09503653c0f35d8348d5b1fb1

SHA256
0553d5ec8480b7aa2595621abf80d7c7054d949920f1df2ddd328d40f1ce7d88

SHA512
e0d9a87bcba2e200e68b72f710ab6e0bc13022a1d59be43393b7ead670a467710c339c6da69f42bc532aff6e77419bc1b85902c378cb1a528a89b00ac6fc7226

Download Submit
C:\Windows\system\fyvsioq.exe

Filesize
1.8MB

MD5
05b4129bf9c99de67a89b8243089633f

SHA1
372194032233a8debec88803d3a8b6469ba61bb1

SHA256
260ea519e9f18e3e44d0147a936abd4a9a4620268ddab9648a53239146998c00

SHA512
38bc91e66f1ebd3c9d359725ed155fa532eb680a810e4c7e02ae8b00ed0835b86620824e9920017c883bf8d29cedd4efde70e44613d9a55f8eaf4ab8dbaa189b

Download Submit
C:\Windows\system\gdZGFzg.exe

Filesize
1.8MB

MD5
ecb425c132efef4b0f989ca80073976a

SHA1
9dccb2bc7e41002f01b958df38c1a79d220b3b65

SHA256
d3bbaf42c7ec6940900c8c2fbdb15e94ed1981cc40fa0ed49cbedf9baa48893e

SHA512
7cc3d70f2b9d99dd12d43a520bb6124ad860de4fbf694555f02cf43cb724306006447e43313148147f6c0608ce4238594df5fb702d064c2c45a57a27e25189ea

Download Submit
C:\Windows\system\ggPcepf.exe

Filesize
1.8MB

MD5
1150babae75ad51e1e8037939461821a

SHA1
981852d0c5710de52d57817c31434c22d7598ea7

SHA256
d29f511d979e0a138a2107e049e1da0877bedb37d919a60d38be897544e1359d

SHA512
efea1a2f1d4ca1c39f238fe94241b413cca1fdfef131f22ac4189cf34158f716486a7f3d434c2b1df9eb245cd8282177b77f8ea3e15a363e2ec46813fda5a9b5

Download Submit
C:\Windows\system\itJPPdq.exe

Filesize
1.8MB

MD5
8471a2cca99c0feb494f23bfe5f70e4c

SHA1
7a489c0b08952a80f05b86adc8eb68a4c4dd41af

SHA256
1111e1e48dd168e391538e79d1cf07232c384d34f8211d86e7f44b57a3cf0217

SHA512
49f09402542fd4e8714e8ca0c6bdc9eac77a5a435aea78fc0c32235acc36b3659982b1846d591e49267a721ceb9d6c71fbe9ae4e8c2ae65c773ed14eeb85ad88

Download Submit
C:\Windows\system\lGAZOkR.exe

Filesize
1.8MB

MD5
ca96bc53c534c99adbcaacd30985248d

SHA1
da9547aa7ed1f46bffab93db6e381db3c09ccb39

SHA256
608d1d151cd19e6134928ee87a36982da03a8d68a0ce67fcf4e69545f1dc6587

SHA512
42a39359284535df2c730a93ef5e5349036e0698376c4d53c95a129e25aeeefa7a9aa59ff23074b628cfefcd301180a1127f2d56c5efac6f8c9195bb6979e108

Download Submit
C:\Windows\system\sXoONkI.exe

Filesize
1.8MB

MD5
1b140184b9f707e82621054d3605984f

SHA1
6c02049c8ee9b0aeb6edddcf324b98901c31e50c

SHA256
a83fe46650138b69bfc4241b5e78de999532c9a094b11d5231ba479b03ec1620

SHA512
9361fb570e9b44d95060b5f8fa56cc03c3787a243fa8e0b4e044f385e001519d6e84b44a67d41c1fc5bc9d64f356a3195c7c7b4d254e220015ee868945b446c7

Download Submit
C:\Windows\system\tWtrewF.exe

Filesize
1.8MB

MD5
39a440f40565ce8f2e5c58cae3a315f5

SHA1
3a44a6a7008558789761720e815a0c4b8d01fc4d

SHA256
5c0946e58b3d9aee1403dd14993bc7bf20e30774f178a6e477a417fe27cf5aa2

SHA512
9b425c58d1aeedc35ae8461c56cbd72b581c88920dbed94281be1828c2ac6dd9d5ff73372850f4af26fe4efc352a0c9159b4aa8f8219512f129888a5a61fb867

Download Submit
C:\Windows\system\tdcaRaS.exe

Filesize
1.8MB

MD5
5d22a5a7d2e9866e623fab90c5210581

SHA1
d397d4ff5b72f6782b524d9fd0b1fa495db8e817

SHA256
1acf9ff196ae83521ddb9864b0662fd1c90a0b9980a9ccd2a5964e3e4cae903a

SHA512
b15e989a208edb5b9abadb5e6625a5e50bd85ee59ef06338314c67a2026b9128b98bd86d506b78037d7691aa61856c8b5480657eb961efa5a06c87a3b2eb703f

Download Submit
C:\Windows\system\tyzjZzF.exe

Filesize
1.8MB

MD5
87206932653a648fbd48c12f5b8f5c3e

SHA1
b55490499a0c1d657e5971a3a14a06934dcc0e05

SHA256
96a2ac7cca241c89d9da563490c0d243ea820647789a6876ee588924b46bbcd1

SHA512
226a964e987dd7e5cac00008a85ed6ff5ddc1ecbe27dc16ac46c5e7bc0117e0814aeed3c65f83ac8fc35930f69e3c280ed3c9f7eb2b762a43b4e85d4179f50b0

Download Submit
C:\Windows\system\vFPQbca.exe

Filesize
1.8MB

MD5
3ffd37bdf4ed80c97e840eb33ecd0244

SHA1
d79a30914bd6856b0abe2becfbcb91b98d2bd110

SHA256
0f950d4b8a45578c1e856f75c77fb6a7102b5643bbda42b253394560553785e9

SHA512
57dbf23d257716aff533b6f9775c3f06e9da9e0123b01dd2d72e57fabecd39fc1ad3bacf4429f0577151921d92b6e22d5b91a1fe8d7f87e8285a3fad7b7bdfd7

Download Submit
C:\Windows\system\vIsCOcN.exe

Filesize
1.8MB

MD5
4750c6b2c849a8d57c0cad43613c0bd5

SHA1
5975704d831966ff56ad9ee49c6dd1f4c03c441f

SHA256
008287d2cf1a93aad2b70d545508e01f14ce359b0d4051a0e11fec7c821fbec3

SHA512
f9185fd860e2778a5dc56286d0c5e07f10412549ea35fee0ce878bfb3b1c8ce1b067d4737e1e14de78655876f671e0987f6fb19d6ba60392b370fd2a7f666ee8

Download Submit
\Windows\system\FfbcKQm.exe

Filesize
1.8MB

MD5
508cb3a870fded96c211eff22cf6ab5d

SHA1
919ec70df783f2bc06bc54b262e8462c182b3b68

SHA256
177e58feadbddb2e1c3b069e4c1464031241a884d2ec94ca2101b20b53d5b6b6

SHA512
aa19cd1bd4de3cd59a1346d558d7354b5255898e9723cabfbb5c19402c741ab5c299867c57a05c79e76cefc2d14e212bb3a1acbdc0b98d7841ae687066b6c1e8

Download Submit
\Windows\system\JBePVWY.exe

Filesize
1.8MB

MD5
5440f0d205f60c3d7ddb500d834eac2e

SHA1
a72b890212db50eb5121187154f2834420ffc739

SHA256
1862880a902803fb90fec8bee650ee2e98959896aec49f762f2723eefd355d72

SHA512
8be82020cdda0e24f0b1af1d5ba8831f9c97df4fd4e249f079bc56008c17df304f23294e0b4bed2a4e84d213969591b8464c2b7db04187a502da83fc2da42a94

Download Submit
\Windows\system\SUMZWDD.exe

Filesize
1.8MB

MD5
ba929337dd2b907d064f1440d08c553e

SHA1
62cabe6ce5d37904bdef4dfdf2519267fe28f7d1

SHA256
4a26e420f9d143cbf5014be9f1f0b72f3ada227fd41d49b2b19141f9f40f1698

SHA512
23bbcf349932a740172eac3284391f71c68a58bbd370fbb1f68d4a7ff230c51963580f4e22ce7b905a2a4a8ceb614749f7684b09264ac169b60e736c98fa5ba6

Download Submit
\Windows\system\WnzAjYb.exe

Filesize
1.8MB

MD5
d07a466d736f5a2d61b71c0bf7a3adcd

SHA1
246274afd69944b035ab2c20aa2ff7309e8c2119

SHA256
82d5e46cbe8bb16fccb440448aafac6e50af5f4974647fe5ded6d2bab98cd08d

SHA512
02dcffc9147a3019d6f790a7532ce7f87dce9f60eb1d161a24922f5d2e95aecb6e61fe3e89524cff63c0909e93626c4480d5d4ffed9fb0118d405c4fa4876686

Download Submit
\Windows\system\XanCreo.exe

Filesize
1.8MB

MD5
f01cf8c0507c5e4c9d1226697b01e1c4

SHA1
55ae338895b57db996b069000c8c7af37a118cf7

SHA256
04326af3e0dc6b187688f5b484a17fb5e09ec113a3c67e7fb71ddddd93022a6d

SHA512
340cab23a2f45d6e6abd828db626386f607317568b64fbef07dea27710a4ca79bf931533f8246bcc0cf6f46e5da7054f33ef6090f6f9dc431fdbaffbd261b30e

Download Submit
\Windows\system\zQpxHbE.exe

Filesize
1.8MB

MD5
b220b9bf040013b4cf6a038e66e6d332

SHA1
bdb5af36262883fe42ca102b5d98982149432626

SHA256
1bcca1dc36491a05092553d51616c7793d40b88cfaaa5c0208691089663392a8

SHA512
4ff0b817bf5d21c3e947f4551f5833a5ef2d5b353e58b7617bd52bc6dacab981460cd85e44690bffae63f375784a88abb267ab1df0096e272aa5b6d147db10bb

Download Submit
memory/1096-13-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1096-293-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1096-2083-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/1136-68-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/1136-0-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/1136-1-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/1136-10-0x0000000002AD0000-0x0000000002EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-78-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1136-80-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1136-291-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/1136-29-0x0000000002AD0000-0x0000000002EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-70-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-63-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-15-0x0000000002AD0000-0x0000000002EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-71-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/1136-73-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-74-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-3356-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-20-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-2081-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-455-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

Filesize
9.6MB

Download
memory/2268-62-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

Filesize
9.6MB

Download
memory/2268-35-0x00000000029D0000-0x0000000002A50000-memory.dmp

Filesize
512KB

Download
memory/2268-77-0x000007FEF4AA0000-0x000007FEF543D000-memory.dmp

Filesize
9.6MB

Download
memory/2268-52-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/2268-42-0x000000001B340000-0x000000001B622000-memory.dmp

Filesize
2.9MB

Download
memory/2360-72-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2360-3355-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2504-64-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2504-3252-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2560-67-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-3357-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-3391-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-66-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-3251-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2692-69-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2936-34-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2936-2080-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download