xmrig | f547b254f3832b2d574d4440137896961ea166a354c8f4006795bfff3609ab35

Analysis

max time kernel
99s
max time network
96s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
Size

1.9MB
MD5

0709ad842e5bc61cbefb1505e6e9090d
SHA1

6de2ceae4ce6bc4248cc2fab233b4b0873444e9f
SHA256

f547b254f3832b2d574d4440137896961ea166a354c8f4006795bfff3609ab35
SHA512

7f663f634d61f1dcbdd9957365b6f1b2775667f390060228bc2abcaa5a0e9a701f46cb3e6c73da18953724100428ad33bc02b4c39b6f31b8f9ae43f584726623
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlT:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2544-90-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2560-96-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2504-106-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2668-105-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2400-102-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/1724-100-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2592-98-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2568-87-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2052-288-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2184-287-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2052-2058-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2568-2059-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2544-2060-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2560-2062-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2592-2061-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2400-2063-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/1724-2064-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2668-2066-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2504-2065-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2052	yNxCDVQ.exe
2568	AFjSbZa.exe
2544	IaWPZil.exe
2560	gVNOAMK.exe
2592	cvAFVAZ.exe
1724	ofOdLXx.exe
2400	nyCZrTG.exe
2668	nsFfWEN.exe
2504	SNtHeHl.exe
1004	MklioWy.exe
1812	CrKSJnN.exe
1440	bLaodoo.exe
1332	nYDPwLx.exe
2664	hzkYEpO.exe
1516	cqqlTbB.exe
1196	RzmeeQb.exe
1896	DdpFwzE.exe
1672	dSDFkSN.exe
852	BfxjPyF.exe
756	mEXvidc.exe
760	LIdPFzk.exe
1436	jIkJleG.exe
2040	pVPmiNX.exe
2304	QoUUXNs.exe
1140	CCfmnCM.exe
2068	JDXdvJe.exe
544	jXUdUiD.exe
2892	vmJVefC.exe
1104	AcMUxUQ.exe
1108	oqHQkJS.exe
2948	GTzaBju.exe
940	xWQMgGC.exe
1396	mQLvVJa.exe
1604	regVlzu.exe
1180	YrPEggD.exe
2200	kNaOmVG.exe
2232	lUYYyyP.exe
1544	FPXVyNQ.exe
1788	TkJBXNt.exe
1452	GUSMgdY.exe
888	RjKCCQU.exe
3068	yEXXqqu.exe
1468	AhtBFDB.exe
1700	xkUQZmn.exe
1676	jtuCCpF.exe
1392	GyQXmBy.exe
864	iUUTclj.exe
2888	cTjWJlQ.exe
2860	sJdEgPj.exe
1692	vuZSYfU.exe
2784	QdrduAc.exe
2340	japezyG.exe
1584	jUQgfJC.exe
2172	oufrkjf.exe
2732	IUsvLEU.exe
2584	oUdXIft.exe
2508	OQzlFTS.exe
2940	qJKzEit.exe
2816	FQkBbsq.exe
2396	vMHFahm.exe
2456	IShyqzx.exe
1716	JItYhfT.exe
276	THpMwLN.exe
2148	MSemECX.exe

Loads dropped DLL 64 IoCs

pid	Process
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-0-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x000c00000001445e-3.dat	upx
behavioral1/memory/2052-9-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/files/0x002d000000014909-14.dat	upx
behavioral1/files/0x000f0000000006fd-19.dat	upx
behavioral1/files/0x0009000000014c67-24.dat	upx
behavioral1/files/0x0007000000014e3d-31.dat	upx
behavioral1/files/0x0007000000014ec4-34.dat	upx
behavioral1/files/0x0009000000015264-54.dat	upx
behavioral1/files/0x0006000000016ccf-58.dat	upx
behavioral1/files/0x0006000000016cf0-68.dat	upx
behavioral1/files/0x0006000000016cd4-63.dat	upx
behavioral1/files/0x0006000000016d01-71.dat	upx
behavioral1/memory/2544-90-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2560-96-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-93.dat	upx
behavioral1/files/0x0006000000016d41-112.dat	upx
behavioral1/memory/2504-106-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2668-105-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2400-102-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/1724-100-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2592-98-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0006000000016d11-88.dat	upx
behavioral1/memory/2568-87-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x0006000000016d84-132.dat	upx
behavioral1/files/0x0006000000017090-145.dat	upx
behavioral1/files/0x0006000000016d4a-120.dat	upx
behavioral1/files/0x000600000001704f-156.dat	upx
behavioral1/files/0x0005000000018698-163.dat	upx
behavioral1/files/0x000500000001868c-159.dat	upx
behavioral1/files/0x0006000000016d89-154.dat	upx
behavioral1/files/0x0006000000016e56-144.dat	upx
behavioral1/files/0x0006000000016d55-136.dat	upx
behavioral1/files/0x0006000000018b33-190.dat	upx
behavioral1/memory/2052-288-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2184-287-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x0006000000018ae8-180.dat	upx
behavioral1/files/0x0006000000018b15-183.dat	upx
behavioral1/files/0x00050000000186a0-170.dat	upx
behavioral1/files/0x0006000000018ae2-173.dat	upx
behavioral1/files/0x0006000000016d4f-124.dat	upx
behavioral1/files/0x0006000000016d24-82.dat	upx
behavioral1/files/0x0009000000015364-51.dat	upx
behavioral1/files/0x0007000000014fe1-43.dat	upx
behavioral1/memory/2052-2058-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2568-2059-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2544-2060-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2560-2062-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2592-2061-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2400-2063-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/1724-2064-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2668-2066-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2504-2065-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ndxJBMb.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\mLqRpjU.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\ZwlWXMS.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\wHPsyJv.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\AlKqpgm.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\vnfSqzT.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\cTjWJlQ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\yTuwHBf.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\jVvjgNL.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\GkbsgHt.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\ehnTXBd.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\opItAKr.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\RqxeqDq.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\ioxEPfb.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\sxfGrlC.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\iyUqiNo.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\WypBvSd.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\tZwXspl.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\FKyjtyQ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\CWBDTjZ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\pveQPxp.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\cmRwpGn.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\AYHBEdm.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\UCARZcI.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\lLHZoBD.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\dSDFkSN.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\kUhZpFX.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\AgDWzAA.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\XoekWFc.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\sXvSOoW.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\fmoUnbu.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\yuaCdQq.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\nnYhsbQ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\odChoFv.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\IYCEwoJ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\AJLhmnD.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\HnhuyIu.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\JXUixoN.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\jUQgfJC.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\rIActFC.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\qvLBgNv.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\FkSFTLq.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\EQYKxPH.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\kOXdYUR.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\kGzlZSe.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\RVZPjjw.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\puqBSdS.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\Clufrtg.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\FfuZHDP.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\bjimzIt.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\zyjdOFW.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\iVdRewJ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\xigeLLg.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\BfxjPyF.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\ewLPwyx.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\dSzecpE.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\NtlNfJc.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\hKEmUZH.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\cixwjQe.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\bSSgJUf.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\DDOueyZ.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\UKrCpaP.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\DoiDBlw.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
File created	C:\Windows\System\tIjfjpo.exe	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1876	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
Token: SeDebugPrivilege	1876	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1876	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	29
PID 2184 wrote to memory of 1876	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	29
PID 2184 wrote to memory of 1876	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2052	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2052	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2052	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2568	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2568	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2568	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2544	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	32
PID 2184 wrote to memory of 2544	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	32
PID 2184 wrote to memory of 2544	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	32
PID 2184 wrote to memory of 2560	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	33
PID 2184 wrote to memory of 2560	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	33
PID 2184 wrote to memory of 2560	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	33
PID 2184 wrote to memory of 2592	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	34
PID 2184 wrote to memory of 2592	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	34
PID 2184 wrote to memory of 2592	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	34
PID 2184 wrote to memory of 1724	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	35
PID 2184 wrote to memory of 1724	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	35
PID 2184 wrote to memory of 1724	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	35
PID 2184 wrote to memory of 2400	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	36
PID 2184 wrote to memory of 2400	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	36
PID 2184 wrote to memory of 2400	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	36
PID 2184 wrote to memory of 2504	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	37
PID 2184 wrote to memory of 2504	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	37
PID 2184 wrote to memory of 2504	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	37
PID 2184 wrote to memory of 2668	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	38
PID 2184 wrote to memory of 2668	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	38
PID 2184 wrote to memory of 2668	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	38
PID 2184 wrote to memory of 1004	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	39
PID 2184 wrote to memory of 1004	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	39
PID 2184 wrote to memory of 1004	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	39
PID 2184 wrote to memory of 1812	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	40
PID 2184 wrote to memory of 1812	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	40
PID 2184 wrote to memory of 1812	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	40
PID 2184 wrote to memory of 1440	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	41
PID 2184 wrote to memory of 1440	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	41
PID 2184 wrote to memory of 1440	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	41
PID 2184 wrote to memory of 1332	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	42
PID 2184 wrote to memory of 1332	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	42
PID 2184 wrote to memory of 1332	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	42
PID 2184 wrote to memory of 1516	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	43
PID 2184 wrote to memory of 1516	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	43
PID 2184 wrote to memory of 1516	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	43
PID 2184 wrote to memory of 2664	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	44
PID 2184 wrote to memory of 2664	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	44
PID 2184 wrote to memory of 2664	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	44
PID 2184 wrote to memory of 1196	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	45
PID 2184 wrote to memory of 1196	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	45
PID 2184 wrote to memory of 1196	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	45
PID 2184 wrote to memory of 1896	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	46
PID 2184 wrote to memory of 1896	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	46
PID 2184 wrote to memory of 1896	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	46
PID 2184 wrote to memory of 1672	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	47
PID 2184 wrote to memory of 1672	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	47
PID 2184 wrote to memory of 1672	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	47
PID 2184 wrote to memory of 852	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	48
PID 2184 wrote to memory of 852	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	48
PID 2184 wrote to memory of 852	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	48
PID 2184 wrote to memory of 760	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	49
PID 2184 wrote to memory of 760	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	49
PID 2184 wrote to memory of 760	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	49
PID 2184 wrote to memory of 756	2184	0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0709ad842e5bc61cbefb1505e6e9090d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1876
- C:\Windows\System\yNxCDVQ.exe
  C:\Windows\System\yNxCDVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\AFjSbZa.exe
  C:\Windows\System\AFjSbZa.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\IaWPZil.exe
  C:\Windows\System\IaWPZil.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\gVNOAMK.exe
  C:\Windows\System\gVNOAMK.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\cvAFVAZ.exe
  C:\Windows\System\cvAFVAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ofOdLXx.exe
  C:\Windows\System\ofOdLXx.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\nyCZrTG.exe
  C:\Windows\System\nyCZrTG.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\SNtHeHl.exe
  C:\Windows\System\SNtHeHl.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\nsFfWEN.exe
  C:\Windows\System\nsFfWEN.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\MklioWy.exe
  C:\Windows\System\MklioWy.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\CrKSJnN.exe
  C:\Windows\System\CrKSJnN.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\bLaodoo.exe
  C:\Windows\System\bLaodoo.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\nYDPwLx.exe
  C:\Windows\System\nYDPwLx.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\cqqlTbB.exe
  C:\Windows\System\cqqlTbB.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\hzkYEpO.exe
  C:\Windows\System\hzkYEpO.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\RzmeeQb.exe
  C:\Windows\System\RzmeeQb.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\DdpFwzE.exe
  C:\Windows\System\DdpFwzE.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\dSDFkSN.exe
  C:\Windows\System\dSDFkSN.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\BfxjPyF.exe
  C:\Windows\System\BfxjPyF.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\LIdPFzk.exe
  C:\Windows\System\LIdPFzk.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\mEXvidc.exe
  C:\Windows\System\mEXvidc.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\QoUUXNs.exe
  C:\Windows\System\QoUUXNs.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\jIkJleG.exe
  C:\Windows\System\jIkJleG.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\CCfmnCM.exe
  C:\Windows\System\CCfmnCM.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\pVPmiNX.exe
  C:\Windows\System\pVPmiNX.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\JDXdvJe.exe
  C:\Windows\System\JDXdvJe.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\jXUdUiD.exe
  C:\Windows\System\jXUdUiD.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\vmJVefC.exe
  C:\Windows\System\vmJVefC.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\AcMUxUQ.exe
  C:\Windows\System\AcMUxUQ.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\oqHQkJS.exe
  C:\Windows\System\oqHQkJS.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\GTzaBju.exe
  C:\Windows\System\GTzaBju.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\xWQMgGC.exe
  C:\Windows\System\xWQMgGC.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\mQLvVJa.exe
  C:\Windows\System\mQLvVJa.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\regVlzu.exe
  C:\Windows\System\regVlzu.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\YrPEggD.exe
  C:\Windows\System\YrPEggD.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\kNaOmVG.exe
  C:\Windows\System\kNaOmVG.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\lUYYyyP.exe
  C:\Windows\System\lUYYyyP.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\FPXVyNQ.exe
  C:\Windows\System\FPXVyNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\TkJBXNt.exe
  C:\Windows\System\TkJBXNt.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\GUSMgdY.exe
  C:\Windows\System\GUSMgdY.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\RjKCCQU.exe
  C:\Windows\System\RjKCCQU.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\yEXXqqu.exe
  C:\Windows\System\yEXXqqu.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\AhtBFDB.exe
  C:\Windows\System\AhtBFDB.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\xkUQZmn.exe
  C:\Windows\System\xkUQZmn.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\jtuCCpF.exe
  C:\Windows\System\jtuCCpF.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\GyQXmBy.exe
  C:\Windows\System\GyQXmBy.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\iUUTclj.exe
  C:\Windows\System\iUUTclj.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\cTjWJlQ.exe
  C:\Windows\System\cTjWJlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\sJdEgPj.exe
  C:\Windows\System\sJdEgPj.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\vuZSYfU.exe
  C:\Windows\System\vuZSYfU.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\QdrduAc.exe
  C:\Windows\System\QdrduAc.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\japezyG.exe
  C:\Windows\System\japezyG.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\jUQgfJC.exe
  C:\Windows\System\jUQgfJC.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\oufrkjf.exe
  C:\Windows\System\oufrkjf.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\IUsvLEU.exe
  C:\Windows\System\IUsvLEU.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\oUdXIft.exe
  C:\Windows\System\oUdXIft.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\OQzlFTS.exe
  C:\Windows\System\OQzlFTS.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\qJKzEit.exe
  C:\Windows\System\qJKzEit.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\FQkBbsq.exe
  C:\Windows\System\FQkBbsq.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\IShyqzx.exe
  C:\Windows\System\IShyqzx.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\vMHFahm.exe
  C:\Windows\System\vMHFahm.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\THpMwLN.exe
  C:\Windows\System\THpMwLN.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\JItYhfT.exe
  C:\Windows\System\JItYhfT.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\MSemECX.exe
  C:\Windows\System\MSemECX.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\qZiREeO.exe
  C:\Windows\System\qZiREeO.exe
  2⤵
  PID:2424
- C:\Windows\System\hncKJoZ.exe
  C:\Windows\System\hncKJoZ.exe
  2⤵
  PID:1184
- C:\Windows\System\jdapCak.exe
  C:\Windows\System\jdapCak.exe
  2⤵
  PID:2512
- C:\Windows\System\GLErmMw.exe
  C:\Windows\System\GLErmMw.exe
  2⤵
  PID:2128
- C:\Windows\System\nRMFxWu.exe
  C:\Windows\System\nRMFxWu.exe
  2⤵
  PID:2388
- C:\Windows\System\BWZfWtk.exe
  C:\Windows\System\BWZfWtk.exe
  2⤵
  PID:560
- C:\Windows\System\oEkgwrY.exe
  C:\Windows\System\oEkgwrY.exe
  2⤵
  PID:2392
- C:\Windows\System\xhDbXVi.exe
  C:\Windows\System\xhDbXVi.exe
  2⤵
  PID:1640
- C:\Windows\System\NGpGyGh.exe
  C:\Windows\System\NGpGyGh.exe
  2⤵
  PID:792
- C:\Windows\System\PWAfYll.exe
  C:\Windows\System\PWAfYll.exe
  2⤵
  PID:1216
- C:\Windows\System\xflmuOK.exe
  C:\Windows\System\xflmuOK.exe
  2⤵
  PID:2820
- C:\Windows\System\cixwjQe.exe
  C:\Windows\System\cixwjQe.exe
  2⤵
  PID:2352
- C:\Windows\System\JGaDzzs.exe
  C:\Windows\System\JGaDzzs.exe
  2⤵
  PID:1740
- C:\Windows\System\fmMyMpl.exe
  C:\Windows\System\fmMyMpl.exe
  2⤵
  PID:1456
- C:\Windows\System\mUEtezQ.exe
  C:\Windows\System\mUEtezQ.exe
  2⤵
  PID:2260
- C:\Windows\System\OQyuZzQ.exe
  C:\Windows\System\OQyuZzQ.exe
  2⤵
  PID:2476
- C:\Windows\System\OJEWAeB.exe
  C:\Windows\System\OJEWAeB.exe
  2⤵
  PID:2916
- C:\Windows\System\iFLBtCz.exe
  C:\Windows\System\iFLBtCz.exe
  2⤵
  PID:2880
- C:\Windows\System\NydfdMC.exe
  C:\Windows\System\NydfdMC.exe
  2⤵
  PID:620
- C:\Windows\System\ykEwRvT.exe
  C:\Windows\System\ykEwRvT.exe
  2⤵
  PID:832
- C:\Windows\System\MydlkOA.exe
  C:\Windows\System\MydlkOA.exe
  2⤵
  PID:1928
- C:\Windows\System\Qntopde.exe
  C:\Windows\System\Qntopde.exe
  2⤵
  PID:2768
- C:\Windows\System\saNGjdU.exe
  C:\Windows\System\saNGjdU.exe
  2⤵
  PID:332
- C:\Windows\System\coEOgcc.exe
  C:\Windows\System\coEOgcc.exe
  2⤵
  PID:1480
- C:\Windows\System\vDzsuOi.exe
  C:\Windows\System\vDzsuOi.exe
  2⤵
  PID:2104
- C:\Windows\System\pveQPxp.exe
  C:\Windows\System\pveQPxp.exe
  2⤵
  PID:1520
- C:\Windows\System\SujWeyM.exe
  C:\Windows\System\SujWeyM.exe
  2⤵
  PID:1156
- C:\Windows\System\UxXMBJs.exe
  C:\Windows\System\UxXMBJs.exe
  2⤵
  PID:2976
- C:\Windows\System\unhHHMN.exe
  C:\Windows\System\unhHHMN.exe
  2⤵
  PID:768
- C:\Windows\System\SSEchlu.exe
  C:\Windows\System\SSEchlu.exe
  2⤵
  PID:2844
- C:\Windows\System\azdJbci.exe
  C:\Windows\System\azdJbci.exe
  2⤵
  PID:2868
- C:\Windows\System\QZqnKFa.exe
  C:\Windows\System\QZqnKFa.exe
  2⤵
  PID:2864
- C:\Windows\System\RduYrUX.exe
  C:\Windows\System\RduYrUX.exe
  2⤵
  PID:2716
- C:\Windows\System\pxdzwJp.exe
  C:\Windows\System\pxdzwJp.exe
  2⤵
  PID:1684
- C:\Windows\System\cICQyDf.exe
  C:\Windows\System\cICQyDf.exe
  2⤵
  PID:2728
- C:\Windows\System\BoWIBjs.exe
  C:\Windows\System\BoWIBjs.exe
  2⤵
  PID:2700
- C:\Windows\System\bSSgJUf.exe
  C:\Windows\System\bSSgJUf.exe
  2⤵
  PID:2152
- C:\Windows\System\jrAteZS.exe
  C:\Windows\System\jrAteZS.exe
  2⤵
  PID:1072
- C:\Windows\System\aofLzMw.exe
  C:\Windows\System\aofLzMw.exe
  2⤵
  PID:2216
- C:\Windows\System\BZknqdR.exe
  C:\Windows\System\BZknqdR.exe
  2⤵
  PID:2620
- C:\Windows\System\xAewkKJ.exe
  C:\Windows\System\xAewkKJ.exe
  2⤵
  PID:2852
- C:\Windows\System\EugoCiM.exe
  C:\Windows\System\EugoCiM.exe
  2⤵
  PID:1336
- C:\Windows\System\OkaYJGJ.exe
  C:\Windows\System\OkaYJGJ.exe
  2⤵
  PID:1128
- C:\Windows\System\oGjcPKD.exe
  C:\Windows\System\oGjcPKD.exe
  2⤵
  PID:2836
- C:\Windows\System\aTskPbw.exe
  C:\Windows\System\aTskPbw.exe
  2⤵
  PID:2656
- C:\Windows\System\etSPtLT.exe
  C:\Windows\System\etSPtLT.exe
  2⤵
  PID:788
- C:\Windows\System\LxyyPVR.exe
  C:\Windows\System\LxyyPVR.exe
  2⤵
  PID:2780
- C:\Windows\System\vQAikNP.exe
  C:\Windows\System\vQAikNP.exe
  2⤵
  PID:2292
- C:\Windows\System\LCCSFEW.exe
  C:\Windows\System\LCCSFEW.exe
  2⤵
  PID:2212
- C:\Windows\System\kvkQnOm.exe
  C:\Windows\System\kvkQnOm.exe
  2⤵
  PID:2704
- C:\Windows\System\WevvWNl.exe
  C:\Windows\System\WevvWNl.exe
  2⤵
  PID:2324
- C:\Windows\System\JyxwkrR.exe
  C:\Windows\System\JyxwkrR.exe
  2⤵
  PID:924
- C:\Windows\System\IOUrlDR.exe
  C:\Windows\System\IOUrlDR.exe
  2⤵
  PID:612
- C:\Windows\System\wxrfrVI.exe
  C:\Windows\System\wxrfrVI.exe
  2⤵
  PID:2928
- C:\Windows\System\ioxEPfb.exe
  C:\Windows\System\ioxEPfb.exe
  2⤵
  PID:1736
- C:\Windows\System\HfRJecp.exe
  C:\Windows\System\HfRJecp.exe
  2⤵
  PID:1760
- C:\Windows\System\NVPHYgH.exe
  C:\Windows\System\NVPHYgH.exe
  2⤵
  PID:2076
- C:\Windows\System\YGiyZPL.exe
  C:\Windows\System\YGiyZPL.exe
  2⤵
  PID:2896
- C:\Windows\System\jWsqkJe.exe
  C:\Windows\System\jWsqkJe.exe
  2⤵
  PID:2228
- C:\Windows\System\jAYIQRV.exe
  C:\Windows\System\jAYIQRV.exe
  2⤵
  PID:676
- C:\Windows\System\aJTzCEN.exe
  C:\Windows\System\aJTzCEN.exe
  2⤵
  PID:1968
- C:\Windows\System\jirXkHX.exe
  C:\Windows\System\jirXkHX.exe
  2⤵
  PID:1168
- C:\Windows\System\VBBMfBj.exe
  C:\Windows\System\VBBMfBj.exe
  2⤵
  PID:2756
- C:\Windows\System\yYpdeBp.exe
  C:\Windows\System\yYpdeBp.exe
  2⤵
  PID:540
- C:\Windows\System\KrXKLvC.exe
  C:\Windows\System\KrXKLvC.exe
  2⤵
  PID:2332
- C:\Windows\System\HAQCWVU.exe
  C:\Windows\System\HAQCWVU.exe
  2⤵
  PID:1732
- C:\Windows\System\PEgzWPE.exe
  C:\Windows\System\PEgzWPE.exe
  2⤵
  PID:1564
- C:\Windows\System\XviurqW.exe
  C:\Windows\System\XviurqW.exe
  2⤵
  PID:600
- C:\Windows\System\kOXdYUR.exe
  C:\Windows\System\kOXdYUR.exe
  2⤵
  PID:2804
- C:\Windows\System\KzRDjWK.exe
  C:\Windows\System\KzRDjWK.exe
  2⤵
  PID:2856
- C:\Windows\System\BOnxXaV.exe
  C:\Windows\System\BOnxXaV.exe
  2⤵
  PID:1820
- C:\Windows\System\JUErDDY.exe
  C:\Windows\System\JUErDDY.exe
  2⤵
  PID:2136
- C:\Windows\System\fJigPfn.exe
  C:\Windows\System\fJigPfn.exe
  2⤵
  PID:2708
- C:\Windows\System\AnKFHeR.exe
  C:\Windows\System\AnKFHeR.exe
  2⤵
  PID:2600
- C:\Windows\System\RardWGs.exe
  C:\Windows\System\RardWGs.exe
  2⤵
  PID:1340
- C:\Windows\System\preUjbw.exe
  C:\Windows\System\preUjbw.exe
  2⤵
  PID:1412
- C:\Windows\System\lyQTOsP.exe
  C:\Windows\System\lyQTOsP.exe
  2⤵
  PID:1148
- C:\Windows\System\ZzmemKg.exe
  C:\Windows\System\ZzmemKg.exe
  2⤵
  PID:2524
- C:\Windows\System\PykRhFV.exe
  C:\Windows\System\PykRhFV.exe
  2⤵
  PID:2720
- C:\Windows\System\wNtePLG.exe
  C:\Windows\System\wNtePLG.exe
  2⤵
  PID:1120
- C:\Windows\System\oSfpqZk.exe
  C:\Windows\System\oSfpqZk.exe
  2⤵
  PID:1892
- C:\Windows\System\vHNxCne.exe
  C:\Windows\System\vHNxCne.exe
  2⤵
  PID:2096
- C:\Windows\System\nxwQPDY.exe
  C:\Windows\System\nxwQPDY.exe
  2⤵
  PID:1988
- C:\Windows\System\sxfGrlC.exe
  C:\Windows\System\sxfGrlC.exe
  2⤵
  PID:3024
- C:\Windows\System\oQBoCAs.exe
  C:\Windows\System\oQBoCAs.exe
  2⤵
  PID:1632
- C:\Windows\System\sXvSOoW.exe
  C:\Windows\System\sXvSOoW.exe
  2⤵
  PID:2080
- C:\Windows\System\UhXWLPd.exe
  C:\Windows\System\UhXWLPd.exe
  2⤵
  PID:1472
- C:\Windows\System\YAkDUft.exe
  C:\Windows\System\YAkDUft.exe
  2⤵
  PID:2348
- C:\Windows\System\VfHFbqw.exe
  C:\Windows\System\VfHFbqw.exe
  2⤵
  PID:820
- C:\Windows\System\yXzbsLZ.exe
  C:\Windows\System\yXzbsLZ.exe
  2⤵
  PID:1904
- C:\Windows\System\DIoSXUG.exe
  C:\Windows\System\DIoSXUG.exe
  2⤵
  PID:1164
- C:\Windows\System\teiSaPc.exe
  C:\Windows\System\teiSaPc.exe
  2⤵
  PID:1704
- C:\Windows\System\CBlPylQ.exe
  C:\Windows\System\CBlPylQ.exe
  2⤵
  PID:2156
- C:\Windows\System\cvuCcBo.exe
  C:\Windows\System\cvuCcBo.exe
  2⤵
  PID:2376
- C:\Windows\System\ekbnuLu.exe
  C:\Windows\System\ekbnuLu.exe
  2⤵
  PID:576
- C:\Windows\System\FTWBrkR.exe
  C:\Windows\System\FTWBrkR.exe
  2⤵
  PID:2024
- C:\Windows\System\JHtiKvb.exe
  C:\Windows\System\JHtiKvb.exe
  2⤵
  PID:2444
- C:\Windows\System\gjcZfwJ.exe
  C:\Windows\System\gjcZfwJ.exe
  2⤵
  PID:1016
- C:\Windows\System\ZJEJICM.exe
  C:\Windows\System\ZJEJICM.exe
  2⤵
  PID:2408
- C:\Windows\System\yoLweft.exe
  C:\Windows\System\yoLweft.exe
  2⤵
  PID:1680
- C:\Windows\System\DTaowTA.exe
  C:\Windows\System\DTaowTA.exe
  2⤵
  PID:684
- C:\Windows\System\vcumfMD.exe
  C:\Windows\System\vcumfMD.exe
  2⤵
  PID:1944
- C:\Windows\System\oWevNHe.exe
  C:\Windows\System\oWevNHe.exe
  2⤵
  PID:1624
- C:\Windows\System\GeEVovD.exe
  C:\Windows\System\GeEVovD.exe
  2⤵
  PID:1748
- C:\Windows\System\ACQxIrl.exe
  C:\Windows\System\ACQxIrl.exe
  2⤵
  PID:1300
- C:\Windows\System\MnvWtba.exe
  C:\Windows\System\MnvWtba.exe
  2⤵
  PID:1508
- C:\Windows\System\RPtkZHx.exe
  C:\Windows\System\RPtkZHx.exe
  2⤵
  PID:1744
- C:\Windows\System\rdkmqsp.exe
  C:\Windows\System\rdkmqsp.exe
  2⤵
  PID:2764
- C:\Windows\System\bNdyfTQ.exe
  C:\Windows\System\bNdyfTQ.exe
  2⤵
  PID:1592
- C:\Windows\System\SEJSCTX.exe
  C:\Windows\System\SEJSCTX.exe
  2⤵
  PID:1908
- C:\Windows\System\fkZmIQZ.exe
  C:\Windows\System\fkZmIQZ.exe
  2⤵
  PID:1540
- C:\Windows\System\URMVCxz.exe
  C:\Windows\System\URMVCxz.exe
  2⤵
  PID:1608
- C:\Windows\System\NTvGwMd.exe
  C:\Windows\System\NTvGwMd.exe
  2⤵
  PID:1800
- C:\Windows\System\rzeXqdt.exe
  C:\Windows\System\rzeXqdt.exe
  2⤵
  PID:2264
- C:\Windows\System\AmhZqCb.exe
  C:\Windows\System\AmhZqCb.exe
  2⤵
  PID:3044
- C:\Windows\System\jHbXura.exe
  C:\Windows\System\jHbXura.exe
  2⤵
  PID:1916
- C:\Windows\System\yECGzFb.exe
  C:\Windows\System\yECGzFb.exe
  2⤵
  PID:2072
- C:\Windows\System\cdfOMhc.exe
  C:\Windows\System\cdfOMhc.exe
  2⤵
  PID:1048
- C:\Windows\System\FmfqiBZ.exe
  C:\Windows\System\FmfqiBZ.exe
  2⤵
  PID:2428
- C:\Windows\System\fiosoVn.exe
  C:\Windows\System\fiosoVn.exe
  2⤵
  PID:1500
- C:\Windows\System\ZfrGgDO.exe
  C:\Windows\System\ZfrGgDO.exe
  2⤵
  PID:2812
- C:\Windows\System\UNtplZx.exe
  C:\Windows\System\UNtplZx.exe
  2⤵
  PID:2576
- C:\Windows\System\urDmtHi.exe
  C:\Windows\System\urDmtHi.exe
  2⤵
  PID:3080
- C:\Windows\System\WzbFoiH.exe
  C:\Windows\System\WzbFoiH.exe
  2⤵
  PID:3096
- C:\Windows\System\WAXFmYj.exe
  C:\Windows\System\WAXFmYj.exe
  2⤵
  PID:3112
- C:\Windows\System\bSllljK.exe
  C:\Windows\System\bSllljK.exe
  2⤵
  PID:3128
- C:\Windows\System\ICeuDiq.exe
  C:\Windows\System\ICeuDiq.exe
  2⤵
  PID:3144
- C:\Windows\System\xNzILFb.exe
  C:\Windows\System\xNzILFb.exe
  2⤵
  PID:3160
- C:\Windows\System\FqlejPl.exe
  C:\Windows\System\FqlejPl.exe
  2⤵
  PID:3180
- C:\Windows\System\HbWjWKs.exe
  C:\Windows\System\HbWjWKs.exe
  2⤵
  PID:3224
- C:\Windows\System\CKBJFQN.exe
  C:\Windows\System\CKBJFQN.exe
  2⤵
  PID:3240
- C:\Windows\System\YfWzgoa.exe
  C:\Windows\System\YfWzgoa.exe
  2⤵
  PID:3256
- C:\Windows\System\TjJNvAM.exe
  C:\Windows\System\TjJNvAM.exe
  2⤵
  PID:3272
- C:\Windows\System\DExpKjW.exe
  C:\Windows\System\DExpKjW.exe
  2⤵
  PID:3312
- C:\Windows\System\pyaRswo.exe
  C:\Windows\System\pyaRswo.exe
  2⤵
  PID:3328
- C:\Windows\System\fmoUnbu.exe
  C:\Windows\System\fmoUnbu.exe
  2⤵
  PID:3352
- C:\Windows\System\BKfkxQo.exe
  C:\Windows\System\BKfkxQo.exe
  2⤵
  PID:3368
- C:\Windows\System\jwrorwW.exe
  C:\Windows\System\jwrorwW.exe
  2⤵
  PID:3396
- C:\Windows\System\HsrxGfP.exe
  C:\Windows\System\HsrxGfP.exe
  2⤵
  PID:3424
- C:\Windows\System\KkWBdNj.exe
  C:\Windows\System\KkWBdNj.exe
  2⤵
  PID:3440
- C:\Windows\System\DNczkGz.exe
  C:\Windows\System\DNczkGz.exe
  2⤵
  PID:3460
- C:\Windows\System\jxikWKF.exe
  C:\Windows\System\jxikWKF.exe
  2⤵
  PID:3476
- C:\Windows\System\UeZLuOl.exe
  C:\Windows\System\UeZLuOl.exe
  2⤵
  PID:3496
- C:\Windows\System\QiOdJUc.exe
  C:\Windows\System\QiOdJUc.exe
  2⤵
  PID:3512
- C:\Windows\System\uErGanK.exe
  C:\Windows\System\uErGanK.exe
  2⤵
  PID:3528
- C:\Windows\System\bxWlyBx.exe
  C:\Windows\System\bxWlyBx.exe
  2⤵
  PID:3544
- C:\Windows\System\aTNUxTO.exe
  C:\Windows\System\aTNUxTO.exe
  2⤵
  PID:3564
- C:\Windows\System\aXmzqPm.exe
  C:\Windows\System\aXmzqPm.exe
  2⤵
  PID:3580
- C:\Windows\System\tptLkvW.exe
  C:\Windows\System\tptLkvW.exe
  2⤵
  PID:3596
- C:\Windows\System\wcmVjaB.exe
  C:\Windows\System\wcmVjaB.exe
  2⤵
  PID:3616
- C:\Windows\System\gplcgsM.exe
  C:\Windows\System\gplcgsM.exe
  2⤵
  PID:3632
- C:\Windows\System\doqbsDK.exe
  C:\Windows\System\doqbsDK.exe
  2⤵
  PID:3648
- C:\Windows\System\mIzvatV.exe
  C:\Windows\System\mIzvatV.exe
  2⤵
  PID:3664
- C:\Windows\System\VHfaoCS.exe
  C:\Windows\System\VHfaoCS.exe
  2⤵
  PID:3684
- C:\Windows\System\dZUPjqV.exe
  C:\Windows\System\dZUPjqV.exe
  2⤵
  PID:3704
- C:\Windows\System\pwuSErw.exe
  C:\Windows\System\pwuSErw.exe
  2⤵
  PID:3720
- C:\Windows\System\vDkcoID.exe
  C:\Windows\System\vDkcoID.exe
  2⤵
  PID:3792
- C:\Windows\System\ilsvQEJ.exe
  C:\Windows\System\ilsvQEJ.exe
  2⤵
  PID:3808
- C:\Windows\System\xnCSqGY.exe
  C:\Windows\System\xnCSqGY.exe
  2⤵
  PID:3824
- C:\Windows\System\zXJwMwm.exe
  C:\Windows\System\zXJwMwm.exe
  2⤵
  PID:3840
- C:\Windows\System\QftqHkB.exe
  C:\Windows\System\QftqHkB.exe
  2⤵
  PID:3856
- C:\Windows\System\YgqvJsK.exe
  C:\Windows\System\YgqvJsK.exe
  2⤵
  PID:3872
- C:\Windows\System\UksRVSt.exe
  C:\Windows\System\UksRVSt.exe
  2⤵
  PID:3892
- C:\Windows\System\HddjtuN.exe
  C:\Windows\System\HddjtuN.exe
  2⤵
  PID:3908
- C:\Windows\System\AfJEjQl.exe
  C:\Windows\System\AfJEjQl.exe
  2⤵
  PID:3924
- C:\Windows\System\oXpNuyv.exe
  C:\Windows\System\oXpNuyv.exe
  2⤵
  PID:3940
- C:\Windows\System\OgBWBpn.exe
  C:\Windows\System\OgBWBpn.exe
  2⤵
  PID:3956
- C:\Windows\System\JRHwqhy.exe
  C:\Windows\System\JRHwqhy.exe
  2⤵
  PID:3976
- C:\Windows\System\gthQKjf.exe
  C:\Windows\System\gthQKjf.exe
  2⤵
  PID:4024
- C:\Windows\System\RiBtIJV.exe
  C:\Windows\System\RiBtIJV.exe
  2⤵
  PID:4044
- C:\Windows\System\mpOMsFC.exe
  C:\Windows\System\mpOMsFC.exe
  2⤵
  PID:4060
- C:\Windows\System\CNtHqFS.exe
  C:\Windows\System\CNtHqFS.exe
  2⤵
  PID:4076
- C:\Windows\System\ZmkovcQ.exe
  C:\Windows\System\ZmkovcQ.exe
  2⤵
  PID:2652
- C:\Windows\System\ipcbRji.exe
  C:\Windows\System\ipcbRji.exe
  2⤵
  PID:2124
- C:\Windows\System\UYEdiTw.exe
  C:\Windows\System\UYEdiTw.exe
  2⤵
  PID:3120
- C:\Windows\System\PEXNYTQ.exe
  C:\Windows\System\PEXNYTQ.exe
  2⤵
  PID:3196
- C:\Windows\System\vCqQVHq.exe
  C:\Windows\System\vCqQVHq.exe
  2⤵
  PID:3216
- C:\Windows\System\jqeZkqB.exe
  C:\Windows\System\jqeZkqB.exe
  2⤵
  PID:3076
- C:\Windows\System\ZOBIxdF.exe
  C:\Windows\System\ZOBIxdF.exe
  2⤵
  PID:2360
- C:\Windows\System\VWVhiWS.exe
  C:\Windows\System\VWVhiWS.exe
  2⤵
  PID:3140
- C:\Windows\System\aJqVZRn.exe
  C:\Windows\System\aJqVZRn.exe
  2⤵
  PID:3192
- C:\Windows\System\nXUrrhy.exe
  C:\Windows\System\nXUrrhy.exe
  2⤵
  PID:3340
- C:\Windows\System\bsODeVd.exe
  C:\Windows\System\bsODeVd.exe
  2⤵
  PID:3380
- C:\Windows\System\lPSuavc.exe
  C:\Windows\System\lPSuavc.exe
  2⤵
  PID:3268
- C:\Windows\System\MGEoieN.exe
  C:\Windows\System\MGEoieN.exe
  2⤵
  PID:3324
- C:\Windows\System\ucKQthA.exe
  C:\Windows\System\ucKQthA.exe
  2⤵
  PID:3420
- C:\Windows\System\QkInWCs.exe
  C:\Windows\System\QkInWCs.exe
  2⤵
  PID:3436
- C:\Windows\System\scQMluD.exe
  C:\Windows\System\scQMluD.exe
  2⤵
  PID:3484
- C:\Windows\System\UflHOZr.exe
  C:\Windows\System\UflHOZr.exe
  2⤵
  PID:3608
- C:\Windows\System\yrLAExd.exe
  C:\Windows\System\yrLAExd.exe
  2⤵
  PID:3576
- C:\Windows\System\LpXeorI.exe
  C:\Windows\System\LpXeorI.exe
  2⤵
  PID:3672
- C:\Windows\System\uabGYeO.exe
  C:\Windows\System\uabGYeO.exe
  2⤵
  PID:3592
- C:\Windows\System\MqnPpqz.exe
  C:\Windows\System\MqnPpqz.exe
  2⤵
  PID:3740
- C:\Windows\System\ImTryVR.exe
  C:\Windows\System\ImTryVR.exe
  2⤵
  PID:3764
- C:\Windows\System\ZnoQYPr.exe
  C:\Windows\System\ZnoQYPr.exe
  2⤵
  PID:3772
- C:\Windows\System\chCeQdR.exe
  C:\Windows\System\chCeQdR.exe
  2⤵
  PID:3776
- C:\Windows\System\nCZFhNg.exe
  C:\Windows\System\nCZFhNg.exe
  2⤵
  PID:3864
- C:\Windows\System\DDOueyZ.exe
  C:\Windows\System\DDOueyZ.exe
  2⤵
  PID:3900
- C:\Windows\System\NLpqKGe.exe
  C:\Windows\System\NLpqKGe.exe
  2⤵
  PID:3968
- C:\Windows\System\LHilisG.exe
  C:\Windows\System\LHilisG.exe
  2⤵
  PID:3816
- C:\Windows\System\GXRCaTg.exe
  C:\Windows\System\GXRCaTg.exe
  2⤵
  PID:3984
- C:\Windows\System\LreKCKf.exe
  C:\Windows\System\LreKCKf.exe
  2⤵
  PID:4000
- C:\Windows\System\jxmMhVP.exe
  C:\Windows\System\jxmMhVP.exe
  2⤵
  PID:4032
- C:\Windows\System\afwwBed.exe
  C:\Windows\System\afwwBed.exe
  2⤵
  PID:3952
- C:\Windows\System\SsbQtdz.exe
  C:\Windows\System\SsbQtdz.exe
  2⤵
  PID:4084
- C:\Windows\System\IspsLVJ.exe
  C:\Windows\System\IspsLVJ.exe
  2⤵
  PID:3288
- C:\Windows\System\UKrCpaP.exe
  C:\Windows\System\UKrCpaP.exe
  2⤵
  PID:3296
- C:\Windows\System\ddWBnaH.exe
  C:\Windows\System\ddWBnaH.exe
  2⤵
  PID:2016
- C:\Windows\System\sELdDzi.exe
  C:\Windows\System\sELdDzi.exe
  2⤵
  PID:3392
- C:\Windows\System\ElySLwB.exe
  C:\Windows\System\ElySLwB.exe
  2⤵
  PID:3468
- C:\Windows\System\gAZEOgg.exe
  C:\Windows\System\gAZEOgg.exe
  2⤵
  PID:3712
- C:\Windows\System\LCCCLAu.exe
  C:\Windows\System\LCCCLAu.exe
  2⤵
  PID:3376
- C:\Windows\System\DSeuFfj.exe
  C:\Windows\System\DSeuFfj.exe
  2⤵
  PID:3092
- C:\Windows\System\bChLvLD.exe
  C:\Windows\System\bChLvLD.exe
  2⤵
  PID:3360
- C:\Windows\System\sjYQToF.exe
  C:\Windows\System\sjYQToF.exe
  2⤵
  PID:3452
- C:\Windows\System\oHzADsx.exe
  C:\Windows\System\oHzADsx.exe
  2⤵
  PID:3736
- C:\Windows\System\vlFkjPN.exe
  C:\Windows\System\vlFkjPN.exe
  2⤵
  PID:3660
- C:\Windows\System\Bhylsin.exe
  C:\Windows\System\Bhylsin.exe
  2⤵
  PID:3552
- C:\Windows\System\ewLPwyx.exe
  C:\Windows\System\ewLPwyx.exe
  2⤵
  PID:3728
- C:\Windows\System\KPzXEvK.exe
  C:\Windows\System\KPzXEvK.exe
  2⤵
  PID:1556
- C:\Windows\System\tPeUFnO.exe
  C:\Windows\System\tPeUFnO.exe
  2⤵
  PID:3784
- C:\Windows\System\jRvdWup.exe
  C:\Windows\System\jRvdWup.exe
  2⤵
  PID:3964
- C:\Windows\System\UqmbAQV.exe
  C:\Windows\System\UqmbAQV.exe
  2⤵
  PID:3732
- C:\Windows\System\jnmbxmL.exe
  C:\Windows\System\jnmbxmL.exe
  2⤵
  PID:3156
- C:\Windows\System\uIKZagu.exe
  C:\Windows\System\uIKZagu.exe
  2⤵
  PID:3888
- C:\Windows\System\HVeWLqf.exe
  C:\Windows\System\HVeWLqf.exe
  2⤵
  PID:4072
- C:\Windows\System\dPuhWYX.exe
  C:\Windows\System\dPuhWYX.exe
  2⤵
  PID:2872
- C:\Windows\System\jHQTJxT.exe
  C:\Windows\System\jHQTJxT.exe
  2⤵
  PID:3284
- C:\Windows\System\zWWEmxb.exe
  C:\Windows\System\zWWEmxb.exe
  2⤵
  PID:3308
- C:\Windows\System\UGkbPnN.exe
  C:\Windows\System\UGkbPnN.exe
  2⤵
  PID:3852
- C:\Windows\System\UQFemKe.exe
  C:\Windows\System\UQFemKe.exe
  2⤵
  PID:3344
- C:\Windows\System\NUJOcwJ.exe
  C:\Windows\System\NUJOcwJ.exe
  2⤵
  PID:3188
- C:\Windows\System\DlUBhKE.exe
  C:\Windows\System\DlUBhKE.exe
  2⤵
  PID:3236
- C:\Windows\System\oJhfToI.exe
  C:\Windows\System\oJhfToI.exe
  2⤵
  PID:3540
- C:\Windows\System\FxfnMkQ.exe
  C:\Windows\System\FxfnMkQ.exe
  2⤵
  PID:3108
- C:\Windows\System\kGzlZSe.exe
  C:\Windows\System\kGzlZSe.exe
  2⤵
  PID:3208
- C:\Windows\System\qOKCPiB.exe
  C:\Windows\System\qOKCPiB.exe
  2⤵
  PID:3992
- C:\Windows\System\lvYOhJj.exe
  C:\Windows\System\lvYOhJj.exe
  2⤵
  PID:3880
- C:\Windows\System\ocsuRNB.exe
  C:\Windows\System\ocsuRNB.exe
  2⤵
  PID:3848
- C:\Windows\System\DvkdiGl.exe
  C:\Windows\System\DvkdiGl.exe
  2⤵
  PID:3756
- C:\Windows\System\JuQIfiF.exe
  C:\Windows\System\JuQIfiF.exe
  2⤵
  PID:3768
- C:\Windows\System\lEtAerh.exe
  C:\Windows\System\lEtAerh.exe
  2⤵
  PID:3176
- C:\Windows\System\XwNKUBE.exe
  C:\Windows\System\XwNKUBE.exe
  2⤵
  PID:4052
- C:\Windows\System\OSXdgMp.exe
  C:\Windows\System\OSXdgMp.exe
  2⤵
  PID:3624
- C:\Windows\System\gApYmGf.exe
  C:\Windows\System\gApYmGf.exe
  2⤵
  PID:3868
- C:\Windows\System\WutCLkf.exe
  C:\Windows\System\WutCLkf.exe
  2⤵
  PID:3220
- C:\Windows\System\IgxeDZk.exe
  C:\Windows\System\IgxeDZk.exe
  2⤵
  PID:4120
- C:\Windows\System\FfuZHDP.exe
  C:\Windows\System\FfuZHDP.exe
  2⤵
  PID:4140
- C:\Windows\System\vKqvhkZ.exe
  C:\Windows\System\vKqvhkZ.exe
  2⤵
  PID:4156
- C:\Windows\System\ReeopBc.exe
  C:\Windows\System\ReeopBc.exe
  2⤵
  PID:4172
- C:\Windows\System\vTswamB.exe
  C:\Windows\System\vTswamB.exe
  2⤵
  PID:4188
- C:\Windows\System\SlUVLGv.exe
  C:\Windows\System\SlUVLGv.exe
  2⤵
  PID:4208
- C:\Windows\System\zJySKvi.exe
  C:\Windows\System\zJySKvi.exe
  2⤵
  PID:4224
- C:\Windows\System\NlvWxOG.exe
  C:\Windows\System\NlvWxOG.exe
  2⤵
  PID:4240
- C:\Windows\System\KGNFDqA.exe
  C:\Windows\System\KGNFDqA.exe
  2⤵
  PID:4256
- C:\Windows\System\xdyxMsR.exe
  C:\Windows\System\xdyxMsR.exe
  2⤵
  PID:4272
- C:\Windows\System\avuHNoz.exe
  C:\Windows\System\avuHNoz.exe
  2⤵
  PID:4296
- C:\Windows\System\sEHEuhP.exe
  C:\Windows\System\sEHEuhP.exe
  2⤵
  PID:4312
- C:\Windows\System\bjimzIt.exe
  C:\Windows\System\bjimzIt.exe
  2⤵
  PID:4328
- C:\Windows\System\hsrMlha.exe
  C:\Windows\System\hsrMlha.exe
  2⤵
  PID:4344
- C:\Windows\System\JtsBUDA.exe
  C:\Windows\System\JtsBUDA.exe
  2⤵
  PID:4364
- C:\Windows\System\jrIgXhD.exe
  C:\Windows\System\jrIgXhD.exe
  2⤵
  PID:4380
- C:\Windows\System\UJOeyCb.exe
  C:\Windows\System\UJOeyCb.exe
  2⤵
  PID:4400
- C:\Windows\System\QbTpmGp.exe
  C:\Windows\System\QbTpmGp.exe
  2⤵
  PID:4416
- C:\Windows\System\uyUGLyj.exe
  C:\Windows\System\uyUGLyj.exe
  2⤵
  PID:4432
- C:\Windows\System\oSHEYOJ.exe
  C:\Windows\System\oSHEYOJ.exe
  2⤵
  PID:4448
- C:\Windows\System\UlsYIhe.exe
  C:\Windows\System\UlsYIhe.exe
  2⤵
  PID:4464
- C:\Windows\System\mbKuiKu.exe
  C:\Windows\System\mbKuiKu.exe
  2⤵
  PID:4480
- C:\Windows\System\nSEEbSg.exe
  C:\Windows\System\nSEEbSg.exe
  2⤵
  PID:4496
- C:\Windows\System\NtKGKnM.exe
  C:\Windows\System\NtKGKnM.exe
  2⤵
  PID:4536
- C:\Windows\System\bfZQqeH.exe
  C:\Windows\System\bfZQqeH.exe
  2⤵
  PID:4556
- C:\Windows\System\oroNwiG.exe
  C:\Windows\System\oroNwiG.exe
  2⤵
  PID:4572
- C:\Windows\System\dsAKezx.exe
  C:\Windows\System\dsAKezx.exe
  2⤵
  PID:4592
- C:\Windows\System\edMWKEm.exe
  C:\Windows\System\edMWKEm.exe
  2⤵
  PID:4608
- C:\Windows\System\DPkRmrA.exe
  C:\Windows\System\DPkRmrA.exe
  2⤵
  PID:4628
- C:\Windows\System\UybvKLA.exe
  C:\Windows\System\UybvKLA.exe
  2⤵
  PID:4644
- C:\Windows\System\cpjZDom.exe
  C:\Windows\System\cpjZDom.exe
  2⤵
  PID:4660
- C:\Windows\System\aFdkQQP.exe
  C:\Windows\System\aFdkQQP.exe
  2⤵
  PID:4676
- C:\Windows\System\vxAWzoi.exe
  C:\Windows\System\vxAWzoi.exe
  2⤵
  PID:4692
- C:\Windows\System\YpjhOaP.exe
  C:\Windows\System\YpjhOaP.exe
  2⤵
  PID:4708
- C:\Windows\System\QgXWdxb.exe
  C:\Windows\System\QgXWdxb.exe
  2⤵
  PID:4724
- C:\Windows\System\bezMzLN.exe
  C:\Windows\System\bezMzLN.exe
  2⤵
  PID:4748
- C:\Windows\System\rUgwkbd.exe
  C:\Windows\System\rUgwkbd.exe
  2⤵
  PID:4768
- C:\Windows\System\VTobCGC.exe
  C:\Windows\System\VTobCGC.exe
  2⤵
  PID:4784
- C:\Windows\System\SWCEzcb.exe
  C:\Windows\System\SWCEzcb.exe
  2⤵
  PID:4800
- C:\Windows\System\gmbCZLf.exe
  C:\Windows\System\gmbCZLf.exe
  2⤵
  PID:4816
- C:\Windows\System\qDeDshQ.exe
  C:\Windows\System\qDeDshQ.exe
  2⤵
  PID:4836
- C:\Windows\System\obuKxgk.exe
  C:\Windows\System\obuKxgk.exe
  2⤵
  PID:4852
- C:\Windows\System\htfiGEK.exe
  C:\Windows\System\htfiGEK.exe
  2⤵
  PID:4868
- C:\Windows\System\nYNgBAN.exe
  C:\Windows\System\nYNgBAN.exe
  2⤵
  PID:4884
- C:\Windows\System\LUcezDl.exe
  C:\Windows\System\LUcezDl.exe
  2⤵
  PID:4904
- C:\Windows\System\rDDpvWL.exe
  C:\Windows\System\rDDpvWL.exe
  2⤵
  PID:4928
- C:\Windows\System\gcGgrMW.exe
  C:\Windows\System\gcGgrMW.exe
  2⤵
  PID:4948
- C:\Windows\System\UTYbCjW.exe
  C:\Windows\System\UTYbCjW.exe
  2⤵
  PID:4972
- C:\Windows\System\tMuZRqU.exe
  C:\Windows\System\tMuZRqU.exe
  2⤵
  PID:4992
- C:\Windows\System\nNVBJlp.exe
  C:\Windows\System\nNVBJlp.exe
  2⤵
  PID:5008
- C:\Windows\System\liPBeUM.exe
  C:\Windows\System\liPBeUM.exe
  2⤵
  PID:5024
- C:\Windows\System\sEItJBY.exe
  C:\Windows\System\sEItJBY.exe
  2⤵
  PID:5040
- C:\Windows\System\hZxHWUW.exe
  C:\Windows\System\hZxHWUW.exe
  2⤵
  PID:5056
- C:\Windows\System\hVxGYio.exe
  C:\Windows\System\hVxGYio.exe
  2⤵
  PID:5072
- C:\Windows\System\zyjdOFW.exe
  C:\Windows\System\zyjdOFW.exe
  2⤵
  PID:5088
- C:\Windows\System\QCtALrP.exe
  C:\Windows\System\QCtALrP.exe
  2⤵
  PID:5104
- C:\Windows\System\rfZJehN.exe
  C:\Windows\System\rfZJehN.exe
  2⤵
  PID:4136
- C:\Windows\System\hBQlvmD.exe
  C:\Windows\System\hBQlvmD.exe
  2⤵
  PID:4168
- C:\Windows\System\ePsGmXk.exe
  C:\Windows\System\ePsGmXk.exe
  2⤵
  PID:4280
- C:\Windows\System\AFfiUmi.exe
  C:\Windows\System\AFfiUmi.exe
  2⤵
  PID:4236
- C:\Windows\System\Pmrxmmg.exe
  C:\Windows\System\Pmrxmmg.exe
  2⤵
  PID:4268
- C:\Windows\System\XOaLQdW.exe
  C:\Windows\System\XOaLQdW.exe
  2⤵
  PID:4304
- C:\Windows\System\nbXLnYo.exe
  C:\Windows\System\nbXLnYo.exe
  2⤵
  PID:4340
- C:\Windows\System\VBbcByT.exe
  C:\Windows\System\VBbcByT.exe
  2⤵
  PID:4396
- C:\Windows\System\pNFbOMu.exe
  C:\Windows\System\pNFbOMu.exe
  2⤵
  PID:4636
- C:\Windows\System\uvxoEEm.exe
  C:\Windows\System\uvxoEEm.exe
  2⤵
  PID:4684
- C:\Windows\System\tgEBXNF.exe
  C:\Windows\System\tgEBXNF.exe
  2⤵
  PID:4716
- C:\Windows\System\eeFvEjs.exe
  C:\Windows\System\eeFvEjs.exe
  2⤵
  PID:4704
- C:\Windows\System\vyKNtIc.exe
  C:\Windows\System\vyKNtIc.exe
  2⤵
  PID:4764
- C:\Windows\System\IYCEwoJ.exe
  C:\Windows\System\IYCEwoJ.exe
  2⤵
  PID:5068
- C:\Windows\System\cmRwpGn.exe
  C:\Windows\System\cmRwpGn.exe
  2⤵
  PID:5020
- C:\Windows\System\IcLWDft.exe
  C:\Windows\System\IcLWDft.exe
  2⤵
  PID:5048
- C:\Windows\System\dPwRUle.exe
  C:\Windows\System\dPwRUle.exe
  2⤵
  PID:3448
- C:\Windows\System\VEfhEvd.exe
  C:\Windows\System\VEfhEvd.exe
  2⤵
  PID:3348
- C:\Windows\System\EKthOxu.exe
  C:\Windows\System\EKthOxu.exe
  2⤵
  PID:4292
- C:\Windows\System\UVBEyul.exe
  C:\Windows\System\UVBEyul.exe
  2⤵
  PID:4388
- C:\Windows\System\eeXlmZA.exe
  C:\Windows\System\eeXlmZA.exe
  2⤵
  PID:4200
- C:\Windows\System\UwUDUYO.exe
  C:\Windows\System\UwUDUYO.exe
  2⤵
  PID:4640
- C:\Windows\System\tixRNGB.exe
  C:\Windows\System\tixRNGB.exe
  2⤵
  PID:4524
- C:\Windows\System\SQStOzv.exe
  C:\Windows\System\SQStOzv.exe
  2⤵
  PID:4444
- C:\Windows\System\DsHvYie.exe
  C:\Windows\System\DsHvYie.exe
  2⤵
  PID:4824
- C:\Windows\System\avKuQxu.exe
  C:\Windows\System\avKuQxu.exe
  2⤵
  PID:4544
- C:\Windows\System\fdMRPcI.exe
  C:\Windows\System\fdMRPcI.exe
  2⤵
  PID:4528
- C:\Windows\System\HPwyKbf.exe
  C:\Windows\System\HPwyKbf.exe
  2⤵
  PID:4620
- C:\Windows\System\XNkEvlb.exe
  C:\Windows\System\XNkEvlb.exe
  2⤵
  PID:4688
- C:\Windows\System\OYExxBq.exe
  C:\Windows\System\OYExxBq.exe
  2⤵
  PID:4860
- C:\Windows\System\aXAxQDm.exe
  C:\Windows\System\aXAxQDm.exe
  2⤵
  PID:4864
- C:\Windows\System\aGDqHZp.exe
  C:\Windows\System\aGDqHZp.exe
  2⤵
  PID:4880
- C:\Windows\System\vWklccb.exe
  C:\Windows\System\vWklccb.exe
  2⤵
  PID:4924
- C:\Windows\System\lxJlNSq.exe
  C:\Windows\System\lxJlNSq.exe
  2⤵
  PID:4964
- C:\Windows\System\CGWlbKa.exe
  C:\Windows\System\CGWlbKa.exe
  2⤵
  PID:4944
- C:\Windows\System\KwJniBb.exe
  C:\Windows\System\KwJniBb.exe
  2⤵
  PID:4360
- C:\Windows\System\XHRyrSU.exe
  C:\Windows\System\XHRyrSU.exe
  2⤵
  PID:4656
- C:\Windows\System\FXJOWSM.exe
  C:\Windows\System\FXJOWSM.exe
  2⤵
  PID:4440
- C:\Windows\System\moedfnJ.exe
  C:\Windows\System\moedfnJ.exe
  2⤵
  PID:4180
- C:\Windows\System\sihymPq.exe
  C:\Windows\System\sihymPq.exe
  2⤵
  PID:4776
- C:\Windows\System\qEMKxGV.exe
  C:\Windows\System\qEMKxGV.exe
  2⤵
  PID:4848
- C:\Windows\System\bStWRhH.exe
  C:\Windows\System\bStWRhH.exe
  2⤵
  PID:3304
- C:\Windows\System\ccJbxJz.exe
  C:\Windows\System\ccJbxJz.exe
  2⤵
  PID:4732
- C:\Windows\System\TnXIbxw.exe
  C:\Windows\System\TnXIbxw.exe
  2⤵
  PID:4588
- C:\Windows\System\niABXVa.exe
  C:\Windows\System\niABXVa.exe
  2⤵
  PID:4672
- C:\Windows\System\FIWiZEZ.exe
  C:\Windows\System\FIWiZEZ.exe
  2⤵
  PID:4940
- C:\Windows\System\IpslkeA.exe
  C:\Windows\System\IpslkeA.exe
  2⤵
  PID:4216
- C:\Windows\System\ZLPVqrA.exe
  C:\Windows\System\ZLPVqrA.exe
  2⤵
  PID:5100
- C:\Windows\System\NFvFWFu.exe
  C:\Windows\System\NFvFWFu.exe
  2⤵
  PID:4428
- C:\Windows\System\ndxJBMb.exe
  C:\Windows\System\ndxJBMb.exe
  2⤵
  PID:5116
- C:\Windows\System\WktVgng.exe
  C:\Windows\System\WktVgng.exe
  2⤵
  PID:4600
- C:\Windows\System\ETXPaMf.exe
  C:\Windows\System\ETXPaMf.exe
  2⤵
  PID:4252
- C:\Windows\System\LZHDnKY.exe
  C:\Windows\System\LZHDnKY.exe
  2⤵
  PID:4564
- C:\Windows\System\TQWaPPq.exe
  C:\Windows\System\TQWaPPq.exe
  2⤵
  PID:4376
- C:\Windows\System\jtxMdXp.exe
  C:\Windows\System\jtxMdXp.exe
  2⤵
  PID:4616
- C:\Windows\System\ncpgyXZ.exe
  C:\Windows\System\ncpgyXZ.exe
  2⤵
  PID:4516
- C:\Windows\System\iGDlpOJ.exe
  C:\Windows\System\iGDlpOJ.exe
  2⤵
  PID:4832
- C:\Windows\System\iWwsxie.exe
  C:\Windows\System\iWwsxie.exe
  2⤵
  PID:5132
- C:\Windows\System\zQvGoeu.exe
  C:\Windows\System\zQvGoeu.exe
  2⤵
  PID:5148
- C:\Windows\System\GZGkfiN.exe
  C:\Windows\System\GZGkfiN.exe
  2⤵
  PID:5164
- C:\Windows\System\bELHxhh.exe
  C:\Windows\System\bELHxhh.exe
  2⤵
  PID:5180
- C:\Windows\System\jkQAmdV.exe
  C:\Windows\System\jkQAmdV.exe
  2⤵
  PID:5196
- C:\Windows\System\DoiDBlw.exe
  C:\Windows\System\DoiDBlw.exe
  2⤵
  PID:5212
- C:\Windows\System\aKPviYW.exe
  C:\Windows\System\aKPviYW.exe
  2⤵
  PID:5228
- C:\Windows\System\SiurptI.exe
  C:\Windows\System\SiurptI.exe
  2⤵
  PID:5244
- C:\Windows\System\MWiiALN.exe
  C:\Windows\System\MWiiALN.exe
  2⤵
  PID:5260
- C:\Windows\System\vxwfcwN.exe
  C:\Windows\System\vxwfcwN.exe
  2⤵
  PID:5280
- C:\Windows\System\NunJFqc.exe
  C:\Windows\System\NunJFqc.exe
  2⤵
  PID:5296
- C:\Windows\System\sCfQEsk.exe
  C:\Windows\System\sCfQEsk.exe
  2⤵
  PID:5312
- C:\Windows\System\XYCbNmi.exe
  C:\Windows\System\XYCbNmi.exe
  2⤵
  PID:5328
- C:\Windows\System\cBfqzHp.exe
  C:\Windows\System\cBfqzHp.exe
  2⤵
  PID:5344
- C:\Windows\System\bGuHkLF.exe
  C:\Windows\System\bGuHkLF.exe
  2⤵
  PID:5360
- C:\Windows\System\aPdyDGC.exe
  C:\Windows\System\aPdyDGC.exe
  2⤵
  PID:5376
- C:\Windows\System\ROyvhGu.exe
  C:\Windows\System\ROyvhGu.exe
  2⤵
  PID:5392
- C:\Windows\System\POPhdxX.exe
  C:\Windows\System\POPhdxX.exe
  2⤵
  PID:5412
- C:\Windows\System\BzaXPqN.exe
  C:\Windows\System\BzaXPqN.exe
  2⤵
  PID:5428
- C:\Windows\System\uYoWdCH.exe
  C:\Windows\System\uYoWdCH.exe
  2⤵
  PID:5448
- C:\Windows\System\dkoZSaJ.exe
  C:\Windows\System\dkoZSaJ.exe
  2⤵
  PID:5464
- C:\Windows\System\XurPbfA.exe
  C:\Windows\System\XurPbfA.exe
  2⤵
  PID:5484
- C:\Windows\System\fUbzXrI.exe
  C:\Windows\System\fUbzXrI.exe
  2⤵
  PID:5500
- C:\Windows\System\DxfAumE.exe
  C:\Windows\System\DxfAumE.exe
  2⤵
  PID:5516
- C:\Windows\System\TWoYUjm.exe
  C:\Windows\System\TWoYUjm.exe
  2⤵
  PID:5532
- C:\Windows\System\ydGVYZf.exe
  C:\Windows\System\ydGVYZf.exe
  2⤵
  PID:5548
- C:\Windows\System\HVmBlNg.exe
  C:\Windows\System\HVmBlNg.exe
  2⤵
  PID:5568
- C:\Windows\System\vtCkAzj.exe
  C:\Windows\System\vtCkAzj.exe
  2⤵
  PID:5584
- C:\Windows\System\cdiRgDl.exe
  C:\Windows\System\cdiRgDl.exe
  2⤵
  PID:5600
- C:\Windows\System\mnJxfLy.exe
  C:\Windows\System\mnJxfLy.exe
  2⤵
  PID:5684
- C:\Windows\System\xuVsjve.exe
  C:\Windows\System\xuVsjve.exe
  2⤵
  PID:5704
- C:\Windows\System\OBknPds.exe
  C:\Windows\System\OBknPds.exe
  2⤵
  PID:5736
- C:\Windows\System\vBdrzdS.exe
  C:\Windows\System\vBdrzdS.exe
  2⤵
  PID:5752
- C:\Windows\System\GOYpwFT.exe
  C:\Windows\System\GOYpwFT.exe
  2⤵
  PID:5776
- C:\Windows\System\AYHBEdm.exe
  C:\Windows\System\AYHBEdm.exe
  2⤵
  PID:5796
- C:\Windows\System\QTXUtbs.exe
  C:\Windows\System\QTXUtbs.exe
  2⤵
  PID:5820
- C:\Windows\System\lOcHVQM.exe
  C:\Windows\System\lOcHVQM.exe
  2⤵
  PID:5836
- C:\Windows\System\SmDZMOc.exe
  C:\Windows\System\SmDZMOc.exe
  2⤵
  PID:5852
- C:\Windows\System\uFlpxdx.exe
  C:\Windows\System\uFlpxdx.exe
  2⤵
  PID:5868
- C:\Windows\System\Oufnryp.exe
  C:\Windows\System\Oufnryp.exe
  2⤵
  PID:5888
- C:\Windows\System\DlJOWcD.exe
  C:\Windows\System\DlJOWcD.exe
  2⤵
  PID:5904
- C:\Windows\System\zNJvdwP.exe
  C:\Windows\System\zNJvdwP.exe
  2⤵
  PID:5920
- C:\Windows\System\oSlcdAB.exe
  C:\Windows\System\oSlcdAB.exe
  2⤵
  PID:5940
- C:\Windows\System\RVZPjjw.exe
  C:\Windows\System\RVZPjjw.exe
  2⤵
  PID:5956
- C:\Windows\System\imXPcoE.exe
  C:\Windows\System\imXPcoE.exe
  2⤵
  PID:5972
- C:\Windows\System\dpkoXvJ.exe
  C:\Windows\System\dpkoXvJ.exe
  2⤵
  PID:5992
- C:\Windows\System\yXaePuE.exe
  C:\Windows\System\yXaePuE.exe
  2⤵
  PID:6008
- C:\Windows\System\NlQohYi.exe
  C:\Windows\System\NlQohYi.exe
  2⤵
  PID:6024
- C:\Windows\System\uSyTbqX.exe
  C:\Windows\System\uSyTbqX.exe
  2⤵
  PID:6040
- C:\Windows\System\nRMirlj.exe
  C:\Windows\System\nRMirlj.exe
  2⤵
  PID:6056
- C:\Windows\System\wiGPZNz.exe
  C:\Windows\System\wiGPZNz.exe
  2⤵
  PID:6076
- C:\Windows\System\YjmmOYX.exe
  C:\Windows\System\YjmmOYX.exe
  2⤵
  PID:6092
- C:\Windows\System\MbAqeez.exe
  C:\Windows\System\MbAqeez.exe
  2⤵
  PID:6108
- C:\Windows\System\nXSiAdJ.exe
  C:\Windows\System\nXSiAdJ.exe
  2⤵
  PID:6128
- C:\Windows\System\xmEOlOA.exe
  C:\Windows\System\xmEOlOA.exe
  2⤵
  PID:4336
- C:\Windows\System\fcVYFYf.exe
  C:\Windows\System\fcVYFYf.exe
  2⤵
  PID:4624
- C:\Windows\System\kaflxFa.exe
  C:\Windows\System\kaflxFa.exe
  2⤵
  PID:5160
- C:\Windows\System\okbeHtB.exe
  C:\Windows\System\okbeHtB.exe
  2⤵
  PID:5224
- C:\Windows\System\kJTyrRS.exe
  C:\Windows\System\kJTyrRS.exe
  2⤵
  PID:5256
- C:\Windows\System\ZhWILbI.exe
  C:\Windows\System\ZhWILbI.exe
  2⤵
  PID:5352
- C:\Windows\System\edaVIvo.exe
  C:\Windows\System\edaVIvo.exe
  2⤵
  PID:4352
- C:\Windows\System\zFSZesl.exe
  C:\Windows\System\zFSZesl.exe
  2⤵
  PID:5204
- C:\Windows\System\yTuwHBf.exe
  C:\Windows\System\yTuwHBf.exe
  2⤵
  PID:5420
- C:\Windows\System\bZdAnwE.exe
  C:\Windows\System\bZdAnwE.exe
  2⤵
  PID:5176
- C:\Windows\System\IOdzddL.exe
  C:\Windows\System\IOdzddL.exe
  2⤵
  PID:5424
- C:\Windows\System\BgDyMeL.exe
  C:\Windows\System\BgDyMeL.exe
  2⤵
  PID:5400
- C:\Windows\System\WNeKRJm.exe
  C:\Windows\System\WNeKRJm.exe
  2⤵
  PID:5496
- C:\Windows\System\ySDTPkh.exe
  C:\Windows\System\ySDTPkh.exe
  2⤵
  PID:4456
- C:\Windows\System\UxwJdrc.exe
  C:\Windows\System\UxwJdrc.exe
  2⤵
  PID:5596
- C:\Windows\System\YyUKbuX.exe
  C:\Windows\System\YyUKbuX.exe
  2⤵
  PID:5444
- C:\Windows\System\xnJYfgj.exe
  C:\Windows\System\xnJYfgj.exe
  2⤵
  PID:5512
- C:\Windows\System\dOvuCVt.exe
  C:\Windows\System\dOvuCVt.exe
  2⤵
  PID:5616
- C:\Windows\System\dSzecpE.exe
  C:\Windows\System\dSzecpE.exe
  2⤵
  PID:5648
- C:\Windows\System\PMMlzHw.exe
  C:\Windows\System\PMMlzHw.exe
  2⤵
  PID:5672
- C:\Windows\System\kxCQSDu.exe
  C:\Windows\System\kxCQSDu.exe
  2⤵
  PID:5664
- C:\Windows\System\biOjmnZ.exe
  C:\Windows\System\biOjmnZ.exe
  2⤵
  PID:5712
- C:\Windows\System\criSDmJ.exe
  C:\Windows\System\criSDmJ.exe
  2⤵
  PID:5716
- C:\Windows\System\uPaCMzP.exe
  C:\Windows\System\uPaCMzP.exe
  2⤵
  PID:5784
- C:\Windows\System\RUxMNbW.exe
  C:\Windows\System\RUxMNbW.exe
  2⤵
  PID:5792
- C:\Windows\System\veisynl.exe
  C:\Windows\System\veisynl.exe
  2⤵
  PID:5832
- C:\Windows\System\irzWxpq.exe
  C:\Windows\System\irzWxpq.exe
  2⤵
  PID:5932
- C:\Windows\System\tyeDytD.exe
  C:\Windows\System\tyeDytD.exe
  2⤵
  PID:5808
- C:\Windows\System\JueuBCu.exe
  C:\Windows\System\JueuBCu.exe
  2⤵
  PID:5816
- C:\Windows\System\BdfLAGz.exe
  C:\Windows\System\BdfLAGz.exe
  2⤵
  PID:5848
- C:\Windows\System\OtfElvU.exe
  C:\Windows\System\OtfElvU.exe
  2⤵
  PID:5980
- C:\Windows\System\ESERSce.exe
  C:\Windows\System\ESERSce.exe
  2⤵
  PID:5988
- C:\Windows\System\ReQTVag.exe
  C:\Windows\System\ReQTVag.exe
  2⤵
  PID:6064
- C:\Windows\System\AJLhmnD.exe
  C:\Windows\System\AJLhmnD.exe
  2⤵
  PID:6016
- C:\Windows\System\CnaXIRP.exe
  C:\Windows\System\CnaXIRP.exe
  2⤵
  PID:6052
- C:\Windows\System\vGqjlBE.exe
  C:\Windows\System\vGqjlBE.exe
  2⤵
  PID:5252
- C:\Windows\System\zdNiYgz.exe
  C:\Windows\System\zdNiYgz.exe
  2⤵
  PID:6124
- C:\Windows\System\FuwbVvb.exe
  C:\Windows\System\FuwbVvb.exe
  2⤵
  PID:4512
- C:\Windows\System\jQsleka.exe
  C:\Windows\System\jQsleka.exe
  2⤵
  PID:4320
- C:\Windows\System\ZLsuQcE.exe
  C:\Windows\System\ZLsuQcE.exe
  2⤵
  PID:5460
- C:\Windows\System\oeoRqbT.exe
  C:\Windows\System\oeoRqbT.exe
  2⤵
  PID:5172
- C:\Windows\System\kWClgXI.exe
  C:\Windows\System\kWClgXI.exe
  2⤵
  PID:5556
- C:\Windows\System\tnJsVyM.exe
  C:\Windows\System\tnJsVyM.exe
  2⤵
  PID:5236
- C:\Windows\System\agsgnJR.exe
  C:\Windows\System\agsgnJR.exe
  2⤵
  PID:5560
- C:\Windows\System\rIActFC.exe
  C:\Windows\System\rIActFC.exe
  2⤵
  PID:5620
- C:\Windows\System\SZYhzWe.exe
  C:\Windows\System\SZYhzWe.exe
  2⤵
  PID:5636
- C:\Windows\System\URgjHxN.exe
  C:\Windows\System\URgjHxN.exe
  2⤵
  PID:5696
- C:\Windows\System\Aawaxej.exe
  C:\Windows\System\Aawaxej.exe
  2⤵
  PID:5788
- C:\Windows\System\GAvFNtM.exe
  C:\Windows\System\GAvFNtM.exe
  2⤵
  PID:5968
- C:\Windows\System\kqfntKl.exe
  C:\Windows\System\kqfntKl.exe
  2⤵
  PID:5812
- C:\Windows\System\jZMueuN.exe
  C:\Windows\System\jZMueuN.exe
  2⤵
  PID:5700
- C:\Windows\System\HgcWNZh.exe
  C:\Windows\System\HgcWNZh.exe
  2⤵
  PID:5884
- C:\Windows\System\QvnZPgT.exe
  C:\Windows\System\QvnZPgT.exe
  2⤵
  PID:5880
- C:\Windows\System\ZmPQmxh.exe
  C:\Windows\System\ZmPQmxh.exe
  2⤵
  PID:6104
- C:\Windows\System\WtVLHGV.exe
  C:\Windows\System\WtVLHGV.exe
  2⤵
  PID:6100
- C:\Windows\System\zCoLfTx.exe
  C:\Windows\System\zCoLfTx.exe
  2⤵
  PID:6116
- C:\Windows\System\UCARZcI.exe
  C:\Windows\System\UCARZcI.exe
  2⤵
  PID:5064
- C:\Windows\System\vvulCdS.exe
  C:\Windows\System\vvulCdS.exe
  2⤵
  PID:5324
- C:\Windows\System\UNdQRPA.exe
  C:\Windows\System\UNdQRPA.exe
  2⤵
  PID:5480
- C:\Windows\System\TjUfCwE.exe
  C:\Windows\System\TjUfCwE.exe
  2⤵
  PID:5340
- C:\Windows\System\jVvjgNL.exe
  C:\Windows\System\jVvjgNL.exe
  2⤵
  PID:5576
- C:\Windows\System\aYvAhcZ.exe
  C:\Windows\System\aYvAhcZ.exe
  2⤵
  PID:5528
- C:\Windows\System\jGXYImA.exe
  C:\Windows\System\jGXYImA.exe
  2⤵
  PID:5624
- C:\Windows\System\gkJiAND.exe
  C:\Windows\System\gkJiAND.exe
  2⤵
  PID:5748
- C:\Windows\System\lShZBFS.exe
  C:\Windows\System\lShZBFS.exe
  2⤵
  PID:5896
- C:\Windows\System\kgLypTq.exe
  C:\Windows\System\kgLypTq.exe
  2⤵
  PID:5676
- C:\Windows\System\OLnMoTV.exe
  C:\Windows\System\OLnMoTV.exe
  2⤵
  PID:6072
- C:\Windows\System\JZHNdas.exe
  C:\Windows\System\JZHNdas.exe
  2⤵
  PID:4504
- C:\Windows\System\JRiRnja.exe
  C:\Windows\System\JRiRnja.exe
  2⤵
  PID:5436
- C:\Windows\System\cwDVntE.exe
  C:\Windows\System\cwDVntE.exe
  2⤵
  PID:5144
- C:\Windows\System\lEHejSt.exe
  C:\Windows\System\lEHejSt.exe
  2⤵
  PID:5668
- C:\Windows\System\EtydfGJ.exe
  C:\Windows\System\EtydfGJ.exe
  2⤵
  PID:5732
- C:\Windows\System\krgmrnU.exe
  C:\Windows\System\krgmrnU.exe
  2⤵
  PID:5952
- C:\Windows\System\DZgtDKi.exe
  C:\Windows\System\DZgtDKi.exe
  2⤵
  PID:5456
- C:\Windows\System\qhJqRxN.exe
  C:\Windows\System\qhJqRxN.exe
  2⤵
  PID:6156
- C:\Windows\System\qIoDSGr.exe
  C:\Windows\System\qIoDSGr.exe
  2⤵
  PID:6172
- C:\Windows\System\rBxBCFs.exe
  C:\Windows\System\rBxBCFs.exe
  2⤵
  PID:6188
- C:\Windows\System\kQCMpnh.exe
  C:\Windows\System\kQCMpnh.exe
  2⤵
  PID:6204
- C:\Windows\System\YnwkaMe.exe
  C:\Windows\System\YnwkaMe.exe
  2⤵
  PID:6220
- C:\Windows\System\iKZNtRO.exe
  C:\Windows\System\iKZNtRO.exe
  2⤵
  PID:6236
- C:\Windows\System\CJvUywz.exe
  C:\Windows\System\CJvUywz.exe
  2⤵
  PID:6252
- C:\Windows\System\vPCjEPR.exe
  C:\Windows\System\vPCjEPR.exe
  2⤵
  PID:6268
- C:\Windows\System\gZfOEgU.exe
  C:\Windows\System\gZfOEgU.exe
  2⤵
  PID:6284
- C:\Windows\System\fFWWriu.exe
  C:\Windows\System\fFWWriu.exe
  2⤵
  PID:6300
- C:\Windows\System\AwYrqlt.exe
  C:\Windows\System\AwYrqlt.exe
  2⤵
  PID:6316
- C:\Windows\System\HtEevwq.exe
  C:\Windows\System\HtEevwq.exe
  2⤵
  PID:6332
- C:\Windows\System\jYgOncq.exe
  C:\Windows\System\jYgOncq.exe
  2⤵
  PID:6348
- C:\Windows\System\KHgBboO.exe
  C:\Windows\System\KHgBboO.exe
  2⤵
  PID:6364
- C:\Windows\System\KMFIQXB.exe
  C:\Windows\System\KMFIQXB.exe
  2⤵
  PID:6380
- C:\Windows\System\fOgPqci.exe
  C:\Windows\System\fOgPqci.exe
  2⤵
  PID:6396
- C:\Windows\System\kUhZpFX.exe
  C:\Windows\System\kUhZpFX.exe
  2⤵
  PID:6412
- C:\Windows\System\yHyrojG.exe
  C:\Windows\System\yHyrojG.exe
  2⤵
  PID:6428
- C:\Windows\System\qQpukTZ.exe
  C:\Windows\System\qQpukTZ.exe
  2⤵
  PID:6444
- C:\Windows\System\vJyMCnT.exe
  C:\Windows\System\vJyMCnT.exe
  2⤵
  PID:6460
- C:\Windows\System\aniGqPu.exe
  C:\Windows\System\aniGqPu.exe
  2⤵
  PID:6476
- C:\Windows\System\GkbsgHt.exe
  C:\Windows\System\GkbsgHt.exe
  2⤵
  PID:6492
- C:\Windows\System\iESKwgg.exe
  C:\Windows\System\iESKwgg.exe
  2⤵
  PID:6508
- C:\Windows\System\OSQcnnm.exe
  C:\Windows\System\OSQcnnm.exe
  2⤵
  PID:6524
- C:\Windows\System\AHYPHPF.exe
  C:\Windows\System\AHYPHPF.exe
  2⤵
  PID:6540
- C:\Windows\System\UHInLbG.exe
  C:\Windows\System\UHInLbG.exe
  2⤵
  PID:6556
- C:\Windows\System\FzPfmBb.exe
  C:\Windows\System\FzPfmBb.exe
  2⤵
  PID:6572
- C:\Windows\System\FHUWrjs.exe
  C:\Windows\System\FHUWrjs.exe
  2⤵
  PID:6592
- C:\Windows\System\OrsfSNG.exe
  C:\Windows\System\OrsfSNG.exe
  2⤵
  PID:6608
- C:\Windows\System\FuxmYnX.exe
  C:\Windows\System\FuxmYnX.exe
  2⤵
  PID:6624
- C:\Windows\System\iisAqbr.exe
  C:\Windows\System\iisAqbr.exe
  2⤵
  PID:6640
- C:\Windows\System\mRRxPAQ.exe
  C:\Windows\System\mRRxPAQ.exe
  2⤵
  PID:6656
- C:\Windows\System\UTlCTNW.exe
  C:\Windows\System\UTlCTNW.exe
  2⤵
  PID:6672
- C:\Windows\System\NPqwDwq.exe
  C:\Windows\System\NPqwDwq.exe
  2⤵
  PID:6688
- C:\Windows\System\HvhPrpC.exe
  C:\Windows\System\HvhPrpC.exe
  2⤵
  PID:6704
- C:\Windows\System\SaYJEuJ.exe
  C:\Windows\System\SaYJEuJ.exe
  2⤵
  PID:6720
- C:\Windows\System\aaUNemU.exe
  C:\Windows\System\aaUNemU.exe
  2⤵
  PID:6736
- C:\Windows\System\PAszILz.exe
  C:\Windows\System\PAszILz.exe
  2⤵
  PID:6752
- C:\Windows\System\lNiMTAN.exe
  C:\Windows\System\lNiMTAN.exe
  2⤵
  PID:6768
- C:\Windows\System\aEUCfmA.exe
  C:\Windows\System\aEUCfmA.exe
  2⤵
  PID:6784
- C:\Windows\System\dgZfKmj.exe
  C:\Windows\System\dgZfKmj.exe
  2⤵
  PID:6800
- C:\Windows\System\rJzYCCr.exe
  C:\Windows\System\rJzYCCr.exe
  2⤵
  PID:6816
- C:\Windows\System\JLgemcL.exe
  C:\Windows\System\JLgemcL.exe
  2⤵
  PID:6832
- C:\Windows\System\yzNNmcL.exe
  C:\Windows\System\yzNNmcL.exe
  2⤵
  PID:6848
- C:\Windows\System\paZIwmS.exe
  C:\Windows\System\paZIwmS.exe
  2⤵
  PID:6864
- C:\Windows\System\qCHXLdG.exe
  C:\Windows\System\qCHXLdG.exe
  2⤵
  PID:6880
- C:\Windows\System\pOeqElK.exe
  C:\Windows\System\pOeqElK.exe
  2⤵
  PID:6896
- C:\Windows\System\RJwnVxZ.exe
  C:\Windows\System\RJwnVxZ.exe
  2⤵
  PID:6912
- C:\Windows\System\ngzxrSN.exe
  C:\Windows\System\ngzxrSN.exe
  2⤵
  PID:6928
- C:\Windows\System\OHRLLml.exe
  C:\Windows\System\OHRLLml.exe
  2⤵
  PID:6944
- C:\Windows\System\bfHfpjr.exe
  C:\Windows\System\bfHfpjr.exe
  2⤵
  PID:6960
- C:\Windows\System\DrXVQdA.exe
  C:\Windows\System\DrXVQdA.exe
  2⤵
  PID:6976
- C:\Windows\System\lLHZoBD.exe
  C:\Windows\System\lLHZoBD.exe
  2⤵
  PID:6992
- C:\Windows\System\jQYjESu.exe
  C:\Windows\System\jQYjESu.exe
  2⤵
  PID:7008
- C:\Windows\System\IPbevWv.exe
  C:\Windows\System\IPbevWv.exe
  2⤵
  PID:7024
- C:\Windows\System\BBmKgQk.exe
  C:\Windows\System\BBmKgQk.exe
  2⤵
  PID:7040
- C:\Windows\System\CyBALWt.exe
  C:\Windows\System\CyBALWt.exe
  2⤵
  PID:7056
- C:\Windows\System\CkqqfCm.exe
  C:\Windows\System\CkqqfCm.exe
  2⤵
  PID:7072
- C:\Windows\System\vlDUHKm.exe
  C:\Windows\System\vlDUHKm.exe
  2⤵
  PID:7088
- C:\Windows\System\QbPiiZd.exe
  C:\Windows\System\QbPiiZd.exe
  2⤵
  PID:7104
- C:\Windows\System\kUthXMg.exe
  C:\Windows\System\kUthXMg.exe
  2⤵
  PID:7120
- C:\Windows\System\IkRuMKm.exe
  C:\Windows\System\IkRuMKm.exe
  2⤵
  PID:7136
- C:\Windows\System\qMuXMbs.exe
  C:\Windows\System\qMuXMbs.exe
  2⤵
  PID:7152
- C:\Windows\System\nezwsCK.exe
  C:\Windows\System\nezwsCK.exe
  2⤵
  PID:5644
- C:\Windows\System\nocWlOQ.exe
  C:\Windows\System\nocWlOQ.exe
  2⤵
  PID:6152
- C:\Windows\System\XWpvtJR.exe
  C:\Windows\System\XWpvtJR.exe
  2⤵
  PID:4956
- C:\Windows\System\STrUHaT.exe
  C:\Windows\System\STrUHaT.exe
  2⤵
  PID:5192
- C:\Windows\System\mobMqAe.exe
  C:\Windows\System\mobMqAe.exe
  2⤵
  PID:5128
- C:\Windows\System\JOpREkD.exe
  C:\Windows\System\JOpREkD.exe
  2⤵
  PID:6216
- C:\Windows\System\vGgkrwG.exe
  C:\Windows\System\vGgkrwG.exe
  2⤵
  PID:6232
- C:\Windows\System\gxruuqS.exe
  C:\Windows\System\gxruuqS.exe
  2⤵
  PID:6280
- C:\Windows\System\JmhDPwk.exe
  C:\Windows\System\JmhDPwk.exe
  2⤵
  PID:6292
- C:\Windows\System\soJbQgU.exe
  C:\Windows\System\soJbQgU.exe
  2⤵
  PID:6344
- C:\Windows\System\XuMdNcL.exe
  C:\Windows\System\XuMdNcL.exe
  2⤵
  PID:6360
- C:\Windows\System\iyUqiNo.exe
  C:\Windows\System\iyUqiNo.exe
  2⤵
  PID:6404
- C:\Windows\System\ZLdBQpM.exe
  C:\Windows\System\ZLdBQpM.exe
  2⤵
  PID:6420
- C:\Windows\System\vNVldKK.exe
  C:\Windows\System\vNVldKK.exe
  2⤵
  PID:6468
- C:\Windows\System\ISwpPuF.exe
  C:\Windows\System\ISwpPuF.exe
  2⤵
  PID:6488
- C:\Windows\System\bgSKdhb.exe
  C:\Windows\System\bgSKdhb.exe
  2⤵
  PID:6520
- C:\Windows\System\vIelzjG.exe
  C:\Windows\System\vIelzjG.exe
  2⤵
  PID:6548
- C:\Windows\System\YYXZUih.exe
  C:\Windows\System\YYXZUih.exe
  2⤵
  PID:6604
- C:\Windows\System\vMDqjRE.exe
  C:\Windows\System\vMDqjRE.exe
  2⤵
  PID:6616
- C:\Windows\System\iZmmFRz.exe
  C:\Windows\System\iZmmFRz.exe
  2⤵
  PID:6696
- C:\Windows\System\yonmBUQ.exe
  C:\Windows\System\yonmBUQ.exe
  2⤵
  PID:6760
- C:\Windows\System\uqmVJyC.exe
  C:\Windows\System\uqmVJyC.exe
  2⤵
  PID:6748
- C:\Windows\System\tSBntXE.exe
  C:\Windows\System\tSBntXE.exe
  2⤵
  PID:6684
- C:\Windows\System\MkoWsZK.exe
  C:\Windows\System\MkoWsZK.exe
  2⤵
  PID:6744
- C:\Windows\System\HHxBGCb.exe
  C:\Windows\System\HHxBGCb.exe
  2⤵
  PID:6856
- C:\Windows\System\SeEqpXD.exe
  C:\Windows\System\SeEqpXD.exe
  2⤵
  PID:6920
- C:\Windows\System\VWOleBY.exe
  C:\Windows\System\VWOleBY.exe
  2⤵
  PID:6984
- C:\Windows\System\MFMEcqE.exe
  C:\Windows\System\MFMEcqE.exe
  2⤵
  PID:6936
- C:\Windows\System\CfnBIZp.exe
  C:\Windows\System\CfnBIZp.exe
  2⤵
  PID:6844
- C:\Windows\System\cEfTzck.exe
  C:\Windows\System\cEfTzck.exe
  2⤵
  PID:7016
- C:\Windows\System\DJtTxDL.exe
  C:\Windows\System\DJtTxDL.exe
  2⤵
  PID:7000
- C:\Windows\System\QYxNcdG.exe
  C:\Windows\System\QYxNcdG.exe
  2⤵
  PID:7068
- C:\Windows\System\EkJjfEF.exe
  C:\Windows\System\EkJjfEF.exe
  2⤵
  PID:7036
- C:\Windows\System\SfTfIEN.exe
  C:\Windows\System\SfTfIEN.exe
  2⤵
  PID:7144
- C:\Windows\System\IbHLGvu.exe
  C:\Windows\System\IbHLGvu.exe
  2⤵
  PID:5876
- C:\Windows\System\NxvibXf.exe
  C:\Windows\System\NxvibXf.exe
  2⤵
  PID:6196
- C:\Windows\System\MmrtpvY.exe
  C:\Windows\System\MmrtpvY.exe
  2⤵
  PID:7160
- C:\Windows\System\IzlpYWi.exe
  C:\Windows\System\IzlpYWi.exe
  2⤵
  PID:6340
- C:\Windows\System\kZWcYRj.exe
  C:\Windows\System\kZWcYRj.exe
  2⤵
  PID:5268
- C:\Windows\System\xbVJumV.exe
  C:\Windows\System\xbVJumV.exe
  2⤵
  PID:6248
- C:\Windows\System\YHBrwBq.exe
  C:\Windows\System\YHBrwBq.exe
  2⤵
  PID:6296
- C:\Windows\System\gGQvKXh.exe
  C:\Windows\System\gGQvKXh.exe
  2⤵
  PID:6532
- C:\Windows\System\nHXkxVH.exe
  C:\Windows\System\nHXkxVH.exe
  2⤵
  PID:6456
- C:\Windows\System\LrLznSa.exe
  C:\Windows\System\LrLznSa.exe
  2⤵
  PID:6652
- C:\Windows\System\VSoCoMS.exe
  C:\Windows\System\VSoCoMS.exe
  2⤵
  PID:6796
- C:\Windows\System\wsBMrFV.exe
  C:\Windows\System\wsBMrFV.exe
  2⤵
  PID:6776
- C:\Windows\System\uhYLuAz.exe
  C:\Windows\System\uhYLuAz.exe
  2⤵
  PID:6812
- C:\Windows\System\GWhUJpI.exe
  C:\Windows\System\GWhUJpI.exe
  2⤵
  PID:6828
- C:\Windows\System\DFuEVQG.exe
  C:\Windows\System\DFuEVQG.exe
  2⤵
  PID:6840
- C:\Windows\System\LFgrEyD.exe
  C:\Windows\System\LFgrEyD.exe
  2⤵
  PID:7084
- C:\Windows\System\ZvmExjA.exe
  C:\Windows\System\ZvmExjA.exe
  2⤵
  PID:7052
- C:\Windows\System\iEOzneZ.exe
  C:\Windows\System\iEOzneZ.exe
  2⤵
  PID:7164
- C:\Windows\System\lmNaGkn.exe
  C:\Windows\System\lmNaGkn.exe
  2⤵
  PID:5900
- C:\Windows\System\zYvHmgU.exe
  C:\Windows\System\zYvHmgU.exe
  2⤵
  PID:6312
- C:\Windows\System\YPhQLBN.exe
  C:\Windows\System\YPhQLBN.exe
  2⤵
  PID:6516
- C:\Windows\System\kmCJLfG.exe
  C:\Windows\System\kmCJLfG.exe
  2⤵
  PID:6716
- C:\Windows\System\OgxdIdg.exe
  C:\Windows\System\OgxdIdg.exe
  2⤵
  PID:6452
- C:\Windows\System\QZzfFGm.exe
  C:\Windows\System\QZzfFGm.exe
  2⤵
  PID:6484
- C:\Windows\System\qvLBgNv.exe
  C:\Windows\System\qvLBgNv.exe
  2⤵
  PID:6908
- C:\Windows\System\DNvnXmn.exe
  C:\Windows\System\DNvnXmn.exe
  2⤵
  PID:7128
- C:\Windows\System\vwJTAxn.exe
  C:\Windows\System\vwJTAxn.exe
  2⤵
  PID:6276
- C:\Windows\System\ytzaGhe.exe
  C:\Windows\System\ytzaGhe.exe
  2⤵
  PID:6372
- C:\Windows\System\xtKLMuQ.exe
  C:\Windows\System\xtKLMuQ.exe
  2⤵
  PID:6376
- C:\Windows\System\QaVFOPW.exe
  C:\Windows\System\QaVFOPW.exe
  2⤵
  PID:6792
- C:\Windows\System\CAnJHyh.exe
  C:\Windows\System\CAnJHyh.exe
  2⤵
  PID:6588
- C:\Windows\System\RZFBgoj.exe
  C:\Windows\System\RZFBgoj.exe
  2⤵
  PID:5472
- C:\Windows\System\UkolyGG.exe
  C:\Windows\System\UkolyGG.exe
  2⤵
  PID:6164
- C:\Windows\System\nlXbzsK.exe
  C:\Windows\System\nlXbzsK.exe
  2⤵
  PID:6732
- C:\Windows\System\rTLNTxb.exe
  C:\Windows\System\rTLNTxb.exe
  2⤵
  PID:7180
- C:\Windows\System\EOesQAO.exe
  C:\Windows\System\EOesQAO.exe
  2⤵
  PID:7196
- C:\Windows\System\kNSbwNn.exe
  C:\Windows\System\kNSbwNn.exe
  2⤵
  PID:7212
- C:\Windows\System\hxOllbj.exe
  C:\Windows\System\hxOllbj.exe
  2⤵
  PID:7228
- C:\Windows\System\jJApBtl.exe
  C:\Windows\System\jJApBtl.exe
  2⤵
  PID:7244
- C:\Windows\System\KlywDSl.exe
  C:\Windows\System\KlywDSl.exe
  2⤵
  PID:7260
- C:\Windows\System\WdWuNVy.exe
  C:\Windows\System\WdWuNVy.exe
  2⤵
  PID:7276
- C:\Windows\System\Jnapepg.exe
  C:\Windows\System\Jnapepg.exe
  2⤵
  PID:7292
- C:\Windows\System\NgwQJYf.exe
  C:\Windows\System\NgwQJYf.exe
  2⤵
  PID:7312
- C:\Windows\System\OrfVVTw.exe
  C:\Windows\System\OrfVVTw.exe
  2⤵
  PID:7328
- C:\Windows\System\LZrhaqd.exe
  C:\Windows\System\LZrhaqd.exe
  2⤵
  PID:7344
- C:\Windows\System\UJPWGXI.exe
  C:\Windows\System\UJPWGXI.exe
  2⤵
  PID:7360
- C:\Windows\System\WypBvSd.exe
  C:\Windows\System\WypBvSd.exe
  2⤵
  PID:7376
- C:\Windows\System\VHroHtv.exe
  C:\Windows\System\VHroHtv.exe
  2⤵
  PID:7392
- C:\Windows\System\jnEKhBt.exe
  C:\Windows\System\jnEKhBt.exe
  2⤵
  PID:7408
- C:\Windows\System\Pmmijlz.exe
  C:\Windows\System\Pmmijlz.exe
  2⤵
  PID:7428
- C:\Windows\System\fCeLOTx.exe
  C:\Windows\System\fCeLOTx.exe
  2⤵
  PID:7444
- C:\Windows\System\GKnvaoN.exe
  C:\Windows\System\GKnvaoN.exe
  2⤵
  PID:7480
- C:\Windows\System\rehiGQT.exe
  C:\Windows\System\rehiGQT.exe
  2⤵
  PID:7496
- C:\Windows\System\QhcgLdb.exe
  C:\Windows\System\QhcgLdb.exe
  2⤵
  PID:7512
- C:\Windows\System\fCKYLlH.exe
  C:\Windows\System\fCKYLlH.exe
  2⤵
  PID:7528
- C:\Windows\System\XAembMi.exe
  C:\Windows\System\XAembMi.exe
  2⤵
  PID:7544
- C:\Windows\System\BWpmAaU.exe
  C:\Windows\System\BWpmAaU.exe
  2⤵
  PID:7560
- C:\Windows\System\FxoyFpJ.exe
  C:\Windows\System\FxoyFpJ.exe
  2⤵
  PID:7576
- C:\Windows\System\uaRIwUb.exe
  C:\Windows\System\uaRIwUb.exe
  2⤵
  PID:7592
- C:\Windows\System\mdgpSPR.exe
  C:\Windows\System\mdgpSPR.exe
  2⤵
  PID:7608
- C:\Windows\System\HOEwdPD.exe
  C:\Windows\System\HOEwdPD.exe
  2⤵
  PID:7624
- C:\Windows\System\mDHtHGH.exe
  C:\Windows\System\mDHtHGH.exe
  2⤵
  PID:7640
- C:\Windows\System\hdlbEYu.exe
  C:\Windows\System\hdlbEYu.exe
  2⤵
  PID:7656
- C:\Windows\System\gmTZJVc.exe
  C:\Windows\System\gmTZJVc.exe
  2⤵
  PID:7672
- C:\Windows\System\SlugpYE.exe
  C:\Windows\System\SlugpYE.exe
  2⤵
  PID:7688
- C:\Windows\System\cXhJLtd.exe
  C:\Windows\System\cXhJLtd.exe
  2⤵
  PID:7704
- C:\Windows\System\Pdomiuf.exe
  C:\Windows\System\Pdomiuf.exe
  2⤵
  PID:7760
- C:\Windows\System\aKvjrZL.exe
  C:\Windows\System\aKvjrZL.exe
  2⤵
  PID:7784
- C:\Windows\System\jqjBLQc.exe
  C:\Windows\System\jqjBLQc.exe
  2⤵
  PID:7800
- C:\Windows\System\PyCAzXH.exe
  C:\Windows\System\PyCAzXH.exe
  2⤵
  PID:7824
- C:\Windows\System\ugLtaHj.exe
  C:\Windows\System\ugLtaHj.exe
  2⤵
  PID:7840
- C:\Windows\System\gTiUpRF.exe
  C:\Windows\System\gTiUpRF.exe
  2⤵
  PID:7856
- C:\Windows\System\yXIySou.exe
  C:\Windows\System\yXIySou.exe
  2⤵
  PID:7872
- C:\Windows\System\cFtpNhH.exe
  C:\Windows\System\cFtpNhH.exe
  2⤵
  PID:7888
- C:\Windows\System\ehnTXBd.exe
  C:\Windows\System\ehnTXBd.exe
  2⤵
  PID:7904
- C:\Windows\System\jDRFPIn.exe
  C:\Windows\System\jDRFPIn.exe
  2⤵
  PID:7924
- C:\Windows\System\kDtntwq.exe
  C:\Windows\System\kDtntwq.exe
  2⤵
  PID:7944
- C:\Windows\System\esgJssk.exe
  C:\Windows\System\esgJssk.exe
  2⤵
  PID:7960
- C:\Windows\System\AySLXaq.exe
  C:\Windows\System\AySLXaq.exe
  2⤵
  PID:7980
- C:\Windows\System\aOLYxLa.exe
  C:\Windows\System\aOLYxLa.exe
  2⤵
  PID:8000
- C:\Windows\System\rVvfZbS.exe
  C:\Windows\System\rVvfZbS.exe
  2⤵
  PID:8016
- C:\Windows\System\FwXnoee.exe
  C:\Windows\System\FwXnoee.exe
  2⤵
  PID:8032
- C:\Windows\System\goGIzvr.exe
  C:\Windows\System\goGIzvr.exe
  2⤵
  PID:8048
- C:\Windows\System\srMkBit.exe
  C:\Windows\System\srMkBit.exe
  2⤵
  PID:8064
- C:\Windows\System\iVdRewJ.exe
  C:\Windows\System\iVdRewJ.exe
  2⤵
  PID:8080
- C:\Windows\System\ihlXgjs.exe
  C:\Windows\System\ihlXgjs.exe
  2⤵
  PID:8096
- C:\Windows\System\ezpVBVP.exe
  C:\Windows\System\ezpVBVP.exe
  2⤵
  PID:8112
- C:\Windows\System\jvqTDcw.exe
  C:\Windows\System\jvqTDcw.exe
  2⤵
  PID:8128
- C:\Windows\System\KXEHWLW.exe
  C:\Windows\System\KXEHWLW.exe
  2⤵
  PID:8144
- C:\Windows\System\BjivTzx.exe
  C:\Windows\System\BjivTzx.exe
  2⤵
  PID:8160
- C:\Windows\System\DEGJrOh.exe
  C:\Windows\System\DEGJrOh.exe
  2⤵
  PID:8180
- C:\Windows\System\wQWhRCu.exe
  C:\Windows\System\wQWhRCu.exe
  2⤵
  PID:6620
- C:\Windows\System\LiCobbS.exe
  C:\Windows\System\LiCobbS.exe
  2⤵
  PID:7172
- C:\Windows\System\edZRmmi.exe
  C:\Windows\System\edZRmmi.exe
  2⤵
  PID:7220
- C:\Windows\System\FcLBfNz.exe
  C:\Windows\System\FcLBfNz.exe
  2⤵
  PID:6600
- C:\Windows\System\MWdNPfe.exe
  C:\Windows\System\MWdNPfe.exe
  2⤵
  PID:7272
- C:\Windows\System\oQDZAbt.exe
  C:\Windows\System\oQDZAbt.exe
  2⤵
  PID:7324
- C:\Windows\System\deWGrzq.exe
  C:\Windows\System\deWGrzq.exe
  2⤵
  PID:7440
- C:\Windows\System\VWClbsV.exe
  C:\Windows\System\VWClbsV.exe
  2⤵
  PID:7472
- C:\Windows\System\wnUVKOc.exe
  C:\Windows\System\wnUVKOc.exe
  2⤵
  PID:7492
- C:\Windows\System\wTyuBvg.exe
  C:\Windows\System\wTyuBvg.exe
  2⤵
  PID:7572
- C:\Windows\System\lfrXsYi.exe
  C:\Windows\System\lfrXsYi.exe
  2⤵
  PID:7664
- C:\Windows\System\smVgAUw.exe
  C:\Windows\System\smVgAUw.exe
  2⤵
  PID:7556
- C:\Windows\System\eqONGtb.exe
  C:\Windows\System\eqONGtb.exe
  2⤵
  PID:7684
- C:\Windows\System\NtlNfJc.exe
  C:\Windows\System\NtlNfJc.exe
  2⤵
  PID:7648
- C:\Windows\System\DvEplXV.exe
  C:\Windows\System\DvEplXV.exe
  2⤵
  PID:7808
- C:\Windows\System\DMxcBHO.exe
  C:\Windows\System\DMxcBHO.exe
  2⤵
  PID:7848
- C:\Windows\System\ErqYOfF.exe
  C:\Windows\System\ErqYOfF.exe
  2⤵
  PID:7916
- C:\Windows\System\cyxVQvp.exe
  C:\Windows\System\cyxVQvp.exe
  2⤵
  PID:7792
- C:\Windows\System\IcxnmYD.exe
  C:\Windows\System\IcxnmYD.exe
  2⤵
  PID:7988
- C:\Windows\System\BOpjwcC.exe
  C:\Windows\System\BOpjwcC.exe
  2⤵
  PID:8028
- C:\Windows\System\QSBEuIK.exe
  C:\Windows\System\QSBEuIK.exe
  2⤵
  PID:8092
- C:\Windows\System\bkOcEdk.exe
  C:\Windows\System\bkOcEdk.exe
  2⤵
  PID:7868
- C:\Windows\System\hKEmUZH.exe
  C:\Windows\System\hKEmUZH.exe
  2⤵
  PID:8076
- C:\Windows\System\NDVlAns.exe
  C:\Windows\System\NDVlAns.exe
  2⤵
  PID:7940
- C:\Windows\System\lMMXEBr.exe
  C:\Windows\System\lMMXEBr.exe
  2⤵
  PID:7724
- C:\Windows\System\CisCrSg.exe
  C:\Windows\System\CisCrSg.exe
  2⤵
  PID:6584
- C:\Windows\System\NzPdTwa.exe
  C:\Windows\System\NzPdTwa.exe
  2⤵
  PID:7284
- C:\Windows\System\TKtiuit.exe
  C:\Windows\System\TKtiuit.exe
  2⤵
  PID:8012
- C:\Windows\System\JxnOlCC.exe
  C:\Windows\System\JxnOlCC.exe
  2⤵
  PID:7372
- C:\Windows\System\tXEUqqS.exe
  C:\Windows\System\tXEUqqS.exe
  2⤵
  PID:7404
- C:\Windows\System\PlGLHVD.exe
  C:\Windows\System\PlGLHVD.exe
  2⤵
  PID:7452
- C:\Windows\System\OYxcQIu.exe
  C:\Windows\System\OYxcQIu.exe
  2⤵
  PID:7488
- C:\Windows\System\zEpOzJF.exe
  C:\Windows\System\zEpOzJF.exe
  2⤵
  PID:8136
- C:\Windows\System\NOlNYtD.exe
  C:\Windows\System\NOlNYtD.exe
  2⤵
  PID:8088
- C:\Windows\System\HyNqQzD.exe
  C:\Windows\System\HyNqQzD.exe
  2⤵
  PID:7976
- C:\Windows\System\yLOiguR.exe
  C:\Windows\System\yLOiguR.exe
  2⤵
  PID:7820
- C:\Windows\System\BsLehnl.exe
  C:\Windows\System\BsLehnl.exe
  2⤵
  PID:7968
- C:\Windows\System\svZfXJF.exe
  C:\Windows\System\svZfXJF.exe
  2⤵
  PID:7192
- C:\Windows\System\lLdkDhP.exe
  C:\Windows\System\lLdkDhP.exe
  2⤵
  PID:7204
- C:\Windows\System\YDULGdI.exe
  C:\Windows\System\YDULGdI.exe
  2⤵
  PID:7400
- C:\Windows\System\DJVbPbi.exe
  C:\Windows\System\DJVbPbi.exe
  2⤵
  PID:7388
- C:\Windows\System\PBjWWse.exe
  C:\Windows\System\PBjWWse.exe
  2⤵
  PID:7652
- C:\Windows\System\mLqRpjU.exe
  C:\Windows\System\mLqRpjU.exe
  2⤵
  PID:8152
- C:\Windows\System\DldauAW.exe
  C:\Windows\System\DldauAW.exe
  2⤵
  PID:6636
- C:\Windows\System\HDjdkQE.exe
  C:\Windows\System\HDjdkQE.exe
  2⤵
  PID:7464
- C:\Windows\System\ojiiAij.exe
  C:\Windows\System\ojiiAij.exe
  2⤵
  PID:8008
- C:\Windows\System\ybuuqWM.exe
  C:\Windows\System\ybuuqWM.exe
  2⤵
  PID:7956
- C:\Windows\System\gbYNlfM.exe
  C:\Windows\System\gbYNlfM.exe
  2⤵
  PID:7780
- C:\Windows\System\ODndJSb.exe
  C:\Windows\System\ODndJSb.exe
  2⤵
  PID:7972
- C:\Windows\System\kAXzbtg.exe
  C:\Windows\System\kAXzbtg.exe
  2⤵
  PID:7884
- C:\Windows\System\WgpocmW.exe
  C:\Windows\System\WgpocmW.exe
  2⤵
  PID:7604
- C:\Windows\System\lVeMPHZ.exe
  C:\Windows\System\lVeMPHZ.exe
  2⤵
  PID:7812
- C:\Windows\System\eiNyVhB.exe
  C:\Windows\System\eiNyVhB.exe
  2⤵
  PID:7836
- C:\Windows\System\FkSFTLq.exe
  C:\Windows\System\FkSFTLq.exe
  2⤵
  PID:8176
- C:\Windows\System\XDynVLp.exe
  C:\Windows\System\XDynVLp.exe
  2⤵
  PID:7768
- C:\Windows\System\dpiSgAr.exe
  C:\Windows\System\dpiSgAr.exe
  2⤵
  PID:7696
- C:\Windows\System\WrWXSrw.exe
  C:\Windows\System\WrWXSrw.exe
  2⤵
  PID:7436
- C:\Windows\System\WKPDhxK.exe
  C:\Windows\System\WKPDhxK.exe
  2⤵
  PID:7632
- C:\Windows\System\JqVmreV.exe
  C:\Windows\System\JqVmreV.exe
  2⤵
  PID:7368
- C:\Windows\System\agGLAIh.exe
  C:\Windows\System\agGLAIh.exe
  2⤵
  PID:7880
- C:\Windows\System\EYJvlSS.exe
  C:\Windows\System\EYJvlSS.exe
  2⤵
  PID:8156
- C:\Windows\System\ehheFVY.exe
  C:\Windows\System\ehheFVY.exe
  2⤵
  PID:7336
- C:\Windows\System\gsfaCuj.exe
  C:\Windows\System\gsfaCuj.exe
  2⤵
  PID:7540
- C:\Windows\System\dYuyBlE.exe
  C:\Windows\System\dYuyBlE.exe
  2⤵
  PID:7728
- C:\Windows\System\hvxbLtl.exe
  C:\Windows\System\hvxbLtl.exe
  2⤵
  PID:7256
- C:\Windows\System\LudJzid.exe
  C:\Windows\System\LudJzid.exe
  2⤵
  PID:7416
- C:\Windows\System\POhkMcC.exe
  C:\Windows\System\POhkMcC.exe
  2⤵
  PID:8196
- C:\Windows\System\EQYKxPH.exe
  C:\Windows\System\EQYKxPH.exe
  2⤵
  PID:8212
- C:\Windows\System\idsBVsH.exe
  C:\Windows\System\idsBVsH.exe
  2⤵
  PID:8228
- C:\Windows\System\kVafMgX.exe
  C:\Windows\System\kVafMgX.exe
  2⤵
  PID:8244
- C:\Windows\System\NyLRvzj.exe
  C:\Windows\System\NyLRvzj.exe
  2⤵
  PID:8264
- C:\Windows\System\AgDWzAA.exe
  C:\Windows\System\AgDWzAA.exe
  2⤵
  PID:8284
- C:\Windows\System\LtTNxIx.exe
  C:\Windows\System\LtTNxIx.exe
  2⤵
  PID:8312
- C:\Windows\System\lUppNWV.exe
  C:\Windows\System\lUppNWV.exe
  2⤵
  PID:8336
- C:\Windows\System\dmsnBIx.exe
  C:\Windows\System\dmsnBIx.exe
  2⤵
  PID:8352
- C:\Windows\System\tgpGsrP.exe
  C:\Windows\System\tgpGsrP.exe
  2⤵
  PID:8368
- C:\Windows\System\jewaFMB.exe
  C:\Windows\System\jewaFMB.exe
  2⤵
  PID:8384
- C:\Windows\System\sepGupF.exe
  C:\Windows\System\sepGupF.exe
  2⤵
  PID:8400
- C:\Windows\System\ZmIEAOz.exe
  C:\Windows\System\ZmIEAOz.exe
  2⤵
  PID:8416
- C:\Windows\System\OEuXRki.exe
  C:\Windows\System\OEuXRki.exe
  2⤵
  PID:8432
- C:\Windows\System\LbSBlfV.exe
  C:\Windows\System\LbSBlfV.exe
  2⤵
  PID:8452
- C:\Windows\System\TvNpaIa.exe
  C:\Windows\System\TvNpaIa.exe
  2⤵
  PID:8468
- C:\Windows\System\YvnMDfR.exe
  C:\Windows\System\YvnMDfR.exe
  2⤵
  PID:8504
- C:\Windows\System\HnhuyIu.exe
  C:\Windows\System\HnhuyIu.exe
  2⤵
  PID:8524
- C:\Windows\System\VzPXwpi.exe
  C:\Windows\System\VzPXwpi.exe
  2⤵
  PID:8544
- C:\Windows\System\DRRFckx.exe
  C:\Windows\System\DRRFckx.exe
  2⤵
  PID:8560
- C:\Windows\System\aFhrkLs.exe
  C:\Windows\System\aFhrkLs.exe
  2⤵
  PID:8584
- C:\Windows\System\BQiTVZG.exe
  C:\Windows\System\BQiTVZG.exe
  2⤵
  PID:8600
- C:\Windows\System\ACmhLOL.exe
  C:\Windows\System\ACmhLOL.exe
  2⤵
  PID:8628
- C:\Windows\System\udaZwVl.exe
  C:\Windows\System\udaZwVl.exe
  2⤵
  PID:8648
- C:\Windows\System\tukLBHA.exe
  C:\Windows\System\tukLBHA.exe
  2⤵
  PID:8676
- C:\Windows\System\PrslaeG.exe
  C:\Windows\System\PrslaeG.exe
  2⤵
  PID:8692
- C:\Windows\System\QKvGLtG.exe
  C:\Windows\System\QKvGLtG.exe
  2⤵
  PID:8708
- C:\Windows\System\gZMdjRo.exe
  C:\Windows\System\gZMdjRo.exe
  2⤵
  PID:8728
- C:\Windows\System\MwaJjuF.exe
  C:\Windows\System\MwaJjuF.exe
  2⤵
  PID:8744
- C:\Windows\System\tZwXspl.exe
  C:\Windows\System\tZwXspl.exe
  2⤵
  PID:8760
- C:\Windows\System\JkSUpeb.exe
  C:\Windows\System\JkSUpeb.exe
  2⤵
  PID:8780
- C:\Windows\System\weRKfYU.exe
  C:\Windows\System\weRKfYU.exe
  2⤵
  PID:8796
- C:\Windows\System\EfLanCa.exe
  C:\Windows\System\EfLanCa.exe
  2⤵
  PID:8812
- C:\Windows\System\rebmlYW.exe
  C:\Windows\System\rebmlYW.exe
  2⤵
  PID:8828
- C:\Windows\System\nFVcmmt.exe
  C:\Windows\System\nFVcmmt.exe
  2⤵
  PID:8844
- C:\Windows\System\GbtcVUE.exe
  C:\Windows\System\GbtcVUE.exe
  2⤵
  PID:8864
- C:\Windows\System\AbQjPqC.exe
  C:\Windows\System\AbQjPqC.exe
  2⤵
  PID:8904
- C:\Windows\System\mcvbexF.exe
  C:\Windows\System\mcvbexF.exe
  2⤵
  PID:8920
- C:\Windows\System\ECsmlkU.exe
  C:\Windows\System\ECsmlkU.exe
  2⤵
  PID:8936
- C:\Windows\System\FsRwcCQ.exe
  C:\Windows\System\FsRwcCQ.exe
  2⤵
  PID:8956
- C:\Windows\System\YsAQJWQ.exe
  C:\Windows\System\YsAQJWQ.exe
  2⤵
  PID:8972
- C:\Windows\System\PzZFXYX.exe
  C:\Windows\System\PzZFXYX.exe
  2⤵
  PID:8988
- C:\Windows\System\byvqudh.exe
  C:\Windows\System\byvqudh.exe
  2⤵
  PID:9008
- C:\Windows\System\DoEgEmn.exe
  C:\Windows\System\DoEgEmn.exe
  2⤵
  PID:9024
- C:\Windows\System\FENkHDZ.exe
  C:\Windows\System\FENkHDZ.exe
  2⤵
  PID:9044
- C:\Windows\System\Qcfqrvp.exe
  C:\Windows\System\Qcfqrvp.exe
  2⤵
  PID:9060
- C:\Windows\System\IAAPlzi.exe
  C:\Windows\System\IAAPlzi.exe
  2⤵
  PID:9076
- C:\Windows\System\NUFTdYg.exe
  C:\Windows\System\NUFTdYg.exe
  2⤵
  PID:9120
- C:\Windows\System\OEFtLnE.exe
  C:\Windows\System\OEFtLnE.exe
  2⤵
  PID:9136
- C:\Windows\System\xIqPYHS.exe
  C:\Windows\System\xIqPYHS.exe
  2⤵
  PID:9152
- C:\Windows\System\vRykyQZ.exe
  C:\Windows\System\vRykyQZ.exe
  2⤵
  PID:7732
- C:\Windows\System\msohfRN.exe
  C:\Windows\System\msohfRN.exe
  2⤵
  PID:8380
- C:\Windows\System\eKBkpBc.exe
  C:\Windows\System\eKBkpBc.exe
  2⤵
  PID:8236
- C:\Windows\System\wdQcRek.exe
  C:\Windows\System\wdQcRek.exe
  2⤵
  PID:8440
- C:\Windows\System\qMkgAzB.exe
  C:\Windows\System\qMkgAzB.exe
  2⤵
  PID:7744
- C:\Windows\System\THYwfPv.exe
  C:\Windows\System\THYwfPv.exe
  2⤵
  PID:8392
- C:\Windows\System\HzaAEAs.exe
  C:\Windows\System\HzaAEAs.exe
  2⤵
  PID:8540
- C:\Windows\System\uljsVeh.exe
  C:\Windows\System\uljsVeh.exe
  2⤵
  PID:8516
- C:\Windows\System\mAuTGSk.exe
  C:\Windows\System\mAuTGSk.exe
  2⤵
  PID:8596
- C:\Windows\System\VggYHeJ.exe
  C:\Windows\System\VggYHeJ.exe
  2⤵
  PID:8500
- C:\Windows\System\pBvqAlK.exe
  C:\Windows\System\pBvqAlK.exe
  2⤵
  PID:8824
- C:\Windows\System\sncQOID.exe
  C:\Windows\System\sncQOID.exe
  2⤵
  PID:8792
- C:\Windows\System\efxOiwH.exe
  C:\Windows\System\efxOiwH.exe
  2⤵
  PID:8856
- C:\Windows\System\pxyKWVt.exe
  C:\Windows\System\pxyKWVt.exe
  2⤵
  PID:8880
- C:\Windows\System\jPKVkBn.exe
  C:\Windows\System\jPKVkBn.exe
  2⤵
  PID:8928
- C:\Windows\System\yuaCdQq.exe
  C:\Windows\System\yuaCdQq.exe
  2⤵
  PID:9052
- C:\Windows\System\tEdEzZQ.exe
  C:\Windows\System\tEdEzZQ.exe
  2⤵
  PID:9088
- C:\Windows\System\vsqnanQ.exe
  C:\Windows\System\vsqnanQ.exe
  2⤵
  PID:7568
- C:\Windows\System\SBfprZM.exe
  C:\Windows\System\SBfprZM.exe
  2⤵
  PID:8424
- C:\Windows\System\xBbPjNv.exe
  C:\Windows\System\xBbPjNv.exe
  2⤵
  PID:8428
- C:\Windows\System\eYCmKwU.exe
  C:\Windows\System\eYCmKwU.exe
  2⤵
  PID:9148
- C:\Windows\System\koLxGyU.exe
  C:\Windows\System\koLxGyU.exe
  2⤵
  PID:8488
- C:\Windows\System\ZKmGcKC.exe
  C:\Windows\System\ZKmGcKC.exe
  2⤵
  PID:8292
- C:\Windows\System\ubHjnNA.exe
  C:\Windows\System\ubHjnNA.exe
  2⤵
  PID:8460
- C:\Windows\System\SBZPLNI.exe
  C:\Windows\System\SBZPLNI.exe
  2⤵
  PID:8660
- C:\Windows\System\qQqlqjo.exe
  C:\Windows\System\qQqlqjo.exe
  2⤵
  PID:8536
- C:\Windows\System\aEGQWNs.exe
  C:\Windows\System\aEGQWNs.exe
  2⤵
  PID:8280
- C:\Windows\System\SuZfhyz.exe
  C:\Windows\System\SuZfhyz.exe
  2⤵
  PID:8220
- C:\Windows\System\BdWIhVj.exe
  C:\Windows\System\BdWIhVj.exe
  2⤵
  PID:8408
- C:\Windows\System\nnYhsbQ.exe
  C:\Windows\System\nnYhsbQ.exe
  2⤵
  PID:8304
- C:\Windows\System\UcWSiOG.exe
  C:\Windows\System\UcWSiOG.exe
  2⤵
  PID:8736
- C:\Windows\System\adBxyIl.exe
  C:\Windows\System\adBxyIl.exe
  2⤵
  PID:8204
- C:\Windows\System\TsezuDq.exe
  C:\Windows\System\TsezuDq.exe
  2⤵
  PID:8260
- C:\Windows\System\XbUEWSy.exe
  C:\Windows\System\XbUEWSy.exe
  2⤵
  PID:8788
- C:\Windows\System\XClvhqR.exe
  C:\Windows\System\XClvhqR.exe
  2⤵
  PID:8968
- C:\Windows\System\vghFKbu.exe
  C:\Windows\System\vghFKbu.exe
  2⤵
  PID:8944
- C:\Windows\System\HaktRZC.exe
  C:\Windows\System\HaktRZC.exe
  2⤵
  PID:8776
- C:\Windows\System\oDqAYxO.exe
  C:\Windows\System\oDqAYxO.exe
  2⤵
  PID:8808
- C:\Windows\System\JKEQclp.exe
  C:\Windows\System\JKEQclp.exe
  2⤵
  PID:8836
- C:\Windows\System\mCfLXaC.exe
  C:\Windows\System\mCfLXaC.exe
  2⤵
  PID:8948
- C:\Windows\System\mGmKgNr.exe
  C:\Windows\System\mGmKgNr.exe
  2⤵
  PID:9172
- C:\Windows\System\ztEABvk.exe
  C:\Windows\System\ztEABvk.exe
  2⤵
  PID:9168
- C:\Windows\System\RaCeQYk.exe
  C:\Windows\System\RaCeQYk.exe
  2⤵
  PID:8900
- C:\Windows\System\JxiTjrs.exe
  C:\Windows\System\JxiTjrs.exe
  2⤵
  PID:2020
- C:\Windows\System\JJdNpmw.exe
  C:\Windows\System\JJdNpmw.exe
  2⤵
  PID:8520
- C:\Windows\System\IZTXClC.exe
  C:\Windows\System\IZTXClC.exe
  2⤵
  PID:2760
- C:\Windows\System\oVuArtP.exe
  C:\Windows\System\oVuArtP.exe
  2⤵
  PID:8308
- C:\Windows\System\XuhNvBe.exe
  C:\Windows\System\XuhNvBe.exe
  2⤵
  PID:8616
- C:\Windows\System\beRyNWS.exe
  C:\Windows\System\beRyNWS.exe
  2⤵
  PID:9004
- C:\Windows\System\vIFoqvq.exe
  C:\Windows\System\vIFoqvq.exe
  2⤵
  PID:9072
- C:\Windows\System\MyJfeUZ.exe
  C:\Windows\System\MyJfeUZ.exe
  2⤵
  PID:9036
- C:\Windows\System\udMgKfq.exe
  C:\Windows\System\udMgKfq.exe
  2⤵
  PID:8344
- C:\Windows\System\csoeZIR.exe
  C:\Windows\System\csoeZIR.exe
  2⤵
  PID:8568
- C:\Windows\System\puqBSdS.exe
  C:\Windows\System\puqBSdS.exe
  2⤵
  PID:8952
- C:\Windows\System\OWCRPty.exe
  C:\Windows\System\OWCRPty.exe
  2⤵
  PID:2140
- C:\Windows\System\YPceekQ.exe
  C:\Windows\System\YPceekQ.exe
  2⤵
  PID:8624
- C:\Windows\System\NxFTkqG.exe
  C:\Windows\System\NxFTkqG.exe
  2⤵
  PID:8740
- C:\Windows\System\BvnpFeZ.exe
  C:\Windows\System\BvnpFeZ.exe
  2⤵
  PID:8892
- C:\Windows\System\jHPRTRQ.exe
  C:\Windows\System\jHPRTRQ.exe
  2⤵
  PID:8964
- C:\Windows\System\hYCAYDV.exe
  C:\Windows\System\hYCAYDV.exe
  2⤵
  PID:9232
- C:\Windows\System\JTTfSjw.exe
  C:\Windows\System\JTTfSjw.exe
  2⤵
  PID:9248
- C:\Windows\System\goBjPDQ.exe
  C:\Windows\System\goBjPDQ.exe
  2⤵
  PID:9264
- C:\Windows\System\KpbdyMw.exe
  C:\Windows\System\KpbdyMw.exe
  2⤵
  PID:9284
- C:\Windows\System\hhDMfnC.exe
  C:\Windows\System\hhDMfnC.exe
  2⤵
  PID:9300
- C:\Windows\System\OrdeRgN.exe
  C:\Windows\System\OrdeRgN.exe
  2⤵
  PID:9356
- C:\Windows\System\QpoTQjr.exe
  C:\Windows\System\QpoTQjr.exe
  2⤵
  PID:9376
- C:\Windows\System\vjGAKQz.exe
  C:\Windows\System\vjGAKQz.exe
  2⤵
  PID:9392
- C:\Windows\System\ZAliqRm.exe
  C:\Windows\System\ZAliqRm.exe
  2⤵
  PID:9424
- C:\Windows\System\vrHDQqN.exe
  C:\Windows\System\vrHDQqN.exe
  2⤵
  PID:9440
- C:\Windows\System\GewGlFZ.exe
  C:\Windows\System\GewGlFZ.exe
  2⤵
  PID:9460
- C:\Windows\System\YujUuFa.exe
  C:\Windows\System\YujUuFa.exe
  2⤵
  PID:9476
- C:\Windows\System\FkBScng.exe
  C:\Windows\System\FkBScng.exe
  2⤵
  PID:9492
- C:\Windows\System\afKLrKU.exe
  C:\Windows\System\afKLrKU.exe
  2⤵
  PID:9696
- C:\Windows\System\AMqwSBI.exe
  C:\Windows\System\AMqwSBI.exe
  2⤵
  PID:9712
- C:\Windows\System\UweyHud.exe
  C:\Windows\System\UweyHud.exe
  2⤵
  PID:9728
- C:\Windows\System\lBdtMpA.exe
  C:\Windows\System\lBdtMpA.exe
  2⤵
  PID:9744
- C:\Windows\System\XtOkCCT.exe
  C:\Windows\System\XtOkCCT.exe
  2⤵
  PID:9760
- C:\Windows\System\xUdXsSt.exe
  C:\Windows\System\xUdXsSt.exe
  2⤵
  PID:9776
- C:\Windows\System\sGMvFqA.exe
  C:\Windows\System\sGMvFqA.exe
  2⤵
  PID:9792
- C:\Windows\System\gAEnzJg.exe
  C:\Windows\System\gAEnzJg.exe
  2⤵
  PID:9808
- C:\Windows\System\FaVoZIx.exe
  C:\Windows\System\FaVoZIx.exe
  2⤵
  PID:9916
- C:\Windows\System\WfnmhtL.exe
  C:\Windows\System\WfnmhtL.exe
  2⤵
  PID:9936
- C:\Windows\System\BsmMyXa.exe
  C:\Windows\System\BsmMyXa.exe
  2⤵
  PID:9952
- C:\Windows\System\QpBsHjX.exe
  C:\Windows\System\QpBsHjX.exe
  2⤵
  PID:9968
- C:\Windows\System\AlKqpgm.exe
  C:\Windows\System\AlKqpgm.exe
  2⤵
  PID:9984
- C:\Windows\System\ogrBpnr.exe
  C:\Windows\System\ogrBpnr.exe
  2⤵
  PID:10024
- C:\Windows\System\JXUixoN.exe
  C:\Windows\System\JXUixoN.exe
  2⤵
  PID:10040
- C:\Windows\System\CXNtGeb.exe
  C:\Windows\System\CXNtGeb.exe
  2⤵
  PID:10056
- C:\Windows\System\vTUYJrv.exe
  C:\Windows\System\vTUYJrv.exe
  2⤵
  PID:10072
- C:\Windows\System\AbbTpBS.exe
  C:\Windows\System\AbbTpBS.exe
  2⤵
  PID:10088
- C:\Windows\System\Qmwcxiv.exe
  C:\Windows\System\Qmwcxiv.exe
  2⤵
  PID:10104
- C:\Windows\System\NIaGclQ.exe
  C:\Windows\System\NIaGclQ.exe
  2⤵
  PID:10120
- C:\Windows\System\ywPtLXE.exe
  C:\Windows\System\ywPtLXE.exe
  2⤵
  PID:10136
- C:\Windows\System\VWBRmHr.exe
  C:\Windows\System\VWBRmHr.exe
  2⤵
  PID:10152
- C:\Windows\System\beOuDIJ.exe
  C:\Windows\System\beOuDIJ.exe
  2⤵
  PID:10168
- C:\Windows\System\DAXNIni.exe
  C:\Windows\System\DAXNIni.exe
  2⤵
  PID:10184
- C:\Windows\System\LLxvjuf.exe
  C:\Windows\System\LLxvjuf.exe
  2⤵
  PID:10200
- C:\Windows\System\mHwFurl.exe
  C:\Windows\System\mHwFurl.exe
  2⤵
  PID:10220
- C:\Windows\System\rMrnodz.exe
  C:\Windows\System\rMrnodz.exe
  2⤵
  PID:7600
- C:\Windows\System\ySrjWfG.exe
  C:\Windows\System\ySrjWfG.exe
  2⤵
  PID:9276
- C:\Windows\System\hPXvIEk.exe
  C:\Windows\System\hPXvIEk.exe
  2⤵
  PID:9320
- C:\Windows\System\AQVwrLA.exe
  C:\Windows\System\AQVwrLA.exe
  2⤵
  PID:9336
- C:\Windows\System\IjGfRxU.exe
  C:\Windows\System\IjGfRxU.exe
  2⤵
  PID:9352
- C:\Windows\System\NZELyds.exe
  C:\Windows\System\NZELyds.exe
  2⤵
  PID:9144
- C:\Windows\System\FJzmNut.exe
  C:\Windows\System\FJzmNut.exe
  2⤵
  PID:8476
- C:\Windows\System\OdyxFoy.exe
  C:\Windows\System\OdyxFoy.exe
  2⤵
  PID:9192
- C:\Windows\System\tvfkYPY.exe
  C:\Windows\System\tvfkYPY.exe
  2⤵
  PID:8556
- C:\Windows\System\rpybDDl.exe
  C:\Windows\System\rpybDDl.exe
  2⤵
  PID:9204
- C:\Windows\System\SPsHqKY.exe
  C:\Windows\System\SPsHqKY.exe
  2⤵
  PID:9180
- C:\Windows\System\ySQNAWx.exe
  C:\Windows\System\ySQNAWx.exe
  2⤵
  PID:8480
- C:\Windows\System\hdeQFHv.exe
  C:\Windows\System\hdeQFHv.exe
  2⤵
  PID:8756
- C:\Windows\System\WkHqfdh.exe
  C:\Windows\System\WkHqfdh.exe
  2⤵
  PID:8720
- C:\Windows\System\YpQYBPE.exe
  C:\Windows\System\YpQYBPE.exe
  2⤵
  PID:9160
- C:\Windows\System\odChoFv.exe
  C:\Windows\System\odChoFv.exe
  2⤵
  PID:9256
- C:\Windows\System\CDZilLV.exe
  C:\Windows\System\CDZilLV.exe
  2⤵
  PID:9296
- C:\Windows\System\YYsSlOt.exe
  C:\Windows\System\YYsSlOt.exe
  2⤵
  PID:7460
- C:\Windows\System\YDkBCMg.exe
  C:\Windows\System\YDkBCMg.exe
  2⤵
  PID:8328
- C:\Windows\System\SjaPwsC.exe
  C:\Windows\System\SjaPwsC.exe
  2⤵
  PID:9196
- C:\Windows\System\DaBAiCv.exe
  C:\Windows\System\DaBAiCv.exe
  2⤵
  PID:8252
- C:\Windows\System\colObyv.exe
  C:\Windows\System\colObyv.exe
  2⤵
  PID:9468
- C:\Windows\System\gemIupY.exe
  C:\Windows\System\gemIupY.exe
  2⤵
  PID:9488
- C:\Windows\System\yrWjkdn.exe
  C:\Windows\System\yrWjkdn.exe
  2⤵
  PID:9408
- C:\Windows\System\pKkrvdb.exe
  C:\Windows\System\pKkrvdb.exe
  2⤵
  PID:9448
- C:\Windows\System\wXXmVpv.exe
  C:\Windows\System\wXXmVpv.exe
  2⤵
  PID:9500
- C:\Windows\System\vGaCFOs.exe
  C:\Windows\System\vGaCFOs.exe
  2⤵
  PID:9516
- C:\Windows\System\hekUIAo.exe
  C:\Windows\System\hekUIAo.exe
  2⤵
  PID:9536
- C:\Windows\System\ZwlWXMS.exe
  C:\Windows\System\ZwlWXMS.exe
  2⤵
  PID:9552
- C:\Windows\System\ladzgKh.exe
  C:\Windows\System\ladzgKh.exe
  2⤵
  PID:9708
- C:\Windows\System\ngbkpCq.exe
  C:\Windows\System\ngbkpCq.exe
  2⤵
  PID:9772
- C:\Windows\System\sPATWkP.exe
  C:\Windows\System\sPATWkP.exe
  2⤵
  PID:9572
- C:\Windows\System\lgVRdNH.exe
  C:\Windows\System\lgVRdNH.exe
  2⤵
  PID:9588
- C:\Windows\System\Pqkwuhd.exe
  C:\Windows\System\Pqkwuhd.exe
  2⤵
  PID:9604
- C:\Windows\System\nimcqss.exe
  C:\Windows\System\nimcqss.exe
  2⤵
  PID:9636
- C:\Windows\System\Clufrtg.exe
  C:\Windows\System\Clufrtg.exe
  2⤵
  PID:9652
- C:\Windows\System\FCBWhtX.exe
  C:\Windows\System\FCBWhtX.exe
  2⤵
  PID:9668
- C:\Windows\System\cUobULG.exe
  C:\Windows\System\cUobULG.exe
  2⤵
  PID:9628
- C:\Windows\System\UysIcEz.exe
  C:\Windows\System\UysIcEz.exe
  2⤵
  PID:9720
- C:\Windows\System\WZmmqMK.exe
  C:\Windows\System\WZmmqMK.exe
  2⤵
  PID:9784
- C:\Windows\System\IXXFgYt.exe
  C:\Windows\System\IXXFgYt.exe
  2⤵
  PID:9824
- C:\Windows\System\HmlzcrU.exe
  C:\Windows\System\HmlzcrU.exe
  2⤵
  PID:9928
- C:\Windows\System\PgDzEai.exe
  C:\Windows\System\PgDzEai.exe
  2⤵
  PID:9992
- C:\Windows\System\GxUdKQO.exe
  C:\Windows\System\GxUdKQO.exe
  2⤵
  PID:9848
- C:\Windows\System\PCmEDpj.exe
  C:\Windows\System\PCmEDpj.exe
  2⤵
  PID:9864
- C:\Windows\System\uQnfWAw.exe
  C:\Windows\System\uQnfWAw.exe
  2⤵
  PID:9880
- C:\Windows\System\PHfkaks.exe
  C:\Windows\System\PHfkaks.exe
  2⤵
  PID:9896
- C:\Windows\System\hToKmDN.exe
  C:\Windows\System\hToKmDN.exe
  2⤵
  PID:9944
- C:\Windows\System\aBDEYHg.exe
  C:\Windows\System\aBDEYHg.exe
  2⤵
  PID:10036
- C:\Windows\System\VwTxqvT.exe
  C:\Windows\System\VwTxqvT.exe
  2⤵
  PID:10100
- C:\Windows\System\CHfAFLi.exe
  C:\Windows\System\CHfAFLi.exe
  2⤵
  PID:10000
- C:\Windows\System\SmykVpv.exe
  C:\Windows\System\SmykVpv.exe
  2⤵
  PID:10012
- C:\Windows\System\YdLgvqA.exe
  C:\Windows\System\YdLgvqA.exe
  2⤵
  PID:10080
- C:\Windows\System\tswdIiy.exe
  C:\Windows\System\tswdIiy.exe
  2⤵
  PID:10116
- C:\Windows\System\FoaRqez.exe
  C:\Windows\System\FoaRqez.exe
  2⤵
  PID:10196
- C:\Windows\System\ZTsWFdn.exe
  C:\Windows\System\ZTsWFdn.exe
  2⤵
  PID:9344
- C:\Windows\System\XOPQSdS.exe
  C:\Windows\System\XOPQSdS.exe
  2⤵
  PID:9292
- C:\Windows\System\NtOKrWe.exe
  C:\Windows\System\NtOKrWe.exe
  2⤵
  PID:9244
- C:\Windows\System\LwooHvU.exe
  C:\Windows\System\LwooHvU.exe
  2⤵
  PID:9212
- C:\Windows\System\IwVWHpe.exe
  C:\Windows\System\IwVWHpe.exe
  2⤵
  PID:8804
- C:\Windows\System\aBTRZOL.exe
  C:\Windows\System\aBTRZOL.exe
  2⤵
  PID:10216
- C:\Windows\System\VANTzyK.exe
  C:\Windows\System\VANTzyK.exe
  2⤵
  PID:9328
- C:\Windows\System\FKyjtyQ.exe
  C:\Windows\System\FKyjtyQ.exe
  2⤵
  PID:8512
- C:\Windows\System\AABkvgG.exe
  C:\Windows\System\AABkvgG.exe
  2⤵
  PID:9164
- C:\Windows\System\UAksUKl.exe
  C:\Windows\System\UAksUKl.exe
  2⤵
  PID:7864
- C:\Windows\System\vAcpiXn.exe
  C:\Windows\System\vAcpiXn.exe
  2⤵
  PID:9228
- C:\Windows\System\HVDjsmk.exe
  C:\Windows\System\HVDjsmk.exe
  2⤵
  PID:9388
- C:\Windows\System\thXULhP.exe
  C:\Windows\System\thXULhP.exe
  2⤵
  PID:9548
- C:\Windows\System\LOkcXRO.exe
  C:\Windows\System\LOkcXRO.exe
  2⤵
  PID:9584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AcMUxUQ.exe

Filesize
1.9MB

MD5
c45dc8a3649caa5f2a4e5d2b6c6d4f5b

SHA1
34e6de39d70b13cdac0fac97bc88f8b87205d4db

SHA256
0b571ca7aa9c90a3a03bc0d717ca2b60e9415744491cfd44f711cad138d5a516

SHA512
8a5c7c163d92240474537b2686692c9439bd582378316248ffda2853c5f46381e6fcd56585315572a4222d51f00358863f6a18e6cea8f9c741bab2b597b6d9ee

Download Submit
C:\Windows\system\BfxjPyF.exe

Filesize
1.9MB

MD5
3dc6e6443accf7908f0a679bbc3db535

SHA1
ecae6811f9a83b34e3720de8e4605526ffdabed8

SHA256
e4dbe4ab9d69fc2f4f8d17d24c4b87b6f271dded4a92305b5ea86f91687d0d0d

SHA512
0102b1b840f7e6c3ee46c03f4624e66929904fe3744a8f8ffb37d5ceae5990245a404c50a9e76e73eff556f19e767e195100fed14abdb0221b9cd1121e11ab7c

Download Submit
C:\Windows\system\CCfmnCM.exe

Filesize
1.9MB

MD5
668a2da4dce50de6878107b9a1ae6dd9

SHA1
e9b805bf5ed996669295cc19c74272d4e17ab670

SHA256
3070e9702b3ca8911f05d1056118ec4550160152dd7f109199e1fea0a6b649ea

SHA512
70039639c4b7e8fe83d477adb0f68044b3e0b8eb2c7341fecdf818abed750b973c3e5246bd99cb4bc2eabdff0213dee827375499e3359439baa948a81c6d6a30

Download Submit
C:\Windows\system\CrKSJnN.exe

Filesize
1.9MB

MD5
4224cb82315a0105be23c849b7006fa8

SHA1
3ae4fdbed0915f3016b8777c859d4d28fa0cca65

SHA256
67c72ae37c816333829d8cb0f2cf4e6d9f408a02123252c75e88abdfe15f2b7c

SHA512
f6c7939a8bb8a69cedcab98f0597e42b61ad67300de5c70b722f9645459f387386da11b54b545ad2e7f0e659a52ddb5af5cf1ff9594da8a537dd4c00940cd5a3

Download Submit
C:\Windows\system\DdpFwzE.exe

Filesize
1.9MB

MD5
11eafd9201a188d2ec3e0320e954971d

SHA1
e04eb56ce15445430f86e6aba928b0c34ed4c91a

SHA256
680d3d76f3f1c44d23a5d20f25d43f9c3dcd703890f201929e6260ec84f01c45

SHA512
75fd2d270e05aab282ecc900ea31254e2733263d6d675ea30b3059705ee05cdeb827422bdecc940aa6ca6a5ff6a5ee34b5d0ebb2ba3c9ea3c984d9736d0f57d2

Download Submit
C:\Windows\system\GTzaBju.exe

Filesize
1.9MB

MD5
c660f5fc1e9314ebe35f96cea03b199e

SHA1
2b7345628020bbda2ba743b377c22fbfa2849d59

SHA256
18697c577992f291d83aefebc178245a7247d0bd46a506c30d332cb8a1400f3b

SHA512
1236e8b8f87baf473bbc2effc5737edd6b31be278795731f6430ad68a55263c939ee1239ded5ee012deb7762deeb1c06c4d384164a85c13b1d41ecb49c117776

Download Submit
C:\Windows\system\JDXdvJe.exe

Filesize
1.9MB

MD5
daacd48401d4b238d83b923c52a25538

SHA1
819df7a9b5c3e185848c3d2c1fbe27a04d9be466

SHA256
4c3d20b5fa9d275a3229f8a27c482624bc1ccba7f064fbc8cc7d008669b4593b

SHA512
f26685de7bc026948fe22b75bcf2215518582197feafc56f424510c2eb1195d800dcf301fbf34e041a25803ba0018d93f498d1c4da46c13949dd369b5695e42c

Download Submit
C:\Windows\system\LIdPFzk.exe

Filesize
1.9MB

MD5
dce360678780f82e46ceaa417f1bd22a

SHA1
9f1e0331e10cd0e8804382623fd586419fdab776

SHA256
9dbe6c0ff97acca9fdbe2507dde554cc357b2c5a3e448d66f7fb6113f091a5d2

SHA512
dd815db7d6b12596004587f28a846823512d711bacf77990c6a72c0512d0942a060ae75beb3867ca0468f98c0af4417db48f180b655b5bc046a8fe0290e15e69

Download Submit
C:\Windows\system\MklioWy.exe

Filesize
1.9MB

MD5
7cfdf73061b4314c5889a32ea2849e64

SHA1
abcd5dd405f59a527d726f3f15aeb2cbcdda1fc2

SHA256
9a7e4841e2c89b4997e8f47d113390ee06341efda1c21fe9f54e8497f714b949

SHA512
a16247069030d9cdbc8fc75f457745fa148afd70451e37f4c7b5423eeecff77db3f1089dc1f7eb7f90ed6ff0cd70129b56ae04b122b8768b2075e6ea167338a1

Download Submit
C:\Windows\system\QoUUXNs.exe

Filesize
1.9MB

MD5
07eae3ce1f194618e49eee5f19452d78

SHA1
e2dbc9701a37826650e51e3a26559385bf421ddb

SHA256
5ac38accec0963cfc1978b165f49275d38df60f8fcac216ae87238c49e21ac6e

SHA512
66da4a532da2748b92a5e4c6b9264eb3c4ead9aa42a5169f49dcb0efb6095cac9d46db36e4cac75ed91daafa67c80a4a7af162bcffbfdbdaa95c6acca143b260

Download Submit
C:\Windows\system\SNtHeHl.exe

Filesize
1.9MB

MD5
7ff253a7ac460207cc41e701d27ab793

SHA1
fe6890bea116779e488ec9cc4500f0a4f6f504c7

SHA256
0ea41b167d5b5c4bb8fec29cdfa444b4ce3e24de3de667fa2913a97eb28ed9d5

SHA512
a34a9f9deda8988ef8f068f433b687904d11d34da56b8360b41fd67a8a6e374f99b115528c1bc2d807c21a9fb138a86ef7523c617abcf2a129358fe659d1eabe

Download Submit
C:\Windows\system\bLaodoo.exe

Filesize
1.9MB

MD5
8f76fa52864bf8687e42ac1584402cd3

SHA1
2ce8348d0001108c2ecdbdab76a6f4447d068efc

SHA256
6711f0d74c6baf1bc7e623998db96c02bfc6e392e4fcfd688905662464f25b26

SHA512
0069f6fb108eb38a3b2a070566420490cf67582361544472d0ed2b7e6019bdf806a3c7791448ea6b5e680620736f4958bf421db0cbd35593b703ce9ec905b73b

Download Submit
C:\Windows\system\cqqlTbB.exe

Filesize
1.9MB

MD5
cad73054bf4d2093d20ce2c4e129a188

SHA1
a60dbdb34cd0e9fc7fb739c89a5909d2006c9790

SHA256
cce0f722e5351424a57933ada0a15140f6bdaa699cae0cddc7862e602fe63490

SHA512
20dce44abfd148202b4a0f5ffdce234eb912de0b59b7bd38d3fc6d7c4de333ee933cb89cf429352d85679df6675411c24ad47763cc7e1f51efebbff361e729be

Download Submit
C:\Windows\system\cvAFVAZ.exe

Filesize
1.9MB

MD5
ba9630eaf927b331e59209aff3d1f67c

SHA1
7095ce2ddd93c33e588fe06d170e922dbd4c2b8d

SHA256
62c769fce98fcd8db73151ea9351f83dc314634d7588f538093da9cdc6538d3e

SHA512
ef4cd100cc722b4f8f6d6d6e3023fd8101f48d5fcdb93f529eb18bf243ab94340792ee033b76ab966824506d1948968b59a7337537fd47d6f0741374b5d27ba4

Download Submit
C:\Windows\system\dSDFkSN.exe

Filesize
1.9MB

MD5
fd781297180396bf1536e1dd6050ae2c

SHA1
30b9016e3170cd6fabe9b6ab054cdf8fa49753ff

SHA256
f8912cb6587bef071674eecaffb2589b664284c5b47536e3ef5dca8a94e3959e

SHA512
5c7ce8f11a35591a594b2f216421d123c8e8e1f2694a27295bd57d0b9f5b03a453fec4e974ac389d2c97357b52879d2009f3a95d55dee6d0545eab728a1009a2

Download Submit
C:\Windows\system\hzkYEpO.exe

Filesize
1.9MB

MD5
06f61b2ecbb90588483ff58412aca3b9

SHA1
b6a9207dafc95c7512cc2a406ead02dce3cef221

SHA256
0147f2e05b7d7ee13361552cbe6c1b868b5c145cbfbee04113a795b6731ad5c4

SHA512
09853cdd6b0ab746ba08a7315f1992a6f637f8c350edad7cf58ef0bbce06886aea6f590597e79cc7e445585a7f9cc31ef340a6707cc2e64d7dbc762fd6814a37

Download Submit
C:\Windows\system\jIkJleG.exe

Filesize
1.9MB

MD5
fd1528157606d26441c7aec23c941456

SHA1
3946c093c0ca1016f98477e32d0d1e6d6903aa06

SHA256
54b84c1b7250c31d9cf1c6191bcaaf0c9b7d4b5e74798d33d6f04df140f372ea

SHA512
39843273386dd3c0056865c6fab0c8cffc8ab4524f082511cf8e0aa872b5a3c6d942f2335f7f0d23b5209c2344c398c5fef23e245699ac8864d908a0067b039c

Download Submit
C:\Windows\system\jXUdUiD.exe

Filesize
1.9MB

MD5
696eff2695593c09e54d5d091ae61405

SHA1
32e7a93edd640cd84c3bec4e1d35869668cc6487

SHA256
155945dd5a5a6072c79a2b024a4ade54c2a5e373b6e73d875f791814f40bbff7

SHA512
da83eb8fbd9559982f045b426028f6dd181de091d4cd6376e281e5f22f91bd5c3e3a2b85fb2bed22c041396c053ec0f8c4950be91f094e735a2477b32174350a

Download Submit
C:\Windows\system\mEXvidc.exe

Filesize
1.9MB

MD5
916ef33e62e47c0ca97315cfc4979819

SHA1
f73e6479664e3b7e65fa8e33130f889d0c0b49e6

SHA256
f5e78a9f45623280526d864e1e31cd837fb5a5dd12639bf25ddd37bc473c00c9

SHA512
f26c52e2944216a747ac899be9b8a9b103fe694b183a2c7324e5a290098084c5922fbf21409355dd758b5ea14ac93b65fce1fcfe3a4992b206d724d759b0d069

Download Submit
C:\Windows\system\nsFfWEN.exe

Filesize
1.9MB

MD5
32f0c3f10d238d9b1ea6aadd8d673ffe

SHA1
ea8abc6a7de2a59a4a46c2b49a50a4925f599a2e

SHA256
30c53c92fab4d79970fad370d9030e7492fa94ff4e0d1ee4be76424b59cca1d9

SHA512
0d159a3847eb588213b453e06fd6ae29902161b4d8c33400769304872571125615f8ce5754e950e3a292a541b5575c9f48fa04773163fc15b40f8e61f3da35f1

Download Submit
C:\Windows\system\nyCZrTG.exe

Filesize
1.9MB

MD5
b23fb1ec8a651a7539a26b503b8d9408

SHA1
3887a742a0e9f9151439220cc57bc31a6662883e

SHA256
7578bde7f7c96213fcfbeee9c95fdc40d864ec7e257338f4b7fb4d153e731b2b

SHA512
7a363ecfc412a2e1afc67a63ef5f536703a89ef2d7730a5069f346272e1f21a8987e46bd72ba210aa4c3d98f3a868f513946b0f06f329159beb3ffc71c77afb9

Download Submit
C:\Windows\system\oqHQkJS.exe

Filesize
1.9MB

MD5
ccb9e312f6ad170d5ed1047be25fb415

SHA1
c747d2c2aa3071fa32639b7892a41fef8dcbc7b6

SHA256
c8bb9d583ecc17daf024ef0b2b4c25516635311e47d7ba829925c107fddd1bd9

SHA512
6e30342ac8b40f4768db4d79836b0b4fcb7f87e2cc964e196ef858ee95aedf5b3be402e9441bcdd59bccaed002fd17ec8af312dc501c0b8821d07df8ea7f0cdc

Download Submit
C:\Windows\system\vmJVefC.exe

Filesize
1.9MB

MD5
ab40b6066e579a352a8ff5d24ea11668

SHA1
416ee9d2e5c7fbd83edb3684c6e480cabf95e55e

SHA256
877920acedebb80438c6756d74f5af6400c4e063d6835e2cd69c109a74dd324c

SHA512
19e7867d0117bc6ac842f5d1d9d70be7796f1a235a1bfe0840fbff5f17c260696caffe1e47c1efd79ac003eacf7729fb99374e2cd001cd611e67358145629141

Download Submit
C:\Windows\system\xWQMgGC.exe

Filesize
1.9MB

MD5
9e1ec751c39d592f0ccc47d48cd5c1ee

SHA1
f2eae4ad537527d00a0ee189d83ddf4f768bf66d

SHA256
a00365bc92fbafce4f20f342836bf158ffcfb52aaef6c0a9197fba8a21eba552

SHA512
41869b56e24467f00df170fb86ff1c789db65ad72751d861db7a2db42264b7831da9b37b2a467bf7b946a570be31cf8debb50606d56d8d9e68c0938381344471

Download Submit
\Windows\system\AFjSbZa.exe

Filesize
1.9MB

MD5
b7b4e1f0087454dc8ac90167c4b917af

SHA1
cf70cc400eabe447cd422279c3c3007abed77e91

SHA256
fe7d293e5e150878511b67cb1900f4a20c01cd1fda630283dd60ae3d6e60020c

SHA512
b78a87059c683277da1b4a4646215734d631259327c9b8125a9604fda8fddbd965c25214ec398698e81e0e7d1cba87d65d770b26de2b2fa4125a00a43ff8b34d

Download Submit
\Windows\system\IaWPZil.exe

Filesize
1.9MB

MD5
5c36f421133d6183fa6effdc3d166bb4

SHA1
73f5f67d8f1e50c86d1d1e94008406e3c8b3ffbf

SHA256
54f6a67c196efacceea389d66772b22848b4a0e19002588baad7bbf1aca8e594

SHA512
7ba24e6f3869837f8df390623fdcd12642d59d5901111d171165d278c3df5503e6511eafd8042d0b52ef34ca421ea4da839ab7e4db09d7d713a5efe9c44ee0dd

Download Submit
\Windows\system\RzmeeQb.exe

Filesize
1.9MB

MD5
b9ffe05d4897dba5a1b341218c500ab2

SHA1
e672aa6b6b49b543ea89f7aebd08ef33bddc553f

SHA256
036de3fc6c2355c21e800f5e69c0c1ec72b82962e105fe4e990b71f11de85e36

SHA512
f1bec8cb0aeb17ef7e4a62a0b30091639fcbc98c4bbd74dd5ccd0e85f5beca1ed7d1f424dfd1121a59b33dc036ae97861640d0af2d33a3437df2f96ce847b70b

Download Submit
\Windows\system\gVNOAMK.exe

Filesize
1.9MB

MD5
5caf0ab8919f7ff21b43e1a796b47e46

SHA1
a54d4025fe607c9a4c71222f407e2ea0b99b06aa

SHA256
4f5bbe85d9afb7ccbdef377f01687f3b3d939f2d7dd4667ee5167850d163bb34

SHA512
4912565c6a6f7723109cbbde8d91925d04a71185096804666b46dd5faf19055a175bb4c0198dde1dd0097492020a149d62047fe66af41a4a1d040fe633d4477d

Download Submit
\Windows\system\nYDPwLx.exe

Filesize
1.9MB

MD5
e6f6f238d63ddc984dc95a441dc43dc0

SHA1
edd46cb93497e4c5f4cfa47720756fe0fbdec9b4

SHA256
2e6f05bd7e2251b45e4ac509359835ce68ac79dd29d16e244e5c07bf8bce29c8

SHA512
a557e54e797dd8f48f479b16b7c2263e17f438766a0ec9de08ca1795e09d3b42be528332cf4698a49a517206fa9d9c961cbc0453e0d6c49e426975fa66d4f089

Download Submit
\Windows\system\ofOdLXx.exe

Filesize
1.9MB

MD5
41d9325dc1cc0567c658f5679bbc22db

SHA1
995d2f1e1cfe2610dc0980fea148585b27de0935

SHA256
0930222a56a8305fc47fd6887d83e02738a80ec7e9aa09726eca72ec40c139ec

SHA512
b6be8077f68f1c98463c5eebd8da5be26a1a650e7d370770fc2554e77048465eca8ce02717c5bb2d4bad261e5855344a69d90243ca23dea7efa8d3a1fd1f9262

Download Submit
\Windows\system\pVPmiNX.exe

Filesize
1.9MB

MD5
512859261a385c14b74c766a0ba3d95f

SHA1
a3d17b81f953d43114044bab83d7b67f32b27351

SHA256
c184c9fb0b93d681229133d025b2e8dbeae9ecd7b535f1105b9b0b467584c98e

SHA512
98efa11b86eab87510f2d453a24954f76baa119c33f7c63574a6c3966c27c9ec679bf46e896c60979edee8f85c020fd7f3ddda1778ffeccfcecee633134baaad

Download Submit
\Windows\system\yNxCDVQ.exe

Filesize
1.9MB

MD5
f2afc90a84fa5d58d9a01bf9d5fe918b

SHA1
1450098ff4f1c073e6a36fa4be81edb71b168e46

SHA256
a1002ca2d45200b8b2612abb4ae1566e610fb75b5bc329ea05e4df2e227e8c53

SHA512
aa38d0eb3dac47bb2affc9e59a804d23c8533d688131eac727691fd1938e5ace5afe6693b1064412aa81ef932a1163e0c5fb75353d2d9fbfe38bc76fd340a75a

Download Submit
memory/1724-100-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1724-2064-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1876-109-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/1876-85-0x00000000023C0000-0x0000000002440000-memory.dmp

Filesize
512KB

Download
memory/1876-35-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/1876-36-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/1876-84-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/1876-115-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/2052-288-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2052-2058-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2052-9-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2184-107-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2184-99-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-103-0x0000000003270000-0x0000000003662000-memory.dmp

Filesize
3.9MB

Download
memory/2184-104-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2184-7-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2184-101-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2184-287-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2184-92-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2184-89-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2184-0-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2184-97-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2184-86-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2400-102-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2400-2063-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2504-106-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-2065-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-90-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2544-2060-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2560-2062-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-96-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-2059-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2568-87-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2592-98-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2592-2061-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2668-2066-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2668-105-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download