xmrig | 70b4067ca684ff786c4cdc78fbe684c409452aff1fc477bc61ba9ea339cf1b6f

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
Size

1.9MB
MD5

07ac84dd2c9536c72a1d2f837eea7bf0
SHA1

9e08e45d3fc6be33fa9bdfb44f0d43b946e23323
SHA256

70b4067ca684ff786c4cdc78fbe684c409452aff1fc477bc61ba9ea339cf1b6f
SHA512

5f4b35013aadf5a9d07555561ef3cb4638eaa50ba7ae28eea3d8eb6c2b7108e96912321a94e5e343e5fb41ee3c463e3fb1ca3514734ea4d9860ae930e8d1b209
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1B:NAB6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2656-34-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/3020-168-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2572-411-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2952-162-0x0000000003480000-0x0000000003872000-memory.dmp	xmrig
behavioral1/memory/2632-118-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2024-91-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2864-80-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2764-79-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2952-78-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/1960-76-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2456-60-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2764	lVnMsaL.exe
2024	HmReSOx.exe
2632	dIsPYPf.exe
2656	YKtuxhm.exe
2572	DACUxJz.exe
1988	SdBcvlG.exe
2456	ecMIcQH.exe
2608	YSAveBu.exe
1960	ogQHHqx.exe
2864	zwaJTJH.exe
3020	RNJjWQs.exe
2092	uDNDTbX.exe
2328	VsTAdBl.exe
2496	BzHZhXE.exe
2692	jaPFTIa.exe
2708	FOeynVn.exe
1684	PNMLMhB.exe
2796	kFpyWhU.exe
2836	AcrnxbV.exe
1792	GgoaAXY.exe
1548	sQPqZtl.exe
1744	oNbbtbB.exe
2420	dzaBsjd.exe
2696	iOyveYI.exe
2320	ArgWfgN.exe
2164	QfPXCzf.exe
2316	eFDotWl.exe
1752	HtuxlWR.exe
2056	EhTZqIp.exe
2020	caURlES.exe
1332	hXuvRUL.exe
2124	zKTijaD.exe
1560	hLHeOYO.exe
1556	DtPvaiC.exe
972	cbXPoCn.exe
780	UGebygM.exe
968	rldNgKx.exe
1028	KFQfXHQ.exe
2372	CmrXADE.exe
1040	QMxaXTN.exe
932	qNqMYgx.exe
632	KmEnZfu.exe
2344	huuJOZJ.exe
2896	IBJshgf.exe
572	iyWqQRk.exe
2348	UhmeczX.exe
548	DnwVCgE.exe
768	BCIsqqO.exe
1540	lQlZzkw.exe
900	zenpVnp.exe
1920	hiFlqBp.exe
2004	nspmVlY.exe
2300	PGTVBic.exe
1616	HIWzPvM.exe
1704	ejGgwZr.exe
884	PAMZJbj.exe
2652	kgxoLXt.exe
2600	oLxvkTU.exe
2728	BKjpYtG.exe
2604	lLoHQiW.exe
2436	AOdUSGc.exe
1980	lzECJgl.exe
2968	RhicTld.exe
2884	aEbgRpp.exe

Loads dropped DLL 64 IoCs

pid	Process
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2952-0-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x000c0000000155f6-3.dat	upx
behavioral1/files/0x0030000000015c6f-8.dat	upx
behavioral1/files/0x0007000000015cb0-12.dat	upx
behavioral1/files/0x0007000000015cce-21.dat	upx
behavioral1/memory/2764-20-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x0007000000015cbd-19.dat	upx
behavioral1/memory/2572-41-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2656-34-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x0007000000015cd9-42.dat	upx
behavioral1/files/0x001800000000558a-53.dat	upx
behavioral1/memory/1988-49-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2632-32-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2024-28-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x000800000001654a-57.dat	upx
behavioral1/files/0x0006000000016813-69.dat	upx
behavioral1/files/0x0006000000016a6f-84.dat	upx
behavioral1/files/0x002e000000015c85-105.dat	upx
behavioral1/files/0x0006000000016da4-145.dat	upx
behavioral1/files/0x0006000000016d3a-138.dat	upx
behavioral1/files/0x0006000000016d32-132.dat	upx
behavioral1/files/0x0006000000016e78-182.dat	upx
behavioral1/files/0x0006000000016db3-188.dat	upx
behavioral1/files/0x0006000000016d9f-186.dat	upx
behavioral1/memory/3020-168-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2572-411-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0006000000016fe8-194.dat	upx
behavioral1/files/0x0006000000016d1f-179.dat	upx
behavioral1/files/0x0006000000016d0e-177.dat	upx
behavioral1/files/0x0006000000016cfd-166.dat	upx
behavioral1/files/0x0006000000016ce4-164.dat	upx
behavioral1/files/0x0006000000016d16-158.dat	upx
behavioral1/files/0x0006000000016d05-157.dat	upx
behavioral1/files/0x0006000000016cf5-156.dat	upx
behavioral1/files/0x0006000000016c8c-155.dat	upx
behavioral1/files/0x0006000000016c3a-144.dat	upx
behavioral1/files/0x0006000000016d36-135.dat	upx
behavioral1/files/0x0006000000016cb2-114.dat	upx
behavioral1/files/0x0006000000016c42-113.dat	upx
behavioral1/files/0x0006000000016c1d-112.dat	upx
behavioral1/memory/2632-118-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2024-91-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2864-80-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2764-79-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2952-78-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/1960-76-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x00060000000165f0-68.dat	upx
behavioral1/memory/2608-63-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2456-60-0x000000013FE30000-0x0000000140222000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NPXvVzS.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\jZisAvi.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\CQRKQIM.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\ZkdrtUg.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\vVmAGje.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\yKnDwhN.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\dKbTRVJ.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\uXepXUl.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\CkqOcIL.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\lMIhOuM.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\KXEVqlE.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\IGdGDbD.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\ceGHDVd.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\olcRJSw.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\WunZWxB.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\YKtuxhm.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\vwInbMI.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\fLHNVVh.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\CFnAlcM.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\noVVxpw.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\toKuqrv.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\ejGgwZr.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\QPdlhau.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\ZpKoDoh.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\lvPWWjY.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\BwICMiy.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\aBZpnXo.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\bqOiBOp.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\BCIsqqO.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\tDOIRLt.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\zsrvSjb.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\vqGdouA.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\TYNfoVf.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\GfJyuZb.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\DxaguuM.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\FOeynVn.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\yLEWaIZ.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\dRcAhGt.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\KYfkPxA.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\lWpaNar.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\lVnMsaL.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\leOcpnc.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\ibWgrcn.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\xHpnxiz.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\CcJEykl.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\fhQRBXr.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\IlGNlQm.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\CrbSAzA.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\FoSqxtT.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\vcMIcKO.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\Mzeveqs.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\zQYRuFm.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\XmgMQJS.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\lyJBnfL.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\rEGBcDF.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\PlDvaAk.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\YSAveBu.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\JUxVRnv.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\fkKgOXJ.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\JnoWKTa.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\ZjkHBNa.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\wyKwAEy.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\OhHiJOe.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
File created	C:\Windows\System\TiXrnlg.exe	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
764	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
Token: SeDebugPrivilege	764	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 764	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	29
PID 2952 wrote to memory of 764	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	29
PID 2952 wrote to memory of 764	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	29
PID 2952 wrote to memory of 2764	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	30
PID 2952 wrote to memory of 2764	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	30
PID 2952 wrote to memory of 2764	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	30
PID 2952 wrote to memory of 2024	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	31
PID 2952 wrote to memory of 2024	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	31
PID 2952 wrote to memory of 2024	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	31
PID 2952 wrote to memory of 2632	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	32
PID 2952 wrote to memory of 2632	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	32
PID 2952 wrote to memory of 2632	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	32
PID 2952 wrote to memory of 2656	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	33
PID 2952 wrote to memory of 2656	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	33
PID 2952 wrote to memory of 2656	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	33
PID 2952 wrote to memory of 2572	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	34
PID 2952 wrote to memory of 2572	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	34
PID 2952 wrote to memory of 2572	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	34
PID 2952 wrote to memory of 1988	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	35
PID 2952 wrote to memory of 1988	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	35
PID 2952 wrote to memory of 1988	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	35
PID 2952 wrote to memory of 2456	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	36
PID 2952 wrote to memory of 2456	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	36
PID 2952 wrote to memory of 2456	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	36
PID 2952 wrote to memory of 2608	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	37
PID 2952 wrote to memory of 2608	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	37
PID 2952 wrote to memory of 2608	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	37
PID 2952 wrote to memory of 1960	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	38
PID 2952 wrote to memory of 1960	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	38
PID 2952 wrote to memory of 1960	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	38
PID 2952 wrote to memory of 2864	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	39
PID 2952 wrote to memory of 2864	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	39
PID 2952 wrote to memory of 2864	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	39
PID 2952 wrote to memory of 3020	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	40
PID 2952 wrote to memory of 3020	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	40
PID 2952 wrote to memory of 3020	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	40
PID 2952 wrote to memory of 2092	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	41
PID 2952 wrote to memory of 2092	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	41
PID 2952 wrote to memory of 2092	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	41
PID 2952 wrote to memory of 2328	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	42
PID 2952 wrote to memory of 2328	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	42
PID 2952 wrote to memory of 2328	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	42
PID 2952 wrote to memory of 2708	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	43
PID 2952 wrote to memory of 2708	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	43
PID 2952 wrote to memory of 2708	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	43
PID 2952 wrote to memory of 2496	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	44
PID 2952 wrote to memory of 2496	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	44
PID 2952 wrote to memory of 2496	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	44
PID 2952 wrote to memory of 1684	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	45
PID 2952 wrote to memory of 1684	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	45
PID 2952 wrote to memory of 1684	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	45
PID 2952 wrote to memory of 2692	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	46
PID 2952 wrote to memory of 2692	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	46
PID 2952 wrote to memory of 2692	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	46
PID 2952 wrote to memory of 2696	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	47
PID 2952 wrote to memory of 2696	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	47
PID 2952 wrote to memory of 2696	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	47
PID 2952 wrote to memory of 2796	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	48
PID 2952 wrote to memory of 2796	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	48
PID 2952 wrote to memory of 2796	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	48
PID 2952 wrote to memory of 2320	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	49
PID 2952 wrote to memory of 2320	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	49
PID 2952 wrote to memory of 2320	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	49
PID 2952 wrote to memory of 2836	2952	07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07ac84dd2c9536c72a1d2f837eea7bf0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\System\lVnMsaL.exe
  C:\Windows\System\lVnMsaL.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\HmReSOx.exe
  C:\Windows\System\HmReSOx.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\dIsPYPf.exe
  C:\Windows\System\dIsPYPf.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\YKtuxhm.exe
  C:\Windows\System\YKtuxhm.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\DACUxJz.exe
  C:\Windows\System\DACUxJz.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\SdBcvlG.exe
  C:\Windows\System\SdBcvlG.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ecMIcQH.exe
  C:\Windows\System\ecMIcQH.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\YSAveBu.exe
  C:\Windows\System\YSAveBu.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ogQHHqx.exe
  C:\Windows\System\ogQHHqx.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\zwaJTJH.exe
  C:\Windows\System\zwaJTJH.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\RNJjWQs.exe
  C:\Windows\System\RNJjWQs.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\uDNDTbX.exe
  C:\Windows\System\uDNDTbX.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\VsTAdBl.exe
  C:\Windows\System\VsTAdBl.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\FOeynVn.exe
  C:\Windows\System\FOeynVn.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\BzHZhXE.exe
  C:\Windows\System\BzHZhXE.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\PNMLMhB.exe
  C:\Windows\System\PNMLMhB.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\jaPFTIa.exe
  C:\Windows\System\jaPFTIa.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\iOyveYI.exe
  C:\Windows\System\iOyveYI.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\kFpyWhU.exe
  C:\Windows\System\kFpyWhU.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ArgWfgN.exe
  C:\Windows\System\ArgWfgN.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\AcrnxbV.exe
  C:\Windows\System\AcrnxbV.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\QfPXCzf.exe
  C:\Windows\System\QfPXCzf.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\GgoaAXY.exe
  C:\Windows\System\GgoaAXY.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\eFDotWl.exe
  C:\Windows\System\eFDotWl.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\sQPqZtl.exe
  C:\Windows\System\sQPqZtl.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\EhTZqIp.exe
  C:\Windows\System\EhTZqIp.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\oNbbtbB.exe
  C:\Windows\System\oNbbtbB.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\caURlES.exe
  C:\Windows\System\caURlES.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\dzaBsjd.exe
  C:\Windows\System\dzaBsjd.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\hXuvRUL.exe
  C:\Windows\System\hXuvRUL.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\HtuxlWR.exe
  C:\Windows\System\HtuxlWR.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\zKTijaD.exe
  C:\Windows\System\zKTijaD.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\hLHeOYO.exe
  C:\Windows\System\hLHeOYO.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\DtPvaiC.exe
  C:\Windows\System\DtPvaiC.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\cbXPoCn.exe
  C:\Windows\System\cbXPoCn.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\UGebygM.exe
  C:\Windows\System\UGebygM.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\rldNgKx.exe
  C:\Windows\System\rldNgKx.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\KFQfXHQ.exe
  C:\Windows\System\KFQfXHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\CmrXADE.exe
  C:\Windows\System\CmrXADE.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\QMxaXTN.exe
  C:\Windows\System\QMxaXTN.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\qNqMYgx.exe
  C:\Windows\System\qNqMYgx.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\KmEnZfu.exe
  C:\Windows\System\KmEnZfu.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\huuJOZJ.exe
  C:\Windows\System\huuJOZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\IBJshgf.exe
  C:\Windows\System\IBJshgf.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\iyWqQRk.exe
  C:\Windows\System\iyWqQRk.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\UhmeczX.exe
  C:\Windows\System\UhmeczX.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\DnwVCgE.exe
  C:\Windows\System\DnwVCgE.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\BCIsqqO.exe
  C:\Windows\System\BCIsqqO.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\lQlZzkw.exe
  C:\Windows\System\lQlZzkw.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\zenpVnp.exe
  C:\Windows\System\zenpVnp.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\hiFlqBp.exe
  C:\Windows\System\hiFlqBp.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\nspmVlY.exe
  C:\Windows\System\nspmVlY.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\PGTVBic.exe
  C:\Windows\System\PGTVBic.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\HIWzPvM.exe
  C:\Windows\System\HIWzPvM.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\ejGgwZr.exe
  C:\Windows\System\ejGgwZr.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\PAMZJbj.exe
  C:\Windows\System\PAMZJbj.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\kgxoLXt.exe
  C:\Windows\System\kgxoLXt.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\oLxvkTU.exe
  C:\Windows\System\oLxvkTU.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\BKjpYtG.exe
  C:\Windows\System\BKjpYtG.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\lLoHQiW.exe
  C:\Windows\System\lLoHQiW.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\AOdUSGc.exe
  C:\Windows\System\AOdUSGc.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\lzECJgl.exe
  C:\Windows\System\lzECJgl.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\RhicTld.exe
  C:\Windows\System\RhicTld.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\aEbgRpp.exe
  C:\Windows\System\aEbgRpp.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\fWupkrw.exe
  C:\Windows\System\fWupkrw.exe
  2⤵
  PID:1276
- C:\Windows\System\bfckeoA.exe
  C:\Windows\System\bfckeoA.exe
  2⤵
  PID:2424
- C:\Windows\System\OyeoLNf.exe
  C:\Windows\System\OyeoLNf.exe
  2⤵
  PID:2848
- C:\Windows\System\toKuqrv.exe
  C:\Windows\System\toKuqrv.exe
  2⤵
  PID:1636
- C:\Windows\System\BJCKdli.exe
  C:\Windows\System\BJCKdli.exe
  2⤵
  PID:2540
- C:\Windows\System\kTUeHqh.exe
  C:\Windows\System\kTUeHqh.exe
  2⤵
  PID:1644
- C:\Windows\System\etOeKRc.exe
  C:\Windows\System\etOeKRc.exe
  2⤵
  PID:2116
- C:\Windows\System\sDhzuTu.exe
  C:\Windows\System\sDhzuTu.exe
  2⤵
  PID:2248
- C:\Windows\System\LFlPNrS.exe
  C:\Windows\System\LFlPNrS.exe
  2⤵
  PID:1736
- C:\Windows\System\lRMKDJS.exe
  C:\Windows\System\lRMKDJS.exe
  2⤵
  PID:2464
- C:\Windows\System\OuRCwri.exe
  C:\Windows\System\OuRCwri.exe
  2⤵
  PID:856
- C:\Windows\System\ggnKwcx.exe
  C:\Windows\System\ggnKwcx.exe
  2⤵
  PID:1288
- C:\Windows\System\yQWreFY.exe
  C:\Windows\System\yQWreFY.exe
  2⤵
  PID:324
- C:\Windows\System\SvjiEFs.exe
  C:\Windows\System\SvjiEFs.exe
  2⤵
  PID:1212
- C:\Windows\System\fWShYXK.exe
  C:\Windows\System\fWShYXK.exe
  2⤵
  PID:2932
- C:\Windows\System\igsrMaY.exe
  C:\Windows\System\igsrMaY.exe
  2⤵
  PID:2924
- C:\Windows\System\gqWVPZA.exe
  C:\Windows\System\gqWVPZA.exe
  2⤵
  PID:1860
- C:\Windows\System\toKCGaF.exe
  C:\Windows\System\toKCGaF.exe
  2⤵
  PID:1236
- C:\Windows\System\OVfigJc.exe
  C:\Windows\System\OVfigJc.exe
  2⤵
  PID:1572
- C:\Windows\System\OOPXFgZ.exe
  C:\Windows\System\OOPXFgZ.exe
  2⤵
  PID:1336
- C:\Windows\System\qRbhplk.exe
  C:\Windows\System\qRbhplk.exe
  2⤵
  PID:2920
- C:\Windows\System\BoyrVNf.exe
  C:\Windows\System\BoyrVNf.exe
  2⤵
  PID:1868
- C:\Windows\System\NBPgHPL.exe
  C:\Windows\System\NBPgHPL.exe
  2⤵
  PID:1660
- C:\Windows\System\LjhZwru.exe
  C:\Windows\System\LjhZwru.exe
  2⤵
  PID:1664
- C:\Windows\System\CkqOcIL.exe
  C:\Windows\System\CkqOcIL.exe
  2⤵
  PID:2108
- C:\Windows\System\zorMvEK.exe
  C:\Windows\System\zorMvEK.exe
  2⤵
  PID:2220
- C:\Windows\System\OUEpAPR.exe
  C:\Windows\System\OUEpAPR.exe
  2⤵
  PID:2520
- C:\Windows\System\GbTIncq.exe
  C:\Windows\System\GbTIncq.exe
  2⤵
  PID:1000
- C:\Windows\System\mQORRCN.exe
  C:\Windows\System\mQORRCN.exe
  2⤵
  PID:888
- C:\Windows\System\yjgXTaB.exe
  C:\Windows\System\yjgXTaB.exe
  2⤵
  PID:1928
- C:\Windows\System\oqeUQoM.exe
  C:\Windows\System\oqeUQoM.exe
  2⤵
  PID:1592
- C:\Windows\System\kBTeVNT.exe
  C:\Windows\System\kBTeVNT.exe
  2⤵
  PID:1724
- C:\Windows\System\UHoGwpC.exe
  C:\Windows\System\UHoGwpC.exe
  2⤵
  PID:2544
- C:\Windows\System\sSCNglm.exe
  C:\Windows\System\sSCNglm.exe
  2⤵
  PID:564
- C:\Windows\System\bQVJSyU.exe
  C:\Windows\System\bQVJSyU.exe
  2⤵
  PID:3032
- C:\Windows\System\IkezgSd.exe
  C:\Windows\System\IkezgSd.exe
  2⤵
  PID:2508
- C:\Windows\System\FoSqxtT.exe
  C:\Windows\System\FoSqxtT.exe
  2⤵
  PID:2740
- C:\Windows\System\wyKwAEy.exe
  C:\Windows\System\wyKwAEy.exe
  2⤵
  PID:2888
- C:\Windows\System\gRqHKPv.exe
  C:\Windows\System\gRqHKPv.exe
  2⤵
  PID:2412
- C:\Windows\System\OhHiJOe.exe
  C:\Windows\System\OhHiJOe.exe
  2⤵
  PID:2840
- C:\Windows\System\Dnlxqrv.exe
  C:\Windows\System\Dnlxqrv.exe
  2⤵
  PID:2076
- C:\Windows\System\sBYeJmk.exe
  C:\Windows\System\sBYeJmk.exe
  2⤵
  PID:2296
- C:\Windows\System\lGTeILh.exe
  C:\Windows\System\lGTeILh.exe
  2⤵
  PID:2776
- C:\Windows\System\FYzhhIq.exe
  C:\Windows\System\FYzhhIq.exe
  2⤵
  PID:1604
- C:\Windows\System\ZmhVYOA.exe
  C:\Windows\System\ZmhVYOA.exe
  2⤵
  PID:2288
- C:\Windows\System\XmgMQJS.exe
  C:\Windows\System\XmgMQJS.exe
  2⤵
  PID:1800
- C:\Windows\System\aYhQSom.exe
  C:\Windows\System\aYhQSom.exe
  2⤵
  PID:352
- C:\Windows\System\HfKmulk.exe
  C:\Windows\System\HfKmulk.exe
  2⤵
  PID:1652
- C:\Windows\System\DvrogBC.exe
  C:\Windows\System\DvrogBC.exe
  2⤵
  PID:1656
- C:\Windows\System\TMjVTur.exe
  C:\Windows\System\TMjVTur.exe
  2⤵
  PID:1932
- C:\Windows\System\BbeCimN.exe
  C:\Windows\System\BbeCimN.exe
  2⤵
  PID:328
- C:\Windows\System\tfPDleA.exe
  C:\Windows\System\tfPDleA.exe
  2⤵
  PID:2280
- C:\Windows\System\AZwKxoa.exe
  C:\Windows\System\AZwKxoa.exe
  2⤵
  PID:3044
- C:\Windows\System\cgITwJf.exe
  C:\Windows\System\cgITwJf.exe
  2⤵
  PID:2644
- C:\Windows\System\kOqsqTo.exe
  C:\Windows\System\kOqsqTo.exe
  2⤵
  PID:2500
- C:\Windows\System\tqmKDep.exe
  C:\Windows\System\tqmKDep.exe
  2⤵
  PID:2876
- C:\Windows\System\ONtByUQ.exe
  C:\Windows\System\ONtByUQ.exe
  2⤵
  PID:2828
- C:\Windows\System\KovwRrA.exe
  C:\Windows\System\KovwRrA.exe
  2⤵
  PID:1872
- C:\Windows\System\uXepXUl.exe
  C:\Windows\System\uXepXUl.exe
  2⤵
  PID:1788
- C:\Windows\System\yBfMlrT.exe
  C:\Windows\System\yBfMlrT.exe
  2⤵
  PID:2228
- C:\Windows\System\ufVZqvR.exe
  C:\Windows\System\ufVZqvR.exe
  2⤵
  PID:1764
- C:\Windows\System\pbjMWkx.exe
  C:\Windows\System\pbjMWkx.exe
  2⤵
  PID:1952
- C:\Windows\System\SZsyLWr.exe
  C:\Windows\System\SZsyLWr.exe
  2⤵
  PID:1696
- C:\Windows\System\bGpCYvQ.exe
  C:\Windows\System\bGpCYvQ.exe
  2⤵
  PID:1524
- C:\Windows\System\KKSRqLl.exe
  C:\Windows\System\KKSRqLl.exe
  2⤵
  PID:2584
- C:\Windows\System\VczvlMx.exe
  C:\Windows\System\VczvlMx.exe
  2⤵
  PID:3040
- C:\Windows\System\OjYuzFR.exe
  C:\Windows\System\OjYuzFR.exe
  2⤵
  PID:2680
- C:\Windows\System\WJhGRQf.exe
  C:\Windows\System\WJhGRQf.exe
  2⤵
  PID:1100
- C:\Windows\System\KGBBSnL.exe
  C:\Windows\System\KGBBSnL.exe
  2⤵
  PID:2744
- C:\Windows\System\mHJgFvr.exe
  C:\Windows\System\mHJgFvr.exe
  2⤵
  PID:964
- C:\Windows\System\aVlwjTl.exe
  C:\Windows\System\aVlwjTl.exe
  2⤵
  PID:1720
- C:\Windows\System\QZubZKQ.exe
  C:\Windows\System\QZubZKQ.exe
  2⤵
  PID:3080
- C:\Windows\System\yLEWaIZ.exe
  C:\Windows\System\yLEWaIZ.exe
  2⤵
  PID:3096
- C:\Windows\System\qKWTrfr.exe
  C:\Windows\System\qKWTrfr.exe
  2⤵
  PID:3112
- C:\Windows\System\iEnqvZA.exe
  C:\Windows\System\iEnqvZA.exe
  2⤵
  PID:3128
- C:\Windows\System\PgqsrKS.exe
  C:\Windows\System\PgqsrKS.exe
  2⤵
  PID:3144
- C:\Windows\System\yzJfwKd.exe
  C:\Windows\System\yzJfwKd.exe
  2⤵
  PID:3164
- C:\Windows\System\YJmRUGI.exe
  C:\Windows\System\YJmRUGI.exe
  2⤵
  PID:3180
- C:\Windows\System\leOcpnc.exe
  C:\Windows\System\leOcpnc.exe
  2⤵
  PID:3196
- C:\Windows\System\gHofQJF.exe
  C:\Windows\System\gHofQJF.exe
  2⤵
  PID:3212
- C:\Windows\System\uYeANfK.exe
  C:\Windows\System\uYeANfK.exe
  2⤵
  PID:3228
- C:\Windows\System\LaBjiav.exe
  C:\Windows\System\LaBjiav.exe
  2⤵
  PID:3244
- C:\Windows\System\AWwYafl.exe
  C:\Windows\System\AWwYafl.exe
  2⤵
  PID:3260
- C:\Windows\System\gLIvypU.exe
  C:\Windows\System\gLIvypU.exe
  2⤵
  PID:3276
- C:\Windows\System\BSGohWp.exe
  C:\Windows\System\BSGohWp.exe
  2⤵
  PID:3292
- C:\Windows\System\rzMjXoK.exe
  C:\Windows\System\rzMjXoK.exe
  2⤵
  PID:3308
- C:\Windows\System\OscOkHZ.exe
  C:\Windows\System\OscOkHZ.exe
  2⤵
  PID:3324
- C:\Windows\System\CyzLkLx.exe
  C:\Windows\System\CyzLkLx.exe
  2⤵
  PID:3340
- C:\Windows\System\yeWFiTR.exe
  C:\Windows\System\yeWFiTR.exe
  2⤵
  PID:3356
- C:\Windows\System\kcXwhiV.exe
  C:\Windows\System\kcXwhiV.exe
  2⤵
  PID:3372
- C:\Windows\System\mXpvTVe.exe
  C:\Windows\System\mXpvTVe.exe
  2⤵
  PID:3388
- C:\Windows\System\RqMGnTk.exe
  C:\Windows\System\RqMGnTk.exe
  2⤵
  PID:3404
- C:\Windows\System\SdarsMr.exe
  C:\Windows\System\SdarsMr.exe
  2⤵
  PID:3420
- C:\Windows\System\ophmzhs.exe
  C:\Windows\System\ophmzhs.exe
  2⤵
  PID:3436
- C:\Windows\System\KufSFpv.exe
  C:\Windows\System\KufSFpv.exe
  2⤵
  PID:3452
- C:\Windows\System\AdCSdTk.exe
  C:\Windows\System\AdCSdTk.exe
  2⤵
  PID:3468
- C:\Windows\System\nGXtTGb.exe
  C:\Windows\System\nGXtTGb.exe
  2⤵
  PID:3484
- C:\Windows\System\AboZeSY.exe
  C:\Windows\System\AboZeSY.exe
  2⤵
  PID:3500
- C:\Windows\System\MCrrsnT.exe
  C:\Windows\System\MCrrsnT.exe
  2⤵
  PID:3516
- C:\Windows\System\dQvuhjd.exe
  C:\Windows\System\dQvuhjd.exe
  2⤵
  PID:3532
- C:\Windows\System\NbnLGCO.exe
  C:\Windows\System\NbnLGCO.exe
  2⤵
  PID:3548
- C:\Windows\System\vqGdouA.exe
  C:\Windows\System\vqGdouA.exe
  2⤵
  PID:3564
- C:\Windows\System\ytrWKzJ.exe
  C:\Windows\System\ytrWKzJ.exe
  2⤵
  PID:3580
- C:\Windows\System\aXDLbzY.exe
  C:\Windows\System\aXDLbzY.exe
  2⤵
  PID:3596
- C:\Windows\System\QKJiKSl.exe
  C:\Windows\System\QKJiKSl.exe
  2⤵
  PID:3612
- C:\Windows\System\sEoWavj.exe
  C:\Windows\System\sEoWavj.exe
  2⤵
  PID:3628
- C:\Windows\System\wVXNfbj.exe
  C:\Windows\System\wVXNfbj.exe
  2⤵
  PID:3644
- C:\Windows\System\uYbMovB.exe
  C:\Windows\System\uYbMovB.exe
  2⤵
  PID:3660
- C:\Windows\System\mhsOElJ.exe
  C:\Windows\System\mhsOElJ.exe
  2⤵
  PID:3676
- C:\Windows\System\baIJjLw.exe
  C:\Windows\System\baIJjLw.exe
  2⤵
  PID:3692
- C:\Windows\System\ZkdrtUg.exe
  C:\Windows\System\ZkdrtUg.exe
  2⤵
  PID:3708
- C:\Windows\System\AAzlWfr.exe
  C:\Windows\System\AAzlWfr.exe
  2⤵
  PID:3724
- C:\Windows\System\iMffTXD.exe
  C:\Windows\System\iMffTXD.exe
  2⤵
  PID:3740
- C:\Windows\System\LSOCZma.exe
  C:\Windows\System\LSOCZma.exe
  2⤵
  PID:3756
- C:\Windows\System\vPjAbFv.exe
  C:\Windows\System\vPjAbFv.exe
  2⤵
  PID:3772
- C:\Windows\System\brbXXXD.exe
  C:\Windows\System\brbXXXD.exe
  2⤵
  PID:3788
- C:\Windows\System\bMFYVzG.exe
  C:\Windows\System\bMFYVzG.exe
  2⤵
  PID:3804
- C:\Windows\System\WSAzzgi.exe
  C:\Windows\System\WSAzzgi.exe
  2⤵
  PID:3820
- C:\Windows\System\TiXrnlg.exe
  C:\Windows\System\TiXrnlg.exe
  2⤵
  PID:3836
- C:\Windows\System\dRcAhGt.exe
  C:\Windows\System\dRcAhGt.exe
  2⤵
  PID:3852
- C:\Windows\System\LcimbBg.exe
  C:\Windows\System\LcimbBg.exe
  2⤵
  PID:3868
- C:\Windows\System\LyxvTwm.exe
  C:\Windows\System\LyxvTwm.exe
  2⤵
  PID:3884
- C:\Windows\System\aIkqzFx.exe
  C:\Windows\System\aIkqzFx.exe
  2⤵
  PID:3900
- C:\Windows\System\nVVjcxr.exe
  C:\Windows\System\nVVjcxr.exe
  2⤵
  PID:3916
- C:\Windows\System\DwMDzBI.exe
  C:\Windows\System\DwMDzBI.exe
  2⤵
  PID:3932
- C:\Windows\System\hysISIR.exe
  C:\Windows\System\hysISIR.exe
  2⤵
  PID:3948
- C:\Windows\System\kfQcFMO.exe
  C:\Windows\System\kfQcFMO.exe
  2⤵
  PID:3964
- C:\Windows\System\vLCqckn.exe
  C:\Windows\System\vLCqckn.exe
  2⤵
  PID:3980
- C:\Windows\System\iHokbQd.exe
  C:\Windows\System\iHokbQd.exe
  2⤵
  PID:3996
- C:\Windows\System\SZdvejc.exe
  C:\Windows\System\SZdvejc.exe
  2⤵
  PID:4012
- C:\Windows\System\UJSxkDh.exe
  C:\Windows\System\UJSxkDh.exe
  2⤵
  PID:4028
- C:\Windows\System\TcVkXqH.exe
  C:\Windows\System\TcVkXqH.exe
  2⤵
  PID:4044
- C:\Windows\System\SIclwXB.exe
  C:\Windows\System\SIclwXB.exe
  2⤵
  PID:4060
- C:\Windows\System\dyPoxst.exe
  C:\Windows\System\dyPoxst.exe
  2⤵
  PID:4076
- C:\Windows\System\XruZmCZ.exe
  C:\Windows\System\XruZmCZ.exe
  2⤵
  PID:4092
- C:\Windows\System\WuHtmZD.exe
  C:\Windows\System\WuHtmZD.exe
  2⤵
  PID:3068
- C:\Windows\System\ykphilF.exe
  C:\Windows\System\ykphilF.exe
  2⤵
  PID:2336
- C:\Windows\System\lQjSIKZ.exe
  C:\Windows\System\lQjSIKZ.exe
  2⤵
  PID:3076
- C:\Windows\System\EhubqoN.exe
  C:\Windows\System\EhubqoN.exe
  2⤵
  PID:3108
- C:\Windows\System\apORpbW.exe
  C:\Windows\System\apORpbW.exe
  2⤵
  PID:3140
- C:\Windows\System\poLhrjH.exe
  C:\Windows\System\poLhrjH.exe
  2⤵
  PID:3172
- C:\Windows\System\SBOPWOQ.exe
  C:\Windows\System\SBOPWOQ.exe
  2⤵
  PID:3176
- C:\Windows\System\YBYSJMF.exe
  C:\Windows\System\YBYSJMF.exe
  2⤵
  PID:3204
- C:\Windows\System\kOvhlKL.exe
  C:\Windows\System\kOvhlKL.exe
  2⤵
  PID:3224
- C:\Windows\System\dIkiSdD.exe
  C:\Windows\System\dIkiSdD.exe
  2⤵
  PID:3256
- C:\Windows\System\DMxUisH.exe
  C:\Windows\System\DMxUisH.exe
  2⤵
  PID:3300
- C:\Windows\System\gSVSJvw.exe
  C:\Windows\System\gSVSJvw.exe
  2⤵
  PID:2892
- C:\Windows\System\nPzipGv.exe
  C:\Windows\System\nPzipGv.exe
  2⤵
  PID:3332
- C:\Windows\System\cYsttoY.exe
  C:\Windows\System\cYsttoY.exe
  2⤵
  PID:3352
- C:\Windows\System\FcWykeF.exe
  C:\Windows\System\FcWykeF.exe
  2⤵
  PID:3396
- C:\Windows\System\HOrTMjX.exe
  C:\Windows\System\HOrTMjX.exe
  2⤵
  PID:3460
- C:\Windows\System\XwIqpku.exe
  C:\Windows\System\XwIqpku.exe
  2⤵
  PID:3412
- C:\Windows\System\WOwzSWW.exe
  C:\Windows\System\WOwzSWW.exe
  2⤵
  PID:3524
- C:\Windows\System\AjyVIrC.exe
  C:\Windows\System\AjyVIrC.exe
  2⤵
  PID:3448
- C:\Windows\System\VLROIwF.exe
  C:\Windows\System\VLROIwF.exe
  2⤵
  PID:3508
- C:\Windows\System\cvGHtPn.exe
  C:\Windows\System\cvGHtPn.exe
  2⤵
  PID:3624
- C:\Windows\System\lyJBnfL.exe
  C:\Windows\System\lyJBnfL.exe
  2⤵
  PID:3636
- C:\Windows\System\vVmAGje.exe
  C:\Windows\System\vVmAGje.exe
  2⤵
  PID:3572
- C:\Windows\System\RrJPIWJ.exe
  C:\Windows\System\RrJPIWJ.exe
  2⤵
  PID:3668
- C:\Windows\System\PcacNfS.exe
  C:\Windows\System\PcacNfS.exe
  2⤵
  PID:3700
- C:\Windows\System\vGoYuKv.exe
  C:\Windows\System\vGoYuKv.exe
  2⤵
  PID:3752
- C:\Windows\System\WsnuJOE.exe
  C:\Windows\System\WsnuJOE.exe
  2⤵
  PID:2784
- C:\Windows\System\PEBLLGv.exe
  C:\Windows\System\PEBLLGv.exe
  2⤵
  PID:3764
- C:\Windows\System\HaiIsFl.exe
  C:\Windows\System\HaiIsFl.exe
  2⤵
  PID:3828
- C:\Windows\System\IDDiTBD.exe
  C:\Windows\System\IDDiTBD.exe
  2⤵
  PID:3876
- C:\Windows\System\mTbdSzO.exe
  C:\Windows\System\mTbdSzO.exe
  2⤵
  PID:3860
- C:\Windows\System\pslhhPj.exe
  C:\Windows\System\pslhhPj.exe
  2⤵
  PID:2532
- C:\Windows\System\NoIJSKV.exe
  C:\Windows\System\NoIJSKV.exe
  2⤵
  PID:2252
- C:\Windows\System\fgmGuZC.exe
  C:\Windows\System\fgmGuZC.exe
  2⤵
  PID:2612
- C:\Windows\System\qcAnjGE.exe
  C:\Windows\System\qcAnjGE.exe
  2⤵
  PID:2264
- C:\Windows\System\uwvkiuu.exe
  C:\Windows\System\uwvkiuu.exe
  2⤵
  PID:1412
- C:\Windows\System\TPUbtbD.exe
  C:\Windows\System\TPUbtbD.exe
  2⤵
  PID:3284
- C:\Windows\System\fWiwxSJ.exe
  C:\Windows\System\fWiwxSJ.exe
  2⤵
  PID:3320
- C:\Windows\System\QPdlhau.exe
  C:\Windows\System\QPdlhau.exe
  2⤵
  PID:3492
- C:\Windows\System\YqqQONl.exe
  C:\Windows\System\YqqQONl.exe
  2⤵
  PID:3304
- C:\Windows\System\PakpfYZ.exe
  C:\Windows\System\PakpfYZ.exe
  2⤵
  PID:3592
- C:\Windows\System\RbYYKxw.exe
  C:\Windows\System\RbYYKxw.exe
  2⤵
  PID:2880
- C:\Windows\System\EEpxEtT.exe
  C:\Windows\System\EEpxEtT.exe
  2⤵
  PID:3432
- C:\Windows\System\tYgDwdX.exe
  C:\Windows\System\tYgDwdX.exe
  2⤵
  PID:3716
- C:\Windows\System\eOpiYgR.exe
  C:\Windows\System\eOpiYgR.exe
  2⤵
  PID:3780
- C:\Windows\System\kgpvWBX.exe
  C:\Windows\System\kgpvWBX.exe
  2⤵
  PID:3652
- C:\Windows\System\UaytReh.exe
  C:\Windows\System\UaytReh.exe
  2⤵
  PID:3688
- C:\Windows\System\SYLpyDP.exe
  C:\Windows\System\SYLpyDP.exe
  2⤵
  PID:3800
- C:\Windows\System\sMdQwpn.exe
  C:\Windows\System\sMdQwpn.exe
  2⤵
  PID:2844
- C:\Windows\System\aNtpfSr.exe
  C:\Windows\System\aNtpfSr.exe
  2⤵
  PID:3848
- C:\Windows\System\vzSaCHh.exe
  C:\Windows\System\vzSaCHh.exe
  2⤵
  PID:2724
- C:\Windows\System\oGHoIYG.exe
  C:\Windows\System\oGHoIYG.exe
  2⤵
  PID:1404
- C:\Windows\System\lMIhOuM.exe
  C:\Windows\System\lMIhOuM.exe
  2⤵
  PID:4024
- C:\Windows\System\fRLKEqQ.exe
  C:\Windows\System\fRLKEqQ.exe
  2⤵
  PID:3944
- C:\Windows\System\WHXUcFd.exe
  C:\Windows\System\WHXUcFd.exe
  2⤵
  PID:4004
- C:\Windows\System\rQJYehM.exe
  C:\Windows\System\rQJYehM.exe
  2⤵
  PID:3928
- C:\Windows\System\NQQuIbx.exe
  C:\Windows\System\NQQuIbx.exe
  2⤵
  PID:4088
- C:\Windows\System\ybHmnhB.exe
  C:\Windows\System\ybHmnhB.exe
  2⤵
  PID:4020
- C:\Windows\System\JyrxfDI.exe
  C:\Windows\System\JyrxfDI.exe
  2⤵
  PID:4052
- C:\Windows\System\pmrxFsW.exe
  C:\Windows\System\pmrxFsW.exe
  2⤵
  PID:2240
- C:\Windows\System\NyXCDcu.exe
  C:\Windows\System\NyXCDcu.exe
  2⤵
  PID:1600
- C:\Windows\System\YVGvOFZ.exe
  C:\Windows\System\YVGvOFZ.exe
  2⤵
  PID:1640
- C:\Windows\System\tGHTpue.exe
  C:\Windows\System\tGHTpue.exe
  2⤵
  PID:1984
- C:\Windows\System\tjRtcQs.exe
  C:\Windows\System\tjRtcQs.exe
  2⤵
  PID:584
- C:\Windows\System\KYfkPxA.exe
  C:\Windows\System\KYfkPxA.exe
  2⤵
  PID:2536
- C:\Windows\System\OGraVuI.exe
  C:\Windows\System\OGraVuI.exe
  2⤵
  PID:3380
- C:\Windows\System\fFFyKcI.exe
  C:\Windows\System\fFFyKcI.exe
  2⤵
  PID:3348
- C:\Windows\System\BjAlhNP.exe
  C:\Windows\System\BjAlhNP.exe
  2⤵
  PID:2688
- C:\Windows\System\udNqqln.exe
  C:\Windows\System\udNqqln.exe
  2⤵
  PID:3604
- C:\Windows\System\LIZzfVj.exe
  C:\Windows\System\LIZzfVj.exe
  2⤵
  PID:1344
- C:\Windows\System\toEZvjg.exe
  C:\Windows\System\toEZvjg.exe
  2⤵
  PID:3816
- C:\Windows\System\MqkbgMu.exe
  C:\Windows\System\MqkbgMu.exe
  2⤵
  PID:3908
- C:\Windows\System\GaKbSVD.exe
  C:\Windows\System\GaKbSVD.exe
  2⤵
  PID:3768
- C:\Windows\System\pKUHmzz.exe
  C:\Windows\System\pKUHmzz.exe
  2⤵
  PID:2152
- C:\Windows\System\yqYDzTl.exe
  C:\Windows\System\yqYDzTl.exe
  2⤵
  PID:3940
- C:\Windows\System\KnVCsNl.exe
  C:\Windows\System\KnVCsNl.exe
  2⤵
  PID:2168
- C:\Windows\System\GdvNjDR.exe
  C:\Windows\System\GdvNjDR.exe
  2⤵
  PID:948
- C:\Windows\System\txvDPJo.exe
  C:\Windows\System\txvDPJo.exe
  2⤵
  PID:3136
- C:\Windows\System\AHjInkr.exe
  C:\Windows\System\AHjInkr.exe
  2⤵
  PID:3268
- C:\Windows\System\pJPzfYh.exe
  C:\Windows\System\pJPzfYh.exe
  2⤵
  PID:2552
- C:\Windows\System\bzFCKAg.exe
  C:\Windows\System\bzFCKAg.exe
  2⤵
  PID:1708
- C:\Windows\System\fIoApJP.exe
  C:\Windows\System\fIoApJP.exe
  2⤵
  PID:2492
- C:\Windows\System\HChvnFw.exe
  C:\Windows\System\HChvnFw.exe
  2⤵
  PID:4084
- C:\Windows\System\LuRTQCZ.exe
  C:\Windows\System\LuRTQCZ.exe
  2⤵
  PID:1512
- C:\Windows\System\gGqbePJ.exe
  C:\Windows\System\gGqbePJ.exe
  2⤵
  PID:3684
- C:\Windows\System\KXEVqlE.exe
  C:\Windows\System\KXEVqlE.exe
  2⤵
  PID:1688
- C:\Windows\System\yrShoGT.exe
  C:\Windows\System\yrShoGT.exe
  2⤵
  PID:3444
- C:\Windows\System\IydzbAz.exe
  C:\Windows\System\IydzbAz.exe
  2⤵
  PID:3560
- C:\Windows\System\sAwrRYz.exe
  C:\Windows\System\sAwrRYz.exe
  2⤵
  PID:1956
- C:\Windows\System\HpWqnLv.exe
  C:\Windows\System\HpWqnLv.exe
  2⤵
  PID:3960
- C:\Windows\System\fpMIkDZ.exe
  C:\Windows\System\fpMIkDZ.exe
  2⤵
  PID:4068
- C:\Windows\System\ZpKoDoh.exe
  C:\Windows\System\ZpKoDoh.exe
  2⤵
  PID:4008
- C:\Windows\System\lvPWWjY.exe
  C:\Windows\System\lvPWWjY.exe
  2⤵
  PID:2588
- C:\Windows\System\yWTKSHO.exe
  C:\Windows\System\yWTKSHO.exe
  2⤵
  PID:3976
- C:\Windows\System\ibWgrcn.exe
  C:\Windows\System\ibWgrcn.exe
  2⤵
  PID:4112
- C:\Windows\System\BdQrmMQ.exe
  C:\Windows\System\BdQrmMQ.exe
  2⤵
  PID:4128
- C:\Windows\System\HqwIRoG.exe
  C:\Windows\System\HqwIRoG.exe
  2⤵
  PID:4144
- C:\Windows\System\JDhVbIH.exe
  C:\Windows\System\JDhVbIH.exe
  2⤵
  PID:4160
- C:\Windows\System\EXnypza.exe
  C:\Windows\System\EXnypza.exe
  2⤵
  PID:4176
- C:\Windows\System\KgfBeKz.exe
  C:\Windows\System\KgfBeKz.exe
  2⤵
  PID:4192
- C:\Windows\System\OwgZFbZ.exe
  C:\Windows\System\OwgZFbZ.exe
  2⤵
  PID:4208
- C:\Windows\System\VeQHTWh.exe
  C:\Windows\System\VeQHTWh.exe
  2⤵
  PID:4224
- C:\Windows\System\xLoEVxf.exe
  C:\Windows\System\xLoEVxf.exe
  2⤵
  PID:4240
- C:\Windows\System\UecRSSt.exe
  C:\Windows\System\UecRSSt.exe
  2⤵
  PID:4256
- C:\Windows\System\xHpnxiz.exe
  C:\Windows\System\xHpnxiz.exe
  2⤵
  PID:4272
- C:\Windows\System\phuVyPR.exe
  C:\Windows\System\phuVyPR.exe
  2⤵
  PID:4288
- C:\Windows\System\hLgAAGO.exe
  C:\Windows\System\hLgAAGO.exe
  2⤵
  PID:4308
- C:\Windows\System\ApEzGRY.exe
  C:\Windows\System\ApEzGRY.exe
  2⤵
  PID:4324
- C:\Windows\System\ajwIEBg.exe
  C:\Windows\System\ajwIEBg.exe
  2⤵
  PID:4340
- C:\Windows\System\ZbxocVW.exe
  C:\Windows\System\ZbxocVW.exe
  2⤵
  PID:4356
- C:\Windows\System\AAZvRAD.exe
  C:\Windows\System\AAZvRAD.exe
  2⤵
  PID:4372
- C:\Windows\System\mdMPkhX.exe
  C:\Windows\System\mdMPkhX.exe
  2⤵
  PID:4388
- C:\Windows\System\qDCEERy.exe
  C:\Windows\System\qDCEERy.exe
  2⤵
  PID:4404
- C:\Windows\System\ZMWopom.exe
  C:\Windows\System\ZMWopom.exe
  2⤵
  PID:4420
- C:\Windows\System\JNvTlFu.exe
  C:\Windows\System\JNvTlFu.exe
  2⤵
  PID:4440
- C:\Windows\System\ZjkHBNa.exe
  C:\Windows\System\ZjkHBNa.exe
  2⤵
  PID:4456
- C:\Windows\System\vwInbMI.exe
  C:\Windows\System\vwInbMI.exe
  2⤵
  PID:4472
- C:\Windows\System\hDWmetW.exe
  C:\Windows\System\hDWmetW.exe
  2⤵
  PID:4488
- C:\Windows\System\TajHFSA.exe
  C:\Windows\System\TajHFSA.exe
  2⤵
  PID:4504
- C:\Windows\System\OmYoGfF.exe
  C:\Windows\System\OmYoGfF.exe
  2⤵
  PID:4520
- C:\Windows\System\RyAnxXY.exe
  C:\Windows\System\RyAnxXY.exe
  2⤵
  PID:4536
- C:\Windows\System\nhAreis.exe
  C:\Windows\System\nhAreis.exe
  2⤵
  PID:4552
- C:\Windows\System\rsNHcCG.exe
  C:\Windows\System\rsNHcCG.exe
  2⤵
  PID:4568
- C:\Windows\System\BQojrmd.exe
  C:\Windows\System\BQojrmd.exe
  2⤵
  PID:4584
- C:\Windows\System\MVvzfuq.exe
  C:\Windows\System\MVvzfuq.exe
  2⤵
  PID:4600
- C:\Windows\System\pfMNguO.exe
  C:\Windows\System\pfMNguO.exe
  2⤵
  PID:4616
- C:\Windows\System\lBxKzvz.exe
  C:\Windows\System\lBxKzvz.exe
  2⤵
  PID:4632
- C:\Windows\System\btmRtmL.exe
  C:\Windows\System\btmRtmL.exe
  2⤵
  PID:4648
- C:\Windows\System\tKXIdLz.exe
  C:\Windows\System\tKXIdLz.exe
  2⤵
  PID:4664
- C:\Windows\System\YnLqmIH.exe
  C:\Windows\System\YnLqmIH.exe
  2⤵
  PID:4680
- C:\Windows\System\wPNfxAq.exe
  C:\Windows\System\wPNfxAq.exe
  2⤵
  PID:4696
- C:\Windows\System\xgKAexP.exe
  C:\Windows\System\xgKAexP.exe
  2⤵
  PID:4712
- C:\Windows\System\iTppJbS.exe
  C:\Windows\System\iTppJbS.exe
  2⤵
  PID:4728
- C:\Windows\System\bALiLdw.exe
  C:\Windows\System\bALiLdw.exe
  2⤵
  PID:4744
- C:\Windows\System\pMUGHor.exe
  C:\Windows\System\pMUGHor.exe
  2⤵
  PID:4760
- C:\Windows\System\pFJPRde.exe
  C:\Windows\System\pFJPRde.exe
  2⤵
  PID:4776
- C:\Windows\System\kqRjMKt.exe
  C:\Windows\System\kqRjMKt.exe
  2⤵
  PID:4796
- C:\Windows\System\VOKvspg.exe
  C:\Windows\System\VOKvspg.exe
  2⤵
  PID:4812
- C:\Windows\System\QNeLpGI.exe
  C:\Windows\System\QNeLpGI.exe
  2⤵
  PID:4828
- C:\Windows\System\TYNfoVf.exe
  C:\Windows\System\TYNfoVf.exe
  2⤵
  PID:4844
- C:\Windows\System\CQRKQIM.exe
  C:\Windows\System\CQRKQIM.exe
  2⤵
  PID:4860
- C:\Windows\System\YjUeBIO.exe
  C:\Windows\System\YjUeBIO.exe
  2⤵
  PID:4876
- C:\Windows\System\XcBKQrZ.exe
  C:\Windows\System\XcBKQrZ.exe
  2⤵
  PID:4892
- C:\Windows\System\vbNqJUC.exe
  C:\Windows\System\vbNqJUC.exe
  2⤵
  PID:4908
- C:\Windows\System\GiSPYqE.exe
  C:\Windows\System\GiSPYqE.exe
  2⤵
  PID:4924
- C:\Windows\System\EVZcXxU.exe
  C:\Windows\System\EVZcXxU.exe
  2⤵
  PID:4940
- C:\Windows\System\UKUKOKk.exe
  C:\Windows\System\UKUKOKk.exe
  2⤵
  PID:4956
- C:\Windows\System\vCtJuXf.exe
  C:\Windows\System\vCtJuXf.exe
  2⤵
  PID:4972
- C:\Windows\System\BkDeyvX.exe
  C:\Windows\System\BkDeyvX.exe
  2⤵
  PID:4988
- C:\Windows\System\CUyCSFH.exe
  C:\Windows\System\CUyCSFH.exe
  2⤵
  PID:5004
- C:\Windows\System\SXrSkxs.exe
  C:\Windows\System\SXrSkxs.exe
  2⤵
  PID:5024
- C:\Windows\System\PITSwCs.exe
  C:\Windows\System\PITSwCs.exe
  2⤵
  PID:5040
- C:\Windows\System\sLvfWwR.exe
  C:\Windows\System\sLvfWwR.exe
  2⤵
  PID:5056
- C:\Windows\System\dqaTHoK.exe
  C:\Windows\System\dqaTHoK.exe
  2⤵
  PID:5072
- C:\Windows\System\aWmjoTk.exe
  C:\Windows\System\aWmjoTk.exe
  2⤵
  PID:5092
- C:\Windows\System\mTLKHHh.exe
  C:\Windows\System\mTLKHHh.exe
  2⤵
  PID:5108
- C:\Windows\System\gtqyGmL.exe
  C:\Windows\System\gtqyGmL.exe
  2⤵
  PID:2736
- C:\Windows\System\OmDABKC.exe
  C:\Windows\System\OmDABKC.exe
  2⤵
  PID:2648
- C:\Windows\System\HozmiqI.exe
  C:\Windows\System\HozmiqI.exe
  2⤵
  PID:4156
- C:\Windows\System\CcJEykl.exe
  C:\Windows\System\CcJEykl.exe
  2⤵
  PID:4184
- C:\Windows\System\IccJFLe.exe
  C:\Windows\System\IccJFLe.exe
  2⤵
  PID:4220
- C:\Windows\System\lNKrIwX.exe
  C:\Windows\System\lNKrIwX.exe
  2⤵
  PID:4280
- C:\Windows\System\oLlxweD.exe
  C:\Windows\System\oLlxweD.exe
  2⤵
  PID:4320
- C:\Windows\System\tjzjHdV.exe
  C:\Windows\System\tjzjHdV.exe
  2⤵
  PID:4352
- C:\Windows\System\IGdGDbD.exe
  C:\Windows\System\IGdGDbD.exe
  2⤵
  PID:4204
- C:\Windows\System\HySXlXf.exe
  C:\Windows\System\HySXlXf.exe
  2⤵
  PID:4264
- C:\Windows\System\rksasbQ.exe
  C:\Windows\System\rksasbQ.exe
  2⤵
  PID:4304
- C:\Windows\System\dkoRhKp.exe
  C:\Windows\System\dkoRhKp.exe
  2⤵
  PID:4428
- C:\Windows\System\GJmNLmo.exe
  C:\Windows\System\GJmNLmo.exe
  2⤵
  PID:4436
- C:\Windows\System\hYPYelp.exe
  C:\Windows\System\hYPYelp.exe
  2⤵
  PID:4496
- C:\Windows\System\AxiEMpW.exe
  C:\Windows\System\AxiEMpW.exe
  2⤵
  PID:4412
- C:\Windows\System\fJsBsWT.exe
  C:\Windows\System\fJsBsWT.exe
  2⤵
  PID:4484
- C:\Windows\System\KmJduaR.exe
  C:\Windows\System\KmJduaR.exe
  2⤵
  PID:4580
- C:\Windows\System\InFdibD.exe
  C:\Windows\System\InFdibD.exe
  2⤵
  PID:4676
- C:\Windows\System\roOwkLB.exe
  C:\Windows\System\roOwkLB.exe
  2⤵
  PID:4740
- C:\Windows\System\zPirlEa.exe
  C:\Windows\System\zPirlEa.exe
  2⤵
  PID:4808
- C:\Windows\System\iSqGscj.exe
  C:\Windows\System\iSqGscj.exe
  2⤵
  PID:4900
- C:\Windows\System\BigmWFI.exe
  C:\Windows\System\BigmWFI.exe
  2⤵
  PID:4688
- C:\Windows\System\ZKoNBkd.exe
  C:\Windows\System\ZKoNBkd.exe
  2⤵
  PID:4516
- C:\Windows\System\dlKfbIS.exe
  C:\Windows\System\dlKfbIS.exe
  2⤵
  PID:5032
- C:\Windows\System\uSaIimv.exe
  C:\Windows\System\uSaIimv.exe
  2⤵
  PID:4872
- C:\Windows\System\vAhQQam.exe
  C:\Windows\System\vAhQQam.exe
  2⤵
  PID:3924
- C:\Windows\System\JUxVRnv.exe
  C:\Windows\System\JUxVRnv.exe
  2⤵
  PID:5100
- C:\Windows\System\CHBmENG.exe
  C:\Windows\System\CHBmENG.exe
  2⤵
  PID:4252
- C:\Windows\System\UwEiWOV.exe
  C:\Windows\System\UwEiWOV.exe
  2⤵
  PID:4656
- C:\Windows\System\wdHcbnD.exe
  C:\Windows\System\wdHcbnD.exe
  2⤵
  PID:5080
- C:\Windows\System\AVSrfaq.exe
  C:\Windows\System\AVSrfaq.exe
  2⤵
  PID:4752
- C:\Windows\System\fGhCaDh.exe
  C:\Windows\System\fGhCaDh.exe
  2⤵
  PID:2560
- C:\Windows\System\niQfshk.exe
  C:\Windows\System\niQfshk.exe
  2⤵
  PID:4596
- C:\Windows\System\FkSxoYt.exe
  C:\Windows\System\FkSxoYt.exe
  2⤵
  PID:4784
- C:\Windows\System\qtQPXxY.exe
  C:\Windows\System\qtQPXxY.exe
  2⤵
  PID:4884
- C:\Windows\System\eVoDUFW.exe
  C:\Windows\System\eVoDUFW.exe
  2⤵
  PID:4948
- C:\Windows\System\LEqZjDH.exe
  C:\Windows\System\LEqZjDH.exe
  2⤵
  PID:5012
- C:\Windows\System\aKJShdZ.exe
  C:\Windows\System\aKJShdZ.exe
  2⤵
  PID:4168
- C:\Windows\System\rEGBcDF.exe
  C:\Windows\System\rEGBcDF.exe
  2⤵
  PID:4300
- C:\Windows\System\rSPdPHI.exe
  C:\Windows\System\rSPdPHI.exe
  2⤵
  PID:4868
- C:\Windows\System\cnnIjxm.exe
  C:\Windows\System\cnnIjxm.exe
  2⤵
  PID:4544
- C:\Windows\System\xUEnvYr.exe
  C:\Windows\System\xUEnvYr.exe
  2⤵
  PID:4840
- C:\Windows\System\pLhdhkq.exe
  C:\Windows\System\pLhdhkq.exe
  2⤵
  PID:5064
- C:\Windows\System\SmsnRKu.exe
  C:\Windows\System\SmsnRKu.exe
  2⤵
  PID:4772
- C:\Windows\System\UBPEDGQ.exe
  C:\Windows\System\UBPEDGQ.exe
  2⤵
  PID:4400
- C:\Windows\System\RdZeBzo.exe
  C:\Windows\System\RdZeBzo.exe
  2⤵
  PID:4644
- C:\Windows\System\YbcQoqh.exe
  C:\Windows\System\YbcQoqh.exe
  2⤵
  PID:2112
- C:\Windows\System\fhQRBXr.exe
  C:\Windows\System\fhQRBXr.exe
  2⤵
  PID:4788
- C:\Windows\System\uiRncmp.exe
  C:\Windows\System\uiRncmp.exe
  2⤵
  PID:5128
- C:\Windows\System\bQyunFi.exe
  C:\Windows\System\bQyunFi.exe
  2⤵
  PID:5148
- C:\Windows\System\PTVGdlP.exe
  C:\Windows\System\PTVGdlP.exe
  2⤵
  PID:5164
- C:\Windows\System\OGUApRn.exe
  C:\Windows\System\OGUApRn.exe
  2⤵
  PID:5180
- C:\Windows\System\oRnCTii.exe
  C:\Windows\System\oRnCTii.exe
  2⤵
  PID:5196
- C:\Windows\System\yvBULUE.exe
  C:\Windows\System\yvBULUE.exe
  2⤵
  PID:5212
- C:\Windows\System\ceGHDVd.exe
  C:\Windows\System\ceGHDVd.exe
  2⤵
  PID:5232
- C:\Windows\System\OhULklD.exe
  C:\Windows\System\OhULklD.exe
  2⤵
  PID:5248
- C:\Windows\System\SPmoNzM.exe
  C:\Windows\System\SPmoNzM.exe
  2⤵
  PID:5264
- C:\Windows\System\UWNMvjb.exe
  C:\Windows\System\UWNMvjb.exe
  2⤵
  PID:5284
- C:\Windows\System\aJdFHLJ.exe
  C:\Windows\System\aJdFHLJ.exe
  2⤵
  PID:5300
- C:\Windows\System\fYqoDXB.exe
  C:\Windows\System\fYqoDXB.exe
  2⤵
  PID:5324
- C:\Windows\System\jDlkImw.exe
  C:\Windows\System\jDlkImw.exe
  2⤵
  PID:5340
- C:\Windows\System\uhffxul.exe
  C:\Windows\System\uhffxul.exe
  2⤵
  PID:5360
- C:\Windows\System\oIbvdMI.exe
  C:\Windows\System\oIbvdMI.exe
  2⤵
  PID:5376
- C:\Windows\System\axPtgtC.exe
  C:\Windows\System\axPtgtC.exe
  2⤵
  PID:5392
- C:\Windows\System\IlGNlQm.exe
  C:\Windows\System\IlGNlQm.exe
  2⤵
  PID:5412
- C:\Windows\System\lWrqxEs.exe
  C:\Windows\System\lWrqxEs.exe
  2⤵
  PID:5428
- C:\Windows\System\wgtDorA.exe
  C:\Windows\System\wgtDorA.exe
  2⤵
  PID:5444
- C:\Windows\System\HWkDVRS.exe
  C:\Windows\System\HWkDVRS.exe
  2⤵
  PID:5464
- C:\Windows\System\jqXbqEX.exe
  C:\Windows\System\jqXbqEX.exe
  2⤵
  PID:5480
- C:\Windows\System\VFNILrz.exe
  C:\Windows\System\VFNILrz.exe
  2⤵
  PID:5496
- C:\Windows\System\CrbSAzA.exe
  C:\Windows\System\CrbSAzA.exe
  2⤵
  PID:5512
- C:\Windows\System\TbWCMaW.exe
  C:\Windows\System\TbWCMaW.exe
  2⤵
  PID:5532
- C:\Windows\System\knHGcXE.exe
  C:\Windows\System\knHGcXE.exe
  2⤵
  PID:5548
- C:\Windows\System\vbfAEjT.exe
  C:\Windows\System\vbfAEjT.exe
  2⤵
  PID:5564
- C:\Windows\System\yQWjmOd.exe
  C:\Windows\System\yQWjmOd.exe
  2⤵
  PID:5580
- C:\Windows\System\fkKgOXJ.exe
  C:\Windows\System\fkKgOXJ.exe
  2⤵
  PID:5600
- C:\Windows\System\pbCEeFi.exe
  C:\Windows\System\pbCEeFi.exe
  2⤵
  PID:5616
- C:\Windows\System\adUTczx.exe
  C:\Windows\System\adUTczx.exe
  2⤵
  PID:5632
- C:\Windows\System\SrQmgrb.exe
  C:\Windows\System\SrQmgrb.exe
  2⤵
  PID:5648
- C:\Windows\System\YLnTTxg.exe
  C:\Windows\System\YLnTTxg.exe
  2⤵
  PID:5668
- C:\Windows\System\fvHBGzL.exe
  C:\Windows\System\fvHBGzL.exe
  2⤵
  PID:5712
- C:\Windows\System\dDEopvJ.exe
  C:\Windows\System\dDEopvJ.exe
  2⤵
  PID:5728
- C:\Windows\System\QqJUSme.exe
  C:\Windows\System\QqJUSme.exe
  2⤵
  PID:5744
- C:\Windows\System\IQTvUuE.exe
  C:\Windows\System\IQTvUuE.exe
  2⤵
  PID:5760
- C:\Windows\System\UJndBlp.exe
  C:\Windows\System\UJndBlp.exe
  2⤵
  PID:5776
- C:\Windows\System\NRIfmeC.exe
  C:\Windows\System\NRIfmeC.exe
  2⤵
  PID:5792
- C:\Windows\System\YsUcKSh.exe
  C:\Windows\System\YsUcKSh.exe
  2⤵
  PID:5808
- C:\Windows\System\fLHNVVh.exe
  C:\Windows\System\fLHNVVh.exe
  2⤵
  PID:5824
- C:\Windows\System\SrqIvou.exe
  C:\Windows\System\SrqIvou.exe
  2⤵
  PID:5840
- C:\Windows\System\exbebtX.exe
  C:\Windows\System\exbebtX.exe
  2⤵
  PID:5856
- C:\Windows\System\oXgqHDa.exe
  C:\Windows\System\oXgqHDa.exe
  2⤵
  PID:5876
- C:\Windows\System\LWjsJGL.exe
  C:\Windows\System\LWjsJGL.exe
  2⤵
  PID:5908
- C:\Windows\System\iOoKkvP.exe
  C:\Windows\System\iOoKkvP.exe
  2⤵
  PID:5924
- C:\Windows\System\LzrTnoa.exe
  C:\Windows\System\LzrTnoa.exe
  2⤵
  PID:5940
- C:\Windows\System\XzHwCBL.exe
  C:\Windows\System\XzHwCBL.exe
  2⤵
  PID:5956
- C:\Windows\System\MchVNeT.exe
  C:\Windows\System\MchVNeT.exe
  2⤵
  PID:5984
- C:\Windows\System\XefOBPf.exe
  C:\Windows\System\XefOBPf.exe
  2⤵
  PID:6004
- C:\Windows\System\TODiklm.exe
  C:\Windows\System\TODiklm.exe
  2⤵
  PID:6020
- C:\Windows\System\QARMXak.exe
  C:\Windows\System\QARMXak.exe
  2⤵
  PID:6036
- C:\Windows\System\pzbFCkl.exe
  C:\Windows\System\pzbFCkl.exe
  2⤵
  PID:6052
- C:\Windows\System\UqRjiiV.exe
  C:\Windows\System\UqRjiiV.exe
  2⤵
  PID:6068
- C:\Windows\System\cLANoWn.exe
  C:\Windows\System\cLANoWn.exe
  2⤵
  PID:6084
- C:\Windows\System\JqaEcHZ.exe
  C:\Windows\System\JqaEcHZ.exe
  2⤵
  PID:6100
- C:\Windows\System\AEUXoff.exe
  C:\Windows\System\AEUXoff.exe
  2⤵
  PID:6116
- C:\Windows\System\RdilLft.exe
  C:\Windows\System\RdilLft.exe
  2⤵
  PID:6132
- C:\Windows\System\ftVxJUU.exe
  C:\Windows\System\ftVxJUU.exe
  2⤵
  PID:5048
- C:\Windows\System\SYwsedJ.exe
  C:\Windows\System\SYwsedJ.exe
  2⤵
  PID:4720
- C:\Windows\System\ciRuUra.exe
  C:\Windows\System\ciRuUra.exe
  2⤵
  PID:5472
- C:\Windows\System\WRVqmbd.exe
  C:\Windows\System\WRVqmbd.exe
  2⤵
  PID:4464
- C:\Windows\System\TGmQYRH.exe
  C:\Windows\System\TGmQYRH.exe
  2⤵
  PID:4480
- C:\Windows\System\TeSqfMs.exe
  C:\Windows\System\TeSqfMs.exe
  2⤵
  PID:5144
- C:\Windows\System\iCXoKnE.exe
  C:\Windows\System\iCXoKnE.exe
  2⤵
  PID:4824
- C:\Windows\System\nPCXajb.exe
  C:\Windows\System\nPCXajb.exe
  2⤵
  PID:5020
- C:\Windows\System\UmbnOUT.exe
  C:\Windows\System\UmbnOUT.exe
  2⤵
  PID:4532
- C:\Windows\System\QJeijAI.exe
  C:\Windows\System\QJeijAI.exe
  2⤵
  PID:4936
- C:\Windows\System\VMttLFX.exe
  C:\Windows\System\VMttLFX.exe
  2⤵
  PID:4348
- C:\Windows\System\kcfZCwJ.exe
  C:\Windows\System\kcfZCwJ.exe
  2⤵
  PID:5188
- C:\Windows\System\hchmKAQ.exe
  C:\Windows\System\hchmKAQ.exe
  2⤵
  PID:5228
- C:\Windows\System\ChQUXJA.exe
  C:\Windows\System\ChQUXJA.exe
  2⤵
  PID:5296
- C:\Windows\System\wtjPfhU.exe
  C:\Windows\System\wtjPfhU.exe
  2⤵
  PID:5400
- C:\Windows\System\cJLyOXp.exe
  C:\Windows\System\cJLyOXp.exe
  2⤵
  PID:5440
- C:\Windows\System\NPXvVzS.exe
  C:\Windows\System\NPXvVzS.exe
  2⤵
  PID:5540
- C:\Windows\System\jZisAvi.exe
  C:\Windows\System\jZisAvi.exe
  2⤵
  PID:5608
- C:\Windows\System\UBbOVdG.exe
  C:\Windows\System\UBbOVdG.exe
  2⤵
  PID:5676
- C:\Windows\System\oLTnTiR.exe
  C:\Windows\System\oLTnTiR.exe
  2⤵
  PID:5696
- C:\Windows\System\tieaOrf.exe
  C:\Windows\System\tieaOrf.exe
  2⤵
  PID:5740
- C:\Windows\System\NpEtSMW.exe
  C:\Windows\System\NpEtSMW.exe
  2⤵
  PID:5772
- C:\Windows\System\EXHOxlo.exe
  C:\Windows\System\EXHOxlo.exe
  2⤵
  PID:4920
- C:\Windows\System\UUzYnWQ.exe
  C:\Windows\System\UUzYnWQ.exe
  2⤵
  PID:4336
- C:\Windows\System\HNqZdXQ.exe
  C:\Windows\System\HNqZdXQ.exe
  2⤵
  PID:5136
- C:\Windows\System\SKETIZs.exe
  C:\Windows\System\SKETIZs.exe
  2⤵
  PID:5276
- C:\Windows\System\dZVrKxa.exe
  C:\Windows\System\dZVrKxa.exe
  2⤵
  PID:5208
- C:\Windows\System\ZQeBHwd.exe
  C:\Windows\System\ZQeBHwd.exe
  2⤵
  PID:5452
- C:\Windows\System\qHBkgHz.exe
  C:\Windows\System\qHBkgHz.exe
  2⤵
  PID:5384
- C:\Windows\System\fXlkwuI.exe
  C:\Windows\System\fXlkwuI.exe
  2⤵
  PID:5320
- C:\Windows\System\bHVaiBP.exe
  C:\Windows\System\bHVaiBP.exe
  2⤵
  PID:5488
- C:\Windows\System\EXTtofx.exe
  C:\Windows\System\EXTtofx.exe
  2⤵
  PID:5492
- C:\Windows\System\VnLKgAl.exe
  C:\Windows\System\VnLKgAl.exe
  2⤵
  PID:5624
- C:\Windows\System\NOGwmpF.exe
  C:\Windows\System\NOGwmpF.exe
  2⤵
  PID:5592
- C:\Windows\System\JTiHqUV.exe
  C:\Windows\System\JTiHqUV.exe
  2⤵
  PID:5752
- C:\Windows\System\nxxZmxF.exe
  C:\Windows\System\nxxZmxF.exe
  2⤵
  PID:5832
- C:\Windows\System\olcRJSw.exe
  C:\Windows\System\olcRJSw.exe
  2⤵
  PID:5864
- C:\Windows\System\ieCdmGb.exe
  C:\Windows\System\ieCdmGb.exe
  2⤵
  PID:5892
- C:\Windows\System\scWTPeG.exe
  C:\Windows\System\scWTPeG.exe
  2⤵
  PID:5936
- C:\Windows\System\cerkStQ.exe
  C:\Windows\System\cerkStQ.exe
  2⤵
  PID:2452
- C:\Windows\System\yKnDwhN.exe
  C:\Windows\System\yKnDwhN.exe
  2⤵
  PID:5916
- C:\Windows\System\NbJDqor.exe
  C:\Windows\System\NbJDqor.exe
  2⤵
  PID:5952
- C:\Windows\System\GfJyuZb.exe
  C:\Windows\System\GfJyuZb.exe
  2⤵
  PID:6048
- C:\Windows\System\ewWtWJx.exe
  C:\Windows\System\ewWtWJx.exe
  2⤵
  PID:6000
- C:\Windows\System\yfFPEgY.exe
  C:\Windows\System\yfFPEgY.exe
  2⤵
  PID:6064
- C:\Windows\System\WWgYruX.exe
  C:\Windows\System\WWgYruX.exe
  2⤵
  PID:6140
- C:\Windows\System\EhHTQJJ.exe
  C:\Windows\System\EhHTQJJ.exe
  2⤵
  PID:3012
- C:\Windows\System\ulwvQqB.exe
  C:\Windows\System\ulwvQqB.exe
  2⤵
  PID:4628
- C:\Windows\System\ArwuHye.exe
  C:\Windows\System\ArwuHye.exe
  2⤵
  PID:4104
- C:\Windows\System\jYhiUhs.exe
  C:\Windows\System\jYhiUhs.exe
  2⤵
  PID:4592
- C:\Windows\System\ofHRpgY.exe
  C:\Windows\System\ofHRpgY.exe
  2⤵
  PID:5140
- C:\Windows\System\XggPDHH.exe
  C:\Windows\System\XggPDHH.exe
  2⤵
  PID:2996
- C:\Windows\System\prpOVqE.exe
  C:\Windows\System\prpOVqE.exe
  2⤵
  PID:5220
- C:\Windows\System\dosStqN.exe
  C:\Windows\System\dosStqN.exe
  2⤵
  PID:5372
- C:\Windows\System\HnNadTu.exe
  C:\Windows\System\HnNadTu.exe
  2⤵
  PID:5036
- C:\Windows\System\cgvMcKF.exe
  C:\Windows\System\cgvMcKF.exe
  2⤵
  PID:5292
- C:\Windows\System\QIwMwXx.exe
  C:\Windows\System\QIwMwXx.exe
  2⤵
  PID:5640
- C:\Windows\System\CFnAlcM.exe
  C:\Windows\System\CFnAlcM.exe
  2⤵
  PID:5708
- C:\Windows\System\tTdNvCf.exe
  C:\Windows\System\tTdNvCf.exe
  2⤵
  PID:5724
- C:\Windows\System\fMEqmfk.exe
  C:\Windows\System\fMEqmfk.exe
  2⤵
  PID:5816
- C:\Windows\System\TydHRks.exe
  C:\Windows\System\TydHRks.exe
  2⤵
  PID:5788
- C:\Windows\System\xgiRwlk.exe
  C:\Windows\System\xgiRwlk.exe
  2⤵
  PID:5460
- C:\Windows\System\QOItWVL.exe
  C:\Windows\System\QOItWVL.exe
  2⤵
  PID:5556
- C:\Windows\System\UJPmbRs.exe
  C:\Windows\System\UJPmbRs.exe
  2⤵
  PID:5820
- C:\Windows\System\naSAHLG.exe
  C:\Windows\System\naSAHLG.exe
  2⤵
  PID:5888
- C:\Windows\System\zjdGCyf.exe
  C:\Windows\System\zjdGCyf.exe
  2⤵
  PID:5972
- C:\Windows\System\GXLbJMi.exe
  C:\Windows\System\GXLbJMi.exe
  2⤵
  PID:5312
- C:\Windows\System\nVWtOTv.exe
  C:\Windows\System\nVWtOTv.exe
  2⤵
  PID:2936
- C:\Windows\System\twwOekT.exe
  C:\Windows\System\twwOekT.exe
  2⤵
  PID:5528
- C:\Windows\System\xQgpyYo.exe
  C:\Windows\System\xQgpyYo.exe
  2⤵
  PID:2964
- C:\Windows\System\bnuANCr.exe
  C:\Windows\System\bnuANCr.exe
  2⤵
  PID:5368
- C:\Windows\System\RFJCyYv.exe
  C:\Windows\System\RFJCyYv.exe
  2⤵
  PID:5992
- C:\Windows\System\zQYRuFm.exe
  C:\Windows\System\zQYRuFm.exe
  2⤵
  PID:4432
- C:\Windows\System\SIRgtLB.exe
  C:\Windows\System\SIRgtLB.exe
  2⤵
  PID:5436
- C:\Windows\System\iwMKQaT.exe
  C:\Windows\System\iwMKQaT.exe
  2⤵
  PID:6112
- C:\Windows\System\vwaqKAq.exe
  C:\Windows\System\vwaqKAq.exe
  2⤵
  PID:2712
- C:\Windows\System\oKDEEjb.exe
  C:\Windows\System\oKDEEjb.exe
  2⤵
  PID:4120
- C:\Windows\System\UZuXZoF.exe
  C:\Windows\System\UZuXZoF.exe
  2⤵
  PID:4296
- C:\Windows\System\IhBMygn.exe
  C:\Windows\System\IhBMygn.exe
  2⤵
  PID:5872
- C:\Windows\System\HBNOuHu.exe
  C:\Windows\System\HBNOuHu.exe
  2⤵
  PID:2832
- C:\Windows\System\VpkDPpJ.exe
  C:\Windows\System\VpkDPpJ.exe
  2⤵
  PID:4916
- C:\Windows\System\BwICMiy.exe
  C:\Windows\System\BwICMiy.exe
  2⤵
  PID:5704
- C:\Windows\System\SlyqaMa.exe
  C:\Windows\System\SlyqaMa.exe
  2⤵
  PID:5948
- C:\Windows\System\YrEOqYs.exe
  C:\Windows\System\YrEOqYs.exe
  2⤵
  PID:5240
- C:\Windows\System\gJrciQV.exe
  C:\Windows\System\gJrciQV.exe
  2⤵
  PID:6032
- C:\Windows\System\oTovISp.exe
  C:\Windows\System\oTovISp.exe
  2⤵
  PID:4564
- C:\Windows\System\pyTLXTl.exe
  C:\Windows\System\pyTLXTl.exe
  2⤵
  PID:6028
- C:\Windows\System\tJWmvdi.exe
  C:\Windows\System\tJWmvdi.exe
  2⤵
  PID:2984
- C:\Windows\System\XlQaSBp.exe
  C:\Windows\System\XlQaSBp.exe
  2⤵
  PID:6060
- C:\Windows\System\ACCnoXE.exe
  C:\Windows\System\ACCnoXE.exe
  2⤵
  PID:5352
- C:\Windows\System\fWThGqa.exe
  C:\Windows\System\fWThGqa.exe
  2⤵
  PID:5628
- C:\Windows\System\dfIttqG.exe
  C:\Windows\System\dfIttqG.exe
  2⤵
  PID:6096
- C:\Windows\System\XsygRWC.exe
  C:\Windows\System\XsygRWC.exe
  2⤵
  PID:6160
- C:\Windows\System\fbPLAYh.exe
  C:\Windows\System\fbPLAYh.exe
  2⤵
  PID:6180
- C:\Windows\System\KjrclWz.exe
  C:\Windows\System\KjrclWz.exe
  2⤵
  PID:6196
- C:\Windows\System\tcpwfvd.exe
  C:\Windows\System\tcpwfvd.exe
  2⤵
  PID:6212
- C:\Windows\System\XoABAkk.exe
  C:\Windows\System\XoABAkk.exe
  2⤵
  PID:6228
- C:\Windows\System\dKbTRVJ.exe
  C:\Windows\System\dKbTRVJ.exe
  2⤵
  PID:6244
- C:\Windows\System\LzbUMVA.exe
  C:\Windows\System\LzbUMVA.exe
  2⤵
  PID:6260
- C:\Windows\System\fTYDWUe.exe
  C:\Windows\System\fTYDWUe.exe
  2⤵
  PID:6276
- C:\Windows\System\iXNOwoH.exe
  C:\Windows\System\iXNOwoH.exe
  2⤵
  PID:6292
- C:\Windows\System\FZDtwLw.exe
  C:\Windows\System\FZDtwLw.exe
  2⤵
  PID:6308
- C:\Windows\System\yhwzTSS.exe
  C:\Windows\System\yhwzTSS.exe
  2⤵
  PID:6324
- C:\Windows\System\mnRnEuF.exe
  C:\Windows\System\mnRnEuF.exe
  2⤵
  PID:6340
- C:\Windows\System\gSCokpv.exe
  C:\Windows\System\gSCokpv.exe
  2⤵
  PID:6356
- C:\Windows\System\ChjRlbU.exe
  C:\Windows\System\ChjRlbU.exe
  2⤵
  PID:6372
- C:\Windows\System\osoEOYw.exe
  C:\Windows\System\osoEOYw.exe
  2⤵
  PID:6388
- C:\Windows\System\WjamIKr.exe
  C:\Windows\System\WjamIKr.exe
  2⤵
  PID:6408
- C:\Windows\System\vToWJOF.exe
  C:\Windows\System\vToWJOF.exe
  2⤵
  PID:6424
- C:\Windows\System\jknZVYy.exe
  C:\Windows\System\jknZVYy.exe
  2⤵
  PID:6440
- C:\Windows\System\XDgrsuD.exe
  C:\Windows\System\XDgrsuD.exe
  2⤵
  PID:6456
- C:\Windows\System\jKTxzFg.exe
  C:\Windows\System\jKTxzFg.exe
  2⤵
  PID:6472
- C:\Windows\System\BxCmspH.exe
  C:\Windows\System\BxCmspH.exe
  2⤵
  PID:6488
- C:\Windows\System\rEESzGu.exe
  C:\Windows\System\rEESzGu.exe
  2⤵
  PID:6504
- C:\Windows\System\iCwVnvg.exe
  C:\Windows\System\iCwVnvg.exe
  2⤵
  PID:6520
- C:\Windows\System\eufNjcF.exe
  C:\Windows\System\eufNjcF.exe
  2⤵
  PID:6540
- C:\Windows\System\JphgGzq.exe
  C:\Windows\System\JphgGzq.exe
  2⤵
  PID:6556
- C:\Windows\System\yCgxFRq.exe
  C:\Windows\System\yCgxFRq.exe
  2⤵
  PID:6572
- C:\Windows\System\dlVgdWg.exe
  C:\Windows\System\dlVgdWg.exe
  2⤵
  PID:6588
- C:\Windows\System\VzFVZUi.exe
  C:\Windows\System\VzFVZUi.exe
  2⤵
  PID:6604
- C:\Windows\System\cmgvNEt.exe
  C:\Windows\System\cmgvNEt.exe
  2⤵
  PID:6620
- C:\Windows\System\tcEfJCQ.exe
  C:\Windows\System\tcEfJCQ.exe
  2⤵
  PID:6636
- C:\Windows\System\WunZWxB.exe
  C:\Windows\System\WunZWxB.exe
  2⤵
  PID:6652
- C:\Windows\System\wfWXaCV.exe
  C:\Windows\System\wfWXaCV.exe
  2⤵
  PID:6668
- C:\Windows\System\vcMIcKO.exe
  C:\Windows\System\vcMIcKO.exe
  2⤵
  PID:6684
- C:\Windows\System\lWpaNar.exe
  C:\Windows\System\lWpaNar.exe
  2⤵
  PID:6700
- C:\Windows\System\eMFdpNl.exe
  C:\Windows\System\eMFdpNl.exe
  2⤵
  PID:6716
- C:\Windows\System\XPpuMQW.exe
  C:\Windows\System\XPpuMQW.exe
  2⤵
  PID:6732
- C:\Windows\System\FSyQBES.exe
  C:\Windows\System\FSyQBES.exe
  2⤵
  PID:6748
- C:\Windows\System\twzPIMF.exe
  C:\Windows\System\twzPIMF.exe
  2⤵
  PID:6764
- C:\Windows\System\drPQRdc.exe
  C:\Windows\System\drPQRdc.exe
  2⤵
  PID:6780
- C:\Windows\System\TxPujtf.exe
  C:\Windows\System\TxPujtf.exe
  2⤵
  PID:6796
- C:\Windows\System\TFQmLqe.exe
  C:\Windows\System\TFQmLqe.exe
  2⤵
  PID:6812
- C:\Windows\System\NPRaPba.exe
  C:\Windows\System\NPRaPba.exe
  2⤵
  PID:6828
- C:\Windows\System\aBZpnXo.exe
  C:\Windows\System\aBZpnXo.exe
  2⤵
  PID:6844
- C:\Windows\System\DxaguuM.exe
  C:\Windows\System\DxaguuM.exe
  2⤵
  PID:6860
- C:\Windows\System\ZeYEGJi.exe
  C:\Windows\System\ZeYEGJi.exe
  2⤵
  PID:6876
- C:\Windows\System\bqOiBOp.exe
  C:\Windows\System\bqOiBOp.exe
  2⤵
  PID:6892
- C:\Windows\System\aCQBUjn.exe
  C:\Windows\System\aCQBUjn.exe
  2⤵
  PID:6908
- C:\Windows\System\Mzeveqs.exe
  C:\Windows\System\Mzeveqs.exe
  2⤵
  PID:6924
- C:\Windows\System\cPjZkfO.exe
  C:\Windows\System\cPjZkfO.exe
  2⤵
  PID:6940
- C:\Windows\System\bSrfjFr.exe
  C:\Windows\System\bSrfjFr.exe
  2⤵
  PID:6956
- C:\Windows\System\PlDvaAk.exe
  C:\Windows\System\PlDvaAk.exe
  2⤵
  PID:6988
- C:\Windows\System\qOdWckK.exe
  C:\Windows\System\qOdWckK.exe
  2⤵
  PID:7004
- C:\Windows\System\nbZQGuX.exe
  C:\Windows\System\nbZQGuX.exe
  2⤵
  PID:7028
- C:\Windows\System\PVzLPtF.exe
  C:\Windows\System\PVzLPtF.exe
  2⤵
  PID:7048
- C:\Windows\System\YvmCaKa.exe
  C:\Windows\System\YvmCaKa.exe
  2⤵
  PID:7064
- C:\Windows\System\GHpDWph.exe
  C:\Windows\System\GHpDWph.exe
  2⤵
  PID:7080
- C:\Windows\System\AHpewiT.exe
  C:\Windows\System\AHpewiT.exe
  2⤵
  PID:7096
- C:\Windows\System\SZUjier.exe
  C:\Windows\System\SZUjier.exe
  2⤵
  PID:7120
- C:\Windows\System\EsiOGTf.exe
  C:\Windows\System\EsiOGTf.exe
  2⤵
  PID:7136
- C:\Windows\System\zsrvSjb.exe
  C:\Windows\System\zsrvSjb.exe
  2⤵
  PID:7152
- C:\Windows\System\WNPbbRs.exe
  C:\Windows\System\WNPbbRs.exe
  2⤵
  PID:5980
- C:\Windows\System\noVVxpw.exe
  C:\Windows\System\noVVxpw.exe
  2⤵
  PID:5244
- C:\Windows\System\KKbGAja.exe
  C:\Windows\System\KKbGAja.exe
  2⤵
  PID:6176
- C:\Windows\System\oJfOQyk.exe
  C:\Windows\System\oJfOQyk.exe
  2⤵
  PID:6016
- C:\Windows\System\xWWSIGR.exe
  C:\Windows\System\xWWSIGR.exe
  2⤵
  PID:5756
- C:\Windows\System\eHgTCzD.exe
  C:\Windows\System\eHgTCzD.exe
  2⤵
  PID:6224
- C:\Windows\System\LvtqARY.exe
  C:\Windows\System\LvtqARY.exe
  2⤵
  PID:6284
- C:\Windows\System\mbIhAcO.exe
  C:\Windows\System\mbIhAcO.exe
  2⤵
  PID:6320
- C:\Windows\System\PhsmZKl.exe
  C:\Windows\System\PhsmZKl.exe
  2⤵
  PID:6384
- C:\Windows\System\ZoyOKEV.exe
  C:\Windows\System\ZoyOKEV.exe
  2⤵
  PID:6452
- C:\Windows\System\zqZghnD.exe
  C:\Windows\System\zqZghnD.exe
  2⤵
  PID:6240
- C:\Windows\System\CFnmPZR.exe
  C:\Windows\System\CFnmPZR.exe
  2⤵
  PID:6516
- C:\Windows\System\JnoWKTa.exe
  C:\Windows\System\JnoWKTa.exe
  2⤵
  PID:6612
- C:\Windows\System\KIkJmrC.exe
  C:\Windows\System\KIkJmrC.exe
  2⤵
  PID:6644
- C:\Windows\System\LqnJEcn.exe
  C:\Windows\System\LqnJEcn.exe
  2⤵
  PID:6712
- C:\Windows\System\hzUBoQV.exe
  C:\Windows\System\hzUBoQV.exe
  2⤵
  PID:6680
- C:\Windows\System\ePkydQS.exe
  C:\Windows\System\ePkydQS.exe
  2⤵
  PID:6776
- C:\Windows\System\VSKXWzI.exe
  C:\Windows\System\VSKXWzI.exe
  2⤵
  PID:6840
- C:\Windows\System\AjtZmji.exe
  C:\Windows\System\AjtZmji.exe
  2⤵
  PID:6904
- C:\Windows\System\NTRZHxq.exe
  C:\Windows\System\NTRZHxq.exe
  2⤵
  PID:6500
- C:\Windows\System\SpBoRoa.exe
  C:\Windows\System\SpBoRoa.exe
  2⤵
  PID:6364
- C:\Windows\System\aSaPjUb.exe
  C:\Windows\System\aSaPjUb.exe
  2⤵
  PID:6432
- C:\Windows\System\ldsAYSi.exe
  C:\Windows\System\ldsAYSi.exe
  2⤵
  PID:6496
- C:\Windows\System\wZoWlnK.exe
  C:\Windows\System\wZoWlnK.exe
  2⤵
  PID:6948
- C:\Windows\System\tDOIRLt.exe
  C:\Windows\System\tDOIRLt.exe
  2⤵
  PID:6600
- C:\Windows\System\IqtEZnU.exe
  C:\Windows\System\IqtEZnU.exe
  2⤵
  PID:6664
- C:\Windows\System\crYxbhX.exe
  C:\Windows\System\crYxbhX.exe
  2⤵
  PID:6728
- C:\Windows\System\QcKsPXg.exe
  C:\Windows\System\QcKsPXg.exe
  2⤵
  PID:6820
- C:\Windows\System\paGROxk.exe
  C:\Windows\System\paGROxk.exe
  2⤵
  PID:6884
- C:\Windows\System\VYExmmY.exe
  C:\Windows\System\VYExmmY.exe
  2⤵
  PID:6952
- C:\Windows\System\mLEnGPj.exe
  C:\Windows\System\mLEnGPj.exe
  2⤵
  PID:6996
- C:\Windows\System\DZxuOLA.exe
  C:\Windows\System\DZxuOLA.exe
  2⤵
  PID:7040
- C:\Windows\System\aEAbzzK.exe
  C:\Windows\System\aEAbzzK.exe
  2⤵
  PID:7016
- C:\Windows\System\QidpAsz.exe
  C:\Windows\System\QidpAsz.exe
  2⤵
  PID:7020
- C:\Windows\System\rDccAkK.exe
  C:\Windows\System\rDccAkK.exe
  2⤵
  PID:7024
- C:\Windows\System\NVMQrqU.exe
  C:\Windows\System\NVMQrqU.exe
  2⤵
  PID:5084
- C:\Windows\System\bfoIGki.exe
  C:\Windows\System\bfoIGki.exe
  2⤵
  PID:7116
- C:\Windows\System\OQApDkJ.exe
  C:\Windows\System\OQApDkJ.exe
  2⤵
  PID:5016
- C:\Windows\System\jmtaUjV.exe
  C:\Windows\System\jmtaUjV.exe
  2⤵
  PID:1820
- C:\Windows\System\XkBNluY.exe
  C:\Windows\System\XkBNluY.exe
  2⤵
  PID:6300
- C:\Windows\System\WTSRoTA.exe
  C:\Windows\System\WTSRoTA.exe
  2⤵
  PID:6580
- C:\Windows\System\MriQcVa.exe
  C:\Windows\System\MriQcVa.exe
  2⤵
  PID:6676
- C:\Windows\System\ZIdALaf.exe
  C:\Windows\System\ZIdALaf.exe
  2⤵
  PID:6484
- C:\Windows\System\pSUbkxd.exe
  C:\Windows\System\pSUbkxd.exe
  2⤵
  PID:6220
- C:\Windows\System\KIpeipQ.exe
  C:\Windows\System\KIpeipQ.exe
  2⤵
  PID:6900
- C:\Windows\System\oKxvnMt.exe
  C:\Windows\System\oKxvnMt.exe
  2⤵
  PID:6464
- C:\Windows\System\pijkClC.exe
  C:\Windows\System\pijkClC.exe
  2⤵
  PID:6568
- C:\Windows\System\yAgNggE.exe
  C:\Windows\System\yAgNggE.exe
  2⤵
  PID:6724
- C:\Windows\System\WwstLis.exe
  C:\Windows\System\WwstLis.exe
  2⤵
  PID:6808
- C:\Windows\System\eycLIxx.exe
  C:\Windows\System\eycLIxx.exe
  2⤵
  PID:6632
- C:\Windows\System\sOSEHgS.exe
  C:\Windows\System\sOSEHgS.exe
  2⤵
  PID:6400
- C:\Windows\System\YLsyjfd.exe
  C:\Windows\System\YLsyjfd.exe
  2⤵
  PID:6916
- C:\Windows\System\UehNbzp.exe
  C:\Windows\System\UehNbzp.exe
  2⤵
  PID:7076
- C:\Windows\System\iCEMOBP.exe
  C:\Windows\System\iCEMOBP.exe
  2⤵
  PID:7164
- C:\Windows\System\YqZuOzC.exe
  C:\Windows\System\YqZuOzC.exe
  2⤵
  PID:7132
- C:\Windows\System\mqzNRoO.exe
  C:\Windows\System\mqzNRoO.exe
  2⤵
  PID:3024
- C:\Windows\System\spWSxIG.exe
  C:\Windows\System\spWSxIG.exe
  2⤵
  PID:6256
- C:\Windows\System\iTwnNgx.exe
  C:\Windows\System\iTwnNgx.exe
  2⤵
  PID:6772
- C:\Windows\System\zEIBoMB.exe
  C:\Windows\System\zEIBoMB.exe
  2⤵
  PID:2732
- C:\Windows\System\bsCJmfn.exe
  C:\Windows\System\bsCJmfn.exe
  2⤵
  PID:6788
- C:\Windows\System\EipmVoh.exe
  C:\Windows\System\EipmVoh.exe
  2⤵
  PID:7104
- C:\Windows\System\ivzIBka.exe
  C:\Windows\System\ivzIBka.exe
  2⤵
  PID:6192
- C:\Windows\System\iHZtyuz.exe
  C:\Windows\System\iHZtyuz.exe
  2⤵
  PID:6536
- C:\Windows\System\BFqrUGk.exe
  C:\Windows\System\BFqrUGk.exe
  2⤵
  PID:6396
- C:\Windows\System\vKxmJfQ.exe
  C:\Windows\System\vKxmJfQ.exe
  2⤵
  PID:6448
- C:\Windows\System\LsdbabX.exe
  C:\Windows\System\LsdbabX.exe
  2⤵
  PID:6984
- C:\Windows\System\RwEjZMR.exe
  C:\Windows\System\RwEjZMR.exe
  2⤵
  PID:6152
- C:\Windows\System\mQAUPIb.exe
  C:\Windows\System\mQAUPIb.exe
  2⤵
  PID:6336
- C:\Windows\System\YTPgpKU.exe
  C:\Windows\System\YTPgpKU.exe
  2⤵
  PID:6596
- C:\Windows\System\vTlAYNA.exe
  C:\Windows\System\vTlAYNA.exe
  2⤵
  PID:6208
- C:\Windows\System\Xofmzqq.exe
  C:\Windows\System\Xofmzqq.exe
  2⤵
  PID:7176
- C:\Windows\System\ApxGXEt.exe
  C:\Windows\System\ApxGXEt.exe
  2⤵
  PID:7192
- C:\Windows\System\xyPsTen.exe
  C:\Windows\System\xyPsTen.exe
  2⤵
  PID:7208
- C:\Windows\System\uNncank.exe
  C:\Windows\System\uNncank.exe
  2⤵
  PID:7224
- C:\Windows\System\vuiQBUh.exe
  C:\Windows\System\vuiQBUh.exe
  2⤵
  PID:7240
- C:\Windows\System\Yfeqtsm.exe
  C:\Windows\System\Yfeqtsm.exe
  2⤵
  PID:7256
- C:\Windows\System\gBMeDNI.exe
  C:\Windows\System\gBMeDNI.exe
  2⤵
  PID:7272
- C:\Windows\System\ijsQeVf.exe
  C:\Windows\System\ijsQeVf.exe
  2⤵
  PID:7288
- C:\Windows\System\LIFUuwb.exe
  C:\Windows\System\LIFUuwb.exe
  2⤵
  PID:7304
- C:\Windows\System\soRZweZ.exe
  C:\Windows\System\soRZweZ.exe
  2⤵
  PID:7320
- C:\Windows\System\CzGpSwP.exe
  C:\Windows\System\CzGpSwP.exe
  2⤵
  PID:7336
- C:\Windows\System\URHTOCg.exe
  C:\Windows\System\URHTOCg.exe
  2⤵
  PID:7352
- C:\Windows\System\DMktHiT.exe
  C:\Windows\System\DMktHiT.exe
  2⤵
  PID:7368
- C:\Windows\System\WeYgKPD.exe
  C:\Windows\System\WeYgKPD.exe
  2⤵
  PID:7384
- C:\Windows\System\ExDqreX.exe
  C:\Windows\System\ExDqreX.exe
  2⤵
  PID:7400
- C:\Windows\System\oMtXqfa.exe
  C:\Windows\System\oMtXqfa.exe
  2⤵
  PID:7416
- C:\Windows\System\KrvSJgn.exe
  C:\Windows\System\KrvSJgn.exe
  2⤵
  PID:7432
- C:\Windows\System\vWWvVmz.exe
  C:\Windows\System\vWWvVmz.exe
  2⤵
  PID:7448
- C:\Windows\System\rRvLCml.exe
  C:\Windows\System\rRvLCml.exe
  2⤵
  PID:7464
- C:\Windows\System\VuXualN.exe
  C:\Windows\System\VuXualN.exe
  2⤵
  PID:7480
- C:\Windows\System\vyEvHDf.exe
  C:\Windows\System\vyEvHDf.exe
  2⤵
  PID:7496
- C:\Windows\System\wuAwrRF.exe
  C:\Windows\System\wuAwrRF.exe
  2⤵
  PID:7512
- C:\Windows\System\VQhBELh.exe
  C:\Windows\System\VQhBELh.exe
  2⤵
  PID:7528
- C:\Windows\System\jKLXXxE.exe
  C:\Windows\System\jKLXXxE.exe
  2⤵
  PID:7544
- C:\Windows\System\dSSgMXH.exe
  C:\Windows\System\dSSgMXH.exe
  2⤵
  PID:7560
- C:\Windows\System\ptKFMeB.exe
  C:\Windows\System\ptKFMeB.exe
  2⤵
  PID:7576
- C:\Windows\System\emcAScF.exe
  C:\Windows\System\emcAScF.exe
  2⤵
  PID:7592
- C:\Windows\System\UNtaWvS.exe
  C:\Windows\System\UNtaWvS.exe
  2⤵
  PID:7608
- C:\Windows\System\VFSigPv.exe
  C:\Windows\System\VFSigPv.exe
  2⤵
  PID:7624
- C:\Windows\System\cwiHMGw.exe
  C:\Windows\System\cwiHMGw.exe
  2⤵
  PID:7640
- C:\Windows\System\EpCXLuH.exe
  C:\Windows\System\EpCXLuH.exe
  2⤵
  PID:7656
- C:\Windows\System\LrbtVhk.exe
  C:\Windows\System\LrbtVhk.exe
  2⤵
  PID:7672
- C:\Windows\System\yIgRRPT.exe
  C:\Windows\System\yIgRRPT.exe
  2⤵
  PID:7688
- C:\Windows\System\vSfvUVa.exe
  C:\Windows\System\vSfvUVa.exe
  2⤵
  PID:7704
- C:\Windows\System\KYtXUEr.exe
  C:\Windows\System\KYtXUEr.exe
  2⤵
  PID:7720
- C:\Windows\System\wVobEXb.exe
  C:\Windows\System\wVobEXb.exe
  2⤵
  PID:7736
- C:\Windows\System\twgsYAl.exe
  C:\Windows\System\twgsYAl.exe
  2⤵
  PID:7756
- C:\Windows\System\qyseqLY.exe
  C:\Windows\System\qyseqLY.exe
  2⤵
  PID:7772
- C:\Windows\System\iBFZEUi.exe
  C:\Windows\System\iBFZEUi.exe
  2⤵
  PID:7788
- C:\Windows\System\WRuepvq.exe
  C:\Windows\System\WRuepvq.exe
  2⤵
  PID:7804
- C:\Windows\System\KsQDeiK.exe
  C:\Windows\System\KsQDeiK.exe
  2⤵
  PID:7820
- C:\Windows\System\WELdImY.exe
  C:\Windows\System\WELdImY.exe
  2⤵
  PID:7836
- C:\Windows\System\lOwPhCk.exe
  C:\Windows\System\lOwPhCk.exe
  2⤵
  PID:7852
- C:\Windows\System\hjoTtoN.exe
  C:\Windows\System\hjoTtoN.exe
  2⤵
  PID:7868
- C:\Windows\System\uVuCsxV.exe
  C:\Windows\System\uVuCsxV.exe
  2⤵
  PID:7884
- C:\Windows\System\TaTeJNy.exe
  C:\Windows\System\TaTeJNy.exe
  2⤵
  PID:7900
- C:\Windows\System\OPEkRbT.exe
  C:\Windows\System\OPEkRbT.exe
  2⤵
  PID:7916
- C:\Windows\System\neRWpqI.exe
  C:\Windows\System\neRWpqI.exe
  2⤵
  PID:7932
- C:\Windows\System\Aeuisku.exe
  C:\Windows\System\Aeuisku.exe
  2⤵
  PID:7948
- C:\Windows\System\ahyXJle.exe
  C:\Windows\System\ahyXJle.exe
  2⤵
  PID:7964
- C:\Windows\System\vnmqVNK.exe
  C:\Windows\System\vnmqVNK.exe
  2⤵
  PID:7980
- C:\Windows\System\mknyxgI.exe
  C:\Windows\System\mknyxgI.exe
  2⤵
  PID:7996
- C:\Windows\System\uCUzQLU.exe
  C:\Windows\System\uCUzQLU.exe
  2⤵
  PID:8012
- C:\Windows\System\HQyDzkG.exe
  C:\Windows\System\HQyDzkG.exe
  2⤵
  PID:8028
- C:\Windows\System\pcvelFK.exe
  C:\Windows\System\pcvelFK.exe
  2⤵
  PID:8044
- C:\Windows\System\OJvmhhu.exe
  C:\Windows\System\OJvmhhu.exe
  2⤵
  PID:8060
- C:\Windows\System\bpwKiaQ.exe
  C:\Windows\System\bpwKiaQ.exe
  2⤵
  PID:8076
- C:\Windows\System\QcaSEdl.exe
  C:\Windows\System\QcaSEdl.exe
  2⤵
  PID:8092
- C:\Windows\System\HSqiYDa.exe
  C:\Windows\System\HSqiYDa.exe
  2⤵
  PID:8108
- C:\Windows\System\njoExil.exe
  C:\Windows\System\njoExil.exe
  2⤵
  PID:8124
- C:\Windows\System\agriFKA.exe
  C:\Windows\System\agriFKA.exe
  2⤵
  PID:8140
- C:\Windows\System\mSmHfgk.exe
  C:\Windows\System\mSmHfgk.exe
  2⤵
  PID:8156
- C:\Windows\System\TVRVtuq.exe
  C:\Windows\System\TVRVtuq.exe
  2⤵
  PID:8172
- C:\Windows\System\OLZaWZK.exe
  C:\Windows\System\OLZaWZK.exe
  2⤵
  PID:6708
- C:\Windows\System\GocncOX.exe
  C:\Windows\System\GocncOX.exe
  2⤵
  PID:5976
- C:\Windows\System\PIsVeNJ.exe
  C:\Windows\System\PIsVeNJ.exe
  2⤵
  PID:7204
- C:\Windows\System\SjvORQz.exe
  C:\Windows\System\SjvORQz.exe
  2⤵
  PID:7264
- C:\Windows\System\wbttRDj.exe
  C:\Windows\System\wbttRDj.exe
  2⤵
  PID:6168
- C:\Windows\System\LdLfABj.exe
  C:\Windows\System\LdLfABj.exe
  2⤵
  PID:7332
- C:\Windows\System\AasLLdY.exe
  C:\Windows\System\AasLLdY.exe
  2⤵
  PID:7248
- C:\Windows\System\gViYKEq.exe
  C:\Windows\System\gViYKEq.exe
  2⤵
  PID:7364
- C:\Windows\System\JGVbSNl.exe
  C:\Windows\System\JGVbSNl.exe
  2⤵
  PID:7392
- C:\Windows\System\RuqoEVL.exe
  C:\Windows\System\RuqoEVL.exe
  2⤵
  PID:7428
- C:\Windows\System\QMLdVYF.exe
  C:\Windows\System\QMLdVYF.exe
  2⤵
  PID:7444
- C:\Windows\System\ZXrJsfW.exe
  C:\Windows\System\ZXrJsfW.exe
  2⤵
  PID:7380
- C:\Windows\System\bamXZRU.exe
  C:\Windows\System\bamXZRU.exe
  2⤵
  PID:7440
- C:\Windows\System\sMYNEBw.exe
  C:\Windows\System\sMYNEBw.exe
  2⤵
  PID:7476
- C:\Windows\System\aWeQeCK.exe
  C:\Windows\System\aWeQeCK.exe
  2⤵
  PID:7620
- C:\Windows\System\IbTqoED.exe
  C:\Windows\System\IbTqoED.exe
  2⤵
  PID:7508
- C:\Windows\System\YrLDGfK.exe
  C:\Windows\System\YrLDGfK.exe
  2⤵
  PID:7540
- C:\Windows\System\CuqlWMe.exe
  C:\Windows\System\CuqlWMe.exe
  2⤵
  PID:7604
- C:\Windows\System\VxmmgtR.exe
  C:\Windows\System\VxmmgtR.exe
  2⤵
  PID:7716
- C:\Windows\System\EvHDZMu.exe
  C:\Windows\System\EvHDZMu.exe
  2⤵
  PID:7664
- C:\Windows\System\bYmnVyp.exe
  C:\Windows\System\bYmnVyp.exe
  2⤵
  PID:7784
- C:\Windows\System\XPvxlqS.exe
  C:\Windows\System\XPvxlqS.exe
  2⤵
  PID:7816
- C:\Windows\System\XVGOtIn.exe
  C:\Windows\System\XVGOtIn.exe
  2⤵
  PID:7828
- C:\Windows\System\PdVgVUG.exe
  C:\Windows\System\PdVgVUG.exe
  2⤵
  PID:7848
- C:\Windows\System\LcSVqLx.exe
  C:\Windows\System\LcSVqLx.exe
  2⤵
  PID:7860
- C:\Windows\System\rhxZmYB.exe
  C:\Windows\System\rhxZmYB.exe
  2⤵
  PID:112
- C:\Windows\System\EgVAeJZ.exe
  C:\Windows\System\EgVAeJZ.exe
  2⤵
  PID:7944
- C:\Windows\System\uZzvdzC.exe
  C:\Windows\System\uZzvdzC.exe
  2⤵
  PID:7956
- C:\Windows\System\luGHGRY.exe
  C:\Windows\System\luGHGRY.exe
  2⤵
  PID:7988
- C:\Windows\System\UaWbLbM.exe
  C:\Windows\System\UaWbLbM.exe
  2⤵
  PID:8068
- C:\Windows\System\VbzDSXa.exe
  C:\Windows\System\VbzDSXa.exe
  2⤵
  PID:8132
- C:\Windows\System\mgVdXUP.exe
  C:\Windows\System\mgVdXUP.exe
  2⤵
  PID:7960
- C:\Windows\System\ehhZkQh.exe
  C:\Windows\System\ehhZkQh.exe
  2⤵
  PID:8020
- C:\Windows\System\IvnYpWC.exe
  C:\Windows\System\IvnYpWC.exe
  2⤵
  PID:8084
- C:\Windows\System\kfHxREH.exe
  C:\Windows\System\kfHxREH.exe
  2⤵
  PID:8120
- C:\Windows\System\VNkqVnU.exe
  C:\Windows\System\VNkqVnU.exe
  2⤵
  PID:7232
- C:\Windows\System\AsHpaYk.exe
  C:\Windows\System\AsHpaYk.exe
  2⤵
  PID:7280
- C:\Windows\System\SyZasZz.exe
  C:\Windows\System\SyZasZz.exe
  2⤵
  PID:7300
- C:\Windows\System\mLcFsfR.exe
  C:\Windows\System\mLcFsfR.exe
  2⤵
  PID:7488
- C:\Windows\System\jwtPkjg.exe
  C:\Windows\System\jwtPkjg.exe
  2⤵
  PID:6696
- C:\Windows\System\aBVmPXB.exe
  C:\Windows\System\aBVmPXB.exe
  2⤵
  PID:7460
- C:\Windows\System\lumcjZD.exe
  C:\Windows\System\lumcjZD.exe
  2⤵
  PID:7552
- C:\Windows\System\KDdJTQX.exe
  C:\Windows\System\KDdJTQX.exe
  2⤵
  PID:7680
- C:\Windows\System\jlXdvLR.exe
  C:\Windows\System\jlXdvLR.exe
  2⤵
  PID:7728
- C:\Windows\System\pvxilQk.exe
  C:\Windows\System\pvxilQk.exe
  2⤵
  PID:7892
- C:\Windows\System\ZlHTYXT.exe
  C:\Windows\System\ZlHTYXT.exe
  2⤵
  PID:7976
- C:\Windows\System\YaFPHWi.exe
  C:\Windows\System\YaFPHWi.exe
  2⤵
  PID:8040
- C:\Windows\System\TnxWBrB.exe
  C:\Windows\System\TnxWBrB.exe
  2⤵
  PID:8056
- C:\Windows\System\jftRRZE.exe
  C:\Windows\System\jftRRZE.exe
  2⤵
  PID:8188
- C:\Windows\System\nLroFDD.exe
  C:\Windows\System\nLroFDD.exe
  2⤵
  PID:7912
- C:\Windows\System\wVrMnCV.exe
  C:\Windows\System\wVrMnCV.exe
  2⤵
  PID:7880
- C:\Windows\System\ttyvRgJ.exe
  C:\Windows\System\ttyvRgJ.exe
  2⤵
  PID:8104
- C:\Windows\System\KXnIHky.exe
  C:\Windows\System\KXnIHky.exe
  2⤵
  PID:6236
- C:\Windows\System\OKlYEBL.exe
  C:\Windows\System\OKlYEBL.exe
  2⤵
  PID:7216
- C:\Windows\System\RhWzEng.exe
  C:\Windows\System\RhWzEng.exe
  2⤵
  PID:7696
- C:\Windows\System\bgKxvXq.exe
  C:\Windows\System\bgKxvXq.exe
  2⤵
  PID:7712
- C:\Windows\System\jjJZRns.exe
  C:\Windows\System\jjJZRns.exe
  2⤵
  PID:7572
- C:\Windows\System\ioWgCJz.exe
  C:\Windows\System\ioWgCJz.exe
  2⤵
  PID:7940
- C:\Windows\System\nlQAbAZ.exe
  C:\Windows\System\nlQAbAZ.exe
  2⤵
  PID:6532
- C:\Windows\System\uKnHExC.exe
  C:\Windows\System\uKnHExC.exe
  2⤵
  PID:8116
- C:\Windows\System\kPMcPwc.exe
  C:\Windows\System\kPMcPwc.exe
  2⤵
  PID:7424
- C:\Windows\System\bSTpXHK.exe
  C:\Windows\System\bSTpXHK.exe
  2⤵
  PID:7312
- C:\Windows\System\RVTcrqD.exe
  C:\Windows\System\RVTcrqD.exe
  2⤵
  PID:8008
- C:\Windows\System\nutdkDo.exe
  C:\Windows\System\nutdkDo.exe
  2⤵
  PID:8200
- C:\Windows\System\xchKFLt.exe
  C:\Windows\System\xchKFLt.exe
  2⤵
  PID:8216
- C:\Windows\System\nhhApbw.exe
  C:\Windows\System\nhhApbw.exe
  2⤵
  PID:8232
- C:\Windows\System\qmggeao.exe
  C:\Windows\System\qmggeao.exe
  2⤵
  PID:8248
- C:\Windows\System\qcpWosB.exe
  C:\Windows\System\qcpWosB.exe
  2⤵
  PID:8264
- C:\Windows\System\OIZVqbZ.exe
  C:\Windows\System\OIZVqbZ.exe
  2⤵
  PID:8284
- C:\Windows\System\wKXVMvN.exe
  C:\Windows\System\wKXVMvN.exe
  2⤵
  PID:8300
- C:\Windows\System\zgyhxEj.exe
  C:\Windows\System\zgyhxEj.exe
  2⤵
  PID:8316
- C:\Windows\System\NrqmobU.exe
  C:\Windows\System\NrqmobU.exe
  2⤵
  PID:8332
- C:\Windows\System\HhMjGXY.exe
  C:\Windows\System\HhMjGXY.exe
  2⤵
  PID:8348
- C:\Windows\System\urzVrmW.exe
  C:\Windows\System\urzVrmW.exe
  2⤵
  PID:8368
- C:\Windows\System\lCIwiOw.exe
  C:\Windows\System\lCIwiOw.exe
  2⤵
  PID:8384
- C:\Windows\System\KsAHzoC.exe
  C:\Windows\System\KsAHzoC.exe
  2⤵
  PID:8400
- C:\Windows\System\XtKNukf.exe
  C:\Windows\System\XtKNukf.exe
  2⤵
  PID:8416
- C:\Windows\System\RVmLPpQ.exe
  C:\Windows\System\RVmLPpQ.exe
  2⤵
  PID:8432
- C:\Windows\System\oCQaTEy.exe
  C:\Windows\System\oCQaTEy.exe
  2⤵
  PID:8448
- C:\Windows\System\APpyTWm.exe
  C:\Windows\System\APpyTWm.exe
  2⤵
  PID:8464
- C:\Windows\System\PdNZmhc.exe
  C:\Windows\System\PdNZmhc.exe
  2⤵
  PID:8480
- C:\Windows\System\oAZhFKe.exe
  C:\Windows\System\oAZhFKe.exe
  2⤵
  PID:8500
- C:\Windows\System\ZnQhlvu.exe
  C:\Windows\System\ZnQhlvu.exe
  2⤵
  PID:8516
- C:\Windows\System\rFjQroF.exe
  C:\Windows\System\rFjQroF.exe
  2⤵
  PID:8580
- C:\Windows\System\asvWToi.exe
  C:\Windows\System\asvWToi.exe
  2⤵
  PID:8596
- C:\Windows\System\PnrphkA.exe
  C:\Windows\System\PnrphkA.exe
  2⤵
  PID:8612
- C:\Windows\System\NDEUCOH.exe
  C:\Windows\System\NDEUCOH.exe
  2⤵
  PID:8628
- C:\Windows\System\xQvncCz.exe
  C:\Windows\System\xQvncCz.exe
  2⤵
  PID:8644
- C:\Windows\System\afRNICY.exe
  C:\Windows\System\afRNICY.exe
  2⤵
  PID:8660
- C:\Windows\System\QfPrJgx.exe
  C:\Windows\System\QfPrJgx.exe
  2⤵
  PID:8676
- C:\Windows\System\IQqCmwp.exe
  C:\Windows\System\IQqCmwp.exe
  2⤵
  PID:8696
- C:\Windows\System\sbWzxNp.exe
  C:\Windows\System\sbWzxNp.exe
  2⤵
  PID:8712
- C:\Windows\System\WuRatHz.exe
  C:\Windows\System\WuRatHz.exe
  2⤵
  PID:8728
- C:\Windows\System\vpDPpyY.exe
  C:\Windows\System\vpDPpyY.exe
  2⤵
  PID:8744
- C:\Windows\System\ZyYnRqu.exe
  C:\Windows\System\ZyYnRqu.exe
  2⤵
  PID:8760
- C:\Windows\System\EeiTdOi.exe
  C:\Windows\System\EeiTdOi.exe
  2⤵
  PID:8776
- C:\Windows\System\vMvzzpb.exe
  C:\Windows\System\vMvzzpb.exe
  2⤵
  PID:8792
- C:\Windows\System\ZFOYnOK.exe
  C:\Windows\System\ZFOYnOK.exe
  2⤵
  PID:8808
- C:\Windows\System\xqINxfU.exe
  C:\Windows\System\xqINxfU.exe
  2⤵
  PID:8824
- C:\Windows\System\yTHTeYS.exe
  C:\Windows\System\yTHTeYS.exe
  2⤵
  PID:8840
- C:\Windows\System\IyDPCCM.exe
  C:\Windows\System\IyDPCCM.exe
  2⤵
  PID:8856
- C:\Windows\System\Xqzrqjt.exe
  C:\Windows\System\Xqzrqjt.exe
  2⤵
  PID:8872
- C:\Windows\System\MHMevdX.exe
  C:\Windows\System\MHMevdX.exe
  2⤵
  PID:8888
- C:\Windows\System\YawUoqt.exe
  C:\Windows\System\YawUoqt.exe
  2⤵
  PID:8904
- C:\Windows\System\QYFTSzx.exe
  C:\Windows\System\QYFTSzx.exe
  2⤵
  PID:8920
- C:\Windows\System\wzOqQCu.exe
  C:\Windows\System\wzOqQCu.exe
  2⤵
  PID:8936
- C:\Windows\System\HYobtOj.exe
  C:\Windows\System\HYobtOj.exe
  2⤵
  PID:8956
- C:\Windows\System\IPyBWjU.exe
  C:\Windows\System\IPyBWjU.exe
  2⤵
  PID:8972
- C:\Windows\System\CSEEIjv.exe
  C:\Windows\System\CSEEIjv.exe
  2⤵
  PID:8988
- C:\Windows\System\coKbWoK.exe
  C:\Windows\System\coKbWoK.exe
  2⤵
  PID:9004
- C:\Windows\System\Aiblutv.exe
  C:\Windows\System\Aiblutv.exe
  2⤵
  PID:9020
- C:\Windows\System\WAzXHgr.exe
  C:\Windows\System\WAzXHgr.exe
  2⤵
  PID:9036
- C:\Windows\System\NjcpqPk.exe
  C:\Windows\System\NjcpqPk.exe
  2⤵
  PID:9060
- C:\Windows\System\MHYPAsa.exe
  C:\Windows\System\MHYPAsa.exe
  2⤵
  PID:9076
- C:\Windows\System\RHFIweI.exe
  C:\Windows\System\RHFIweI.exe
  2⤵
  PID:9092
- C:\Windows\System\WrGwjdw.exe
  C:\Windows\System\WrGwjdw.exe
  2⤵
  PID:9108
- C:\Windows\System\TNeysXE.exe
  C:\Windows\System\TNeysXE.exe
  2⤵
  PID:9124
- C:\Windows\System\jJsouQh.exe
  C:\Windows\System\jJsouQh.exe
  2⤵
  PID:9140
- C:\Windows\System\CBZgnDv.exe
  C:\Windows\System\CBZgnDv.exe
  2⤵
  PID:9156
- C:\Windows\System\xSjKUhX.exe
  C:\Windows\System\xSjKUhX.exe
  2⤵
  PID:9172
- C:\Windows\System\AecdKoQ.exe
  C:\Windows\System\AecdKoQ.exe
  2⤵
  PID:9188
- C:\Windows\System\YjwvkxH.exe
  C:\Windows\System\YjwvkxH.exe
  2⤵
  PID:9204
- C:\Windows\System\fEHJUjx.exe
  C:\Windows\System\fEHJUjx.exe
  2⤵
  PID:8196
- C:\Windows\System\HPUNoKH.exe
  C:\Windows\System\HPUNoKH.exe
  2⤵
  PID:8228
- C:\Windows\System\WCtzDrh.exe
  C:\Windows\System\WCtzDrh.exe
  2⤵
  PID:7752
- C:\Windows\System\AWabhMZ.exe
  C:\Windows\System\AWabhMZ.exe
  2⤵
  PID:8152
- C:\Windows\System\nMzJkaf.exe
  C:\Windows\System\nMzJkaf.exe
  2⤵
  PID:8240
- C:\Windows\System\QdHohfq.exe
  C:\Windows\System\QdHohfq.exe
  2⤵
  PID:3160
- C:\Windows\System\ywFKZPS.exe
  C:\Windows\System\ywFKZPS.exe
  2⤵
  PID:8280
- C:\Windows\System\nZNnuvA.exe
  C:\Windows\System\nZNnuvA.exe
  2⤵
  PID:8364
- C:\Windows\System\iauauLb.exe
  C:\Windows\System\iauauLb.exe
  2⤵
  PID:8396
- C:\Windows\System\QlgLzbo.exe
  C:\Windows\System\QlgLzbo.exe
  2⤵
  PID:8456
- C:\Windows\System\pyOQuiv.exe
  C:\Windows\System\pyOQuiv.exe
  2⤵
  PID:8488
- C:\Windows\System\OJEiUZy.exe
  C:\Windows\System\OJEiUZy.exe
  2⤵
  PID:8476
- C:\Windows\System\ZPnJpuJ.exe
  C:\Windows\System\ZPnJpuJ.exe
  2⤵
  PID:8472
- C:\Windows\System\mIXyUKB.exe
  C:\Windows\System\mIXyUKB.exe
  2⤵
  PID:8528
- C:\Windows\System\nFwlrTl.exe
  C:\Windows\System\nFwlrTl.exe
  2⤵
  PID:8548
- C:\Windows\System\qBQEGkd.exe
  C:\Windows\System\qBQEGkd.exe
  2⤵
  PID:8560
- C:\Windows\System\ehFGRoT.exe
  C:\Windows\System\ehFGRoT.exe
  2⤵
  PID:8576
- C:\Windows\System\WAxFOnn.exe
  C:\Windows\System\WAxFOnn.exe
  2⤵
  PID:7748
- C:\Windows\System\cWYvece.exe
  C:\Windows\System\cWYvece.exe
  2⤵
  PID:8736
- C:\Windows\System\CVGdZYo.exe
  C:\Windows\System\CVGdZYo.exe
  2⤵
  PID:8800
- C:\Windows\System\GCGRcwY.exe
  C:\Windows\System\GCGRcwY.exe
  2⤵
  PID:8864
- C:\Windows\System\VqsdRce.exe
  C:\Windows\System\VqsdRce.exe
  2⤵
  PID:8624
- C:\Windows\System\FcLorCk.exe
  C:\Windows\System\FcLorCk.exe
  2⤵
  PID:8880
- C:\Windows\System\UroeHiA.exe
  C:\Windows\System\UroeHiA.exe
  2⤵
  PID:8620
- C:\Windows\System\VOnjKWm.exe
  C:\Windows\System\VOnjKWm.exe
  2⤵
  PID:8656
- C:\Windows\System\lfijLua.exe
  C:\Windows\System\lfijLua.exe
  2⤵
  PID:8756
- C:\Windows\System\VqetXWy.exe
  C:\Windows\System\VqetXWy.exe
  2⤵
  PID:8816
- C:\Windows\System\kZEtdzu.exe
  C:\Windows\System\kZEtdzu.exe
  2⤵
  PID:8964
- C:\Windows\System\pClgtal.exe
  C:\Windows\System\pClgtal.exe
  2⤵
  PID:9028
- C:\Windows\System\blHsyJX.exe
  C:\Windows\System\blHsyJX.exe
  2⤵
  PID:9072
- C:\Windows\System\kNPuLIo.exe
  C:\Windows\System\kNPuLIo.exe
  2⤵
  PID:9136
- C:\Windows\System\neEDFVe.exe
  C:\Windows\System\neEDFVe.exe
  2⤵
  PID:9200
- C:\Windows\System\VysbhbR.exe
  C:\Windows\System\VysbhbR.exe
  2⤵
  PID:8296
- C:\Windows\System\sadXJUl.exe
  C:\Windows\System\sadXJUl.exe
  2⤵
  PID:8428
- C:\Windows\System\AURhTWg.exe
  C:\Windows\System\AURhTWg.exe
  2⤵
  PID:8508
- C:\Windows\System\mSmPxSc.exe
  C:\Windows\System\mSmPxSc.exe
  2⤵
  PID:9052
- C:\Windows\System\IRJFcnf.exe
  C:\Windows\System\IRJFcnf.exe
  2⤵
  PID:7652
- C:\Windows\System\nCxTqBq.exe
  C:\Windows\System\nCxTqBq.exe
  2⤵
  PID:8360
- C:\Windows\System\IKALLsH.exe
  C:\Windows\System\IKALLsH.exe
  2⤵
  PID:8408
- C:\Windows\System\IwMWEFt.exe
  C:\Windows\System\IwMWEFt.exe
  2⤵
  PID:8540
- C:\Windows\System\IXmhwuw.exe
  C:\Windows\System\IXmhwuw.exe
  2⤵
  PID:8952
- C:\Windows\System\aExMLoC.exe
  C:\Windows\System\aExMLoC.exe
  2⤵
  PID:9044
- C:\Windows\System\JmGgREk.exe
  C:\Windows\System\JmGgREk.exe
  2⤵
  PID:9148
- C:\Windows\System\pEPQHhO.exe
  C:\Windows\System\pEPQHhO.exe
  2⤵
  PID:9212
- C:\Windows\System\NsrEXeg.exe
  C:\Windows\System\NsrEXeg.exe
  2⤵
  PID:8608
- C:\Windows\System\VxUYpli.exe
  C:\Windows\System\VxUYpli.exe
  2⤵
  PID:8912
- C:\Windows\System\KnohlAH.exe
  C:\Windows\System\KnohlAH.exe
  2⤵
  PID:8916
- C:\Windows\System\QFPciKT.exe
  C:\Windows\System\QFPciKT.exe
  2⤵
  PID:8244
- C:\Windows\System\NHIxVcV.exe
  C:\Windows\System\NHIxVcV.exe
  2⤵
  PID:8708
- C:\Windows\System\DqAuadY.exe
  C:\Windows\System\DqAuadY.exe
  2⤵
  PID:9168
- C:\Windows\System\PSRilLu.exe
  C:\Windows\System\PSRilLu.exe
  2⤵
  PID:8224
- C:\Windows\System\goGeTuH.exe
  C:\Windows\System\goGeTuH.exe
  2⤵
  PID:2276
- C:\Windows\System\eWkNVCB.exe
  C:\Windows\System\eWkNVCB.exe
  2⤵
  PID:9000
- C:\Windows\System\NMTvdYU.exe
  C:\Windows\System\NMTvdYU.exe
  2⤵
  PID:9180
- C:\Windows\System\mMUWXHT.exe
  C:\Windows\System\mMUWXHT.exe
  2⤵
  PID:8564
- C:\Windows\System\ggIaXvX.exe
  C:\Windows\System\ggIaXvX.exe
  2⤵
  PID:9116
- C:\Windows\System\YotYzfm.exe
  C:\Windows\System\YotYzfm.exe
  2⤵
  PID:8768
- C:\Windows\System\xqRHQUm.exe
  C:\Windows\System\xqRHQUm.exe
  2⤵
  PID:2140
- C:\Windows\System\gwReUTe.exe
  C:\Windows\System\gwReUTe.exe
  2⤵
  PID:8340
- C:\Windows\System\sywLKTr.exe
  C:\Windows\System\sywLKTr.exe
  2⤵
  PID:1164
- C:\Windows\System\mWEDaSX.exe
  C:\Windows\System\mWEDaSX.exe
  2⤵
  PID:8932
- C:\Windows\System\UWunjQf.exe
  C:\Windows\System\UWunjQf.exe
  2⤵
  PID:9228
- C:\Windows\System\nQCKozh.exe
  C:\Windows\System\nQCKozh.exe
  2⤵
  PID:9244
- C:\Windows\System\oCVTykJ.exe
  C:\Windows\System\oCVTykJ.exe
  2⤵
  PID:9260
- C:\Windows\System\MCIWknh.exe
  C:\Windows\System\MCIWknh.exe
  2⤵
  PID:9280
- C:\Windows\System\HgItQcC.exe
  C:\Windows\System\HgItQcC.exe
  2⤵
  PID:9300
- C:\Windows\System\wXgpOJr.exe
  C:\Windows\System\wXgpOJr.exe
  2⤵
  PID:9316
- C:\Windows\System\CkRQoua.exe
  C:\Windows\System\CkRQoua.exe
  2⤵
  PID:9336
- C:\Windows\System\PvQgOJF.exe
  C:\Windows\System\PvQgOJF.exe
  2⤵
  PID:9356
- C:\Windows\System\RyDOxDz.exe
  C:\Windows\System\RyDOxDz.exe
  2⤵
  PID:9380
- C:\Windows\System\VBEwmJt.exe
  C:\Windows\System\VBEwmJt.exe
  2⤵
  PID:9396
- C:\Windows\System\Kqmndtp.exe
  C:\Windows\System\Kqmndtp.exe
  2⤵
  PID:9412
- C:\Windows\System\iERjokR.exe
  C:\Windows\System\iERjokR.exe
  2⤵
  PID:9428
- C:\Windows\System\FrOePXp.exe
  C:\Windows\System\FrOePXp.exe
  2⤵
  PID:9448
- C:\Windows\System\lPNSUqx.exe
  C:\Windows\System\lPNSUqx.exe
  2⤵
  PID:9464
- C:\Windows\System\xbLKiPX.exe
  C:\Windows\System\xbLKiPX.exe
  2⤵
  PID:9480
- C:\Windows\System\VaMBxNc.exe
  C:\Windows\System\VaMBxNc.exe
  2⤵
  PID:9496
- C:\Windows\System\wyOarim.exe
  C:\Windows\System\wyOarim.exe
  2⤵
  PID:9512
- C:\Windows\System\FwDDFlk.exe
  C:\Windows\System\FwDDFlk.exe
  2⤵
  PID:9528
- C:\Windows\System\cnUfyYv.exe
  C:\Windows\System\cnUfyYv.exe
  2⤵
  PID:9544
- C:\Windows\System\MvpMfiR.exe
  C:\Windows\System\MvpMfiR.exe
  2⤵
  PID:9572
- C:\Windows\System\xpdxyAr.exe
  C:\Windows\System\xpdxyAr.exe
  2⤵
  PID:9592
- C:\Windows\System\FFPoNQQ.exe
  C:\Windows\System\FFPoNQQ.exe
  2⤵
  PID:9608
- C:\Windows\System\terahAI.exe
  C:\Windows\System\terahAI.exe
  2⤵
  PID:9708
- C:\Windows\System\luLdayb.exe
  C:\Windows\System\luLdayb.exe
  2⤵
  PID:9772
- C:\Windows\System\eaBXafd.exe
  C:\Windows\System\eaBXafd.exe
  2⤵
  PID:9788
- C:\Windows\System\FPgsxFV.exe
  C:\Windows\System\FPgsxFV.exe
  2⤵
  PID:9804
- C:\Windows\System\XuOkXMk.exe
  C:\Windows\System\XuOkXMk.exe
  2⤵
  PID:9820
- C:\Windows\System\VMYDYKi.exe
  C:\Windows\System\VMYDYKi.exe
  2⤵
  PID:9836
- C:\Windows\System\uedunqU.exe
  C:\Windows\System\uedunqU.exe
  2⤵
  PID:9876
- C:\Windows\System\EOnYzEB.exe
  C:\Windows\System\EOnYzEB.exe
  2⤵
  PID:9892
- C:\Windows\System\qYHcKGA.exe
  C:\Windows\System\qYHcKGA.exe
  2⤵
  PID:9928
- C:\Windows\System\MRKRYkx.exe
  C:\Windows\System\MRKRYkx.exe
  2⤵
  PID:9944
- C:\Windows\System\KksFfHq.exe
  C:\Windows\System\KksFfHq.exe
  2⤵
  PID:9968
- C:\Windows\System\oTZnvIG.exe
  C:\Windows\System\oTZnvIG.exe
  2⤵
  PID:9984
- C:\Windows\System\ZJiwtNV.exe
  C:\Windows\System\ZJiwtNV.exe
  2⤵
  PID:10000
- C:\Windows\System\SLcvKGs.exe
  C:\Windows\System\SLcvKGs.exe
  2⤵
  PID:10016
- C:\Windows\System\YIDhKCb.exe
  C:\Windows\System\YIDhKCb.exe
  2⤵
  PID:10156
- C:\Windows\System\zoPHDhC.exe
  C:\Windows\System\zoPHDhC.exe
  2⤵
  PID:10176
- C:\Windows\System\vaLVMtf.exe
  C:\Windows\System\vaLVMtf.exe
  2⤵
  PID:10200
- C:\Windows\System\iMhJEbS.exe
  C:\Windows\System\iMhJEbS.exe
  2⤵
  PID:10228
- C:\Windows\System\WApHtjR.exe
  C:\Windows\System\WApHtjR.exe
  2⤵
  PID:9132
- C:\Windows\System\bhJvYSB.exe
  C:\Windows\System\bhJvYSB.exe
  2⤵
  PID:8896
- C:\Windows\System\OPiofep.exe
  C:\Windows\System\OPiofep.exe
  2⤵
  PID:8324
- C:\Windows\System\SeabWhc.exe
  C:\Windows\System\SeabWhc.exe
  2⤵
  PID:9056
- C:\Windows\System\AuvDClw.exe
  C:\Windows\System\AuvDClw.exe
  2⤵
  PID:9540
- C:\Windows\System\XjFcXmH.exe
  C:\Windows\System\XjFcXmH.exe
  2⤵
  PID:9632
- C:\Windows\System\QpFbqra.exe
  C:\Windows\System\QpFbqra.exe
  2⤵
  PID:9956
- C:\Windows\System\NFmnfot.exe
  C:\Windows\System\NFmnfot.exe
  2⤵
  PID:10036
- C:\Windows\System\cPqoGMP.exe
  C:\Windows\System\cPqoGMP.exe
  2⤵
  PID:10028
- C:\Windows\System\OnTICTv.exe
  C:\Windows\System\OnTICTv.exe
  2⤵
  PID:9740
- C:\Windows\System\gEjMUTV.exe
  C:\Windows\System\gEjMUTV.exe
  2⤵
  PID:9760
- C:\Windows\System\rIjukfo.exe
  C:\Windows\System\rIjukfo.exe
  2⤵
  PID:10052
- C:\Windows\System\BlXAOZz.exe
  C:\Windows\System\BlXAOZz.exe
  2⤵
  PID:10076
- C:\Windows\System\MsLydzo.exe
  C:\Windows\System\MsLydzo.exe
  2⤵
  PID:10092
- C:\Windows\System\QnkEWjl.exe
  C:\Windows\System\QnkEWjl.exe
  2⤵
  PID:10108
- C:\Windows\System\DylJxdh.exe
  C:\Windows\System\DylJxdh.exe
  2⤵
  PID:10152
- C:\Windows\System\QBJbdZl.exe
  C:\Windows\System\QBJbdZl.exe
  2⤵
  PID:9620
- C:\Windows\System\xpnBtlP.exe
  C:\Windows\System\xpnBtlP.exe
  2⤵
  PID:9960
- C:\Windows\System\ylwPDpp.exe
  C:\Windows\System\ylwPDpp.exe
  2⤵
  PID:10164
- C:\Windows\System\PGHKlFI.exe
  C:\Windows\System\PGHKlFI.exe
  2⤵
  PID:10212
- C:\Windows\System\TQUbHNN.exe
  C:\Windows\System\TQUbHNN.exe
  2⤵
  PID:8720
- C:\Windows\System\WtKWPzb.exe
  C:\Windows\System\WtKWPzb.exe
  2⤵
  PID:9976
- C:\Windows\System\SNietGh.exe
  C:\Windows\System\SNietGh.exe
  2⤵
  PID:9812
- C:\Windows\System\wffyxgB.exe
  C:\Windows\System\wffyxgB.exe
  2⤵
  PID:9252
- C:\Windows\System\XAuINGa.exe
  C:\Windows\System\XAuINGa.exe
  2⤵
  PID:9664
- C:\Windows\System\kbUpGjg.exe
  C:\Windows\System\kbUpGjg.exe
  2⤵
  PID:9668
- C:\Windows\System\rladUNh.exe
  C:\Windows\System\rladUNh.exe
  2⤵
  PID:9624
- C:\Windows\System\xODhnGw.exe
  C:\Windows\System\xODhnGw.exe
  2⤵
  PID:9628
- C:\Windows\System\ycQtOpn.exe
  C:\Windows\System\ycQtOpn.exe
  2⤵
  PID:9676
- C:\Windows\System\PuNajMM.exe
  C:\Windows\System\PuNajMM.exe
  2⤵
  PID:9848
- C:\Windows\System\FcjEGIc.exe
  C:\Windows\System\FcjEGIc.exe
  2⤵
  PID:9716
- C:\Windows\System\hKAgQGR.exe
  C:\Windows\System\hKAgQGR.exe
  2⤵
  PID:9908
- C:\Windows\System\HtwnYMX.exe
  C:\Windows\System\HtwnYMX.exe
  2⤵
  PID:10044
- C:\Windows\System\UCLHLKG.exe
  C:\Windows\System\UCLHLKG.exe
  2⤵
  PID:10012
- C:\Windows\System\zjlJXRc.exe
  C:\Windows\System\zjlJXRc.exe
  2⤵
  PID:10060
- C:\Windows\System\AACoFJz.exe
  C:\Windows\System\AACoFJz.exe
  2⤵
  PID:8412
- C:\Windows\System\pAsxfyg.exe
  C:\Windows\System\pAsxfyg.exe
  2⤵
  PID:8820
- C:\Windows\System\BeqoqOm.exe
  C:\Windows\System\BeqoqOm.exe
  2⤵
  PID:9224
- C:\Windows\System\sKPlbdI.exe
  C:\Windows\System\sKPlbdI.exe
  2⤵
  PID:9408
- C:\Windows\System\YxBrBbQ.exe
  C:\Windows\System\YxBrBbQ.exe
  2⤵
  PID:8984
- C:\Windows\System\zrrZJtW.exe
  C:\Windows\System\zrrZJtW.exe
  2⤵
  PID:7456
- C:\Windows\System\fMtXrao.exe
  C:\Windows\System\fMtXrao.exe
  2⤵
  PID:9104
- C:\Windows\System\VGwkLie.exe
  C:\Windows\System\VGwkLie.exe
  2⤵
  PID:8752
- C:\Windows\System\GsGgntk.exe
  C:\Windows\System\GsGgntk.exe
  2⤵
  PID:10116
- C:\Windows\System\uWFFqrY.exe
  C:\Windows\System\uWFFqrY.exe
  2⤵
  PID:9996
- C:\Windows\System\TLYkiAy.exe
  C:\Windows\System\TLYkiAy.exe
  2⤵
  PID:10048
- C:\Windows\System\rKidQcT.exe
  C:\Windows\System\rKidQcT.exe
  2⤵
  PID:9376
- C:\Windows\System\EesmQes.exe
  C:\Windows\System\EesmQes.exe
  2⤵
  PID:9980
- C:\Windows\System\wpPgZCj.exe
  C:\Windows\System\wpPgZCj.exe
  2⤵
  PID:10132
- C:\Windows\System\AaFdDWc.exe
  C:\Windows\System\AaFdDWc.exe
  2⤵
  PID:9236
- C:\Windows\System\RNTcbJd.exe
  C:\Windows\System\RNTcbJd.exe
  2⤵
  PID:9568
- C:\Windows\System\XniESNS.exe
  C:\Windows\System\XniESNS.exe
  2⤵
  PID:9492
- C:\Windows\System\tdITQQs.exe
  C:\Windows\System\tdITQQs.exe
  2⤵
  PID:9904
- C:\Windows\System\BxldkGB.exe
  C:\Windows\System\BxldkGB.exe
  2⤵
  PID:9272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AcrnxbV.exe

Filesize
1.9MB

MD5
f0c20bf5f9a8f0ac013494cde1858343

SHA1
995a8c1dd20e9e703985777f86160494ba0ccffd

SHA256
5b84654c7257faef42d92f2097145b4e8349e0c0d885381a0137f63003360fd3

SHA512
b5c3425c0b137964dd00bf9e4464e3bc86c49b515867e8b5098941d32e4d18b6f5422689b045588c4cbc81dc9b46f7d3b22fb25d271cdf6c4b08316909c14725

Download Submit
C:\Windows\system\ArgWfgN.exe

Filesize
1.9MB

MD5
52ea9a152e8a7831ff47ac6c79ed0acd

SHA1
c18beebfbce08647f1d0d01782c0e09d197310bb

SHA256
cae1be2600b0df1379700137a86543d83ac0d61f6c1137bdd00f64dcb7fa9d8f

SHA512
7abbb90b23abc389b6b55c76c402fa0a19219538473a1fdda273a2eb6be8fb3ba293086f0a2bf99615bd4327921890232dcca766233afefbdf173e0b61c4112a

Download Submit
C:\Windows\system\BzHZhXE.exe

Filesize
1.9MB

MD5
8669dc77424e9b78d5a15902f07ad7fd

SHA1
88c2bce4a972f086bd4dc0e3ee456b6b15854676

SHA256
e61c78e0c77e2f53ce5246e1ef0d9fe08b547bc25a090b90935feff6fe8bd309

SHA512
db1b646a1399656b92d5e79998d18550cce9f68b11af09fe717cd578127b59fe2fd7081d156dd37f66646dff7d2af25c8776cf1984e1a735a62ae0ebb278c485

Download Submit
C:\Windows\system\FOeynVn.exe

Filesize
1.9MB

MD5
cfb1a0409ee9b0e573c1e3d0428c3b17

SHA1
373d59270225da330b9912c9fd9d46b5af32c391

SHA256
f820367892b9529aec420419d7eaf4b09fed7fc6e486b984c4181691c6a05a1f

SHA512
e5a6292420e5036b85f9f0562fb5cf958f5e159d10738dba6f86e8cff1af75d3837202d4262f4c7eb21f8082513bc84cc76258035af4f3efe0bef88781bbe8fb

Download Submit
C:\Windows\system\GgoaAXY.exe

Filesize
1.9MB

MD5
5ca41209307255c88c024fc12da7f431

SHA1
a75621018b1cc262aaa42252bd04d6a7c020dde7

SHA256
a8f24f283a06edc18b438b77d58a150fd97848947a12a615cb063bafcbfa21c5

SHA512
ec4dcdc0259de275c9d5254273ddbf7db97a636b6c1c3218dfac7034f656af87563e249a53742b67b51fb8b0980b5f1203bbe86a9f09b18473745d2528646c76

Download Submit
C:\Windows\system\HtuxlWR.exe

Filesize
1.9MB

MD5
1ce34e47c978c49c88e9dd874546fc98

SHA1
35c2d86917abb3c967d396ca050ca2f944a3c72e

SHA256
34ced9cecc638024d82fe4a3ce89908cf813c36b7f49c19f21a7aae62a25ccec

SHA512
d997fe5780bf8d486061906bef7a57f3302dd8a77fe14deecf5ca63160a43ffea1c8d8097f6f60fedfaf15f5ffda867e2984169ae8e5e3f905b5758255a5c234

Download Submit
C:\Windows\system\PNMLMhB.exe

Filesize
1.9MB

MD5
caae76ad510c248354be12f3b1a7626f

SHA1
850a8c0c5d74067be41e2a1cba84dd4556da199a

SHA256
4e7749f8ee0ce043137c6bdbcecbed0fe9c654221ecb0f31db9fa97dfac32ca3

SHA512
3222d5eb6ba2930be7e686051026487a9d14e9ac626949470a023724234f18005fb6dbf5d8e8ce2c6fb9d201685ffac5e6bf65066efe4aeb9c98b1ab787f6aee

Download Submit
C:\Windows\system\QfPXCzf.exe

Filesize
1.9MB

MD5
677aedca5e4501562a9583ed596fe324

SHA1
f8807dad754a4b5881f0b6662a3ee712f6032671

SHA256
aa5292b0175384dd18d60803553387ef61d3fef62ad4301826c13b794c1fbd40

SHA512
179d173ac3215f69943ba8cb16acd38f1a57582df52fcc5dc8bca8ffbb832fc85c9e8e7acf75073a4e386141092bf955afe4709e235f72e197021d42a3fa2af6

Download Submit
C:\Windows\system\RNJjWQs.exe

Filesize
1.9MB

MD5
9778ef79a153b726ab5485d31d3e52fe

SHA1
8bd933c5a4735c3bdba7e54b569e169e50688d48

SHA256
45ebe08da2e8aeb832dd762f21ce5cfb25f5154e6c3b7ce2151f0249b48b8358

SHA512
4f8bf395c2570e4edcb7b0fdbdf4b4f4cd47db1cd8c6b4127dc283c1d72db270d54e5d9e52308dc4ce3245bd7c02f6d3db326aef86ad221a5479970245d39936

Download Submit
C:\Windows\system\VsTAdBl.exe

Filesize
1.9MB

MD5
ee28d12af9e8e31e4734b1249ec1699f

SHA1
a688788618362fd9510180f7d6693e1a23a638ea

SHA256
52fabbced0145fe43fb13093ee60d04875af03e9e28b94cda0c033dbc3dab2e3

SHA512
c97761d65378ef0ec8eb465d073b1d9cfa44201a720620c091781faef803de7320c26943406889a0029fa8b9144ef318792de0779687396d07b944efb4258ce2

Download Submit
C:\Windows\system\YKtuxhm.exe

Filesize
1.9MB

MD5
ff5159d4bffa14f1ae00fd0de2bbc0a6

SHA1
50aea0e1e7b801d366edcbbe8852139e2752d608

SHA256
85f0a4842a3fa9a4c06c3375b474c140aace4f2163afb8cd9e356db1c403ca99

SHA512
ac002a5edb39cd45d685365d71ac8c4bb7d4687283f0bc409093a132c4ed96f833bbc6a0e4f46071036f53a0bd4f57355b7a98c37157f3e30050c55613e9e585

Download Submit
C:\Windows\system\caURlES.exe

Filesize
1.9MB

MD5
6ed3b87dd8c975002e23604f02cf838f

SHA1
0e9341c94464ff284421add29507edd785e67f8e

SHA256
11648b3468ebbdf5a3d2785d8e4094b857056e16329f9330c5209934ed905ac2

SHA512
57035b629088d9b65ed2343811cfdfde1796956ac3d9ee0acf058bf0ef7f67fd0b0b4637d41203217ca843aa8e9e41806c2c1c6ae68096285cae0a8de0612761

Download Submit
C:\Windows\system\eFDotWl.exe

Filesize
1.9MB

MD5
49eb0be2346f070cc0c7d75309cf00a9

SHA1
3ce95125a7a7021a8e51c91f747cd6bf3ab23162

SHA256
064b0aeea7b60c7e5ff807cea410f9536b9b6728436c5922edeea6b3e2083210

SHA512
982a363947cc0461343f8fff84281efd5989421206c3c11d1682496c2a8b0ede0ac30c176379ca38a5dc07640d799265d732c015da49327d7c9a902dade8e2a3

Download Submit
C:\Windows\system\ecMIcQH.exe

Filesize
1.9MB

MD5
d5512ab0adef7d308a16ea1c3fae2dd9

SHA1
4dc35fb1c649f601eb09f0212f55f96bc04bd4a5

SHA256
3831e087ffd7449566944db5b4cc55f58bf723b04908f7eed05974cb1dce725a

SHA512
6f3d656a1b1a88eda5e61669fec3f6aee650aafb4e3d1b10c98381d4fc5e8ff9c499d7ac7aa134c3082bd69ad780197af3d464641a445f532f68b6ef69821c89

Download Submit
C:\Windows\system\hXuvRUL.exe

Filesize
1.9MB

MD5
00450b7da89d516db57024dcd820f855

SHA1
1e848c4ea84cb36907408432b302ba014513e278

SHA256
f1106a57d07ddd654b2dd49b7d79003102350fc8449314b80cb7035cea338eed

SHA512
9b0f6b2a1e2251c6a8496e6aecb4cbd378d451c3756c0ffdf4bc57880bac37ddb87ad511e6c62ab05983d5acebaaab5019ed45b4824619bca7e013372ed31fd0

Download Submit
C:\Windows\system\iOyveYI.exe

Filesize
1.9MB

MD5
6120f5203c92e842bd6f38b10f252d4a

SHA1
e686200dadcf5900276a3f975a0d2833c27d00bf

SHA256
ae07412515b96e46fcc8fda0cfebcb4fe6e4c8f726104cad0b4bf849a26d9112

SHA512
4b7aaa320e7729838270945f8b86f4b005325732ddfd2dcc60b9f89251c46955eb6ad53f1b994ad411770eefff3a672c03fafa52b11adc5dcf56b2caf302a37e

Download Submit
C:\Windows\system\jaPFTIa.exe

Filesize
1.9MB

MD5
d610e3d4ca8391e93a1935ed5c9a8ad1

SHA1
07622e4f299aa09f263162ea226af3ff6118e05f

SHA256
8126faea85b6a114adb77b00fc67b4d39c855fb1a917af4b8d34a56ae9cb2169

SHA512
696f61dc69b602cd56e17de85cae301299596c5813dfc4d4bb596e9a15565ac425c375aa9c94bf761145eb8d1d5713301a5794b9a6aec1683deb450132abe2bb

Download Submit
C:\Windows\system\kFpyWhU.exe

Filesize
1.9MB

MD5
220dbed54d23dbb2d2e8b0dad4f6e8db

SHA1
464a006d66c32a8f38eda0592112fdc22654fb54

SHA256
ae83439c52a677f5b0c2701021e5283fdea5aa56c17789b15dacacae78b9900f

SHA512
8250e50fb3288244873e9d285ade0bba5f882f40fde6aa8918b3427b2e30188c3ffadbd6cdad14a2329ce51374ec8f576d8cda2f84329861ef3af4c377dfc95d

Download Submit
C:\Windows\system\ogQHHqx.exe

Filesize
1.9MB

MD5
654e7f489d4fcb6a22b69455f665d458

SHA1
d86b380fb52c5716d884f72236c8703188e80724

SHA256
f9fe368dffda716b2df8a230fdb173ecc1bd2ebfad4ba80904057c92b697b5dc

SHA512
6be355440cc069f98fd0a4068dccfe9f707dc74c612130814721f907736a5197e7d5f5b3aa1c54590283da197729cd381cd964ac33ca1016dd0cc0aa90420dee

Download Submit
C:\Windows\system\uDNDTbX.exe

Filesize
1.9MB

MD5
cf2b7a4d4cddbcfefb77f0696da28891

SHA1
35af487d80739c7561ac5f12c8f6bf8e01212006

SHA256
87db1dc9366d2c430090c779252dfe8410a32e0637c94b92c627173d2eb3b580

SHA512
db0b91bbc22d7829e243ce5a335b31a2b79717cc762d039a13eeede18f4852e9d9984b0910ea36ee26cd497b195e41228db030aac5e223d4644b7061623082ea

Download Submit
C:\Windows\system\zKTijaD.exe

Filesize
1.9MB

MD5
d8fc3c2cc5ed92f34c079d0084c27434

SHA1
d2f8907bab6ffe87f17e0c9d67a7670c9ee7f1f3

SHA256
772ca7d2fe299b149e2e8cc3d8a51678feff8570551bc4c2e2f7bfeffeacb647

SHA512
109934f057d22a0f41d3871d70158cc1da6fbc617c0e1bc8c1b2da0817456ac09ebc0d1ce421c3f9be6d217895c17e1c94949bee4d33cbe5871387d02e8b097e

Download Submit
\Windows\system\DACUxJz.exe

Filesize
1.9MB

MD5
5ea447b1b51ab098e9238b39ac542ac5

SHA1
2547241a370c30cf35638a4383214ec0e3b6b9cc

SHA256
b89e1ab71fab7954ec470fb1475b33f525a4b716c04c58701f0e94b0e17e846a

SHA512
5746b32dbffde853fa40c77dc72dd0d31bff60c012ec78a74d081eb351726d331511b2608b4c8be8d4e1cc9932d18197e6075d245ed914e8e5952be6ddfebf95

Download Submit
\Windows\system\EhTZqIp.exe

Filesize
1.9MB

MD5
ddbd6cfdc631cd1a340fece1aa496cae

SHA1
0570a6f4aae150ee0aef06977524d414db4dc344

SHA256
49cd50b403407c5bf404e6b0b72399d839fb42d35a6b579f47935ac7c6bd8f8b

SHA512
eaeab0796ceda46d026629bf997c7044fbfd0b3efdafc69a7dc268d9b3d6eaac2831a523ab9149c60b095863aa39af7684fb198d0b0b0b621b942dfd82c9e9ac

Download Submit
\Windows\system\HmReSOx.exe

Filesize
1.9MB

MD5
d413d57a6bed3fc01369af7bcce98134

SHA1
b832aef4e07984e96bd5c00ee79d7933e1788174

SHA256
cf05e23fb6e7d57cb9f39692094274f32e648296765cd9f61338badd0eb67579

SHA512
a6c24ac8c34fa939c3d8a23e9522b9707adfd303136383b7167fff4be3c109711f18b82dda53a419aa884376ec480c66a116c24dde0956b956f85a41c29060d7

Download Submit
\Windows\system\SdBcvlG.exe

Filesize
1.9MB

MD5
5cfeef338485c374dc964e57e66311fd

SHA1
98c755895d1df1fd18ded891828bda835069bbdb

SHA256
53d3cf5e592c6a2edc2e9a66174b6b2a62166e317a65aa8243c6a71a76b24e9a

SHA512
73e1564249b50bc9cbe44b34bdc00df9c661ed4521e8f02f3fb63363a93080ba543c648e7f74664fe295de64abd09f21cd1ef894065dd98098db8a39e9e2f0a4

Download Submit
\Windows\system\YSAveBu.exe

Filesize
1.9MB

MD5
cd5bcf35545d7e7236fd058638dcd05e

SHA1
91a95b97b15839803df2f1e4c2a05c9858aa1fe1

SHA256
3516891937eed77f0533b55000b376c728d44c98955cb28ce9d7cfe51f9ebe44

SHA512
4e0ea911d9ed101bbd604cedcaf856d1d071fae98af3cbb35d5568e407351659dc28c0d5f3b2abdb2209b019448e6f5d741d5725680b2b673512a0c54c083285

Download Submit
\Windows\system\dIsPYPf.exe

Filesize
1.9MB

MD5
1c71dd647e1f783a97ecf07f0c67be17

SHA1
0b90fd7c4796554218a646c9f1ab80c87a300603

SHA256
6f369cc45137dc9529942f432b766a8146a7ddebca4d522b1b53dc2411f88154

SHA512
1854f02bb3ff7da3ed2449c68b50aab27bbbe177e41ae48618405d8d0298d014496fcc87ad5850fd95da91d7c68a216056460eecb1314f040e23be1e509cb88f

Download Submit
\Windows\system\dzaBsjd.exe

Filesize
1.9MB

MD5
b88bfd168a61931fbd96c068e48e4f5b

SHA1
08069fce68f020f0686e08dbbbe514a31ffee826

SHA256
56d24ded9b3977f08ff2f8e5c32f762ec65cc5a8ed7fb76962dc3e47ae37f972

SHA512
8f64fe94f4de6fd80290d8e0137a831c525f885488445a89a7f558b27a1760c5bec7c3e2585687ee9200ab66729f6ee8ef4851c1f74b2460b37ef74021581525

Download Submit
\Windows\system\lVnMsaL.exe

Filesize
1.9MB

MD5
7ee42c21e2729ce864f9f2b4f175d3f2

SHA1
cdcf38ec989ea122f69dfbd774bb89510284f180

SHA256
2b191bdd76258265f83f7139fa092e54fbdadd4e11f3bf49846c8169e970e8a1

SHA512
a612f06248f71cb9ffad572634f0deb218835119f675f5b73bd1749ed4638037ab980df2776176726a4ce5a3799073cc0aea6f36ba5e73deda8f5dea2856fdce

Download Submit
\Windows\system\oNbbtbB.exe

Filesize
1.9MB

MD5
a85a2a9437ad0a1833b677878d7f6761

SHA1
6840e5ed96cd86f603f185febd1693cf77f83d3f

SHA256
c886aca90c8b23d67c9d02c7332f2e35d65be6396483b55c61a12b8367fe40a9

SHA512
662c0878e8b663d74b38adf262dcff76c4dc29eb9effba38a262e8fa5b1374ed2c66c08fea5ffdef2692bf0dece255c295c71a409f5b603fb0bb8d83714c867c

Download Submit
\Windows\system\sQPqZtl.exe

Filesize
1.9MB

MD5
4074cd8072198b25786003e0cf56e4fd

SHA1
85cdc0dd8cbd1473434bebda516cf54384d9a8a3

SHA256
13be6ffc383f24c25852d4aaed9cc637643de77d794bea85d86b106d4c66f439

SHA512
bbe4112bea21a3873cdd7230a7482daf43601242cbb92955e79ccae54058142fbbc8f49f2f0411ff1c74618027dd3dbb04ae356207b9b6aa75954c96fa1b8605

Download Submit
\Windows\system\zwaJTJH.exe

Filesize
1.9MB

MD5
44b9657eab06a6d69231470e43afddce

SHA1
2a17283b187751dfd62c06ee0339d5aa4cd4b2f8

SHA256
9c3524f9889d648c8e3188421f1410dd423bd79a0660c03b825944d698a1e859

SHA512
3354a7b49934ce50a359daa91c0f57eef6d0c687f97e6f33b7393a8d2fa338a523d8734bce3ca06d7e7829c319fe8b5f159981261145eb16e3b646aebfc8868e

Download Submit
memory/764-43-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/764-46-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1960-76-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/1988-49-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2024-91-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2024-28-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2456-60-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2572-411-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2572-41-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2608-63-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-118-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-32-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-34-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2764-79-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2764-20-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2864-80-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-162-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2952-37-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-7-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2952-61-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-47-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2952-29-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-0-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2952-175-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2952-176-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2952-33-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2952-1351-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2952-78-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2952-77-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2952-56-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2952-74-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2952-35-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2952-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/3020-168-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download