xmrig | 2a3fcc9f198b43755c652672f90fe09c6ae866ea36971279a8c132e32f14f80d

Analysis

max time kernel
15s
max time network
37s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
Size

1.9MB
MD5

09cfc6e7fe9de3c6fd3353c7515cfe9b
SHA1

dec3ddf9f4fe03ae23d13cc43eef0f800a29f4dc
SHA256

2a3fcc9f198b43755c652672f90fe09c6ae866ea36971279a8c132e32f14f80d
SHA512

deaae1d1a7a734b454272e5eeeab1d2963b0edfc390e3bafb4bc772d9033765187bd0daf418d182f1cecb656f428110635125c63480ec2c11e2fe214f2c6ac9b
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U7g:NABJ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/1616-80-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2616-95-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2348-97-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2864-69-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2288-102-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2100-89-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2468-76-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2688-75-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2736-70-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2716-57-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2576-52-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1616	nYahJtk.exe
2100	JdRsfcm.exe
2576	ZRtZFhZ.exe
2716	eOXnyoC.exe
2864	empAkAc.exe
2736	JeEOfUu.exe
2672	VEiZRtC.exe
2688	ZnkgGHz.exe
2616	jvkYSoQ.exe
2348	nRDpWtQ.exe
2288	wwypXdy.exe
2468	xEyvdOE.exe
2528	ISnaeXy.exe
2768	WQIjxbE.exe
1076	WHYGoAD.exe
2784	ztiKekW.exe
2180	YXFCQhe.exe
2124	XKpjWjV.exe
2280	FNCRrrw.exe
2788	UsHSwiG.exe
2108	fkgoUIp.exe
1680	BvCNnfd.exe
1436	qZvtDLt.exe
852	uredaTe.exe
1980	CdRbwTe.exe
2724	bwoxEoK.exe
1156	ONYawak.exe
1716	RiPPmxD.exe
1792	EHNgOlg.exe
656	parWVSs.exe
452	pYlUQVz.exe
1360	UJYbnhC.exe
640	xbMircm.exe
1604	qshIEsV.exe
964	MundmnW.exe
1316	ecJrKgg.exe
1136	gnvuxvB.exe
2332	lxAISqF.exe
320	FcWwhPj.exe
792	jIdkGwr.exe
1296	MCaaScQ.exe
1632	OyEdCdk.exe
2068	CZvhGtY.exe
784	XaKyNLB.exe
328	RbPFxES.exe
296	ptTxzzP.exe
2164	suHUssV.exe
2656	bXZAXob.exe
1908	wiDiDbe.exe
2876	SUEfzqx.exe
1644	qkkzbGC.exe
1588	yvcqyxI.exe
2692	PDQTFdR.exe
2812	cjsEBjz.exe
2840	AYtakZs.exe
864	GaPgvui.exe
692	sLXWbrR.exe
2804	nZoiTCJ.exe
1328	FuZYcuN.exe
1796	XnwWBaq.exe
2560	eZumEIZ.exe
1788	yAtKplh.exe
1164	AvxMILw.exe
1892	srBxmNY.exe

Loads dropped DLL 64 IoCs

pid	Process
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2028-0-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x000c0000000122bb-6.dat	upx
behavioral1/files/0x000a00000001342b-10.dat	upx
behavioral1/files/0x000b0000000141e6-38.dat	upx
behavioral1/files/0x00070000000142c4-43.dat	upx
behavioral1/files/0x00090000000139e0-15.dat	upx
behavioral1/files/0x0008000000013a21-50.dat	upx
behavioral1/files/0x00070000000142b0-54.dat	upx
behavioral1/files/0x0007000000014316-55.dat	upx
behavioral1/memory/1616-80-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2616-95-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2348-97-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0006000000014667-107.dat	upx
behavioral1/files/0x00060000000143ec-108.dat	upx
behavioral1/files/0x00060000000146b8-113.dat	upx
behavioral1/files/0x000600000001448a-119.dat	upx
behavioral1/files/0x0006000000014539-120.dat	upx
behavioral1/files/0x00060000000147ea-125.dat	upx
behavioral1/files/0x0006000000014b70-146.dat	upx
behavioral1/files/0x000a000000013928-153.dat	upx
behavioral1/memory/2864-69-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/2288-102-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x00060000000155f3-171.dat	upx
behavioral1/files/0x00060000000155f7-170.dat	upx
behavioral1/files/0x0006000000015018-164.dat	upx
behavioral1/files/0x00060000000155ed-163.dat	upx
behavioral1/files/0x0006000000014ef8-156.dat	upx
behavioral1/files/0x0006000000014de9-149.dat	upx
behavioral1/files/0x0006000000014b31-143.dat	upx
behavioral1/files/0x0006000000014abe-136.dat	upx
behavioral1/files/0x0006000000014825-128.dat	upx
behavioral1/files/0x00060000000146a2-123.dat	upx
behavioral1/files/0x00060000000146c0-121.dat	upx
behavioral1/memory/2100-89-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2468-76-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2688-75-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2672-72-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2736-70-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x0006000000014af6-141.dat	upx
behavioral1/files/0x00060000000149f5-135.dat	upx
behavioral1/files/0x0006000000014390-65.dat	upx
behavioral1/files/0x00060000000144ac-94.dat	upx
behavioral1/files/0x000600000001447e-93.dat	upx
behavioral1/memory/2716-57-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x000b000000014120-53.dat	upx
behavioral1/memory/2576-52-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/files/0x000c000000013113-11.dat	upx
behavioral1/files/0x0008000000013a71-37.dat	upx
behavioral1/files/0x0008000000013a11-22.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VQjjVml.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\OWcXDze.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\nRDpWtQ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\nZoiTCJ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\FuZYcuN.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\aFplOvU.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\snxFYgE.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\pfAHMcL.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\bOdTbXG.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\zWCRdTQ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\jJlfaLK.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\AzxTIyC.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\pUVqhUR.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\NsLWGVD.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\TGdZKbS.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\RhgxcDL.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\MaiLcNA.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ztiKekW.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\GaPgvui.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\EKBoLmi.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\EygeIiP.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\CXrJVjy.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\xrMEtkg.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\wiDiDbe.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\VcRchln.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ZWuHLzG.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\THaBmPW.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\NGLiySY.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\vkvatFZ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\NXgsXsC.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\xhFuRlh.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\fJRCvSw.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\npwPfuS.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\EWfLHzy.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ecJrKgg.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\JGkvNLF.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\zkzVTWu.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\PrSwBve.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\rGYxIoy.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\CGRxWFW.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\wkJqtVY.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\WZEOlNs.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\CIzxvSW.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\JdksrLc.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\gwJkMfy.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\srBxmNY.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\RJfWILH.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\aySQecx.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\xEyvdOE.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\ZOzciAS.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\WhKOsUF.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\fbNLBAL.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\RNELauk.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\fIhMVbB.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\oILlQvd.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\MYPmuUv.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\HeblCNZ.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\kYrdsQc.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\lMEOohU.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\qmJDUjc.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\PBSCzVR.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\NQacGhc.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\fgmLnjx.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
File created	C:\Windows\System\EaVfAcS.exe	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1828	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
Token: SeDebugPrivilege	1828	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1828	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	29
PID 2028 wrote to memory of 1828	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	29
PID 2028 wrote to memory of 1828	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	29
PID 2028 wrote to memory of 1616	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	30
PID 2028 wrote to memory of 1616	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	30
PID 2028 wrote to memory of 1616	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	30
PID 2028 wrote to memory of 2100	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	31
PID 2028 wrote to memory of 2100	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	31
PID 2028 wrote to memory of 2100	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	31
PID 2028 wrote to memory of 2576	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	32
PID 2028 wrote to memory of 2576	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	32
PID 2028 wrote to memory of 2576	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	32
PID 2028 wrote to memory of 2672	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	33
PID 2028 wrote to memory of 2672	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	33
PID 2028 wrote to memory of 2672	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	33
PID 2028 wrote to memory of 2716	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	34
PID 2028 wrote to memory of 2716	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	34
PID 2028 wrote to memory of 2716	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	34
PID 2028 wrote to memory of 2616	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	35
PID 2028 wrote to memory of 2616	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	35
PID 2028 wrote to memory of 2616	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	35
PID 2028 wrote to memory of 2864	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	36
PID 2028 wrote to memory of 2864	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	36
PID 2028 wrote to memory of 2864	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	36
PID 2028 wrote to memory of 2348	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	37
PID 2028 wrote to memory of 2348	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	37
PID 2028 wrote to memory of 2348	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	37
PID 2028 wrote to memory of 2736	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	38
PID 2028 wrote to memory of 2736	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	38
PID 2028 wrote to memory of 2736	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	38
PID 2028 wrote to memory of 2288	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	39
PID 2028 wrote to memory of 2288	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	39
PID 2028 wrote to memory of 2288	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	39
PID 2028 wrote to memory of 2688	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	40
PID 2028 wrote to memory of 2688	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	40
PID 2028 wrote to memory of 2688	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	40
PID 2028 wrote to memory of 2468	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	41
PID 2028 wrote to memory of 2468	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	41
PID 2028 wrote to memory of 2468	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	41
PID 2028 wrote to memory of 2528	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	42
PID 2028 wrote to memory of 2528	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	42
PID 2028 wrote to memory of 2528	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	42
PID 2028 wrote to memory of 2180	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	43
PID 2028 wrote to memory of 2180	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	43
PID 2028 wrote to memory of 2180	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	43
PID 2028 wrote to memory of 2768	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	44
PID 2028 wrote to memory of 2768	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	44
PID 2028 wrote to memory of 2768	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	44
PID 2028 wrote to memory of 2280	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	45
PID 2028 wrote to memory of 2280	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	45
PID 2028 wrote to memory of 2280	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	45
PID 2028 wrote to memory of 1076	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	46
PID 2028 wrote to memory of 1076	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	46
PID 2028 wrote to memory of 1076	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	46
PID 2028 wrote to memory of 2788	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	47
PID 2028 wrote to memory of 2788	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	47
PID 2028 wrote to memory of 2788	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	47
PID 2028 wrote to memory of 2784	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	48
PID 2028 wrote to memory of 2784	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	48
PID 2028 wrote to memory of 2784	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	48
PID 2028 wrote to memory of 2108	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	49
PID 2028 wrote to memory of 2108	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	49
PID 2028 wrote to memory of 2108	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	49
PID 2028 wrote to memory of 2124	2028	09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09cfc6e7fe9de3c6fd3353c7515cfe9b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System\nYahJtk.exe
  C:\Windows\System\nYahJtk.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\JdRsfcm.exe
  C:\Windows\System\JdRsfcm.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ZRtZFhZ.exe
  C:\Windows\System\ZRtZFhZ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\VEiZRtC.exe
  C:\Windows\System\VEiZRtC.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\eOXnyoC.exe
  C:\Windows\System\eOXnyoC.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\jvkYSoQ.exe
  C:\Windows\System\jvkYSoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\empAkAc.exe
  C:\Windows\System\empAkAc.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\nRDpWtQ.exe
  C:\Windows\System\nRDpWtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\JeEOfUu.exe
  C:\Windows\System\JeEOfUu.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\wwypXdy.exe
  C:\Windows\System\wwypXdy.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\ZnkgGHz.exe
  C:\Windows\System\ZnkgGHz.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\xEyvdOE.exe
  C:\Windows\System\xEyvdOE.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\ISnaeXy.exe
  C:\Windows\System\ISnaeXy.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\YXFCQhe.exe
  C:\Windows\System\YXFCQhe.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\WQIjxbE.exe
  C:\Windows\System\WQIjxbE.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\FNCRrrw.exe
  C:\Windows\System\FNCRrrw.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\WHYGoAD.exe
  C:\Windows\System\WHYGoAD.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\UsHSwiG.exe
  C:\Windows\System\UsHSwiG.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ztiKekW.exe
  C:\Windows\System\ztiKekW.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\fkgoUIp.exe
  C:\Windows\System\fkgoUIp.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\XKpjWjV.exe
  C:\Windows\System\XKpjWjV.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\qshIEsV.exe
  C:\Windows\System\qshIEsV.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\BvCNnfd.exe
  C:\Windows\System\BvCNnfd.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ecJrKgg.exe
  C:\Windows\System\ecJrKgg.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\qZvtDLt.exe
  C:\Windows\System\qZvtDLt.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\gnvuxvB.exe
  C:\Windows\System\gnvuxvB.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\uredaTe.exe
  C:\Windows\System\uredaTe.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\lxAISqF.exe
  C:\Windows\System\lxAISqF.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\CdRbwTe.exe
  C:\Windows\System\CdRbwTe.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\FcWwhPj.exe
  C:\Windows\System\FcWwhPj.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\bwoxEoK.exe
  C:\Windows\System\bwoxEoK.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\jIdkGwr.exe
  C:\Windows\System\jIdkGwr.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ONYawak.exe
  C:\Windows\System\ONYawak.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\MCaaScQ.exe
  C:\Windows\System\MCaaScQ.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\RiPPmxD.exe
  C:\Windows\System\RiPPmxD.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\CZvhGtY.exe
  C:\Windows\System\CZvhGtY.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\EHNgOlg.exe
  C:\Windows\System\EHNgOlg.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\XaKyNLB.exe
  C:\Windows\System\XaKyNLB.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\parWVSs.exe
  C:\Windows\System\parWVSs.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\RbPFxES.exe
  C:\Windows\System\RbPFxES.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\pYlUQVz.exe
  C:\Windows\System\pYlUQVz.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ptTxzzP.exe
  C:\Windows\System\ptTxzzP.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\UJYbnhC.exe
  C:\Windows\System\UJYbnhC.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\suHUssV.exe
  C:\Windows\System\suHUssV.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\xbMircm.exe
  C:\Windows\System\xbMircm.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\wiDiDbe.exe
  C:\Windows\System\wiDiDbe.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\MundmnW.exe
  C:\Windows\System\MundmnW.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\SUEfzqx.exe
  C:\Windows\System\SUEfzqx.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\OyEdCdk.exe
  C:\Windows\System\OyEdCdk.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\qkkzbGC.exe
  C:\Windows\System\qkkzbGC.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\bXZAXob.exe
  C:\Windows\System\bXZAXob.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\PDQTFdR.exe
  C:\Windows\System\PDQTFdR.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\yvcqyxI.exe
  C:\Windows\System\yvcqyxI.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\cjsEBjz.exe
  C:\Windows\System\cjsEBjz.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\AYtakZs.exe
  C:\Windows\System\AYtakZs.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\nZoiTCJ.exe
  C:\Windows\System\nZoiTCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\GaPgvui.exe
  C:\Windows\System\GaPgvui.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\FuZYcuN.exe
  C:\Windows\System\FuZYcuN.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\sLXWbrR.exe
  C:\Windows\System\sLXWbrR.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\XnwWBaq.exe
  C:\Windows\System\XnwWBaq.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\eZumEIZ.exe
  C:\Windows\System\eZumEIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\yAtKplh.exe
  C:\Windows\System\yAtKplh.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\AvxMILw.exe
  C:\Windows\System\AvxMILw.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\srBxmNY.exe
  C:\Windows\System\srBxmNY.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\yVHDEUK.exe
  C:\Windows\System\yVHDEUK.exe
  2⤵
  PID:1996
- C:\Windows\System\pfAHMcL.exe
  C:\Windows\System\pfAHMcL.exe
  2⤵
  PID:2156
- C:\Windows\System\gsXQiwv.exe
  C:\Windows\System\gsXQiwv.exe
  2⤵
  PID:2624
- C:\Windows\System\IZYuyTs.exe
  C:\Windows\System\IZYuyTs.exe
  2⤵
  PID:2744
- C:\Windows\System\AFPSgrI.exe
  C:\Windows\System\AFPSgrI.exe
  2⤵
  PID:1816
- C:\Windows\System\gDBBhDZ.exe
  C:\Windows\System\gDBBhDZ.exe
  2⤵
  PID:1772
- C:\Windows\System\gHBcCvQ.exe
  C:\Windows\System\gHBcCvQ.exe
  2⤵
  PID:2256
- C:\Windows\System\wkJqtVY.exe
  C:\Windows\System\wkJqtVY.exe
  2⤵
  PID:564
- C:\Windows\System\ZWBNQUG.exe
  C:\Windows\System\ZWBNQUG.exe
  2⤵
  PID:1824
- C:\Windows\System\CLPavFT.exe
  C:\Windows\System\CLPavFT.exe
  2⤵
  PID:884
- C:\Windows\System\gWRZDpr.exe
  C:\Windows\System\gWRZDpr.exe
  2⤵
  PID:2684
- C:\Windows\System\YWRFtNO.exe
  C:\Windows\System\YWRFtNO.exe
  2⤵
  PID:2444
- C:\Windows\System\BxWVTEo.exe
  C:\Windows\System\BxWVTEo.exe
  2⤵
  PID:1928
- C:\Windows\System\LEkXlTE.exe
  C:\Windows\System\LEkXlTE.exe
  2⤵
  PID:948
- C:\Windows\System\XwKZTps.exe
  C:\Windows\System\XwKZTps.exe
  2⤵
  PID:1672
- C:\Windows\System\PBSCzVR.exe
  C:\Windows\System\PBSCzVR.exe
  2⤵
  PID:2924
- C:\Windows\System\XVjSjFI.exe
  C:\Windows\System\XVjSjFI.exe
  2⤵
  PID:1556
- C:\Windows\System\wcVtdnO.exe
  C:\Windows\System\wcVtdnO.exe
  2⤵
  PID:1692
- C:\Windows\System\MnQfIdl.exe
  C:\Windows\System\MnQfIdl.exe
  2⤵
  PID:1740
- C:\Windows\System\LSepSGc.exe
  C:\Windows\System\LSepSGc.exe
  2⤵
  PID:1656
- C:\Windows\System\HeblCNZ.exe
  C:\Windows\System\HeblCNZ.exe
  2⤵
  PID:2364
- C:\Windows\System\ufAbKtw.exe
  C:\Windows\System\ufAbKtw.exe
  2⤵
  PID:2196
- C:\Windows\System\GcOAlhp.exe
  C:\Windows\System\GcOAlhp.exe
  2⤵
  PID:3060
- C:\Windows\System\iAaYoAc.exe
  C:\Windows\System\iAaYoAc.exe
  2⤵
  PID:2940
- C:\Windows\System\icDrNhR.exe
  C:\Windows\System\icDrNhR.exe
  2⤵
  PID:2492
- C:\Windows\System\PlUESkK.exe
  C:\Windows\System\PlUESkK.exe
  2⤵
  PID:2632
- C:\Windows\System\tdnTkfW.exe
  C:\Windows\System\tdnTkfW.exe
  2⤵
  PID:2872
- C:\Windows\System\AomQzPr.exe
  C:\Windows\System\AomQzPr.exe
  2⤵
  PID:1088
- C:\Windows\System\eNuWFZA.exe
  C:\Windows\System\eNuWFZA.exe
  2⤵
  PID:2868
- C:\Windows\System\bNpDqck.exe
  C:\Windows\System\bNpDqck.exe
  2⤵
  PID:2836
- C:\Windows\System\MsctuzB.exe
  C:\Windows\System\MsctuzB.exe
  2⤵
  PID:2020
- C:\Windows\System\HtCnFZm.exe
  C:\Windows\System\HtCnFZm.exe
  2⤵
  PID:2880
- C:\Windows\System\koHZkzd.exe
  C:\Windows\System\koHZkzd.exe
  2⤵
  PID:2980
- C:\Windows\System\lisztDR.exe
  C:\Windows\System\lisztDR.exe
  2⤵
  PID:1080
- C:\Windows\System\RzoIQHx.exe
  C:\Windows\System\RzoIQHx.exe
  2⤵
  PID:772
- C:\Windows\System\JzjkUxW.exe
  C:\Windows\System\JzjkUxW.exe
  2⤵
  PID:2052
- C:\Windows\System\RqbvrwI.exe
  C:\Windows\System\RqbvrwI.exe
  2⤵
  PID:2772
- C:\Windows\System\kKJkgLG.exe
  C:\Windows\System\kKJkgLG.exe
  2⤵
  PID:2416
- C:\Windows\System\MxvaFBx.exe
  C:\Windows\System\MxvaFBx.exe
  2⤵
  PID:2752
- C:\Windows\System\OvAUNXv.exe
  C:\Windows\System\OvAUNXv.exe
  2⤵
  PID:2176
- C:\Windows\System\IWOGkQg.exe
  C:\Windows\System\IWOGkQg.exe
  2⤵
  PID:3016
- C:\Windows\System\bXdWbsL.exe
  C:\Windows\System\bXdWbsL.exe
  2⤵
  PID:2428
- C:\Windows\System\GcHEgDE.exe
  C:\Windows\System\GcHEgDE.exe
  2⤵
  PID:2512
- C:\Windows\System\FfvdDeA.exe
  C:\Windows\System\FfvdDeA.exe
  2⤵
  PID:760
- C:\Windows\System\Xnerysh.exe
  C:\Windows\System\Xnerysh.exe
  2⤵
  PID:2060
- C:\Windows\System\AZDBGdx.exe
  C:\Windows\System\AZDBGdx.exe
  2⤵
  PID:2676
- C:\Windows\System\CXrJVjy.exe
  C:\Windows\System\CXrJVjy.exe
  2⤵
  PID:1168
- C:\Windows\System\cspgYQg.exe
  C:\Windows\System\cspgYQg.exe
  2⤵
  PID:2732
- C:\Windows\System\DYhehLw.exe
  C:\Windows\System\DYhehLw.exe
  2⤵
  PID:3036
- C:\Windows\System\PqVUdFC.exe
  C:\Windows\System\PqVUdFC.exe
  2⤵
  PID:1564
- C:\Windows\System\xLDfbQb.exe
  C:\Windows\System\xLDfbQb.exe
  2⤵
  PID:1048
- C:\Windows\System\TmsCopH.exe
  C:\Windows\System\TmsCopH.exe
  2⤵
  PID:540
- C:\Windows\System\NXgsXsC.exe
  C:\Windows\System\NXgsXsC.exe
  2⤵
  PID:2848
- C:\Windows\System\ITucAJd.exe
  C:\Windows\System\ITucAJd.exe
  2⤵
  PID:1676
- C:\Windows\System\fIhMVbB.exe
  C:\Windows\System\fIhMVbB.exe
  2⤵
  PID:2056
- C:\Windows\System\srYhgCp.exe
  C:\Windows\System\srYhgCp.exe
  2⤵
  PID:1628
- C:\Windows\System\kYrdsQc.exe
  C:\Windows\System\kYrdsQc.exe
  2⤵
  PID:3064
- C:\Windows\System\HbXtVsQ.exe
  C:\Windows\System\HbXtVsQ.exe
  2⤵
  PID:2764
- C:\Windows\System\KpVwQDn.exe
  C:\Windows\System\KpVwQDn.exe
  2⤵
  PID:2396
- C:\Windows\System\oILlQvd.exe
  C:\Windows\System\oILlQvd.exe
  2⤵
  PID:2740
- C:\Windows\System\bPHrLAk.exe
  C:\Windows\System\bPHrLAk.exe
  2⤵
  PID:2756
- C:\Windows\System\ajZkpak.exe
  C:\Windows\System\ajZkpak.exe
  2⤵
  PID:3088
- C:\Windows\System\ZzAqKAH.exe
  C:\Windows\System\ZzAqKAH.exe
  2⤵
  PID:3104
- C:\Windows\System\AIEwyvt.exe
  C:\Windows\System\AIEwyvt.exe
  2⤵
  PID:3120
- C:\Windows\System\nZkodiz.exe
  C:\Windows\System\nZkodiz.exe
  2⤵
  PID:3136
- C:\Windows\System\nlSGFtV.exe
  C:\Windows\System\nlSGFtV.exe
  2⤵
  PID:3152
- C:\Windows\System\ZOzciAS.exe
  C:\Windows\System\ZOzciAS.exe
  2⤵
  PID:3168
- C:\Windows\System\HnvScoK.exe
  C:\Windows\System\HnvScoK.exe
  2⤵
  PID:3184
- C:\Windows\System\TDPRZXO.exe
  C:\Windows\System\TDPRZXO.exe
  2⤵
  PID:3200
- C:\Windows\System\NQacGhc.exe
  C:\Windows\System\NQacGhc.exe
  2⤵
  PID:3216
- C:\Windows\System\tFBTlqP.exe
  C:\Windows\System\tFBTlqP.exe
  2⤵
  PID:3232
- C:\Windows\System\uZWbbqi.exe
  C:\Windows\System\uZWbbqi.exe
  2⤵
  PID:3248
- C:\Windows\System\RiamgCx.exe
  C:\Windows\System\RiamgCx.exe
  2⤵
  PID:3264
- C:\Windows\System\nRaOPjR.exe
  C:\Windows\System\nRaOPjR.exe
  2⤵
  PID:3332
- C:\Windows\System\JltdLob.exe
  C:\Windows\System\JltdLob.exe
  2⤵
  PID:3352
- C:\Windows\System\DRVozaH.exe
  C:\Windows\System\DRVozaH.exe
  2⤵
  PID:3368
- C:\Windows\System\DzkBgXE.exe
  C:\Windows\System\DzkBgXE.exe
  2⤵
  PID:3384
- C:\Windows\System\VCdhflB.exe
  C:\Windows\System\VCdhflB.exe
  2⤵
  PID:3400
- C:\Windows\System\wWMmXPD.exe
  C:\Windows\System\wWMmXPD.exe
  2⤵
  PID:3416
- C:\Windows\System\bBASczG.exe
  C:\Windows\System\bBASczG.exe
  2⤵
  PID:3432
- C:\Windows\System\zHzwfsY.exe
  C:\Windows\System\zHzwfsY.exe
  2⤵
  PID:3448
- C:\Windows\System\xnBsiIO.exe
  C:\Windows\System\xnBsiIO.exe
  2⤵
  PID:3464
- C:\Windows\System\aFplOvU.exe
  C:\Windows\System\aFplOvU.exe
  2⤵
  PID:3484
- C:\Windows\System\TGdZKbS.exe
  C:\Windows\System\TGdZKbS.exe
  2⤵
  PID:3500
- C:\Windows\System\tesvHsm.exe
  C:\Windows\System\tesvHsm.exe
  2⤵
  PID:3516
- C:\Windows\System\CgLHSgi.exe
  C:\Windows\System\CgLHSgi.exe
  2⤵
  PID:3532
- C:\Windows\System\zWCRdTQ.exe
  C:\Windows\System\zWCRdTQ.exe
  2⤵
  PID:3548
- C:\Windows\System\kTRxyet.exe
  C:\Windows\System\kTRxyet.exe
  2⤵
  PID:3564
- C:\Windows\System\OBvSpfb.exe
  C:\Windows\System\OBvSpfb.exe
  2⤵
  PID:3580
- C:\Windows\System\ARrJiTU.exe
  C:\Windows\System\ARrJiTU.exe
  2⤵
  PID:3596
- C:\Windows\System\PiKdFHH.exe
  C:\Windows\System\PiKdFHH.exe
  2⤵
  PID:3612
- C:\Windows\System\fbNLBAL.exe
  C:\Windows\System\fbNLBAL.exe
  2⤵
  PID:3632
- C:\Windows\System\MYPmuUv.exe
  C:\Windows\System\MYPmuUv.exe
  2⤵
  PID:3648
- C:\Windows\System\xrMEtkg.exe
  C:\Windows\System\xrMEtkg.exe
  2⤵
  PID:3664
- C:\Windows\System\ssBbRaD.exe
  C:\Windows\System\ssBbRaD.exe
  2⤵
  PID:3680
- C:\Windows\System\maeHQHi.exe
  C:\Windows\System\maeHQHi.exe
  2⤵
  PID:3696
- C:\Windows\System\VQjjVml.exe
  C:\Windows\System\VQjjVml.exe
  2⤵
  PID:3712
- C:\Windows\System\whVoIja.exe
  C:\Windows\System\whVoIja.exe
  2⤵
  PID:3728
- C:\Windows\System\zvwqyJA.exe
  C:\Windows\System\zvwqyJA.exe
  2⤵
  PID:3744
- C:\Windows\System\wmopzoD.exe
  C:\Windows\System\wmopzoD.exe
  2⤵
  PID:3908
- C:\Windows\System\vkvatFZ.exe
  C:\Windows\System\vkvatFZ.exe
  2⤵
  PID:3936
- C:\Windows\System\wAdgGPk.exe
  C:\Windows\System\wAdgGPk.exe
  2⤵
  PID:3952
- C:\Windows\System\OWcXDze.exe
  C:\Windows\System\OWcXDze.exe
  2⤵
  PID:3968
- C:\Windows\System\JGkvNLF.exe
  C:\Windows\System\JGkvNLF.exe
  2⤵
  PID:3984
- C:\Windows\System\RNELauk.exe
  C:\Windows\System\RNELauk.exe
  2⤵
  PID:4012
- C:\Windows\System\mteHOuX.exe
  C:\Windows\System\mteHOuX.exe
  2⤵
  PID:4032
- C:\Windows\System\RhgxcDL.exe
  C:\Windows\System\RhgxcDL.exe
  2⤵
  PID:4048
- C:\Windows\System\txjUcPq.exe
  C:\Windows\System\txjUcPq.exe
  2⤵
  PID:4064
- C:\Windows\System\WifJFpN.exe
  C:\Windows\System\WifJFpN.exe
  2⤵
  PID:4080
- C:\Windows\System\ctknnPf.exe
  C:\Windows\System\ctknnPf.exe
  2⤵
  PID:2912
- C:\Windows\System\WZEOlNs.exe
  C:\Windows\System\WZEOlNs.exe
  2⤵
  PID:2664
- C:\Windows\System\mwNscfk.exe
  C:\Windows\System\mwNscfk.exe
  2⤵
  PID:2532
- C:\Windows\System\QnrFWkj.exe
  C:\Windows\System\QnrFWkj.exe
  2⤵
  PID:2984
- C:\Windows\System\xfoxUlb.exe
  C:\Windows\System\xfoxUlb.exe
  2⤵
  PID:1988
- C:\Windows\System\EWrHHND.exe
  C:\Windows\System\EWrHHND.exe
  2⤵
  PID:580
- C:\Windows\System\XqVeIIR.exe
  C:\Windows\System\XqVeIIR.exe
  2⤵
  PID:3084
- C:\Windows\System\NmeyfIJ.exe
  C:\Windows\System\NmeyfIJ.exe
  2⤵
  PID:1744
- C:\Windows\System\QUIhlHX.exe
  C:\Windows\System\QUIhlHX.exe
  2⤵
  PID:3116
- C:\Windows\System\iYBwQkR.exe
  C:\Windows\System\iYBwQkR.exe
  2⤵
  PID:3128
- C:\Windows\System\CIzxvSW.exe
  C:\Windows\System\CIzxvSW.exe
  2⤵
  PID:3244
- C:\Windows\System\dfLLfRP.exe
  C:\Windows\System\dfLLfRP.exe
  2⤵
  PID:3288
- C:\Windows\System\fwTrdYA.exe
  C:\Windows\System\fwTrdYA.exe
  2⤵
  PID:3304
- C:\Windows\System\SxqCOgW.exe
  C:\Windows\System\SxqCOgW.exe
  2⤵
  PID:3320
- C:\Windows\System\EmCKVnb.exe
  C:\Windows\System\EmCKVnb.exe
  2⤵
  PID:3196
- C:\Windows\System\tAelBZC.exe
  C:\Windows\System\tAelBZC.exe
  2⤵
  PID:1172
- C:\Windows\System\ZokUaWl.exe
  C:\Windows\System\ZokUaWl.exe
  2⤵
  PID:3096
- C:\Windows\System\QknBqxM.exe
  C:\Windows\System\QknBqxM.exe
  2⤵
  PID:3344
- C:\Windows\System\VcRchln.exe
  C:\Windows\System\VcRchln.exe
  2⤵
  PID:3408
- C:\Windows\System\dFGuwbi.exe
  C:\Windows\System\dFGuwbi.exe
  2⤵
  PID:3544
- C:\Windows\System\nZuhNQT.exe
  C:\Windows\System\nZuhNQT.exe
  2⤵
  PID:3604
- C:\Windows\System\zkSbqNp.exe
  C:\Windows\System\zkSbqNp.exe
  2⤵
  PID:3364
- C:\Windows\System\OOewMpp.exe
  C:\Windows\System\OOewMpp.exe
  2⤵
  PID:3428
- C:\Windows\System\YtYMmgq.exe
  C:\Windows\System\YtYMmgq.exe
  2⤵
  PID:3496
- C:\Windows\System\VfMZoae.exe
  C:\Windows\System\VfMZoae.exe
  2⤵
  PID:3560
- C:\Windows\System\VQjDmzp.exe
  C:\Windows\System\VQjDmzp.exe
  2⤵
  PID:3628
- C:\Windows\System\VSukYlk.exe
  C:\Windows\System\VSukYlk.exe
  2⤵
  PID:3692
- C:\Windows\System\tsklVEu.exe
  C:\Windows\System\tsklVEu.exe
  2⤵
  PID:3756
- C:\Windows\System\NeNjqVj.exe
  C:\Windows\System\NeNjqVj.exe
  2⤵
  PID:3772
- C:\Windows\System\fyburRE.exe
  C:\Windows\System\fyburRE.exe
  2⤵
  PID:3788
- C:\Windows\System\tSZSHjz.exe
  C:\Windows\System\tSZSHjz.exe
  2⤵
  PID:3808
- C:\Windows\System\DHkYIeY.exe
  C:\Windows\System\DHkYIeY.exe
  2⤵
  PID:3824
- C:\Windows\System\eQaKWuc.exe
  C:\Windows\System\eQaKWuc.exe
  2⤵
  PID:3840
- C:\Windows\System\BkHRIvx.exe
  C:\Windows\System\BkHRIvx.exe
  2⤵
  PID:3856
- C:\Windows\System\tYprcXs.exe
  C:\Windows\System\tYprcXs.exe
  2⤵
  PID:3380
- C:\Windows\System\AynIpzN.exe
  C:\Windows\System\AynIpzN.exe
  2⤵
  PID:3512
- C:\Windows\System\dlQLmzY.exe
  C:\Windows\System\dlQLmzY.exe
  2⤵
  PID:1668
- C:\Windows\System\uSNaInB.exe
  C:\Windows\System\uSNaInB.exe
  2⤵
  PID:3708
- C:\Windows\System\DXcyTXL.exe
  C:\Windows\System\DXcyTXL.exe
  2⤵
  PID:3872
- C:\Windows\System\xwjBfMb.exe
  C:\Windows\System\xwjBfMb.exe
  2⤵
  PID:3916
- C:\Windows\System\RJfWILH.exe
  C:\Windows\System\RJfWILH.exe
  2⤵
  PID:3944
- C:\Windows\System\jmmoynN.exe
  C:\Windows\System\jmmoynN.exe
  2⤵
  PID:3980
- C:\Windows\System\TenzYdi.exe
  C:\Windows\System\TenzYdi.exe
  2⤵
  PID:2312
- C:\Windows\System\SHYsCPs.exe
  C:\Windows\System\SHYsCPs.exe
  2⤵
  PID:2464
- C:\Windows\System\jJlfaLK.exe
  C:\Windows\System\jJlfaLK.exe
  2⤵
  PID:3132
- C:\Windows\System\xutqalo.exe
  C:\Windows\System\xutqalo.exe
  2⤵
  PID:336
- C:\Windows\System\lQBDhDq.exe
  C:\Windows\System\lQBDhDq.exe
  2⤵
  PID:3624
- C:\Windows\System\THaBmPW.exe
  C:\Windows\System\THaBmPW.exe
  2⤵
  PID:3724
- C:\Windows\System\fGsrJcH.exe
  C:\Windows\System\fGsrJcH.exe
  2⤵
  PID:3444
- C:\Windows\System\DGyAuYP.exe
  C:\Windows\System\DGyAuYP.exe
  2⤵
  PID:2564
- C:\Windows\System\CZFOnGi.exe
  C:\Windows\System\CZFOnGi.exe
  2⤵
  PID:3272
- C:\Windows\System\PArGZlk.exe
  C:\Windows\System\PArGZlk.exe
  2⤵
  PID:1664
- C:\Windows\System\EfYheod.exe
  C:\Windows\System\EfYheod.exe
  2⤵
  PID:3784
- C:\Windows\System\uZyrkxE.exe
  C:\Windows\System\uZyrkxE.exe
  2⤵
  PID:3852
- C:\Windows\System\iaxEPqK.exe
  C:\Windows\System\iaxEPqK.exe
  2⤵
  PID:2968
- C:\Windows\System\ftuheqf.exe
  C:\Windows\System\ftuheqf.exe
  2⤵
  PID:3224
- C:\Windows\System\AzxTIyC.exe
  C:\Windows\System\AzxTIyC.exe
  2⤵
  PID:1804
- C:\Windows\System\FPCjHcd.exe
  C:\Windows\System\FPCjHcd.exe
  2⤵
  PID:3180
- C:\Windows\System\mYLOZkI.exe
  C:\Windows\System\mYLOZkI.exe
  2⤵
  PID:4108
- C:\Windows\System\DNSxGbv.exe
  C:\Windows\System\DNSxGbv.exe
  2⤵
  PID:4128
- C:\Windows\System\PJKEBFf.exe
  C:\Windows\System\PJKEBFf.exe
  2⤵
  PID:4144
- C:\Windows\System\jqkWYcS.exe
  C:\Windows\System\jqkWYcS.exe
  2⤵
  PID:4160
- C:\Windows\System\SEAlOnX.exe
  C:\Windows\System\SEAlOnX.exe
  2⤵
  PID:4176
- C:\Windows\System\LdnynHJ.exe
  C:\Windows\System\LdnynHJ.exe
  2⤵
  PID:4192
- C:\Windows\System\zDpqhDD.exe
  C:\Windows\System\zDpqhDD.exe
  2⤵
  PID:4208
- C:\Windows\System\fgmLnjx.exe
  C:\Windows\System\fgmLnjx.exe
  2⤵
  PID:4224
- C:\Windows\System\LuDprYQ.exe
  C:\Windows\System\LuDprYQ.exe
  2⤵
  PID:4240
- C:\Windows\System\kfSyZpY.exe
  C:\Windows\System\kfSyZpY.exe
  2⤵
  PID:4256
- C:\Windows\System\NGLiySY.exe
  C:\Windows\System\NGLiySY.exe
  2⤵
  PID:4276
- C:\Windows\System\VFuTqKj.exe
  C:\Windows\System\VFuTqKj.exe
  2⤵
  PID:4292
- C:\Windows\System\qnXVOSo.exe
  C:\Windows\System\qnXVOSo.exe
  2⤵
  PID:4308
- C:\Windows\System\PEbZXpl.exe
  C:\Windows\System\PEbZXpl.exe
  2⤵
  PID:4324
- C:\Windows\System\DbKtjHv.exe
  C:\Windows\System\DbKtjHv.exe
  2⤵
  PID:4340
- C:\Windows\System\gaBuYIj.exe
  C:\Windows\System\gaBuYIj.exe
  2⤵
  PID:4356
- C:\Windows\System\ykBozfk.exe
  C:\Windows\System\ykBozfk.exe
  2⤵
  PID:4376
- C:\Windows\System\rEAYXtC.exe
  C:\Windows\System\rEAYXtC.exe
  2⤵
  PID:4392
- C:\Windows\System\kDndBst.exe
  C:\Windows\System\kDndBst.exe
  2⤵
  PID:4408
- C:\Windows\System\YpOnqut.exe
  C:\Windows\System\YpOnqut.exe
  2⤵
  PID:4500
- C:\Windows\System\ohqewmA.exe
  C:\Windows\System\ohqewmA.exe
  2⤵
  PID:4520
- C:\Windows\System\mslyHLW.exe
  C:\Windows\System\mslyHLW.exe
  2⤵
  PID:4544
- C:\Windows\System\xhFuRlh.exe
  C:\Windows\System\xhFuRlh.exe
  2⤵
  PID:4560
- C:\Windows\System\MaiLcNA.exe
  C:\Windows\System\MaiLcNA.exe
  2⤵
  PID:4576
- C:\Windows\System\ArdXXxq.exe
  C:\Windows\System\ArdXXxq.exe
  2⤵
  PID:4592
- C:\Windows\System\qmJDUjc.exe
  C:\Windows\System\qmJDUjc.exe
  2⤵
  PID:4668
- C:\Windows\System\UNtctzx.exe
  C:\Windows\System\UNtctzx.exe
  2⤵
  PID:4688
- C:\Windows\System\rAsPVIF.exe
  C:\Windows\System\rAsPVIF.exe
  2⤵
  PID:4704
- C:\Windows\System\srOkNNw.exe
  C:\Windows\System\srOkNNw.exe
  2⤵
  PID:4720
- C:\Windows\System\bOdTbXG.exe
  C:\Windows\System\bOdTbXG.exe
  2⤵
  PID:4736
- C:\Windows\System\ZOLAQWn.exe
  C:\Windows\System\ZOLAQWn.exe
  2⤵
  PID:4756
- C:\Windows\System\pUVqhUR.exe
  C:\Windows\System\pUVqhUR.exe
  2⤵
  PID:4800
- C:\Windows\System\OKAVOwr.exe
  C:\Windows\System\OKAVOwr.exe
  2⤵
  PID:4816
- C:\Windows\System\wKuirtq.exe
  C:\Windows\System\wKuirtq.exe
  2⤵
  PID:4832
- C:\Windows\System\lqOswBy.exe
  C:\Windows\System\lqOswBy.exe
  2⤵
  PID:4848
- C:\Windows\System\bWlTjCK.exe
  C:\Windows\System\bWlTjCK.exe
  2⤵
  PID:4864
- C:\Windows\System\fTCWwLN.exe
  C:\Windows\System\fTCWwLN.exe
  2⤵
  PID:4880
- C:\Windows\System\xTjnsLF.exe
  C:\Windows\System\xTjnsLF.exe
  2⤵
  PID:4896
- C:\Windows\System\zkzVTWu.exe
  C:\Windows\System\zkzVTWu.exe
  2⤵
  PID:4912
- C:\Windows\System\RsjOnmh.exe
  C:\Windows\System\RsjOnmh.exe
  2⤵
  PID:4928
- C:\Windows\System\cClHzIz.exe
  C:\Windows\System\cClHzIz.exe
  2⤵
  PID:4944
- C:\Windows\System\MjkGBRS.exe
  C:\Windows\System\MjkGBRS.exe
  2⤵
  PID:4964
- C:\Windows\System\VCdDuDh.exe
  C:\Windows\System\VCdDuDh.exe
  2⤵
  PID:4980
- C:\Windows\System\Tircpvq.exe
  C:\Windows\System\Tircpvq.exe
  2⤵
  PID:4996
- C:\Windows\System\SoImlDW.exe
  C:\Windows\System\SoImlDW.exe
  2⤵
  PID:5068
- C:\Windows\System\GpRsrGq.exe
  C:\Windows\System\GpRsrGq.exe
  2⤵
  PID:5084
- C:\Windows\System\kMMbbpy.exe
  C:\Windows\System\kMMbbpy.exe
  2⤵
  PID:5100
- C:\Windows\System\XCzFlPx.exe
  C:\Windows\System\XCzFlPx.exe
  2⤵
  PID:5116
- C:\Windows\System\rvooVhU.exe
  C:\Windows\System\rvooVhU.exe
  2⤵
  PID:3212
- C:\Windows\System\pyhoNLU.exe
  C:\Windows\System\pyhoNLU.exe
  2⤵
  PID:2824
- C:\Windows\System\HstdGLN.exe
  C:\Windows\System\HstdGLN.exe
  2⤵
  PID:3556
- C:\Windows\System\aySQecx.exe
  C:\Windows\System\aySQecx.exe
  2⤵
  PID:3768
- C:\Windows\System\fJRCvSw.exe
  C:\Windows\System\fJRCvSw.exe
  2⤵
  PID:3836
- C:\Windows\System\Yonwycy.exe
  C:\Windows\System\Yonwycy.exe
  2⤵
  PID:3476
- C:\Windows\System\smxAmPl.exe
  C:\Windows\System\smxAmPl.exe
  2⤵
  PID:3928
- C:\Windows\System\mVMnAKa.exe
  C:\Windows\System\mVMnAKa.exe
  2⤵
  PID:4124
- C:\Windows\System\rgKiayL.exe
  C:\Windows\System\rgKiayL.exe
  2⤵
  PID:4188
- C:\Windows\System\TSsQOjB.exe
  C:\Windows\System\TSsQOjB.exe
  2⤵
  PID:1580
- C:\Windows\System\SUaqnGk.exe
  C:\Windows\System\SUaqnGk.exe
  2⤵
  PID:4316
- C:\Windows\System\HnjZdqA.exe
  C:\Windows\System\HnjZdqA.exe
  2⤵
  PID:4352
- C:\Windows\System\gTIplkY.exe
  C:\Windows\System\gTIplkY.exe
  2⤵
  PID:4400
- C:\Windows\System\wiIwahR.exe
  C:\Windows\System\wiIwahR.exe
  2⤵
  PID:2084
- C:\Windows\System\YjeXtvm.exe
  C:\Windows\System\YjeXtvm.exe
  2⤵
  PID:4056
- C:\Windows\System\rGYxIoy.exe
  C:\Windows\System\rGYxIoy.exe
  2⤵
  PID:4092
- C:\Windows\System\EygeIiP.exe
  C:\Windows\System\EygeIiP.exe
  2⤵
  PID:2820
- C:\Windows\System\snxFYgE.exe
  C:\Windows\System\snxFYgE.exe
  2⤵
  PID:4416
- C:\Windows\System\itkNXVB.exe
  C:\Windows\System\itkNXVB.exe
  2⤵
  PID:1660
- C:\Windows\System\ZWuHLzG.exe
  C:\Windows\System\ZWuHLzG.exe
  2⤵
  PID:3228
- C:\Windows\System\lIFgSGj.exe
  C:\Windows\System\lIFgSGj.exe
  2⤵
  PID:4104
- C:\Windows\System\pyBwNOG.exe
  C:\Windows\System\pyBwNOG.exe
  2⤵
  PID:4200
- C:\Windows\System\KtfYNmH.exe
  C:\Windows\System\KtfYNmH.exe
  2⤵
  PID:4264
- C:\Windows\System\HMopjkt.exe
  C:\Windows\System\HMopjkt.exe
  2⤵
  PID:4368
- C:\Windows\System\ZIwuHNt.exe
  C:\Windows\System\ZIwuHNt.exe
  2⤵
  PID:2636
- C:\Windows\System\IothFEQ.exe
  C:\Windows\System\IothFEQ.exe
  2⤵
  PID:4388
- C:\Windows\System\OVDcbxu.exe
  C:\Windows\System\OVDcbxu.exe
  2⤵
  PID:4440
- C:\Windows\System\XCAKSqw.exe
  C:\Windows\System\XCAKSqw.exe
  2⤵
  PID:4460
- C:\Windows\System\ZCFRxnD.exe
  C:\Windows\System\ZCFRxnD.exe
  2⤵
  PID:4484
- C:\Windows\System\ftOnmLB.exe
  C:\Windows\System\ftOnmLB.exe
  2⤵
  PID:4528
- C:\Windows\System\ZiqbnXC.exe
  C:\Windows\System\ZiqbnXC.exe
  2⤵
  PID:4600
- C:\Windows\System\SVXyWbN.exe
  C:\Windows\System\SVXyWbN.exe
  2⤵
  PID:4584
- C:\Windows\System\HDJbGtC.exe
  C:\Windows\System\HDJbGtC.exe
  2⤵
  PID:4612
- C:\Windows\System\MRuDNkf.exe
  C:\Windows\System\MRuDNkf.exe
  2⤵
  PID:1336
- C:\Windows\System\vScvcVX.exe
  C:\Windows\System\vScvcVX.exe
  2⤵
  PID:4652
- C:\Windows\System\fwEWnaF.exe
  C:\Windows\System\fwEWnaF.exe
  2⤵
  PID:4664
- C:\Windows\System\QJboBsP.exe
  C:\Windows\System\QJboBsP.exe
  2⤵
  PID:4696
- C:\Windows\System\PrSwBve.exe
  C:\Windows\System\PrSwBve.exe
  2⤵
  PID:4732
- C:\Windows\System\QIWaFgI.exe
  C:\Windows\System\QIWaFgI.exe
  2⤵
  PID:4748
- C:\Windows\System\vSrrDXa.exe
  C:\Windows\System\vSrrDXa.exe
  2⤵
  PID:4784
- C:\Windows\System\kpvDGmN.exe
  C:\Windows\System\kpvDGmN.exe
  2⤵
  PID:2952
- C:\Windows\System\jcUOurs.exe
  C:\Windows\System\jcUOurs.exe
  2⤵
  PID:4796
- C:\Windows\System\DkaHdYM.exe
  C:\Windows\System\DkaHdYM.exe
  2⤵
  PID:4844
- C:\Windows\System\hDQzkzN.exe
  C:\Windows\System\hDQzkzN.exe
  2⤵
  PID:4920
- C:\Windows\System\WhKOsUF.exe
  C:\Windows\System\WhKOsUF.exe
  2⤵
  PID:1576
- C:\Windows\System\npwPfuS.exe
  C:\Windows\System\npwPfuS.exe
  2⤵
  PID:4976
- C:\Windows\System\JLTiVhi.exe
  C:\Windows\System\JLTiVhi.exe
  2⤵
  PID:5004
- C:\Windows\System\pNDzNMU.exe
  C:\Windows\System\pNDzNMU.exe
  2⤵
  PID:4904
- C:\Windows\System\BJYHnxa.exe
  C:\Windows\System\BJYHnxa.exe
  2⤵
  PID:5040
- C:\Windows\System\PaByXhB.exe
  C:\Windows\System\PaByXhB.exe
  2⤵
  PID:5028
- C:\Windows\System\CGRxWFW.exe
  C:\Windows\System\CGRxWFW.exe
  2⤵
  PID:5056
- C:\Windows\System\FOQYqNk.exe
  C:\Windows\System\FOQYqNk.exe
  2⤵
  PID:5080
- C:\Windows\System\JikNLWR.exe
  C:\Windows\System\JikNLWR.exe
  2⤵
  PID:3992
- C:\Windows\System\EaVfAcS.exe
  C:\Windows\System\EaVfAcS.exe
  2⤵
  PID:3820
- C:\Windows\System\UqFVWZK.exe
  C:\Windows\System\UqFVWZK.exe
  2⤵
  PID:3164
- C:\Windows\System\lMEOohU.exe
  C:\Windows\System\lMEOohU.exe
  2⤵
  PID:1584
- C:\Windows\System\drfUmyq.exe
  C:\Windows\System\drfUmyq.exe
  2⤵
  PID:3396
- C:\Windows\System\DJhjWep.exe
  C:\Windows\System\DJhjWep.exe
  2⤵
  PID:3528
- C:\Windows\System\YfxeKwU.exe
  C:\Windows\System\YfxeKwU.exe
  2⤵
  PID:3804
- C:\Windows\System\vNEWOBP.exe
  C:\Windows\System\vNEWOBP.exe
  2⤵
  PID:4156
- C:\Windows\System\tvJYaxf.exe
  C:\Windows\System\tvJYaxf.exe
  2⤵
  PID:4004
- C:\Windows\System\YyiWiEs.exe
  C:\Windows\System\YyiWiEs.exe
  2⤵
  PID:4008
- C:\Windows\System\DIWODLA.exe
  C:\Windows\System\DIWODLA.exe
  2⤵
  PID:3672
- C:\Windows\System\bItoCdv.exe
  C:\Windows\System\bItoCdv.exe
  2⤵
  PID:4040
- C:\Windows\System\NsLWGVD.exe
  C:\Windows\System\NsLWGVD.exe
  2⤵
  PID:816
- C:\Windows\System\oeDKmWG.exe
  C:\Windows\System\oeDKmWG.exe
  2⤵
  PID:4044
- C:\Windows\System\JKgDhZt.exe
  C:\Windows\System\JKgDhZt.exe
  2⤵
  PID:2628
- C:\Windows\System\gwFjrwQ.exe
  C:\Windows\System\gwFjrwQ.exe
  2⤵
  PID:2612
- C:\Windows\System\cUObucQ.exe
  C:\Windows\System\cUObucQ.exe
  2⤵
  PID:2816
- C:\Windows\System\jBUohCP.exe
  C:\Windows\System\jBUohCP.exe
  2⤵
  PID:3848
- C:\Windows\System\YwfMpYV.exe
  C:\Windows\System\YwfMpYV.exe
  2⤵
  PID:3752
- C:\Windows\System\lxfvRWb.exe
  C:\Windows\System\lxfvRWb.exe
  2⤵
  PID:4100
- C:\Windows\System\aKmWYYY.exe
  C:\Windows\System\aKmWYYY.exe
  2⤵
  PID:4304
- C:\Windows\System\QRdQMMR.exe
  C:\Windows\System\QRdQMMR.exe
  2⤵
  PID:4336
- C:\Windows\System\SMTAhRP.exe
  C:\Windows\System\SMTAhRP.exe
  2⤵
  PID:4252
- C:\Windows\System\lkzHObY.exe
  C:\Windows\System\lkzHObY.exe
  2⤵
  PID:4432
- C:\Windows\System\yNuYdkY.exe
  C:\Windows\System\yNuYdkY.exe
  2⤵
  PID:4472
- C:\Windows\System\fhoISdo.exe
  C:\Windows\System\fhoISdo.exe
  2⤵
  PID:4536
- C:\Windows\System\TxwFbYA.exe
  C:\Windows\System\TxwFbYA.exe
  2⤵
  PID:2964
- C:\Windows\System\gubcTMa.exe
  C:\Windows\System\gubcTMa.exe
  2⤵
  PID:4608
- C:\Windows\System\rCMVnNS.exe
  C:\Windows\System\rCMVnNS.exe
  2⤵
  PID:4620
- C:\Windows\System\JdksrLc.exe
  C:\Windows\System\JdksrLc.exe
  2⤵
  PID:1752
- C:\Windows\System\CotOteG.exe
  C:\Windows\System\CotOteG.exe
  2⤵
  PID:4824
- C:\Windows\System\OlrYeCP.exe
  C:\Windows\System\OlrYeCP.exe
  2⤵
  PID:4076
- C:\Windows\System\pBXpctd.exe
  C:\Windows\System\pBXpctd.exe
  2⤵
  PID:4184
- C:\Windows\System\pvytCSI.exe
  C:\Windows\System\pvytCSI.exe
  2⤵
  PID:5048
- C:\Windows\System\RRaYXZI.exe
  C:\Windows\System\RRaYXZI.exe
  2⤵
  PID:4288
- C:\Windows\System\nJzVxoz.exe
  C:\Windows\System\nJzVxoz.exe
  2⤵
  PID:2668
- C:\Windows\System\UAMOagG.exe
  C:\Windows\System\UAMOagG.exe
  2⤵
  PID:5076
- C:\Windows\System\XucjPTS.exe
  C:\Windows\System\XucjPTS.exe
  2⤵
  PID:5012
- C:\Windows\System\RPPhFZR.exe
  C:\Windows\System\RPPhFZR.exe
  2⤵
  PID:4972
- C:\Windows\System\jLESMOm.exe
  C:\Windows\System\jLESMOm.exe
  2⤵
  PID:3620
- C:\Windows\System\cFogiDQ.exe
  C:\Windows\System\cFogiDQ.exe
  2⤵
  PID:4364
- C:\Windows\System\FNMpVaK.exe
  C:\Windows\System\FNMpVaK.exe
  2⤵
  PID:3924
- C:\Windows\System\UjRzgxj.exe
  C:\Windows\System\UjRzgxj.exe
  2⤵
  PID:4792
- C:\Windows\System\ztxwpBE.exe
  C:\Windows\System\ztxwpBE.exe
  2⤵
  PID:4988
- C:\Windows\System\qRDHxZB.exe
  C:\Windows\System\qRDHxZB.exe
  2⤵
  PID:3800
- C:\Windows\System\gwJkMfy.exe
  C:\Windows\System\gwJkMfy.exe
  2⤵
  PID:2800
- C:\Windows\System\QLxBjUx.exe
  C:\Windows\System\QLxBjUx.exe
  2⤵
  PID:4220
- C:\Windows\System\EKBoLmi.exe
  C:\Windows\System\EKBoLmi.exe
  2⤵
  PID:3764
- C:\Windows\System\kDQHDxQ.exe
  C:\Windows\System\kDQHDxQ.exe
  2⤵
  PID:3276
- C:\Windows\System\XmluKzP.exe
  C:\Windows\System\XmluKzP.exe
  2⤵
  PID:3868
- C:\Windows\System\GYLpDpS.exe
  C:\Windows\System\GYLpDpS.exe
  2⤵
  PID:1300
- C:\Windows\System\BecVgVv.exe
  C:\Windows\System\BecVgVv.exe
  2⤵
  PID:3592
- C:\Windows\System\CbxXEYt.exe
  C:\Windows\System\CbxXEYt.exe
  2⤵
  PID:4300
- C:\Windows\System\LcgrVZr.exe
  C:\Windows\System\LcgrVZr.exe
  2⤵
  PID:4492
- C:\Windows\System\MdubIqg.exe
  C:\Windows\System\MdubIqg.exe
  2⤵
  PID:4644
- C:\Windows\System\EWfLHzy.exe
  C:\Windows\System\EWfLHzy.exe
  2⤵
  PID:4456
- C:\Windows\System\MIvDsdh.exe
  C:\Windows\System\MIvDsdh.exe
  2⤵
  PID:2588
- C:\Windows\System\RoiqLeT.exe
  C:\Windows\System\RoiqLeT.exe
  2⤵
  PID:4640
- C:\Windows\System\cNTJgcA.exe
  C:\Windows\System\cNTJgcA.exe
  2⤵
  PID:4556
- C:\Windows\System\QsrajLl.exe
  C:\Windows\System\QsrajLl.exe
  2⤵
  PID:4752
- C:\Windows\System\CTcpLzn.exe
  C:\Windows\System\CTcpLzn.exe
  2⤵
  PID:4776
- C:\Windows\System\VzRDJgy.exe
  C:\Windows\System\VzRDJgy.exe
  2⤵
  PID:4764
- C:\Windows\System\xEfmQzW.exe
  C:\Windows\System\xEfmQzW.exe
  2⤵
  PID:3284
- C:\Windows\System\wRHudZz.exe
  C:\Windows\System\wRHudZz.exe
  2⤵
  PID:4888
- C:\Windows\System\uxGNLYZ.exe
  C:\Windows\System\uxGNLYZ.exe
  2⤵
  PID:2308
- C:\Windows\System\RQBzbHA.exe
  C:\Windows\System\RQBzbHA.exe
  2⤵
  PID:4172
- C:\Windows\System\tAQgPTN.exe
  C:\Windows\System\tAQgPTN.exe
  2⤵
  PID:3312
- C:\Windows\System\Zuxveem.exe
  C:\Windows\System\Zuxveem.exe
  2⤵
  PID:3004
- C:\Windows\System\nTMpFqm.exe
  C:\Windows\System\nTMpFqm.exe
  2⤵
  PID:4512
- C:\Windows\System\vwDtVGz.exe
  C:\Windows\System\vwDtVGz.exe
  2⤵
  PID:4956
- C:\Windows\System\wnYFVKb.exe
  C:\Windows\System\wnYFVKb.exe
  2⤵
  PID:2988
- C:\Windows\System\HwAofUd.exe
  C:\Windows\System\HwAofUd.exe
  2⤵
  PID:4716
- C:\Windows\System\XjifIfA.exe
  C:\Windows\System\XjifIfA.exe
  2⤵
  PID:3576
- C:\Windows\System\UitFNkv.exe
  C:\Windows\System\UitFNkv.exe
  2⤵
  PID:3300
- C:\Windows\System\RpwvGLV.exe
  C:\Windows\System\RpwvGLV.exe
  2⤵
  PID:4660
- C:\Windows\System\SWTaAHg.exe
  C:\Windows\System\SWTaAHg.exe
  2⤵
  PID:5124
- C:\Windows\System\VElHaom.exe
  C:\Windows\System\VElHaom.exe
  2⤵
  PID:5140
- C:\Windows\System\ODOOYLL.exe
  C:\Windows\System\ODOOYLL.exe
  2⤵
  PID:5160
- C:\Windows\System\IgqeYgJ.exe
  C:\Windows\System\IgqeYgJ.exe
  2⤵
  PID:5176
- C:\Windows\System\oVXhWdf.exe
  C:\Windows\System\oVXhWdf.exe
  2⤵
  PID:5192
- C:\Windows\System\OkECXYv.exe
  C:\Windows\System\OkECXYv.exe
  2⤵
  PID:5208
- C:\Windows\System\LxTcIpU.exe
  C:\Windows\System\LxTcIpU.exe
  2⤵
  PID:5224
- C:\Windows\System\VmppmFb.exe
  C:\Windows\System\VmppmFb.exe
  2⤵
  PID:5240
- C:\Windows\System\EGeOGVA.exe
  C:\Windows\System\EGeOGVA.exe
  2⤵
  PID:5260
- C:\Windows\System\nHMCRGi.exe
  C:\Windows\System\nHMCRGi.exe
  2⤵
  PID:5276
- C:\Windows\System\UxkOEko.exe
  C:\Windows\System\UxkOEko.exe
  2⤵
  PID:5292
- C:\Windows\System\MDLBiiP.exe
  C:\Windows\System\MDLBiiP.exe
  2⤵
  PID:5308
- C:\Windows\System\lUhZWPa.exe
  C:\Windows\System\lUhZWPa.exe
  2⤵
  PID:5324
- C:\Windows\System\jEuuyIf.exe
  C:\Windows\System\jEuuyIf.exe
  2⤵
  PID:5340
- C:\Windows\System\YATveGM.exe
  C:\Windows\System\YATveGM.exe
  2⤵
  PID:5356
- C:\Windows\System\PLCivUu.exe
  C:\Windows\System\PLCivUu.exe
  2⤵
  PID:5376
- C:\Windows\System\BDWmQmh.exe
  C:\Windows\System\BDWmQmh.exe
  2⤵
  PID:5392
- C:\Windows\System\hyDFVFL.exe
  C:\Windows\System\hyDFVFL.exe
  2⤵
  PID:5408
- C:\Windows\System\JcEwnWT.exe
  C:\Windows\System\JcEwnWT.exe
  2⤵
  PID:5424
- C:\Windows\System\wyAnjYF.exe
  C:\Windows\System\wyAnjYF.exe
  2⤵
  PID:5440
- C:\Windows\System\wsfZFGQ.exe
  C:\Windows\System\wsfZFGQ.exe
  2⤵
  PID:5456
- C:\Windows\System\cjaATzx.exe
  C:\Windows\System\cjaATzx.exe
  2⤵
  PID:5472
- C:\Windows\System\HeKjLom.exe
  C:\Windows\System\HeKjLom.exe
  2⤵
  PID:5488
- C:\Windows\System\LuVyunZ.exe
  C:\Windows\System\LuVyunZ.exe
  2⤵
  PID:5504
- C:\Windows\System\mQacsPg.exe
  C:\Windows\System\mQacsPg.exe
  2⤵
  PID:5520
- C:\Windows\System\OcePogF.exe
  C:\Windows\System\OcePogF.exe
  2⤵
  PID:5548
- C:\Windows\System\OVJLPpT.exe
  C:\Windows\System\OVJLPpT.exe
  2⤵
  PID:5564
- C:\Windows\System\KlxnWRJ.exe
  C:\Windows\System\KlxnWRJ.exe
  2⤵
  PID:5580
- C:\Windows\System\ALDqbrZ.exe
  C:\Windows\System\ALDqbrZ.exe
  2⤵
  PID:5596
- C:\Windows\System\eGjFBKb.exe
  C:\Windows\System\eGjFBKb.exe
  2⤵
  PID:5612
- C:\Windows\System\gYRAASU.exe
  C:\Windows\System\gYRAASU.exe
  2⤵
  PID:5628
- C:\Windows\System\aEWJUrv.exe
  C:\Windows\System\aEWJUrv.exe
  2⤵
  PID:5644
- C:\Windows\System\MjINanv.exe
  C:\Windows\System\MjINanv.exe
  2⤵
  PID:5660
- C:\Windows\System\HbMrTKV.exe
  C:\Windows\System\HbMrTKV.exe
  2⤵
  PID:5676
- C:\Windows\System\dAAjdAI.exe
  C:\Windows\System\dAAjdAI.exe
  2⤵
  PID:5692
- C:\Windows\System\mAgMSfX.exe
  C:\Windows\System\mAgMSfX.exe
  2⤵
  PID:5712
- C:\Windows\System\bjMuyIv.exe
  C:\Windows\System\bjMuyIv.exe
  2⤵
  PID:5728
- C:\Windows\System\WFaBiOI.exe
  C:\Windows\System\WFaBiOI.exe
  2⤵
  PID:5744
- C:\Windows\System\sbYrntM.exe
  C:\Windows\System\sbYrntM.exe
  2⤵
  PID:5764
- C:\Windows\System\cJaRflW.exe
  C:\Windows\System\cJaRflW.exe
  2⤵
  PID:5780
- C:\Windows\System\AwllPWO.exe
  C:\Windows\System\AwllPWO.exe
  2⤵
  PID:5796
- C:\Windows\System\CndzxzZ.exe
  C:\Windows\System\CndzxzZ.exe
  2⤵
  PID:5812
- C:\Windows\System\LdAeiLR.exe
  C:\Windows\System\LdAeiLR.exe
  2⤵
  PID:5836
- C:\Windows\System\GSFWHJl.exe
  C:\Windows\System\GSFWHJl.exe
  2⤵
  PID:5852
- C:\Windows\System\RjMvZxo.exe
  C:\Windows\System\RjMvZxo.exe
  2⤵
  PID:5884
- C:\Windows\System\lYVtGCb.exe
  C:\Windows\System\lYVtGCb.exe
  2⤵
  PID:5900
- C:\Windows\System\UWmKfEN.exe
  C:\Windows\System\UWmKfEN.exe
  2⤵
  PID:5916
- C:\Windows\System\rIrnRqV.exe
  C:\Windows\System\rIrnRqV.exe
  2⤵
  PID:5936
- C:\Windows\System\PzubfBp.exe
  C:\Windows\System\PzubfBp.exe
  2⤵
  PID:5952
- C:\Windows\System\gYiazan.exe
  C:\Windows\System\gYiazan.exe
  2⤵
  PID:5968
- C:\Windows\System\zNRDZee.exe
  C:\Windows\System\zNRDZee.exe
  2⤵
  PID:5984
- C:\Windows\System\KeUIaSL.exe
  C:\Windows\System\KeUIaSL.exe
  2⤵
  PID:6000
- C:\Windows\System\taEzrKe.exe
  C:\Windows\System\taEzrKe.exe
  2⤵
  PID:6016
- C:\Windows\System\fCdTlZS.exe
  C:\Windows\System\fCdTlZS.exe
  2⤵
  PID:6032
- C:\Windows\System\rBoPaXT.exe
  C:\Windows\System\rBoPaXT.exe
  2⤵
  PID:6048
- C:\Windows\System\Jzkqxcv.exe
  C:\Windows\System\Jzkqxcv.exe
  2⤵
  PID:6064
- C:\Windows\System\QxarWvm.exe
  C:\Windows\System\QxarWvm.exe
  2⤵
  PID:6080
- C:\Windows\System\fGverSa.exe
  C:\Windows\System\fGverSa.exe
  2⤵
  PID:5352
- C:\Windows\System\JEdGBSw.exe
  C:\Windows\System\JEdGBSw.exe
  2⤵
  PID:5384
- C:\Windows\System\dFFZYCW.exe
  C:\Windows\System\dFFZYCW.exe
  2⤵
  PID:5420
- C:\Windows\System\upOabsk.exe
  C:\Windows\System\upOabsk.exe
  2⤵
  PID:5480
- C:\Windows\System\JdIVjsz.exe
  C:\Windows\System\JdIVjsz.exe
  2⤵
  PID:5372
- C:\Windows\System\mpPXTNT.exe
  C:\Windows\System\mpPXTNT.exe
  2⤵
  PID:5576
- C:\Windows\System\HsXuOec.exe
  C:\Windows\System\HsXuOec.exe
  2⤵
  PID:5636
- C:\Windows\System\JemJEUY.exe
  C:\Windows\System\JemJEUY.exe
  2⤵
  PID:5496
- C:\Windows\System\jTClirK.exe
  C:\Windows\System\jTClirK.exe
  2⤵
  PID:5624
- C:\Windows\System\EtqoUcG.exe
  C:\Windows\System\EtqoUcG.exe
  2⤵
  PID:5720
- C:\Windows\System\dkGcWoa.exe
  C:\Windows\System\dkGcWoa.exe
  2⤵
  PID:5760
- C:\Windows\System\ROkPuzy.exe
  C:\Windows\System\ROkPuzy.exe
  2⤵
  PID:5824
- C:\Windows\System\itmrFcF.exe
  C:\Windows\System\itmrFcF.exe
  2⤵
  PID:5864
- C:\Windows\System\JAEcLmF.exe
  C:\Windows\System\JAEcLmF.exe
  2⤵
  PID:5880
- C:\Windows\System\VKzNpZB.exe
  C:\Windows\System\VKzNpZB.exe
  2⤵
  PID:5536
- C:\Windows\System\igqnWcP.exe
  C:\Windows\System\igqnWcP.exe
  2⤵
  PID:5976
- C:\Windows\System\uHBSjWV.exe
  C:\Windows\System\uHBSjWV.exe
  2⤵
  PID:6044
- C:\Windows\System\kLiHCjl.exe
  C:\Windows\System\kLiHCjl.exe
  2⤵
  PID:5704
- C:\Windows\System\PeALfPg.exe
  C:\Windows\System\PeALfPg.exe
  2⤵
  PID:5776
- C:\Windows\System\zHVjXfI.exe
  C:\Windows\System\zHVjXfI.exe
  2⤵
  PID:5740
- C:\Windows\System\kJGdJKV.exe
  C:\Windows\System\kJGdJKV.exe
  2⤵
  PID:5896
- C:\Windows\System\yRZbyAs.exe
  C:\Windows\System\yRZbyAs.exe
  2⤵
  PID:5960
- C:\Windows\System\xzxVAYe.exe
  C:\Windows\System\xzxVAYe.exe
  2⤵
  PID:6024
- C:\Windows\System\CVfeKYu.exe
  C:\Windows\System\CVfeKYu.exe
  2⤵
  PID:6076
- C:\Windows\System\jJINvDg.exe
  C:\Windows\System\jJINvDg.exe
  2⤵
  PID:6092
- C:\Windows\System\VdAnZQQ.exe
  C:\Windows\System\VdAnZQQ.exe
  2⤵
  PID:6108
- C:\Windows\System\TLWMJQE.exe
  C:\Windows\System\TLWMJQE.exe
  2⤵
  PID:6128
- C:\Windows\System\wphLTci.exe
  C:\Windows\System\wphLTci.exe
  2⤵
  PID:2828
- C:\Windows\System\Lqlqcfk.exe
  C:\Windows\System\Lqlqcfk.exe
  2⤵
  PID:4684
- C:\Windows\System\KtslISt.exe
  C:\Windows\System\KtslISt.exe
  2⤵
  PID:5148
- C:\Windows\System\VYtCPgY.exe
  C:\Windows\System\VYtCPgY.exe
  2⤵
  PID:5188
- C:\Windows\System\pTqIdyI.exe
  C:\Windows\System\pTqIdyI.exe
  2⤵
  PID:5248
- C:\Windows\System\kvrxicX.exe
  C:\Windows\System\kvrxicX.exe
  2⤵
  PID:4780
- C:\Windows\System\tiSQUyf.exe
  C:\Windows\System\tiSQUyf.exe
  2⤵
  PID:3572
- C:\Windows\System\BppUKXM.exe
  C:\Windows\System\BppUKXM.exe
  2⤵
  PID:5132
- C:\Windows\System\fmEeliw.exe
  C:\Windows\System\fmEeliw.exe
  2⤵
  PID:5172
- C:\Windows\System\gEckWVa.exe
  C:\Windows\System\gEckWVa.exe
  2⤵
  PID:5236
- C:\Windows\System\IDsvCcW.exe
  C:\Windows\System\IDsvCcW.exe
  2⤵
  PID:5368
- C:\Windows\System\HLHNloN.exe
  C:\Windows\System\HLHNloN.exe
  2⤵
  PID:5736
- C:\Windows\System\xVPfZjY.exe
  C:\Windows\System\xVPfZjY.exe
  2⤵
  PID:6088
- C:\Windows\System\VroTpHh.exe
  C:\Windows\System\VroTpHh.exe
  2⤵
  PID:4436
- C:\Windows\System\gFYcUVF.exe
  C:\Windows\System\gFYcUVF.exe
  2⤵
  PID:5364
- C:\Windows\System\OEOeoEL.exe
  C:\Windows\System\OEOeoEL.exe
  2⤵
  PID:5220
- C:\Windows\System\DzmAlbV.exe
  C:\Windows\System\DzmAlbV.exe
  2⤵
  PID:5752
- C:\Windows\System\RJQpQhT.exe
  C:\Windows\System\RJQpQhT.exe
  2⤵
  PID:5348
- C:\Windows\System\WscFAAb.exe
  C:\Windows\System\WscFAAb.exe
  2⤵
  PID:4728
- C:\Windows\System\GDxoodA.exe
  C:\Windows\System\GDxoodA.exe
  2⤵
  PID:5892
- C:\Windows\System\CDTDXOo.exe
  C:\Windows\System\CDTDXOo.exe
  2⤵
  PID:6096
- C:\Windows\System\zXTPiLi.exe
  C:\Windows\System\zXTPiLi.exe
  2⤵
  PID:5184
- C:\Windows\System\jfBkVDa.exe
  C:\Windows\System\jfBkVDa.exe
  2⤵
  PID:5200
- C:\Windows\System\mmemtVu.exe
  C:\Windows\System\mmemtVu.exe
  2⤵
  PID:5432
- C:\Windows\System\EIoXvQC.exe
  C:\Windows\System\EIoXvQC.exe
  2⤵
  PID:5592
- C:\Windows\System\mtrqevk.exe
  C:\Windows\System\mtrqevk.exe
  2⤵
  PID:5684
- C:\Windows\System\VEdymzX.exe
  C:\Windows\System\VEdymzX.exe
  2⤵
  PID:5640
- C:\Windows\System\FUIvnmU.exe
  C:\Windows\System\FUIvnmU.exe
  2⤵
  PID:5708
- C:\Windows\System\acXeEWM.exe
  C:\Windows\System\acXeEWM.exe
  2⤵
  PID:5876
- C:\Windows\System\DEioPOB.exe
  C:\Windows\System\DEioPOB.exe
  2⤵
  PID:5772
- C:\Windows\System\FwCNunF.exe
  C:\Windows\System\FwCNunF.exe
  2⤵
  PID:6100
- C:\Windows\System\YrHlTGk.exe
  C:\Windows\System\YrHlTGk.exe
  2⤵
  PID:2296
- C:\Windows\System\MHwoZAm.exe
  C:\Windows\System\MHwoZAm.exe
  2⤵
  PID:5544
- C:\Windows\System\TsJodRH.exe
  C:\Windows\System\TsJodRH.exe
  2⤵
  PID:5468
- C:\Windows\System\LOeLYQq.exe
  C:\Windows\System\LOeLYQq.exe
  2⤵
  PID:5448
- C:\Windows\System\Egwxwdv.exe
  C:\Windows\System\Egwxwdv.exe
  2⤵
  PID:5404
- C:\Windows\System\LJhMUbx.exe
  C:\Windows\System\LJhMUbx.exe
  2⤵
  PID:5268
- C:\Windows\System\JpZjJLY.exe
  C:\Windows\System\JpZjJLY.exe
  2⤵
  PID:5656
- C:\Windows\System\wNlRXgv.exe
  C:\Windows\System\wNlRXgv.exe
  2⤵
  PID:5944
- C:\Windows\System\YrlhqGj.exe
  C:\Windows\System\YrlhqGj.exe
  2⤵
  PID:5820
- C:\Windows\System\SWHInRg.exe
  C:\Windows\System\SWHInRg.exe
  2⤵
  PID:1748
- C:\Windows\System\zbaRYAU.exe
  C:\Windows\System\zbaRYAU.exe
  2⤵
  PID:5512
- C:\Windows\System\ifwqizU.exe
  C:\Windows\System\ifwqizU.exe
  2⤵
  PID:5872
- C:\Windows\System\oDCLkdW.exe
  C:\Windows\System\oDCLkdW.exe
  2⤵
  PID:5560
- C:\Windows\System\YfaPJQX.exe
  C:\Windows\System\YfaPJQX.exe
  2⤵
  PID:5156
- C:\Windows\System\WpdDGzW.exe
  C:\Windows\System\WpdDGzW.exe
  2⤵
  PID:5168
- C:\Windows\System\ipqsFVp.exe
  C:\Windows\System\ipqsFVp.exe
  2⤵
  PID:6148
- C:\Windows\System\owNCgCk.exe
  C:\Windows\System\owNCgCk.exe
  2⤵
  PID:6164
- C:\Windows\System\guzaVbv.exe
  C:\Windows\System\guzaVbv.exe
  2⤵
  PID:6184
- C:\Windows\System\LUFWpId.exe
  C:\Windows\System\LUFWpId.exe
  2⤵
  PID:6200
- C:\Windows\System\EOQoybE.exe
  C:\Windows\System\EOQoybE.exe
  2⤵
  PID:6216
- C:\Windows\System\EOSjBNl.exe
  C:\Windows\System\EOSjBNl.exe
  2⤵
  PID:6232
- C:\Windows\System\TwaTKhk.exe
  C:\Windows\System\TwaTKhk.exe
  2⤵
  PID:6248
- C:\Windows\System\CqVSwns.exe
  C:\Windows\System\CqVSwns.exe
  2⤵
  PID:6276
- C:\Windows\System\zpGdtJE.exe
  C:\Windows\System\zpGdtJE.exe
  2⤵
  PID:6292
- C:\Windows\System\TYRIXeS.exe
  C:\Windows\System\TYRIXeS.exe
  2⤵
  PID:6308
- C:\Windows\System\HqZJmEG.exe
  C:\Windows\System\HqZJmEG.exe
  2⤵
  PID:6352
- C:\Windows\System\hHSHqAd.exe
  C:\Windows\System\hHSHqAd.exe
  2⤵
  PID:6368
- C:\Windows\System\CShfNXU.exe
  C:\Windows\System\CShfNXU.exe
  2⤵
  PID:6384
- C:\Windows\System\nPdFPCg.exe
  C:\Windows\System\nPdFPCg.exe
  2⤵
  PID:6400
- C:\Windows\System\KAfdOtn.exe
  C:\Windows\System\KAfdOtn.exe
  2⤵
  PID:6420
- C:\Windows\System\AnIBheJ.exe
  C:\Windows\System\AnIBheJ.exe
  2⤵
  PID:6436
- C:\Windows\System\ZzWMJhE.exe
  C:\Windows\System\ZzWMJhE.exe
  2⤵
  PID:6456
- C:\Windows\System\UUHOWsw.exe
  C:\Windows\System\UUHOWsw.exe
  2⤵
  PID:6472
- C:\Windows\System\thuwhXQ.exe
  C:\Windows\System\thuwhXQ.exe
  2⤵
  PID:6488
- C:\Windows\System\BzZijXG.exe
  C:\Windows\System\BzZijXG.exe
  2⤵
  PID:6504
- C:\Windows\System\rbhjUKp.exe
  C:\Windows\System\rbhjUKp.exe
  2⤵
  PID:6520
- C:\Windows\System\mHJxZPF.exe
  C:\Windows\System\mHJxZPF.exe
  2⤵
  PID:6536
- C:\Windows\System\gsXjDfW.exe
  C:\Windows\System\gsXjDfW.exe
  2⤵
  PID:6556
- C:\Windows\System\xlaugSH.exe
  C:\Windows\System\xlaugSH.exe
  2⤵
  PID:6572
- C:\Windows\System\jwnInuG.exe
  C:\Windows\System\jwnInuG.exe
  2⤵
  PID:6588
- C:\Windows\System\VkgWCyh.exe
  C:\Windows\System\VkgWCyh.exe
  2⤵
  PID:6604
- C:\Windows\System\UAFXqdI.exe
  C:\Windows\System\UAFXqdI.exe
  2⤵
  PID:6620
- C:\Windows\System\uzYFweH.exe
  C:\Windows\System\uzYFweH.exe
  2⤵
  PID:6640
- C:\Windows\System\DMKekuF.exe
  C:\Windows\System\DMKekuF.exe
  2⤵
  PID:6656
- C:\Windows\System\EzhwbcT.exe
  C:\Windows\System\EzhwbcT.exe
  2⤵
  PID:6672
- C:\Windows\System\ZhjMJrQ.exe
  C:\Windows\System\ZhjMJrQ.exe
  2⤵
  PID:6688
- C:\Windows\System\VzzbCyW.exe
  C:\Windows\System\VzzbCyW.exe
  2⤵
  PID:6708
- C:\Windows\System\AnogowB.exe
  C:\Windows\System\AnogowB.exe
  2⤵
  PID:6724
- C:\Windows\System\XDWBOmG.exe
  C:\Windows\System\XDWBOmG.exe
  2⤵
  PID:6740
- C:\Windows\System\AOzzEzE.exe
  C:\Windows\System\AOzzEzE.exe
  2⤵
  PID:6760
- C:\Windows\System\bqkYTIx.exe
  C:\Windows\System\bqkYTIx.exe
  2⤵
  PID:6780
- C:\Windows\System\jLcbEQt.exe
  C:\Windows\System\jLcbEQt.exe
  2⤵
  PID:6800
- C:\Windows\System\TbUhjUS.exe
  C:\Windows\System\TbUhjUS.exe
  2⤵
  PID:6816
- C:\Windows\System\bnOPtCB.exe
  C:\Windows\System\bnOPtCB.exe
  2⤵
  PID:6860
- C:\Windows\System\Smwfnsz.exe
  C:\Windows\System\Smwfnsz.exe
  2⤵
  PID:6876
- C:\Windows\System\GRfTxXx.exe
  C:\Windows\System\GRfTxXx.exe
  2⤵
  PID:6892
- C:\Windows\System\zyWGjWg.exe
  C:\Windows\System\zyWGjWg.exe
  2⤵
  PID:6908
- C:\Windows\System\AMnjJYJ.exe
  C:\Windows\System\AMnjJYJ.exe
  2⤵
  PID:6924
- C:\Windows\System\SjOscKL.exe
  C:\Windows\System\SjOscKL.exe
  2⤵
  PID:6940
- C:\Windows\System\ggSSpiq.exe
  C:\Windows\System\ggSSpiq.exe
  2⤵
  PID:6956
- C:\Windows\System\PZqlHyG.exe
  C:\Windows\System\PZqlHyG.exe
  2⤵
  PID:6972
- C:\Windows\System\MqcvKvu.exe
  C:\Windows\System\MqcvKvu.exe
  2⤵
  PID:6988
- C:\Windows\System\JMpuTfy.exe
  C:\Windows\System\JMpuTfy.exe
  2⤵
  PID:7012
- C:\Windows\System\TxnVgoS.exe
  C:\Windows\System\TxnVgoS.exe
  2⤵
  PID:7028
- C:\Windows\System\MWdPknq.exe
  C:\Windows\System\MWdPknq.exe
  2⤵
  PID:7044
- C:\Windows\System\UTymfXj.exe
  C:\Windows\System\UTymfXj.exe
  2⤵
  PID:7060
- C:\Windows\System\rbNDGte.exe
  C:\Windows\System\rbNDGte.exe
  2⤵
  PID:7076
- C:\Windows\System\NNmHOvW.exe
  C:\Windows\System\NNmHOvW.exe
  2⤵
  PID:7092
- C:\Windows\System\wRMmqgi.exe
  C:\Windows\System\wRMmqgi.exe
  2⤵
  PID:7120
- C:\Windows\System\daccLaq.exe
  C:\Windows\System\daccLaq.exe
  2⤵
  PID:7136
- C:\Windows\System\cjmkjqF.exe
  C:\Windows\System\cjmkjqF.exe
  2⤵
  PID:7152
- C:\Windows\System\KXdmTCM.exe
  C:\Windows\System\KXdmTCM.exe
  2⤵
  PID:5016
- C:\Windows\System\xQkRUTQ.exe
  C:\Windows\System\xQkRUTQ.exe
  2⤵
  PID:6172
- C:\Windows\System\HlWmmHE.exe
  C:\Windows\System\HlWmmHE.exe
  2⤵
  PID:6228
- C:\Windows\System\sOSYzvd.exe
  C:\Windows\System\sOSYzvd.exe
  2⤵
  PID:5556
- C:\Windows\System\vMzRXup.exe
  C:\Windows\System\vMzRXup.exe
  2⤵
  PID:6160
- C:\Windows\System\tLyPTzX.exe
  C:\Windows\System\tLyPTzX.exe
  2⤵
  PID:6240
- C:\Windows\System\ixerxDY.exe
  C:\Windows\System\ixerxDY.exe
  2⤵
  PID:6288
- C:\Windows\System\bGjptlj.exe
  C:\Windows\System\bGjptlj.exe
  2⤵
  PID:6268
- C:\Windows\System\HWmrgEV.exe
  C:\Windows\System\HWmrgEV.exe
  2⤵
  PID:6332
- C:\Windows\System\oanheQe.exe
  C:\Windows\System\oanheQe.exe
  2⤵
  PID:6320
- C:\Windows\System\ckRMkPU.exe
  C:\Windows\System\ckRMkPU.exe
  2⤵
  PID:6412
- C:\Windows\System\DHoPjig.exe
  C:\Windows\System\DHoPjig.exe
  2⤵
  PID:6480
- C:\Windows\System\Nfvwshf.exe
  C:\Windows\System\Nfvwshf.exe
  2⤵
  PID:6544
- C:\Windows\System\DYCTbfb.exe
  C:\Windows\System\DYCTbfb.exe
  2⤵
  PID:6580
- C:\Windows\System\hYjQhKo.exe
  C:\Windows\System\hYjQhKo.exe
  2⤵
  PID:6028
- C:\Windows\System\HlgmcEM.exe
  C:\Windows\System\HlgmcEM.exe
  2⤵
  PID:6668
- C:\Windows\System\eMWSPSv.exe
  C:\Windows\System\eMWSPSv.exe
  2⤵
  PID:6464
- C:\Windows\System\hQAOzKM.exe
  C:\Windows\System\hQAOzKM.exe
  2⤵
  PID:6528
- C:\Windows\System\AnXMeKi.exe
  C:\Windows\System\AnXMeKi.exe
  2⤵
  PID:6632
- C:\Windows\System\JVUrsNc.exe
  C:\Windows\System\JVUrsNc.exe
  2⤵
  PID:6700
- C:\Windows\System\oSQzrIq.exe
  C:\Windows\System\oSQzrIq.exe
  2⤵
  PID:6616
- C:\Windows\System\RllsgHF.exe
  C:\Windows\System\RllsgHF.exe
  2⤵
  PID:6716
- C:\Windows\System\CVBBYtN.exe
  C:\Windows\System\CVBBYtN.exe
  2⤵
  PID:6684
- C:\Windows\System\GcudqBg.exe
  C:\Windows\System\GcudqBg.exe
  2⤵
  PID:6776
- C:\Windows\System\cirXjJa.exe
  C:\Windows\System\cirXjJa.exe
  2⤵
  PID:7164
- C:\Windows\System\nrOkWOo.exe
  C:\Windows\System\nrOkWOo.exe
  2⤵
  PID:6156
- C:\Windows\System\gtiOLuf.exe
  C:\Windows\System\gtiOLuf.exe
  2⤵
  PID:6932
- C:\Windows\System\jlannaz.exe
  C:\Windows\System\jlannaz.exe
  2⤵
  PID:6996
- C:\Windows\System\tUQZEzx.exe
  C:\Windows\System\tUQZEzx.exe
  2⤵
  PID:7036
- C:\Windows\System\YfWZeTR.exe
  C:\Windows\System\YfWZeTR.exe
  2⤵
  PID:7100
- C:\Windows\System\uxscLca.exe
  C:\Windows\System\uxscLca.exe
  2⤵
  PID:7144
- C:\Windows\System\LyMzOCP.exe
  C:\Windows\System\LyMzOCP.exe
  2⤵
  PID:6256
- C:\Windows\System\tSxaftv.exe
  C:\Windows\System\tSxaftv.exe
  2⤵
  PID:5996
- C:\Windows\System\CTCAaee.exe
  C:\Windows\System\CTCAaee.exe
  2⤵
  PID:6284
- C:\Windows\System\LZDPoao.exe
  C:\Windows\System\LZDPoao.exe
  2⤵
  PID:6392
- C:\Windows\System\Xrqhrry.exe
  C:\Windows\System\Xrqhrry.exe
  2⤵
  PID:6432
- C:\Windows\System\DVWVWuA.exe
  C:\Windows\System\DVWVWuA.exe
  2⤵
  PID:6612
- C:\Windows\System\hArEvom.exe
  C:\Windows\System\hArEvom.exe
  2⤵
  PID:6324
- C:\Windows\System\dljnLxm.exe
  C:\Windows\System\dljnLxm.exe
  2⤵
  PID:6448
- C:\Windows\System\DmsnHar.exe
  C:\Windows\System\DmsnHar.exe
  2⤵
  PID:6364
- C:\Windows\System\TahpaDH.exe
  C:\Windows\System\TahpaDH.exe
  2⤵
  PID:6696
- C:\Windows\System\vFpTDlr.exe
  C:\Windows\System\vFpTDlr.exe
  2⤵
  PID:6648
- C:\Windows\System\EhiGXUH.exe
  C:\Windows\System\EhiGXUH.exe
  2⤵
  PID:6856
- C:\Windows\System\VUXMnKJ.exe
  C:\Windows\System\VUXMnKJ.exe
  2⤵
  PID:6884
- C:\Windows\System\pGuiopR.exe
  C:\Windows\System\pGuiopR.exe
  2⤵
  PID:6920
- C:\Windows\System\sTEsMWt.exe
  C:\Windows\System\sTEsMWt.exe
  2⤵
  PID:6208
- C:\Windows\System\UgFZYEd.exe
  C:\Windows\System\UgFZYEd.exe
  2⤵
  PID:6348
- C:\Windows\System\KkIUDja.exe
  C:\Windows\System\KkIUDja.exe
  2⤵
  PID:6732
- C:\Windows\System\ZKFxzOO.exe
  C:\Windows\System\ZKFxzOO.exe
  2⤵
  PID:6444
- C:\Windows\System\uQECptq.exe
  C:\Windows\System\uQECptq.exe
  2⤵
  PID:6548
- C:\Windows\System\SzcYyRU.exe
  C:\Windows\System\SzcYyRU.exe
  2⤵
  PID:6748
- C:\Windows\System\CaSprki.exe
  C:\Windows\System\CaSprki.exe
  2⤵
  PID:6664
- C:\Windows\System\EDGeMXm.exe
  C:\Windows\System\EDGeMXm.exe
  2⤵
  PID:6832
- C:\Windows\System\RrBZUNy.exe
  C:\Windows\System\RrBZUNy.exe
  2⤵
  PID:6984
- C:\Windows\System\GdKaDaa.exe
  C:\Windows\System\GdKaDaa.exe
  2⤵
  PID:7084
- C:\Windows\System\QujsCFl.exe
  C:\Windows\System\QujsCFl.exe
  2⤵
  PID:7160
- C:\Windows\System\YOOjBLJ.exe
  C:\Windows\System\YOOjBLJ.exe
  2⤵
  PID:6916
- C:\Windows\System\ddyIAxR.exe
  C:\Windows\System\ddyIAxR.exe
  2⤵
  PID:6196
- C:\Windows\System\pPjolYg.exe
  C:\Windows\System\pPjolYg.exe
  2⤵
  PID:7072
- C:\Windows\System\brmMRvY.exe
  C:\Windows\System\brmMRvY.exe
  2⤵
  PID:7112
- C:\Windows\System\QAozEWS.exe
  C:\Windows\System\QAozEWS.exe
  2⤵
  PID:5032
- C:\Windows\System\OECypfo.exe
  C:\Windows\System\OECypfo.exe
  2⤵
  PID:6212
- C:\Windows\System\LRDusUm.exe
  C:\Windows\System\LRDusUm.exe
  2⤵
  PID:6852
- C:\Windows\System\VjNmAeU.exe
  C:\Windows\System\VjNmAeU.exe
  2⤵
  PID:7128
- C:\Windows\System\oiNpcjJ.exe
  C:\Windows\System\oiNpcjJ.exe
  2⤵
  PID:6500
- C:\Windows\System\EYtEJyd.exe
  C:\Windows\System\EYtEJyd.exe
  2⤵
  PID:6512
- C:\Windows\System\akwFuGs.exe
  C:\Windows\System\akwFuGs.exe
  2⤵
  PID:7180
- C:\Windows\System\JjxgcNo.exe
  C:\Windows\System\JjxgcNo.exe
  2⤵
  PID:7196
- C:\Windows\System\WwFQhCb.exe
  C:\Windows\System\WwFQhCb.exe
  2⤵
  PID:7212
- C:\Windows\System\eNrcYjG.exe
  C:\Windows\System\eNrcYjG.exe
  2⤵
  PID:7228
- C:\Windows\System\Edjthlb.exe
  C:\Windows\System\Edjthlb.exe
  2⤵
  PID:7244
- C:\Windows\System\VGjjMnB.exe
  C:\Windows\System\VGjjMnB.exe
  2⤵
  PID:7260
- C:\Windows\System\QDMbBml.exe
  C:\Windows\System\QDMbBml.exe
  2⤵
  PID:7276
- C:\Windows\System\qUzAvYJ.exe
  C:\Windows\System\qUzAvYJ.exe
  2⤵
  PID:7296
- C:\Windows\System\HCejyVd.exe
  C:\Windows\System\HCejyVd.exe
  2⤵
  PID:7312
- C:\Windows\System\yHUGXPV.exe
  C:\Windows\System\yHUGXPV.exe
  2⤵
  PID:7328
- C:\Windows\System\kwUshZa.exe
  C:\Windows\System\kwUshZa.exe
  2⤵
  PID:7348
- C:\Windows\System\abfBCwI.exe
  C:\Windows\System\abfBCwI.exe
  2⤵
  PID:7364
- C:\Windows\System\KStTVaT.exe
  C:\Windows\System\KStTVaT.exe
  2⤵
  PID:7380
- C:\Windows\System\POVLgrh.exe
  C:\Windows\System\POVLgrh.exe
  2⤵
  PID:7396
- C:\Windows\System\lFqAxLA.exe
  C:\Windows\System\lFqAxLA.exe
  2⤵
  PID:7412
- C:\Windows\System\ZQWoebe.exe
  C:\Windows\System\ZQWoebe.exe
  2⤵
  PID:7428
- C:\Windows\System\mYYuFip.exe
  C:\Windows\System\mYYuFip.exe
  2⤵
  PID:7444
- C:\Windows\System\tBVgkpx.exe
  C:\Windows\System\tBVgkpx.exe
  2⤵
  PID:7460
- C:\Windows\System\rlazmto.exe
  C:\Windows\System\rlazmto.exe
  2⤵
  PID:7476
- C:\Windows\System\fwKRGgd.exe
  C:\Windows\System\fwKRGgd.exe
  2⤵
  PID:7492
- C:\Windows\System\qeHDjsf.exe
  C:\Windows\System\qeHDjsf.exe
  2⤵
  PID:7508
- C:\Windows\System\ignBXuj.exe
  C:\Windows\System\ignBXuj.exe
  2⤵
  PID:7524
- C:\Windows\System\HiOsKUn.exe
  C:\Windows\System\HiOsKUn.exe
  2⤵
  PID:7540
- C:\Windows\System\XJcFGhB.exe
  C:\Windows\System\XJcFGhB.exe
  2⤵
  PID:7556
- C:\Windows\System\EQEAIjb.exe
  C:\Windows\System\EQEAIjb.exe
  2⤵
  PID:7572
- C:\Windows\System\ATXPRIS.exe
  C:\Windows\System\ATXPRIS.exe
  2⤵
  PID:7588
- C:\Windows\System\FEKkbYS.exe
  C:\Windows\System\FEKkbYS.exe
  2⤵
  PID:7604
- C:\Windows\System\McEcDFQ.exe
  C:\Windows\System\McEcDFQ.exe
  2⤵
  PID:7620
- C:\Windows\System\AcWDtjO.exe
  C:\Windows\System\AcWDtjO.exe
  2⤵
  PID:7636
- C:\Windows\System\TGRFjSg.exe
  C:\Windows\System\TGRFjSg.exe
  2⤵
  PID:7652
- C:\Windows\System\iiwKdXG.exe
  C:\Windows\System\iiwKdXG.exe
  2⤵
  PID:7668
- C:\Windows\System\OMjeuLQ.exe
  C:\Windows\System\OMjeuLQ.exe
  2⤵
  PID:7684
- C:\Windows\System\rKRkUEV.exe
  C:\Windows\System\rKRkUEV.exe
  2⤵
  PID:7704
- C:\Windows\System\AIoqAnc.exe
  C:\Windows\System\AIoqAnc.exe
  2⤵
  PID:7720
- C:\Windows\System\cRmQHvB.exe
  C:\Windows\System\cRmQHvB.exe
  2⤵
  PID:7736
- C:\Windows\System\qqmLpit.exe
  C:\Windows\System\qqmLpit.exe
  2⤵
  PID:7756
- C:\Windows\System\djJkvbX.exe
  C:\Windows\System\djJkvbX.exe
  2⤵
  PID:7772
- C:\Windows\System\uoIrkvR.exe
  C:\Windows\System\uoIrkvR.exe
  2⤵
  PID:7788
- C:\Windows\System\amvVOhY.exe
  C:\Windows\System\amvVOhY.exe
  2⤵
  PID:7808
- C:\Windows\System\HCeaRJM.exe
  C:\Windows\System\HCeaRJM.exe
  2⤵
  PID:7824
- C:\Windows\System\tygsNij.exe
  C:\Windows\System\tygsNij.exe
  2⤵
  PID:7840
- C:\Windows\System\DHoyxzk.exe
  C:\Windows\System\DHoyxzk.exe
  2⤵
  PID:7856
- C:\Windows\System\ggvQrbF.exe
  C:\Windows\System\ggvQrbF.exe
  2⤵
  PID:7872
- C:\Windows\System\hRdtKLU.exe
  C:\Windows\System\hRdtKLU.exe
  2⤵
  PID:7888
- C:\Windows\System\lCJqBVP.exe
  C:\Windows\System\lCJqBVP.exe
  2⤵
  PID:7904
- C:\Windows\System\xBqMfut.exe
  C:\Windows\System\xBqMfut.exe
  2⤵
  PID:7920
- C:\Windows\System\fjMIWQD.exe
  C:\Windows\System\fjMIWQD.exe
  2⤵
  PID:7936
- C:\Windows\System\vpuySMx.exe
  C:\Windows\System\vpuySMx.exe
  2⤵
  PID:7956
- C:\Windows\System\NVEcmLx.exe
  C:\Windows\System\NVEcmLx.exe
  2⤵
  PID:7972
- C:\Windows\System\ybuITCj.exe
  C:\Windows\System\ybuITCj.exe
  2⤵
  PID:7988
- C:\Windows\System\qKleONq.exe
  C:\Windows\System\qKleONq.exe
  2⤵
  PID:8004
- C:\Windows\System\bfovPrp.exe
  C:\Windows\System\bfovPrp.exe
  2⤵
  PID:8020
- C:\Windows\System\XtsUNxg.exe
  C:\Windows\System\XtsUNxg.exe
  2⤵
  PID:8036
- C:\Windows\System\sgXbIpQ.exe
  C:\Windows\System\sgXbIpQ.exe
  2⤵
  PID:8052
- C:\Windows\System\oVYTDeM.exe
  C:\Windows\System\oVYTDeM.exe
  2⤵
  PID:8068
- C:\Windows\System\pftiIps.exe
  C:\Windows\System\pftiIps.exe
  2⤵
  PID:8084
- C:\Windows\System\dZSpORK.exe
  C:\Windows\System\dZSpORK.exe
  2⤵
  PID:8100
- C:\Windows\System\zxkvStA.exe
  C:\Windows\System\zxkvStA.exe
  2⤵
  PID:8116
- C:\Windows\System\FdiQquX.exe
  C:\Windows\System\FdiQquX.exe
  2⤵
  PID:8132
- C:\Windows\System\RownNpY.exe
  C:\Windows\System\RownNpY.exe
  2⤵
  PID:8148
- C:\Windows\System\dQzOCJJ.exe
  C:\Windows\System\dQzOCJJ.exe
  2⤵
  PID:8164
- C:\Windows\System\oHvvhen.exe
  C:\Windows\System\oHvvhen.exe
  2⤵
  PID:8180
- C:\Windows\System\pvyefGE.exe
  C:\Windows\System\pvyefGE.exe
  2⤵
  PID:6964
- C:\Windows\System\kPhZjeb.exe
  C:\Windows\System\kPhZjeb.exe
  2⤵
  PID:7108
- C:\Windows\System\XKJHYbO.exe
  C:\Windows\System\XKJHYbO.exe
  2⤵
  PID:6796
- C:\Windows\System\mdefaDF.exe
  C:\Windows\System\mdefaDF.exe
  2⤵
  PID:7024
- C:\Windows\System\WjNfKIB.exe
  C:\Windows\System\WjNfKIB.exe
  2⤵
  PID:5860
- C:\Windows\System\CAsIiHc.exe
  C:\Windows\System\CAsIiHc.exe
  2⤵
  PID:7052
- C:\Windows\System\RREtYDd.exe
  C:\Windows\System\RREtYDd.exe
  2⤵
  PID:7268
- C:\Windows\System\dyWuzHP.exe
  C:\Windows\System\dyWuzHP.exe
  2⤵
  PID:7340
- C:\Windows\System\FuiWTcr.exe
  C:\Windows\System\FuiWTcr.exe
  2⤵
  PID:7404
- C:\Windows\System\etKPYIk.exe
  C:\Windows\System\etKPYIk.exe
  2⤵
  PID:7468
- C:\Windows\System\WQVmooX.exe
  C:\Windows\System\WQVmooX.exe
  2⤵
  PID:7532
- C:\Windows\System\utZMAAJ.exe
  C:\Windows\System\utZMAAJ.exe
  2⤵
  PID:7288
- C:\Windows\System\YDUFeif.exe
  C:\Windows\System\YDUFeif.exe
  2⤵
  PID:7388
- C:\Windows\System\trYtTFw.exe
  C:\Windows\System\trYtTFw.exe
  2⤵
  PID:7188
- C:\Windows\System\ygflDpk.exe
  C:\Windows\System\ygflDpk.exe
  2⤵
  PID:7252
- C:\Windows\System\QvEYccC.exe
  C:\Windows\System\QvEYccC.exe
  2⤵
  PID:7420
- C:\Windows\System\fnQBJez.exe
  C:\Windows\System\fnQBJez.exe
  2⤵
  PID:7516
- C:\Windows\System\DHziBlK.exe
  C:\Windows\System\DHziBlK.exe
  2⤵
  PID:7564
- C:\Windows\System\uwjlLLa.exe
  C:\Windows\System\uwjlLLa.exe
  2⤵
  PID:7700
- C:\Windows\System\JWIwFQB.exe
  C:\Windows\System\JWIwFQB.exe
  2⤵
  PID:7660
- C:\Windows\System\EfWXwIi.exe
  C:\Windows\System\EfWXwIi.exe
  2⤵
  PID:7768
- C:\Windows\System\swLFiMX.exe
  C:\Windows\System\swLFiMX.exe
  2⤵
  PID:7764
- C:\Windows\System\tdJQsaq.exe
  C:\Windows\System\tdJQsaq.exe
  2⤵
  PID:7864
- C:\Windows\System\TrbVrEO.exe
  C:\Windows\System\TrbVrEO.exe
  2⤵
  PID:7928
- C:\Windows\System\ZLJjLuf.exe
  C:\Windows\System\ZLJjLuf.exe
  2⤵
  PID:7968
- C:\Windows\System\pnpHCJT.exe
  C:\Windows\System\pnpHCJT.exe
  2⤵
  PID:7716
- C:\Windows\System\rSpZZpv.exe
  C:\Windows\System\rSpZZpv.exe
  2⤵
  PID:7948
- C:\Windows\System\yLxZQyn.exe
  C:\Windows\System\yLxZQyn.exe
  2⤵
  PID:7748
- C:\Windows\System\PrzCrEb.exe
  C:\Windows\System\PrzCrEb.exe
  2⤵
  PID:7916
- C:\Windows\System\tfCtDia.exe
  C:\Windows\System\tfCtDia.exe
  2⤵
  PID:8064
- C:\Windows\System\RQQgcyY.exe
  C:\Windows\System\RQQgcyY.exe
  2⤵
  PID:7680
- C:\Windows\System\cuAWTzB.exe
  C:\Windows\System\cuAWTzB.exe
  2⤵
  PID:7784
- C:\Windows\System\szPtppN.exe
  C:\Windows\System\szPtppN.exe
  2⤵
  PID:7884
- C:\Windows\System\eJaEVSX.exe
  C:\Windows\System\eJaEVSX.exe
  2⤵
  PID:8092
- C:\Windows\System\gRAQZHj.exe
  C:\Windows\System\gRAQZHj.exe
  2⤵
  PID:8128
- C:\Windows\System\MiPybxR.exe
  C:\Windows\System\MiPybxR.exe
  2⤵
  PID:8076
- C:\Windows\System\nUvLMNB.exe
  C:\Windows\System\nUvLMNB.exe
  2⤵
  PID:7176
- C:\Windows\System\uGGzEDi.exe
  C:\Windows\System\uGGzEDi.exe
  2⤵
  PID:7372
- C:\Windows\System\UyCfUMP.exe
  C:\Windows\System\UyCfUMP.exe
  2⤵
  PID:7504
- C:\Windows\System\vdyDZug.exe
  C:\Windows\System\vdyDZug.exe
  2⤵
  PID:7224
- C:\Windows\System\kjBDfiH.exe
  C:\Windows\System\kjBDfiH.exe
  2⤵
  PID:6812
- C:\Windows\System\ajvlpCq.exe
  C:\Windows\System\ajvlpCq.exe
  2⤵
  PID:7728
- C:\Windows\System\XXkPfOX.exe
  C:\Windows\System\XXkPfOX.exe
  2⤵
  PID:7308
- C:\Windows\System\YXpXRHl.exe
  C:\Windows\System\YXpXRHl.exe
  2⤵
  PID:8176
- C:\Windows\System\tJyLqKx.exe
  C:\Windows\System\tJyLqKx.exe
  2⤵
  PID:7580
- C:\Windows\System\NznkJvB.exe
  C:\Windows\System\NznkJvB.exe
  2⤵
  PID:6868
- C:\Windows\System\GFKMAuP.exe
  C:\Windows\System\GFKMAuP.exe
  2⤵
  PID:7852
- C:\Windows\System\MZfxzHA.exe
  C:\Windows\System\MZfxzHA.exe
  2⤵
  PID:8108
- C:\Windows\System\RJAuvhq.exe
  C:\Windows\System\RJAuvhq.exe
  2⤵
  PID:7800
- C:\Windows\System\taNyPFQ.exe
  C:\Windows\System\taNyPFQ.exe
  2⤵
  PID:7648
- C:\Windows\System\CTfdDqV.exe
  C:\Windows\System\CTfdDqV.exe
  2⤵
  PID:7880
- C:\Windows\System\Rcfdhrm.exe
  C:\Windows\System\Rcfdhrm.exe
  2⤵
  PID:7488
- C:\Windows\System\qcDOAND.exe
  C:\Windows\System\qcDOAND.exe
  2⤵
  PID:7664
- C:\Windows\System\wvADwlr.exe
  C:\Windows\System\wvADwlr.exe
  2⤵
  PID:7896
- C:\Windows\System\UGTgcDd.exe
  C:\Windows\System\UGTgcDd.exe
  2⤵
  PID:8160
- C:\Windows\System\jdaBLxg.exe
  C:\Windows\System\jdaBLxg.exe
  2⤵
  PID:7500
- C:\Windows\System\pgMRiYV.exe
  C:\Windows\System\pgMRiYV.exe
  2⤵
  PID:8044
- C:\Windows\System\FJHsslI.exe
  C:\Windows\System\FJHsslI.exe
  2⤵
  PID:7900
- C:\Windows\System\aiJbqoZ.exe
  C:\Windows\System\aiJbqoZ.exe
  2⤵
  PID:7484
- C:\Windows\System\izaQUOv.exe
  C:\Windows\System\izaQUOv.exe
  2⤵
  PID:7236
- C:\Windows\System\gyisDch.exe
  C:\Windows\System\gyisDch.exe
  2⤵
  PID:6952
- C:\Windows\System\LFerYpu.exe
  C:\Windows\System\LFerYpu.exe
  2⤵
  PID:7360
- C:\Windows\System\ipsgOCK.exe
  C:\Windows\System\ipsgOCK.exe
  2⤵
  PID:7536
- C:\Windows\System\oyoBCIm.exe
  C:\Windows\System\oyoBCIm.exe
  2⤵
  PID:8012
- C:\Windows\System\aAYODZZ.exe
  C:\Windows\System\aAYODZZ.exe
  2⤵
  PID:8172
- C:\Windows\System\diLpsHy.exe
  C:\Windows\System\diLpsHy.exe
  2⤵
  PID:8028
- C:\Windows\System\Czwingw.exe
  C:\Windows\System\Czwingw.exe
  2⤵
  PID:7256
- C:\Windows\System\aQnTZbF.exe
  C:\Windows\System\aQnTZbF.exe
  2⤵
  PID:8112
- C:\Windows\System\gOAKOGQ.exe
  C:\Windows\System\gOAKOGQ.exe
  2⤵
  PID:8016
- C:\Windows\System\OQKayGE.exe
  C:\Windows\System\OQKayGE.exe
  2⤵
  PID:8200
- C:\Windows\System\WyKzsnq.exe
  C:\Windows\System\WyKzsnq.exe
  2⤵
  PID:8232
- C:\Windows\System\DlQktwK.exe
  C:\Windows\System\DlQktwK.exe
  2⤵
  PID:8248
- C:\Windows\System\RSUfTAw.exe
  C:\Windows\System\RSUfTAw.exe
  2⤵
  PID:8264
- C:\Windows\System\HZoxVKB.exe
  C:\Windows\System\HZoxVKB.exe
  2⤵
  PID:8280
- C:\Windows\System\IEjZtMe.exe
  C:\Windows\System\IEjZtMe.exe
  2⤵
  PID:8300
- C:\Windows\System\hQWjqrI.exe
  C:\Windows\System\hQWjqrI.exe
  2⤵
  PID:8316
- C:\Windows\System\aiTBTMQ.exe
  C:\Windows\System\aiTBTMQ.exe
  2⤵
  PID:8336
- C:\Windows\System\PxmDFNL.exe
  C:\Windows\System\PxmDFNL.exe
  2⤵
  PID:8352
- C:\Windows\System\vYylOXQ.exe
  C:\Windows\System\vYylOXQ.exe
  2⤵
  PID:8368
- C:\Windows\System\ufvszVz.exe
  C:\Windows\System\ufvszVz.exe
  2⤵
  PID:8388
- C:\Windows\System\FeJgXJi.exe
  C:\Windows\System\FeJgXJi.exe
  2⤵
  PID:8404
- C:\Windows\System\OlCxcwK.exe
  C:\Windows\System\OlCxcwK.exe
  2⤵
  PID:8420
- C:\Windows\System\obFAxRr.exe
  C:\Windows\System\obFAxRr.exe
  2⤵
  PID:8436
- C:\Windows\System\EQXXUSA.exe
  C:\Windows\System\EQXXUSA.exe
  2⤵
  PID:8452
- C:\Windows\System\iMALtQN.exe
  C:\Windows\System\iMALtQN.exe
  2⤵
  PID:8472
- C:\Windows\System\BZduofA.exe
  C:\Windows\System\BZduofA.exe
  2⤵
  PID:8488
- C:\Windows\System\QNBHWjh.exe
  C:\Windows\System\QNBHWjh.exe
  2⤵
  PID:8504
- C:\Windows\System\KhJGnvG.exe
  C:\Windows\System\KhJGnvG.exe
  2⤵
  PID:8520
- C:\Windows\System\Xltpdsx.exe
  C:\Windows\System\Xltpdsx.exe
  2⤵
  PID:8536
- C:\Windows\System\hgcBymJ.exe
  C:\Windows\System\hgcBymJ.exe
  2⤵
  PID:8556
- C:\Windows\System\HXhfFhY.exe
  C:\Windows\System\HXhfFhY.exe
  2⤵
  PID:8572
- C:\Windows\System\iIPKlWw.exe
  C:\Windows\System\iIPKlWw.exe
  2⤵
  PID:8592
- C:\Windows\System\SGWptUF.exe
  C:\Windows\System\SGWptUF.exe
  2⤵
  PID:8608
- C:\Windows\System\tSJnozm.exe
  C:\Windows\System\tSJnozm.exe
  2⤵
  PID:8624
- C:\Windows\System\PlXHpoY.exe
  C:\Windows\System\PlXHpoY.exe
  2⤵
  PID:8644
- C:\Windows\System\TUSkEWH.exe
  C:\Windows\System\TUSkEWH.exe
  2⤵
  PID:8660
- C:\Windows\System\curJidR.exe
  C:\Windows\System\curJidR.exe
  2⤵
  PID:8752
- C:\Windows\System\RlICDZK.exe
  C:\Windows\System\RlICDZK.exe
  2⤵
  PID:8772
- C:\Windows\System\MkrJlnl.exe
  C:\Windows\System\MkrJlnl.exe
  2⤵
  PID:8788
- C:\Windows\System\wlKHAnh.exe
  C:\Windows\System\wlKHAnh.exe
  2⤵
  PID:8808
- C:\Windows\System\kmwuFAj.exe
  C:\Windows\System\kmwuFAj.exe
  2⤵
  PID:8828
- C:\Windows\System\lKiaNsW.exe
  C:\Windows\System\lKiaNsW.exe
  2⤵
  PID:8844
- C:\Windows\System\PKJwrgZ.exe
  C:\Windows\System\PKJwrgZ.exe
  2⤵
  PID:8860
- C:\Windows\System\FZjgtdv.exe
  C:\Windows\System\FZjgtdv.exe
  2⤵
  PID:8876
- C:\Windows\System\aOofVyh.exe
  C:\Windows\System\aOofVyh.exe
  2⤵
  PID:8896
- C:\Windows\System\KOxwixs.exe
  C:\Windows\System\KOxwixs.exe
  2⤵
  PID:8912
- C:\Windows\System\AXIaYuM.exe
  C:\Windows\System\AXIaYuM.exe
  2⤵
  PID:8928
- C:\Windows\System\ZUWKPuh.exe
  C:\Windows\System\ZUWKPuh.exe
  2⤵
  PID:8948
- C:\Windows\System\slsVdOu.exe
  C:\Windows\System\slsVdOu.exe
  2⤵
  PID:8964
- C:\Windows\System\hPJGryV.exe
  C:\Windows\System\hPJGryV.exe
  2⤵
  PID:8984
- C:\Windows\System\aGHtAOD.exe
  C:\Windows\System\aGHtAOD.exe
  2⤵
  PID:9004
- C:\Windows\System\WwfiGhw.exe
  C:\Windows\System\WwfiGhw.exe
  2⤵
  PID:9020
- C:\Windows\System\XokCymT.exe
  C:\Windows\System\XokCymT.exe
  2⤵
  PID:9036
- C:\Windows\System\NCcWQnN.exe
  C:\Windows\System\NCcWQnN.exe
  2⤵
  PID:9052
- C:\Windows\System\lvAuLKv.exe
  C:\Windows\System\lvAuLKv.exe
  2⤵
  PID:9080
- C:\Windows\System\wfgMZaQ.exe
  C:\Windows\System\wfgMZaQ.exe
  2⤵
  PID:9096
- C:\Windows\System\blfWNJt.exe
  C:\Windows\System\blfWNJt.exe
  2⤵
  PID:9112
- C:\Windows\System\clsNulX.exe
  C:\Windows\System\clsNulX.exe
  2⤵
  PID:9132
- C:\Windows\System\xIKRlsl.exe
  C:\Windows\System\xIKRlsl.exe
  2⤵
  PID:9148
- C:\Windows\System\KpYwNPQ.exe
  C:\Windows\System\KpYwNPQ.exe
  2⤵
  PID:9164
- C:\Windows\System\YpwKntg.exe
  C:\Windows\System\YpwKntg.exe
  2⤵
  PID:9184
- C:\Windows\System\UdHynfN.exe
  C:\Windows\System\UdHynfN.exe
  2⤵
  PID:9200
- C:\Windows\System\lbNhiAE.exe
  C:\Windows\System\lbNhiAE.exe
  2⤵
  PID:8208
- C:\Windows\System\kzBDkSJ.exe
  C:\Windows\System\kzBDkSJ.exe
  2⤵
  PID:8228
- C:\Windows\System\IqglbDT.exe
  C:\Windows\System\IqglbDT.exe
  2⤵
  PID:7848
- C:\Windows\System\FvKFHeI.exe
  C:\Windows\System\FvKFHeI.exe
  2⤵
  PID:8060
- C:\Windows\System\nuFUIlq.exe
  C:\Windows\System\nuFUIlq.exe
  2⤵
  PID:7752
- C:\Windows\System\SsXTWDf.exe
  C:\Windows\System\SsXTWDf.exe
  2⤵
  PID:8260
- C:\Windows\System\jTavRMd.exe
  C:\Windows\System\jTavRMd.exe
  2⤵
  PID:8328
- C:\Windows\System\dHkRIVp.exe
  C:\Windows\System\dHkRIVp.exe
  2⤵
  PID:8396
- C:\Windows\System\OjOtlfG.exe
  C:\Windows\System\OjOtlfG.exe
  2⤵
  PID:8460
- C:\Windows\System\SIAWzLI.exe
  C:\Windows\System\SIAWzLI.exe
  2⤵
  PID:8500
- C:\Windows\System\IbqaHSg.exe
  C:\Windows\System\IbqaHSg.exe
  2⤵
  PID:8600
- C:\Windows\System\VZFagkb.exe
  C:\Windows\System\VZFagkb.exe
  2⤵
  PID:8672
- C:\Windows\System\LRRPpbK.exe
  C:\Windows\System\LRRPpbK.exe
  2⤵
  PID:8676
- C:\Windows\System\WCgfnia.exe
  C:\Windows\System\WCgfnia.exe
  2⤵
  PID:8272
- C:\Windows\System\NHfSdIv.exe
  C:\Windows\System\NHfSdIv.exe
  2⤵
  PID:8344
- C:\Windows\System\uIYNpdR.exe
  C:\Windows\System\uIYNpdR.exe
  2⤵
  PID:8448
- C:\Windows\System\fjfYqRp.exe
  C:\Windows\System\fjfYqRp.exe
  2⤵
  PID:8516
- C:\Windows\System\XYUheOl.exe
  C:\Windows\System\XYUheOl.exe
  2⤵
  PID:8584
- C:\Windows\System\SvkCADh.exe
  C:\Windows\System\SvkCADh.exe
  2⤵
  PID:8652
- C:\Windows\System\hjUoezg.exe
  C:\Windows\System\hjUoezg.exe
  2⤵
  PID:8688
- C:\Windows\System\ediWYJP.exe
  C:\Windows\System\ediWYJP.exe
  2⤵
  PID:8704
- C:\Windows\System\bWDhzre.exe
  C:\Windows\System\bWDhzre.exe
  2⤵
  PID:8728
- C:\Windows\System\CioxzjK.exe
  C:\Windows\System\CioxzjK.exe
  2⤵
  PID:8780
- C:\Windows\System\HDjTWUu.exe
  C:\Windows\System\HDjTWUu.exe
  2⤵
  PID:8712
- C:\Windows\System\ItVDDrV.exe
  C:\Windows\System\ItVDDrV.exe
  2⤵
  PID:8852
- C:\Windows\System\zsDDFIe.exe
  C:\Windows\System\zsDDFIe.exe
  2⤵
  PID:8888
- C:\Windows\System\aZOIjld.exe
  C:\Windows\System\aZOIjld.exe
  2⤵
  PID:8960
- C:\Windows\System\FbItPEs.exe
  C:\Windows\System\FbItPEs.exe
  2⤵
  PID:8944
- C:\Windows\System\LdtLCAq.exe
  C:\Windows\System\LdtLCAq.exe
  2⤵
  PID:9048
- C:\Windows\System\zfOOzIP.exe
  C:\Windows\System\zfOOzIP.exe
  2⤵
  PID:9120
- C:\Windows\System\BxdMZcK.exe
  C:\Windows\System\BxdMZcK.exe
  2⤵
  PID:9124
- C:\Windows\System\OAaPVIA.exe
  C:\Windows\System\OAaPVIA.exe
  2⤵
  PID:9208
- C:\Windows\System\UnfKdFt.exe
  C:\Windows\System\UnfKdFt.exe
  2⤵
  PID:9196
- C:\Windows\System\zWuIEqP.exe
  C:\Windows\System\zWuIEqP.exe
  2⤵
  PID:7584
- C:\Windows\System\PPQUUhM.exe
  C:\Windows\System\PPQUUhM.exe
  2⤵
  PID:8296
- C:\Windows\System\AvMwGOR.exe
  C:\Windows\System\AvMwGOR.exe
  2⤵
  PID:8532
- C:\Windows\System\nMzgzNw.exe
  C:\Windows\System\nMzgzNw.exe
  2⤵
  PID:8256
- C:\Windows\System\gCjqEBh.exe
  C:\Windows\System\gCjqEBh.exe
  2⤵
  PID:8360
- C:\Windows\System\BBgQFBZ.exe
  C:\Windows\System\BBgQFBZ.exe
  2⤵
  PID:7004
- C:\Windows\System\VIgtyut.exe
  C:\Windows\System\VIgtyut.exe
  2⤵
  PID:8312
- C:\Windows\System\tWwCNcs.exe
  C:\Windows\System\tWwCNcs.exe
  2⤵
  PID:9028
- C:\Windows\System\MeKbGxT.exe
  C:\Windows\System\MeKbGxT.exe
  2⤵
  PID:9000
- C:\Windows\System\jnTOlIx.exe
  C:\Windows\System\jnTOlIx.exe
  2⤵
  PID:8884
- C:\Windows\System\JUjDMIM.exe
  C:\Windows\System\JUjDMIM.exe
  2⤵
  PID:8868
- C:\Windows\System\JfQkTbu.exe
  C:\Windows\System\JfQkTbu.exe
  2⤵
  PID:9012
- C:\Windows\System\FczgMCz.exe
  C:\Windows\System\FczgMCz.exe
  2⤵
  PID:8804
- C:\Windows\System\AeThWGJ.exe
  C:\Windows\System\AeThWGJ.exe
  2⤵
  PID:9088
- C:\Windows\System\bVjLKkz.exe
  C:\Windows\System\bVjLKkz.exe
  2⤵
  PID:9160
- C:\Windows\System\dthaFga.exe
  C:\Windows\System\dthaFga.exe
  2⤵
  PID:9064
- C:\Windows\System\JnoqykI.exe
  C:\Windows\System\JnoqykI.exe
  2⤵
  PID:7548
- C:\Windows\System\QMJQLYY.exe
  C:\Windows\System\QMJQLYY.exe
  2⤵
  PID:8564
- C:\Windows\System\lIXBesb.exe
  C:\Windows\System\lIXBesb.exe
  2⤵
  PID:8544
- C:\Windows\System\JTNQShp.exe
  C:\Windows\System\JTNQShp.exe
  2⤵
  PID:8432
- C:\Windows\System\xTlaNUZ.exe
  C:\Windows\System\xTlaNUZ.exe
  2⤵
  PID:8000
- C:\Windows\System\MlNIyJb.exe
  C:\Windows\System\MlNIyJb.exe
  2⤵
  PID:8416
- C:\Windows\System\PUdLASC.exe
  C:\Windows\System\PUdLASC.exe
  2⤵
  PID:8736
- C:\Windows\System\lTEDPsB.exe
  C:\Windows\System\lTEDPsB.exe
  2⤵
  PID:8384
- C:\Windows\System\fbeiPdZ.exe
  C:\Windows\System\fbeiPdZ.exe
  2⤵
  PID:8924
- C:\Windows\System\uEJjKur.exe
  C:\Windows\System\uEJjKur.exe
  2⤵
  PID:8724
- C:\Windows\System\swhaaRu.exe
  C:\Windows\System\swhaaRu.exe
  2⤵
  PID:8816
- C:\Windows\System\yQntEEM.exe
  C:\Windows\System\yQntEEM.exe
  2⤵
  PID:9108
- C:\Windows\System\MQgmSGR.exe
  C:\Windows\System\MQgmSGR.exe
  2⤵
  PID:9180
- C:\Windows\System\UDIsCNX.exe
  C:\Windows\System\UDIsCNX.exe
  2⤵
  PID:8640
- C:\Windows\System\UIetqqm.exe
  C:\Windows\System\UIetqqm.exe
  2⤵
  PID:8700
- C:\Windows\System\tTRouZg.exe
  C:\Windows\System\tTRouZg.exe
  2⤵
  PID:9044
- C:\Windows\System\LvkUVZN.exe
  C:\Windows\System\LvkUVZN.exe
  2⤵
  PID:9060
- C:\Windows\System\ipaRnLa.exe
  C:\Windows\System\ipaRnLa.exe
  2⤵
  PID:8796
- C:\Windows\System\yKxJVZM.exe
  C:\Windows\System\yKxJVZM.exe
  2⤵
  PID:8680
- C:\Windows\System\EtPnjIp.exe
  C:\Windows\System\EtPnjIp.exe
  2⤵
  PID:8496
- C:\Windows\System\VVpxCIn.exe
  C:\Windows\System\VVpxCIn.exe
  2⤵
  PID:8244
- C:\Windows\System\frhLlpE.exe
  C:\Windows\System\frhLlpE.exe
  2⤵
  PID:8580
- C:\Windows\System\GUQKsoZ.exe
  C:\Windows\System\GUQKsoZ.exe
  2⤵
  PID:9156
- C:\Windows\System\gzqgGbB.exe
  C:\Windows\System\gzqgGbB.exe
  2⤵
  PID:8840
- C:\Windows\System\BhiHSZd.exe
  C:\Windows\System\BhiHSZd.exe
  2⤵
  PID:8196
- C:\Windows\System\ZEyZbec.exe
  C:\Windows\System\ZEyZbec.exe
  2⤵
  PID:8980
- C:\Windows\System\sHUIYmM.exe
  C:\Windows\System\sHUIYmM.exe
  2⤵
  PID:8748
- C:\Windows\System\jtVmJao.exe
  C:\Windows\System\jtVmJao.exe
  2⤵
  PID:8240
- C:\Windows\System\LfjdApa.exe
  C:\Windows\System\LfjdApa.exe
  2⤵
  PID:9220
- C:\Windows\System\oNXnkbB.exe
  C:\Windows\System\oNXnkbB.exe
  2⤵
  PID:9236
- C:\Windows\System\eSLwNFD.exe
  C:\Windows\System\eSLwNFD.exe
  2⤵
  PID:9252
- C:\Windows\System\fimbnHZ.exe
  C:\Windows\System\fimbnHZ.exe
  2⤵
  PID:9268
- C:\Windows\System\NZbBUUB.exe
  C:\Windows\System\NZbBUUB.exe
  2⤵
  PID:9288
- C:\Windows\System\zQYTgTT.exe
  C:\Windows\System\zQYTgTT.exe
  2⤵
  PID:9304
- C:\Windows\System\ujTuUNv.exe
  C:\Windows\System\ujTuUNv.exe
  2⤵
  PID:9320
- C:\Windows\System\abGuqFA.exe
  C:\Windows\System\abGuqFA.exe
  2⤵
  PID:9336
- C:\Windows\System\oMnCFXx.exe
  C:\Windows\System\oMnCFXx.exe
  2⤵
  PID:9352
- C:\Windows\System\cvPEsYK.exe
  C:\Windows\System\cvPEsYK.exe
  2⤵
  PID:9372
- C:\Windows\System\dHsmpeX.exe
  C:\Windows\System\dHsmpeX.exe
  2⤵
  PID:9388
- C:\Windows\System\RGZaFrz.exe
  C:\Windows\System\RGZaFrz.exe
  2⤵
  PID:9404
- C:\Windows\System\hUXhzMK.exe
  C:\Windows\System\hUXhzMK.exe
  2⤵
  PID:9420
- C:\Windows\System\cMmgbjG.exe
  C:\Windows\System\cMmgbjG.exe
  2⤵
  PID:9436
- C:\Windows\System\VzXXYOu.exe
  C:\Windows\System\VzXXYOu.exe
  2⤵
  PID:9452
- C:\Windows\System\JvVeALC.exe
  C:\Windows\System\JvVeALC.exe
  2⤵
  PID:9468
- C:\Windows\System\FIezChc.exe
  C:\Windows\System\FIezChc.exe
  2⤵
  PID:9484
- C:\Windows\System\GpamnIC.exe
  C:\Windows\System\GpamnIC.exe
  2⤵
  PID:9504
- C:\Windows\System\xvuibDD.exe
  C:\Windows\System\xvuibDD.exe
  2⤵
  PID:9520
- C:\Windows\System\vabApKk.exe
  C:\Windows\System\vabApKk.exe
  2⤵
  PID:9536
- C:\Windows\System\jiGEgII.exe
  C:\Windows\System\jiGEgII.exe
  2⤵
  PID:9552
- C:\Windows\System\yEJuKrP.exe
  C:\Windows\System\yEJuKrP.exe
  2⤵
  PID:9568
- C:\Windows\System\DhwXnxi.exe
  C:\Windows\System\DhwXnxi.exe
  2⤵
  PID:9584
- C:\Windows\System\kLbwTWK.exe
  C:\Windows\System\kLbwTWK.exe
  2⤵
  PID:9600
- C:\Windows\System\qrSIzGh.exe
  C:\Windows\System\qrSIzGh.exe
  2⤵
  PID:9616
- C:\Windows\System\ZxRgOAb.exe
  C:\Windows\System\ZxRgOAb.exe
  2⤵
  PID:9636
- C:\Windows\System\zivjoAW.exe
  C:\Windows\System\zivjoAW.exe
  2⤵
  PID:9652
- C:\Windows\System\jnAboiL.exe
  C:\Windows\System\jnAboiL.exe
  2⤵
  PID:9668
- C:\Windows\System\rouBOZn.exe
  C:\Windows\System\rouBOZn.exe
  2⤵
  PID:9684
- C:\Windows\System\PXwZlpD.exe
  C:\Windows\System\PXwZlpD.exe
  2⤵
  PID:9700
- C:\Windows\System\wWkqAvh.exe
  C:\Windows\System\wWkqAvh.exe
  2⤵
  PID:9716
- C:\Windows\System\zdjVlWd.exe
  C:\Windows\System\zdjVlWd.exe
  2⤵
  PID:9732
- C:\Windows\System\zHRFofj.exe
  C:\Windows\System\zHRFofj.exe
  2⤵
  PID:9748
- C:\Windows\System\hSvlYot.exe
  C:\Windows\System\hSvlYot.exe
  2⤵
  PID:9764
- C:\Windows\System\OXzqNdL.exe
  C:\Windows\System\OXzqNdL.exe
  2⤵
  PID:9780
- C:\Windows\System\RoexJCk.exe
  C:\Windows\System\RoexJCk.exe
  2⤵
  PID:9796
- C:\Windows\System\lWblKRd.exe
  C:\Windows\System\lWblKRd.exe
  2⤵
  PID:9812
- C:\Windows\System\STIHVLX.exe
  C:\Windows\System\STIHVLX.exe
  2⤵
  PID:9828
- C:\Windows\System\MGzzfGs.exe
  C:\Windows\System\MGzzfGs.exe
  2⤵
  PID:9844
- C:\Windows\System\wKkVRDZ.exe
  C:\Windows\System\wKkVRDZ.exe
  2⤵
  PID:9864
- C:\Windows\System\dYirLgW.exe
  C:\Windows\System\dYirLgW.exe
  2⤵
  PID:9880
- C:\Windows\System\dnmkMYe.exe
  C:\Windows\System\dnmkMYe.exe
  2⤵
  PID:9896
- C:\Windows\System\GGQPMyj.exe
  C:\Windows\System\GGQPMyj.exe
  2⤵
  PID:9912
- C:\Windows\System\XdXEeWb.exe
  C:\Windows\System\XdXEeWb.exe
  2⤵
  PID:9928
- C:\Windows\System\BAVliHY.exe
  C:\Windows\System\BAVliHY.exe
  2⤵
  PID:9944
- C:\Windows\System\PsvXztO.exe
  C:\Windows\System\PsvXztO.exe
  2⤵
  PID:9960
- C:\Windows\System\AwTAMPM.exe
  C:\Windows\System\AwTAMPM.exe
  2⤵
  PID:9976
- C:\Windows\System\WAQzFrB.exe
  C:\Windows\System\WAQzFrB.exe
  2⤵
  PID:9992
- C:\Windows\System\buLBLqz.exe
  C:\Windows\System\buLBLqz.exe
  2⤵
  PID:10008
- C:\Windows\System\zyOxuQI.exe
  C:\Windows\System\zyOxuQI.exe
  2⤵
  PID:10024
- C:\Windows\System\xvcbBpo.exe
  C:\Windows\System\xvcbBpo.exe
  2⤵
  PID:10040
- C:\Windows\System\nhLKavU.exe
  C:\Windows\System\nhLKavU.exe
  2⤵
  PID:10056
- C:\Windows\System\EZIQEfE.exe
  C:\Windows\System\EZIQEfE.exe
  2⤵
  PID:10072
- C:\Windows\System\JbmSDbG.exe
  C:\Windows\System\JbmSDbG.exe
  2⤵
  PID:10088
- C:\Windows\System\LCufsLn.exe
  C:\Windows\System\LCufsLn.exe
  2⤵
  PID:10108
- C:\Windows\System\MpWvYuG.exe
  C:\Windows\System\MpWvYuG.exe
  2⤵
  PID:10124
- C:\Windows\System\iaKDdRx.exe
  C:\Windows\System\iaKDdRx.exe
  2⤵
  PID:10140
- C:\Windows\System\joloLha.exe
  C:\Windows\System\joloLha.exe
  2⤵
  PID:10156
- C:\Windows\System\goqWMoi.exe
  C:\Windows\System\goqWMoi.exe
  2⤵
  PID:10172
- C:\Windows\System\vpRDzHh.exe
  C:\Windows\System\vpRDzHh.exe
  2⤵
  PID:10188
- C:\Windows\System\lzRGiXh.exe
  C:\Windows\System\lzRGiXh.exe
  2⤵
  PID:10204
- C:\Windows\System\UQBdOox.exe
  C:\Windows\System\UQBdOox.exe
  2⤵
  PID:10220
- C:\Windows\System\fSsAlmV.exe
  C:\Windows\System\fSsAlmV.exe
  2⤵
  PID:10236
- C:\Windows\System\rKdGpQt.exe
  C:\Windows\System\rKdGpQt.exe
  2⤵
  PID:8872
- C:\Windows\System\lvlYGBv.exe
  C:\Windows\System\lvlYGBv.exe
  2⤵
  PID:8824
- C:\Windows\System\flkqxZh.exe
  C:\Windows\System\flkqxZh.exe
  2⤵
  PID:9248
- C:\Windows\System\gowHUmx.exe
  C:\Windows\System\gowHUmx.exe
  2⤵
  PID:9260
- C:\Windows\System\SvQrMSK.exe
  C:\Windows\System\SvQrMSK.exe
  2⤵
  PID:9328
- C:\Windows\System\vverkZU.exe
  C:\Windows\System\vverkZU.exe
  2⤵
  PID:9368
- C:\Windows\System\eMrMIAO.exe
  C:\Windows\System\eMrMIAO.exe
  2⤵
  PID:9344
- C:\Windows\System\fbaTbWO.exe
  C:\Windows\System\fbaTbWO.exe
  2⤵
  PID:9432
- C:\Windows\System\pPDonlM.exe
  C:\Windows\System\pPDonlM.exe
  2⤵
  PID:9496
- C:\Windows\System\wxZzznx.exe
  C:\Windows\System\wxZzznx.exe
  2⤵
  PID:9564
- C:\Windows\System\kNzJvwY.exe
  C:\Windows\System\kNzJvwY.exe
  2⤵
  PID:9628
- C:\Windows\System\xnXcegt.exe
  C:\Windows\System\xnXcegt.exe
  2⤵
  PID:9692
- C:\Windows\System\wiytahC.exe
  C:\Windows\System\wiytahC.exe
  2⤵
  PID:9444
- C:\Windows\System\LpsaTcQ.exe
  C:\Windows\System\LpsaTcQ.exe
  2⤵
  PID:9544
- C:\Windows\System\HTAJAyb.exe
  C:\Windows\System\HTAJAyb.exe
  2⤵
  PID:9580
- C:\Windows\System\FrTjaGz.exe
  C:\Windows\System\FrTjaGz.exe
  2⤵
  PID:9792
- C:\Windows\System\PzWbfeo.exe
  C:\Windows\System\PzWbfeo.exe
  2⤵
  PID:9612
- C:\Windows\System\JbEwpHm.exe
  C:\Windows\System\JbEwpHm.exe
  2⤵
  PID:9856
- C:\Windows\System\DDsuKao.exe
  C:\Windows\System\DDsuKao.exe
  2⤵
  PID:9776
- C:\Windows\System\hBxUmwI.exe
  C:\Windows\System\hBxUmwI.exe
  2⤵
  PID:9708
- C:\Windows\System\ooHiAhO.exe
  C:\Windows\System\ooHiAhO.exe
  2⤵
  PID:9952
- C:\Windows\System\buaXaeh.exe
  C:\Windows\System\buaXaeh.exe
  2⤵
  PID:9988
- C:\Windows\System\ikEhvLT.exe
  C:\Windows\System\ikEhvLT.exe
  2⤵
  PID:10048
- C:\Windows\System\qTlpVHC.exe
  C:\Windows\System\qTlpVHC.exe
  2⤵
  PID:9712
- C:\Windows\System\IowpBlW.exe
  C:\Windows\System\IowpBlW.exe
  2⤵
  PID:10148
- C:\Windows\System\SzYiewk.exe
  C:\Windows\System\SzYiewk.exe
  2⤵
  PID:9908
- C:\Windows\System\ovzPcdQ.exe
  C:\Windows\System\ovzPcdQ.exe
  2⤵
  PID:9904
- C:\Windows\System\qglyVaH.exe
  C:\Windows\System\qglyVaH.exe
  2⤵
  PID:10104
- C:\Windows\System\vXPIXKj.exe
  C:\Windows\System\vXPIXKj.exe
  2⤵
  PID:10004
- C:\Windows\System\qCvZDUb.exe
  C:\Windows\System\qCvZDUb.exe
  2⤵
  PID:10132
- C:\Windows\System\gmtRcYr.exe
  C:\Windows\System\gmtRcYr.exe
  2⤵
  PID:10184
- C:\Windows\System\auusKBc.exe
  C:\Windows\System\auusKBc.exe
  2⤵
  PID:9284
- C:\Windows\System\ZFEllDv.exe
  C:\Windows\System\ZFEllDv.exe
  2⤵
  PID:9312
- C:\Windows\System\yMuCmmN.exe
  C:\Windows\System\yMuCmmN.exe
  2⤵
  PID:8908
- C:\Windows\System\GUkHIKi.exe
  C:\Windows\System\GUkHIKi.exe
  2⤵
  PID:9364
- C:\Windows\System\PUimRGb.exe
  C:\Windows\System\PUimRGb.exe
  2⤵
  PID:9532
- C:\Windows\System\mxtYSuX.exe
  C:\Windows\System\mxtYSuX.exe
  2⤵
  PID:9492
- C:\Windows\System\wLbKNGR.exe
  C:\Windows\System\wLbKNGR.exe
  2⤵
  PID:9624
- C:\Windows\System\aouqvfy.exe
  C:\Windows\System\aouqvfy.exe
  2⤵
  PID:9416
- C:\Windows\System\zRnbBro.exe
  C:\Windows\System\zRnbBro.exe
  2⤵
  PID:9728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FNCRrrw.exe

Filesize
1.9MB

MD5
876289a87471021ca442dee7d71aaf44

SHA1
7279a90b0dba9b35fae3a8250ebfe22cfb240d28

SHA256
81fc913a49be9016466f43a54030434573d415d3b99da18e86aac70a1576cdd3

SHA512
09d59165efe81c3bbda95c3d37c3968999d30a8de3f58d9f836568b7120b78e6b64b3854c8ca40f8bed621c814d1a39b0216ec5e7b05d9ecd513b281755cac75

Download Submit
C:\Windows\system\ISnaeXy.exe

Filesize
1.9MB

MD5
443c5418f573549676ecc3be0f9f4492

SHA1
e97ba8c63dbd0c0c1a03dfe6ab774e2e8bc56b86

SHA256
5de575f25f0fcbb07bb014f4050982c876e3a24c373fe8c31b757c68465cd8e5

SHA512
583311b832103b7e9183ab4d21898b1429ebd236f225f057b19ae390dc9240ae4ab3ac4d7be569d7db55418a9d00c1be29ec8ef7780503c8cf5474532ca151f7

Download Submit
C:\Windows\system\JdRsfcm.exe

Filesize
1.9MB

MD5
c46ec91af02b5ffe970ba254c9e00f00

SHA1
b9f132d6c71fd6e999124d9636628c1d35400583

SHA256
ea020246de144e7f77abe9cae5b8da03c1d4ebd78dfa57218a5dadbbab1d6c85

SHA512
a951062f6b17413f5b16308a22de298bc0287629a2cda16989f29db957c4eea494c8206ea4d4d6ff7124944e3a44e4f9c7b51c17dc0578c70b2af24a6d254580

Download Submit
C:\Windows\system\JeEOfUu.exe

Filesize
1.9MB

MD5
0575501dcadac9ab66ad28d291eff09c

SHA1
b80389f2b5b527070e0544a52342eae29e160db0

SHA256
90ca9758d2b63afee9c6ee1b1991ddcce2de5da4988cbb9b946eedecab0b884d

SHA512
c387c0fd66d5f99d18e13da9397a6adbe93c2ff98983838f3df90ea489cf1704a5effa2dc2f89968fae13dcc4f932e041b89f19a163c918218fcc5e6f3d36f91

Download Submit
C:\Windows\system\ONYawak.exe

Filesize
1.9MB

MD5
12bcabb2832d42143ff35ecf42c09c98

SHA1
a1151f2ae1bc287ee354e156db46bcd3117ec906

SHA256
342f4d265f24082280c7a9c5a0a6da0c1a087d9b0c49f2d81a594722d95a2bc4

SHA512
c5437ebc84a578acecabdc20d60a911ca4504b6e44e288ba787657fea10bfb1476f3528c5cc94c12f9ca04e1d664a4b2baf6ea47399c9c678c24d59f29f9b7e6

Download Submit
C:\Windows\system\RiPPmxD.exe

Filesize
1.9MB

MD5
fd99c74e5dee2742dbdc68d4b84ff008

SHA1
0f4a26f78028ce34a7bb9da862752e11aae747aa

SHA256
7ece1046b3c045d3acb9071e4abfb7f7b0aa5c2d1ddce2b74910638461e6d714

SHA512
e43ecd8b8d0667879ee9ab13fbf27a9fff4accc005bee61cda2905e1aca480c8552e09a8fd238ada219d233daec3167df62448c9b8cd353f9e9c075947e62553

Download Submit
C:\Windows\system\UsHSwiG.exe

Filesize
1.9MB

MD5
6e1fac38f112a8221672a5535bffea01

SHA1
a60dcc1ce84b60984217da4653c3e278e340043f

SHA256
e1e0dbd307c7123bcd5a62d42d3e24e7cc28ceeafc88fac6c6fe07e24bb4b928

SHA512
a69678c50eba96bcda792b69e26fe735d3149e01e77b28e6d20cb767af43e321a5540f5764e484e2d65e1680bf341f970d178f744ab9cbdc97a94c3407e36e69

Download Submit
C:\Windows\system\WHYGoAD.exe

Filesize
1.9MB

MD5
127ad0e63088caf3c0a79a58ca57b74b

SHA1
7d2c003d442df1394808c89b47aeaa992fbe3201

SHA256
9a49bb63f85c46bc9b0d0a3c6f8b0f6e3c97701eaecc3cce7f1ebf5fdfadd270

SHA512
98f0971119414b8be1871fd454e69916c1cdaf2afde517dbf8b8571d7ebcfa14739aa4e21c21af94a4801c62aa3543d7ba40fa0ad8e951da6c6b5535269cd90f

Download Submit
C:\Windows\system\WQIjxbE.exe

Filesize
1.9MB

MD5
3990f6c3bdc1c1690c00ba7de8932aed

SHA1
360a673a0b1d0d2c8b5b6bf27e5c3a8600df59bc

SHA256
cacf70bdd86ccb915e4fd39b7cc32a9b72da5913d64a23ccf68109808861cacb

SHA512
069af8cf8cad2ef3278dafb5f17d349e4bd11803ed77dba4d391773299c58391793b3e988d1039d377210ab009c90eaaf8c0bb9cb62af82ee2cc13aabd8e352b

Download Submit
C:\Windows\system\YXFCQhe.exe

Filesize
1.9MB

MD5
8e3963c58068852f220086c81e4df243

SHA1
bf83fd188bceadfd4681125734b12b3449a3fa59

SHA256
9980e32486d764817916178451620eb757201fdbee4158541ae947d9a21a5c35

SHA512
ee4d8433b4ef38dcdc2ff367c44a680d5d86dd758f6f319888f5ae01047f32e8cfb0f90555364b1207e14fc46d97d5ff36053bd6551f30cfffebb628e4d2cc51

Download Submit
C:\Windows\system\ZRtZFhZ.exe

Filesize
1.9MB

MD5
833fe735b85afdfac87ce845bea3a051

SHA1
93b4e8b4e961609241f87e4d755c948f07a5017b

SHA256
9e6e541ec834cfaee77f499db1dc10c8a51b7101ad166c19d8979b6bdbb2c4e7

SHA512
64e07a87fe2bd2e2da3b3060c8ddab1a49d76166c222dcb0d3fa21b3f437410a241ea8f49dc5aa6fdeea389dfbefd1756696a229b82fdc35e0529be93a9785a8

Download Submit
C:\Windows\system\eOXnyoC.exe

Filesize
1.9MB

MD5
f210e52c3a9ee8800071cab694937fe8

SHA1
757df0d4b27854d75c817f0a6a20f5abe88efe24

SHA256
ae2e6cad629148285c0ce0771240318f82c3e417fb55bb9f2d492ce0b2fc209f

SHA512
73b256145a7aa0b6ba0400d055ed52fdc0f787dfdd2b741f8a2528a18dce9cde1eb7a4f971604bb4edaba361e6b107d8e58d13904cffc49496b9d202b227b476

Download Submit
C:\Windows\system\empAkAc.exe

Filesize
1.9MB

MD5
dccd5ca420c3b49461223d1ffee54466

SHA1
df6a890422d847dcbd460c6c1d59103a469bfc29

SHA256
f438c25839cea4a105ac428747815ad6e702a675471696e4de7dc5d306f430fc

SHA512
f2c5a91400f1a4aae33a48a80b534cf36c849e9b1c300f223376f9407156eb71a90fec8bcd753bfc6c07bb1a96b77609ff22f7ea4f4f1a1d0dd99c650d64ab3e

Download Submit
C:\Windows\system\fkgoUIp.exe

Filesize
1.9MB

MD5
1b8acd6ec34010c03f28e8000f59ac30

SHA1
add45d7b330e25710841b0ebaa0b30b23251b2ec

SHA256
5fab7b0609d561d41aab9c8810567538d986459247e340abb7adabe56a62d6e6

SHA512
b68f4dd44a29bdf17ff5eb3f76cf49fcd4baefb5fbf6c6464d91ab76a3277f4ccce8d5f6e828eda74079224b38f4f5fe2a50d80b26cdd3eab13282b20b28f31c

Download Submit
C:\Windows\system\jvkYSoQ.exe

Filesize
1.9MB

MD5
a81a1bbdfb2a9a106be07635133c8942

SHA1
091f012355d5016cb08d95b062cbfbb387e94027

SHA256
a0c916bb0f4591701dadc39ed33a5000c3f68bb7538edd7c89ac0d13de8c9bdf

SHA512
c27dae19b9121efba41c32e09a9a49457ad678c363f2d93e40344c917a46e7734b938cd0fe0e633f37911ffeb88838572e034f3b61357f8a0c4b4028c42b847f

Download Submit
C:\Windows\system\nRDpWtQ.exe

Filesize
1.9MB

MD5
ee472da6462d268afd5e623a8c3f2c8a

SHA1
8dde439fc1eb55707b3ec6696f652d55b145fa85

SHA256
0450156fc09d6dfdbeb97036814dbf12e3c70f5134818c40135c0bf9d780375d

SHA512
3a5e722f58ecb618cc3ea38dd88897be50b0d160b07ac9c3910c955f534e76bf9f8ceb266a36c8c43610224326ce64ee1ce89f3b20f0ed42610a1e0bf24974bf

Download Submit
C:\Windows\system\nYahJtk.exe

Filesize
1.9MB

MD5
9e7b150d4d70a5dd646e7a4a87db71d2

SHA1
1df9966c1ccfbba5f630ece8dc75a7bc33fcd92b

SHA256
2c21e78475d3145290daafea01ad133ccf096c84ff4de3e93c4f5917e4925498

SHA512
841827738c9a5760d2ea11e51e30cde8078f5c4b194b2608613b0a90bf16b43e279240be583384892f0d994f0813ea70825cd38dda5e452558aeb9ccbcfb9e5e

Download Submit
C:\Windows\system\qZvtDLt.exe

Filesize
1.9MB

MD5
6eba5234c4db29a7b26040d8bc3e30cb

SHA1
48acae65a474b82281226b95ef2092a89caa21e2

SHA256
03f63cb27ad64b48b4f60ee03d57097d67e706f5164f912fec8c6426b9956d92

SHA512
4c29aaeb547c42545a9cd63a204e26fbf8f690d78c3530b6a0e60bb198ee262b80ecd5f810bdbd8576d6ca2a09bb1620f7cd060ab92f00eba54cf6a9036c2e1c

Download Submit
C:\Windows\system\uredaTe.exe

Filesize
1.9MB

MD5
c1d577b5a77aa2ff63242dd7cfbbea2d

SHA1
928342b2622eb2b55e3984e8d016b3c278fb20cd

SHA256
b1df859879bec8a49f774c5e9e2e60e4bc91e873b6b465d362f6dd2023bcc1a2

SHA512
3713bf451124559c5883c711e0bce591fe540b14cd2cdea1bcfc8511211268a37e287269bfff222dbb99526dbd642dae97bac1b4af7ae8e465162a55c605465e

Download Submit
C:\Windows\system\wwypXdy.exe

Filesize
1.9MB

MD5
0086ffd1ae42a3f2f9235b3e44640e6b

SHA1
8f73d0a78c0cf3521211a782db9274718c2aaefd

SHA256
5ad3dc75901b3ffcd62bc1a0aaa785713e148745f10cc876a358e54cd018d0f3

SHA512
231eef51af1c6238b5e8ab111771465cc1198f81b14b700414d3660825b8593f8000cba0d7478b710c6829ed59d239cbb00fedf309268158226a530cab4a927d

Download Submit
C:\Windows\system\xEyvdOE.exe

Filesize
1.9MB

MD5
f7b90f7dea6b812d2ba2428676e7f4d5

SHA1
100b4c4aa065dacd546e37e6d9a2f96cabea34ad

SHA256
daf0a8a7915f971db8a4304b5d1e9f5919cbc5972639eb3ffd1cb8b0e0ebec0a

SHA512
faaa5a0b717e71cd34b0e41f0816bc9a8979f1e4795bee90ea8d5ace72d01afeb27f13d66942d6134ac73728da9338f4fec8809a344dbee7b03efa1f23683cc1

Download Submit
C:\Windows\system\ztiKekW.exe

Filesize
1.9MB

MD5
8aa8d01423223bcbcd419fd1dcafbb92

SHA1
5332cbef0fbe899ae957e41a6eba8e498dcbecb5

SHA256
3b52b51fe246bbc797bf478a79c05354b9150ebf82c4bbd7e83d440b3e1c93b8

SHA512
c8078a093c092da47454d023986cb8247acd9c2feb5840a8a5a2e5f0eae0196ad32210fc35ed64b23da391f1203632546049249492e3ca70709c42ef4b62fd69

Download Submit
\Windows\system\BvCNnfd.exe

Filesize
1.9MB

MD5
2cb212a98cbc325d89cb96ea5dc3ecc5

SHA1
bcfa0057140dd0d82a9f647194aa71f5f8b7926f

SHA256
84fe4873ae519bbd55eec08fc332ce9fb0a91d7e632485e993537d34b5410980

SHA512
ba8d11a0ac8346471dcb415c8085a60e156c114439d4c899cda6eb7f88af7cdb5159fb9f578f7f5c2d7bcb92ca0eb1d4bfab19d67dc1a4c765c1979533e58d93

Download Submit
\Windows\system\CZvhGtY.exe

Filesize
1.9MB

MD5
31bc75e0edb215c09b12417a5e67ce51

SHA1
4c72958e08e63acb12494db2d35b20cce1f368e8

SHA256
860ce184251f1accc6f930b54faa516cc2306d53e7ff2bdf705bcd54d9d1f452

SHA512
8ec002ae1344982ecb524738a09e2650e0b9a8ac912f8a68ef49a06305a0db815a297f6e0ab66ec988e47a3026b4a3e192cc914e1dbe7db4ef86561a2585bda8

Download Submit
\Windows\system\CdRbwTe.exe

Filesize
1.9MB

MD5
e9b20ffe4f17583df2aa4b3381099798

SHA1
95121e314704844ecf10a76b245f48cad63ca92f

SHA256
83d1bcb4fe8e40618e75072779959bd230b0a0097d82333e6d71d7f368bfa645

SHA512
70b21df9678b9ab36191d520ca2049e8b8c1bef9427242fbcba5ea32a659b6a57992412276096480f6f7d29d8fa45aac1addf4c21794dec20d2eba684c5e0acd

Download Submit
\Windows\system\FcWwhPj.exe

Filesize
1.9MB

MD5
af68a4f63fe6dd951d99fa4f74e0244a

SHA1
d9751001117df3296a296c71143bbf2e1a03b190

SHA256
6840a85b92793fb7cb2b63b849d3bed80635528eeaea00b733436ae7515e5041

SHA512
71d2afecd340d290f4bb48d9377c0659779c4977ebb77bfedd10940ce22330b75717609d8ff22ae29f92293128ee03c1ec1af7b4cd6275207f864684547ce49e

Download Submit
\Windows\system\MCaaScQ.exe

Filesize
1.9MB

MD5
26f92447a8ff8f7cd137db04882eed6c

SHA1
716e7a690f4e7dee4e3aac8f0b301ef1c71180ac

SHA256
329a124aacfea3bc1c7be2412b00a777fd3d7ef7c2e4b879a226c3d7997ab9bc

SHA512
bec8dfb2a527d5ed258dbfc601a6b5410497ab80443d7fa4ab2af581d3df368a3020e6673c4b5d91382930376b5c39918fa972af113f5e2464e0478976d05753

Download Submit
\Windows\system\VEiZRtC.exe

Filesize
1.9MB

MD5
df3552f300659545f09187ff1b9d7d3a

SHA1
c8da8eb63d37ee4a565ed360a11abbd667937c3c

SHA256
7ab07d0b0b80f3a7a55006b0fd0876def0032aa2ae809a8ec8b5f49042afe23d

SHA512
6be8123297384e63207ed3c5dce6b73e05deee0b6f858080372152547bf9584d77925719edbb841cf833d9c0570ac311042267ad0212b22d325ca018fc72c3ad

Download Submit
\Windows\system\XKpjWjV.exe

Filesize
1.9MB

MD5
7b25a96036b066424dae8de5b3581b9a

SHA1
57b0b8bf39dc209e980e2abd7f68d9727f20a0fb

SHA256
9244a9da6dfcc943c603320ea0cff5b3c57163bc80b6352dfe2434a1a3c24d7c

SHA512
135f110139a5cbe30471a90fd9c10f7ae35b9088774701543eabce64412dd79d0f84a6863cf5b07363d2face075b8ae3ef2c8557338a98b842f45219e08df8e9

Download Submit
\Windows\system\ZnkgGHz.exe

Filesize
1.9MB

MD5
235bfdfe99f709fbae035529531eee29

SHA1
7128a958281a063097195f426e3d9b3e213b4f89

SHA256
29bd84687b4d6e9f89ebbe3a6f69fcf26c0f16290f129d26d2513bd81cf3d3bc

SHA512
580ef977e0b6c423a95b65bae3e2c3db38cabae4ef6c8d5d49350d9297b59f6ad831806ce036ae3d6d67be7bcce756a6e01afa274fc407cd17b49c7ac1b1d9dc

Download Submit
\Windows\system\bwoxEoK.exe

Filesize
1.9MB

MD5
34dbf5c32392381f1be2143763e2c878

SHA1
2d8d445599fc250a2885180f139f44d1f1a0febd

SHA256
b67e1da966e5b86a8f81fa38ffdc025c4285ced2bf44673d0866ea2be971dd25

SHA512
e2fe7ea395db7279c18432c8c942be322417a0bf5a8b22f24e77b2b4c3df347d7e20ee89ee090504b05a92b7302f3de4feea78d7e9c93a29e649655255930d80

Download Submit
\Windows\system\ecJrKgg.exe

Filesize
1.9MB

MD5
53238a3eb343bb0b377b07cb36de17fb

SHA1
f1a7fc15cb48e5f62cb19da003a9539bba2fb941

SHA256
5cfa9352410043123fa7680e4cb87123614508a617abbbd3ac98e19e4fb807b9

SHA512
84bedc5fd470e7339af85932fb7c79b63184afeb134aba64cafecc7647263350d25b4bd036c86148f438b0db15283664ccfcda95a986b82aa49f114065cb6c81

Download Submit
\Windows\system\gnvuxvB.exe

Filesize
1.9MB

MD5
86264656c1fc85521f48c81fa9066db6

SHA1
8ae548805f5a03d94fa315f11b30dfb554eaf644

SHA256
c7c63a07f25f9016f8e9b1b171e195c3ab4144f27f0ef1fe060140a9bdcf66ef

SHA512
d49b9e836111fa994377f7241d0e9075a5404632126cd2bf0c0f1cc296650020bf67ecb9c01fcd9f0c2905a7bd8749e0710333d3890144ee77715604cfc57da5

Download Submit
\Windows\system\jIdkGwr.exe

Filesize
1.9MB

MD5
a9061734ccfdbc9bec5195278eade2bc

SHA1
992497d9d9ade5bfc3799e329822973ee564cd15

SHA256
fc443e4c56423ec167251e766ca347512f67d39f5038cd015f92e97e3c25ab2b

SHA512
46ec200abe55141eb9de0aef66af4610b6c3b0d6e730db055c1edcd9590d7324cd80b5c42b918570dd4227cb5c65037ae469a5adf377f1bb2f0b49f8623debd4

Download Submit
\Windows\system\lxAISqF.exe

Filesize
1.9MB

MD5
9415789869870f02ec3156b54c848e5a

SHA1
ea31038a5527a6ada5696d220759dfd4667f057a

SHA256
56934af232f9f9c1726fec22f508e6d2b09d4518a19db19d4750f35416fd7112

SHA512
b24b6fe809198a7e80594de811f9d6c3c99efadc18b1293bdb10d210434bcd233b6868741f839e47dff460501fe52e23b1db632d1b646151931229b48682d457

Download Submit
\Windows\system\qshIEsV.exe

Filesize
1.9MB

MD5
562141841f299deb61491437b785ab77

SHA1
81881b1cd39247197ddd14c3c25aa3f8b173dfe7

SHA256
efefc6d9252a3ea57498bd562c04985ad749ec621463fda3e85647b56d1196a8

SHA512
f85cf6d1595abb5a04f1668daf59583fed8e5aa708334eaf492b00b977f4580084daef4052134fed73904776d4907368a48fd1e2769158c296e572c5ccaa7a2f

Download Submit
memory/1616-80-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1828-307-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/1828-306-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2028-74-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-66-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2028-59-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2028-73-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2028-51-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2028-71-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-49-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2028-68-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-67-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-9-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2028-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2028-0-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-89-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2288-102-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-97-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-76-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-52-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2616-95-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-72-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2688-75-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2716-57-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-70-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-69-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download